C++ Code Analysis Improvements for Visual Studio 2017 15.7 Preview 1

We’re making it easier to configure and use the C++ code analysis features with a set of changes targeting 15.7. In the first 15.7 preview we’ve cleaned up the UI, fixed our documentation links and, most importantly, simplified the way analysis extensions are configured. 

If you’re not familiar with C++ Core Check, it’s a code analysis extension that helps you update your code to be safer and use a more modern style as outlined in the C++ Core Guidelines. You can learn more about the rules we enforce on our reference page.

C++ Core Check Extension on by Default

We wanted to make it easier for developers to take advantage of the new checks from C++ Core Check. Previously if developers wanted to use C++ Core Check with code analysis, they had to explicitly enable the analysis extension for each project. Then, when running analysis, the tools would produce a deluge of Core Check warnings because all C++ Core Check warnings were enabled by default. 

Starting in Preview 1, the C++ Core Check extension is enabled whenever code analysis is run. We also updated the Microsoft Native Recommended Rules and Microsoft Native Minimum Rules to include only the highest impact C++ Core Check warnings (more on that below). We think this provides the best experience: running code analysis on a project “just works” without requiring additional configuration. 

We also removed the UI that was used to configure the analysis extensions because it’s no longer needed. Our goal is to make the ruleset the one-stop configuration file for code analysis. All a developer needs to worry about is which warnings he or she wants to run, and the engine will intelligently enable and disable extensions and checkers based on the ruleset. This feature isn’t fully implemented in Preview 1; the remaining work will ship in an upcoming preview. 

Screenshot showing the previous code analysis extension panel that was removed.

The code analysis extensions selection panel has been removed – extensions will be enabled automatically based on the rules that are enabled.

Screenshot showing that the extension panel was removed.

The code analysis extensions panel was removed from the project properties page in 15.7 preview 1.

Disabling C++ Core Check for a Project

Because this work is still in preview, we added a way to revert to the previous behavior. If the C++ Core Check extension is causing problems with a project, it can be disabled per-project by editing the vcxproj file and adding the following property.


When building from the command line with msbuild, it can also be disabled by passing the property /p:EnableCppCoreCheck=false

If you find you need to disable the extension, we’d like to know about any blocking issues you found. Use the “Send Feedback” button in Visual Studio to report any problems. 

New Rules in Recommended and Minimum Rulesets

Previously the Microsoft Native Recommended and Microsoft Minimum Rulesets had all C++ Core Check warnings enabled by default. This meant if you wanted to try out C++ Core Check and enabled the extension, you’d get a flood of additional warnings. 

To stay consistent with the spirit of the “Recommended” and “Minimum” rulesets, we looked across our internal projects and identified the C++ Core Check rules that helped prevent the most critical bugs. The Recommended and Minimum rulesets still contain the core analyzer rules they had previously and now also contain the high-impact C++ Core Check rules. If you want to run with all the C++ Core Check warnings enabled, you can still choose the “C++ Core Check Rules” ruleset. 

New in Microsoft Native Minimum 


New in Microsoft Native Recommended

  • All the Minimum rules above

Screenshot of warning C26498 on sample code.

Simple example of warning C26498 from C++ Core Check.

C++ Core Check Experimental Extension Removed 

Previous versions of Visual Studio included a C++ Core Check (Experimental) option for rules that weren’t quite ready for release. We’ve been updating these rules over several releases and now the rules dealing with raw pointers, owner pointers, and lifetime profile are implemented in the main checker. A few of the experimental rules do not map exactly to new rules and are being deprecated.   

The following experimental rules are deprecated 


Fit and Finish

We also spent some time fixing some minor bugs to improve the overall C++ code analysis experience. 

  • Clicking on an error navigates to the current documentation page instead of the page for previous versions of Visual Studio. 
  • Removed “Run Code Metrics” from the Analyze menu on projects that don’t support Code Metrics. 
  • C++ Core Check now runs significantly faster and uses up to 50% less memory compared with the 15.6 release.
  • Added a hot key to run code analysis on the current file: Ctrl+Shift+Alt+F7 in the default keyboard mapping.

Wrap Up 

We’re excited to have C++ Core Check on by default and a simpler story for getting our code analysis tools set up for your projects. Hopefully you’ll find the C++ code analysis tools easier to use and the new warnings useful. Download the latest Visual Studio preview and give them a try.

As always, we welcome your feedback. Feel free to send any comments through e-mail at visualcpp@microsoft.com, through Twitter @visualc, or Facebook at Microsoft Visual Cpp. 

If you encounter other problems with MSVC in VS 2017, please let us know via the Report a Problem option, either from the installer or the Visual Studio IDE itself. For suggestions, let us know through UserVoice. Thank you! 

Happy coding.