{"id":35604,"date":"2025-07-15T18:00:13","date_gmt":"2025-07-15T18:00:13","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/cppblog\/?p=35604"},"modified":"2025-07-15T18:58:19","modified_gmt":"2025-07-15T18:58:19","slug":"updates-to-warning-suppressions-in-microsoft-c-code-analysis","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cppblog\/updates-to-warning-suppressions-in-microsoft-c-code-analysis\/","title":{"rendered":"Updates to Warning Suppressions in Microsoft C++ Code Analysis"},"content":{"rendered":"

Microsoft C++ Code Analysis is a powerful static analysis tool integrated into Visual\nStudio that helps you identify and fix potential issues in your C++ code.\nLarge projects require effective management of analysis warnings to maintain code\nquality and you sometimes need to suppress warnings, but must do so in a clear and\nauditable way.<\/p>\n

To that end, we are excited to announce significant updates to the warning suppression\nmechanisms in Microsoft C++ Code Analysis. These enhancements provide better tracking,\njustification, and overall management of warning suppressions, leading to a more\nmaintainable and robust codebase.<\/p>\n

What’s New in the SARIF Output?<\/h2>\n

We enhanced the\nStatic Analysis Results Interchange Format (SARIF)<\/a>\noutput to include detailed information about warning suppressions, most notably the\njustification provided by you. This allows teams to easily review why<\/em> a specific\nwarning was silenced.<\/p>\n

To generate a SARIF file, use the \/analyze:log:format:sarif<\/code> compiler option. To ensure\nthat details about suppressed warnings (including their justifications) are included in\nthis SARIF log, you must also use the \/analyze:log:includesuppressed<\/code> option.<\/p>\n

What’s New in gsl::suppress<\/code>?<\/h2>\n

We have updated our support for gsl::suppress<\/code> to align with the latest C++ Core\nGuidelines syntax. Warnings can now be suppressed by using the gsl::suppress<\/code> attribute\nin the following way:<\/p>\n

[[gsl::suppress( \"<warning_id>\", justification: \"<justification>\" )]]<\/code><\/pre>\n
Where <warning_id><\/code> is the ID of the warning you want to suppress, and the optional\n<justification><\/code> is a string that provides a justification for the suppression.<\/p>\n
For now, [[gsl::suppress]]<\/code> is only available for C++ codebases. For C codebases, you\nmust use the #pragma warning(suppress)<\/code> syntax.<\/em><\/p>\n
Example:<\/p>\n
\/\/ CoreCheckExample.cpp\r\n\/\/ Add CppCoreCheck package and enable code analysis in build for warnings.\r\n\r\nint main()\r\n{\r\n    int arr[10];           \/\/ warning C26494\r\n    int* p = arr;          \/\/ warning C26485\r\n\r\n    [[gsl::suppress(\"bounds.1\", justification : \"This attribute suppresses Bounds rules #1\")]]\r\n    {\r\n        int* q = p + 1;    \/\/ warning C26481 (suppressed)\r\n        p = q++;           \/\/ warning C26481 (suppressed)\r\n    }\r\n\r\n    return 0;\r\n}<\/code><\/pre>\n
What’s New in #pragma warning<\/code>?<\/h2>\n
We have extended #pragma warning<\/code> to support the justification<\/code> field. Here is how\nyou can use it starting in Visual Studio 2022 version 17.14:<\/p>\n
#pragma warning(suppress : <warning_id>, justification : \"<justification>\")<\/code><\/pre>\n
Where <warning_id><\/code> is the ID of the warning you want to suppress, and the optional\n<justification><\/code> is a string that provides a justification for the suppression.<\/p>\n
Choosing Between #pragma warning<\/code> and gsl::suppress<\/code><\/h2>\n
Both #pragma warning(suppress)<\/code> and [[gsl::suppress]]<\/code> offer fine-grained control over\nwarning suppression.<\/p>\n