hi @Red_Blob. Sorry for the delay.
I’ve answered here a similar problem. Between 7.9 and 8.4.2 we improved our security offering (detection of injection vulnerabilities) and this may be tied to this.
Could you please share the logs with reportanalyzer set to true? I’m mainly interested in the time taken by our rules.
msbuild /p:reportanalyzer=true /v:d > build.log
To get the most consuming rules for each project:
select-string -path “build.log” -pattern “NOTE: Elapsed time may be less than analyzer execution time because analyzers can run concurrently.” -Context 1,30 > analyzer_times.txt
And you can share the analyzer_times.txt file.