chore(deps): update dependency sonaranalyzer.csharp to v10

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
SonarAnalyzer.CSharp (source)	9.32.0.97167 → 10.22.0.136894

---

Release Notes

SonarSource/sonar-dotnet (SonarAnalyzer.CSharp)

v10.22.0.136894: 10.22

Compare Source

Hello everyone,
This release brings 4 new rules to help developers transition to C# 14, and a bunch of false positive fixes.

New rules

• NET-3361 - New rule S8381: "scoped" should be escaped when used as a type name in lambda parameters
• NET-3359 - New rule S8368: "extension" identifiers should be escaped to avoid contextual keyword conflicts
• NET-3347 - New rule S8380: Return types named "partial" should be escaped with "@​"
• NET-3345 - New rule S8367: Identifiers should not conflict with the "field" keyword in C# 14?

False Positive

• NET-3443 - Fix S1940 FP: for floating point numbers that can be NaN "!(a <= b)" is not the same as "a > b"
• NET-3001 - Fix S3063 FP: Concatenation with identifier
• NET-1569 - Fix S5944 FP: AddressOf(MethodName) in Return statement
• NET-3445 - Fix T0029 FP: Inside target-typed new
• NET-2817 - Fix T0029 FP: Ident for collection expression members
• NET-2024 - Fix T0029 FP: Inside array initializer
• NET-3341 - Fix T0029 FP: After member access
• NET-3462 - Fix T0042 FP: Inside constructors and collection initializers
• NET-3426 - Fix T0042: Raw string in collection initializer
• NET-2888 - Fix T0042 FP: Returned from method
• NET-2874 - Fix T0042 FP: Raw string in ternary

Bugs

• NET-3386 - Fix S4583 AD0001: BeginInvoke callback declared in separate file

Other

• NET-3385 - S2612: Rule type changed from Security Hotspot to Vulnerability

v10.21.0.135717: 10.21

Compare Source

Bug

• NET-3376 - Fix S6930 AD0001: Issue on template / code files for blazor
• NET-3367 - Fix S4830 AD0001: CertificateValidationCheck Syntax node is not within syntax tree

Feature

• NET-3260 - Fix broken links in S6960 RSPEC

False Positive

• NET-2886 - Fix T0015 FP: In constructor
• NET-1678 - Fix S4275 FP: with property overload

v10.20.0.135146: 10.20

Compare Source

This release brings 9 precision improvements — 7 false positive fixes and 2 false negative fixes — across rules S1116, S1144, S1210, S1643, S1854, S2365, S3254, S3265, and S127. It also promotes S2068 and S6418 from Security Hotspot to Vulnerability, making them visible directly in the IDE, and removes S3256 from the Sonar Way quality profile.

Changes

• NET-3227 - Remove S3256 from "Sonar Way" quality profile
• NET-3208 - S6418: Rule type changed from Security Hotspot to Vulnerability
• NET-3207 - S2068: Rule type changed from Security Hotspot to Vulnerability
• NET-3206 - Remove links to rules.sonarsource.com

False Positive

• NET-3215 - Fix FP on S127: Should only raise on stop condition variables
• NET-3212 - Fix FP on S3254: Don't raise if the parameter isn't last
• NET-3053 - Fix FP on S1210: Implementing comparable operators for private types
• NET-2984 - Fix FP on S3265: BCL enums with [Flags] not recognized due to metadata resolution
• NET-2976 - Fix FP on S1854: Default value initializations flagged despite exemptions
• NET-2966 - Fix FP on S1144: Constructors in MEF-exported types
• NET-2956 - Fix FP on S1116: Empty loop body with side effects in condition

False Negative

• NET-1261 - Fix FN on S2365: Rule should report on new collection
• NET-1259 - Fix FN on S1643: Concatenation for parameters, fields and properties are not detected

Rule specification

• NET-3246 - Modify Rule S127: Update Description
• NET-3218 - Modify Rule S3265: Add exception for MethodImplAttributes
• NET-3086 - Modify Rule S1116: Add loop exception

Maintenance

• NET-3047 - Update RSPEC before 10.20 release

v10.19.0.132793: 10.19

Compare Source

Documentation

• NET-3012 - Modify Rule S3903: Update description for C#10

False Positive

• NET-3004 - Fix S2696 FP: New extension method format triggers FP when accessing static fields

False Negative

• NET-3011 - Fix S4790 FN: Support Using statement

Task

• NET-2948 - Update RSPEC before 10.19 release

Bug

• NET-1866 - Support future VS versions in NuGet package

v10.18.0.131500: 10.18

Compare Source

This releases focuses on fixing the false-positives that are raised on code making use of the new features in C# 14.

Improvement

• NET-2921 - Fix passthrough calculation in ModelBuilder
• NET-2903 - Remove manual extension methods
• NET-2895 - Cleanup handling of ParameterList of primary constructors

Task

• NET-2917 - Update RSPEC before 10.18 release

False Positive

• NET-2898 - Fix S2583/S2589 FP: Extension Members
• NET-2877 - Fix S2225 FP: Extension member
• NET-2832 - Fix S3063 FP: NullConditionalOperator
• NET-2825 - Fix S1144 FP: Partial events
• NET-2821 - Fix S3264 FP: Partial events
• NET-2805 - Fix S1144 FP: S1144 Is confused by Debugger Display attribute
• NET-2748 - Fix S3459 FP: NullConditional Assignment
• NET-2716 - Fix S2325 FP: Field Keyword
• NET-2712 - Fix S2953 FP: Extension block member
• NET-2707 - Fix S3877 FP: Equals method without IEquatable
• NET-2684 - Fix S7039 FP/FN: Null-conditional assignment
• NET-2672 - Fix S3928 FP: Extension block
• NET-2671 - Fix S2970 FP: Null Conditional Assignment
• NET-2668 - Fix S3398 FP: On private methods in C#14 extensions classes
• NET-2644 - Fix S1144 FP: Always raises on private methods in extension block
• NET-2621 - Fix S2325 FP: Incorrectly reports on C# 14 extensions
• NET-2620 - Fix S4545 FP: Extension Methods
• NET-2391 - Fix S1121 FP: Extract (null-forgiving) assignment from expression
• NET-1914 - Fix S3264 FP: when using +=

False Negative

• NET-2813 - Fix S2292 FN: FieldKeyword
• NET-2681 - Fix S2692 FN: Support Spans

v10.17.0.131074: 10.17

Compare Source

False Negative

• NET-2840 - Improve S2077: Support more methods

Task

• NET-2839 - Update RSPEC before 10.17 release

New Feature

• NET-2820 - ShimLayer: Implement Factory
• NET-2789 - ShimLayer Generator: Enums
• NET-2728 - ShimLayer Generator: SyntaxNodes

Bug

• NET-2816 - Fix S3603 AD0001: NRE when LocalFunction inside Record constructor in C#7

Improvement

• NET-2722 - Activate new ShimLayer
• NET-2721 - Create diff for ShimLayer
• NET-2720 - Create ShimLayer projects

v10.16.1.129956: 10.16.1

Compare Source

Rotations of binary signing keys

v10.16.0.128591: 10.16

Compare Source

False Positive

• NET-1729 - Fix S2114 FP: list.AddRange(list) and list.Concat(list) are sensible

False Negative

• NET-399 - Fix S4790 FN: Support CryptographicOperations data methods

Bug

• NET-2686 - Fix S3604 AD0001: NRE with partial constructor

v10.15.0.120848: 10.15

Compare Source

False Positive

• NET-2198 - Fix S1905 FP: Cast of default! expression is required
• NET-2197 - Fix S1905 FP: stackalloc and Span conversions
• NET-1641 - Fix S1905 FP: casting IEnumerable<string?> to IEnumerable<string>
• NET-2157 - Fix S2589 FP: Don't raise an issue after a delegate is invoked
• NET-2073 - Fix S2699 FP: Add support for FsCheck property tests
• NET-1537 - Fix S6964 FP: Don't raise on properties annotated with the BindRequiredAttribute

Improvement

• NET-2112 - Consider ExplodedNodes relevant if a successor would be relevant
• NET-2183 - SE: Set constraint on operation when learning from IsPattern

False Negative

• NET-429 - Fix S4275 FN: Support partial properties

Task

• NET-2208 - Update RSpec before release

v10.14.0.120626: 10.14

Compare Source

Hey everyone,

This release mostly focuses on mitigating (NET-2196) a performance regression that was introduced in 10.13.

Improvement

• NET-2196 - Fix path algorithm for execution flows to mitigate performance regression
• NET-2177 - Improve how the Symbolic Execution engine handles exception paths
• NET-2135 - Support xUnit V3
• NET-2163 - Provide Interface for other plugins to add rules to VB.NET SonarWay profile

False Negative

• NET-235 - Fix S2053: Adjust required salt length to be 32 bytes

Task

• NET-2170 - Update RSPEC before 10.14 release

v10.13.0.120203: 10.13

Compare Source

Hello everyone,

In this release, we've focused on:

• False positive fixes
• Enhancing S2259's secondary locations to provide clearer, step-by-step explanations of null pointer dereferences issues.

False Positives

• NET-2099 - Fix S3885 FP: Do not raise in ResolutionEventHandler
• NET-2023 - Fix S3257 FP: Array with target-typed new
• NET-1646 - Fix S3267 FP: Loops should be simplified with LINQ expressions
• NET-1588 - Fix S1066 FP: Combination of dynamic and out should not raise
• NET-882 - Fix S3257 FP: Don't raise for C# 10 and later when there's explicit delegate creation

Improvements

• NET-2095 - Improve incremental PR analysis path detection
• SE: S2259 - Improve secondary locations

v10.12.0.118525: 10.12

Compare Source

This release brings the VB version of S6418 and a few FP and FN fixes.

New Rule

• NET-1379 - New Rule: Implement S6418 Hard-coded secrets are security-sensitive for VB.NET

False Positive

• NET-1526 - Fix S3267 FP: Only raise on IEnumerable

False Negative

• NET-1260 - Fix S1215 FN: GC.GetTotalMemory(forceFullCollection: true) should not be called
• NET-1258 - Fix S6678 FN: Lowercase placeholders in interpolated string
• NET-1255 - Fix S3267 FN: Logical operators are not supported

Task

• NET-2060 - Update RSPEC before 11.12 release

v10.11.0.117924: 10.11

Compare Source

Hello everyone!
In this release we fixed a bunch of false positives and false negatives.
Additionally this version adds support for telemetry in order to gather information on feature usage. Telemetry, requires scanner 10.2.0 or greater.

False Positive

• NET-1522 - Fix S2068 FP: Do not raise on password:secret
• NET-1149 - Fix S3626 FP: Add exception when return statement is preceding local functions

False Negative

• NET-1263 - Fix S1871 FN: Nested if .. else if chain
• NET-1256 - S2068: Remove word boundary(\b) from regex
• NET-1254 - Fix S3878 FN: When params are passed as array through an attribute
• NET-1252 - FN S1168: Support IndexerDeclaration and ConversionOperatorDeclaration
• NET-459 - Fix S1168 FN: Add support for partial indexers

v10.10.0.116381: 10.10

Compare Source

Hey everyone, this release mostly focuses on internal and technical things.

General

• NET-1444 - Move ProfileRegistrar to org.sonar.plugins.csharpenterprise.api
• NET-1326 - Update RSPEC before 10.10 release

Internal Styling Rules

• NET-1378 - New Rule T0045: Use var
• NET-1359 - New Rule T0043: Avoid primary constructors on normal classes and structs
• NET-1358 - New Rule T0042: Indent raw string literal +4
• NET-1357 - New Rule T0041: Use raw string literals for multiline strings
• NET-1356 - New Rule T0040: Use minimum necessary interpolation characters
• NET-1355 - New Rule T0039: Protected field should start with lower case letter
• NET-1354 - New Rule T0038: Use fields instead of auto-implemented private or protected properties
• NET-1347 - New Rule T0000: Don't use Get prefixes
• NET-1346 - New Rule T0037: Use .Test suffix namespace
• NET-1345 - New rule T0046: Move extension method to dedicated class
• NET-1344 - New Rule T0035: Do not use var for this deconstruction
• NET-1343 - New Rule T0034: Do not embed var into this condition
• NET-1342 - New Rule T0033: Swap the logic to use positive conditions instead
• NET-1341 - New Rule T0032: Move the method body to the next line
• NET-1339 - New Rule T0030: Move the field initializer on the same line
• NET-1338 - New Rule T0029: Indent all arguments +4 further than the invocation line
• NET-1337 - New Rule T0028: Move all arguments on the same line, or wrap all of them
• NET-1336 - New Rule T0027: Move subsequent expressions on separate lines
• NET-1335 - New Rule T0026: Indent member access +4 further than the initial line
• NET-1334 - New Rule T0025: Indent ‘?’ and ‘:’ +4 further than the condition line
• NET-1333 - New Rule T0024: Place multiline ‘?’ and ‘:’ on separate lines
• NET-1332 - New Rule T0022: Indent all parameters with the first one
• NET-1331 - New Rule T0021: Use extension methods for Linq
• NET-1329 - New Rule T0019: Indent operator correctly
• NET-1328 - New Rule T0018: Move the operator to the beginning of the next line
• NET-1327 - New Rule T0015: Move local function at the end of the method
• NET-1237 - New Rule T0044: Don't add Arrange, Act, and Assert(s) comments
• NET-1325 - Improve T0007: Raise on nondeclaring is { } check

v10.9.0.115408: 10.9

Compare Source

Hello everyone!

This is a mega-hardening release! Enjoy 😄

False Positive

• NET-1309 - Fix S2583 FP: Support overrides in IsImplementingInterfaceMember
• NET-1308 - Fix S2583 FP: Add support for AdressOf operator
• NET-1302 - Fix S4158 FP: Don't raise on GetEnumerator() calls
• NET-1295 - Fix S3236 FP: Exclude Debug.Assert
• NET-1290 - Fix S4158 FP: Support RouteValueDictionary in AspNetCore
• NET-1289 - Fix S4158 FP: Adding methods with well defined sematics
• NET-1288 - Fix S4158 FP: Recognize Add methods with bool return type
• NET-1287 - Fix S4158 FP: Don't raise on SetValue
• NET-1280 - Fix S2342 FP: Flaky reports
• NET-1278 - Fix S3440 FP: Variable assignment and switch expression
• NET-1246 - Fix S1481 FP: Don't report on discard like looking variables
• NET-1242 - Fix S2583/S4158 FP: Support for collections that are initialized with object
• NET-1241 - Fix S2589 FP: Don't track concurrent collections
• NET-1230 - Fix S4158 FP: Immutable collections
• NET-1223 - Fix S3267 FP: ref struct types cannot leave the stack
• NET-1214 - Fix S2259 FP: Foreach loop over empty collection
• NET-1212 - Fix S2259 FP: Learn bool from NotNull constraint and Null value
• NET-1208 - Fix S2589 FP: Rule ignores case guards
• NET-1207 - Fix S3966 FP: disposing element of indexable after declaration pattern
• NET-1203 - Fix S3966 FP: Enumerating a collection of tuples
• NET-1202 - Fix S2259 FP: Foreach nested in try, nested in loop
• NET-1188 - Improve S4158 - Empty Collections should not be Enumerated
• NET-1088 - Fix S3240 FP: Ignore when a conditional block contains a ternary
• NET-800 - Fix S2259 FP: FlowCaptures in loops and try-regions

False Negative

• NET-1299 - Fix S2053 FN: Support Copy methods
• NET-1257 - Fix S4790 FN: New HashData overloads not recognized
• NET-1194 - Fix S4158 FN: Collection Expressions (C# 12)
• NET-357 - Fix S2068 FN: does not consider launchSettings.json files
• NET-210 - Fix S4158 FN: AddRange with empty collection

Bug

• NET-1267 - Fix S2068 bug: Issue location is out of range in web.config for elements or attributes with an xml namespace
• NET-1184 - Roslyn rule import should map the issue severity to the Software Quality impact in SonarQube Server

Improvement

• NET-1217 - Improve S3996: Set location to the property instead of record

v10.8.0.113526: 10.8

Compare Source

A small release with a few improvements for S1172, S2222 and S4158:

False Positive

• NET-1210 - Fix S4158 FP: collection filled by another function
• NET-1168 - Fix S1172 FP: When parameter is used in local function in a null-conditional or null-coalescing statement

False Negative

• NET-427 - Fix S2222 FN: Support locking via Lock object primitives
• NET-1228 - Fix S4158 FN: Support LinkedList

v10.7.0.110445: 10.7

Compare Source

Improvement

• NET-1116 - Deprecate S1227: break statements should not be used except for switch cases
• NET-1045 - Remove unused AnalyzerId and RuleNamespace server properties

Bug

• NET-1047 - Fix install scripts for NuGet packages

v10.6.0.109712: 10.6

Compare Source

Improvement

• NET-735 - Remove RoslynProfileExporter
• NET-1031 - Remove deprecated SonarLintProfileExporter
• NET-1038 - Add symbolic-execution tag to our rules
• NET-988 - Remove S1197 from SonarWay for VB.NET
• NET-989 - S3444: Add secondary location message
• NET-982 - S4144: Add secondary location message
• NET-979 - S4663: Add secondary location message
• NET-978 - S1168: Add secondary location message
• NET-977 - S4047: Add secondary location message
• NET-976 - S4457: Add secondary location message
• NET-975 - S1066: Add secondary location message
• NET-974 - S4070: Add secondary location message
• NET-973 - S1110: Add secondary location message
• NET-971 - S2612: Add secondary location message
• NET-970 - S6667: Add secondary location message
• NET-969 - S6931: Add secondary location message
• NET-968 - S6934: Add secondary location message
• NET-967 - S5034: Add secondary location message
• NET-966 - S6607: Add secondary location message
• NET-965 - S4143: Add secondary location message
• NET-961 - S6664: Add secondary location message
• NET-960 - S6677: Add secondary location message
• NET-956 - S6673: Add secondary location message

v10.5.0.109200: 10.5

Compare Source

Improvement

• NET-957 - S5693: Add secondary location message

v10.4.0.108396: 10.4

Compare Source

Improvements

In this release, we have added support for test density and metrics at the individual file level. You can now view the number of unit tests, as well as details on skipped tests, failed tests, and test duration, from all supported coverage tools (xUnit, MsTest, and nUnit).

Additionally, we have significantly optimized memory allocation, resulting in memory usage reduction during registration.

False Positive

• NET-868 - Fix S1854 FP: Don't raise when inner finally assignment is used to outer block
• NET-865 - Fix S1172 FP: Parameter used as extension delegate target
• NET-863 - Fix S1172 FP: Don't report on partial method parameters
• NET-862 - Fix S1854 FP: Don't raise in catch when variable is used in following catch
• NET-857 - Fix S3655 FP: Types with implicit conversion operator
• NET-836 - Fix S1854 FP: Value used after catch

False Negative

• NET-798 - Fix S1854 FN: Support &&, ||, ?? and ??=

Task

• NET-763 - Update RSPEC before 10.4 release

v10.3.0.106239: 10.3

Compare Source

False Positive

• NET-675 - Fix S1144 FP: support struct constructor calls
• NET-499 Telemetry: Report Language version and target framework

Other

• NET-622 - Update license files to SSAL

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud