If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/xamarin/Xamarin.Forms shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

WAIT — Stale — last commit 2y ago

• 23+ active contributors
• Other licensed
• CI configured
• Tests present
• ⚠ Stale — last commit 2y ago
• ⚠ Concentrated ownership — top contributor handles 53% of recent commits
• ⚠ Non-standard license (Other) — review terms

_{Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests}

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live xamarin/Xamarin.Forms repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/xamarin/Xamarin.Forms.

What it runs against: a local clone of xamarin/Xamarin.Forms — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in xamarin/Xamarin.Forms | Confirms the artifact applies here, not a fork | | 2 | License is still Other | Catches relicense before you depend on it | | 3 | Default branch 5.0.0 exists | Catches branch renames | | 4 | Last commit ≤ 770 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of xamarin/Xamarin.Forms. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/xamarin/Xamarin.Forms.git
#   cd Xamarin.Forms
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of xamarin/Xamarin.Forms and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "xamarin/Xamarin.Forms(\\.git)?\\b" \\
  && ok "origin remote is xamarin/Xamarin.Forms" \\
  || miss "origin remote is not xamarin/Xamarin.Forms (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(Other)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"Other\"" package.json 2>/dev/null) \\
  && ok "license is Other" \\
  || miss "license drift — was Other at generation time"

# 3. Default branch
git rev-parse --verify 5.0.0 >/dev/null 2>&1 \\
  && ok "default branch 5.0.0 exists" \\
  || miss "default branch 5.0.0 no longer exists"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 770 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~740d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/xamarin/Xamarin.Forms"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

Xamarin.Forms is a cross-platform UI framework that allows developers to build native iOS, Android, Windows, and macOS applications from a single C# codebase. It provides a unified API for creating platform-specific native UIs without writing platform-specific code, shipping as NuGet packages (Xamarin.Forms core, Xamarin.Forms.Maps, Xamarin.Forms.AppLinks, etc.). However, this project is end-of-life as of May 1, 2024, and has been succeeded by .NET MAUI. Monorepo structure: core platform-agnostic abstractions in src/Core; platform-specific implementations in src/Xamarin.Forms.Platform.Android, src/Xamarin.Forms.Platform.iOS, src/Xamarin.Forms.Platform.Tizen, etc.; NuGet package definitions in .nuspec/; native Java/Kotlin Android helpers in AndroidNative/FormsViewGroup; build configuration via .sln files and .props/.targets MSBuild files for multi-targeting.

C# developers who built enterprise mobile applications on Xamarin.Forms between 2014–2024; now primarily maintainers of legacy Xamarin.Forms apps seeking to migrate to .NET MAUI. Contributors are limited as the project is in maintenance mode post-EOL.

Xamarin.Forms reached production maturity over its ~10-year lifecycle (2014–2024), with extensive platform coverage across iOS/Android/UWP/macOS and a rich ecosystem of NuGet packages. However, support formally ended May 1, 2024; the codebase is now in archive/legacy status with no new feature development, making it unsuitable for new projects. The repository remains available for critical security patches and migration guidance only.

Critical risk: the project is officially unsupported and end-of-life as of May 2024, so no new features or long-term maintenance should be expected. The monolithic 15M+ lines of C# across platform-specific renderers (Android, iOS, UWP) creates high maintenance burden; any new contributions face skepticism since the ecosystem is directing all users toward .NET MAUI migration. Dependency versions in AndroidNative (compileSdkVersion 20, buildToolsVersion 25.0.2) are severely outdated.

The repository is in maintenance mode: no active feature development. Based on the EOL announcement in the README and GitHub workflows (dotnet-format-daily.yml, backport-trigger.yml), the team is performing code hygiene updates and backporting critical fixes. All development energy has shifted to the .NET MAUI repository (dotnet/maui).

git clone https://github.com/xamarin/Xamarin.Forms.git && cd Xamarin.Forms && dotnet restore (requires .NET SDK matching .config/dotnet-tools.json pinned version). For platform-specific work, open .Xamarin.Forms.Android.slnf, .Xamarin.Forms.iOS.slnf, or .Xamarin.Forms.UAP.slnf in Visual Studio or Rider.

Daily commands: No traditional 'dev server' — Xamarin.Forms is a framework library. To build: dotnet build Xamarin.Forms.sln or msbuild /p:Configuration=Release for specific platforms. To test: dotnet test Xamarin.Forms.Core.Tests or platform-specific test projects. For sample apps, see the Xamarin.Forms sample galleries in the controls/ directory.

• README.md: Announces end-of-life (May 1, 2024) and directs users to .NET MAUI migration guide; critical context for all work on this repo.
• .Xamarin.Forms.Android.slnf: Solution filter for Android-specific development; entry point for platform engineers working on Android renderers.
• .nuspec/Xamarin.Forms.nuspec: Primary NuGet package definition; controls versioning and dependencies shipped to NuGet.org.
• src/Xamarin.Forms.Core/BindableObject.cs: Foundation of the data-binding system; all Forms elements inherit from this, making it critical to understand for any core changes.
• src/Xamarin.Forms.Platform.Android/Renderers/: Android renderer implementations; where visual controls are mapped to native Android views.
• .github/workflows/dotnet-format-daily.yml: CI automation for code style enforcement; defines the code quality bar for contributions.
• .config/dotnet-tools.json: Pins exact .NET SDK version and tools; required for reproducible builds across CI and local development.

For core platform abstractions: edit src/Xamarin.Forms.Core/Element*.cs, src/Xamarin.Forms.Core/View*.cs, src/Xamarin.Forms.Core/Pages/*.cs. For Android rendering: src/Xamarin.Forms.Platform.Android/Renderers/. For iOS rendering: src/Xamarin.Forms.Platform.iOS/Renderers/. For XAML parsing: src/Xamarin.Forms.Xaml/. Always add corresponding unit tests in src/*Tests/ directories. Code style is enforced via .editorconfig and dotnet-format workflows.

1. Xamarin.Forms targets multiple platforms with deeply different native APIs; a change in src/Xamarin.Forms.Core may require parallel fixes in Android, iOS, and UWP renderers. 2. AndroidNative/ uses legacy Gradle config (compileSdkVersion 20, minSdkVersion 15) that will not work with modern Android tooling—any Android updates require coordinating across both .NET and Java build systems. 3. The project uses solution filters (.slnf files) to manage platform-specific subsets; opening the full .sln in an IDE may load incompatible platform projects and fail to build. 4. XAML parsing is non-trivial; changes to element binding or markup behavior require updates in both src/Xamarin.Forms.Xaml/ and renderers. 5. All development should acknowledge this is end-of-life—contributions are for maintenance/backports only, not new features.

• Platform Renderer Pattern — Xamarin.Forms abstracts platform differences via renderer classes (AndroidViewRenderer, iOSViewRenderer) that map cross-platform Elements to native controls; understanding this is essential for any core or platform-specific contribution.
• BindableObject and XAML Data Binding — The BindableObject class implements INotifyPropertyChanged and powers declarative XAML binding; nearly every Forms element inherits from it, so binding pipeline changes affect the entire framework.
• Dependency Service (Service Locator) — Xamarin.Forms uses DependencyService as a lightweight IoC container to resolve platform-specific implementations at runtime; critical for understanding how framework code calls into native APIs.
• Markup Extension Pattern (XAML) — Xamarin.Forms.Xaml parses custom markup extensions (e.g., Binding, StaticResource, DynamicResource) to enable runtime value resolution in declarative layouts; changes to this affect XAML parsing throughout the codebase.
• Effect vs Behavior vs Trigger — Xamarin.Forms provides three distinct patterns for extending element behavior (Effects for native customization, Behaviors for reusable logic, Triggers for reactive state changes); choosing the right pattern is critical for maintainability.
• Visual Style Hierarchy and Cascading — Xamarin.Forms supports implicit and explicit styles with CSS-like cascading; the style resolution engine must handle inheritance and dynamic style changes, making it a complex subsystem.
• Dual-Screen and Foldable Device Support — Xamarin.Forms.DualScreen handles dual-screen layouts (Surface Duo, foldable phones); understanding TwoPaneView and device state change patterns is important for modern device support.

• dotnet/maui — Direct successor to Xamarin.Forms; all new cross-platform .NET development uses MAUI instead. Users of this repo should migrate here.
• xamarin/xamarin-android — Xamarin.Android runtime powering the Android renderer implementations; deep dives into platform integration require understanding this lower layer.
• xamarin/xamarin-macios — Xamarin.iOS/macOS runtime; parallel to xamarin-android, needed for iOS/macOS renderer development in Xamarin.Forms.
• microsoft/dotnet — Broader .NET ecosystem; Xamarin.Forms depends on .NET SDK versions and runtime features managed here.
• reactiveui/ReactiveUI — MVVM framework heavily used in Xamarin.Forms apps; many production Xamarin.Forms codebases depend on ReactiveUI for reactive binding patterns.

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Update Android build configuration to modern SDK targets

The AndroidNative/build.gradle file uses deprecated compileSdkVersion 20 and buildToolsVersion 25.0.2 from ~2016. Even though Xamarin.Forms is end-of-life, updating to modern Android API levels (34+) and using 'implementation' instead of deprecated 'compile' syntax would prevent build failures for contributors attempting to build locally and improve the repository's technical health for reference/archival purposes.

• [ ] Update AndroidNative/FormsViewGroup/build.gradle compileSdkVersion to 34 or higher
• [ ] Update buildToolsVersion to '34.0.0' or latest stable
• [ ] Replace deprecated 'compile' with 'implementation' in dependencies block
• [ ] Update support-v4 dependency to modern androidx equivalents (e.g., androidx.appcompat:appcompat)
• [ ] Test that AndroidNative module builds without warnings

Add GitHub Actions workflow for automated end-of-life repository maintenance

The .github/workflows directory contains active workflows (dotnet-format-daily.yml, backport-trigger.yml) that may still be running on a sunset repository. Since support ended May 1, 2024, a new workflow should automate pinning issues/PRs as end-of-life and redirecting users to .NET MAUI. This prevents contributor confusion and reduces maintenance burden.

• [ ] Create .github/workflows/eol-redirect.yml that runs on new issues/PRs
• [ ] Add job to post automated comment with migration guidance and .NET MAUI link
• [ ] Add job to apply 'end-of-life' and 'migrate-to-maui' labels to new issues
• [ ] Document the workflow in .github/CONTRIBUTING.md under a new 'Support Status' section
• [ ] Test workflow behavior with a draft PR

Create migration guide document with specific Xamarin.Forms → .NET MAUI API mappings

While README.md links to official migration docs, many contributors may need quick API reference mappings. The repo lacks a .github/MIGRATION_GUIDE.md with concrete before/after code examples for common Xamarin.Forms patterns (e.g., DependencyService → IPlatformApplication, MessagingCenter → WeakReferenceMessenger) that would reduce support questions and serve as valuable archival documentation.

• [ ] Create .github/MIGRATION_GUIDE.md file
• [ ] Add section 'Common API Migrations' with 5-10 before/after code examples (DependencyService, MessagingCenter, Effects, Renderers, etc.)
• [ ] Add section 'Platform-Specific Code' mapping Android/iOS handlers
• [ ] Link to .NET MAUI docs and migration tool references
• [ ] Reference this guide from README.md and CONTRIBUTING.md

• Add missing unit tests for src/Xamarin.Forms.Core/BindableObject.cs property change edge cases (null coalescing, circular binding detection); currently test coverage for binding edge cases is sparse.
• Update AndroidNative/FormsViewGroup/build.gradle to use modern compileSdkVersion (34+) and Gradle plugin versions, then verify FormsViewGroup.java still compiles and passes instrumentation tests on Android 14+.
• Document the renderer lifecycle (OnElementChanged → OnElementPropertyChanged → Dispose) with code examples for src/Xamarin.Forms.Platform.Android/Renderers/ and src/Xamarin.Forms.Platform.iOS/Renderers/ in a new CONTRIBUTING_RENDERERS.md file, addressing common contributor confusion points.

The Xamarin.Forms codebase presents significant security risks due to its end-of-support status (May 1, 2024) combined with severely outdated dependencies and platform targets. The Android support library is from 2014 with known vulnerabilities, compileSdkVersion and buildToolsVersion are 9+ years old, and minifyEnabled is disabled in release builds. Most critically, this is an unmaintained project that will not receive any security patches. Immediate action is required: either migrate to .NET MAUI (recommended) or implement a comprehensive security hardening and update strategy for any remaining use. Production applications should prioritize migration.

• High · Outdated Android Support Library Dependency — Dependencies/Package file (gradle configuration). The gradle dependency file specifies 'com.android.support:support-v4:20.0.0', which is an extremely outdated version from 2014. This library contains multiple known security vulnerabilities and lacks critical security patches. The Android Support Library has been deprecated and superseded by AndroidX. Fix: Migrate to AndroidX libraries. Replace 'com.android.support:support-v4:20.0.0' with the latest AndroidX equivalent 'androidx.legacy:legacy-support-v4:1.0.0' or higher. Update compileSdkVersion from 20 to at least 33+, and update buildToolsVersion to a current version (e.g., '34.0.0').
• High · End of Support - Unmaintained Codebase — Repository-wide (indicated in README and SECURITY.md). Xamarin.Forms reached end of support on May 1, 2024. The entire repository is no longer maintained or receiving security patches. Any vulnerabilities discovered will not be fixed. This is especially critical for production applications. Fix: Migrate to .NET MAUI, which is the official successor to Xamarin.Forms and is actively maintained. Follow the official migration guidance at https://learn.microsoft.com/dotnet/maui/migration.
• High · Severely Outdated Android SDK Versions — Dependencies/Package file (gradle configuration). The gradle configuration specifies compileSdkVersion 20, buildToolsVersion '25.0.2', minSdkVersion 15, and targetSdkVersion 15. These versions are from 2014-2015 and lack modern security features including proper SSL/TLS enforcement, vulnerability patches, and security hardening features introduced in later Android versions. Fix: Update to modern Android API levels: set compileSdkVersion to 34+, buildToolsVersion to '34.0.0'+, minSdkVersion to at least 21, and targetSdkVersion to 34+. This ensures access to modern security APIs and platform hardening features.
• Medium · Potential Code Obfuscation Not Enforced — Dependencies/Package file (gradle configuration - buildTypes.release). The proguard configuration in the gradle buildTypes shows 'minifyEnabled false' for release builds. This means production builds are not obfuscated, making reverse engineering easier and potentially exposing sensitive logic. Fix: Enable minification in release builds by setting 'minifyEnabled true'. Ensure appropriate proguard rules are configured to protect sensitive code while maintaining functionality. This is especially important given the legacy status of the project.
• Medium · Legacy Java Code Quality Concerns — AndroidNative/FormsViewGroup/src/main/java/com/xamarin/forms/platform/android/FormsViewGroup.java. The AndroidNative/FormsViewGroup/src/main/java directory contains native Java code that may not follow current security best practices. Legacy Java code from this era (2014-2015) often lacks proper input validation, secure coding patterns, and vulnerability protections. Fix: Conduct a thorough security code review of all native Java code. Implement input validation, secure coding practices, and verify proper permission handling. Consider migrating to Kotlin and modern Android development practices.

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.