Microsoft.CodeAnalysis.NetAnalyzers v10.0.301: CA30xx interprocedural analysis causes infinite build / StackOverflow on .NET Framework 4.8 projects

[Amitram1103]

Summary

After replacing legacy FxCop/code-analysis with Microsoft.CodeAnalysis.NetAnalyzers v10.0.301, two different projects in our large solution (both .NET Framework 4.8, non-SDK-style) either hang indefinitely during build analysis or throw a StackOverflowException. Converting to SDK-style did not help. This appears to be a regression in the CA30xx interprocedural/taint-analysis rules.

Environment

• Analyzer: Microsoft.CodeAnalysis.NetAnalyzers v10.0.301
• Target frameworks: .NET Framework 4.8 (non-SDK-style; conversion to SDK-style tested — no effect)
• OS: Windows (v10.0.26200)
• dotnet SDK: 10.0.300

Repro steps

1. Replace legacy FxCop/codeanalysis with Microsoft.CodeAnalysis.NetAnalyzers v10.0.301 (global).
2. Restore packages.
3. Build the solution (MSBuild or Visual Studio). Observe Project A crash and Project B hang.

Observed behavior

• Project A: build eventually throws StackOverflowException during analysis. Downgrading analyzers to v7.0.4 fixes this project.
• Project B: build hangs indefinitely with no error. Adding these lines to .editorconfig resolves the hang by limiting interprocedural depth to 1:

dotnet_code_quality.CA3001.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3002.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3003.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3006.max_interprocedural_method_call_chain = 1
dotnet_code_quality.CA3011.max_interprocedural_method_call_chain = 1

Workarounds tried

• Downgraded Microsoft.CodeAnalysis.NetAnalyzers to v7.0.4 (fixes Project A).
• Added max_interprocedural_method_call_chain = 1 for CA3001/3002/3003/3006/3011 in .editorconfig (fixes Project B).
• Converted projects to SDK-style (no effect).
• Other standard mitigations (disable specific rules, build-mode toggles) were tested without full resolution.

Impact

High — builds are blocked (infinite hang or crash), affecting CI and developer productivity.

Request

Please investigate CA30xx interprocedural analysis in v10.0.301 for .NET Framework (non-SDK) projects. If this is a regression, provide a fix or recommended mitigation beyond downgrading to v7.0.4 or aggressively reducing max_interprocedural_method_call_chain. Guidance on safe defaults for large codebases would be appreciated.