Skip to content

chore(deps): Bump CommunityToolkit.Mvvm from 8.2.2 to 8.4.2#7

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/IUUT.App/CommunityToolkit.Mvvm-8.4.2
Closed

chore(deps): Bump CommunityToolkit.Mvvm from 8.2.2 to 8.4.2#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/IUUT.App/CommunityToolkit.Mvvm-8.4.2

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 30, 2026

Updated CommunityToolkit.Mvvm from 8.2.2 to 8.4.2.

Release notes

Sourced from CommunityToolkit.Mvvm's releases.

8.4.2

What's Changed

Full Changelog: CommunityToolkit/dotnet@v8.4.1...v8.4.2

8.4.1

This release of the .NET Community Toolkit updates the MVVM Toolkit analyzers and source generator to Roslyn 5.0, so they can work with C# 14 out of the box. This means that [ObservableProperty] on partial properties no longer needs preview language version 🎉

What's Changed 🆕

New Contributors

Full Changelog: CommunityToolkit/dotnet@v8.4.0...v8.4.1

8.4.0

What's Changed 🆕

New Contributors

Full Changelog: CommunityToolkit/dotnet@v8.3.2...v8.4.0

8.4.0-preview3

What's Changed 🆕

New Contributors

Full Changelog: CommunityToolkit/dotnet@v8.3.2...v8.4.0-preview3

8.3.2

This hotfix release updates the build time validation for the Windows SDK projections, when using the .NET 9 SDK.

What's Changed 🆕

8.3.1

This hotfix release includes build time validation for the Windows SDK projections, to improve the developer experience.

What's Changed 🆕

8.3.0

What's Changed 🆕

New Contributors

Full Changelog: CommunityToolkit/dotnet@v8.2.2...v8.3.0

Note ℹ️

If you're consuming the MVVM Toolkit from net8.0-windows10.0.xxxxx.0, you'll either need the latest servicing update of the .NET 8 SDK (ie. > 8.0.403), or as a temporary workaround you can manually specify the Windows SDK package version in your .csproj, as follows:

<WindowsSdkPackageVersion>10.0.xxxxx.41</WindowsSdkPackageVersion>

Where "xxxxx" should match the Windows SDK you're targeting (in your "TargetFramework" property).

https://www.nuget.org/packages/Microsoft.Windows.SDK.NET.Ref/10.0.26100.41
https://www.nuget.org/packages/Microsoft.Windows.SDK.NET.Ref/10.0.22621.41
https://www.nuget.org/packages/Microsoft.Windows.SDK.NET.Ref/10.0.22000.41
https://www.nuget.org/packages/Microsoft.Windows.SDK.NET.Ref/10.0.20348.41
https://www.nuget.org/packages/Microsoft.Windows.SDK.NET.Ref/10.0.19041.41
https://www.nuget.org/packages/Microsoft.Windows.SDK.NET.Ref/10.0.18362.41
https://www.nuget.org/packages/Microsoft.Windows.SDK.NET.Ref/10.0.17763.41

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---
updated-dependencies:
- dependency-name: CommunityToolkit.Mvvm
  dependency-version: 8.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 30, 2026

Labels

The following labels could not be found: agent:dependabot, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot requested a review from ImPanick as a code owner May 30, 2026 20:07
ImPanick pushed a commit that referenced this pull request May 30, 2026
…tprint)

Makes the user-facing intent binding and verifiable so operator execution
matches documented intent.

Acquisition — two paths, same IUUT.exe (master doc §6.4, docs/INSTALL.md):
  - Path A: download the pre-built IUUT.exe + SHA256SUMS.txt from Releases,
    verify hash + Sigstore build-provenance attestation, double-click.
  - Path B: build from source via the §6.3 publish command.

Integrity — "verified signed hashes" with zero certificate cost:
  - release.yml (new) on a vX.Y.Z tag: builds the self-contained single-file
    IUUT.exe + IUUT-portable.zip, emits SHA256SUMS.txt, and attests build
    provenance via actions/attest-build-provenance (Sigstore). Users verify
    with Get-FileHash + `gh attestation verify`.
  - Authenticode signing documented as a future upgrade (needs a cert).

No-install / fire-and-forget / minimal footprint:
  - NG8: no installer, no admin/UAC, no registry, no Program Files, no
    Start-Menu entries, no machine-wide changes.
  - One state folder: %AppData%\IUUT\ (cache, DPAPI-encrypted key, logs),
    OR portable mode via an `IUUT.portable` marker -> .\IUUT-Data\ (nothing
    in AppData). Native single-file extraction pinned inside that folder.
  - Clean removal = delete the exe + the one folder. Save backups live inside
    the game's PlayerData folder by design (CONSTITUTION III), not scattered.

Auto-link save dir + manual fallback made explicit in §7.1.

Also:
  - Fixed the §7.5.1 cache-path inconsistency (%AppData%\IUUT\, was
    %AppData%\IcarusUltimateUtilityTool\).
  - IUUT.App.csproj: EnableCompressionInSingleFile in Release; footprint note.
  - publish-release.ps1 contract aligned (local dry-run; CI is canonical/attested).
  - README "Get IUUT" + doc index; DEVELOPMENT build-your-own-exe; CICD
    release-integrity model + runbook; MANUAL_CHECKLIST §11 (integrity) + §12
    (footprint/portable); CHANGELOG.
  - Master doc bumped to 1.3.0 (§24).

Verified: dotnet build 0/0, format clean, governance-lint clean (99 files).

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#III,#V,#VII, .agent/SECURITY_PROTOCOL.md#5, .agent/HANDOFF_PROTOCOL.md#9, docs/IUUT-PROJECT-DOCUMENTATION.md#3.3,#6.1,#6.3,#6.4,#7.1,#7.5.1,#19,#24
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
Implements the operator footprint guarantee (master doc §6.4) and closes Phase 0.

- Services/AppPaths: resolves IUUT's single state folder — default
  %AppData%\IUUT\, or .\IUUT-Data\ beside the exe when an IUUT.portable marker
  is present (true fire-and-forget). Exposes the derived paths (steam cache,
  settings, DPAPI key blob, Logs, runtime-extract dir) all under one root, plus
  EnsureStateRoot(). Never hardcodes a username. The runtime-extract dir is where
  the app points DOTNET_BUNDLE_EXTRACT_BASE_DIR so single-file extraction stays
  inside the footprint.
- Services/AppSettings: non-secret prefs (SaveRootOverride, Steam name toggle,
  cache TTL, refresh-on-launch) + extension data (CONSTITUTION VI). The Steam API
  key is NOT stored here — it lives DPAPI-encrypted in AppPaths.ApiKeyFile
  (SECURITY_PROTOCOL §5), written by the app layer.
- Services/AppSettingsStore: resilient load/save (UTF-8 no BOM).

Wiring note: the WP-6 SteamProfileCacheStore takes a path, so the app composes
AppPaths.SteamCacheFile -> store; no refactor needed.

Also fixed MANUAL_CHECKLIST §8 (logs are under %AppData%\IUUT\Logs, not
%LocalAppData% — the footprint is one folder, master §6.4).

Tests (8 new, 116 total, all green; real temp dirs): AppPaths default vs
portable-marker, derived-paths-under-root, EnsureStateRoot; AppSettings
round-trip / defaults / no-BOM / unknown-member preservation.

Phase 0 (foundation) is complete: safe-write spine, all four Lazy-Max-file
parsers, save discovery, Steam name resolution, game detection, health scan,
validation engine, and footprint plumbing — 116 tests, validated against the
real save.

Verified: dotnet build -c Release 0/0, dotnet test 116/116, dotnet format clean,
governance-lint clean.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#V,#VI, .agent/CODE_STYLE.md#1,#10, .agent/SECURITY_PROTOCOL.md#5, .agent/TESTING_CONTRACT.md#5, docs/IUUT-PROJECT-DOCUMENTATION.md#6.4,#7.1,#7.5.1
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
…n decision

Captures two owner notes durably (master §20.1, plan §0):

- §20.1 Engine Mods tab — expanded from the fog-only stub into the real intent:
  a "Buff FPS" performance feature plus QoL toggles. Each card is an on/off toggle
  that OWNS an Engine.ini fragment of sectioned cvar lines ([/script/...]); ON
  merges the fragment (shared sections appended, not duplicated), OFF removes only
  that toggle's lines and drops emptied sections. Duplicate-cvar guard de-dups to a
  single authoritative line (UE4 last-writer semantics). The Icarus cvar catalog is
  game-dependent, so it's seeded from UE4 knowledge then validated against a live
  client via an operator-runnable cvar dump (scripts/dump-cvars.ps1) curated into
  vetted reversible fragments — a local, user-initiated scrape, never a phone-home
  (CONSTITUTION V). Engine.ini is not a save file but a bad INI breaks launch, so it
  gets its own INI writer with the same backup/atomic/rollback contract
  (CONSTITUTION III). Post-v1.0; no WP allocated.

- Plan §0 — parked decisions: UI presentation is deliberately provisional (WP-13 is
  a functional shell; exact app presentation is settled last, Phase 6 polish — keep
  logic in Core so the view can be reskinned), and a pointer to the Engine Mods
  future feature so neither note is lost across a context compaction.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#III,#V, docs/IUUT-PROJECT-DOCUMENTATION.md#3.3,#7.3,#20, docs/IMPLEMENTATION-PLAN.md#0
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
First UI (master §10.2; CODE_STYLE §3 DI, §7 MVVM). Phase 1 continues. Per the
parked owner decision (plan §0) the presentation is deliberately provisional — the
value here is the wiring and a fully-tested orchestration layer, not final visuals.

Core (testable, no UI):
- HomeService composes SaveDiscoveryService + SteamProfileResolverService (offline-
  first) + GameProcessDetector into a HomeState. Pure orchestration — joins the three
  services' results; pairs each discovered profile with its resolved display by
  SteamID64 (robust to ordering), falling back to the raw ID when unresolved.
- HomeState { SaveRoot, SaveRootFound, Slots, Game } and HomeSaveSlot (SaveProfile +
  SteamProfileDisplay → DisplayLabel/PersonaName/NameSource/char count/health flags),
  both view-ready records.

App (thin WPF shell):
- App.xaml.cs builds the DI container (ServiceCollection): foundation (IClock,
  IGuidProvider, AppPaths), catalogs + LazyMaxService (ready for the WP-14 apply
  pipeline), the Home chain, HomeViewModel, and MainWindow. StartupUri dropped; the
  window is resolved from DI in OnStartup and the provider disposed on exit.
- HomeViewModel (CommunityToolkit.Mvvm ObservableObject) — explicit properties +
  Async/RelayCommand (no source generators, keeps it analyzer-clean under
  warnings-as-errors). LoadAsync pulls a HomeState; the catch-all is a justified UI
  boundary (CA1031 pragma) so a load failure surfaces as a message, never a crash.
  LazyMaxCommand is the entry point; apply is deferred to WP-14.
- MainWindow.xaml: provisional layout matching §10.2 — save-root row + Browse
  (OpenFolderDialog) + Reload, PersonaName profile dropdown with detail line, warn-only
  game-state banner (green/red via DataTrigger, never blocks — §14), three preset cards
  (Lazy Max live; Recovery/Custom disabled until their phases), and a status bar.

Tests (5 new, 146 total, all green): HomeService over a TempDir-built PlayerData tree
with FakeLocalSteamNames + FakeRunningProcesses — discovers + labels slots (PersonaName
vs SteamID64 fallback), reports SaveRootFound=false on missing PlayerData, orders by
SteamID64, and surfaces the game-running banner both ways. (WPF VM/view are thin
binding-shape, exercised at startup; logic under test lives in Core per CODE_STYLE §7.)

Verified: dotnet build -c Debug and -c Release 0/0, dotnet test 146/146, dotnet format
clean, governance-lint clean. IMPLEMENTATION-PLAN §0 advanced to WP-14.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#V,#IX, .agent/CODE_STYLE.md#3,#7, .agent/TESTING_CONTRACT.md#2,#5, docs/IUUT-PROJECT-DOCUMENTATION.md#10.2,#9.1,#14, docs/IMPLEMENTATION-PLAN.md#0
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
Phase 2 (Broken Save Recovery) begins. The walker finds the best clean restore
source for a corrupt save file (master §12.1, §7.6, F-021/F-022).

- Globs <File>.*backup* siblings rather than a fixed name list, so every game
  convention is caught: .backup, .backup_1..10, AND Loadouts' odd .<N>.backup
  (Loadouts.json.4.backup) — a hardcoded list would silently skip the last.
- Partitions game-rotated backups from IUUT's own .iuut-backup-* copies (matched
  by BackupManager.BackupInfix).
- Ranks clean candidates by mtime; the caller supplies the clean check (parse, and
  for prospects SHA-1) and any throw is treated as not-clean.
- Prospect rule: with ≥2 clean candidates, prefers the SECOND-newest (the freshest
  may be the corrupted in-memory flush).
- Falls back to the newest clean IUUT backup only when no clean game backup exists
  (the sole safety net for files the game never rotates — MetaInventory, etc.).
  Game backups always outrank IUUT fallbacks.

Types: BackupCandidate, BackupScanResult, BackupRestoreKind (None/GameBackup/IuutBackup).
.editorconfig: CA1822 exemption extended to src/IUUT.Core/Recovery/*.cs (same DI-service
rationale as Services/ — stateless methods on injected instances).

Tests (7 new, 160 total, all green): newest-clean wins over a corrupt-newer; prospect
second-newest; non-prospect newest; IUUT fallback when no game backup; game outranks
IUUT; the .<N>.backup convention is discovered; none-clean → None.

Verified: dotnet build -c Release 0/0, dotnet test 160/160, dotnet format clean,
governance-lint clean.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#III, .agent/CODE_STYLE.md#3, .agent/TESTING_CONTRACT.md#2,#5, docs/IUUT-PROJECT-DOCUMENTATION.md#12.1,#7.6,#11.3
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
Adversarial audit of the Phase 2 recovery subsystem surfaced three genuine
hardening gaps; fixed here.

BackupChainWalker:
- Stable selection on mtime ties — added an ordinal path tiebreaker so the chosen
  (and the prospect "second-newest") backup is deterministic across runs instead of
  relying on LINQ's unspecified ordering for equal timestamps.
- Empty/whitespace-only backups are never treated as a clean restore source (a
  zero-byte sibling could otherwise be considered before the parse check).

RecoveryService.CreateMasterBackup:
- Rejects a master-backup directory that lives inside the profile folder (would zip
  itself) — fails fast with ArgumentException.
- Builds the snapshot with a filtered ZipArchive that excludes IUUT's own .iuut-tmp-*
  and .iuut-recovery-* artifacts (only the save data is captured), and skips a file
  locked mid-recovery rather than aborting the whole snapshot.
- A zip failure now degrades to MasterBackupZipPath=null and recovery still proceeds
  (per-file SafeSaveWriter backups remain the safety net) instead of crashing.

Audit findings deliberately NOT actioned (with reasons): recomputing a prospect blob
SHA-1 over corrupt bytes is not recovery (it would let the game load a logically-broken
world) — refusing → restore-from-backup is correct; the walker is already blob-aware
(the planner passes a prospect predicate that includes the SHA-1 check); the
plan→execute TOCTOU is bounded by SafeSaveWriter's post-write re-parse, which rejects
any backup that changed to invalid content.

Tests (4 new, 173 total, all green): empty backup never chosen; equal-mtime selection
is deterministic; master-backup dir inside the profile folder throws; the snapshot zip
excludes .iuut-tmp-* but contains the corrupt save.

Verified: dotnet build -c Release 0/0, dotnet test 173/173, dotnet format clean,
governance-lint clean.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#III, .agent/CODE_STYLE.md#3, .agent/TESTING_CONTRACT.md#2,#5, docs/IUUT-PROJECT-DOCUMENTATION.md#12.1,#7.6
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
First step of the UI pass (UI-DESIGN-CONCEPT §8): unpark the Glass Console by adding the
navigation architecture every screen needs. No Core changes; the in-window page-swap shell
the owner chose.

- INavigationService + ShellViewModel: the shell hosts one page view-model at a time and
  swaps it on navigate; pages are resolved lazily from DI by key (so a page can depend on
  INavigationService = the shell with no construction cycle). Back-stack + Back/Home commands;
  CanGoBack drives a nav bar that's hidden on Home, shown on sub-pages.
- MainWindow is now the shell: FluentWindow chrome + the in-window orbit background (shared
  behind every page) + a ContentControl that renders the current page via implicit
  DataTemplates (HomeViewModel→HomeView, RecoveryViewModel→RecoveryView).
- Home extracted from MainWindow into Views/HomeView (UserControl) with its Browse + Lazy Max
  confirm handlers; the Recovery mode tile now navigates (OpenRecoveryCommand) instead of being
  disabled. RecoveryView/RecoveryViewModel are a stub, wired to the services next.
- DI: ShellViewModel + INavigationService + the page view-models; MainWindow now takes the shell.

Verified: dotnet build -c Debug and -c Release 0/0, dotnet format clean, governance-lint clean,
221 Core tests unaffected, and a smoke launch confirms the shell renders + navigates without a
startup crash. Pixel-level QA is owner-run.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#IX, .agent/CODE_STYLE.md#3,#7, docs/UI-DESIGN-CONCEPT.md, docs/IUUT-PROJECT-DOCUMENTATION.md#10.1,#10.2
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
Second UI-pass step: the first real feature screen on the navigation shell. Wires the
already-built, tested Broken Save Recovery Core (WP-16..18 + advisor) to a page — the
recovery engine finally has a face. No Core changes.

- RecoveryViewModel: pick a save profile (lists via HomeService) → Scan
  (RecoveryPlanner.Plan on a background thread) → a per-file plan (file → restore-from-
  game-backup / restore-from-IUUT-backup / rebuild-skeleton / cannot-recover) with the
  partial-recovery flag → Repair (RecoveryService.ExecuteAsync: full-folder backup zip into
  %AppData%\IUUT\RecoveryBackups, then restore/template) → report (changed/failed counts,
  master-backup name) + the RecoveryAdvisor advisories (Steam Cloud / conflicted copies /
  CFA / coherence). Re-scans after repair. CA1031 pragmas at the UI boundary.
- RecoveryView: profile selector + Scan, a scrollable plan list + partial-recovery warning +
  advisories, and a Repair button gated on CanRepair. The repair confirm dialog lives in the
  view code-behind (VM stays WPF-free).
- App DI: registers the recovery services (HealthScanService, BackupChainWalker,
  TemplateRepairService, RecoveryPlanner, RecoveryAdvisor, RecoveryService) and enables
  ValidateOnBuild — the whole DI graph (incl. this page's chain) is validated at startup, so a
  wiring break fails fast rather than on first navigation.

Verified: dotnet build -c Debug and -c Release 0/0, dotnet format clean, governance-lint clean,
221 Core tests unaffected, and a smoke launch confirms the app renders AND the full DI graph
validates at startup (RecoveryViewModel → RecoveryPlanner/RecoveryService → all deps constructed
cleanly). Click-through visual QA is owner-run. §0 updated.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#III,#IX, .agent/CODE_STYLE.md#3,#7, docs/IUUT-PROJECT-DOCUMENTATION.md#10.1,#11.3,#12.1, docs/UI-DESIGN-CONCEPT.md
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
Third UI-pass step (master §10.3): the Custom editor navigation frame on the Glass
Console shell. Profile selector + a category sidebar whose selection swaps the editor
panel. No Core changes; the per-category editors get wired to their (already-built,
tested) Core services next.

- CustomViewModel / CustomView: save-profile selector + a sidebar ListBox of categories
  → a detail/editor panel bound to the selected category (glyph, label, description, and
  a build-status line naming the Core service that backs it). Lists saves on display.
- Categories: Account & Currencies, Characters & Talents, Accolades & Bestiary, Orbital
  Stash, Loadouts, Prospects, Mounts, Engine Flags, **Game Tuning** (new, per owner —
  the Engine.ini cvar feature from docs/GAME-TUNING.md, marked Phase-7/future), and
  Advanced/Raw. Each notes which tested Core service it will wire to.
- Shell + Home: ShellViewModel CustomKey + resolve; HomeViewModel OpenCustomCommand; the
  Custom tile on Home now navigates (was disabled); MainWindow DataTemplate
  CustomViewModel→CustomView; DI registers CustomViewModel (validated by ValidateOnBuild).

Polish noted (NOT acted on, per owner screenshots): the Recovery header's title+subtitle
overlap (two TextBlocks in one grid cell) + a general spacing/contrast pass — logged in
plan §0 for the polish pass. The Custom shell uses clean grid rows to avoid the same
overlap.

Verified: dotnet build -c Debug and -c Release 0/0, dotnet format clean, governance-lint
clean, 221 Core tests unaffected, and a smoke launch confirms the app renders + the full
DI graph (incl. CustomViewModel) validates at startup. Click-through QA is owner-run.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#IX, .agent/CODE_STYLE.md#3,#7, docs/IUUT-PROJECT-DOCUMENTATION.md#10.3, docs/GAME-TUNING.md, docs/UI-DESIGN-CONCEPT.md
Co-Authored-By: Claude <noreply@anthropic.com>
ImPanick pushed a commit that referenced this pull request May 31, 2026
…ass)

Per owner: Game Tuning is its own top-level feature, not a Custom category.

- Home: a new Game Tuner mode tile (⚙ cog) next to Custom Editor — the row is now four
  tiles (Recovery / Lazy Max / Custom / Game Tuner) and all four navigate. Game Tuning was
  removed from the Custom editor sidebar.
- GameTunerViewModel / GameTunerView: reads the client's Engine.ini and lists each tunable.
  Toggles disable an effect; numbers show a toggle + a slider AND a free-text number box,
  both bound to the same value which CLAMPS to the setting's stable-max (typing 99999 in the
  box snaps back to the cap). Apply (behind a confirm dialog) writes Engine.ini via the Core
  service — backed up + atomic; restart Icarus to take effect.
- Wiring: ShellViewModel GameTunerKey + resolve; HomeViewModel OpenGameTunerCommand; MainWindow
  DataTemplate GameTunerViewModel→GameTunerView; DI registers GameTuningCatalog + GameTuningService
  + GameTunerViewModel (validated by ValidateOnBuild).

Caveat shown in the confirm + GAME-TUNING.md: these are standard UE cvars; Icarus may ignore/
clamp some — live verification (GT-6) is owner-run.

Verified: dotnet build -c Debug and -c Release 0/0, dotnet test 230/230, dotnet format clean,
governance-lint clean, smoke launch renders + the full DI graph (incl. GameTunerViewModel)
validates at startup. Click-through QA is owner-run.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#III,#V, .agent/CODE_STYLE.md#3,#7, docs/GAME-TUNING.md, docs/IUUT-PROJECT-DOCUMENTATION.md#20, docs/UI-DESIGN-CONCEPT.md
Co-Authored-By: Claude <noreply@anthropic.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Jun 1, 2026

Looks like CommunityToolkit.Mvvm is no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 1, 2026
@dependabot dependabot Bot deleted the dependabot/nuget/src/IUUT.App/CommunityToolkit.Mvvm-8.4.2 branch June 1, 2026 07:02
ImPanick pushed a commit that referenced this pull request Jun 2, 2026
Re-applies the pending Dependabot version bumps as one governed commit,
since the bot branches were based on a stale dev and carried no Agent/
Consulted trailers (failing governance-check). All changes verified
locally on the fixed CI sequence: restore (Release) + build + test +
`dotnet format --verify-no-changes` — 0 warnings, 0 errors, 312/312
tests passing.

GitHub Actions:
- actions/checkout        v4 -> v6  (build, release, governance-check)
- actions/setup-dotnet    v4 -> v5  (build, release)
- actions/upload-artifact v4 -> v7  (build)
- actions/github-script   v7 -> v9  (governance-check)

NuGet:
- Microsoft.Extensions.Hosting  8.0.0 -> 10.0.8  (IUUT.App)
- Microsoft.Extensions.Logging  8.0.0 -> 10.0.8  (IUUT.App)
- Microsoft.NET.Test.Sdk       17.10.0 -> 18.6.0 (tests)
- xunit                         2.9.0 -> 2.9.3   (tests)
- xunit.runner.visualstudio     2.8.2 -> 3.1.5   (tests)
- coverlet.collector            6.0.2 -> 10.0.1  (tests)

Held back (not applied):
- FluentAssertions 6.12.0 -> 8.10.0: v8 changed to a paid/commercial
  license model (free only for non-commercial/OSS). Per dependabot.yml's
  governance note and SCOPE_GUARDRAILS §2.6 (license review), this bump is
  left for explicit owner decision rather than taken silently.

Supersedes PRs #1, #2, #3, #4, #5, #6 (closed as consolidated). PR #7
(CommunityToolkit.Mvvm 8.4.2) was already applied to dev. The stale
agent/claude/wp-infra-ci-triggers branch is intentionally NOT merged —
its CI intent is already in dev and merging it would revert ~37.8k lines.

Agent: claude-code/2.1.149
Consulted: AGENTS.md, .agent/CONSTITUTION.md#VIII, .agent/SCOPE_GUARDRAILS.md#1,#2, .agent/SECURITY_PROTOCOL.md#8, .github/dependabot.yml, docs/CICD.md
Co-Authored-By: Claude <noreply@anthropic.com>
Handoff-State: ready-for-review
Handoff-Notes: Done — bumps consolidated and verified green locally (312 tests). Next: push dev, close the superseded bot PRs, then open dev->main. Owner decisions pending: (1) add CODACY_PROJECT_TOKEN secret so coverage uploads; (2) whether to accept FluentAssertions 8's license to take that bump. Do not merge the wp-infra branch (stale, would delete the codebase).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants