feat(comet): upgrade Comet to .NET 11 preview 5

[davidortinau]

What

Bumps Comet's pinned SDK and MAUI version to the .NET 11 preview 5 release (2026-06-09). The bump is scoped to the Comet subtree only — the rest of maui-labs (DevFlow, Linux.Gtk4, Windows.WPF, EssentialsAI, samples) stays on MAUI 10 until those products migrate separately.

Changes (all under src/Comet/)

File	Change
global.json	SDK 11.0.100-preview.3 → 11.0.100-preview.5.26302.115
Directory.Build.props	Hardcode MauiVersion to 11.0.0-preview.5.26304.4 (with TODO to drop the override once eng/Versions.props moves to MAUI 11)
sample/CometControlsGallery/CometControlsGallery.csproj	Hardcoded -macos MauiVersion override 10.0.31 → preview.5
sample/CometMacApp/CometMacApp.csproj	Hardcoded MauiVersion 10.0.31 → preview.5
NuGet.config (new)	Comet-scoped nuget.org feed so Debug samples can restore Redth.MauiDevFlow.Agent (per .squad/decisions.md the team standard) — that package isn't mirrored on any dnceng feed the repo-root NuGet.config restricts itself to

Why scope to Comet only

A repo-wide bump of MicrosoftMauiControlsVersion to preview.5 would break every sibling on net10.0-* that uses CPM aliases without a VersionOverride — MAUI 11 preview 5 only ships net11.0 / netstandard lib assets, no net10.0. Affected projects include the Linux.Gtk4 backend, the Windows.WPF backend, the EssentialsAI samples, the AIExtensions samples, and DevFlow.Sample. Keeping the bump local to src/Comet/Directory.Build.props leaves those net10.0 consumers untouched.

The <Import Project="...eng/Versions.props" /> in Comet's Directory.Build.props is preserved so future repo-wide MicrosoftMauiControlsVersion updates flow through if the override is removed.

Verified on macOS / preview 5

• dotnet build src/Comet/src/Comet/Comet.csproj (Debug, net11.0-maccatalyst): 0 errors after rm -rf obj/ clean restore.
• dotnet build sample/Comet.Sample (Debug, net11.0-maccatalyst): 0 errors after clean restore.
• project.assets.json confirms Microsoft.Maui.Controls/11.0.0-preview.5.26304.4 resolves (proves the localized version wins, not the repo-wide 10.0.41).
• Comet.Sample launched on Mac Catalyst — visible UI, MauiDevFlow agent on port 9223, no startup errors, killed cleanly.

Follow-ups (not in this PR)

• Re-enable net11.0-macos in src/Comet/src/Comet/Comet.csproj (the "workload not yet available" comment is obsolete in preview 5 — microsoft.net.sdk.macos ships).
• Migrate the rest of the repo to MAUI 11 in dedicated per-product PRs; once eng/Versions.props is on MAUI 11, drop the override in Directory.Build.props per the TODO.

[github-actions]

Expert Code Review — PR #325

Methodology: 3 independent reviewers with adversarial consensus

Findings: 4 posted as inline comments

#	Severity	Consensus	File	Summary
1	🔴 Critical	3/3	src/Comet/NuGet.config	nuget.org added without packageSourceMapping — supply chain / dependency confusion risk
2	🟡 Moderate	2/3 (follow-up)	src/Comet/sample/CometMacApp/CometMacApp.csproj	Unconditional MauiVersion will silently freeze on next preview bump
3	🟢 Minor	2/3	src/Comet/sample/CometControlsGallery/CometControlsGallery.csproj	Dead code — MauiVersion condition is unreachable
4	🟢 Minor	3/3 (follow-up)	src/Comet/global.json + CI workflow	rollForward: latestPatch + floating CI SDK install will break when preview.6 ships

Discarded Findings

• Floating Version="*" for Redth.MauiDevFlow.Agent (1 reviewer only) — both follow-up reviewers disagreed; the floating version is pre-existing, Release-only, in a non-shipping sample, and not a regression introduced by this PR.

CI Status

• ❌ build (macos-latest) — failed
• 🚫 build (windows-latest) — cancelled (dependent on macOS)
• ✅ license/cla — passed

Test Coverage

This PR contains no test changes. As a version-bump PR scoped to build infrastructure and sample projects, no new tests are expected. However, the CI build failure on macOS should be investigated.

---

Generated by Expert Code Review · 3 independent reviewers with adversarial consensus

Generated by Expert Code Review (auto) for issue #325 · ● 7.9M · ◷

[github-actions]

Expert Code Review: 4 findings posted inline (1 critical, 1 moderate, 2 minor). See the summary comment for full details.

Generated by Expert Code Review (auto) for issue #325 · ● 7.9M

[github-actions]

🟢 MINOR · 2/3 consensus

Dead code: MauiVersion condition is unreachable

This condition $(TargetFramework.Contains('-macos')) AND '$(MauiVersion)' == '' can never be true because Directory.Build.props already sets MauiVersion (via its own == '' guard) before this csproj body evaluates. The line is unreachable dead code that may mislead developers during future version bumps.

Recommendation: Remove the line or add a comment noting it's a placeholder for when -macos is re-enabled in <TargetFrameworks>.

[github-actions]

🔴 CRITICAL · 3/3 consensus

Supply chain: nuget.org added without packageSourceMapping

This config adds nuget.org to the restore path for the entire src/Comet/ subtree with no <packageSourceMapping>. NuGet resolves packages from the feed offering the highest matching version — any attacker publishing a package with the same ID as a dnceng-hosted package (internal tooling, preview MAUI assets, etc.) and a higher version number would silently win resolution (classic dependency-confusion vector).

Combined with the Version="*" floating reference for Redth.MauiDevFlow.Agent in the samples, this is actively exploitable in Release builds.

Recommendation: Add <packageSourceMapping> to scope nuget.org to only the required package pattern:

<packageSourceMapping>
  <packageSource key="nuget.org">
    <package pattern="Redth.MauiDevFlow.*" />
  </packageSource>
</packageSourceMapping>

[github-actions]

🟡 MODERATE · 2/3 consensus (confirmed via follow-up)

Silent version freeze on next preview bump

This <MauiVersion> is set unconditionally (no Condition attribute). In MSBuild evaluation order, Directory.Build.props runs first and sets MauiVersion conditionally, then this csproj overwrites it unconditionally. When Directory.Build.props is bumped for preview.6, this project will silently stay on preview.5.

Recommendation: Either remove the inline property and rely on Directory.Build.props, or add a guard condition:

<MauiVersion Condition="'$(MauiVersion)' == ''">11.0.0-preview.5.26304.4</MauiVersion>

Note: One reviewer disagreed, arguing the unconditional override is intentional because eng/Versions.props may still carry a MAUI 10 value. If that's the intent, a comment explaining this would prevent future confusion.

[github-actions]

🟢 MINOR · 3/3 consensus (confirmed via follow-up)

CI version band drift risk

.github/workflows/ci-comet.yml uses dotnet-version: '11.0.x' + dotnet-quality: 'preview' (floating). This global.json pins 11.0.100-preview.5 with rollForward: latestPatch. When preview.6 ships, CI will install preview.6, but latestPatch won't roll forward across preview bands (preview.5→preview.6 is a feature-band change). Builds will fail with "SDK not found."

Recommendation: Either use global-json-file: src/Comet/global.json in the setup-dotnet action (so the exact pinned version is installed), or change rollForward to latestFeature.