vendor: bump DirectX-Headers v1.619.1 and mesa 24.0.1

[benhillis]

Phase 1 of the vendor-source refresh: low-risk version bumps for the two components pinned by version-string in CI (DirectX-Headers and mesa). Companion change to wslg-build (the Azure DevOps pipeline) updates the same version defaults so CI consumes the new tarballs.

Changes

• CONTRIBUTING.md — clone-tag instructions for new contributors bumped to the new versions:
  • DirectX-Headers: v1.608.0 → v1.619.1 (Nov 2022 → Mar 2026)
  • mesa: mesa-23.1.0 → mesa-24.0.1 (matches what Azure Linux 3.0 ships, per microsoft/azurelinux SPECS/mesa/mesa.spec on the 3.0 branch)
• cgmanifest.json — Component Governance manifest updated:
  • mesa CommitHash updated to the 24.0.1 tag commit 3e361635...
  • New entry added for DirectX-Headers (9e393d6d..., v1.619.1) — this component previously had no cgmanifest entry

Why

• DirectX-Headers v1.608.0 → v1.619.1: ~3.5 years of upstream improvements; headers-only, no CVE history; trivial bump.
• mesa 23.1.0 → 24.0.1: aligns with the mesa version Azure Linux 3.0 packages, so the WSLg-built mesa matches the host distro's mesa SBOM. Newer mesa versions aren't available from the azurelinuxsrcstorage blob CI downloads from (probed 24.0.2 through 25.2.x — all 404), so 24.0.1 is the realistic upper bound without re-plumbing CI's tarball source. Mesa's WSLg build flags (-Dgallium-drivers=swrast,d3d12 -Dvulkan-drivers= -Dllvm=disabled) are unchanged and continue to apply.

Validation

• ./build-and-export.sh completes all 88 Docker build steps with the new sources.
• Built image's /etc/versions.txt correctly carries the new commit SHAs.
• Mesa configures and installs both swrast and d3d12 gallium DRI drivers as before.
• DirectX-Headers v1.619.1 builds cleanly via meson (no API churn affecting WSLg's consumers).

Pairs with

Companion wslg-build PR user/benhillis/phase1-vendor-bumps updates the corresponding mesaVersion / directxHeadersVersion defaults in devops/pipeline-shared.yml, wslg-github-buddy.yml, and wslg-github-release.yml (plus the official-release enforcement check at pipeline-shared.yml:146-147).

Not in scope

• FreeRDP, weston, pulseaudio versions — those are pulled from microsoft/*-mirror working branch tips at CI build time, not by this repo. See the upgrade plan / CVE summary for the follow-on phases.

[Copilot]

Pull request overview

Updates the pinned vendor component versions used by WSLg’s system-distro build to newer DirectX-Headers and Mesa revisions, aligning documentation and component governance metadata with the refreshed sources.

Changes:

• Bump the contributor clone instructions to DirectX-Headers v1.619.1 and Mesa mesa-24.0.1.
• Update cgmanifest.json to point Mesa at the mesa-24.0.1 commit and add a new DirectX-Headers component entry.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
CONTRIBUTING.md	Updates local build instructions to clone newer DirectX-Headers and Mesa tags.
cgmanifest.json	Refreshes Mesa commit hash and adds DirectX-Headers registration for Component Governance.

Comments suppressed due to low confidence (1)

cgmanifest.json:53

• cgmanifest.json is invalid JSON due to the trailing comma after the final registration object (the comma after the last } before the closing ]). This will break parsing for Component Governance tooling; remove the trailing comma so the Registrations array ends with the last object followed directly by ].

                }
            },
            "DevelopmentDependency": false
        },
    ]

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.