v26.5.1.960

All changes since the last stable release (v26.3.5.912).

Highlights

• Light mode is now available, with an option to follow the system theme (title bar included).
• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering across sessions.
• MUI-aware event message resolution — events on international Windows installs (and from exported .evtx files with LocaleMetaData folders) now resolve correctly via .mui satellites instead of falling back to placeholders.
• Faster combined-events sorting via a k-way merge of pre-sorted per-log lists (replaces the full re-sort), and a cross-log RecordId equality bug is fixed.
• Filter pipeline overhaul — immutable BasicFilterSource / CompiledFilter model, signature-based change detection, parallel filtering above a threshold, and only-new-events filtering on arrival instead of re-filtering all active logs.
• Custom menu bar replaces the XAML one and simplifies context menus across the app.
• Accessibility infrastructure: skip link, live regions, focus-visible, reduced-motion, landmarks, role=button, non-color cues.
• Details pane height is now remembered as a user preference.
• DbTool now supports MTA files; added missing severity levels and additional event types / EvtVariantTypes for broader event coverage.
• Major memory and performance pass — pooled StringBuilder via thread-static cache, System.Text.Json source generators for provider DB serialization, IFormattable direct-write logging, primitive specializations on interpolated log handlers, and many smaller hot-path wins.

Features

• Light mode with follow-system-theme option, and the title bar honors the OS theme.
• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering.
• Details pane height persisted as a user preference.
• XML resolution no longer requires the toggle — XML is automatically available, but only resolved when a filter actually needs it.
• Custom menu bar with templated menu items, replacing the XAML menu bar (also simplifies context menus).
• Improved keyboard navigation in the event table, with refactored event selection.
• LogName parser now creates folder structure that aligns with the MMC.
• Support for exported LocaleMetaData folders when resolving events from exported .evtx files.
• DbTool supports MTA files for provider details.
• Added missing severity levels so more events display the correct level.
• Added additional event types and EvtVariantTypes for broader event coverage.
• Title bar shows app name and version before log names.
• Markdown italics now render in release notes / in-app Markdown.

Filter Improvements

• New immutable filter model: BasicFilterSource, CompiledFilter, and a FilterCompiler replacing the old mutable FilterModel shape.
• FilterEditorModel split into Main + flat SubClauses with mutable draft types, leaving the persisted FilterModel immutable.
• Signature-based change detection computed during filter construction (no more refilter on UI flip).
• Parallel filtering above a threshold when combined event count is large; only-new-events filtering on arrival instead of re-filtering all active logs.
• FilterCategoryEditor items cached per ActiveLogs snapshot via ConditionalWeakTable to avoid per-render recomputation.
• EventFilter.RequiresXml precomputed at construction instead of scanned on every access.
• FilterService.TryParse string escaping now handles quotes, backslashes, and whitespace consistently across top-level, sub-filter, and MultiSelect paths.
• New-filter drafts now render as FilterPane-local / FilterGroup-local pending rows instead of dispatching IsEditing placeholders, with stale row state cleared on group collapse.
• Filters are now indexed so position in the pane is preserved.
• Generic BaseFilterRow / EditableFilterRowBase shares common row code; FilterGroup.SetFilter is now an upsert.
• Favorites import deduplication and filter group display rebuild consolidated and optimized.
• Date-range default logic moved into a single DateRangeDefaults helper.
• Filter spinner: replaced ToggleIsLoading with SetIsLoading and added a filter-generation guard for stale-result races.
• Retired FilterModel.IsEditing and the legacy in-state edit actions/reducers/effects; finalized init-only FilterModel fields.

Performance & Memory

• K-way merge of pre-sorted per-log lists for combined events (replaces full re-sort); per-log/combined default aligned to DateAndTime.
• Pooled StringBuilder via thread-static cache; replaced per-call format-token allocations with IFormattable direct paths, plus primitive specializations on logging interpolated handlers.
• System.Text.Json source generators for provider database DTO serialization.
• Streamed JSON directly to/from GZipStream in CompressedJsonValueConverter — eliminates intermediate string and byte[] allocations.
• Per-provider Lazy gates coalesce first-touch ProviderDetails work; replaced shared Registry.LocalMachine with an owned base key for parallel local resolution.
• Single-pass GetKeywordsFromBitmask: hoisted Keywords value, mask-gated the standard-keyword loop, replaced .Keys+indexer with KVP enumeration.
• stackalloc bounded in EventMethods native-render paths, with ArrayPool fallback above 4096 chars.
• GetComparer ascending/descending instances cached as static readonly singletons.
• ScrollToSelectedEvent collapsed from FirstOrDefault + IndexOf into a single indexed pass over DisplayedEvents.
• Multi-event clipboard copy reuses a single StringBuilder; replaced OwningLog.Split.Last with a LastIndexOf slice (also in the row template).
• Deferred KeywordsDisplayName join until first read.
• Rotating cache for NTStatus and HResult lookups.
• Caches are instance-based so they release at end of life cycle.
• Faster event table loading (batch loading + improved indexing).
• Refactored string cache and keywords display (created on init instead of per call); consolidated to IReadOnlyList and removed extra allocations.
• Sort-in-place on load (no ImmutableArray round-trip); event table compares updated vs. current combined lists before triggering an update; status bar only triggers updates on actual value changes.
• Logger allocates only when an event is actually logged, and uses a temp file instead of in-memory buffering.
• Property-count function reuses the same caching as the format-properties function; better template matching when multiple candidates exist.
• Optimized hot paths and reduced redundant allocations across the app.

Async / Threading Cleanup

• HandleOpenLog uses channels instead of run-jobs, with a semaphore to throttle threads when multiple logs are opened.
• Replaced FireAndForget with InvokeAsync so the render thread and JS interop play nicely.
• Converted certain async void methods to async Task; wrapped InvokeAsync calls with exception handlers and removed redundant InvokeAsync calls.
• Updated CTS flow for cleaner cancellation; tests updated to use cancellation tokens.
• Simplified the provider lock pattern.
• Set a threshold for switching filtering to parallel; removed IsLoading for table updates with multi-log loading.
• Refactored the logger to use an event instead of an action property.

UI / CSS / Accessibility

• New a11y infrastructure: focus-visible, reduced-motion, landmarks.
• New a11y behavior: skip link, live regions, role=button, non-color cues.
• Converted ID selectors to classes, removed !important overrides, and dropped the forced-colors override.
• Consolidated CSS tokens and removed unused/redundant CSS; row styles share a common base.
• Generic modal service replaces individual modal components; per-modal sizing variables and an inline alert header for modals.
• Boolean select restyled to be theme-consistent — enabled state now uses the positive color (no more red/green polarity confusion).
• ValueSelect dropdowns: bug fixes and optimizations.
• Removed unused HTML / navigation scaffolding and dropped aria-expanded from the Razor side (handled by JS).
• Markdown parser now supports italics.

Bug Fixes

• Cross-log RecordId equality bug in the combined-events view (records from different logs no longer collide).
• Index out of range when event messages contain a trailing %n or use 0 as a terminator.
• Variant type mismatch that could cause event resolution issues; added a missing variant and a more diagnostic default.
• Reading a log file after it was deleted.
• Temp file creation failure when encryption was involved (now uses a file stream directly instead of copying).
• Dispose method on the DB event resolver and a watcher constructor bug.
• Logger DI issue.
• Failure dialogs now only appear when a manual scan is initiated (no more startup-scan noise).
• Several smaller bugs and optimizations in ValueSelect.
• Added a failure path when Deserialize returns null.
• Added IDisposable to several components to prevent leaks; cleaned up unneeded dispose patterns.

v26.4.22.1179

What's New in v26.4.22.1179

Features

• Light mode is now available, with an option to follow the system theme
• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering across sessions
• Details pane height is now remembered as a user preference
• XML resolution no longer requires the toggle — XML is automatically available, but only resolved when a filter actually needs it
• Improved keyboard navigation in the event table with refactored event selection
• Support for exported LocaleMetaData folders when resolving events from exported .evtx files
• DbTool now supports MTA files for provider details
• Added missing severity levels so more events display the correct level
• Added additional event types and EvtVariantTypes for broader event coverage
• Title bar now shows app name and version before the log names

Improvements

• Faster event table loading with batch loading and improved indexing performance
• Better performance when opening multiple logs (channels + semaphore-throttled threading)
• Filtering automatically switches to parallel processing above a threshold
• Smoother UI updates — the event table and status bar only refresh when values actually change
• Added a rotating cache for NTStatus and HResult lookups
• Caches are now instance-based so they release at end of life cycle
• Reduced memory usage and optimized hot paths throughout the app (string cache, keyword display, property/format caching, sort-in-place, IReadOnlyList)
• Refactored logger to allocate only when an event is actually logged; uses a temp file instead of in-memory buffering
• Refactored async patterns: removed FireAndForget in favor of InvokeAsync, converted async void to async Task, wrapped InvokeAsync calls with exception handlers
• Simplified provider lock pattern and refactored event resolver
• Improved event template matching when multiple potential templates exist
• Refactored filtering references to keyword display name
• Unified State naming across the app for consistency
• Release notes now render properly as Markdown on GitHub
• Removed unused HTML/navigation since the app does not use page navigation
• Removed aria-expanded from the Razor side (handled in JS now)
• Created a GitHub PR pipeline and removed unused legacy pipelines
• Hardened the release workflow to run with least required permissions
• Treat warnings as errors and cleaned up remaining warnings
• Added additional debug logging for event debugging

Bug Fixes

• Fixed index out of range errors when event messages contain a trailing %n or use 0 as a terminator
• Fixed variant type mismatch that could cause event resolution issues
• Fixed issue reading a log file after it was deleted
• Fixed temp file creation failure when encryption was involved (now uses a file stream directly)
• Fixed dispose method on the DB event resolver and a watcher constructor bug
• Fixed logger DI issue
• Fixed several smaller bugs and applied optimizations to ValueSelect dropdowns
• Fixed CI issue related to needs-upgrade checks
• Added a failure path when Deserialize returns null
• Added IDisposable to several components to prevent leaks; cleaned up unneeded dispose patterns

v26.4.21.94

What's New in v26.4.21.94

Features

• Column drag-and-drop reordering in the event table, with persistent column sizing and ordering across sessions
• Details pane height is now remembered as a user preference
• Support for exported LocaleMetaData folders when resolving events from exported .evtx files
• DbTool now supports MTA files for provider details
• Added missing severity levels so more events display the correct level
• Title bar now shows app name and version before the log names

Improvements

• Faster event table loading with batch loading and improved indexing performance
• Better performance when opening multiple logs (reworked threading/throttling)
• Smoother UI updates — the event table and status bar only refresh when values actually change
• Filtering automatically switches to parallel processing above a threshold for better responsiveness
• Added a rotating cache for NTStatus and HResult lookups
• Reduced memory usage and optimized hot paths throughout the app

Bug Fixes

• Fixed index out of range errors when event messages contain a trailing %n or 0 terminator
• Fixed issue reading a log file after it was deleted
• Fixed temp file creation failure when encryption was involved (now uses a file stream directly)
• Fixed a variant type mismatch that could cause event resolution issues
• Fixed several smaller bugs and optimizations in the value selector dropdowns
• Addressed potential memory leaks by properly disposing components
• Updated dependencies/packages

v26.3.5.912

Changes:

• eb8927e Added missing categories to basic filter

This list of changes was auto generated.

v26.2.12.1177

Changes:

• 67098ee Added labels to sub filter and fixed issue with dropdown list being aria hidden
• a07e682 Added aria label for main table
• 7328987 Fixed aria labels in EventTable
• 17642c2 Fixed aria labels on ValueSelect
• 0aacf74 Updated section toggles to show current state
• f463011 Fixed spaces in id params
• 7ead433 Updated labels for section toggles
• 04b0fac Adjusted more labels
• e0003ee Disable forced color adjust
• 74e5772 Added tab and keyboard toggle support to dropdown toggles

See More

• 99e1a15 Added focus element to input components
• f465a01 Added error prompt when trying to rename filter group
• 87cb4c5 Added Aria labels to missing components
• 8975826 Moved title logic to resolve race condition

This list of changes was auto generated.

v26.2.11.1429

Changes:

• a07e682 Added aria label for main table
• 7328987 Fixed aria labels in EventTable
• 17642c2 Fixed aria labels on ValueSelect
• 0aacf74 Updated section toggles to show current state
• f463011 Fixed spaces in id params
• 7ead433 Updated labels for section toggles
• 04b0fac Adjusted more labels
• e0003ee Disable forced color adjust
• 74e5772 Added tab and keyboard toggle support to dropdown toggles
• 99e1a15 Added focus element to input components

See More

• f465a01 Added error prompt when trying to rename filter group
• 87cb4c5 Added Aria labels to missing components
• 8975826 Moved title logic to resolve race condition

This list of changes was auto generated.

v26.2.10.1249

Changes:

• 7ead433 Updated labels for section toggles
• 04b0fac Adjusted more labels
• e0003ee Disable forced color adjust
• 74e5772 Added tab and keyboard toggle support to dropdown toggles
• 99e1a15 Added focus element to input components
• f465a01 Added error prompt when trying to rename filter group
• 87cb4c5 Added Aria labels to missing components
• 8975826 Moved title logic to resolve race condition

This list of changes was auto generated.

v26.2.3.57

Changes:

• 04b0fac Adjusted more labels
• e0003ee Disable forced color adjust
• 74e5772 Added tab and keyboard toggle support to dropdown toggles
• 99e1a15 Added focus element to input components
• f465a01 Added error prompt when trying to rename filter group
• 87cb4c5 Added Aria labels to missing components
• 8975826 Moved title logic to resolve race condition

This list of changes was auto generated.

v26.1.28.1157

Changes:

• e0003ee Disable forced color adjust
• 74e5772 Added tab and keyboard toggle support to dropdown toggles
• 99e1a15 Added focus element to input components
• f465a01 Added error prompt when trying to rename filter group
• 87cb4c5 Added Aria labels to missing components
• 8975826 Moved title logic to resolve race condition

This list of changes was auto generated.

v26.1.22.1168

Changes:

• 99e1a15 Added focus element to input components
• f465a01 Added error prompt when trying to rename filter group
• 87cb4c5 Added Aria labels to missing components
• 8975826 Moved title logic to resolve race condition

This list of changes was auto generated.