Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
What Is Static Analysis, What Does It Find and Miss? Linters, Analyzers, Type Checkers and SAST
Static analysis catches bug patterns and rule violations without running the code, but it cannot see business rules that are not written in the code. In a Bookstore price import pull request, the .NET 10 defaults found 2 problems and Recommended mode 7 diagnostics; even with a clean build, a negative price and a bug reading 329,90 as 32990 still reached the database. The post covers the tool spectrum, severity, the layers from IDE to dashboard and the ratchet strategy.
.NET Analyzers: AnalysisLevel, CA Rules, .globalconfig, WarningsAsErrors and Rolling Out Gradually in a Legacy Project
Pinning AnalysisLevel to a release such as 10.0-recommended stops an SDK upgrade from silently enabling new rules and breaking CI; in Bookstore the .NET 11 SDK gave a CA2028 error with latest and passed cleanly with the pinned level. The post covers the roles of .globalconfig and .editorconfig, CA1309 and a coupon that fails on the Turkish i, CA2100 and a real SQL injection, targeted WarningsAsErrors, justified suppressions, and SARIF with pull request annotations.
Third-Party Analyzers and Writing Your Own Roslyn Analyzer: BannedApiAnalyzers, Popular Packages, DiagnosticAnalyzer and CodeFix
If a rule only says 'don't use this API', BannedApiAnalyzers is enough; if you need a code fix, team-specific logic or a context-aware message, you write your own Roslyn analyzer. In Bookstore, Meziantou, Roslynator and SonarAnalyzer added 87 warnings and 14 times the analysis time but didn't catch DateTime.UtcNow by default. The post builds a TimeProvider rule with an operation-callback analyzer, a code fix in a separate assembly, Microsoft.CodeAnalysis.Testing tests and a NuGet package.
ESLint for Angular and TypeScript: Flat Config, typescript-eslint Type-Aware Rules and angular-eslint Template Rules
Only rules that use type information catch code that doesn't await its promises: in Bookstore's Angular client the config from ng add angular-eslint found 2 problems in a pull request, and strictTypeChecked with projectService found 12. The post covers ESLint 10's flat-config-only world, no-floating-promises and no-misused-promises bugs, accessibility template rules, the cost of type-aware linting, stale cache results and the TypeScript 7 incompatibility, all with real output.
Quality Gates with SonarQube: Community Build or Server, Quality Profiles, New-Code Gates and CI Integration
SonarQube's default gate only looks at new code: zero new issues and at least 80% coverage on new code. In Bookstore a 'similar books' endpoint with a clean build and green tests failed the gate with 10.3% new-code coverage and passed after two tests. The post covers running the Community Build with PostgreSQL in Docker, SonarScanner for .NET, the Sonar way core profile, double reporting with Roslyn, the stale coverage report trap and the Community Build's lack of PR analysis, with real output.
What Changed in Static Analysis: .NET 5–11 Analyzers, From TSLint to ESLint 10, TypeScript 7 and Next-Generation Linters
Analyzers have been part of the SDK since .NET 5, and every release brings new rules: the same code gave zero warnings with the .NET 10 SDK and four with the .NET 11 SDK (CA2026, CA2027, CA1877, CA2028). The post covers the .NET 6–11 rule history, CA2028 missing source-generated regexes, why automatic .eslintrc to flat config migration isn't enough with angular-eslint 22, TypeScript 7 holding back typescript-eslint, Oxlint and Biome results on Bookstore, and Sonar's new names.