Rewrite VS extension using VisualStudio.Extensibility SDK for VS2022/2026 compatibility by Copilot · Pull Request #720 · microsoft/DevSkim

Copilot · 2026-02-04T23:09:26Z

Rewrite the Visual Studio extension using the new VisualStudio.Extensibility SDK for Visual Studio 2022/2026 compatibility.

Problem

The VS2022 DevSkim extension was not functioning properly - the language server was not being activated when opening files. The root cause was that the legacy MEF-based ILanguageClient implementation using [ContentType("code")] did not properly trigger activation in Visual Studio.

Solution

Completely rewrote the extension using the modern VisualStudio.Extensibility SDK:

New architecture: Replaced legacy MEF-based ILanguageClient with LanguageServerProvider from the new VS Extensibility SDK
Proper activation: Uses DocumentFilter.FromDocumentType("text") for broad file type support
Process management: Implemented Windows Job Object to ensure the language server process is properly cleaned up when VS exits
Improved logging: Added diagnostic logging to help troubleshoot server startup issues
Code fixes & suppressions: Fixed issues with code actions and suppression comments

Changes

Removed legacy files: DevSkimLanguageClient.cs, SettingsChangedNotifier.cs, VisualStudioSettingsManager.cs, etc.
Added DevSkimExtension.cs - Extension entry point using new SDK
Added DevSkimLanguageServerProvider.cs - Language server provider implementation
Updated project file for new SDK dependencies

Testing

The extension now properly:

Activates when opening supported file types
Starts the DevSkim language server process
Displays security diagnostics in the editor
Provides code fixes and suppression actions
Cleans up the server process when VS exits

Original prompt

investigate why the visual studio 2022 extension version of devskim is not functioning properly. It doesn't seem like when the extension is launched by visual studio that it is properly connecting to or communicating with the languge server. THe language server does work fine with visual studio code - but the clients are different and we had to implement some custom logic between the two modes. it may be prudent to research other visul studio extensions to find examples of perhaps something that may be a common issue. This etension is closely based on an older smple from the visual sutdio extensibility samples repo.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Visual Studio does not activate ILanguageClient for base content types like "code". Each specific content type must be explicitly registered for the language client to be activated when files of that type are opened. Added content type registrations for: C/C++, CSharp, F#, JavaScript, TypeScript, HTML, JSON, XML, XAML, Python, Ruby, Perl, PHP, Java, Go, Rust, SQL, Lua, Swift, PowerShell, shellscript, yaml, plaintext. Kept "code" as fallback for any types not explicitly listed. Co-authored-by: gfs <98900+gfs@users.noreply.github.com>

gfs · 2026-02-05T23:05:06Z

@copilot update description and title

Copilot · 2026-02-05T23:06:23Z

@copilot update description and title

Updated the PR description to reflect the full scope of changes - rewriting the VS extension using the new VisualStudio.Extensibility SDK for VS 2022/2026 compatibility. The title should now be: "Rewrite VS extension using VisualStudio.Extensibility SDK"

Note: I can update the PR description but cannot directly modify the PR title. You may need to update the title manually to something like "Rewrite VS extension using VisualStudio.Extensibility SDK for VS2022/2026 compatibility".

… to include in the key too

…m/microsoft/DevSkim into copilot/investigate-devskim-issue

Copilot

Pull request overview

This PR completely rewrites the Visual Studio extension using the modern VisualStudio.Extensibility SDK to fix activation issues in VS2022/2026. The legacy MEF-based ILanguageClient implementation was not properly triggering when files were opened, causing the extension to be non-functional.

Changes:

Replaced legacy MEF architecture with new VisualStudio.Extensibility SDK's LanguageServerProvider
Implemented proper settings management using the new SDK's settings API with localized string resources
Added Windows Job Object support for reliable language server process cleanup
Enhanced code actions/fixes handling for VS compatibility
Removed legacy files and simplified the project structure

Reviewed changes

Copilot reviewed 40 out of 42 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
devskim-server-log20260205.txt	⚠️ Debug log file - should not be committed
Microsoft.DevSkim.sln	Removed unnecessary project configurations (SourceGenerator, ManualGenerator) and platform targets
DevSkimExtension.cs	New extension entry point using VS Extensibility SDK
DevSkimLanguageServerProvider.cs	New language server provider implementation with process management and settings handling
DevSkimSettingDefinitions.cs	Settings definitions using new SDK's declarative API
string-resources.json	Localized display names and descriptions for all settings
Microsoft.DevSkim.VisualStudio.csproj	Modernized project file using SDK-style format with new dependencies
Program.cs (LanguageServer)	Added support for initializationOptions to receive settings from VS client
CodeActionHandler.cs	New handler for textDocument/codeAction requests (VS compatibility)
TextDocumentSyncHandler.cs	Enhanced to register code fixes with CodeActionHandler
StaticScannerSettings.cs	Added proper default initialization for scanner options
PortableScannerSettings.cs	Added default values for settings properties
Multiple deleted files	Removed legacy MEF-based files, old settings management, and generator projects
.gitignore	Added Server folder to ignore list

Files not reviewed (1)

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/Properties/Resources.Designer.cs: Language not supported

Comments suppressed due to low confidence (5)

DevSkim-DotNet/Microsoft.DevSkim.LanguageServer/Program.cs:44

These lines contain debug/test code that should be removed before merging:

Line 43: Unused variable thing with a hardcoded URL
Line 44: MD5.Create() is called but never used, and MD5 is a deprecated cryptographic algorithm

This appears to be leftover debug code. Please remove these lines as they serve no functional purpose and the MD5 usage triggers security concerns even though it's not actually being used.

        var thing = "http://test.com";
        MD5 mD5 = MD5.Create();

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:390

Replace this call with a call to managed code if possible.

                NativeMethods.SetInformationJobObject(_jobHandle, 9 /* JobObjectExtendedLimitInformation */, pExtendedInfo, (uint)length);

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:409

Replace this call with a call to managed code if possible.

                NativeMethods.AssignProcessToJobObject(_jobHandle, process.Handle);

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:435

Minimise the use of unmanaged code.

        public static extern bool SetInformationJobObject(SafeHandle hJob, int jobObjectInfoClass, IntPtr lpJobObjectInfo, uint cbJobObjectInfoLength);

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:438

Minimise the use of unmanaged code.

        public static extern bool AssignProcessToJobObject(SafeHandle hJob, IntPtr hProcess);

DevSkim-DotNet/Microsoft.DevSkim.LanguageServer/Program.cs

Copilot · 2026-02-06T00:24:23Z

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimExtension.cs

+
+using global::Microsoft.Extensions.DependencyInjection;
+using global::Microsoft.VisualStudio.Extensibility;
+using System.Security.Cryptography;


The using System.Security.Cryptography; import on line 8 is unused and should be removed. There's no cryptographic code in this file.

Suggested change

using System.Security.Cryptography;

DevSkim-DotNet/Microsoft.DevSkim.LanguageServer/CodeActionHandler.cs

DevSkim-DotNet/Microsoft.DevSkim.LanguageServer/Program.cs

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

gfs · 2026-02-06T00:35:53Z

@copilot apply changes based on the comments in this thread

- Replace foreach loop with .Select() in CodeActionHandler.cs - Remove unused MD5 and test code from Program.cs Co-authored-by: gfs <98900+gfs@users.noreply.github.com>

…m/microsoft/DevSkim into copilot/investigate-devskim-issue

- Added XML documentation explaining why native interop is necessary - Added code analysis suppression with justification - Changed method visibility to internal for better encapsulation Co-authored-by: gfs <98900+gfs@users.noreply.github.com>

Copilot · 2026-02-06T00:41:15Z

@copilot apply changes based on the comments in this thread

Applied changes in commit ed6cf52:

CodeActionHandler.cs - Already addressed in previous commit (3d185d9): replaced foreach with .Select()
Program.cs - Already addressed in previous commit: removed unused MD5 code
DevSkimLanguageServerProvider.cs - Added XML documentation explaining why P/Invoke is required for Windows Job Objects (no managed .NET equivalent exists), added code analysis suppression with justification, and changed methods to internal visibility

The P/Invoke code for Job Objects cannot be replaced with managed code because .NET doesn't provide a managed API for this Windows kernel feature. The native interop is necessary to ensure child processes are terminated when VS exits unexpectedly.

…m/microsoft/DevSkim into copilot/investigate-devskim-issue

Copilot

Pull request overview

Copilot reviewed 42 out of 44 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/Properties/Resources.Designer.cs: Language not supported

Comments suppressed due to low confidence (4)

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:390

Replace this call with a call to managed code if possible.

                NativeMethods.SetInformationJobObject(_jobHandle, 9 /* JobObjectExtendedLimitInformation */, pExtendedInfo, (uint)length);

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:409

Replace this call with a call to managed code if possible.

                NativeMethods.AssignProcessToJobObject(_jobHandle, process.Handle);

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:442

Minimise the use of unmanaged code.

        internal static extern bool SetInformationJobObject(SafeHandle hJob, int jobObjectInfoClass, IntPtr lpJobObjectInfo, uint cbJobObjectInfoLength);

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs:445

Minimise the use of unmanaged code.

        internal static extern bool AssignProcessToJobObject(SafeHandle hJob, IntPtr hProcess);

DevSkim-DotNet/Microsoft.DevSkim.VisualStudio/DevSkimLanguageServerProvider.cs

…ings (eslint, @humanwhocodes/config-array, @humanwhocodes/object-schema, rimraf, glob@7, inflight). Remaining 2 warnings are transitive deps of @vscode/vsce. - Upgrade eslint ^8.8.0 → ^9.0.0 - Upgrade @typescript-eslint/eslint-plugin and parser ^5.10.1 → ^8.0.0 - Add typescript-eslint package for flat config support - Replace .eslintrc.js + .eslintignore with eslint.config.mjs - Update lint script to remove deprecated --ext flag - Auto-fix lint errors in client/devSkimFixer.ts (var→const, missing semicolon) - Remove stale eslint-disable directive in devskimSettings.ts

- Added class-level _disposeCts that is cancelled in Dispose method - Updated SubscribeAsync calls to use _disposeCts.Token instead of CancellationToken.None - Added try/catch for OperationCanceledException to handle disposal during initialization Co-authored-by: gfs <98900+gfs@users.noreply.github.com>

Initial plan

111824c

Copilot AI assigned Copilot and gfs Feb 4, 2026

Copilot started work on behalf of gfs February 4, 2026 23:09 View session

Copilot AI changed the title ~~[WIP] Investigate issues with DevSkim extension in Visual Studio 2022~~ Fix VS2022 extension activation by registering specific content types Feb 4, 2026

Copilot AI requested a review from gfs February 4, 2026 23:22

Copilot finished work on behalf of gfs February 4, 2026 23:22

gfs added 3 commits February 5, 2026 13:42

Rewrite VS Extension for new VS SDK +VS 2026 compatibility.

b206264

Fix code fixes + suppressions.

5ea212b

Clean up language server process

4572df2

Copilot started work on behalf of gfs February 5, 2026 23:05 View session

Copilot AI changed the title ~~Fix VS2022 extension activation by registering specific content types~~ Rewrite VS extension using VisualStudio.Extensibility SDK for VS2022/2026 compatibility Feb 5, 2026

Copilot finished work on behalf of gfs February 5, 2026 23:06

Fix settings

21d8566

gfs requested a review from Copilot February 6, 2026 00:18

Copilot started reviewing on behalf of gfs February 6, 2026 00:18 View session

gfs and others added 3 commits February 5, 2026 16:21

Delete DevSkim-DotNet/devskim-server-log20260205.txt

b5cb808

Simplify diagnostic key - alraedy mapped in dictionary by uri no need…

461db4d

… to include in the key too

Merge branch 'copilot/investigate-devskim-issue' of https://github.co…

e241b3e

…m/microsoft/DevSkim into copilot/investigate-devskim-issue

Copilot AI reviewed Feb 6, 2026

View reviewed changes

gfs and others added 4 commits February 5, 2026 16:29

Fix version stamping extension

61c2fc3

Remove custom fix handler (now redundant)

c9824e2

Fix metadata in VS Extension

8b9871d

Update DevSkim-DotNet/Microsoft.DevSkim.LanguageServer/Program.cs

07325b3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of gfs February 6, 2026 00:34 View session

Remove inadvertent detection test change.

f7e548e

Copilot AI and others added 2 commits February 6, 2026 00:36

Address code review feedback: use Select() and remove unused code

3d185d9

- Replace foreach loop with .Select() in CodeActionHandler.cs - Remove unused MD5 and test code from Program.cs Co-authored-by: gfs <98900+gfs@users.noreply.github.com>

Merge branch 'copilot/investigate-devskim-issue' of https://github.co…

f36a241

…m/microsoft/DevSkim into copilot/investigate-devskim-issue

Copilot finished work on behalf of gfs February 6, 2026 00:37

Copilot started work on behalf of gfs February 6, 2026 00:38 View session

Copilot finished work on behalf of gfs February 6, 2026 00:41

gfs requested a review from Copilot February 6, 2026 00:44

Copilot started reviewing on behalf of gfs February 6, 2026 00:45 View session

gfs added 2 commits February 5, 2026 16:49

Code review improvements/cleanup.

331529c

Merge branch 'copilot/investigate-devskim-issue' of https://github.co…

8188425

…m/microsoft/DevSkim into copilot/investigate-devskim-issue

Copilot AI reviewed Feb 6, 2026

View reviewed changes

Copilot started work on behalf of gfs February 6, 2026 02:01 View session

Copilot finished work on behalf of gfs February 6, 2026 02:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Rewrite VS extension using VisualStudio.Extensibility SDK for VS2022/2026 compatibility#720

Rewrite VS extension using VisualStudio.Extensibility SDK for VS2022/2026 compatibility#720
Copilot wants to merge 21 commits intomainfrom
copilot/investigate-devskim-issue

Copilot AI commented Feb 4, 2026 •

edited

Loading

Uh oh!

gfs commented Feb 5, 2026

Uh oh!

Copilot AI commented Feb 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Feb 6, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gfs commented Feb 6, 2026

Uh oh!

Copilot AI commented Feb 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Copilot AI commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Changes

Testing

Uh oh!

gfs commented Feb 5, 2026

Uh oh!

Copilot AI commented Feb 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gfs commented Feb 6, 2026

Uh oh!

Copilot AI commented Feb 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 4, 2026 •

edited

Loading