Bump Microsoft.Windows.SDK.BuildTools from 10.0.28000.2270 to 10.0.28000.2526

[dependabot]

Updated Microsoft.Windows.SDK.BuildTools from 10.0.28000.2270 to 10.0.28000.2526.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 27, 2026, 2:17 AM ET / 06:17 UTC.

ClawSweeper review

What this changes

Updates the shared Microsoft Windows SDK build-tools NuGet version from 10.0.28000.2270 to 10.0.28000.2526 for projects that consume the repository build configuration.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep open. This is a focused Dependabot patch that updates one centralized Windows SDK build-tools version, and the supplied current-main base still uses the older version, so the requested update is not already implemented. No line-level correctness or security defect is evident from the one-property diff; let the in-progress Windows CI validate the package upgrade at this head.

Priority: P3
Reviewed head: 60e064182cfd04986723aa59eb83d06f200e2219

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A small, conventional dependency-version update with a clear shared configuration boundary; final confidence depends on the in-progress Windows CI.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot dependency-maintenance PR is bot-authored; the applicable evidence is the repository's build and test CI rather than contributor-specific runtime proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot dependency-maintenance PR is bot-authored; the applicable evidence is the repository's build and test CI rather than contributor-specific runtime proof.
Evidence reviewed	4 items	Focused PR diff: The submitted change modifies only the centralized MicrosoftWindowsSdkBuildToolsVersion property, from 10.0.28000.2270 to 10.0.28000.2526. Current-main comparison: The provided pull-request patch is based on current main acf4ab1, where the property still has the previous 10.0.28000.2270 value; the update is therefore not already present on main. Review and validation state: The supplied PR context reports no human review comments or review findings, is cleanly mergeable, and has its Windows test and E2E checks still in progress; those checks are the appropriate remaining compatibility signal for a build-tooling patch.
Findings	None	None.
Security	None	None.

How this fits together

The repository uses a shared MSBuild properties file to provide package versions to its Windows tray, node, and test projects. During restore and build, those projects consume this setting to select the Windows SDK build-tools package used by the build toolchain.

flowchart LR
  A[Project files] --> B[Shared build configuration]
  B --> C[Windows SDK BuildTools version]
  C --> D[NuGet restore]
  D --> E[Windows build toolchain]
  E --> F[Tray, node, and test builds]

Loading

Before merge

• Resolve merge risk (P1) - The new SDK build-tools package has not yet completed the repository's Windows build, shared-test, tray-test, and E2E CI checks at this PR head.
• Complete next step (P2) - This is a normal, narrowly scoped dependency PR awaiting its existing CI validation, not a concrete repair task for an automated fix lane.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Change scope	1 file changed, 1 property updated	The patch has a narrowly bounded build-tooling surface, so completed Windows CI is more informative than broad code review.

Merge-risk options

Maintainer options:

1. Decide the mitigation before merge
   Retain the single shared version-property update and merge only after the repository's required Windows validation completes successfully for this exact dependency version.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Retain the single shared version-property update and merge only after the repository's required Windows validation completes successfully for this exact dependency version.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates a build-time package version rather than repairing a reported runtime failure, and the relevant validation path is the repository's Windows build and test suite.

Is this the best way to solve the issue?

Yes: changing the existing centralized version property is the narrowest maintainable route because dependent projects already receive this package version through shared build configuration.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against acf4ab1d2b02.

Labels

Label changes:

• add P3: This is a routine patch-level build dependency update with no reported user-facing regression or demonstrated failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot dependency-maintenance PR is bot-authored; the applicable evidence is the repository's build and test CI rather than contributor-specific runtime proof.

Label justifications:

• P3: This is a routine patch-level build dependency update with no reported user-facing regression or demonstrated failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot dependency-maintenance PR is bot-authored; the applicable evidence is the repository's build and test CI rather than contributor-specific runtime proof.

Evidence

What I checked:

• Focused PR diff: The submitted change modifies only the centralized MicrosoftWindowsSdkBuildToolsVersion property, from 10.0.28000.2270 to 10.0.28000.2526. (Directory.Build.props:5, 60e064182cfd)
• Current-main comparison: The provided pull-request patch is based on current main acf4ab1, where the property still has the previous 10.0.28000.2270 value; the update is therefore not already present on main. (Directory.Build.props:5, acf4ab1d2b02)
• Review and validation state: The supplied PR context reports no human review comments or review findings, is cleanly mergeable, and has its Windows test and E2E checks still in progress; those checks are the appropriate remaining compatibility signal for a build-tooling patch. (60e064182cfd)
• Historical area signal: The repository release history records an earlier Microsoft.Windows.SDK.BuildTools dependency bump in pull request 282, indicating this version property has an established automated dependency-maintenance path. (Directory.Build.props:5)

Likely related people:

• github-actions[bot]: Repository release history attributes an earlier Microsoft.Windows.SDK.BuildTools upgrade to this automation path, making it the only concrete historical signal available for the centralized dependency setting. (role: recent area contributor; confidence: low; files: Directory.Build.props)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Let the required Windows build, shared tests, tray tests, and E2E checks complete successfully at the current head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.