Skip to content

Release v1.31.0 - #666

Merged
erikdarlingdata merged 35 commits into
mainfrom
dev
Oct 20, 2026
Merged

Release v1.31.0#666
erikdarlingdata merged 35 commits into
mainfrom
dev

Conversation

@erikdarlingdata

@erikdarlingdata erikdarlingdata commented Oct 20, 2026

Copy link
Copy Markdown
Owner

Release v1.31.0 (dev -> main). Merging this PR runs release.yml.

What ships

Release-time checks

  • Three SignPath approvals, in order: App, the Velopack-generated executables (SignTemplate), then the SSMS Vsix. Each waits up to 30 minutes.
  • SSMS extension and installer built locally at 1.31.0. The VSIX entry list matches v1.30.0's apart from the four parts signing adds.
  • release-auditor: READY. The only change to release.yml since v1.30.0 is Pin vulnerable transitive packages and audit them in CI (#650) #654's log capture in the SSMS build step (still continue-on-error); this run is its first.
  • Second run of the nuget.org push of PerformanceStudio.Cli (Trusted Publishing).
  • GitHub status: all systems operational when this PR was opened.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND

dependabot Bot and others added 30 commits October 13, 2026 05:23
@dependabot
ci: bump the actions group with 2 updates
3010287 
Bumps the actions group with 2 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `anthropics/claude-code-action` from 1.0.240 to 1.0.248
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@ed670b4...1d6de8c)

Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.248
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
deps: Bump the patch-and-minor group with 9 updates
718f282 
Bumps Avalonia from 12.1.3 to 12.1.4
Bumps Avalonia.Desktop from 12.1.3 to 12.1.4
Bumps Avalonia.Fonts.Inter from 12.1.3 to 12.1.4
Bumps Avalonia.Headless from 12.1.3 to 12.1.4
Bumps Avalonia.Themes.Fluent from 12.1.3 to 12.1.4
Bumps Meziantou.Framework.Win32.CredentialManager from 3.0.4 to 3.0.5
Bumps Microsoft.SqlServer.TransactSql.ScriptDom from 180.117.0 to 180.140.0
Bumps Microsoft.Testing.Extensions.HangDump from 2.4.1 to 2.5.1
Bumps xunit.v3 from 4.0.1 to 4.0.2

---
updated-dependencies:
- dependency-name: Avalonia
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Avalonia.Desktop
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Avalonia.Fonts.Inter
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Avalonia.Themes.Fluent
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Meziantou.Framework.Win32.CredentialManager
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Microsoft.SqlServer.TransactSql.ScriptDom
  dependency-version: 180.140.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: Meziantou.Framework.Win32.CredentialManager
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Microsoft.SqlServer.TransactSql.ScriptDom
  dependency-version: 180.140.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: Meziantou.Framework.Win32.CredentialManager
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Microsoft.SqlServer.TransactSql.ScriptDom
  dependency-version: 180.140.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: Avalonia
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Avalonia.Desktop
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Avalonia.Fonts.Inter
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Avalonia.Headless
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Avalonia.Themes.Fluent
  dependency-version: 12.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Meziantou.Framework.Win32.CredentialManager
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Microsoft.SqlServer.TransactSql.ScriptDom
  dependency-version: 180.140.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: Microsoft.Testing.Extensions.HangDump
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: Microsoft.Testing.Extensions.HangDump
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@erikdarlingdata @claude
Use sql2025 in the package README example
9d5cc34 
Suggested by Neal Mummau on #646: the latest SQL Server version makes the
better example server name.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HJ4mqVCaTTw3cnQqTEbRbC
@erikdarlingdata
Merge pull request #649 from erikdarlingdata/fix/646-readme-sql2025
32a72a8 
Use sql2025 in the package README example
@erikdarlingdata @claude
Suppress individual findings by query hash in .planview.json (#651)
61040e9 
Add a "suppressions" list beside "rules". Each entry names a statement by
query hash plus a rule number or warning type, an optional operator label
substring, and a required reason. Matching findings are flagged, never
removed, and drop out of total_warnings, critical_warnings and warning_types.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata @claude
Fix CI build, config error handling, suppressed counts and docs (#651)
e0a65f5 
Link OperatorLabel.cs into the Web project. Catch loader failures in the REPL
and the desktop app. Exclude suppressed warnings from the grid, root badge,
advice chip and comparison counts. Name the real config file in validation
errors. Add CLI, grouped text, advice and comparison tests. Docs follow-ups.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata @claude
Report an unreadable .planview.json as one line, not a crash (#651)
8b78ee3 
ConfigLoader.Load read the file unguarded, so a locked or permission-denied
config threw IOException or UnauthorizedAccessException past every caller
that catches InvalidDataException: the CLI commands, the REPL entry and the
desktop app's LoadPlan. Wrap the read the same way the parse is wrapped, so
all four sites print one line naming the file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata
Merge pull request #644 from erikdarlingdata/dependabot/nuget/dev/pat…
b541dcf 
…ch-and-minor-0ec8aa1b38

deps: Bump the patch-and-minor group with 9 updates
@erikdarlingdata
Merge pull request #643 from erikdarlingdata/dependabot/github_action…
d9f2d67 
…s/dev/actions-d2229f474e

ci: bump the actions group with 2 updates
@erikdarlingdata
Merge pull request #652 from erikdarlingdata/fix/651-suppressions
347d863 
Suppress individual findings by query hash in .planview.json (#651)
@erikdarlingdata @claude
Pin vulnerable transitive packages and audit them in CI (#650)
92bd902 
Pin System.Security.Cryptography.Pkcs 10.0.13 (via PlanViewer.Core) and
MessagePack 2.5.307 (via PlanViewer.Ssms) over the transitive versions,
audit transitive packages with NU1903 as an error, and submit the resolved
dependency graph to GitHub.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata @claude
Exclude MessagePack runtime assets in SSMS, fix workflow steps and a …
5dfe9b7 
…comment (#650)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata @claude
Apply round-1 review: gate NU1904, harden dependency submission, fix …
e49b942 
…Pkcs drop condition

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata
Merge pull request #654 from erikdarlingdata/fix/650-transitive-pins
b351f19 
Pin vulnerable transitive packages and audit them in CI (#650)
@erikdarlingdata @claude
Submit the dependency snapshot without a third-party binary holding t…
a98c6c7 
…he write token (#655)

Split dependency-submission.yml into a read-only detect job that builds the snapshot from
obj/project.assets.json with a repo script, and a write-token submit job that only downloads
the artifact and posts it with gh api.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata @claude
Apply round-1 security review to the dependency snapshot workflow (#655)
74d552c 
- Restore PlanShare in its own step.
- Restore SSMS projects under bash so the first failing restore fails the step.
- Script fails when an assets file logs a restore Error; add #Requires -Version 7.0.
- submit rewrites sha, ref and job id from the run, fails unless result is SUCCESS or
  ACCEPTED, and prints the response body on an HTTP error.
- Concurrency group per ref so the latest commit's graph is submitted last.
- Correct the correlator comment (the old action's snapshot is not replaced) and the scope comment.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata @claude
Restore line continuations in the submit step (#655)
7621e83 
Cosmetic: the two multi-line commands had been flattened into single
lines with runs of spaces. Same commands, same behavior.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata
Merge pull request #656 from erikdarlingdata/fix/655-dependency-snapshot
4f4f59f 
Submit the dependency snapshot without a third-party binary holding the write token (#655)
@erikdarlingdata @claude
Run the SSMS restore step under pwsh with per-command exit checks (#655)
0d058da 
The first dev run of the two-job workflow (38660830104) failed at "Restore SSMS
projects" with "msbuild: command not found". The round-1 review had switched the
step to bash so the first failing restore would fail the step, but the msbuild
folder that setup-msbuild adds to PATH does not reach a bash step on the Windows
runner. It did reach the pwsh step in the green run before that change.

The step runs under pwsh again, and each restore checks $LASTEXITCODE so a
failure in the first or second command still fails the step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MrD9SGvLFx4kJaeGZyXG9
@erikdarlingdata
Merge pull request #657 from erikdarlingdata/fix/655-ssms-restore-pwsh
4e63d5d 
Run the SSMS restore step under pwsh with per-command exit checks (#655)
@dependabot
ci: bump the actions group with 2 updates
9b1315b 
Bumps the actions group with 2 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [actions/download-artifact](https://github.com/actions/download-artifact).


Updates `anthropics/claude-code-action` from 1.0.248 to 1.0.252
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@1d6de8c...f27be6b)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.252
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@erikdarlingdata @claude
Self CPU: subtract whole batch zones, and sum threads for an operator…
563da59 
…'s own CPU

The CLI's "Expensive operators" list and the GUI's advice cards each did their
own row-mode subtraction. It took only a batch child's own time, so a row-mode
parent was charged the rest of the batch zone, for elapsed and CPU both. On
param-sniffing-posttypeid2.sqlplan the Stream Aggregate (node 4) showed
14,771 ms CPU and 14,720 ms elapsed. PlanAnalyzer already gave it 3,059 ms of
elapsed. The listed CPU shares added up to 159%.

- PlanAnalyzer.GetOperatorOwnCpuMs (new): own CPU summed across threads,
  per-thread subtraction, batch zones summed. OperatorResult gets OwnCpuMs and
  OwnElapsedMs (own_cpu_ms / own_elapsed_ms in JSON) from ResultMapper, and the
  text formatter and advice cards read those instead of subtracting again.
- GetEffectiveChildCpuMs sums a batch child's zone, like the elapsed path does.
  This also fixes the serial path of GetOperatorMaxThreadOwnCpuMs.
- GetOperatorMaxThreadOwnCpuMs returns a batch operator's busiest thread
  without subtracting children, like GetOperatorOwnElapsedMs.
- NodeTimeAttribution.GetOwnCpuMs sums batch zones too.

After: node 4 shows 3,112 ms CPU and 3,059 ms elapsed, and the shares add up
to 98%. Across the 60 test plans, the Expensive operators text changes on 10.
Two plans listed CPU shares over 105% before, and none do now.

Four new tests in OperatorSelfTimeTests. Core tests: 1,503 total, 0 failed,
40 skipped (1,499 and 40 before).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@erikdarlingdata @claude
Update two comments for the analyzer-owned own times
060c304 
The advice cards no longer mirror TextFormatter's attribution, only its
filtering, ranking and formatting; both read OwnCpuMs and OwnElapsedMs from
OperatorResult. NodeTimeAttribution's remark now names GetOperatorOwnCpuMs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND
@erikdarlingdata @claude
Fall back to the estimated mode in the analyzer's own-time batch checks
da1f33e 
GetOperatorOwnElapsedMs, GetOperatorMaxThreadOwnCpuMs and GetOperatorOwnCpuMs
read only ActualExecutionMode for the node itself, while the child paths read
ActualExecutionMode ?? ExecutionMode. The parser fills ActualExecutionMode from
a per-thread attribute that can be missing, so a batch node without it was
subtracted as a batch child but treated as row mode as a parent. All three now
use the same fallback as the child paths and NodeTimeAttribution.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND
@erikdarlingdata @claude
Keep a batch node's total CPU when it has no per-thread rows
3761fcb 
GetOperatorMaxThreadOwnCpuMs returned 0 for a batch node with no
PerThreadStats. Parsed plans always have at least one thread row when
ActualCPUMs is above 0, but a node built in code may not, so fall back to
ActualCPUMs as GetOperatorOwnCpuMs does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND
@erikdarlingdata
Merge pull request #662 from erikdarlingdata/fix/self-cpu-batch-zones
ec6573c 
Self CPU: subtract whole batch zones, and sum threads for an operator's own CPU
@erikdarlingdata @claude
get_expensive_operators ranks by own time, not cumulative elapsed (#658)
b59e074 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND
@erikdarlingdata
Merge pull request #663 from erikdarlingdata/fix/658-expensive-operat…
c7f0f08 
…ors-own-time

get_expensive_operators ranks by own time, not cumulative elapsed (#658)
@erikdarlingdata @claude
deps: apply the 13 patch-and-minor bumps from #660; ignore SelectionC…
6ed2ec7 
…hanged raised during XAML load in SettingsWindow

Avalonia 12.1.4 raises SelectionChanged while the XAML loads, before the named
fields are assigned, so opening Settings threw a NullReferenceException.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND
@erikdarlingdata
Merge pull request #664 from erikdarlingdata/deps/660-patch-and-minor
5a8679b 
deps: apply the 13 patch-and-minor bumps from #660; handle Avalonia 12.1.4 load-time selection events
erikdarlingdata and others added 4 commits October 20, 2026 11:10
@erikdarlingdata @claude
Bump version to 1.31.0
d26b02f 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND
@erikdarlingdata
Merge pull request #665 from erikdarlingdata/release/v1.31.0
825fa75 
Bump version to 1.31.0
@erikdarlingdata
Merge pull request #659 from erikdarlingdata/dependabot/github_action…
d64f34f 
…s/dev/actions-61e773faea

ci: bump the actions group with 2 updates
@erikdarlingdata @claude
Merge main into dev for the v1.31.0 release
d3d8225 
main carries #653, which synced #643's action pins from dev on 2026-10-14.
#659 has since moved the same lines in claude-code-review.yml and
claude.yml to claude-code-action v1.0.252, so release PR #666 conflicted.
Both conflicts take dev's side; the merged tree is identical to dev's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoaQ2xKMpZEXvm4HncT8ND
@erikdarlingdata erikdarlingdata mentioned this pull request Oct 20, 2026
Merged
@erikdarlingdata
Merge pull request #667 from erikdarlingdata/sync/main-into-dev-v1.31.0
9ecbb8b 
Merge main into dev for the v1.31.0 release
@erikdarlingdata
erikdarlingdata merged commit 5b504ea into main Oct 20, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@erikdarlingdata