chore(deps): update dotnet monorepo to 18.7.1

[thomhurst]

This PR contains the following updates:

Package	Change	Age	Confidence
Microsoft.Build (source)	18.6.3 → 18.7.1

---

Release Notes

dotnet/msbuild (Microsoft.Build)

v18.7.1

What's Changed

• Fix TraceEngine file contention deadlock in multithreaded mode by @​JanProvaznik in #​13446
• Remove duplicate test cases in MultithreadableTaskAnalyzer by @​Youssef1313 in #​13483
• Ensure ThreadSafeTaskAnalyzer.Tests is considered as a unit test project by @​Youssef1313 in #​13481
• Fix MSBuildTask0002 analyzer warnings in already-migrated tasks by @​JanProvaznik in #​13466
• Fix race conditions in task host path resolution by @​AR-May in #​13485
• Migrate ToolTask and Al task to TaskEnvironment API by @​OvesN in #​13423
• Bump main to 18.7, add vs18.6 to merge flow by @​MichalPavlik in #​13472
• Avoid allocations in GetHashCode implementations by @​DustinCampbell in #​13475
• Add PATs rotation to agentic workflow(s) by @​JanKrivanek in #​13496
• Fix ASP.NET WebSite projects to copy netstandard.dll facade when required by @​JanProvaznik in #​13058
• Migrate AspNetCompiler to TaskEnvironment API by @​OvesN in #​13424
• Add review workflow by @​JanKrivanek in #​13503
• Strengthen reviewer skill: add step-back analysis dimensions by @​JanProvaznik in #​13504
• Add 'Request Speedometer Perf Run' to VS experimental insertion build policies by @​Copilot in #​13505
• Remove duplicate @​ prefix from issueAuthor in GitOps by @​akoeplinger in #​13492
• Improve review aw by @​JanKrivanek in #​13510
• Migrates unit tests to use RoslynCodeTaskFactory to enable running tests under .NET Core by @​jankratochvilcz in #​13500
• Fix cross-AppDomain TaskItem modifier cache regression by @​DustinCampbell in #​13493
• Discourage review agent from approving PRs by @​JanKrivanek in #​13512
• Stop trying to deploy ValueTuple by @​rainersigwald in #​13507
• Ad-hoc re-sign bootstrap dotnet on macOS to prevent SIGKILL by @​jankratochvilcz in #​13513
• RoslynCodeTaskFactory: Log MSB3753 when task class does not implement ITask by @​jankratochvilcz in #​13517
• Update gh-aw (upon mcp policy changes) by @​JanKrivanek in #​13526
• Eliminate XmlChildNodes allocations in GetXmlNodeInnerContents by @​nareshjo in #​13509
• Fix telemetry allocation regression: per-engine collector ownership by @​JanProvaznik in #​13516
• Migrate to xunit.v3 by @​Youssef1313 in #​13482
• Fix stray brace in HandleBuildCancel trace string causing MSB1025 by @​Copilot in #​13535
• Bumping to 10.0.4 runtime packages by @​MichalPavlik in #​13533
• Remove early return in GetCanonicalForm, always call System.IO.Path by @​OvesN in #​13532
• Do not overwrite GetCopyToOutputDirectoryItemsDependsOn, just add new… by @​snechaev in #​13474
• Migrate GetReferenceAssemblyPaths task to TaskEnvironment API by @​OvesN in #​13495
• Stabilize ToolTaskThatTimeoutAndRetry test by @​rainersigwald in #​13489
• [automated] Merge branch 'vs18.6' => 'main' by @​github-actions[bot] in #​13506
• Add extra test assertions around tests by @​Youssef1313 in #​13536
• Add static eval for repo skills/agents via skill-validator by @​JanKrivanek in #​13537
• Migrate SGen task to Task environment API by @​OvesN in #​13457
• Fix TerminalLogger assert failure for metaproj files and cached project eval ID by @​OvesN in #​13480
• Filter out approving review from pr-reviewer agent by @​JanKrivanek in #​13553
• Use a unique task name per invocation to tabilize RoslynCodeTaskFactory_ReuseCompilation test by @​huulinhnguyen-dev in #​13551
• Brief doc on feedback/logging/data systems by @​rainersigwald in #​13554
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1388198 by @​dotnet-bot in #​13437
• Stage 3: Forward BuildProjectFile* callbacks from OOP TaskHost to worker node by @​JanProvaznik in #​13350
• Enable TaskHost Callbacks by default by @​JanProvaznik in #​13579
• Remove unactionable info from reviewer agent by @​JanKrivanek in #​13578
• Enlighten RequiresFramework35SP1Assembly task for multithreaded mode by @​jankratochvilcz in #​13575
• Make SdkResolver-provided environment variables take precedence over ambient environment by @​Copilot in #​12655
• Add dotnet/skills marketplace and enable plugins by @​Evangelink in #​13582
• The skills/agents check filters-in only touched files by @​JanKrivanek in #​13586
• Fix skill-validation workflow failing when agents directory is deleted by @​JeremyKuhne in #​13592
• [automated] Merge branch 'vs18.6' => 'main' by @​github-actions[bot] in #​13593
• Fix: Show source project in graph build errors for invalid project references by @​Copilot in #​12672
• Performance optimizations for EscapingUtilities by @​DustinCampbell in #​13426
• Refactor Tests using Dispose() Pattern in TastExecution Tests by @​AlesProkop in #​13584
• Unit testing skill by @​jankratochvilcz in #​13574
• Measure task host overhead in mt by @​OvesN in #​13555
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​13600
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​13624
• Document MSBuildTaskHost compatibility constraints by @​Copilot in #​13640
• Add codeowners entries to auto-request review from ClickOnce by @​rainersigwald in #​13641
• Exclude documentation and .github from CI triggers by @​Copilot in #​13214
• Add more multithreaded tests by @​AR-May in #​12994
• Migrate GetInstalledSDKLocations to Task Environment API by @​OvesN in #​13564
• Move remaining CommunicationsUtilities to Microsoft.Build.Framework by @​DustinCampbell in #​13547
• Add support for Haiku by @​trungnt2910 in #​13607
• Removed WMI due to performance by @​MichalPavlik in #​13610
• Migrate manifest-handling tasks to TaskEnvironment API by @​JanProvaznik in #​13177
• [automated] Merge branch 'vs18.6' => 'main' by @​github-actions[bot] in #​13654
• Final branding for 18.7 release by @​SimaTian in #​13658
• Bump version prefix from 18.7.0 to 18.7.1 by @​rainersigwald in #​13664

New Contributors

• @​snechaev made their first contribution in #​13474
• @​Evangelink made their first contribution in #​13582
• @​trungnt2910 made their first contribution in #​13607

Full Changelog: dotnet/msbuild@v18.6.3...v18.7.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[claude]

Dependency Update Review: Microsoft.Build 18.6.3 → 18.7.1

This is a straightforward patch/minor version bump of Microsoft.Build, used only in src/ModularPipelines.Build/ModularPipelines.Build.csproj (the internal build pipeline project, not a published package).

What's in 18.7.1

The release includes several notable fixes relevant to correctness and stability:

• Deadlock fix: Fix for TraceEngine file contention deadlock in multithreaded mode — this could affect parallel pipeline execution.
• Race condition fixes: Task host path resolution and cross-AppDomain TaskItem modifier cache regression fixes.
• Telemetry allocation regression fix.
• Performance improvements: Reduced allocations in GetHashCode implementations and XmlChildNodes.
• TaskHost callbacks enabled by default (Stage 3 OOP task host forwarding).

Impact Assessment

• Scope: Limited to the internal build runner (ModularPipelines.Build). This package is not referenced by any published/consumer-facing project.
• Risk: Low. The fixes in this release (deadlock, race conditions) are improvements — they reduce failure modes rather than introduce them.
• Breaking changes: None indicated in the release notes.

Verdict

No issues found. This is a safe, low-risk bump that brings stability and performance improvements to the build tooling. The auto-merge configuration is appropriate for this kind of routine dependency update.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	✅ 0 (≤ 20 complexity)

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}