Bump Microsoft.CodeAnalysis.Analyzers from 2.6.1 to 2.9.8

[dependabot-preview]

Bumps Microsoft.CodeAnalysis.Analyzers from 2.6.1 to 2.9.8.

Release notes

Sourced from Microsoft.CodeAnalysis.Analyzers's releases.

v2.9.7

Release build of Roslyn-analyzers based on Microsoft.CodeAnalysis 2.9.0 NuGet packages. Works with VS 2017.9 or later.

Contains following important changes on top of the v2.9.6 release

Fixes

• CA5390: Do Not Hard Code Encryption Key -- improved performance
• Rules tracking property values -- now handling assignments such as foo.Bar = Singletons.Bar ?? throw new Exception();

Added

• Security
  • CA5401: Do not use CreateEncryptor with non-default IV
  • CA5402: Use CreateEncryptor with the default IV
  • CA5403: Do not hard-code certificate

v2.9.6

Release build of Roslyn-analyzers based on Microsoft.CodeAnalysis 2.9.0 NuGet packages. Works with VS 2017.9 or later.

Contains following important bug fix on top of v2.9.5 release:

• CA2246: https://github-redirect.dependabot.com/dotnet/roslyn-analyzers/issues/2889: AD0001 - NullReferenceException when running CA2246

v2.9.5

Release build of Roslyn-analyzers based on Microsoft.CodeAnalysis 2.9.0 NuGet packages. Works with VS 2017.9 or later.

Contains following important changes on top of v2.9.4 release

Bug Fixes

• Critical Performance: Fixed memory leak in flow analysis results cache which leads to OOM exceptions and crashes on large solution. This is applicable for all rules
• Critical Reliability: Hardened all the analyzers and fixers from crashes due to Single or SingleOrDefault invocations.
• CA1065: Fixed false positives caused by breaking changes in the IOperation tree shape for throw operations.
• CA1067: Fixed false positives.
• CA1708: Fix high memory allocations in the rule implementation
• CA1721: Fixed false positives.
• CA2000: Fixed false positives
• CA2234: Fixed false positives
• CA2327: Do not use insecure JsonSerializerSettings -- Fixed InvalidCastException
• CA3147: Mark verb handlers with ValidateAntiForgeryToken -- Now handles Task-based ASP.NET MVC controller action methods
• CA3075: Insecure DTD processing in XML -- Fixed NullReferenceException.
• CA3076: Insecure XSLT script processing -- Fixed ArgumentOutOfRangeException.
• CA5390: Do Not Hard Code Encryption Key -- Treats Encoding.GetBytes() as a potentially hardcoded key. Also considers newer .NET Core 3.0 AesGcm and AesCcm APIs.

Additional analyzers/fixers:

Added

• Performance
  • CA1828: Do not use CountAsync() or LongCountAsync() when AnyAsync() can be used -- Enabled by default
  • CA1829: Use Length/Count property instead of Count() when available -- Enabled by default
• Security
  • CA2329: Do not deserialize with JsonSerializer using an insecure configuration
  • CA2330: Ensure that JsonSerializer has a secure configuration when deserializing
  • CA5391: Use antiforgery tokens in ASP.NET Core MVC controllers -- Enabled by default

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[ghost]

DeepCode Report (#bd740f)

DeepCode analyzed this pull request.
There are no new issues.

[dependabot-preview]

Superseded by #15.