[laurentiu021]

Why

The code scanning baseline has been zero since September. Six alerts appeared between 30 October and 3 November. A pull request's CodeQL check passes on warnings and notes, and the default alert list shows main only, so none of them stopped a merge: five were on main by 2 November, and the sixth arrived with #3152 today.

What changes

• AboutViewModel (1744, 1745, cs/constant-condition). Both re-checks after an await compared release.Tag != _latest?.Tag, after _latest is not { } release at the top of the method, so CodeQL read the ?. as dead. It is: _latest is only ever assigned a release, never null. Both call IsOnTheCard(release) now. It compares the tags with the null check kept, in case a later change ever clears _latest, and carries the comment the first check had.
• DnsService.CaptureSnapshotAsync (1746) and GamingProfile.HasAnyThatCanRun (1747, cs/complex-condition). Each condition had more than three nested && and ||. Their parts are named: staticWithoutServers and absentWithServers, and forTheGame and asAdministrator.
• AppAlertService.VersionNumber (1748, cs/constant-condition in the generated RegexGenerator.g.cs). The generator's matcher backtracked into \d+(?:\.\d+)+, and at that point checked a loop count that cannot be zero there. Giving digits back can never make a match: the next character would be a digit or a dot, and neither the optional letter nor the end of the version can be either. The digits and dots are an atomic group now, so the matcher keeps no backtracking for them, and the dead check is gone from the generated code.
• UninstallerViewModel (1749, cs/dispose-not-called-on-throw). The batch created its CancellationTokenSource and, since fix: uninstall apps from any drive, and let Cancel stop the leftover search #3152, disposed it later in the same method to start the leftover search's, outside a finally. The field owns the source: whatever replaces it next, or Dispose, disposes it, so a throw in between left nothing behind. The four places that replace it call RenewCancellation() now, marked [MemberNotNull(nameof(_cts))], which states that ownership in one place.

Behavior is unchanged

• The old and new patterns replace identically on all 271,452 strings of one to five characters from 1 9 . v V a x K _ - space (, and on 19 product names, in .NET and in Python's re. 868 of the generated strings hold a version, so the comparison is not over strings neither pattern matches.
• In the generated code, the VersionNumber matcher loses its loop backtracking and the check CodeQL flagged. Everything else in RegexGenerator.g.cs is the same apart from the pattern in its doc comment.
• The existing tests cover each changed condition, and each fails when its part is broken, by mutation, with each file restored byte for byte afterwards:
  • IsOnTheCard always true: 2 About tests fail, the download and the install that a newer release stops.
  • A static source with no server kept: 2 fail. An absent IPv6 with servers kept: 1 fails.
  • The game steps counted without a game: 1 fails. The administrator steps counted without it: 1 fails.
  • RenewCancellation keeping the last source: 1 fails, the cancelled batch whose leftover search still has to run.
• New: CaptureSnapshotAsync_AStaticSourceThatNamesNoServer_Throws, for IPv4 and IPv6, a check no test held before. Five WithoutVersion rows at the end of a version: one letter, two letters, a dot and a word, a letter between two parts, and a digit after the letter.

Checks

• All four projects build with 0 warnings, and dotnet format --verify-no-changes is clean.
• The unit suite passed twice on the final tree: 10,758 tests, 0 failed, and the one skip that was there before.
• No version bump or CHANGELOG entry: nothing anyone using the app sees changes.