►
From YouTube: .NET Tooling Community Standup - Sept 17th 2020 - Analysis Levels in .NET 5: Find latent bugs
Description
Jon published an excellent post on the new analysis levels we are introducing in .NET 5. We'll also talk about the new warnings and errors in .NET 5 preview that help you find common mistakes early! https://devblogs.microsoft.com/dotnet/automatically-find-latent-bugs-in-your-code-with-net-5
Community Links: https://www.theurlist.com/dotnet-community-standup-tooling-9-17-2020
Featuring: Jonathon Marolf (@JonathonMarolf)
A
A
A
I
can
share
the
link
in
chat
and
let
me
make
sure
I
got
the
right
thing
in
my
clipboard,
so
you
guys
can
read
up
on
it.
If
you
haven't
before
it
is
very
good
john
says
we
look
and
sound
good.
Thank
you
john.
I
also
feel
like
I
look
good
okay,
so
so
this
is
super
impactful
work
because
we're
finding
and
giving
more
information
on
errors
and
warnings
and
all
this
stuff
in
the
frameworks
that
we've
never
been
able
to
give
and
how
we
use
it.
A
C
C
There's
a
default,
that's
selected
for
you
default
is
the
latest,
and
so,
when
you
go
to
net5,
what's
going
gonna
happen?
Is
we
will
have
the
compiler
give
you
new
warnings
about
various
code
patterns
that
we
know
are
likely
wrong
and
we
can
we'll
show
you
so
what
some
of
those
are
as
an
example
later,
but
so
that
just
means
when
you
move
to.net5
from.net
core
31,
which
we
know
everyone's
on
when
you
move
there,
you'll
just
get
bet
better
analysis
warnings
automatically.
C
C
You
can
set
analysis
level
to
five
or
latest
in
that
project
and
then
you'll
get
them
even
though
you're
targeting
a
different
framework.
So
we
default
you
to
the
latest
for
the
new
frameworks,
but
analysis
level
allows
you
to
have
control
over
what
makes
most
sense
for
your
individual
projects.
And
so
that's
but
again
you
don't
have
to
care
about
it.
But
if
there
you
want
that
level
of
control,
which
makes
sense
for
some
very
large
projects
and
small
ones
too,
you
have
it
now
and
that's.
A
C
No,
it
works
just
fine.
This
is
not.
I
mean
a
lot
of
times
in
our
messaging
for
for
good
reason.
We
say:
well,
it's
all
tied
to
a
visual
version
of
dota
framework,
but
this
is
just
a
compiler
feature.
It
doesn't
care
what
target
framework
using
it
just
cares.
What
compiler,
using
so
you'd,
have
to
have
a
new.net
sdk,
so
you'd
have
to
have
the.5
sdk,
because
this
is
the
feature
comes
with
the
compiler
and
that
sdk.
A
A
C
Yeah
I
mean,
if
you
cut
to
my
screen
here
real
quick,
I
did
add
some
information
in
the
project
property
pages
for
people
using
visual
studio.
I
know
that's
not
everywhere,
but
so
we
actually
under
code
analysis
level.
Here
we
have,
we
will
actually
list
what
your
current
analysis
level
is,
and
so
you
can
set
it
to
none
to
say
turn
this
feature
off.
C
C
A
C
That
is
the
plan
I
work
with
emo,
so
you
can
never
bet
on
whether
numbers
will
make
sense
or
stay
the
same
or
who
knows
right.
But
yes,
we,
the
plan
is
there'll,
be
a
dot
next
six
and
then
dot
n6.
We
will
have
analysis
level
six,
so
hopefully
that
can
stay
fairly
easy
to
remember
of
like
well.
I
want
the
sort
of
compiler
analysis
that
I
got
with
dot:
net
five:
okay,
I'm
going
to
change
analysis
level.
Five.
C
A
C
C
Wanted
for
a
long
time,
and
it's
something
that
I
think
when
you
first
describe
to
someone
they're
like,
why
can't
you
just
do
this,
but
there's
reason
so
this
is.
We
have
a
date
time
which,
if
you're
unfamiliar
this,
is
a
struct
type.
So
that
means
it
can't
be
null
but
we're
comparing
it
to
null
here,
which
is
honestly
nonsensical
and
so
back
in
the
day
we
used
to
not
warn
for
this.
We
would
say
you
know
this
code
does
nothing,
but
we
we
didn't
tell
you
now
we'll
actually
say
hey.
C
Comparing
types
to
like
you
know,
strikes
like
this
they're,
basically
wanting
to
know
if
this
was
like
a
nullable
of
t
type
or
something-
and
you
know
we-
this
was
a
blocker,
because
people
would
get
a
lot
of
errors
in
this
code.
We
and
rosalind
have
a
lot
of
errors
like
this
in
our
code,
and
the
only
reason
we
don't
is
because
we
have
this
warning
to.
C
C
If
you
compare,
if
you're
trying
to
do
is
on
static
classes,
so
in
c-sharp
you
can
declare
a
static
class,
which
means
hey,
you're,
not
allowed
to
do
a
lot
of
things
with
this
class
not
allowed
to
inherit
it
now
to
create
a
new
object
of
it,
for
example,
and
so
we
just
know
like
well
o
can't
be
fizz,
because
this
is
a
static
class.
So,
like
that's
just
since
this
is
an
instance
and
fizz
isn't
allowed
to
have
instances.
C
A
Sure,
actually,
that
kind
of
brings
us
to
the
next.
My
next
question:
we
people
don't
want
to
see
a
ton
of
warnings
in
their
area
list,
so
I
think
at
the
very
beginning,
with
the
date
time
and
struct
is
notable
kind
of
comparison.
You
mentioned
that
this
is
so
obvious.
You
know
that
we
shouldn't
be
doing
this,
who
like?
Why?
Wouldn't
we
just
have
this
as
a
warning
all
the
time.
C
Well,
that's
a
yeah,
so
the
answer
is
a
long-standing
problem
for
the
compiler
team
is
the
feature
worn
as
air
exists,
which
we're
getting
a
little
bit
into.
You
know,
I
think
how
people
think
about
their
code
and
how
they
want
to
manage
it.
That's
a
very
personal
thing,
so
everyone
has
preferences.
So
a
lot
of
people
will
set
ones
as
errors,
which
means,
if
there's
a
warning,
fail
my
build,
which
I
can
totally
agree
with,
because
I
think
there's
lots
of
situations
where
hey.
C
If
we
don't
do
that,
you
know
warnings
are
just
gonna
accumulate
over
time
because
everyone's
when
the
chips
are
down
and
you've
got
to
get
a
feature
and
most
people
aren't
going
to
have
the
discipline
to
go
and
ensure
that
code
compiles
the
warnings.
And
so,
if
you're,
making
an
area,
you
say
no
we're
just
making
a
statement.
You
can't
do
that.
You
have
to
fix
all
your
warnings
and
so
that
that
a
lot
of
people
makes
a
lot
of
sense.
C
But
then
now,
once
you
add,
new
warnings
now
you're
breaking
people's
code,
so
someone
takes
a
new
compiler
update
and
now
they
can't
just
take
that
and
start
let's
say
using
new
language
features.
Now
they
have
to
fix
any
new
warnings
immediately
in
their
code
and
they
have
no
choice
right.
They
have
no
capability
to
configure
that.
So
the
concern
with
this
feature
was
always
well.
C
If
we
add
new
warnings,
that's
sort
of
breaking
people,
we
need
to
give
them
the
ability
to
ex
you
know
worst
case
scenario
just
turn
those
old
those
new
warnings
off
if
they
have
to
and
potentially
configure
them
on
a
case-by-case
basis.
So
that's
again.
Another
reason
why
analysis
level
exists
is
so
that
if
you
need
to
bulk
configure
these,
you
can
but
like
everything
in
visual
studio
or
in
just.net
tooling,
you
can
suppress
issues
in
source.
You
can
do
this.
C
Pragma
suppression
thing
for
an
individual
case
or
you
know,
do
the
or
do
the
suppression,
file
or
add
attributes
and
various
things.
So
you
can-
and
you
can
do
that
also
from
the
air
list.
If
there's
like
a
group
of
them,
you
can
go
and
say,
suppress,
right
and
so
or
just
turn
off
that
particular
rule.
You
can
type,
no
warn
you
know
whatever
so
yeah.
C
That
was,
I
think,
one
of
the
reasons
we
didn't
do
this
feature
in
the
past
and
felt
we
had
to
figure
this
out
is
how
do
users
have
all
the
tools
they
need
to
configure
it
so
that
whatever
their
project,
does
we
don't
pigeonhole
them
and
force
them
into
a
corner?
Because
there's
a
millions
of
millions
lines
of
code
written
in
c,
sharp
and
being
too
opinionated
can
lead
to
a
very,
very
difficult
situation
for
a
lot
of
projects.
C
A
That
can
be
really
impactful
so
since
we've
almost
had
our
hands
tied
up
till
now,
because
we
didn't
have
like
a
way
to
successfully
introduce
these
without
breaking
people,
I
guess
so.
We've
just
been
storing
up
all
of
these.
I
guess
framework
specific
patterns
and
things
we
wish.
We
could
tell
people
for
a
long
time,
and
now
we
finally
can.
C
Yeah,
as
dustin
campbell
first
mentioned,
my
shows
I
was
like.
Finally,
we
can
tell
people
they're
wrong,
which
is
a
little
facetious.
That's
not,
I
think
the
intention
here,
the
hope
is
again.
We
can
give
you
a
smarter
platform
that
you
get
to
decide
what
matters
to
you.
You
know,
there's
other
analysis.
We
didn't
include
yet
we're
being
a
little
conservative
but
like
yeah,
hopefully
someday
you
could
say
hey
this
project
is
very
performance
sensitive.
C
We
care
a
lot
about
how
this
code
performs,
and
so
we
could
do
initial
analysis,
like
hey,
you're,
doing
a
lot
of
things
that
are
not
going
to
make
this
code
fast.
Here's
a
faster
alternative
because
we
know
you've
asked
for
that
and
you
care
about
it,
and
so
that's
really.
The
goal
is
to
instead
of
be
dogmatic
and
tell
you
you're
wrong,
is
to
give
you
the
tools
to
make
the
your
code
as
good
as
it
can
by
default,
just
built
into
the
compiler.
Without
you
know,
needing
a
bunch
of
additional
tools.
C
I
just
want
to
show
this
one,
because
it
has
a
special
place
to
my
heart.
This
was
the
first
analyzer
I
ever
wrote
when
I
was
on
the
team
and
the
code
fix
for.
I
also
wrote,
because
it
is
the
simplest
one
possible
is
just
remove
this
this
statement
here.
A
lot
of
these
we
have
are
our
a
lot
of
these
are
analyzers
that
we
wrote
that
sort
of
come
from
a
lot
of
the
design
from
fx
cops.
C
So
a
lot
of
if
you're
familiar
with
fxcop
as
a
2008
technology
of
the
shipped
a
lot
of
those
ideas,
we're
now
moving
forward
and
putting
again
into
the
the
compiler
layer
here.
But
so
this
is
the
thing
that
I
think
everyone
immediately
thinks
about,
but
doesn't
realize
is
wrong,
which
is
you
know
as
a
kid
I
learned
to
throw
the
ball
and
catch
the
ball,
and
so,
if
I'm
throwing
an
exception
and
I
catch
the
exception,
it
makes
sense
that
I
would
throw
that
exception
back.
C
C
You
will
change
the
stack
frames
which
will
make
it
very
difficult
to
diagnose
what
actually
happened
to
cause
this
exception,
and
so
the
correct
thing
to
do
is
to
actually
just
type
a
a
naked,
throw
keyword
to
say
that
that's
that's
what
you
intend
here
and
you
know
very
minor
thing,
most
people,
you
know
who
are
for
very,
very
veteran
c-sharp
programmers
know
this,
but
again
the
whole
goal
is
well.
If
you're
new
to
c-sharp.
C
C
C
Let's
see
so,
we
have
some
pretty
advanced
capabilities
in
for
two
configure
analyzers
now
so
like
most
things,
analyzers
that
are
shipped
as
nougat
packages
come
with
props
and
targets
files
that
you
can
generate
for
them,
and
so
we
now
have
a
new
capability
where
you
can
specify
hey.
These
are
the
ms
build
things
these
are
like
the
settings
that
are
in
my
project
file
that
I
need
to
know
about,
and
so
you
can
set
in
your
analyzer
package.
C
C
We
now
do
analysis
of
like
hey
you're,
using
an
api,
and
you
said
you're
targeting,
let's
say
mac,
and
we
actually
know
that
that
api
won't
work
on
mac.
So
we'll
warn
you
about
it
right
to
do
that.
The
analyzer
has
to
know
what
your
project
is
targeting,
which
is
not
a
thing
that
compiler
knows,
but
is
a
thing
that
the
project
file
talks
about.
So
in
a
roundabout
way.
A
C
Yeah,
the
only
other
one
I
wanted
to
show
off
is
just
because
I
think
this
is
again
actually
demonstrating.
I
was
talking
about
of
the
framework
team
being
able
to
design
and
give
us
new
apis
that
they
previously
wouldn't
due
to
dangers,
is
there's
a
there's.
This
memory
manager
type
it's
very
specialized.
I
don't
think
most
people
wouldn't
use
it,
but
it's
basically
for
defining
your
own
span
based
constructs.
So
if
you're
unity
or
some
some
high
performance
program,
that
really
needs
to
manage
your
memory
very
exactly.
C
You
can
derive
your
own
custom
memory
manager
right,
but
if
you
like,
for
some
reason,
implement
a
a
one
of
these
finalizers
to
the
class,
it's
actually
unclear
what
that
will
do
to
the
runtime
and
it
may
actually
destabilize
the
runtime
like
cause
your
program
to
crash.
So
now
we
can
actually
warn
you
like.
C
Thing
you're
not
allowed
to
do
because
we
have
like
no
way
to
reason
about
what
happens
with
the
finalizer,
with
this
sort
of
unmanaged
sort
of
type
thing,
and
so
previously
the
runtime
team
have
been
very
sorry.
I
don't
know
if
we
can
ship
this
there's
a
lot
of
scary
stuff
about
putting
this
type
out
of
like
oh,
at
least
we
can
warn
people
like
hey.
C
If
this
is
you
know,
this
is
a
warning,
so
maybe
you're
doing
this
for
debugging
or
something
and
that's
okay,
but
like
your
production
code
should
ideally
not
have
a
finalizer,
because
that
can
really
mess
with
what
the
runtimes
expectations
about
how
memory
is
going
to
work
are,
and
we
hope
to
see
more
of
this
right
dot.
Five
most
of
these
warnings
are
for
very
low
level
sort
of
span
like
things
but
yeah.
C
We
hope
to
have
that
expand,
there's
lots
of
types
that
are
internal,
that
if
you're
a
inhabitant
of
the
github
done
at
runtime
repo,
you
know
people
been
asking
for
it
now,
it's
like!
Oh,
we
could
maybe
give
them
the
you
know
the
stack
based
string
builder
or
something
because,
even
though
that
thing
is
really
terrifying
it
to
use
correctly,
it
is
a
major
performance
win,
but
we'll
see
we'll
see
where
we
go
from
here.
B
Go
ahead!
Oh
sorry,
about
that.
Okay,
I
love
that
there's
both
angles
with
these
analyzers
of
those
helping
users
fall
into
like
good
patterns
that
aren't
immediately.
Obviously,
you
just
kind
of
fall
into
the
okay.
That's
a
bad
idea
with
just
re-throwing
the
exception
and
then
there's
that
also
extreme,
that,
if
you're
doing
some
stuff,
that
is
a
bit
advanced,
it
also
saves
you
some
doing.
You
know
some
really
bad
things
like
preventing
memory
from
being
free.
So
I
love
those
kinds
of
things
being
in
there
by
default
myself.
So.
C
C
One
is
test
continuation
options
and
the
other
is
task
creation
options
and
this
one
actually
accepts
tax
creation
options,
but
since
it
has
a
a
constructor
that
accepts
an
object,
it
will
like
let
you
pass
in
just
any
old
enum
effectively.
So
you're
allowed
to
do
this,
but
this
is
just
accepting.
If
you
look
if
you
why?
C
C
You
know
members,
and
we
think
you
probably
meant
this
so
the
you
know
that's,
which
again
is
a
minor
thing
like
how
many
people
encounter
this.
I
don't
know-
hopefully
not
too
many,
but
but
now
at
least
like
yeah
stuff
like
this
or
we
can
say,
hey,
we
even
made
maybe
a
unfortunate
oversight
and
an
api.
We
can
now
hopefully
be
smarter
and
let
people
yeah
use
things
effectively
and
yeah.
A
C
C
C
Well,
you've
got
to
be
remember
in
middle
school
thinking.
I
was
a
real
cool
guy
because
I
changed
the
default
character
from
clippies.
I
think
you
could
have
it
be
like
a
dog
or
like
einstein
or
something
that
one
was
like
just
the
earth,
and
I
was
like
yeah,
I'm
even
more
unique,
I'm
an
even
more
unique
snowflake,
because
I've
got
like
einstein
suggesting
stuff
to
me
instead,
which
felt
pretty
cool
yeah.
A
C
Options
like
yeah,
I'm
sorry,
I'm
not
looking
at
the
channel.
If
people
are
asking
about
that,
but
yeah,
the
my
general
advice
is
one
just:
no,
I'm
I'm
not
really
testing
that
scenario,
so
if
you
encounter
bugs
feel
free
to
file
them,
but
that's
not
something
that
like
was
the
main
line
thing
here.
I'm
like
I'm
not
trying
to
block
it
working,
but
I'm
also
not
like
doing
a
lot
of
testing
to
verify
it
works
perfectly.
C
I
would
generally
say
if
you
look,
this
is
like
the
new
sdk
style,
what
we
call
it
project
and
regardless
of
what
you're
doing
I
would
let
me
comment
this.
I
would
migrate
your
project
to
be
that,
if
possible,
so
you
can
do
this
in
the
new
sdk
style
project,
where
you
say:
hey,
I'm
targeting.net
framework
for
eight
and
I
want
analysis
level
five,
so
I'm
overwriting
whatever
that
is-
and
this
will
work
right-
the
basically
because
this
feature
just
comes
from
the
sdk.
C
So
by
definition
the
sdk
pro
style
project
will
have
it.
If
you
wanted
to
do
this
in
an
older
style
donut
from
a
project,
it's
theoretically
possible,
basically
the
way
you'd
have
to
do.
That
would
be
to
go
and
add
the
analyzers
that
we're
that
we
add
manually
for
you.
So
these
there
are
third
party
nuget
packages
we
will
ship
and
that's
sort
of
the
design
is
we'll
still
ship.
A
C
So
it
is
possible,
you
can
do
it,
we're
not
I'm
not
doing
a
lot
of
testing
on
that
scenario,
but
yeah
I'm
not
trying
to
block
it
either.
Okay,
but
I
would
say
it's
definitely
easier
and
simpler
and
I
think
you
will
generally
be
happier
if
you're
in
an
sdk
style
project
and
I
think
again
for
a
lot
of
other
reasons.net
5
will
give
you
some
performance
and
just
usability
advantages
over
dotnet
framework,
but
again
everyone's
code.
Some
people
like
I've,
got
millions
lines
of
code.
I
can't
I
can't
do
it
all.
C
A
Yeah,
do
you
think
we
can
kind
of
probably
wind
down
on
the
questions
here?
Let
us
know
in
chat
if
you
have
any
more
for
john,
but
I
was
just
wondering:
do
you
think
this
will
change
sort
of
what
like
default,
severities
of
analyzers
that
we
check
in
because
now
we
can
say?
Oh
yeah.
We
definitely
want
this
to
be
like
a
warning
or
an
error,
but
maybe
they
won't
get
it
if,
unless
they're
at
a
more
progressed
analysis
level,
so
there's
like.
C
Yeah
were
there
is
a
lot
of
internal
discussion
meetings
about
sort
of
back
compat
and
how
this
works
with
new
warnings
me
and
manish
have
spent
many
males
and
private
teams
chats
discussing
this
mish
bassani
is
sort
of
the
lead.
I
would
say
architect
for
analyzers
at
this
point,
he's
written
most
of
them
he's
also
written
literally
written
the
book
on
them.
C
A
C
A
great
guy,
the,
but
but
so
yeah
moving
forward.
We
will
we're
basically
bringing
new
warnings
before
a
sort
of
compat
council
that,
like
stephen
tobe
and
a
lot
of
other
sort
of
net
architects,
people
you
know
are
on
and
sort
of
make
the
case.
At
least
this
is
what
I
did
for
a
lot
of
these
is
to
make
the
case
like
this
is
why
I
think
this
is
good
and
then
everyone
sort
of
weighs
in
like
yes,
it
is
no.
C
C
Actually
right
that
those
new
warnings
are
there
so
we've
it's
already
come
up
multiple
times
between
the
compiler
team
and
the
and
the
runtime
team
of
new
stuff.
We
want
to
add
for
dot-net
six,
but
I'm
trying
to
be
a
little
conservative
here
for
don
at
five
and
say
well,
let's
just
put
a
small
set
out
because
it's
the
first
time
we're
doing
this
and
verify
that
all
the
right
hooks
and
knobs
for
people
to
control
what
their
code
does
are
there
and
once.
A
C
Useful
we're
also,
you
know
toying
with
as
well
while
we're
here
man
you
should
like
me
to.
We
also
joined
with
the
ability
to
add
code
style
enforcement
to
your
build.
So
now
you
could
make
theoretically
code
style
errors,
failure
build
if
that's
what
you
wanted,
or
at
least
produce
warnings,
and
in
the
past
you
could
get
code
style
sort
of
stuff
in
visual
studio
or
in
vs
for
mac
or
your
ide,
but
then
there's
no
way
to
sort
of
enforce
that
easily
on
build.
C
I
worked
with
joey
on.net
format
to
sort
of
a
command
line
tool
to
do
that.
But
now
we
would
like
to
say
well
again
the
compiler.
If
it's
in
the
compiler,
it's
sort
of
a
feature
everyone
gets
for
free.
There
shouldn't
be
too
much
work,
so
we
are
experimenting
and
hope:
it.net
six
to
have
sort
of
the
plan,
solidified
for
code
style
enforcement
so
again
giving
users
the
flexibility
to
say
for
my
project.
C
You
know
these
sort
of
things
are
errors
or
our
warnings,
and
these
things
they
don't
care
about,
and
I
can
specify
that
and
then
know
that,
like
no
matter
who's,
you
know
developing
this
open
source
project,
whatever
tools
they're
using,
they
will
get
the
right
sort
of
warnings
and
errors
in
analysis
to
do
the
right
things.
My
project
automatically,
and
I
don't
have
to
spend
time
in
code
review
telling
them.
Oh.
B
A
C
C
C
Yeah,
we've
sort
of
been
cheating
and
living
with
a
lot
of
these
speeches
for
a
long
time,
which
is
again
why
I
had
pretty
high
confidence
that
these
were
going
to
be
the
right
things
to
ship,
because
we'd
sort
of
been
dog
footing
them
for
years.
At
this
point
so
but
yeah.
So
today,
if
you
were
to
turn
this
on
and
you
wouldn't
see
any
errors
in
roslyn,
but
that's
not
because
we're
incredible
programmers!
It's
because
we've
been
cheating
and
have
had.
C
Running
yeah
for
a
very
long
time,
but
I
recently
turned
this
on,
because
every
code
base
that
I'll
just
say
don't
feel
bad
every
code
base.
I've
turned
this
on
there's
at
least
one
instance
of
compare
structural
like
I
think
there
was
the
the.net
sdk
repo.
I
turned
this
on
and
one
of
their
tests,
they're,
comparing
structural
and
like
a
link,
query
which
is
like
yep,
everyone
does
that
it's
just
very
hard
to
not
in
with
generics
and
just
the
world.