Skip to content

chore: Update Microsoft.CodeAnalysis package versions#3130

Draft
VaclavElias wants to merge 2 commits intostride3d:masterfrom
VaclavElias:chore-bump-code-analysis
Draft

chore: Update Microsoft.CodeAnalysis package versions#3130
VaclavElias wants to merge 2 commits intostride3d:masterfrom
VaclavElias:chore-bump-code-analysis

Conversation

@VaclavElias
Copy link
Copy Markdown
Contributor

@VaclavElias VaclavElias commented Apr 11, 2026

PR Details

Bump Microsoft.CodeAnalysis.* to remove transitive vulnerability messages.

Blocker: We need latest RoslynPad.Roslyn (not available yet) which is also referencing the vulnerable package.

roslynpad/roslynpad#626

Related Issue

Types of changes

  • Docs change / refactoring / dependency upgrade
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist

  • My change requires a change to the documentation.
  • I have added tests to cover my changes.
  • All new and existing tests passed.
  • I have built and run the editor to try this change out.

PR Classification

Update Microsoft.CodeAnalysis package versions

PR Summary

This pull request upgrades several Microsoft.CodeAnalysis package dependencies to the latest stable version.

  • Directory.Packages.props: Updated Microsoft.CodeAnalysis.CSharp.Features, Microsoft.CodeAnalysis.CSharp.Scripting, Microsoft.CodeAnalysis.CSharp.Workspaces, and Microsoft.CodeAnalysis.Workspaces.MSBuild from version 4.12.0 to 5.3.0.

- Directory.Packages.props - Bump Microsoft.CodeAnalysis.CSharp.Features, CSharp.Scripting, CSharp.Workspaces, and Workspaces.MSBuild from 4.12.0 to 5.3.0
- Removes transitive vulnerability coming from Microsoft.Build.Tasks.Core
@VaclavElias
Copy link
Copy Markdown
Contributor Author

This PR is blocked by RoslynPad.Roslyn which needs to be updated. RoslynPad.Roslyn needs to update to the latest Microsoft.CodeAnalysis before we could use it.

Currently, this PR throws error when run from source code in MetadataUtil.cs in our RoslynPad.Roslyn namespace. When ignored GameStudio works but you can't edit scripts.

System.TypeLoadException
  HResult=0x80131522
  Message=Method 'ForceRunCodeAnalysisDiagnosticsAsync' in type 'Microsoft.CodeAnalysis.Diagnostics.DiagnosticAnalyzerService' from assembly 'Microsoft.CodeAnalysis.LanguageServer.Protocol, Version=4.12.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' does not have an implementation.
  Source=System.Private.CoreLib
  StackTrace:
   at System.Reflection.RuntimeAssembly.<GetTypeCore>g____PInvoke|25_0(QCallAssembly __assembly_native, Byte* __typeName_native, IntPtr* __nestedTypeNames_native, Int32 __nestedTypeNamesLength_native, ObjectHandleOnStack __retType_native)
   at System.Reflection.RuntimeAssembly.<GetTypeCore>g____PInvoke|25_0(QCallAssembly __assembly_native, Byte* __typeName_native, IntPtr* __nestedTypeNames_native, Int32 __nestedTypeNamesLength_native, ObjectHandleOnStack __retType_native)
   at System.Reflection.RuntimeAssembly.GetTypeCore(QCallAssembly assembly, String typeName, ReadOnlySpan`1 nestedTypeNames, Int32 nestedTypeNamesLength, ObjectHandleOnStack retType)
   at System.Reflection.RuntimeAssembly.GetTypeCore(String typeName, ReadOnlySpan`1 nestedTypeNames, Boolean throwOnFileNotFound, Boolean ignoreCase)
   at System.Reflection.TypeNameResolver.GetType(String escapedTypeName, ReadOnlySpan`1 nestedTypeNames, TypeName parsedName)
   at System.Reflection.TypeNameResolver.Resolve(TypeName typeName)
   at System.Reflection.RuntimeAssembly.GetType(String name, Boolean throwOnError, Boolean ignoreCase)
   at RoslynPad.Roslyn.MetadataUtil.LoadTypesBy(Assembly assembly, Func`2 predicate) in D:\Projects\GitHub\stride\sources\editor\Stride.Assets.Presentation\AssetEditors\ScriptEditor\MetadataUtil.cs:line 34
   at RoslynPad.Roslyn.MetadataUtil.LoadTypesByNamespaces(Assembly assembly, String[] namespaces) in D:\Projects\GitHub\stride\sources\editor\Stride.Assets.Presentation\AssetEditors\ScriptEditor\MetadataUtil.cs:line 16
   at Stride.Assets.Presentation.AssetEditors.ScriptEditor.RoslynHost.GetDiagnosticCompositionTypes() in D:\Projects\GitHub\stride\sources\editor\Stride.Assets.Presentation\AssetEditors\ScriptEditor\RoslynHost.cs:line 58
   at Stride.Assets.Presentation.AssetEditors.ScriptEditor.RoslynHost.CreateCompositionContext() in D:\Projects\GitHub\stride\sources\editor\Stride.Assets.Presentation\AssetEditors\ScriptEditor\RoslynHost.cs:line 77
   at Stride.Assets.Presentation.AssetEditors.ScriptEditor.RoslynHost..ctor() in D:\Projects\GitHub\stride\sources\editor\Stride.Assets.Presentation\AssetEditors\ScriptEditor\RoslynHost.cs:line 44
   at Stride.Assets.Presentation.AssetEditors.ProjectWatcher.CreateRoslynHost() in D:\Projects\GitHub\stride\sources\editor\Stride.Assets.Presentation\AssetEditors\ProjectWatcher.cs:line 79
   at System.Threading.Tasks.Task`1.InnerInvoke()
   at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
image

@Ethereal77
Copy link
Copy Markdown
Contributor

Maybe we should have our own fork just for the code editor + Roslyn host part. That way we can control versions, dependencies and integration into Game Studio better.

@xen2
Copy link
Copy Markdown
Member

xen2 commented Apr 11, 2026

Should have commented this here:

Probably not relevant anymore.
BTW there is a Roslyn LSP tool now: https://www.nuget.org/packages/roslyn-language-server maybe it will be useful for editor.

I would like to update Roslyn more often but RoslynPad is always messy to upgrade, very easy to break.
So I am quite interested if using something like roslyn-language-server (or anything else) allows us to do that more easily.

Is there any proof of concept project/mini editor sample using it?
(ideally using a tech we could embed, even if not WPF/Winforms)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants