$ the-wire · showcase
ROSLYN FIXES EDITOR SYNC, WPF TIGHTENS SECURITY
By RepoJournal · Filed · About .NET · Composed from the cited sources · methodology
Roslyn patched a critical textDocument notification handler that was dropping range information, breaking editor sync across the IDE.
The Roslyn team shipped a fix for textDocument/didChange notifications that weren't passing range data correctly [1], resolving a sync issue that could corrupt edits in real-time. This restores changes from an earlier PR with updated naming to match the 3.18 LSP spec [2]. On the security front, WPF added CodeQL suppression comments in ResourcesGenerator and UidManager after determining the flagged data flows were build-time only and sourced from trusted MSBuild inputs supplied by project files, not untrusted external sources [3]. The VMR continues its regular sync cycle with codeflow updates flowing from runtime into dotnet/dotnet [4] and from dotnet/dotnet into WPF [5], keeping the ecosystem locked in step. Across 3 repos this cycle: 4 commits, 4 PRs.
Action items
- → Pull latest Roslyn changes to test editor sync in your LSP clients dotnet/roslyn [plan]
- → Sync WPF and runtime codeflow updates on next VMR refresh dotnet/wpf [plan]
- → Monitor Roslyn didChange handler in production IDE scenarios dotnet/roslyn [monitor]
References
- [1] Handle textDocument/didChange notifications that don't pass across the range ↗ dotnet/roslyn
- [2] Handle textDocument/didChange notifications that don't pass across the range (#84714) ↗ dotnet/roslyn
- [3] Add CodeQL comments to clarify trusted input handling in ResourcesGen… ↗ dotnet/wpf
- [4] [main] Source code updates from dotnet/runtime ↗ dotnet/dotnet
- [5] [main] Source code updates from dotnet/dotnet ↗ dotnet/wpf
