Check there are no high-priority issues to fix prior to dropping support for VS2017.

[duncanp-sonar]

Description

Related issue: SLVS-2882
#2882

Once we've dropped support for VS2017, the UX for VS2017 users will essentially be fixed - no analyzer updates, no new features, no bug-fixes (except critical security fixes).
We want to check there are no critical issues

Analyzers: impact

The analyzers will be frozen at the follow versions:

• C#/VB.NET
  Embedded version: v8.35, released Jan 2022
  https://github.com/SonarSource/sonar-dotnet/releases/tag/8.35.0.42613

Latest shipped version: 8.36.1, release Mar 2022
https://github.com/SonarSource/sonar-dotnet/releases/tag/8.36.1.44192

Most of the changes relate to the new symbolic execution engine which isn't availabe in VS2017.
-> relativelu low risk, but low value.

• CFamily
  Embedded version: v6.29, released Dec 2021
  https://github.com/SonarSource/sonar-cpp/releases/tag/6.29.0.41127

Latest shipped version: v6.30, Jan 2022
https://github.com/SonarSource/sonar-cpp/releases/tag/6.30.0.42324

The latest version has a significant refactoring to how vcxproj configuration settings are obtained
(see #2872 and #2874).
-> too risky to update prior to dropping support.

• JS/TS
  Embedded version: v8.1, released June 2021.
  https://github.com/SonarSource/SonarJS/releases/tag/8.1.0.15788

Latest shipped version: 8.9, release February 2022.
https://github.com/SonarSource/SonarJS/releases/tag/8.9.0.17411

Updating to the latest shipping version is not straightforward: there have significant changes to e.g. how the configuration is discovered and used, changes to the eslintbridge protocol.
-> too risky to update prior to dropping support.

• Secrets
  Not available.

Bugs

The bugs exist in the SLVS 2017 v5.5 and won't be fixed:

[[Perf] VS becomes sluggish/locks up after opening very large C++ files #2798

No idea of root cause. Affects a limited number of users (CFamily + very large files)

VS2022: Cannot connect to SonarCloud in connected mode #2826

• not reliably reproducible.

Credentials not saved when solution already bound to SonarQube project #2845

Two workarounds exist.

[CMake] Fetching environment variables fails intermittently #2614

Intermittent. Limited impact.

Promoting Peek definition to Document triggers analysis of all open documents #1657

May cause a gold bar. No easy fix.

Missing features

Support setting rule severity in the user settings file for JS/TS #2400

i.e. JS/TS issues are not configurable in standalone mode

[Javascript/Daemon] Issues should use the severity specified in the Quality Profile #1385

Add support for connected mode JavaScript language #770

i.e. JS/TS issues are not configurable in connected mode

Apply server settings in connected mode #1335

[duncanp-sonar]

@marco-comi-sonarsource FYI this ticket documents the main points of the state SLVS2017 will be in when we stop shipping new updates (I haven't included all bugs or features, just the more impactful ones).
We're not proposing to fix any of these. Let us know if you disagree. Thanks!

[marco-comi-sonarsource]

Hello @duncanp-sonar, it is probably worth to mention the files exclusions in the list of missing features. Anyways, it looks fine to me to proceed with the deprecations of VS2017 in the current state.