Update dependency Microsoft.Build to 18.9.6

[thomhurst]

This PR contains the following updates:

Package	Change	Age	Confidence
Microsoft.Build (source)	18.8.2 → 18.9.6

---

Release Notes

dotnet/msbuild (Microsoft.Build)

v18.9.6

What's Changed

• [vs18.6] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13793
• [vs18.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13859
• [vs18.6] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13858
• [vs18.7] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13863
• CsWin32 follow-up: CLR metadata + TypeLib interop migration by @​JeremyKuhne in #​13853
• Update vmr-sb-validation.yml for Azure Pipelines by @​meghnave in #​13871
• Test: keep shell alive 15s in ToolTaskCanChangeCanonicalErrorFormat (#​13734) by @​jankratochvilcz in #​13878
• Add vs18.8 to merge-flow config by @​OvesN in #​13877
• Stable branding for 18.8 release by @​OvesN in #​13883
• Bump main to 18.9.0 after vs18.8 snap by @​OvesN in #​13880
• Avoid checkout in insertion pipeline by @​rainersigwald in #​13887
• Report actual launch path in MSB4216 for Runtime="NET" task host by @​ViktorHofer in #​13889
• Migrate Tlblmp and AxImp to Multithreaded Execution by @​AlesProkop in #​13708
• Replace ErrorUtilities assertion methods with Assumed API and BCL throw helpers by @​DustinCampbell in #​13790
• Fix CLR_E_SHIM_RUNTIMELOAD in RAR's IMetaDataDispenser activation by @​JeremyKuhne in #​13899
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​13905
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13907
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​13910
• [vs17.14] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13908
• [vs18.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13906
• Fix ToolTask output loss: increase EOF pipe timeout from 2s to 30s by @​huulinhnguyen-dev in #​13767
• Improve symlink cycle condition by @​GangWang01 in #​13901
• [vs18.6] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13904
• Add flaky-test detection and auto-fix agentic workflows by @​ViktorHofer in #​13915
• Quote --ignore-exit-code values so the quarantine pipeline does not shell-split on Unix by @​ViktorHofer in #​13918
• Fix flaky-test detector PR-evidence loss and raise scan limits by @​ViktorHofer in #​13919
• Tighten the pr review agent by @​JanKrivanek in #​13921
• Add environment variables for governance detection by @​ViktorHofer in #​13920
• Change IsPackable to true and add IsShipping flag by @​ViktorHofer in #​13924
• [vs18.7] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13911
• Make flaky detector verify recurrence postdates the fix before commenting by @​ViktorHofer in #​13930
• Fix AbsolutePath.GetCanonicalForm process state leak on Windows by @​OvesN in #​13788
• Fix flaky detector: unblock dnceng feed, fail fast, and defer quarantine to a second run by @​ViktorHofer in #​13936
• Update documentation for ImplicitUsings element by @​drewnoakes in #​13900
• [vs18.6] Point OptProf bootstrapper at rel/stable instead of int.main by @​AlesProkop in #​13923
• Add CS8618 suppressor for required MSBuild task properties by @​AArnott in #​13926
• Tighten NodeLaunchData.EnvironmentOverrides nullability to IDictionary<string, string?>? by @​OvesN with @​Copilot in #​13815
• Fix ToolTask EOF wait to be STA-safe via CountdownEvent (MSB4018 in AspNetCompiler) by @​YuliiaKovalova in #​13917
• [automated] Merge branch 'vs18.6' => 'vs18.7' by @​github-actions[bot] in #​13941
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1419225 by @​dotnet-bot in #​13849
• Bumping to 10.0.8 runtime packages by @​OvesN in #​13898
• Flaky-test workflow: reassure on empty PR list + drop local reproduction (quarantine-first) by @​ViktorHofer in #​13938
• [Flaky Test] Un-quarantine 5 consistently-green tests by @​github-actions[bot] in #​13952
• Flaky-test detector: open PRs ready-for-review; drop newly-filed-issues section from PR body by @​ViktorHofer in #​13958
• [Flaky Test] Quarantine 4 flaky tests by @​github-actions[bot] in #​13937
• Flaky-test: fix duplicate-issue bug by switching dedup key to a visible code-block key by @​ViktorHofer in #​13963
• CsWin32 follow-up: WindowsNative + VS Setup Configuration + remaining hand-rolled interop by @​JeremyKuhne in #​13872
• Add the reviewer release skill checking if the Learn article Change waves is updated by @​GangWang01 in #​13840
• [main] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​13977
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​13987
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13983
• [Flaky Test] Un-quarantine 5 flaky tests confirmed green in quarantine pipeline by @​github-actions[bot] in #​13979
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​13982
• [vs17.14] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13985
• [vs18.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13984
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1430919 by @​dotnet-bot in #​13957
• Add parentheses in capacity calculation by @​jnyrup in #​13980
• [vs18.6] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​13981
• Dedup target list in ProjectGraph.ExpandDefaultTargets to prevent graph explosion by @​dfederm in #​13855
• [vs18.7] Revert "Fix ToolTask hang when grandchild processes inherit pipe handles (#​13351)" by @​JanProvaznik in #​13945
• chore: Pin GitHub Actions to commit SHAs by @​pgoslatara in #​13269
• [vs18.7] Fix OptProf bootstrapper channel: use 'release' not 'stable' by @​JanProvaznik in #​13993
• [vs18.6] Fix OptProf bootstrapper channel: use 'release' not 'stable' by @​JanProvaznik in #​13992
• Enabling weekly Dependabot updates for GitHub Actions by @​rainersigwald with @​Copilot in #​13999
• [vs18.6] Fix OptProf bootstrapper channel: use 'int.stable' not 'release' by @​JanProvaznik in #​14005
• [vs18.7] Fix OptProf bootstrapper channel: use 'int.stable' not 'release' by @​JanProvaznik in #​14006
• Bump actions/download-artifact from 4 to 8 by @​dependabot[bot] in #​14000
• Bump actions/cache from 4 to 5 by @​dependabot[bot] in #​14001
• Bump actions/github-script from 7 to 9 by @​dependabot[bot] in #​14004
• Update release-checklist.md by @​OvesN in #​13754
• Bump and pin actions/checkout from 3.6.0 to v6.0.3 SHA by @​dependabot[bot] in #​14003
• Bump github/gh-aw-actions from 0.77.5 to 0.78.3 by @​dependabot[bot] in #​14002
• Source bootstrap dotnet-install script from a repo-local path by @​JanProvaznik in #​14011
• Raise un-quarantine bar to 50 distinct builds / 14 days by @​ViktorHofer in #​14009
• Replace Csc task with Roslyn API in FileTrackerTests by @​huulinhnguyen-dev in #​13094
• Introduce Copilot PAT rotation to agentic workflows by @​JanKrivanek in #​14013
• Fix Expert Code Review (on open) failing with git checkout error by @​JanKrivanek in #​14018
• CsWin32 follow-up: ComReference family + typelib registration interop by @​JeremyKuhne in #​13975
• Enable AOT/trim analyzers for Framework and StringTools by @​JeremyKuhne in #​14012
• Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​14021
• Enable AOT/trim analyzers for Utilities and Tasks by @​JeremyKuhne in #​14024
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​14022
• Release checklist: read shipped version from VS rel/stable; stop pinging in template by @​JanProvaznik in #​14017
• Update CsWin32 to 0.3.287 and remove interop workarounds by @​JeremyKuhne in #​14046
• Fix invalid cache action pins in Skill Validation workflow by @​rainersigwald with @​Copilot in #​14048
• Enablement of parallel project evaluation by @​MichalPavlik in #​12757
• Launch the MSBuild server process with Server GC by @​JanProvaznik in #​14043
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14065
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14066
• Move core ProjectReferenceTargets from Managed-only to Common targets by @​dfederm in #​13427
• Use direct NuGet.Frameworks reference on .NET Core by @​rainersigwald in #​14047
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1439012 by @​dotnet-bot in #​14074
• [Flaky Test] Un-quarantine 2 consistently-green drive enumeration tests by @​github-actions[bot] in #​14076
• Expose import tree as MSBuildImportedProject items by @​drewnoakes in #​13681
• Add MSBuild Coordinator for fair-share node allocation by @​DustinCampbell in #​13653
• Improve MotW handling and clarify the MSB3821 by @​JanKrivanek in #​14015
• Localized file check-in by OneLocBuild Task: Build definition ID 9434: Build ID 1440159 by @​dotnet-bot in #​14080
• Package MT migration skill as a portable Copilot plugin + add MT migration reviewer agent by @​jankratochvilcz in #​14072
• Enable dotnet-msbuild plugin in settings by @​ViktorHofer in #​14083
• [Server] -mt implies MSBuild Server by @​JanProvaznik in #​13758
• Add mt-migration plugin to Copilot settings by @​ViktorHofer in #​14084
• MT reviewer: flag missing tests for substantive migrations by @​jankratochvilcz in #​14086
• [vs18.8] Replace ToolTask #​13351 revert with STA-safe EOF fix (#​13917) by @​JanProvaznik in #​14082
• [vs18.7] Replace ToolTask #​13351 revert with STA-safe EOF fix (#​13917) by @​JanProvaznik in #​14081
• Fix TerminalLogger auto-detection under MSBuild Server on Unix by @​JanProvaznik in #​14077
• Make IActivity.SetTag/SetTags return non-nullable IActivity by @​DustinCampbell in #​14091
• Make Runtime=NET task host handshake architecture-agnostic by @​ViktorHofer in #​13890
• Add MSBuild.Coordinator.exe.config files to VS layout by @​DustinCampbell in #​14101
• Default out-of-proc node pipe buffers to 1 MB (change wave 18.9) by @​JanProvaznik in #​14094
• Clean up Expander: split files, remove redundant type parameters, rename and restructure by @​DustinCampbell in #​14092
• Fix TaskParameterTaskItem.ToString() returning type name instead of item-spec by @​huulinhnguyen-dev in #​14095
• Disable Bootstrapper for vs17.14 by @​AlesProkop in #​14105
• [main] Update dependencies from nuget/nuget.client by @​dotnet-maestro[bot] in #​14124
• [main] Update dependencies from dotnet/roslyn by @​dotnet-maestro[bot] in #​14125
• Recognize C# record as a type in CreateCSharpManifestResourceName by @​OvesN with @​Copilot in #​13870
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​14123
• Set vs.file.ngenPriority for MSBuild.Coordinator.exe on x64 by @​DustinCampbell in #​14117
• Introduce mode for project graph construction to load entire graph by @​jeffkl in #​13717
• Removes unneeded pipeline by @​jankratochvilcz in #​14129
• Add directory-scoped agent instructions for deprecated MSBuildTaskHost code by @​rainersigwald with @​Copilot in #​14136
• Clean-up unnecessary compatibility polyfills and feature definitions. by @​teo-tsirpanis in #​12231
• Add MSBuild EventSource tracing documentation by @​vitek-karas in #​13961
• Fix DrainPacketQueue threads leaking by @​Erarndt in #​14135
• Add test pinning Returns capture before AfterTargets run by @​rainersigwald in #​14089
• Replace regex-based metadata expansion with manual scanning by @​DustinCampbell in #​14116
• [vs17.14] Redistribute net472 dotnet/runtime 10.0.8 servicing wave (Nrbf + HashCode 6.0) by @​JanProvaznik in #​14127
• Don't NGEN MSBuild.Coordinator.exe on x86 by @​DustinCampbell in #​14139
• Move ErrorUtilities_Tests to Assumed_Tests by @​DustinCampbell in #​14141
• Link Maestro flow wiki in release checklist step 5.5 by @​OvesN in #​14155
• Upgrade gh-aw to v0.79.8 and use copilot-pat-pool agentic environment by @​jeffhandley in #​14158
• Make property functions and reflection-heavy paths trim-compatible by @​JeremyKuhne in #​14079
• Add RequestThreadProc context to ETW events by @​vitek-karas in #​13978
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​14201
• Bump actions/cache/restore from 5.0.5 to 6.1.0 by @​dependabot[bot] in #​14200
• Bump github/gh-aw-actions/setup from 0.78.3 to 0.81.6 by @​dependabot[bot] in #​14199
• Bump actions/cache/save from 5.0.5 to 6.1.0 by @​dependabot[bot] in #​14198
• [Flaky Test] Quarantine 5 flaky tests (Windows-only) by @​github-actions[bot] in #​14197
• Fix NET task host MSB4216 handshake failure via child-side salt widening by @​ViktorHofer in #​14027
• Fix FindPublicMethodBySignature matching static methods for instance calls by @​lewing in #​14191
• ensure we build the analyzer in sourcebuild so downstream projects can use it by @​baronfel in #​14209
• [main] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14204
• Stable branding for 18.9 release by @​JanProvaznik in #​14218
• [vs18.9] Serialize BuildRequestConfiguration.RequestedTargets to fix solution metaproject MSB4057 in parallel builds by @​github-actions[bot] in #​14227
• [vs18.0] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14205
• [automated] Merge branch 'vs17.14' => 'vs18.0' by @​github-actions[bot] in #​14112
• [automated] Merge branch 'vs18.0' => 'vs18.6' by @​github-actions[bot] in #​14276
• [automated] Merge branch 'vs18.6' => 'vs18.7' by @​github-actions[bot] in #​14283
• [automated] Merge branch 'vs18.7' => 'vs18.8' by @​github-actions[bot] in #​14286
• [automated] Merge branch 'vs18.8' => 'vs18.9' by @​github-actions[bot] in #​14287
• [vs18.9] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14316
• [vs18.9] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14448
• [vs18.9] Update dependencies from dotnet/arcade by @​dotnet-maestro[bot] in #​14529
• [vs18.9] Source code updates from dotnet/dotnet by @​dotnet-maestro[bot] in #​14515

New Contributors

• @​meghnave made their first contribution in #​13871
• @​jnyrup made their first contribution in #​13980
• @​pgoslatara made their first contribution in #​13269
• @​lewing made their first contribution in #​14191

Full Changelog: dotnet/msbuild@v18.8.2...v18.9.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[coderabbitai]

Warning

Review limit reached

@thomhurst, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 5 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 354a5989-628d-4ef6-90ff-1fa97a8003ac

📥 Commits

Reviewing files that changed from the base of the PR and between cf36d10 and 3b81d5c.

📒 Files selected for processing (1)

• Directory.Packages.props

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Code review

This is an automated Renovate dependency-update PR. The diff is a single-line version bump in Directory.Packages.props (Microsoft.Build 18.8.2 → 18.9.6), a patch/minor release with no code changes on our side to review for design, architecture, or bugs.

No issues found. Checked for bugs and CLAUDE.md compliance — not applicable here since there are no source changes, only a package version bump.