v26.5.1.960

All changes since the last stable release (v26.3.5.912).

Highlights

• Light mode is now available, with an option to follow the system theme (title bar included).
• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering across sessions.
• MUI-aware event message resolution — events on international Windows installs (and from exported .evtx files with LocaleMetaData folders) now resolve correctly via .mui satellites instead of falling back to placeholders.
• Faster combined-events sorting via a k-way merge of pre-sorted per-log lists (replaces the full re-sort), and a cross-log RecordId equality bug is fixed.
• Filter pipeline overhaul — immutable BasicFilterSource / CompiledFilter model, signature-based change detection, parallel filtering above a threshold, and only-new-events filtering on arrival instead of re-filtering all active logs.
• Custom menu bar replaces the XAML one and simplifies context menus across the app.
• Accessibility infrastructure: skip link, live regions, focus-visible, reduced-motion, landmarks, role=button, non-color cues.
• Details pane height is now remembered as a user preference.
• DbTool now supports MTA files; added missing severity levels and additional event types / EvtVariantTypes for broader event coverage.
• Major memory and performance pass — pooled StringBuilder via thread-static cache, System.Text.Json source generators for provider DB serialization, IFormattable direct-write logging, primitive specializations on interpolated log handlers, and many smaller hot-path wins.

Features

• Light mode with follow-system-theme option, and the title bar honors the OS theme.
• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering.
• Details pane height persisted as a user preference.
• XML resolution no longer requires the toggle — XML is automatically available, but only resolved when a filter actually needs it.
• Custom menu bar with templated menu items, replacing the XAML menu bar (also simplifies context menus).
• Improved keyboard navigation in the event table, with refactored event selection.
• LogName parser now creates folder structure that aligns with the MMC.
• Support for exported LocaleMetaData folders when resolving events from exported .evtx files.
• DbTool supports MTA files for provider details.
• Added missing severity levels so more events display the correct level.
• Added additional event types and EvtVariantTypes for broader event coverage.
• Title bar shows app name and version before log names.
• Markdown italics now render in release notes / in-app Markdown.

Filter Improvements

• New immutable filter model: BasicFilterSource, CompiledFilter, and a FilterCompiler replacing the old mutable FilterModel shape.
• FilterEditorModel split into Main + flat SubClauses with mutable draft types, leaving the persisted FilterModel immutable.
• Signature-based change detection computed during filter construction (no more refilter on UI flip).
• Parallel filtering above a threshold when combined event count is large; only-new-events filtering on arrival instead of re-filtering all active logs.
• FilterCategoryEditor items cached per ActiveLogs snapshot via ConditionalWeakTable to avoid per-render recomputation.
• EventFilter.RequiresXml precomputed at construction instead of scanned on every access.
• FilterService.TryParse string escaping now handles quotes, backslashes, and whitespace consistently across top-level, sub-filter, and MultiSelect paths.
• New-filter drafts now render as FilterPane-local / FilterGroup-local pending rows instead of dispatching IsEditing placeholders, with stale row state cleared on group collapse.
• Filters are now indexed so position in the pane is preserved.
• Generic BaseFilterRow / EditableFilterRowBase shares common row code; FilterGroup.SetFilter is now an upsert.
• Favorites import deduplication and filter group display rebuild consolidated and optimized.
• Date-range default logic moved into a single DateRangeDefaults helper.
• Filter spinner: replaced ToggleIsLoading with SetIsLoading and added a filter-generation guard for stale-result races.
• Retired FilterModel.IsEditing and the legacy in-state edit actions/reducers/effects; finalized init-only FilterModel fields.

Performance & Memory

• K-way merge of pre-sorted per-log lists for combined events (replaces full re-sort); per-log/combined default aligned to DateAndTime.
• Pooled StringBuilder via thread-static cache; replaced per-call format-token allocations with IFormattable direct paths, plus primitive specializations on logging interpolated handlers.
• System.Text.Json source generators for provider database DTO serialization.
• Streamed JSON directly to/from GZipStream in CompressedJsonValueConverter — eliminates intermediate string and byte[] allocations.
• Per-provider Lazy gates coalesce first-touch ProviderDetails work; replaced shared Registry.LocalMachine with an owned base key for parallel local resolution.
• Single-pass GetKeywordsFromBitmask: hoisted Keywords value, mask-gated the standard-keyword loop, replaced .Keys+indexer with KVP enumeration.
• stackalloc bounded in EventMethods native-render paths, with ArrayPool fallback above 4096 chars.
• GetComparer ascending/descending instances cached as static readonly singletons.
• ScrollToSelectedEvent collapsed from FirstOrDefault + IndexOf into a single indexed pass over DisplayedEvents.
• Multi-event clipboard copy reuses a single StringBuilder; replaced OwningLog.Split.Last with a LastIndexOf slice (also in the row template).
• Deferred KeywordsDisplayName join until first read.
• Rotating cache for NTStatus and HResult lookups.
• Caches are instance-based so they release at end of life cycle.
• Faster event table loading (batch loading + improved indexing).
• Refactored string cache and keywords display (created on init instead of per call); consolidated to IReadOnlyList and removed extra allocations.
• Sort-in-place on load (no ImmutableArray round-trip); event table compares updated vs. current combined lists before triggering an update; status bar only triggers updates on actual value changes.
• Logger allocates only when an event is actually logged, and uses a temp file instead of in-memory buffering.
• Property-count function reuses the same caching as the format-properties function; better template matching when multiple candidates exist.
• Optimized hot paths and reduced redundant allocations across the app.

Async / Threading Cleanup

• HandleOpenLog uses channels instead of run-jobs, with a semaphore to throttle threads when multiple logs are opened.
• Replaced FireAndForget with InvokeAsync so the render thread and JS interop play nicely.
• Converted certain async void methods to async Task; wrapped InvokeAsync calls with exception handlers and removed redundant InvokeAsync calls.
• Updated CTS flow for cleaner cancellation; tests updated to use cancellation tokens.
• Simplified the provider lock pattern.
• Set a threshold for switching filtering to parallel; removed IsLoading for table updates with multi-log loading.
• Refactored the logger to use an event instead of an action property.

UI / CSS / Accessibility

• New a11y infrastructure: focus-visible, reduced-motion, landmarks.
• New a11y behavior: skip link, live regions, role=button, non-color cues.
• Converted ID selectors to classes, removed !important overrides, and dropped the forced-colors override.
• Consolidated CSS tokens and removed unused/redundant CSS; row styles share a common base.
• Generic modal service replaces individual modal components; per-modal sizing variables and an inline alert header for modals.
• Boolean select restyled to be theme-consistent — enabled state now uses the positive color (no more red/green polarity confusion).
• ValueSelect dropdowns: bug fixes and optimizations.
• Removed unused HTML / navigation scaffolding and dropped aria-expanded from the Razor side (handled by JS).
• Markdown parser now supports italics.

Bug Fixes

• Cross-log RecordId equality bug in the combined-events view (records from different logs no longer collide).
• Index out of range when event messages contain a trailing %n or use 0 as a terminator.
• Variant type mismatch that could cause event resolution issues; added a missing variant and a more diagnostic default.
• Reading a log file after it was deleted.
• Temp file creation failure when encryption was involved (now uses a file stream directly instead of copying).
• Dispose method on the DB event resolver and a watcher constructor bug.
• Logger DI issue.
• Failure dialogs now only appear when a manual scan is initiated (no more startup-scan noise).
• Several smaller bugs and optimizations in ValueSelect.
• Added a failure path when Deserialize returns null.
• Added IDisposable to several components to prevent leaks; cleaned up unneeded dispose patterns.