Avalonia.Desktop is a patch behind Avalonia (12.1.4 vs 12.1.5), so the package ships mixed Avalonia assemblies; dependabot has no Avalonia group to keep them together #77

What's wrong

Directory.Packages.props lines 6-8 currently pin:

<PackageVersion Include="Avalonia" Version="12.1.5" />
<PackageVersion Include="Avalonia.Desktop" Version="12.1.4" />
<PackageVersion Include="Avalonia.Native" Version="12.1.5" />

Restore therefore resolves two Avalonia versions side by side, for every TFM and RID:

• Avalonia.Base, Avalonia.Native and Avalonia.Remote.Protocol come in at 12.1.5.
• Avalonia.X11, Avalonia.Win32, Avalonia.Skia, Avalonia.FreeDesktop and Avalonia.HarfBuzz come in through Avalonia.Desktop at 12.1.4.

In the built demo, Avalonia.Base.dll is 12.1.5.0 and Avalonia.X11.dll is 12.1.4.0.

How it happened, and why it will keep happening

• Dependabot opened Bump Avalonia from 12.1.4 to 12.1.5 #72, Bump Avalonia, Avalonia.Desktop and Avalonia.Native #73 and Bump Avalonia and Avalonia.Native #74 at about the same time.
• Bump Avalonia and Avalonia.Native #74 bumped only Avalonia and Avalonia.Native and was merged (bf0fa39).
• Bump Avalonia, Avalonia.Desktop and Avalonia.Native #73, which bumped all three, was then closed as "no longer updatable", leaving Desktop behind.
• The same thing happened before. Bump Avalonia and Avalonia.Native #48 (6f2c408) moved Avalonia and Avalonia.Native to 12.1.4 while Desktop stayed at 12.1.3, until Bump Avalonia.Desktop from 12.1.3 to 12.1.4 #50 (cf13176). Release v1.4.3-pre.1 (dbaec0b) shipped in that skewed state.

.github/dependabot.yml groups ktsu.*, Microsoft.*, System.* and Silk.NET.*, but has no group for Avalonia*, so the three packages arrive in separate PRs.

Why it matters

Consumers of the published package get a combination of Avalonia assemblies the Avalonia team never released together. Avalonia's platform backends (X11, Win32, Skia) use internal and private APIs of Avalonia.Base. A patch release that changes one of those APIs turns this into a runtime MissingMethodException/TypeLoadException in the tray path, on only some platforms.

The current skew does not break today: a tray run under xvfb worked. This is a hazard, not an observed crash.

Suggested fix / acceptance criteria

• Bump Avalonia.Desktop to 12.1.5 so all three match.
• Add a dependabot group, for example:

  avalonia:
    patterns:
      - "Avalonia*"

  so the packages always move in a single PR.
• Optional: a build-time check that fails when the Avalonia* PackageVersion entries differ.