spike: `when` conditional-scoping feasibility evidence (throwaway, not for merge) by timotheeguerin · Pull Request #32 · timotheeguerin/typespec

timotheeguerin · 2026-09-01T16:16:32Z

Not for merge. Parking the throwaway spike evidence somewhere reviewable, since the decisions in microsoft#11806 and microsoft#10551 rest on it.

The brief for microsoft#10551 was explicitly: don't ship partial when support and then discover the only real solution is full conditional compilation. So the structural questions were spiked before Phase 1 was written.

`spike/FINDINGS-declaration-symbols.md`

Can a when-conditioned declaration be one symbol that is present-or-absent per scope, instead of competing definitions?

Two structurally different Widgets: no. The surprise is where it fails. The IDE is fine — merging same-named models the way mergeNamespaceDeclarations merges namespaces gives correct goto-def, find-references, and atomic rename. The checker dies: a symbol has exactly one declaredType slot, so declarations[1..n] are never turned into types. No diagnostic, wrong type graph, and a coherent-looking IDE masking it.

The "variants must be adjacent in the same file" restriction was tested directly and buys nothing structural.

Present-or-absent gating: qualified yes. Zero checker changes — @typespec/versioning is the existence proof (a $onValidate pass, no createChecker anywhere in it). Absence propagation is a monotone-decreasing fixpoint, so it terminates and is cycle-safe.

`spike/scope-algebra.ts` + `spike/FINDINGS-cross-scope-validation.md`

Runnable prototype (node spike/scope-algebra.ts) generalising versioning's availability check to K orthogonal dimensions as set containment. O(references × dimensions) for single-conjunction predicates, no Cartesian materialisation.

The correction that matters

Both spikes independently landed on the same premise error: versioning enumerates, it does not reason symbolically. getAvailabilityMap loops for (const ver of allVersions) and compares pointwise. That works because versions are a closed declared enum. Scope atoms are an open universe — unscoped must mean all scopes including emitters that don't exist yet — so enumeration cannot transfer and a symbolic <future-emitter> witness is required. "Just copy versioning" would have been unsound.

Drive-by

The prototype also demonstrates a real bug in shipping @typespec/versioning: validateAvailabilityForRef is a boundary-event check, so a source merely available while its target has been removed produces no diagnostic. Filed separately.

…icrosoft#11221) Fixes microsoft#11141 Auto-generate a reference documentation page per **linter rule** and per **diagnostic** with `tspd`, so these pages stop being hand-written and drift-prone. > [!NOTE] > This PR is scoped to the `tspd` documentation generation. The `referenceDocs.baseUrl` url auto-generation and the language server hover that surfaces these docs at a reported error are split into a follow-up PR. ## Compiler - **`docs` field on diagnostics and linter rules.** Both `createRule` and diagnostic definitions accept a `docs` field for extended documentation: ```ts export const myRule = createRule({ name: "my-rule", severity: "warning", description: "Short description.", docs: fileRef.fromPackageRoot("src/rules/my-rule.md"), messages: { /* ... */ }, }); ``` The value is `string | FileRef`: either inline markdown, or a `FileRef` created via `fileRef.fromPackageRoot("...")`. A `FileRef` is a plain `{ kind, path }` data object read **lazily** by tooling, so it is safe to include in code bundled for the browser (e.g. the playground). Because the docs live on the definition, they are available at compile time, not just to `tspd`. ## tspd `tspd doc` now renders: - one page per rule -> `reference/rules/<name>.md` - one page per diagnostic -> `reference/diagnostics/<code>.md` (each shows its severity) - a `documentation-missing` warning for every rule/diagnostic without `docs`. ## Pilots Content is faithfully migrated from the hand-written pages, which are then deleted: - **`@typespec/http`** — the `op-reference-container-route` rule. - **`@typespec/openapi3`** — 6 diagnostics (`path-query`, `duplicate-header`, `inline-cycle`, `invalid-schema`, `invalid-server-variable`, `union-null`); the old hand-written `emitters/openapi3/diagnostics.md` is replaced by the generated pages under `reference/diagnostics/`. ## Validation - Built `compiler`, `tspd`, `http`, `openapi3`; regen is stable (running it twice produces no diff). - `lint` green for the touched packages; the `op-reference-container-route` rule tests pass. --------- Co-authored-by: tadelesh <chenjieshi@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

) The OpenAPI `License` object supports an `identifier` field (SPDX expression) since spec v3.1, but TypeSpec's `@info` decorator was missing it — causing a spurious "unknown prop" warning. ## Changes ### `@typespec/openapi` - Added `identifier?: string` to the `License` model and TypeScript interfaces - Added `license-url-identifier-conflict` diagnostic: `url` and `identifier` are mutually exclusive (per spec); both being set is now a compile-time error - Validation enforced in the `$info` decorator ### `@typespec/openapi3` — Emitter - **OpenAPI 3.1 / 3.2**: `identifier` emits as the native `identifier` field - **OpenAPI 3.0**: `identifier` is emitted as the `x-oai-license-identifier` extension ### `@typespec/openapi3` — Converter (OpenAPI → TypeSpec) - `identifier` in 3.1 documents maps directly to `identifier` - `x-oai-license-identifier` in 3.0 documents is promoted to `identifier` ## Example ```typespec @info(#{ license: #{ name: "MIT", identifier: "MIT" }, }) namespace MyService; ``` Emits for OpenAPI 3.1: ```json "license": { "name": "MIT", "identifier": "MIT" } ``` Emits for OpenAPI 3.0: ```json "license": { "name": "MIT", "x-oai-license-identifier": "MIT" } ``` closes microsoft#11302 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: baywet <7905502+baywet@users.noreply.github.com> Co-authored-by: Vincent Biret <vibiret@microsoft.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…11297) This updates dependency resolution to enforce `sigstore@4.1.1`, addressing vulnerability exposure from earlier transitive versions. The lockfile is refreshed so installs consistently resolve to the pinned version. - **Dependency resolution hardening** - Added a workspace-level pnpm override for `sigstore` in `pnpm-workspace.yaml`. - Ensures all transitive resolution paths converge on `4.1.1`. - **Deterministic install output** - Regenerated `pnpm-lock.yaml` to apply the override in resolved package graph. - Removed prior lockfile resolution paths that pulled older `sigstore` versions. ```yaml # pnpm-workspace.yaml overrides: sigstore: 4.1.1 ``` --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: timotheeguerin <1031227+timotheeguerin@users.noreply.github.com> Co-authored-by: Timothee Guerin <tiguerin@microsoft.com> Co-authored-by: Mike Harder <mharder@microsoft.com>

fixes microsoft#6870 --------- Co-authored-by: iscai-msft <isabellavcai@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…microsoft#11303) Extracts the self-contained `tsp init` template-loading refactor out of microsoft#11299 into its own PR. ## What Replaces `getExecutionRoot()`-based template resolution in `tsp init` with a first-class `TemplateSource` abstraction, with three implementations behind one interface: - **`FileSystemTemplateSource`** — the default (installed/`node`) path; reads `templates/` from the compiler package root. No `getExecutionRoot()` dependency. - **`InMemoryTemplateSource`** — serves the index and every template file from an in-memory map (used by the standalone single-executable to serve templates offline). - **`RemoteTemplateSource`** — `--templates-url`; keeps the untrusted-source confirmation and relative-file resolution. ## Why Template loading previously went through the `CompilerHost` filesystem contract anchored at `getExecutionRoot()`, which also serves the stdlib. Serving templates from an embedded/offline source required masquerading an in-memory map as a real filesystem and overloading `getExecutionRoot()`. This refactor decouples template resolution from the host FS contract so each context supplies its own source, and leaves `getExecutionRoot()` solely for the stdlib. ## Notes - No behavior change on the normal path: `init` defaults to `FileSystemTemplateSource`. - Language server (`getTypeSpecCoreTemplates` / `scaffoldNewProject`) and the VS Code extension keep working; the extension threads a `TemplateSource` through `create-tsp-project`. - Backward-compatible: `serverlib.ts` / `server/types.ts` are unchanged. - This is the first of a split of microsoft#11299; the standalone single-executable feature remains in microsoft#11299 and builds on top of this.

…osoft#11312) ## Summary Removes the unused `backupPath` fallback argument from the internal `runScript` helper (`packages/compiler/src/runner.ts`) and its two callers. `runScript(relativePath, backupPath)` used to fall back to `backupPath` when `relativePath` did not exist under the resolved package root. Both call sites (`cmd/tsp.js`, `cmd/tsp-server.js`) always pass a `relativePath` that exists, so the fallback (and its `checkFileExists` helper + `access` import) is dead code. This is a pure, self-contained cleanup extracted out of microsoft#11299 (standalone SEA rewrite) so that PR stays focused on the feature. The standalone CLI does not use `runScript`. ## History / why it is safe to remove The `backupPath` fallback was added in microsoft#1410 and shipped in `@cadl-lang/compiler` **0.38.2** (Dec 2022) as a patch: _"Revert breaking change to global cli usage."_ That PR introduced the stable indirection entrypoints `entrypoints/cli.js` and `entrypoints/server.js`. Before 0.38.2 the global CLI booted the compiler directly at `dist/core/cli/cli.js` (and `dist/server/server.js`). Because a **globally-installed** CLI resolves and runs the **locally-installed** compiler, a global 0.38.2 CLI could hit an older local compiler that did not yet have the `entrypoints/` files. The `backupPath` (`dist/core/cli/cli.js` / `dist/server/server.js`) was the fallback so the global CLI could still boot those pre-0.38.2 local installs. Every supported compiler version has shipped `entrypoints/cli.js` / `entrypoints/server.js` since 0.38.2, so the fallback branch is now unreachable dead code. ## Changes - `runner.ts`: `runScript(relativePath)` — dropped `backupPath` param, `checkFileExists`, and the now-unused `access` import. - `cmd/tsp.js` / `cmd/tsp-server.js`: drop the second argument. ## Validation - `tsc -p packages/compiler/tsconfig.build.json` passes.

…ation (microsoft#11316) ## Summary Adds a `--rules-dir` option (and matching `rulesDir` API option) to `tspd doc` to control the directory where the per-rule reference pages are written. Since the tspd change that auto-generates one reference page per linter rule, those pages are always emitted under `<output-dir>/rules/`. Some consumers (e.g. `typespec-azure`) generate their reference docs into a `reference/` output dir but want the rule pages to keep their historical location one level up (`libraries/<lib>/rules/<name>`), so that existing rule URLs stay stable. This adds a small, backwards-compatible knob to control that location. ## Details - New CLI flag `--rules-dir <dir>` on `tspd doc`. - New `rulesDir` option on `GenerateLibraryDocsOptions` and `RenderToStarlightMarkdownOptions`. - Defaults to `"rules"` (relative to `--output-dir`) — **no change** to existing behavior. - Can be set to a path that escapes the output dir (e.g. `"../rules"`) to place rule pages outside the generated reference folder. - The `StarlightRenderer.linterRuleLink` (used by `linter.md`) honors the configured dir so cross-links resolve correctly. ## Example ```bash # default (unchanged): pages at <output-dir>/rules/<name>.md tspd doc . --enable-experimental --output-dir ./reference # keep rule pages outside the reference folder: <output-dir>/../rules/<name>.md tspd doc . --enable-experimental --output-dir ./reference --rules-dir ../rules ```

…pat (microsoft#11315) The underscore back-compat pass restores previously-shipped underscore names (e.g. `Tls1_0`) when the current spec normalizes them (e.g. `Tls10`). For extensible enums whose custom code re-adds the underscore member, the restoration renamed the *generated* member back to the underscore form — colliding with the custom member and removing the generated symbol it referenced. Example custom code that broke: ```csharp public partial struct ServiceBusMinimumTlsVersion { // references the generated `Tls10`; back-compat renamed it to `Tls1_0`, // producing a duplicate and dropping `Tls10` public static ServiceBusMinimumTlsVersion Tls1_0 { get; } = Tls10; } ``` ## Changes - **`EnumProvider.GetBackCompatibleName`**: new optional `customMemberNames` argument; skips the underscore restoration when the restored name already exists in custom code, keeping the generated name. - **`ExtensibleEnumProvider.BuildEnumValues`**: collects custom member names from `CustomCodeView.Properties` (case-insensitive) and threads them through. Uses `CustomCodeView` rather than `CanonicalView` to avoid the `CanonicalView → Properties → EnumValues → BuildEnumValues` recursion cycle; it contributes the same custom members. - **Tests**: adds `BackCompat_ExtensibleEnumCustomCodeTakesPrecedenceOverPreservedUnderscores` with `(Custom)`/`(Last)` TestData; existing `BackCompat_ExtensibleEnumUnderscoresPreserved` remains as the no-custom-code case. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jorgerangel-msft <102122018+jorgerangel-msft@users.noreply.github.com>

…t#11320) ## Problem The tspd change that auto-generates one reference page per linter rule (microsoft#11221) moved the `@typespec/http` linter rule page from its historical location: - **Before:** `https://typespec.io/docs/libraries/http/rules/op-reference-container-route` - **After:** `https://typespec.io/docs/libraries/http/reference/rules/op-reference-container-route` This is a breaking change to the public documentation URL. The rule's own `url` field, external links, and the diagnostic "see documentation" link all still point at the historical `libraries/http/rules/<name>` location, which now 404s. ## Fix Use the `--rules-dir ../rules` option (added in microsoft#11316) in http's `regen-docs` script so the per-rule reference pages are written back to `libraries/http/rules/<name>`, restoring the original URL. - `packages/http/package.json` — add `--rules-dir ../rules` to `regen-docs`. - Regenerated docs: the rule page moves back to `libraries/http/rules/op-reference-container-route.md` (100% rename) and `linter.md` links back to `../rules/...`. - `current-sidebar.ts` — re-enable the http "Rules" sidebar group (`hasLinterRules: true`), which autogenerates from `libraries/http/rules`. `@typespec/http` is the only library in this repo that ships linter rules, so no other library is affected. ## Validation - `regen-docs` is stable (running it twice produces no diff). - The restored page URL `libraries/http/rules/op-reference-container-route` matches the rule's hardcoded `url` again. - `chronus verify` passes. Co-authored-by: tadelesh <chenjieshi@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

) ## Summary Adds XML serialization support to the `@typespec/http-client-java` generator (azure-core v1 flavor). When any model is serialized/deserialized as XML, the generator now: 1. **Emits two helper classes** into the implementation package — `XmlSerializer` (an `ObjectSerializer` backed by `azure-xml` + reflective `fromXml(XmlReader)`) and `XmlSerializerProviders` (factory). Emission is gated on `isAzureV1()` and any generating model with `ClientModel::isUsedInXml`. 2. **Uses the XML serializer overload** in generated convenience methods — a static `SERIALIZER` field is declared on sync/async convenience clients, and `BinaryData.fromObject(input, SERIALIZER)` / `toObject(X.class, SERIALIZER)` are emitted when the request/response content type is XML. The azure-v2 / clientcore flavor handles `XmlSerializable` natively and is unaffected. Non-XML output is unchanged. ## Changes - **Generator core**: new resource templates `XmlSerializer.java` / `XmlSerializerProviders.java`; XML-aware `SupportedMimeType` handling in `ConvenienceMethodTemplateBase`, `ConvenienceSyncMethodTemplate`, `ConvenienceAsyncMethodTemplate`; static `SERIALIZER` field in `ServiceSyncClientTemplate` / `ServiceAsyncClientTemplate`; constants in `ClientModelUtil`. - **Generator plugin**: `TypeSpecPlugin.writeHelperClasses` emits the two helper files for XML models. - **Test module**: enabled the `payload/xml` spec, regenerated clients, and ported the XML test suite. ## Testing - `payload.xml.XmlTests`: **26 run, 0 failures, 2 skipped** (namespace scenarios). - Verified end-to-end: generator rebuild → emitter pack → `tsp compile` → generated output adopted into `src` matches, tests green. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…t#11289) Follow-up fix to microsoft#11197 (pylint-guidelines-checker `0.5.9` bump). On regeneration, DPG models emitted a **duplicate docstring**: `:keyword:`/`:paramtype:` lines in the class docstring duplicated the existing `:ivar:`/`:vartype:` entries (e.g. `InvalidAuth`). ## Changes - Remove the redundant keyword-doc generation for DPG models (the source of the duplicated lines). - For DPG models, suppress `docstring-keyword-should-match-keyword-only` at the class line instead — DPG `__init__` overloads have empty bodies, so the checker validates keyword-only args against the *class* docstring, and we intentionally document those args once as `:ivar:` entries. ## Validation - locally ran `npm run regenerate` and full regeneration (azure + unbranded) succeeds; docstrings no longer duplicated. ## todo - [ ] disable `no-cross-package-private-import` in pylintrc of `typespec-azure` --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Yuchao Yan <yuchaoyan@microsoft.com>

…icrosoft#11326) ## Problem Since tspd generates one reference page per linter rule and diagnostic from each definition's `docs` field, the generated pages checked into the website content duplicate their source markdown: - `website/.../libraries/http/rules/op-reference-container-route.md` ↔ `packages/http/src/rules/op-reference-container-route.md` - `website/.../emitters/openapi3/reference/diagnostics/*.md` (6 files) ↔ `packages/openapi3/src/diagnostics/*.md` Keeping both copies in git means every content edit has to be made (or regenerated) in two places. ## Fix Follow the same approach as [Azure/typespec-azure#4968](Azure/typespec-azure#4968) and the repo's existing `js-api` precedent (`**/docs/**/js-api/` is already gitignored): stop tracking the generated pages and regenerate them during the website build. - `.gitignore` — ignore the generated pages: - `website/src/content/docs/docs/**/rules/` - `website/src/content/docs/docs/**/reference/diagnostics/` - Untrack the 7 generated pages (their source markdown under `packages/*/src/**` remains the single tracked copy). The website build regenerates them: `website` build runs `build:web`, which runs `regen-all-packages-docs` before `astro check`/`astro build`. ## Validation - Deleted the generated pages from disk, ran `regen-docs` for http + openapi3, and confirmed all 7 pages are reproduced at the same paths — and git now treats them as ignored (no longer tracked, not shown as untracked). - `@typespec/http` (rules) and `@typespec/openapi3` (diagnostics) are the only libraries in this repo that use the `docs` field, so the globs only match generated content. - `chronus verify` passes (no shipped package changes). Co-authored-by: tadelesh <chenjieshi@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… merged by mistake that way (microsoft#11321) ## Summary - Reverted `pnpm-lock.yaml` to remove registry-proxy-injected `tarball:` URLs (load-balanced `ms-feed-N.pkgs.visualstudio.com` hosts) that are environment-specific and break CI. The lockfile is now integrity-only again. - Added a `check-lockfile` script (`eng/common/scripts/check-lockfile.ts`) that fails if any `tarball:` URL is present in `pnpm-lock.yaml`. - Wired it into the `version-consistency` job in `consistency.yml`. ## Why not a pnpm setting? pnpm's `lockfile-include-tarball-url=false` is already the default and is [known to be flaky](pnpm/pnpm#6667) when the registry host differs from the tarball host, so it does not reliably prevent this. A lightweight CI guard is the robust option. ## Validation - `pnpm run check-lockfile` passes on the cleaned lockfile. - Verified it exits non-zero when a `tarball:` URL is injected. - `tsc -p ./tsconfig.eng.json --noEmit` passes.

Fixes six open **A11y_TypeSpec** website accessibility bugs (all Sev2, `meta:website`) filed against typespec.io. | Issue | WCAG | Fix | | ----- | ---- | --- | | microsoft#10789 | 2.4.1 Bypass Blocks | Added a visible-on-focus **"Skip to main content"** link + a focusable `<main id tabindex="-1">` landmark to the non-docs page layout. | | microsoft#10791 | 2.1.1 Keyboard | Made the OpenAPI page sample **carousel keyboard operable** — converted the `role="tab"` anchors (no `href`) to `<button>`s with the full ARIA tabs pattern. | | microsoft#10793 | 1.3.1 Info & Relationships | Gave the docs **sidebar a distinct landmark name** ("Documentation") via an i18n override so it no longer duplicates the header's "Main" nav. | | microsoft#10794 | 1.4.12 Text Spacing | Kept the header on a **single row** under increased text spacing: hide the version banner in the narrow desktop range (1024–1200px) and let the nav wrap as a fallback instead of overlapping. | | microsoft#10795 | 1.4.10 Reflow | On docs pages the site header menu button overlapped Starlight's sidebar menu button (and the search button). **Hid the redundant site menu button** and reserved space for Starlight's; the site links remain reachable from the Starlight mobile menu. | | microsoft#10796 | 1.4.4 Resize Text | Same root cause as microsoft#10795 — resolved by the same change plus syncing `--sl-nav-height` to the real header height so content offsets track the header. | ## Verification Each fix was verified in a locally running dev server with Playwright/Chromium: - Skip link is the first focusable element and moves focus to `<main>` on activation. - Carousel tabs are focusable buttons; ArrowLeft/Right switch panels and update `aria-selected`. - Docs page exposes distinct `Main` and `Documentation` nav landmarks. - Header stays a single row at all widths, including the tester's ~1918px text-spacing repro. - Only one menu button on docs pages at mobile widths, with no overlap against the search button; the Starlight menu contains the site links so nothing is hidden. `astro check` (0 errors / 0 warnings / 0 hints), `oxlint`, and `prettier` all pass. > `@typespec/website` is a private package (not published), so no changelog entry is required.

…ft#11273) `@typespec/http-specs` was not registered under any Chronus version policy, leaving it unmanaged for versioning purposes. ## Changes - Added `@typespec/http-specs` to the `typespec-preview` lockstep policy in `.chronus/config.yaml` so it versions in lockstep with other preview packages. Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: timotheeguerin <1031227+timotheeguerin@users.noreply.github.com> Co-authored-by: Timothee Guerin <tiguerin@microsoft.com>

## What `eng/emitter-diff` **diffs the generated code produced by two versions of a TypeSpec emitter**. It resolves a *baseline* and a *head* source tree (each a local folder or a GitHub url/sha), runs the emitter's own regenerate command in each, and renders the difference between the generated output as a clickable **HTML report** (default) plus a terminal summary. For go/rust/languages in azure/typespec-azure you would add the language to the registry and update your package.json to reference this in the core submodule (or you can directly call the cli script (no registry needed) with the correct flags set in your package.json) ## How it works - **Refs** (`--baseline` / `--head`): `local:/path`, `github:owner/repo@<sha|branch>`, or `gh:<sha|branch>` (this repo). Head defaults to the current working tree; baseline defaults to `upstream/main` (or `origin/main`). - **Setup**: a tree the tool fetches fresh from GitHub is prepared with the preset's `--setup` (install + build). The current working tree and `local:` paths are assumed already built and never installed by the tool. A commit-keyed cached worktree is prepared once, so reruns skip re-setup. - **Baseline-output cache**: baseline generated output is cached per profile + baseline commit, so iterative local runs only regenerate head. Disabled in CI with `--ci`. On a cache hit the baseline tree is not even checked out — its identity is resolved with a cheap shallow fetch. - **Filtering a subset of tests**: everything after `--` is appended to the regenerate command verbatim on both sides, so you can forward the regenerate script's own filter flags (e.g. python's `--name authentication/api-key --flavor azure`) to diff only part of the suite. ## Flags `--emitter <name>` (preset: `python`, `typescript`/`ts`), `--command`, `--emitter-path`, `--generated-code-path`, `--setup` (repeatable) / `--no-setup`, `--baseline` / `--head`, `--work-dir`, `--sequential` (regenerate sides one at a time instead of in parallel), `--ci`, `--html`, `--fail-on-diff`, and `-- <args>` passthrough. See `eng/emitter-diff/README.md`. ## Changes - **`eng/emitter-diff/`** — the tool: CLI/orchestrator (`cli.ts`), ref resolver for local/github/`gh:` refs with a commit-keyed worktree cache (`resolver.ts`), emitter presets (`registry.ts`), a zero-dependency HTML/terminal diff renderer (`diff.ts`), the local baseline-output cache (`baseline-cache.ts`), shared types/utilities, `tsconfig.json`, and `README.md`. - **`packages/http-client-python/package.json`** — adds the `diff-spector-tests` script (`tsx ../../eng/emitter-diff/src/cli.ts --emitter python`). - **`.github/workflows/ci-emitter-diff-python.yml`** — the PR workflow (below). - **`cspell.yaml`**, **`.chronus/changes/…`** — a spelling allow-list entry and an `internal` changeset. ## CI behavior The `python / emitter diff` workflow runs on PRs that touch `http-client-python` or the tool. It diffs this PR's emitter against the **PR merge-base** (overridable via `workflow_dispatch`), uploads the rendered **HTML report** as an artifact, and posts/updates a **sticky PR comment** with the diff summary. It is **informational**: the job fails only on a tool/build error — **never on a diff**. --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Splitting from the rest of dep upgrade as it creates a lot of diff

…ft#11319) The regen preview pipeline aborted mgmt library regeneration with `Unbranded package not found: .../csharp-debug-.../typespec-http-client-csharp-<version>.tgz`. `Update-MgmtGenerator` resolves the unbranded emitter from the debug folder as `typespec-http-client-csharp-$LocalVersion.tgz`, but `Submit-AzureSdkForNetPr.ps1` referenced the unbranded `.tgz` directly from `$BuildArtifactsPath` and only staged the `.nupkg` files and the locally built Azure `.tgz` into the debug folder — leaving the unbranded package absent from where the mgmt build looks. ### Changes - **`Submit-AzureSdkForNetPr.ps1`**: Copy the unbranded `typespec-http-client-csharp-*.tgz` from build artifacts into `$debugFolder` and point `$unbrandedPackagePath` at that copy, so both the Azure and management plane generators resolve it from the same location. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jorgerangel-msft <102122018+jorgerangel-msft@users.noreply.github.com>

## Summary Routine dependency upgrade pass for July 2026. - Bump `pnpm` to `11.10.0`. - Update catalog dependencies: `@astrojs/starlight`, `@babel/*` (7 → 8), `@expressive-code/core` / `astro-expressive-code`, `vite`, `@vscode/test-web`, `oxlint-tsgolint`, `vite-plugin-dts`, etc. - Raise `minimumReleaseAge` to 7 days. ## Note on astro `astro` is **pinned to `7.0.3`** rather than bumped. Versions `7.0.4`-`7.0.6` contain a static-build regression ([withastro/astro#17306](withastro/astro#17306)) where dynamic file-extension endpoints (e.g. `docs/[...slug].md.ts`) with `trailingSlash: "always"` fail the build with `NoMatchingStaticPathFound`. The upstream fix ([#17320](withastro/astro#17320)) ships in `7.0.8`, which is published but still within our 7-day new-package quarantine. The pin should be dropped once `7.0.8` clears quarantine. ## Validation - `website` builds successfully with the pin (1128 pages, no `NoMatchingStaticPathFound`).

…m 2.18.7 to 2.18.9 in /packages/http-client-java/generator/http-client-generator-clientcore-test (microsoft#11334) Bumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) from 2.18.7 to 2.18.9. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/FasterXML/jackson/commits">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.fasterxml.jackson.core:jackson-databind&package-manager=maven&previous-version=2.18.7&new-version=2.18.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/typespec/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

… skip raw bytes payloads (microsoft#11329) ## Fix XML serializer gating for byte[] payloads ### Problem A recent change (support XML serialization in the http-client-java generator) emitted a static XML `ObjectSerializer SERIALIZER` field whenever an operation had an XML content-type. This was wrong in two cases: 1. **Raw `byte[]`/`BinaryData` payloads** (e.g. an operation returning a raw XML document as `bytes`, like `azure-analytics-planetarycomputer`'s `getWmtsCapabilities`). Here the `SERIALIZER` referenced an `XmlSerializerProviders` helper that is only generated for models actually used in XML, so the generated code failed to compile. 2. **Non `azure-v1` data-plane clients.** XML `ObjectSerializer` handling only applies to the `azure-core` (v1) data-plane flavor. ### Fix - Gate `SERIALIZER` emission on `isAzureV1() && isDataPlaneClient()`. - Only use the XML `ObjectSerializer` when the payload is an actual model, i.e. not `byte[]`/`BinaryData`/`Base64Url`. - Inspect the **convenience** method's model body types (unwrapping `Mono`/`Flux`/`Response`/`ResponseBase`/`PagedIterable`/`PagedFlux`/`PagedResponseBase`) instead of the protocol method's `BinaryData` type. ### Verification - New `tsp/xml-bytes-verify.tsp` case (data-plane azure-v1 op returning `bytes` with `application/xml`) generates committed source under `tsptest/xmlbytesverify`. - New reflection-based `XmlBytesVerifyTests` asserts the generated clients declare **no** static `SERIALIZER` field for raw bytes payloads, with a positive control on `payload.xml.SimpleModelValueClient`. - Regenerating `payload/xml` produces identical output (`SERIALIZER` count unchanged at 312), confirming real XML model clients are unaffected. Ref: Azure/azure-sdk-for-java#49877 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…soft#11339) Adds a 7-day cooldown to all dependabot update entries so newly published packages must age before Dependabot opens PRs, satisfying the quarantine policy. - **All ecosystems (pip, npm, github-actions)**: added `cooldown: default-days: 7` Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: timotheeguerin <1031227+timotheeguerin@users.noreply.github.com> Co-authored-by: Timothee Guerin <tiguerin@microsoft.com>

…t#11351) ## Problem `turbo build` randomly fails on Windows CI, exiting with code 1 and **no task output / no "run failed" summary**: \`\`\` $ turbo --filter=!@typespec/monorepo "build" • Packages in scope: ... • Running build in 65 packages • Remote caching disabled [ELIFECYCLE] Command failed with exit code 1. \`\`\` ## Root cause The failures started when turbo was bumped \`2.9.14 → 2.10.5\` in microsoft#11265. This is [vercel/turborepo#13346](vercel/turborepo#13346): turbo **2.10.1+** ships a vendored \`libghostty-vt\` compiled with **non-baseline CPU instructions** (inherited from the release build runners). On CPUs lacking those instructions, turbo crashes with \`STATUS_ILLEGAL_INSTRUCTION (0xC000001D)\` — a hard process kill, so turbo never prints its own error summary. The crash is **deterministic per-CPU** but appears *random* because CI runner pools have **heterogeneous CPUs** — you only fail when scheduled onto an older/leaner microarchitecture. The upstream fix ([vercel/turborepo#13352](vercel/turborepo#13352)) only rebuilt \`libghostty-vt\` and was verified on a single maintainer VM; no fully-fixed stable (\`>=2.10.6\`) exists yet. ## Fix Revert the catalog pin to **\`turbo: 2.9.14\`** — the version this repo ran on Windows CI cleanly for ~7 weeks (Jun 2 → Jul 21). Added a comment pointing to the upstream issue so the next dependency bump can gate re-upgrade on a verified fixed stable. The \`pnpm-lock.yaml\` change was applied surgically (only the 7 turbo entries) to avoid the registry-proxy tarball churn that \`pnpm install --lockfile-only\` introduces; validated with \`pnpm install --frozen-lockfile\`.

…soft#11313) Since the migration from `xml2js` to `fast-xml-parser` (microsoft#10239), `validateXmlBodyEquals` prepends `<?xml version='1.0' encoding='UTF-8'?>` to plain expected strings, and `fast-xml-parser` (unlike `xml2js`) preserves that declaration as a `?xml` node in the parsed output. This causes comparison failures when the actual request body omits the declaration. ## Changes - **`packages/spec-api/src/request-validations.ts`** — Add `ignoreDeclaration: true` to `XMLParser` options so declarations are stripped from both sides before comparison, restoring the semantic-equality behavior of `xml2js`. - **`packages/spector/test/xml-validation.test.ts`** — Add test for the inverse path: actual body without a declaration matching an expected string (the exact scenario failing in Spector). ```js // Previously threw ValidationError; now passes validateXmlBodyEquals( { rawBody: "<Root><a>1</a></Root>" }, "<Root><a>1</a></Root>", ); ``` --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: timotheeguerin <1031227+timotheeguerin@users.noreply.github.com> Co-authored-by: Timothee Guerin <tiguerin@microsoft.com>

## Problem Some emitters/areas are contributed by teams **outside** the Microsoft org. We want them to act like code owners for their area, but GitHub doesn't allow this: - `CODEOWNERS` entries must be collaborators with write access. - The review-request API also **rejects non-collaborators** (`"Reviews may only be requested from collaborators."`), even on public repos. The existing `.github/policies/prs.external-reviewers.yml` used `requestReview:` for the external graphql owners — which **silently fails** for that reason. ## Fix The only thing that works for arbitrary external users is an **@-mention in a comment**. This PR switches the external-owners policy to a comment mention, driven by the Microsoft **Policy Service** (already active on this repo) and **generated** from config via the existing `sync-labels` pipeline — consistent with `issues.triage.generated.yml` / `prs.triage.generated.yml`. ### Changes - `eng/common/config/area.ts` — new `ExternalOwners` map (keyed by area name, reuses `AreaPaths` globs; seeded `emitter:graphql → steverice, swatkatz`) + `externalReviewMarkerLabel()` helper. - `eng/common/config/labels.ts` — declares per-area marker labels and threads `externalOwners` into the config. - `eng/common/scripts/labels/types.ts` — adds `externalOwners` to `RepoConfig`. - `eng/common/scripts/labels/policy.ts` — typed `addReply` / `addLabel` action helpers. - `eng/common/scripts/labels/automation.ts` — `createExternalReviewersConfig()` generates `.github/policies/prs.external-reviewers.generated.yml` (with a `cspell:ignore` header for usernames). - Removed the broken hand-written `.github/policies/prs.external-reviewers.yml`. - Regenerated the policy + `CONTRIBUTING.md` label table. ### Behavior On a PR that touches an owned area's paths, and only if the per-area marker label is absent, the Policy Service posts a comment @-mentioning the owners and adds the marker label. This notifies them **once** — even for paths that first appear in a later push — and avoids re-pinging on every subsequent commit. To onboard another external team later: add an entry to `ExternalOwners` and run `pnpm sync-labels`. ### Notes - `addReply` is used because it's the comment action already proven in this repo (`pr.stale.yml`, `issues.needs-info.yml`). - Full end-to-end behavior can only be confirmed after merge, since the Policy Service runs server-side. Local validation covers generation correctness + `pnpm sync-labels --check` (what `verify-labels.yml` runs in CI).

@ref

…s group (microsoft#11352) Bumps the actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action). Updates `github/codeql-action` from 4 to 4.37.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action's releases</a>.</em></p> <blockquote> <h2>v4.37.0</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>v4.36.3</h2> <p>No user facing changes.</p> <h2>v4.36.2</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>v4.36.1</h2> <p>No user facing changes.</p> <h2>v4.36.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>v4.35.5</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>v4.35.4</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>v4.35.3</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3837">#3837</a></li> <li>Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. <a href="https://redirect.github.com/github/codeql-action/pull/3850">#3850</a></li> <li>Best-effort connection tests for private registries now use <code>GET</code> requests instead of <code>HEAD</code> for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. <a href="https://redirect.github.com/github/codeql-action/pull/3853">#3853</a></li> <li>Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. <a href="https://redirect.github.com/github/codeql-action/pull/3852">#3852</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.3">2.25.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3865">#3865</a></li> </ul> <h2>v4.35.2</h2> <ul> <li>The undocumented TRAP cache cleanup feature that could be enabled using the <code>CODEQL_ACTION_CLEANUP_TRAP_CACHES</code> environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the <code>trap-caching: false</code> input to the <code>init</code> Action. <a href="https://redirect.github.com/github/codeql-action/pull/3795">#3795</a></li> <li>The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. <a href="https://redirect.github.com/github/codeql-action/pull/3789">#3789</a></li> <li>Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. <a href="https://redirect.github.com/github/codeql-action/pull/3794">#3794</a></li> <li>Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. <a href="https://redirect.github.com/github/codeql-action/pull/3807">#3807</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.2">2.25.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3823">#3823</a></li> </ul> <h2>v4.35.1</h2> <ul> <li>Fix incorrect minimum required Git version for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a>: it should have been 2.36.0, not 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3781">#3781</a></li> </ul> <h2>v4.35.0</h2> <ul> <li>Reduced the minimum Git version required for <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> from 2.38.0 to 2.11.0. <a href="https://redirect.github.com/github/codeql-action/pull/3767">#3767</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1">2.25.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3773">#3773</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9"><code>99df26d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3996">#3996</a> from github/update-v4.37.0-c7c896d71</li> <li><a href="https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0"><code>31c2707</code></a> Add changenote for <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a></li> <li><a href="https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6"><code>72df218</code></a> Update changelog for v4.37.0</li> <li><a href="https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91"><code>c7c896d</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3995">#3995</a> from github/update-bundle/codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146"><code>3f34ff0</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1"><code>43bec09</code></a> Update default bundle to codeql-bundle-v2.26.0</li> <li><a href="https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46"><code>f58f0d1</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/3973">#3973</a> from github/mbg/repo-props/config-file-shorthands</li> <li><a href="https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8"><code>7dc37cb</code></a> Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...</li> <li><a href="https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f"><code>8e22350</code></a> Thread <code>ActionState</code> to <code>initConfig</code></li> <li><a href="https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b"><code>69c9e8c</code></a> Mark some <code>status-report</code> imports as <code>type</code>-only to avoid circular dependencies</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v4...v4.37.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4&new-version=4.37.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…microsoft#11353) ## What - Updated `.github/copilot-instructions.md` with two additions: 1. **Commit instructions**: Added explicit `pnpm format` rule and guidance to avoid committing `pnpm-lock.yaml` unless necessary. 2. **Branch and PR Workflow** (new section): Added guidance on branching from the main Azure fork's `main` branch and opening PRs against it. ## Why These rules help ensure consistent commit hygiene and correct branch/PR targeting across contributors. ## How to verify Review the diff — all existing content is preserved, only additive changes. Co-authored-by: iscai-msft <isabellavcai@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

… XML usage (microsoft#11341) The XML `WriteObjectValue<T>` extension method emits a `case IPersistableModel<T>` that calls `ModelReaderWriter.Write(..., <Namespace>Context.Default)`. When the generated `ModelReaderWriterContext` registers no buildable types, the source generator fails to produce `.Default`, breaking compilation (observed in Azure.Storage.Blobs.Batch). Root cause: `InputLibrary.GetHasXmlModelSerialization()` treated an enum with XML usage as XML serialization support. Enums do not implement `IPersistableModel` and are never registered with the context, so an XML-usage enum alone enabled the XML helpers while leaving the context empty. ### Changes - **`InputLibrary.GetHasXmlModelSerialization`**: only consider models (which implement `IPersistableModel`); removed the enum branch. This gates all XML serialization helpers — including `WriteObjectValue` and the `BinaryContentHelper` XML overload — on the presence of at least one XML model. Legitimate XML enums are already covered, since such enums only exist as properties of an XML model. - **Tests**: added `ValidateXmlMethodsAreNotGeneratedWhenOnlyEnumHasXmlUsage`, asserting no `XmlWriter`/`XElement` helpers are emitted when only an enum carries XML usage. ```csharp // Before: enum-only XML usage returned true -> XML helpers emitted, empty context -> build break // After: only models with XML usage count foreach (var model in InputNamespace.Models) { if (model.Usage.HasFlag(InputModelTypeUsage.Xml)) { return true; } } return false; ``` --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jorgerangel-msft <102122018+jorgerangel-msft@users.noreply.github.com>

## Summary - normalize date-time `Start*` and `End*` names to `StartsOn` and `EndsOn` - preserve exact `First*` and `Last*` date-time names while retaining compound-name normalization - keep normalized operation parameters mapped to their original input names so header, query, and path serialization is not dropped Addresses feedback from Azure/azure-sdk-for-net#62390. ## Validation - `npm run build` - `eng/scripts/Generate.ps1` - `npm test` - `npm run cop` --------- Copilot-Session: 813a9e1d-ed7a-4e38-ac7a-2096d4933fa5

…osoft#11766) ## Summary Fixes generated Java code corruption when a Javadoc table cell (parameter name/type/description, or response header name/type/description) contains a literal `*/` sequence. ## Root cause Values written into the optional-parameters and response-headers Javadoc tables are escaped for XML special characters via `CodeNamer.escapeXmlComment`, but never comment-escaped. When a value embeds `*/` (for example, TCGC's Content-Type parameter doc for an unconstrained `Http.File` content type, whose `contentTypes` array is `["*/*"]`), the literal `*/` prematurely closes the surrounding generated `/** ... */` Javadoc block. This corrupts the rest of the generated Java file and breaks compilation with a long cascade of parser errors. ## Fix `CodeNamer.escapeComment` already exists and correctly escapes `*/` to `*&microsoft#47;`, but it wasn't applied consistently. This change centralizes the escaping in the shared `ClientMethodTemplateBase#javadocTable` helper so every cell value (not just parameter descriptions) is protected, alongside the existing XML escaping. ## Context Found while fixing Azure/typespec-azure#5288 (Azure/typespec-azure#5306), where making the Content-Type parameter for default `Http.File` bodies client-visible (previously hidden as a constant) surfaced this latent Javadoc-escaping bug in CI. --------- Co-authored-by: iscai-msft <isabellavcai@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6a785543-019d-4b0c-9750-5affcfc900ee

…errors covering standard status codes (microsoft#11250) ## Problem When a TypeSpec operation declares a customized error model that covers one of the standard azure-core status codes (401, 404, 409, 304), the Python emitter did not consistently raise the dedicated azure-core error type: - **Ranged custom error** (e.g. `4XX`) covering a standard code → fell through to a generic `HttpResponseError`. - **Default custom error model** (covers all non-success codes) → likewise fell through to `HttpResponseError` for the standard codes. Only a custom error targeting a standard code *specifically* raised the dedicated type, so behavior was inconsistent across the single / ranged / default cases. ## Fix Standard status codes now **always** map to their dedicated azure-core error type via the operation `error_map`, regardless of whether a customized error model (single, ranged, or default) also covers them: - `401 → ClientAuthenticationError` - `404 → ResourceNotFoundError` - `409 → ResourceExistsError` - `304 → ResourceNotModifiedError` Because `map_error(status_code=..., response=..., error_map=error_map)` runs first in the generated handler, these codes raise their dedicated type there. The customized error body continues to be deserialized and attached (`model=error`) to the generic `HttpResponseError` that is raised for any **other** (non-standard) status codes covered by the customized error. ### Behavior change note For a custom error that targets a standard code *specifically* (e.g. a `404` model), the dedicated error is still raised, but the deserialized custom body is **no longer attached** to it — `map_error` raises before deserialization, so `exc.model` is `None` for those codes. The body remains available on `HttpResponseError` for non-standard codes. The `response-status-code-range` mock-api tests were updated to reflect this. ### Example generated output (ranged custom error + default custom error) ```python if response.status_code not in [204]: map_error(status_code=response.status_code, response=response, error_map=error_map) error = None if 494 <= response.status_code <= 499: error = _failsafe_deserialize(_models.ErrorInRange, response) else: error = _failsafe_deserialize(_models.DefaultError, response) raise HttpResponseError(response=response, model=error) ``` with the shared error map: ```python error_map: MutableMapping = { 401: ClientAuthenticationError, 404: ResourceNotFoundError, 409: ResourceExistsError, 304: ResourceNotModifiedError, } ``` ## Validation - Regenerated all Azure + unbranded spector specs (181 specs, 0 failures). - `response-status-code-range` mock-api tests pass (sync + async, 4/4), exercising both an in-range code and the single 404 → `ResourceNotFoundError`. - Added a `fix` changelog entry for `@typespec/http-client-python`. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: iscai-msft <isabellavcai@gmail.com>

… wrong format. (microsoft#11731) This pull request fixes an issue with how `duration` example values are serialized when using the `@encode("milliseconds", ...)` decorator. Previously, these values were being serialized as ISO 8601 strings instead of numeric values. The update ensures that durations are now correctly serialized as numbers representing milliseconds. The most important changes are: **Bug Fix: Duration Serialization** * Fixed the serialization logic in `packages/compiler/src/lib/examples.ts` so that when encoding durations as `"milliseconds"`, the output is a numeric value (integer or float, as appropriate), not an ISO 8601 string. **Testing** * Added new test cases in `packages/compiler/test/decorators/examples.test.ts` to verify that durations encoded as milliseconds produce the correct numeric values in both integer and float formats. **Documentation** * Added a changelog entry in `.chronus/changes/fix-duration-milliseconds-example-serialization-2026-8-19-18-30-0.md` describing the fix and its impact.

@Discriminator

…crosoft#11594) - Generate Azure-flavor client methods that return `Stream[T]` / `AsyncStream[T]` for JSONL (`application/jsonl`) and SSE (`text/event-stream`) response streams ```python stream = client.receive() # Stream[Thing] for thing in stream: ... ``` Supports this [spec](https://gist.github.com/chrisradek/b2656d7ee5db1b29768d50db0628f033#typespecevents) Missing support for : microsoft#11761 QUESTIONS/NOTES FOR NOW OR FUTURE REF: - handling multiple unamed events correctly -- supporting [@Discriminator to figure out which event is which](https://gist.github.com/chrisradek/b2656d7ee5db1b29768d50db0628f033#typespecevents) - handling `@data` (w/ w/o envelopes correctly -- python is just returning data aka Stream[T] not Stream[SSEEvent[T]] (like paging) so Stream[`@data` payload]) - decoding payload content-type correctly -- use of isEventEnvelope*? -- don't currently use for python b/c of above design - Currently not supporting automatic reconnect (last-event-id can be passed in by user if needed, but `@retry` not used - both should be exposed on Stream) -- microsoft#11761 - terminal events yielding -- [DONE] vs a terminal event that is a model and how we handle that /yield them or not EXAMPLES: What search retrieveStream() looks like: <img width="2795" height="1445" alt="image" src="https://github.com/user-attachments/assets/fe39b2fb-1654-4ec4-871e-2d8683e3fa65" /> `Stream(response=response, deserialization_callback=_callback, terminal_event_names=["error", "response.completed"])` What search retrieveStream() output looks like: the sample: <img width="1028" height="131" alt="image" src="https://github.com/user-attachments/assets/9b868d8d-0f45-4468-a2d7-bf02510e6905" /> the output: <img width="2886" height="705" alt="image" src="https://github.com/user-attachments/assets/5bca2fbf-34f2-4dda-b84a-f4d89148a036" /> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e57edafe-9764-4b99-a1ae-0efd56e8729e Copilot-Session: 2a68a869-b075-46b2-87b4-2bbe62948e69 Copilot-Session: 51359cbf-bc53-429e-b947-8284a91d7d46

…t#11778) The generation of the dashboard adds unnecessary time to the regen process, also it is flaky since it has to queue npm. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jorgerangel-msft <102122018+jorgerangel-msft@users.noreply.github.com>

) ## Summary - derive REST request-builder names from the original operation identity instead of mutable wrapper-specific back-compatibility state - preserve the previous GA public method and request spelling, allowing a wrapper to expose `GetUrl` and consistently call the emitted `CreateGetUrlRequest` - add a regression where a shipped wrapper preserves `GetUrl`, a later wrapper selects `GetUri`, and the final rendered REST provider still contains the request captured by the earlier wrapper - preserve exact operation names while retaining normal C# identifier conversion for REST request helpers This addresses the SDK generation failure described in microsoft#11708 where a generated wrapper called a REST request method that was absent from the final emitted provider. Retaining original operation identity also keeps distinct `GetUrl` and `GetUri` operations mapped to distinct REST request names without set-dependent collision handling. ## Validation - `Microsoft.TypeSpec.Generator.ClientModel.Tests`: 1,595 passed - Local data-plane SDK regeneration: 47 Azure-branded and 5 unbranded libraries regenerated successfully, with no unexpected REST request-name diffs attributable to this change

…ft#11763) TypeSpec documentation containing C# line terminators beyond `\n` could emit continuation text without a `///` prefix. This could place documentation text into generated C# as ordinary source. - **Line normalization** - Normalize `\r`, `\r\n`, `U+0085`, `U+2028`, and `U+2029` through the existing newline continuation path. - Preserve the allocation-free path for ordinary text and `\n`. - **Generator coverage** - Cover enum-member documentation containing every supported terminator. - Verify each continuation is emitted as `///` documentation and the generated enum compiles. ```csharp /// <summary> /// First line /// Second line /// </summary> Value ```  - Fixes microsoft#11762 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jorgerangel-msft <102122018+jorgerangel-msft@users.noreply.github.com>

## Summary - generate the playground sample manifest from `packages/samples` metadata - derive categories, emitter choice, and inherited linter configuration - remove the seven duplicate playground sample files - validate generated samples and configuration edge cases ## Stack Depends on microsoft#11498 (and microsoft#11497). 1. Curate TypeSpec samples 2. Add sample metadata configuration 3. **Source playground examples from samples** (this PR) This PR temporarily targets `main` because native stacked PRs are disabled for this repository; its diff contracts after the preceding layers merge.

The C# server emitter generated model and enum filenames from raw TypeSpec names instead of the C# naming policy. Enum XML documentation was also emitted below `[JsonConverter]`. ![Incorrect camel-cased generated filenames](https://github.com/user-attachments/assets/3f521147-544d-4a0e-ac2d-0e633b4ffb9e) - **File naming** - Apply the C# naming policy to model and enum filenames. - `camelModel` and `camelEnum` now generate `CamelModel.cs` and `CamelEnum.cs`. - **Enum documentation** - Emit XML documentation before declaration attributes: ```csharp /// <summary> /// The kind of entity that created the resource. /// </summary> [JsonConverter(typeof(JsonStringEnumConverter))] public enum CreatedByType ``` - **Regression coverage** - Verify generated paths and enum documentation ordering. - Update affected generated-output snapshots.  - Fixes microsoft#11536 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: timotheeguerin <1031227+timotheeguerin@users.noreply.github.com> Co-authored-by: Timothee Guerin <tiguerin@microsoft.com>

…crosoft#11597) An override descriptor already accepted a `declaration` entry, but nothing ever dispatched to it — only `reference` was wired up. So an emitter could change how a type is *referenced* and had no say in how it is *declared*. The only way to customize a declaration was to copy the framework component into your own package and diverge from it, which is exactly what `@typespec/http-server-csharp` did for classes, properties and enums. `Experimental_OverridableComponent` now dispatches `declaration` too, and the C# `ClassDeclaration`, `Property` and `EnumDeclaration` render through it. An override can replace the declaration outright, or re-render the default with different props: ```tsx const overrides = Experimental_ComponentOverridesConfig().forTypeKind("ModelProperty", { declaration: (props) => isSecret(props.type) ? ( <props.Declaration {...props.declarationProps} public={false} internal /> ) : ( props.default ), }); ``` `props.Declaration` is the unwrapped body, so re-rendering it does not recurse back through the override. The declaration props type is generic and defaults to `Record<string, any>`, because the existing `Experimental_CustomTypeToProps` map is TypeScript-specific (`VarDeclarationProps`, `ObjectPropertyProps`) and means nothing for C#. Callers that want type safety pass the concrete props type: `.forTypeKind<"ModelProperty", PropertyProps>(...)`. --- Independent — targets `main` and can merge on its own. One of 7 PRs moving `@typespec/http-server-csharp` onto the emitter framework instead of its private forks: microsoft#11596, microsoft#11597, microsoft#11598, microsoft#11599, microsoft#11600, microsoft#11601, microsoft#11602.

The emitter carried a 217-line hand-maintained table of C# keywords and a `createLibrary` call re-declaring the `System.Text.Json.Serialization` attributes. `@alloy-js/csharp` ships both, and its versions are better: the local keyword list was missing `delegate`, and hand-declared symbols do not participate in Alloy's automatic `using` management. Both are deleted in favour of the Alloy equivalents (`isValidCSharpIdentifier`, `csharpKeywords`, the `System/Text/Json` builtins), along with the local `getDocComments` copy, which is already exported from `@typespec/emitter-framework/csharp`. One thing Alloy deliberately does *not* do is worth calling out: its name policy `@`-escapes real keywords, but the emitter needs namespace segments colliding with common BCL type names to be **renamed** — a namespace called `Type` shadows `System.Type` and breaks every `typeof()` in the generated converters. That rule survives, now isolated in `getCSharpNamespaceName` and built on Alloy's keyword sets rather than a parallel list. Generated output is unchanged. --- Independent — targets `main` and can merge on its own. One of 7 PRs moving `@typespec/http-server-csharp` onto the emitter framework instead of its private forks: microsoft#11596, microsoft#11597, microsoft#11598, microsoft#11599, microsoft#11600, microsoft#11601, microsoft#11602. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

@service

…rosoft#11777) A value coming from a `.tsp` spec could be interpolated into an emitted file path without any sanitization, letting a spec write files **outside** the emitter output dir. ```tsp @versioned(Versions) @service namespace Svc; enum Versions { v1: "../../../../../../tmp/PWNED/pwn" } ``` With `@typespec/openapi3` this wrote `/tmp/PWNED/pwn.yaml` instead of something under `tsp-output/`. `{version}` was not the only vector. Backticked identifiers accept arbitrary characters, so any name reaching a file path had the same problem: | Emitter | Vector | | --- | --- | | `openapi3` | `{version}`, `{service-name}`, `{service-name-if-multiple}` in `output-file` | | `json-schema` | ``model `../../x` {}`` → `../../x.json` | | `asset-emitter` | any `createSourceFile` name, which is the choke point for `emitter-framework`, `http-server-csharp`, `http-client-js`, … | ## What changed New `sanitizePathSegment` helper in the compiler, applied to every spec-derived value that ends up as a path segment: ```ts sanitizePathSegment("2021-10-01-preview"); // "2021-10-01-preview" (unchanged) sanitizePathSegment("../../etc/passwd"); // ".._.._etc_passwd" ``` - **openapi3**: applied to `{version}`, `{service-name}` and `{service-name-if-multiple}`. The user provided `output-file` option is untouched — that is config, not spec input. - **json-schema**: applied to the declaration name used as the file name. - **asset-emitter**: `createSourceFile` now resolves strictly under `emitterOutputDir` — absolute roots and `..` components are dropped, sub-directories keep working. `emitFile` itself is deliberately left unrestricted: an emitter may legitimately write outside its own output dir, so the fix is at the source of the untrusted data. ## Notes - Behavior change for anyone relying on a `{version}` value containing `/` to build a nested layout — that is exactly the vulnerable behavior. - `typespec-autorest` in `Azure/typespec-azure` has the same exposure on `{version}`/`{service-name}` and needs a follow-up once this ships. Sanitizing inside `interpolatePath` itself was ruled out on purpose: that emitter interpolates `{arm-types-dir}`, a genuine multi-segment path.

…m.getTypeInfo API (microsoft#11489) Fixes microsoft#1993 Fixes microsoft#4860 (http specific info) ## Summary Adds a new experimental `$provideTypeInfo` library provider and `program.getTypeInfo(type)` API that lets libraries contribute extra, domain-specific information about types. This information is surfaced in IDE hover tooltips and can be queried programmatically by tooling (e.g. AI agents). Unlike `$onValidate`, a provider: - **is never run during compilation** — it is invoked lazily and on demand. - **must not mutate the type graph** — it only reads the program to answer questions about a type. The feature is gated behind a new `type-info-provider` compiler feature flag, scoped to the package declaring it: a library opts in via its own `tspconfig.yaml` and consumers do not need to enable anything. ```ts export const $provideTypeInfo = defineTypeInfoProvider(({ program, target }) => { if (target.kind !== "Operation") return undefined; return { content: "extra info about this operation" }; }); ``` <img width="824" height="173" alt="image" src="https://github.com/user-attachments/assets/6f9ab5f5-7232-45c7-b22d-2b603912bf2b" />

`tsp install` could not bootstrap its package manager from registries such as Azure Artifacts because it relied on a version-specific manifest endpoint those registries do not provide. This kept the release E2E job disabled even when `TYPESPEC_NPM_REGISTRY` was configured. Package-manager versions are now resolved from standard registry package metadata, including tags and semver ranges. TypeSpec still reads only `TYPESPEC_NPM_REGISTRY` for its bootstrap; the invoked package manager remains responsible for its own registry and authentication configuration. Registry and tarball failures are also reported as install diagnostics instead of internal compiler errors. The release E2E job is re-enabled against the Azure SDK registry mirror, with the TypeSpec registry variable passed through Turbo. Fixes microsoft#11665 Fixes microsoft#11688

The C# `TypeExpression` threw a hard `Error` for anything it did not recognise — tuples, string templates, enum members, template parameters and most of the intrinsics. An emitter hitting one of those got a crash with no source location instead of a diagnostic, so `@typespec/http-server-csharp` had to wrap every call site in `try`/`catch`. Those kinds are now handled, and a genuinely unsupported type reports a diagnostic against the offending type and falls back to `object`, so compilation continues and the user gets a pointer to the spec that caused it. The diagnostics name the type, so it is actionable without bisecting the spec: ``` warning emitter-framework/csharp-unsupported-scalar: Scalar 'MyLib.ipAddress' has no C# equivalent, using 'object' instead. Extend a built-in scalar to control how it is emitted. warning emitter-framework/csharp-unsupported-type: Type '@MyLib.flag' of kind 'Decorator' is not supported in C#, using 'object' instead. ``` The two are kept separate because they call for different actions: the scalar one is fixable in the spec by extending a built-in scalar, while the other reports a gap in the emitter. Two smaller bugs fixed along the way: - Unsupported scalars reported a **TypeScript** diagnostic (`typescript-unsupported-scalar`) from the C# components. C# now has its own `src/csharp/lib.ts`, matching the existing `typescript/lib.ts` and `python/lib.ts`, which makes that class of mistake a type error. - The `null` and `never` intrinsics emitted `null` and `never`, neither of which is a C# type. They now emit `object` and `void`. Also adds an `isCSharpValueType` util, since deciding whether a TypeSpec type maps to a C# struct is something every C# emitter needs and every C# emitter was reimplementing. --- Independent — targets `main` and can merge on its own. One of 7 PRs moving `@typespec/http-server-csharp` onto the emitter framework instead of its private forks: microsoft#11596, microsoft#11597, microsoft#11598, microsoft#11599, microsoft#11600, microsoft#11601, microsoft#11602.

A library that exposes decorators from a subpath export could not be built with `tspd`. Only the first `typespec` export was ever compiled, so decorators declared in a subpath entrypoint got no signatures at all — and there was no way to make them work: implementing them in the root `$decorators` trips the library linter and leaks them to consumers who never imported the subpath, while implementing them in the subpath's `$decorators` (the structurally correct place) produced a `.ts-test.ts` that failed to typecheck because it imported from the package root. Now each `exports` entry with a `typespec` condition is compiled on its own, and a decorator or function is attributed to the first export that reaches the file declaring it — so entities in the root entrypoint stay on the root even though `lib/streams/main.tsp` imports `../main.tsp` back. Signatures land in a directory matching the subpath and import from that same subpath: ``` generated-defs/MyLib.ts <- from `.`, imports from "my-lib" generated-defs/streams/MyLib.Streams.ts <- from `./streams`, imports from "my-lib/streams" ``` ```ts // generated-defs/streams/MyLib.Streams.ts-test.ts import { $decorators } from "my-lib/streams"; import type { MyLibStreamsDecorators } from "./MyLib.Streams.js"; const _decs: MyLibStreamsDecorators = $decorators["MyLib.Streams"]; ``` A subpath with a `typespec` condition but no JS condition now gets a warning instead of an unbuildable typecheck file. This also reverts the stop-gap from microsoft#8915 that disabled `additionalImports`. Fixes microsoft#8913. Along the way this fixes a latent path-identity bug: the same file resolves under different paths in different programs when reached through a symlink (pnpm workspace links, `/tmp` on macOS), which duplicated the root's decorators into every subpath. Paths are now compared via `host.realpath`. Regenerating the signatures of all 14 libraries plus the compiler's own script produces zero diff, so nothing shifts for existing single-export packages. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

@added

…oft#11551) Diagnostics referencing an operation's parameter printed the anonymous model expression, e.g. `TestService.{ param: TestService.Foo }.param`, which is neither stable nor traceable back to the operation. `getTypeName` had no way to resolve the "parent" of a parameters model expression, so it fell back to the generic anonymous-model rendering. ## Changes - **`getModelName` (`packages/compiler/src/core/helpers/type-name-utils.ts`)**: for an anonymous model, first attempt to resolve it as an operation's parameters. - **New `getOperationParametersName`**: walks the syntax tree (`ModelExpression` → `OperationSignatureDeclaration.parameters` → `OperationStatement`) to render `Namespace.op::parameters`, including the interface prefix when the operation is on an interface, and `op::parameters` under `nameOnly`. - Updated expectations in `packages/versioning/test/incompatible-versioning.test.ts` and the `@overload` case in `packages/compiler/test/decorators/decorators.test.ts`; added coverage in `type-name-utils.test.ts`. ## Example ```tsp namespace TestService; @added(Versions.v2) model Foo {} op test(param: Foo): void; ``` Before: ``` 'TestService.{ param: TestService.Foo }.param' is referencing versioned type 'TestService.Foo' but is not versioned itself. ``` After: ``` 'TestService.test::parameters.param' is referencing versioned type 'TestService.Foo' but is not versioned itself. ``` This also improves unrelated messages built on the same helper, e.g. `@overload` mismatches now read `Property 'param' is missing on type 'someUnrelatedThing::parameters' but required in 'someThing::parameters'`.  - Fixes microsoft#5863 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: timotheeguerin <1031227+timotheeguerin@users.noreply.github.com> Co-authored-by: Timothee Guerin <tiguerin@microsoft.com>

Names explicitly configured with `exact` could be replaced by names restored from the previous contract. This made advanced client naming overrides ineffective when back compatibility was enabled. - **Naming precedence** - Preserve exact names for service parameters and property-derived model factory and constructor parameters. - Continue restoring last-contract names for non-exact parameters. - **Model factories** - Treat exact-name-only differences as compatible signatures. - Avoid generating duplicate back-compat overloads. - Log when an exact rename is source breaking, since an overload cannot be added for it. - **Coverage** - Add regression cases for RestClient, model factory, model constructor, and enum naming paths. ```typespec @clientName(Azure.ClientGenerator.Core.exact("api_key"), "csharp") apiKey: string; ``` The generated C# declaration remains `api_key` even when the previous contract used another name. Note that `exact` controls the **declaration** name. Parameters *derived* from a property — model constructor and model factory parameters — still go through the usual `ToVariableName` transformation, so the example above yields a property `api_key` initialized from a parameter named `apiKey`. Method parameters declared directly in the spec are emitted verbatim (`api_key`). This PR does not change that transformation; it only ensures the configured spelling is never replaced by a previously-published name.  - Fixes microsoft#11640 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jorgerangel-msft <102122018+jorgerangel-msft@users.noreply.github.com> Co-authored-by: Jorge Rangel <jorgerangel@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

- [x] Add focused regression coverage requiring `files` for publishable packages - [x] Add minimal `files` allowlists to the 11 affected packages - [x] Verify package contents and run targeted checks - [x] Add changelog entries and complete review/security validation  - Fixes microsoft#11589 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: timotheeguerin <1031227+timotheeguerin@users.noreply.github.com> Co-authored-by: Timothee Guerin <tiguerin@microsoft.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Our workflows reference third-party and first-party actions by mutable tags (`actions/checkout@v7`, `pnpm/action-setup@v6`, …). A tag can be repointed at any commit, so anyone who can move a tag in one of those repos can silently run arbitrary code inside our CI — including on jobs that hold write tokens. Every `uses:` in `.github/` is now pinned to an immutable commit SHA, with the human-readable version kept as a trailing comment: ```yaml - uses: actions/checkout@3d3c42e # v7.0.1 ``` All pinned SHAs were verified to resolve from the tag they claim, and no unpinned `uses:` references remain. Picks up the action-pinning portion of microsoft#11730; the Dependabot `github-actions` ecosystem entry is intentionally left out of this PR. --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…soft#11773) ## Summary - preserve exact public GA property names when their date-time stems match the current MTG-normalized property - keep canonical MTG naming for new properties and when a GA name is incompatible or already claimed - keep customization suppression and canonical wire information associated with the correct spec property across preserved names, aliases, exact names, and refiltering - cover historical, canonical, projected-provider, collision, customization, and sibling-ownership scenarios - normalize `ExpireTime` and `ExpireOn` to `ExpiresOn` for new APIs, making `ExpireOn` and `ExpirationTime` share the semantic `Expires` stem Fixes microsoft#11772 ## Validation - `dotnet test packages/http-client-csharp/generator/Microsoft.TypeSpec.Generator/test/Microsoft.TypeSpec.Generator.Tests.csproj --no-restore --filter 'FullyQualifiedName~PropertyProviderTests|FullyQualifiedName~ModelCustomizationTests|FullyQualifiedName~CSharpNameExtensionsTests' -- NUnit.NumberOfTestWorkers=1` --------- Co-authored-by: Jorge Rangel <jorgerangel@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0a5e8332-8ebe-44b1-97c5-44cc31caf25e

…t#11793) ## Summary - continue processing response headers after omitting a constant header - suppress the constant-header warning only for `Content-Type` - add a response-header generation regression case ## Validation - `npm run build` - `npm run format` - `pnpm format` - `pnpm exec oxlint packages/http-client-java/emitter --type-aware --deny-warnings` - `npm run test:emitter` - `mvn test --define "test=tsptest.responseheaders.ResponseHeadersTests" --no-transfer-progress` Copilot-Session: bb07cf76-b69f-4640-87a7-8660a97e0d23

…microsoft#11789) Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/gh-aw/actions/setup-cli](https://github.com/github/gh-aw) | `0.83.4` | `0.87.3` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.2` | `4.0.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.3` | `4.37.8` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.3` | `4.37.8` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.3` | `4.37.8` | Updates `github/gh-aw/actions/setup-cli` from 0.83.4 to 0.87.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/gh-aw/releases">github/gh-aw/actions/setup-cli's releases</a>.</em></p> <blockquote> <h2>v0.87.2</h2> <h2>🌟 Release Highlights</h2> <p>This release strengthens sandbox security defaults, improves package/workflow update reliability, and ships a batch of linter, docs, and CI reliability fixes.</p> <h3>✨ What's New</h3> <ul> <li><strong>External threat detection enabled by default</strong> (<a href="https://redirect.github.com/github/gh-aw/pull/54111">#54111</a>) — workflows now get proactive threat-detection coverage out of the box, improving baseline security posture without extra configuration.</li> <li><strong>Cloud Hypervisor adopted across 58 agentic workflows</strong> (<a href="https://redirect.github.com/github/gh-aw/pull/54346">#54346</a>) — broader migration improves sandbox isolation and reliability for agentic runs.</li> <li><strong>Scoped ownership for package resources</strong> (<a href="https://redirect.github.com/github/gh-aw/pull/54120">#54120</a>) and <strong>re-resolved manifests during workflow updates</strong> (<a href="https://redirect.github.com/github/gh-aw/pull/54119">#54119</a>) — package dependencies stay accurate and correctly scoped as workflows evolve.</li> <li><strong>New <code>manualpathconcat</code> linter</strong> (<a href="https://redirect.github.com/github/gh-aw/pull/54307">#54307</a>) flags manual <code>/</code> path concatenation, catching a common class of path-handling bugs at compile time.</li> <li><strong>Support for runner groups in custom safe jobs</strong> (<a href="https://redirect.github.com/github/gh-aw/pull/53977">#53977</a>) gives more control over where custom safe-output jobs execute.</li> </ul> <h3>🐛 Bug Fixes & Improvements</h3> <ul> <li>Fixed the logs MCP tool silently truncating explicit date-range queries to a single stale day with no warning (<a href="https://redirect.github.com/github/gh-aw/pull/54110">#54110</a>).</li> <li>Fixed safe-output inline-backtick neutralization (<a href="https://redirect.github.com/github/gh-aw/pull/54103">#54103</a>) and JSON-array expressions in approve-workflow-run safe outputs (<a href="https://redirect.github.com/github/gh-aw/pull/53812">#53812</a>).</li> <li>Fixed a false-positive heredoc detection on bare <code>(( ))</code> arithmetic in the <code>generatedyamlheredoc</code> linter (<a href="https://redirect.github.com/github/gh-aw/pull/53991">#53991</a>).</li> <li>Hardened command argument validation for pip/uv checks and npm lockfile execution (<a href="https://redirect.github.com/github/gh-aw/pull/53957">#53957</a>), and added regression coverage for pip argv validation before exec (<a href="https://redirect.github.com/github/gh-aw/pull/54282">#54282</a>).</li> <li>Fixed schedule-triggered workflow false positives and improved root-cause surfacing for disabled workflows in the health monitor (<a href="https://redirect.github.com/github/gh-aw/pull/53881">#53881</a>).</li> <li>Fixed <code>approve_workflow_run</code> handler load failure caused by an npm <code>minimatch</code> require (<a href="https://redirect.github.com/github/gh-aw/pull/54281">#54281</a>).</li> <li>Fixed actionlint error from an agent job referencing <code>needs.approval_allowlist</code> without a declared dependency (<a href="https://redirect.github.com/github/gh-aw/pull/54028">#54028</a>).</li> <li>Restored GHES-compatible artifact action pins (<a href="https://redirect.github.com/github/gh-aw/pull/53966">#53966</a>) and hardened post-agent cache Git commits (<a href="https://redirect.github.com/github/gh-aw/pull/53879">#53879</a>).</li> </ul> <h3>📚 Documentation</h3> <ul> <li>Clarified lock files and workflow setup commands (<a href="https://redirect.github.com/github/gh-aw/pull/54342">#54342</a>), documented compiler-generated job authentication (<a href="https://redirect.github.com/github/gh-aw/pull/54100">#54100</a>), and made Copilot auth docs easier to scan (<a href="https://redirect.github.com/github/gh-aw/pull/54337">#54337</a>).</li> <li>Documented PR fast-track triage criteria (<a href="https://redirect.github.com/github/gh-aw/pull/53880">#53880</a>) and closed non-Copilot engine parity gaps for <code>gh aw init</code> and custom engine frontmatter (<a href="https://redirect.github.com/github/gh-aw/pull/53834">#53834</a>).</li> <li>Added workflow wizard links to documentation (<a href="https://redirect.github.com/github/gh-aw/pull/53862">#53862</a>) and unbloated the network and safe-outputs PR references (<a href="https://redirect.github.com/github/gh-aw/pull/54104">#54104</a>, <a href="https://redirect.github.com/github/gh-aw/pull/53875">#53875</a>).> Generated by <a href="https://github.com/github/gh-aw/actions/runs/32420477557">🚀 Release</a> · auto · 16.2 AIC · ⊞ 11.7K</li> </ul>  <hr /> <h2>What's Changed</h2> <ul> <li>Redirect Astro wizard docs to hosted wizard by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53815">github/gh-aw#53815</a></li> <li>[test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe pkg/cli subtests by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/github/gh-aw/pull/53822">github/gh-aw#53822</a></li> <li>Add <code>review-agentic-workflows</code> skill for security-first workflow review and optimization triage by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53775">github/gh-aw#53775</a></li> <li>Remove hidden README and docs navigation text by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53816">github/gh-aw#53816</a></li> <li>Add workflow wizard links to documentation by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53862">github/gh-aw#53862</a></li> <li>[test-parallel] test: add t.Parallel() to TestCLIProxyBashDisabledCodemod subtests by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/github/gh-aw/pull/53845">github/gh-aw#53845</a></li> <li>pr-sous-chef: document GraphQL fetch for reviewThreads (fixes invalid gh pr view field) by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53833">github/gh-aw#53833</a></li> <li>docs: close non-Copilot engine parity gaps for <code>gh aw init</code> and custom engine frontmatter by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53834">github/gh-aw#53834</a></li> <li>Fix JSON-array expressions in approve workflow run safe outputs by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53812">github/gh-aw#53812</a></li> <li>[docs] docs: unbloat safe outputs PR reference by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/github/gh-aw/pull/53875">github/gh-aw#53875</a></li> <li>Fix chronic Smoke Copilot AOAI dispatch failure and cap per-run AI credits by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53817">github/gh-aw#53817</a></li> <li>[test-parallel] Add t.Parallel() to safe codemod test files (batch after codemod_factory_test.go) by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/github/gh-aw/pull/53887">github/gh-aw#53887</a></li> <li>Infer GitHub App permissions and events from resolved package workflows in add-wizard bootstrap by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53766">github/gh-aw#53766</a></li> <li>Document PR fast-track triage criteria by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53880">github/gh-aw#53880</a></li> <li>Fix schedule-triggered workflow false positives and surface disabled-workflow root cause in health monitor by <a href="https://github.com/pelikhan"><code>@pelikhan</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/github/gh-aw/pull/53881">github/gh-aw#53881</a></li> <li>[community] Update community contributions in README by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/github/gh-aw/pull/53893">github/gh-aw#53893</a></li> <li>[test-parallel] test: add t.Parallel() to safe pkg/cli tests (daily batch) by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/github/gh-aw/pull/53931">github/gh-aw#53931</a></li> <li>[eslint-miner] eslint: extend no-exec-interpolated-command to cover execApi parameter-alias calls by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/github/gh-aw/pull/53947">github/gh-aw#53947</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/gh-aw/commit/466b8ad27fcfaaa861da3f16ba7c01272df25f46"><code>466b8ad</code></a> Add npm registry access to daily-rendering-scripts-verifier network allowlist...</li> <li><a href="https://github.com/github/gh-aw/commit/734f391bab9e6f7bd46d4c75634a776fa6b4d6ae"><code>734f391</code></a> Add actionable guidance to shell completion rc-path errors (<a href="https://redirect.github.com/github/gh-aw/issues/54672">#54672</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/d52203c4030be63c7560c2431d6cc00b0ff10fc6"><code>d52203c</code></a> Add step-level failure attribution to Detection Analysis Report (Rule 3) (<a href="https://redirect.github.com/github/gh-aw/issues/54">#54</a>...</li> <li><a href="https://github.com/github/gh-aw/commit/6d315d0ca5f30d01c96275ac51aea68f5bbd02a4"><code>6d315d0</code></a> Include file path in pkg/parser wrapper errors (<a href="https://redirect.github.com/github/gh-aw/issues/54648">#54648</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/d11b06c3282cd59b9b27c7ad0b9878351dc38d3b"><code>d11b06c</code></a> [test-parallel] Daily Go Test Parallelizer: add t.Parallel() to safe subtests...</li> <li><a href="https://github.com/github/gh-aw/commit/8dcf60674efe3fccf7632fc6c7c6699c19711b29"><code>8dcf606</code></a> Paginate daily performance data through its 90-day window (<a href="https://redirect.github.com/github/gh-aw/issues/54679">#54679</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/2512707a3994811fe0d357b0446c1041c4fe047a"><code>2512707</code></a> docs: unbloat workflow structure reference (<a href="https://redirect.github.com/github/gh-aw/issues/54676">#54676</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/80a44d777dd097c7f4455162764590f66937d6f6"><code>80a44d7</code></a> [WIP] Fix failing GitHub Actions job js-integration-live-api (<a href="https://redirect.github.com/github/gh-aw/issues/54650">#54650</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/03f65d873e81677ccda1d73e5d2a5717da501c12"><code>03f65d8</code></a> Add regression coverage for CLI strict-mode default (<a href="https://redirect.github.com/github/gh-aw/issues/54657">#54657</a>)</li> <li><a href="https://github.com/github/gh-aw/commit/0923f14283a6002ed0b78f4486147c54082fa252"><code>0923f14</code></a> Fail compilation when safe-outputs step-output token references cannot resolv...</li> <li>Additional commits viewable in <a href="https://github.com/github/gh-aw/compare/bbb8042878459948333b15b66f27113f4b5c1b9a...466b8ad27fcfaaa861da3f16ba7c01272df25f46">compare view</a></li> </ul> </details> <br /> Updates `dorny/paths-filter` from 4.0.2 to 4.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update Outputs in readme to account for the 'every' predicate-quantifier by <a href="https://github.com/hintron"><code>@hintron</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li>fix: scope base-ignored warning to API path by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/319">dorny/paths-filter#319</a></li> <li>docs: add contents permission to PR example by <a href="https://github.com/134130"><code>@134130</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li>feat: add 'some-with-excludes' predicate quantifier by <a href="https://github.com/arxeiss"><code>@arxeiss</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> <li>Document safe handling of file list outputs in workflows by <a href="https://github.com/dorny"><code>@dorny</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/326">dorny/paths-filter#326</a></li> </ul> <h2>Security</h2> <ul> <li>Escape multi-line filenames in list-files shell and csv output] by <a href="https://github.com/ken-matsui"><code>@ken-matsui</code></a> and <a href="https://github.com/tjswlsgg"><code>@tjswlsgg</code></a> in <a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">https://github.com/advisories/GHSA-7hc6-8hq5-9q2m</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hintron"><code>@hintron</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li><a href="https://github.com/134130"><code>@134130</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li><a href="https://github.com/arxeiss"><code>@arxeiss</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4...v4.0.3">https://github.com/dorny/paths-filter/compare/v4...v4.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/326">Document safe handling of file list outputs in workflows</a></li> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/322">Add 'some-with-excludes' predicate quantifier</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/248">Add contents permission to PR example</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/319">Scope base-ignored warning to API path</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/247">Update outputs in readme to account for the 'every' predicate-quantifier</a></li> </ul> <h2>v4.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/317">Work around git dubious ownership errors in container jobs</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/303">Use rev-parse instead of branch --show-current for older git compat</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/282">Fix warning message</a></li> </ul> <h2>v4.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/255">Support merge queue</a></li> </ul> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/294">Update action runtime to node24</a></li> </ul> <h2>v3.0.4</h2> <ul> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> </ul> <h2>v3.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/279">Add missing predicate-quantifier</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/224">Add config parameter for predicate quantifier</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/133">Compare base and ref when token is empty</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/210">Update to Node.js 20</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/215">Update all dependencies</a></li> </ul> <h2>v2.11.1</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/167">Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/168">Document need for pull-requests: read permission</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/164">Updating to actions/checkout@v3</a></li> </ul> <h2>v2.11.0</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/157">Set list-files input parameter as not required</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/161">Update Node.js</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/162">Fix incorrect handling of Unicode characters in exec()</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/163">Use Octokit pagination</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/160">Updates real world links</a></li> </ul> <h2>v2.10.2</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d"><code>ceb8a2b</code></a> Update CHANGELOG.md for v4.0.3 and v3.0.4 (<a href="https://redirect.github.com/dorny/paths-filter/issues/327">#327</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/ef09b88f3eacdbec6ce135a7c9a193a6849545c1"><code>ef09b88</code></a> Document safe handling of file list outputs in workflows (<a href="https://redirect.github.com/dorny/paths-filter/issues/326">#326</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/44adc5b06dc135dba334efce9bf3cf0624512d2d"><code>44adc5b</code></a> Merge commit from fork</li> <li><a href="https://github.com/dorny/paths-filter/commit/4711b7a31b4aa89103d8c6ffab2e3b8e7b6381c7"><code>4711b7a</code></a> feat: add 'some-with-excludes' predicate quantifier (<a href="https://redirect.github.com/dorny/paths-filter/issues/322">#322</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/93c889f9e58fca66f35a0c83d8673ac7e88bb70a"><code>93c889f</code></a> fix: escape multi-line filenames in list-files shell and csv output</li> <li><a href="https://github.com/dorny/paths-filter/commit/b41dfa943b1939b9b646f67753bfe35cf6e4de03"><code>b41dfa9</code></a> docs: add contents permission to PR example (<a href="https://redirect.github.com/dorny/paths-filter/issues/248">#248</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/9af6e5a9d010d1ae8ec570390b3d793e2b70a402"><code>9af6e5a</code></a> fix: scope base-ignored warning to API path (<a href="https://redirect.github.com/dorny/paths-filter/issues/319">#319</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/cae9006b65a1a53044b518c68e13e835c54948a7"><code>cae9006</code></a> docs: update outputs in readme to account for the 'every' predicate-quantifie...</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/7b450fff21473bca461d4b92ce414b9d0420d706...ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.3 to 4.37.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.8</h2> <p>No user facing changes.</p> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"><code>db488dd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4102">#4102</a> from github/update-v4.37.8-9ee088e13</li> <li><a href="https://github.com/github/codeql-action/commit/1845f5ba8b4057590f49ee8e246c95ef2ba4b53f"><code>1845f5b</code></a> Update changelog for v4.37.8</li> <li><a href="https://github.com/github/codeql-action/commit/9ee088e13615f8d1eaef4766f9dde95d3356a8f6"><code>9ee088e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4080">#4080</a> from github/henrymercer/studious-giggle</li> <li><a href="https://github.com/github/codeql-action/commit/1aef003397c876c0ab5bd118e1b1f34c175622e9"><code>1aef003</code></a> Address review feedback on overlay disk flags</li> <li><a href="https://github.com/github/codeql-action/commit/508b83bc415e8df76ce8ea08c0cf42c2529ebc63"><code>508b83b</code></a> Merge main into overlay minimum disk feature branch</li> <li><a href="https://github.com/github/codeql-action/commit/d97b3428e8eebbb1810cf454d6397886d136b4ba"><code>d97b342</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4098">#4098</a> from github/mbg/permission-error-as-configuration-error</li> <li><a href="https://github.com/github/codeql-action/commit/47fa6222231b12097f83215dd7a6b4a0915841fd"><code>47fa622</code></a> Make <code>EACCES</code> a <code>ConfigurationError</code></li> <li><a href="https://github.com/github/codeql-action/commit/45693cc6882bb175b58a06818c91876e201037c7"><code>45693cc</code></a> Refactor <code>ENOSPC</code> check into <code>isDiskConfigurationError</code> function</li> <li><a href="https://github.com/github/codeql-action/commit/c2fd8f54d19fa46c94ed79cb92e6dd6606d61762"><code>c2fd8f5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4081">#4081</a> from github/mario-campos/version-cache-to-disk</li> <li><a href="https://github.com/github/codeql-action/commit/c56f48e9bd458a387eb68a68534459e503e56b17"><code>c56f48e</code></a> Log unexpected conditions during caching CLI output</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.37.3 to 4.37.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.37.8</h2> <p>No user facing changes.</p> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"><code>db488dd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4102">#4102</a> from github/update-v4.37.8-9ee088e13</li> <li><a href="https://github.com/github/codeql-action/commit/1845f5ba8b4057590f49ee8e246c95ef2ba4b53f"><code>1845f5b</code></a> Update changelog for v4.37.8</li> <li><a href="https://github.com/github/codeql-action/commit/9ee088e13615f8d1eaef4766f9dde95d3356a8f6"><code>9ee088e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4080">#4080</a> from github/henrymercer/studious-giggle</li> <li><a href="https://github.com/github/codeql-action/commit/1aef003397c876c0ab5bd118e1b1f34c175622e9"><code>1aef003</code></a> Address review feedback on overlay disk flags</li> <li><a href="https://github.com/github/codeql-action/commit/508b83bc415e8df76ce8ea08c0cf42c2529ebc63"><code>508b83b</code></a> Merge main into overlay minimum disk feature branch</li> <li><a href="https://github.com/github/codeql-action/commit/d97b3428e8eebbb1810cf454d6397886d136b4ba"><code>d97b342</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4098">#4098</a> from github/mbg/permission-error-as-configuration-error</li> <li><a href="https://github.com/github/codeql-action/commit/47fa6222231b12097f83215dd7a6b4a0915841fd"><code>47fa622</code></a> Make <code>EACCES</code> a <code>ConfigurationError</code></li> <li><a href="https://github.com/github/codeql-action/commit/45693cc6882bb175b58a06818c91876e201037c7"><code>45693cc</code></a> Refactor <code>ENOSPC</code> check into <code>isDiskConfigurationError</code> function</li> <li><a href="https://github.com/github/codeql-action/commit/c2fd8f54d19fa46c94ed79cb92e6dd6606d61762"><code>c2fd8f5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4081">#4081</a> from github/mario-campos/version-cache-to-disk</li> <li><a href="https://github.com/github/codeql-action/commit/c56f48e9bd458a387eb68a68534459e503e56b17"><code>c56f48e</code></a> Log unexpected conditions during caching CLI output</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.8</h2> <p>No user facing changes.</p> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"><code>db488dd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4102">#4102</a> from github/update-v4.37.8-9ee088e13</li> <li><a href="https://github.com/github/codeql-action/commit/1845f5ba8b4057590f49ee8e246c95ef2ba4b53f"><code>1845f5b</code></a> Update changelog for v4.37.8</li> <li><a href="https://github.com/github/codeql-action/commit/9ee088e13615f8d1eaef4766f9dde95d3356a8f6"><code>9ee088e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4080">#4080</a> from github/henrymercer/studious-giggle</li> <li><a href="https://github.com/github/codeql-action/commit/1aef003397c876c0ab5bd118e1b1f34c175622e9"><code>1aef003</code></a> Address review feedback on overlay disk flags</li> <li><a href="https://github.com/github/codeql-action/commit/508b83bc415e8df76ce8ea08c0cf42c2529ebc63"><code>508b83b</code></a> Merge main into overlay minimum disk feature branch</li> <li><a href="https://github.com/github/codeql-action/commit/d97b3428e8eebbb1810cf454d6397886d136b4ba"><code>d97b342</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4098">#4098</a> from github/mbg/permission-error-as-configuration-error</li> <li><a href="https://github.com/github/codeql-action/commit/47fa6222231b12097f83215dd7a6b4a0915841fd"><code>47fa622</code></a> Make <code>EACCES</code> a <code>ConfigurationError</code></li> <li><a href="https://github.com/github/codeql-action/commit/45693cc6882bb175b58a06818c91876e201037c7"><code>45693cc</code></a> Refactor <code>ENOSPC</code> check into <code>isDiskConfigurationError</code> function</li> <li><a href="https://github.com/github/codeql-action/commit/c2fd8f54d19fa46c94ed79cb92e6dd6606d61762"><code>c2fd8f5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4081">#4081</a> from github/mario-campos/version-cache-to-disk</li> <li><a href="https://github.com/github/codeql-action/commit/c56f48e9bd458a387eb68a68534459e503e56b17"><code>c56f48e</code></a> Log unexpected conditions during caching CLI output</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…rsive types (microsoft#11779) `isTypeAssignableToInternal` created a brand new relation cache for every nested call instead of forwarding the one it was given, so the "in progress" entry seeded by `areModelsRelated` only survived a single level. Two mutually recursive models therefore recursed forever. Unions were never seeded at all, so any union reaching itself did the same. This reproduces on `main` today through a regular template constraint, so it can be pasted directly into the playground: ```typespec model SourceA { b: SourceB; } model SourceB { a: SourceA; } model TargetA { b: TargetB; } model TargetB { a: TargetA; } model Constrained<T extends TargetA> {} alias Result = Constrained<SourceA>; ``` The compiler crashes with `RangeError: Maximum call stack size exceeded`. ## What changed - `isTypeAssignableToInternal` now forwards the `relationCache` it was given instead of allocating a fresh one. - The cache stores `[Related, errors]` instead of just `Related`. Forwarding the cache alone was not safe: the old code returned `[cached, []]` and `areModelsRelated` turns a result with no errors back into `Related.true`, so a cached `false` would flip to `true`. - The source-union branch of `isTypeAssignableToWorker` and `isAssignableToUnion` now seed the cache before walking variants, the same way `areModelsRelated` already did. ## Semantics of a cyclic union A purely cyclic union such as `union Loop { self: Loop }` has no way to produce a value, so it describes the empty set and is vacuously assignable to anything, exactly like `never`. That is why the source side is seeded with `Related.maybe`. The target side is the dual: being assignable *to* a union only requires one variant to match, so a cycle brings no new information and is seeded with `Related.false`. ## Validation - `tsc -p tsconfig.build.json --noEmit` clean - 4,121 compiler tests pass, including a playground-style regression test verified to fail with the exact stack overflow on the pre-fix checker - `@typespec/openapi3` 2,578 tests pass, plus http, json-schema, versioning, rest, events, sse, streams, and xml - `pnpm lint` clean --generated by Copilot --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: be5c2e95-cfc7-417c-bc70-b34cf66bbea4

…rosoft#11744) # fix(compiler,openapi): keep object value members named `__proto__` Fixes microsoft#11743 ## What is broken and why When the compiler marshals an object value for a decorator, `objectValueToJs` in `packages/compiler/src/core/js-marshaller.ts` (lines 88 to 94 on main) added each member with a plain assignment: ```ts const result: Record<string, unknown> = {}; for (const [key, value] of type.properties) { result[key] = marshalTypeForJs(value.value, undefined); } return result; ``` For a member named `__proto__` that assignment does not create a property. It invokes the `Object.prototype.__proto__` setter instead. Two things follow: * The member never reaches the decorator, and no diagnostic reports it. * When the member holds an object or an array, that value becomes the prototype of the marshalled object, so a decorator that reads any name it did not declare can read the author's data (`value.polluted === true` with `polluted` not an own property). The checker stores object value members in a `Map` (`checkObjectLiteralProperties` in `checker.ts`), and `unmarshalJsToValue` in the same marshaller file already builds a `Map` from entries, so this loop was the only place in the compiler where the member was lost. The issue reproduces through `@extension` from `@typespec/openapi`, and that path has a second copy of the same pattern. `convertRemainingValuesToExtensions` in `packages/openapi/src/decorators.ts` (lines 101 to 108 on main) rebuilds the object it receives from the compiler with `Object.entries` followed by `result[key] = ...`. Once the compiler hands it an object with an own `__proto__` property, `Object.entries` lists that key and the assignment hits the setter again, so the extension stored by the decorator lost the member and had its prototype replaced in exactly the same way. Fixing only the compiler would not have changed the output of the issue's playground. ## The fix Both sites now build the object with `Object.fromEntries`, which defines every member as an own enumerable data property (it uses CreateDataProperty) and never consults the setter. `packages/compiler/src/core/js-marshaller.ts`: ```ts function objectValueToJs(type: ObjectValue): Record<string, unknown> { // Object.fromEntries defines each member as an own property, so a member named `__proto__` // is kept instead of going through the Object.prototype setter and being dropped. return Object.fromEntries( [...type.properties].map(([key, value]) => [key, marshalTypeForJs(value.value, undefined)]), ); } ``` `packages/openapi/src/decorators.ts`, in the plain object branch of `convertRemainingValuesToExtensions`: ```ts return Object.fromEntries( Object.entries(value) .filter(([, val]) => val !== undefined) .map(([key, val]) => [key, convertRemainingValuesToExtensions(program, val)]), ); ``` The openapi copy keeps its existing behaviour of skipping `undefined` values, and the nested case was already handled by recursion. The result still inherits from `Object.prototype` in both places. `Object.create(null)` was deliberately not used because it would change the prototype of every object handed to every decorator, which is a larger behaviour change than the bug warrants. `Object.fromEntries` was preferred over `Object.defineProperty` because it reads like the surrounding code (`unmarshalJsToValue` already uses it) and needs no descriptor flags. Change entries: one `fix` entry for `@typespec/compiler` and a separate `fix` entry for `@typespec/openapi`, as the repository guidelines ask for one entry per package. `chronus verify` reports both packages documented. ## Testing ### Reproduction before the fix End to end through `@extension`, compiled with the openapi test host (`Tester.compile`) and read back with `getExtensions`, using the three cases from the issue. With the compiler fix applied but `@typespec/openapi` untouched, the stored extensions measured: ``` x-a-object: ownKeys=["ok"] hasOwn(__proto__)=false protoIsObjectPrototype=false prototypeOwnNames=["polluted"] value.polluted=true x-b-string: ownKeys=["ok"] hasOwn(__proto__)=false protoIsObjectPrototype=true value.polluted=undefined x-c-control: ownKeys=["normal","ok"] hasOwn(__proto__)=false protoIsObjectPrototype=true value.polluted=undefined ``` So the compiler change alone did not reach the reporter's output. On pristine main the decorator argument itself measured the same way (`ownKeys=["ok"]`, `prototypeOwnNames=["polluted"]`, `arg.polluted === true` for the object case; `ownKeys=["ok"]` for the string case). With both fixes: ``` x-a-object: ownKeys=["__proto__","ok"] hasOwn(__proto__)=true protoIsObjectPrototype=true value.polluted=undefined x-b-string: ownKeys=["__proto__","ok"] hasOwn(__proto__)=true protoIsObjectPrototype=true value.polluted=undefined x-c-control: ownKeys=["normal","ok"] hasOwn(__proto__)=false protoIsObjectPrototype=true value.polluted=undefined ``` ### New tests `packages/compiler/test/checker/decorators.test.ts` (under `value marshalling > passing an object value`): * keeps a member named `__proto__` holding a string as an own property * keeps a member named `__proto__` holding an object as an own property `packages/openapi/test/decorators.test.ts` (under `@extension`): * keeps a member named `__proto__` holding a string as an own property * keeps a member named `__proto__` holding an object as an own property Each test asserts `Object.prototype.hasOwnProperty.call(value, "__proto__")`, `Object.keys(value)` equals `["__proto__", "ok"]`, the member's value, that `Object.getPrototypeOf(value) === Object.prototype`, and for the object case that `value.polluted` is `undefined`. ### Commands and counts All runs use `npx vitest run` (vitest 4.1.10) from the package directory. The openapi tests execute the compiler and the openapi decorator from their `dist` builds, so `tsc -p tsconfig.build.json` was run in both packages before each openapi run. | Run | Command | Result | | --- | --- | --- | | Compiler, pristine main, full suite | `packages/compiler`: `npx vitest run` | 160 files passed, 4107 passed, 6 skipped (4113) | | Compiler, new tests against main's `js-marshaller.ts` (file restored from `a791115b`) | `npx vitest run test/checker/decorators.test.ts` | 2 failed, 75 passed (77); the two failures are the new `__proto__` tests, failing at the `hasOwnProperty` assertion | | Compiler, with fix | `npx vitest run test/checker/decorators.test.ts` | 77 passed (77) | | Compiler, with fix, full suite | `npx vitest run` | 160 files passed, 4109 passed, 6 skipped (4115) | | OpenAPI, before openapi fix (compiler fix present), full suite | `packages/openapi`: `npx vitest run` | 3 files passed, 64 passed (64) | | OpenAPI, new tests with `src/decorators.ts` stashed and `dist` rebuilt | `npx vitest run test/decorators.test.ts` | 2 failed, 54 passed (56); the two failures are the new `__proto__` tests, failing at the `hasOwnProperty` assertion | | OpenAPI, with fix | `npx vitest run test/decorators.test.ts` | 56 passed (56) | | OpenAPI, with fix, full suite | `npx vitest run` | 3 files passed, 66 passed (66) | ### Lint and formatting * `prettier --check` on the four changed source files and the two change entries: clean. * `oxlint --deny-warnings` on the four changed source files: no findings. * `cspell` on all six changed files: 0 issues. * `chronus verify`: all changed packages documented (`@typespec/compiler`, `@typespec/openapi`). * `tsc -p tsconfig.build.json` in `packages/compiler` and `packages/openapi`: clean. * `oxlint . --deny-warnings` (the `pnpm lint` script) in `packages/openapi`: exit 0, no findings. The same oxlint invocation was checked to report a `debugger;` statement (exit 1), so it is actually linting. * `tsp compile . --warn-as-error --import @typespec/library-linter --no-emit` (the `lint-typespec-library` build step) in `packages/openapi`: compilation completed successfully. ## Notes for reviewers * The fix is bounded to what the compiler and `@extension` hand over. A decorator that copies its argument with `Object.assign(target, arg)` or a `for ... in` loop with assignment will trigger the setter again on its own copy, because those use `[[Set]]`. Object spread and `Object.fromEntries` do not, so copies made that way keep the member. * Three other places in the compiler build plain objects from user chosen keys with assignment and were left alone because they are not on this issue's path: `serializeObjectValueAsJson` in `packages/compiler/src/lib/examples.ts` (line 161, model property or encoded names), the `Model` case of `typespecTypeToJsonInternal` in `packages/compiler/src/core/decorator-utils.ts` (line 262, model property names), and the argument record in `packages/compiler/src/core/auto-decorator.ts` (line 43, decorator parameter names). A model property or parameter literally named `__proto__` would hit the same setter there. Happy to handle them in this PR or a follow up if maintainers prefer. * Type aware oxlint (`--type-aware`) could only be run with `packages/compiler/dist` moved aside; with `dist` present it errors on a tsconfig input overlap for `dist/src/server/tmlanguage.d.ts` that is unrelated to this change. * Only the compiler, openapi, and their workspace dependency closures (http, rest, streams, library-linter, tspd and the internal build utilities) were installed and built locally; the rest of the monorepo was not built or tested, and `pnpm lint` and `pnpm format:check` were run per file rather than at the monorepo root.

Co-authored-by: iscai-msft <isabellavcai@gmail.com>

## Summary - rename hidden Java protocol methods to use the `WithResponseInternal` suffix - preserve protocol generation configuration separately from operation access - correctly route sync-over-async protocol methods to the renamed async implementation - regenerate affected Java test clients and add focused protocol-disabled coverage - update the stale Java emitter lint scripts from ESLint to Oxlint ## Validation - focused `@protocolAPI(false)` generation and tests - focused `internalApi` naming regression test - focused data-plane sync-over-async generation - full `http-client-generator-test` regeneration - full Java test suite: 799 tests passed, 32 skipped - Java emitter build, formatting, and Oxlint ## Dependency audit `npm audit` reports one existing high-severity transitive advisory for `nanoid@3.3.17` through `vitest -> vite -> postcss`. The available fix updates it to `3.3.18`; it is not included in this PR. Part of microsoft#10742. --------- Copilot-Session: e5dff7f2-5849-4374-b6b3-9c7177834a21

Not for merge. Written record of the throwaway spikes run before proposing Phase 1 of microsoft#10551. - spike/README.md - consolidated go/no-go writeup - spike/FINDINGS-declaration-symbols.md - can `when` on declarations avoid symbol splitting? Structurally divergent variants: NO (the checker has one type slot per symbol and drops variants silently). Present-or-absent gating: qualified yes, zero checker changes. - spike/FINDINGS-cross-scope-validation.md + spike/scope-algebra.ts - runnable prototype generalising versioning's availability check to K orthogonal dimensions via set containment. Also demonstrates a real bug in shipping @typespec/versioning. Run the prototype with `node spike/scope-algebra.ts`.

tadelesh and others added 30 commits July 20, 2026 14:30

[specs] add sse tests (microsoft#11239)

8d47733

fixes microsoft#6870 --------- Co-authored-by: iscai-msft <isabellavcai@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Bump prettier and format [skip chg] (microsoft#11332)

feafcd0

Splitting from the rest of dep upgrade as it creates a lot of diff

[python] release new version (microsoft#11333)

ef65dbd

JoshLove-msft and others added 29 commits August 25, 2026 21:31

[python] bump for release (microsoft#11797)

2b5b32a

Co-authored-by: iscai-msft <isabellavcai@gmail.com>

timotheeguerin mentioned this pull request Sep 1, 2026

Versioning misses a reference to a type removed before the referrer, emitting a dangling ref with no diagnostic microsoft/typespec#11807

Closed

Navigation Menu

Repository navigation

spike: `when` conditional-scoping feasibility evidence (throwaway, not for merge) - #32

spike: `when` conditional-scoping feasibility evidence (throwaway, not for merge)#32
timotheeguerin wants to merge 631 commits into
mainfrom
spike/when-feasibility

timotheeguerin commented Sep 1, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

timotheeguerin commented Sep 1, 2026

spike/FINDINGS-declaration-symbols.md

spike/scope-algebra.ts + spike/FINDINGS-cross-scope-validation.md

The correction that matters

Drive-by

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

`spike/FINDINGS-declaration-symbols.md`

`spike/scope-algebra.ts` + `spike/FINDINGS-cross-scope-validation.md`