·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 0. Classified findings closed: 0. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 9. Review findings remaining: 2.
None
None
Expand | File | Group | Subtype | Severity | Status |
|---|
No findings available
0 findings
Microsoft.Extensions.DependencyInjectionThe MVVM Toolkit deliberately ships no DI container — it composes with
Microsoft.Extensions.DependencyInjection, the same container ASP.NET
Core, Worker services, and the .NET Generic Host use.
IMessenger once and injecting it into ObservableRecipient
ViewModelsFor source generators and ViewModel patterns see the mvvm-toolkit
skill. For Messenger pub/sub see mvvm-toolkit-messenger.
Generic Host benefits:
appsettings.json binding via Microsoft.Extensions.ConfigurationMicrosoft.Extensions.LoggingIHostedService) for background workWhen you only need a service container and want zero extra dependencies:
Inject services and child ViewModels through the constructor:
In real apps, log events rather than personal or user entered values.
Why constructor injection beats a service locator:
ValidateOnBuild is enabled| Lifetime | Method | Typical use in XAML apps |
|---|---|---|
Singleton |
| Shell/main-window VM, settings, file/HTTP services, the shared |
Transient |
| Per-page or per-document ViewModels (a fresh instance every resolve) |
Scoped |
| Rarely needed in client apps; useful with explicit |
Resolve the page's root ViewModel in code-behind, then let it pull its own dependencies:
Bind in XAML with {x:Bind ViewModel.Xxx} (compiled bindings) or
{Binding Xxx} against DataContext.
For navigation frameworks (WinUI 3 Frame.Navigate, MAUI Shell, Prism,
MVVMCross), let the framework resolve the page and the page resolves its
ViewModel from DI. Don't new ViewModels manually.
IMessenger registrationRegister the messenger you want once, inject IMessenger everywhere:
The default messengers are shared across the whole process. Recipients of the strong reference messenger stay alive until they unregister or are deactivated. Use a dedicated keyed or scoped messenger instance, or channel tokens, for sensitive or per-window messages.
Then:
An ObservableRecipient receives messages only after it is set active,
typically on navigation or load. Setting it inactive on unload
unregisters its handlers, which the strong reference messenger needs in
order to release recipients.
For per-window messengers, register with keyed services or as scoped instances and inject into per-window ViewModels.
See the mvvm-toolkit-messenger skill for the messenger surface area.
Resolve different implementations of the same interface by key:
Constructor-injected dependencies are trivial to swap in tests. With
Moq:
If you're mocking Ioc.Default or static state, the ViewModel is using a
service locator — refactor to constructor injection.
Ioc.DefaultCommunityToolkit.Mvvm.DependencyInjection.Ioc is an escape hatch for
cases where constructor injection is impossible — XAML-instantiated VMs
for design-time data, ValueConverters, control templates.
When a host is used, configure Ioc.Default with the existing service
provider of the host rather than a newly built one, so singletons stay
shared.
Treat it as the last resort. Inside ViewModels, services, and any class the DI container can construct, prefer constructor injection.
Ioc.Default.GetService<T>() inside a VM constructor. Hides the
dependency, breaks unit tests, prevents startup graph validation.Singleton. A "per-document" VM registered as singleton
becomes shared state across all documents — subtle data corruption.
Use AddTransient for per-instance VMs.BuildServiceProvider() calls. Each call is a fresh
container — singletons aren't shared. Build once at startup.IServiceProvider in long-lived objects. Indicates a
service-locator pattern. Inject the specific dependencies you need.Host.CreateDefaultBuilder()
sets ValidateScopes and ValidateOnBuild only when the hosting
environment is Development. Desktop apps run as Production by default,
so enable both explicitly through the default service provider options
so registration mistakes fail at startup, not at first use.IServiceScope.IServiceScope, or keep transient ViewModels
free of disposable state.| Topic | File |
|---|---|
Full deep dive (Generic Host setup, lifetimes, keyed services, testing patterns, legacy Ioc) |
External:
Get started with chainctlchainctl skill install public/github/mvvm-toolkit-di:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/github/skills/mvvm-toolkit-di:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/dependency-injection.md