Visitar URL original
chore(sdk): Bump Uno.Sdk.Private versions behind the 7.0 stables and SkiaSharp 4.156.0 (master) by agneszitte · Pull Request #26325 · unoplatform/uno · GitHub
Skip to content

chore(sdk): Bump Uno.Sdk.Private versions behind the 7.0 stables and SkiaSharp 4.156.0 (master) - #26325

Merged
agneszitte merged 6 commits into
masterfrom
dev/agzi/sdk-private-master-70-stables
Nov 12, 2026
Merged

chore(sdk): Bump Uno.Sdk.Private versions behind the 7.0 stables and SkiaSharp 4.156.0 (master)#26325
agneszitte merged 6 commits into
masterfrom
dev/agzi/sdk-private-master-70-stables

Conversation

@agneszitte

@agneszitte agneszitte commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

GitHub Issue: relates to https://github.com/unoplatform/private/issues/1251 (Uno Platform 7.0: post-release manifest update); related to #26179 (SkiaSharp 4.156.0); related to #26332 (SVG fails to load)

PR Type:

🏗️ Build or CI related changes

What changed? 🚀

After the 7.0 release (Uno.Sdk 7.0.5), this bumps the versions in src/Uno.Sdk/packages.json (the Uno.Sdk.Private manifest) that are behind the stable ones in the 7.0 manifest (uno.templates 7.0.5), to those versions. Same post-release step as #25899 after 6.7 SR2.

Same change as #26322 on release/stable/7.0. With the same edit on both branches, the nightly master → 7.0 sync merges this file cleanly.

Group Before After (7.0.5)
settings 2.0.0-dev.23 2.0.1
hotdesign 2.0.0-dev.2 2.0.1
AppMcp 2.0.0-dev.7 2.0.1
CSharpMarkup 7.0.0-dev.33 7.0.1
Extensions 8.0.0-dev.150 8.0.1
Toolkit 11.0.0-dev.157 11.0.1
Themes 9.0.0-dev.61 9.0.1
Resizetizer 2.0.0-dev.36 2.0.1
sdkextras 6.4.0-dev.15 6.4.1
UnoFonts 2.10.0-dev.9 2.10.1
Reactor 0.1.0-dev.77 0.1.1
WasmBootstrap (net10.0) 10.1.0-dev.284 10.1.1
UnoMaui, UnoRetarget 0.1.0-dev.1 0.1.0-dev.2
Maui 10.0.90 10.0.120
MauiCompatibility 10.0.90 10.0.120
MicrosoftLoggingConsole 10.0.12 10.0.14
MicrosoftWebView2 1.0.4191.47 1.0.4314.35
MsalClient 4.87.0 4.92.0
WinAppSdkBuildTools 10.0.28000.2705 10.0.28000.2957
WinAppSdkBuildToolsWinApp 0.7.1 0.8.0
AndroidXWearTiles 1.6.1 1.6.2
VlcNativeWindowsAssets 3.0.23.1 3.0.24
  • Versions already on a newer build are left as they are: WasmBootstrap net11.0 (11.1.0-dev.5), SvgSkia (5.2.3), and the net11.0 Maui / MicrosoftLoggingConsole pins, already on .NET 11 GA (11.0.0).
  • No group is added to or removed from the manifest. The base pin set is net10.0, so no net10.0 override is added.

SkiaSharp 4.156.0

  • Completes chore(deps): Bump SkiaSharp to 4.156.0 #26165, which moved Uno core to SkiaSharp 4.156.0 (fixes 2 critical CVEs: uno-private#2486 and uno-private#2487).
  • The manifest's SkiaSharp group (Skottie, Views.WinUI, the NativeAssets packages) moves from 4.151.1 to 4.156.0, the version Uno core now uses: chore(deps): Bump SkiaSharp to 4.156.0 #26165 left it on 4.151.1 (confirmed overlooked; the 4.151.1 bump changed both files). The CVE fixes are in the native Skia binaries, so apps must not keep the 4.151.1 native packages through these pins.
  • The manifest's HarfBuzzSharp (native assets) moves from 14.2.1.1 to 14.4.0.100, which SkiaSharp.HarfBuzz 4.156.0 requires (7.0.5 has 14.4.0).
  • The nuspecs of Uno.WinUI.Composition.Skia, Uno.WinUI.Graphics2DSK and Uno.WinUI.Svg still declared SkiaSharp 4.151.1 (19 entries), so the packed Uno packages let apps resolve the 4.151.1 SkiaSharp and native packages. They move to 4.156.0, the same files the 4.151.1 bump changed.
  • Core HarfbuzzSharpVersion and the Uno.WinUI.nuspec dependency move from 14.2.1.1 to 14.4.0.100, so the managed HarfBuzzSharp matches the native packages pinned in the manifest (review suggestion).
  • Docs (using-skia-desktop.md): the SkiaSharp upgrade section now references the managed SkiaSharp, SkiaSharp.Skottie and HarfBuzzSharp packages along with SkiaSharpVersion / HarfBuzzSharpVersion. SkiaSharpVersion alone only moves the native packages, and SkiaSharp fails at startup when managed and native differ. The PackageReference Update example had no effect, so it is removed.

Svg.Skia floor

  • The Uno.WinUI.Svg nuspec floor moves from Svg.Skia 3.0.6 to 5.2.3 (6 entries), the version Uno.UI.Svg.dll is built against. With 3.0.6, parsing an SVG on desktop fails with "Could not load file or assembly 'Svg.Skia, Version=5.2.3.0'" (SVG images fail to load on desktop with Uno.Sdk 7.0.5 and the Svg feature #26332).
  • The public Uno.Sdk must pin Svg.Skia 5.2.3 in the same version that brings this floor (uno.templates, with the core bump), or Android/iOS restores fail with NU1605.

Validated locally

  • build/ci/scripts/validate-packages-json.ps1: all 117 package/version combinations exist on nuget.org (SkiaSharp 4.156.0 and HarfBuzzSharp 14.4.0.100 included), and the dependency checks pass for the base/net10.0, net10.0 and net11.0 pin sets.
  • Uno.UI.Composition.Managed (the HarfBuzzSharp consumer) builds against HarfBuzzSharp 14.4.0.100 (net10.0, .NET SDK 11.0.100).
  • Smoke test of the new versions on .NET 10 and .NET 11 (Windows): native Skia 156 loads, HarfBuzz shapes Latin and Arabic text, shaped text renders, PNG round trip, SVG (Svg.Skia 5.2.3) and Lottie (Skottie) render.
  • Uno.UI.Composition.Skia builds for net10.0 and net11.0 against SkiaSharp 4.156.0 / HarfBuzzSharp 14.4.0.100, with no NU1605/NU1608/NU1107.
  • The package set these PRs produce, simulated in an Uno.Sdk 7.0.5 app (desktop + WebAssembly): every SkiaSharp package on 4.156.0 and every HarfBuzzSharp package on 14.4.0.100. Desktop builds, and the WebAssembly build links the 4.156.0 native Skia.
  • Managed SkiaSharp 4.151.1 over native 4.156.0 (the mismatch the nuspec fix prevents) fails at startup: "The version of the native libSkiaSharp library (156.0) is incompatible with this version of SkiaSharp".
  • In a Uno.Sdk 7.0.5 app with the Svg feature, Uno's SkiaSvgRenderer.Parse throws that error with Svg.Skia 3.0.6 and parses the SVG with 5.2.3. A restore with a 5.2.3 floor fails with NU1605 against the 3.0.6 pin and succeeds with 5.2.3.
  • Uno.Sdk.AddInVersionValidation.Tests (dotnet test -c Release, .NET SDK 11.0.100): passes with Licensing 2.0.1, Hot Design 2.0.1 and App MCP 2.0.1.

PR Checklist ✅

  • 🧪 Added Runtime tests, UI tests, or a manual test sample: N/A, dependency versions only.
  • 📚 Docs have been added/updated: SkiaSharp upgrade section of using-skia-desktop.md.
  • 🖼️ Validated PR Screenshots Compare Test Run results: to check on this run (HarfBuzzSharp text shaping).
  • ❗ Contains NO breaking changes
  • 👀 Reviewed 2 other open pull requests (optional but appreciated!)

🤖 Generated with Claude Code

@agneszitte @claude
chore(sdk): Bump Uno.Sdk.Private versions behind the 7.0 stables
586291a 
Raise the src/Uno.Sdk/packages.json pins that are behind the released
Uno.Sdk 7.0.5 manifest to those versions. Newer builds stay as they are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@mergify

mergify Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This pull request is merged.

@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @agneszitte's task in 12s —— View job

Review summary

Verdict: ship

  • Read the diff (src/Uno.Sdk/packages.json, +24/-24)
  • Checked each change against the table in the PR description
  • Checked the AGENTS.md rules that apply (Conventional Commits title, no source or test changes)

Findings: 0 blocker, 0 major, 0 minor. I posted no inline comments.

  • The diff matches the PR description row for row. All 23 version changes are in the table, and nothing is added or removed.
  • Entries already ahead of the 7.0 stables are untouched, as described: WasmBootstrap net11.0, SvgSkia, and the net11.0 Maui and MicrosoftLoggingConsole pins.
  • The title chore(sdk): ... follows Conventional Commits.
  • The change is formatting-neutral. Tab indentation is preserved and there are no structural edits.

Not verified by me: I did not run validate-packages-json.ps1 or the Uno.Sdk.AddInVersionValidation.Tests project. I'm relying on the PR description for that evidence, so CI should confirm it. I also didn't check that the 7.0.5 manifest values match upstream. That comparison would need network access to uno.templates.

Note for the author: UnoMaui and UnoRetarget go to 0.1.0-dev.2, which is still a prerelease. This is consistent with the 7.0.5 manifest, so no action is needed. Just confirm that is intended.

@github-actions github-actions Bot added the area/sdk Categorizes an issue or PR as relevant to the Uno.Sdk label Nov 12, 2026
@agneszitte @claude
fix(sdk): Pin SkiaSharp 4.156.0 in Uno.Sdk.Private
448ffb0 
Uno core moved to SkiaSharp 4.156.0 (security fixes in the native Skia
binaries) but the manifest still pinned the 4.151.1 SkiaSharp packages.
HarfBuzzSharp moves to 14.4.0.100, which SkiaSharp.HarfBuzz 4.156.0
requires.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @agneszitte's task in 15s —— View job

Review summary

Verdict: ship, after you fix the PR description (see below).

Findings: 0 blocker, 0 major, 1 minor. There are no inline comments because the issue is in the PR description, not in a diff line.

Minor: the PR description doesn't match the diff. The diff of src/Uno.Sdk/packages.json (25 changed lines) has two entries that the description gets wrong:

  • SkiaSharp goes from 4.151.1 to 4.156.0. It comes from the second commit, "Pin SkiaSharp 4.156.0", and it isn't in the table. The description also says "Nothing is added or removed" and that all changes follow the 7.0 stables, so a reader would not expect a SkiaSharp pin change.
  • HarfBuzzSharp goes to 14.4.0.100. The table says 14.4.0.

Please update the table (or the PR text) so the description matches what merges. Please also confirm that 4.156.0 and 14.4.0.100 are the versions you meant. If the 7.0.5 manifest has HarfBuzzSharp at 14.4.0, the "same edit on both branches" claim for the clean nightly sync doesn't hold for this entry. The same goes for SkiaSharp if release/stable/7.0 (#26322) doesn't have the same pin.

Everything else checks out:

  • The other 22 version changes match the table.
  • Entries already ahead of the 7.0 stables are untouched.
  • The title follows Conventional Commits, and the file keeps its tab indentation.

Not verified by me: I did not run validate-packages-json.ps1 or Uno.Sdk.AddInVersionValidation.Tests. I did not compare the values against upstream either. If the SkiaSharp pin came after your local validation run, please re-run it, because the existence check on nuget.org covers all 117 combinations.

@agneszitte agneszitte mentioned this pull request Nov 12, 2026
Merged
2 of 5 tasks
@agneszitte agneszitte changed the title chore(sdk): Bump Uno.Sdk.Private versions behind the 7.0 stables (master) chore(sdk): Bump Uno.Sdk.Private versions behind the 7.0 stables and SkiaSharp 4.156.0 (master) Nov 12, 2026
Xiaoy312
Xiaoy312 approved these changes Nov 12, 2026
View reviewed changes

@Xiaoy312 Xiaoy312 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Versions check out.

  • Compared against uno.templates 7.0.5 src/Uno.Sdk/packages.json: every bumped group matches 7.0.5. The only remaining differences are intended or already newer on master: SkiaSharp 4.156.0 (follows #26165), HarfBuzzSharp 14.4.0.100 (required by SkiaSharp.HarfBuzz 4.156.0), Svg.Skia 5.2.3, WasmBootstrap net11.0, and the .NET 11 GA Maui/Logging pins.
  • validate-packages-json.ps1 in strict mode passes: all 117 package/version combinations exist on nuget.org and the dependency checks pass for every pin set.
  • The resulting packages.json is byte-identical to #26322's, so the master → 7.0 sync should merge cleanly.

Non-blocking: core src/Directory.Packages.props still has HarfbuzzSharpVersion 14.2.1.1, so apps get the 14.2.1.1 managed library over the 14.4.0.100 native assets pinned here. 7.0.5 already ships the same mix, so this PR doesn't introduce it, but moving core to 14.4.0.100 in a follow-up would align them.

@agneszitte @claude
fix(deps): Align HarfBuzzSharp and the nuspec SkiaSharp versions with…
380044d 
… SkiaSharp 4.156.0

The SkiaSharp 4.156.0 bump only moved src/Directory.Packages.props. The
Composition.Skia, Graphics2DSK and Svg nuspecs still declared SkiaSharp
4.151.1, so the packed Uno packages let apps resolve the 4.151.1
SkiaSharp and native packages. HarfBuzzSharp moves to 14.4.0.100, the
version paired with SkiaSharp 4.156.0 and pinned in Uno.Sdk.Private.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @agneszitte's task in 13s —— View job

Review summary

Verdict: ship

Findings: 0 blocker, 0 major, 0 minor. No inline comments were needed.

  • Reviewed the latest commit, which aligns HarfBuzzSharp and the SkiaSharp pins in src/Directory.Packages.props and four build/nuget/*.nuspec files.
  • Searched src and build for leftover 4.151.1 and 14.2.1.1 references in props, nuspec, json, csproj, targets, ps1 and yml files. There are none.

What I checked

  • SkiaSharpVersion is 4.156.0 and HarfbuzzSharpVersion is 14.4.0.100 in src/Directory.Packages.props. Every SkiaSharp and HarfBuzzSharp PackageVersion entry reads from these properties, so the managed and native packages stay aligned.
  • The nuspec dependency versions match those props. The old SkiaSharp 4.151.1 and HarfBuzzSharp 14.2.1.1 pins are gone from every file.
  • This resolves the non-blocking follow-up from Xiaoy312's review. Core no longer pairs the 14.2.1.1 managed HarfBuzzSharp with the 14.4.0.100 native assets.
  • The PR title follows Conventional Commits, and the changes are dependency versions only.

Not verified by me: I did not build, run validate-packages-json.ps1, or run any tests. Please let CI confirm the restore and pack with the new versions.

Note for the author: the PR description still says "Nothing is added or removed". It also doesn't mention the nuspec and Directory.Packages.props edits made in the latest commit. Consider adding a line about them so the description matches what merges.

@github-actions github-actions Bot added the area/build Categorizes an issue or PR as relevant to build infrastructure label Nov 12, 2026
@agneszitte @claude
docs: Use SkiaSharp 4.156.0 in the SkiaSharp override examples
c1fe4a6 
The examples showed 4.148.0, now older than the version the Uno.Sdk
brings, and without the native Skia security fixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @agneszitte's task in 9s —— View job

Review summary

Verdict: ship

Findings: 0 blocker, 0 major, 0 minor. No inline comments.

  • I diffed against origin/master (7 files). SkiaSharpVersion is 4.156.0 and HarfbuzzSharpVersion is 14.4.0.100 in src/Directory.Packages.props. The nuspecs and the packages.json pins agree with them.
  • A git grep for 4.151.1 and 14.2.1.1 finds no leftovers outside markdown files.
  • The doc examples in doc/articles/features/using-skia-desktop.md now use 4.156.0 and 14.4.0.100. This is a docs-only change.
  • Commits and the PR title follow Conventional Commits.

Cross-cutting note: the PR description still says "Nothing is added or removed". It also doesn't mention the nuspec, Directory.Packages.props and doc edits. Consider adding a line so it matches what merges.

Not verified by me: I did not build, run validate-packages-json.ps1, or run any tests. CI should confirm restore and pack with the new versions, including the Screenshots Compare run for HarfBuzzSharp text shaping.

@agneszitte @claude
docs: Explain how to move SkiaSharp without a native version mismatch
79163f9 
SkiaSharpVersion only retargets the native-asset packages: the managed
SkiaSharp packages come through the Uno Platform packages, and SkiaSharp
fails at startup when the managed and native versions differ. The
PackageReference Update example had no effect, since the Uno.Sdk adds
its references after the project file. Show the properties together
with direct references to the managed packages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @agneszitte's task in 10s —— View job

Review summary

Verdict: ship

Findings: 0 blocker, 0 major, 0 minor. No inline comments.

  • I diffed origin/master...HEAD (5 commits, 7 files). The nuspec edits all move SkiaSharp 4.151.1 to 4.156.0 and HarfBuzzSharp 14.2.1.1 to 14.4.0.100. HarfbuzzSharpVersion in src/Directory.Packages.props matches.
  • git grep finds the old versions only in specs/packaging-impl/PLAN.md and specs/webgpu-parity/evidence/wasm-webgpu-verification.md. Both are historical notes, so I left them alone.
  • The title and commits follow Conventional Commits.

Cross-cutting note: the PR description still says "Nothing is added or removed". It does cover the nuspec and Directory.Packages.props edits, but it doesn't mention the doc changes in using-skia-desktop.md. Consider adding a line for them.

Not verified by me: I did not build, run validate-packages-json.ps1, or run any tests. CI should confirm restore and pack with the new versions, including the Screenshots Compare run for HarfBuzzSharp text shaping.

@unodevops

unodevops commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

🤖 Your Docs stage site is ready! Visit it here: https://unodocsprstaging.z13.web.core.windows.net/pr-26325/docs/index.html

@agneszitte agneszitte mentioned this pull request Nov 12, 2026
Merged
1 of 5 tasks
@unodevops

unodevops commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

🤖 Your WebAssembly Sample App stage site is ready! Visit it here:

@agneszitte
agneszitte added this pull request to stack #26330 November 12, 2026 03:51
@agneszitte agneszitte mentioned this pull request Nov 12, 2026
Open
@agneszitte @claude
fix(svg): Require Svg.Skia 5.2.3, the version Uno.UI.Svg is built aga…
8b00643 
…inst

Uno.UI.Svg.dll references Svg.Skia 5.2.3.0, but the Uno.WinUI.Svg
nuspec still declared Svg.Skia 3.0.6 as its floor, so an app could
resolve 3.0.6 and fail to load Svg.Skia when parsing an SVG.

The public Uno.Sdk must pin Svg.Skia 5.2.3 in the same version that
brings this floor, or Android/iOS restores fail with NU1605.

Related to #26332

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Claude finished @agneszitte's task in 8s —— View job

Review summary

Verdict: ship

Findings: 0 blocker, 0 major, 0 minor. No inline comments.

  • I diffed origin/master...HEAD (7 files). A git grep for 4.151.1 and 14.2.1.1 in src, build and doc (excluding markdown) finds no leftovers.
  • The changes are dependency versions, nuspec pins and docs only. They contain no source, test, async or platform-suffix concerns.
  • The title and commits follow Conventional Commits.

Not verified by me: I did not build, run validate-packages-json.ps1, or run any tests. CI should confirm restore and pack with the new versions, including the Screenshots Compare run for HarfBuzzSharp text shaping.

@unodevops

unodevops commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

🤖 Your WebAssembly Sample App stage site is ready! Visit it here:

@unodevops

unodevops commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

🤖 Your Docs stage site is ready! Visit it here: https://unodocsprstaging.z13.web.core.windows.net/pr-26325/docs/index.html

@agneszitte
agneszitte merged commit f970f3b into master Nov 12, 2026
58 checks passed
@agneszitte
agneszitte deleted the dev/agzi/sdk-private-master-70-stables branch November 12, 2026 06:35
@agneszitte agneszitte mentioned this pull request Nov 12, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nickrandolph nickrandolph nickrandolph approved these changes
@ajpinedam ajpinedam ajpinedam approved these changes
@Xiaoy312 Xiaoy312 Xiaoy312 approved these changes
@MartinZikmund MartinZikmund Awaiting requested review from MartinZikmund
@jonpryor jonpryor Awaiting requested review from jonpryor

Assignees

@agneszitte agneszitte

Labels

area/build Categorizes an issue or PR as relevant to build infrastructure area/sdk Categorizes an issue or PR as relevant to the Uno.Sdk kind/documentation

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@agneszitte @unodevops @nickrandolph @ajpinedam @Xiaoy312