Roslyn-analyzers: <AnalysisMode>AllEnabledByDefault</AnalysisMode> doesn't enable all rules

[Bosch-Eli-Black]

Our project is a .NET Standard 2.0 project that has the Microsoft.CodeAnalysis.NetAnalyzers NuGet package installed. In our .csproj file, we have the following settings:

<PropertyGroup>
    <EnableNETAnalyzers>true</EnableNETAnalyzers>
    <AnalysisMode>AllEnabledByDefault</AnalysisMode>
  </PropertyGroup>

The documentation says that setting AnalysisMode to AllEnabledByDefault means this:

Aggressive or opt-out mode, where all rules are enabled by default as build warnings. You can selectively opt out of individual rules to disable them.

However, despite setting AnalysisMode to AllEnabledByDefault, we're not seeing warnings for CA5401.

To see CA5401 warnings again, I have to add this line to our .editorconfig file:

# CA5401: Do not use CreateEncryptor with non-default IV
dotnet_diagnostic.CA5401.severity = warning

This seems to contradict the documentation for AllEnabledByDefault

[Youssef1313]

I think this is related to https://github.com/dotnet/roslyn-analyzers/issues/4540.

[Bosch-Eli-Black]

@Youssef1313 Interesting 🙂 Indeed, we have several different analyzer NuGet packages installed, so it sounds like this could be related.

[mavasani]

This is a different issue has been fixed in the .NET SDK, but version with the fix has not released yet. Meanwhile, to workaround can you set MSBuild property AnalysisLevel to latest in your project file?

[mavasani]

See https://github.com/dotnet/roslyn-analyzers#microsoftcodeanalysisnetanalyzers for AnalysisLevel

[ArturDorochowicz]

I'm experiencing the same issue and can confirm that the workaround works, i.e. explicitly setting AnalysisLevel to latest causes AnalysisMode to be respected.

BTW, is there any way to get default analyzer configuration from FxCopAnalyzers back (other than configure each individual rule)? We now have a rather binary choice between all enabled (which is an overkill IMO) or all disabled (and the default but it's quite close to all disabled). Version 3.x had a reasonable default configuration that enabled way more rules than the new default.

[Bosch-Eli-Black]

Thanks, @mavasani; that fixed it for me :)

[Bosch-Eli-Black]

@ArturDorochowicz, I think you might want to open a new issue :)

[mavasani]

BTW, is there any way to get default analyzer configuration from FxCopAnalyzers back (other than configure each individual rule)? We now have a rather binary choice between all enabled (which is an overkill IMO) or all disabled (and the default but it's quite close to all disabled). Version 3.x had a reasonable default configuration that enabled way more rules than the new default.

This is tracked by https://github.com/dotnet/roslyn/issues/49250#issuecomment-731455224 - the Recommended mode in there would enable whole bunch more rules and be much closer to FxCop package. I just merged a PR yesterday which will provide this functionality in the built-in SDK analyzers starting .NET 6 SDK. We will likely also release a NuGet package Microsoft.CodeAnalysis.NetAnalyzers lot earlier, which will also have functionality even prior to .NET 6 SDK.

[mavasani]

I'll close this issue as the original issue reported by @Bosch-Eli-Black has been fixed and is just pending release. There is also a workaround for it meanwhile.