HttpClient.Resilience.Analyzers 0.1.162

<p align="center"> <img src="https://raw.githubusercontent.com/georgepwall1991/HttpClient.Resilience.Analyzers/main/assets/logo.png" alt="HttpClient.Resilience.Analyzers logo — Roslyn analyzers for HttpClient and IHttpClientFactory" width="160"> </p>

HttpClient Resilience Analyzers — IHttpClientFactory, Polly, and Http.Resilience

Compile-time Roslyn analyzers and code fixes for .NET HttpClient, IHttpClientFactory, AddHttpClient typed clients, Polly, and Microsoft.Extensions.Http.Resilience.

Catch outbound HTTP reliability bugs at build time—socket exhaustion, missing PooledConnectionLifetime, DI lifetime leaks, stacked resilience handlers, unsafe POST retries, undisposed responses, and dropped cancellation tokens—before production, not at runtime.

Analyzer-only package: no runtime dependency is added to your application.

The problem

HttpClient misuse often compiles cleanly and looks fine in review. Socket exhaustion, stale DNS, double retries on POST, typed clients held by singletons, and undisposed ResponseHeadersRead streams show up under load—after deploy.

What it catches

• Per-request new HttpClient() and long-lived clients without PooledConnectionLifetime
• Cached IHttpClientFactory.CreateClient() results and typed clients injected into singletons
• Duplicate typed-client registrations and shared implicit client names
• Stacked AddStandardResilienceHandler pipelines, unsafe-method retries, unsafe-method hedging, and custom AddResilienceHandler pipelines that retry unsafe methods
• Undisposed responses/streams, sync-over-async, missing CancellationToken
• Unbounded HTTP fan-out and fragile named-client string literals

The package currently ships 21 documented diagnostics (HCR001–HCR085), with automatic code fixes for common lifetime, retry, hedging, disposal, cancellation, and registration problems.

Install

dotnet add package HttpClient.Resilience.Analyzers

For a library or shared project, keep the analyzer private to the project:

<PackageReference Include="HttpClient.Resilience.Analyzers" Version="0.1.162" PrivateAssets="all" />

Build normally with dotnet build. Diagnostics appear in supported IDEs, command-line builds, and CI without application configuration.

See it work

Product-flow diagrams from the real showcase sample (not stock screenshots):

Quick start

1. Add the package reference with PrivateAssets="all".
2. Run dotnet build — no service registration or runtime setup required.
3. Fix or suppress high-confidence findings on critical outbound paths.
4. Optionally copy a severity profile from the package contentFiles (default, brownfield-adoption, strict-ci, library-author).

Feature snapshot

Configure severity

[*.cs]
dotnet_diagnostic.HCR041.severity = error
dotnet_diagnostic.HCR080.severity = suggestion

Compatibility

Targets Roslyn via a netstandard2.0 analyzer assembly. Works with modern .NET SDK builds, ASP.NET Core, and any project that uses HttpClient / IHttpClientFactory patterns the rules can prove statically. Heuristic checks use lower default severity; deliberate exceptions can be suppressed per rule.

Documentation

• Documentation site
• Getting started
• Complete rule catalog
• Configuration guide
• Adoption guide
• FAQ
• Source and releases

Licensed under the MIT License.