.NET Analyzers: AnalysisLevel, CA Rules, .globalconfig, WarningsAsErrors and Rolling Out Gradually in a Legacy Project
Pinning AnalysisLevel to a release such as 10.0-recommended stops an SDK upgrade from silently enabling new rules and breaking CI; in Bookstore the .NET 11 SDK gave a CA2028 error with latest and passed cleanly with the pinned level. The post covers the roles of .globalconfig and .editorconfig, CA1309 and a coupon that fails on the Turkish i, CA2100 and a real SQL injection, targeted WarningsAsErrors, justified suppressions, and SARIF with pull request annotations.
14 Nov 2026
·
15 min
·
12
