Rust: Upgrade to rust-analyzer 0.328 by tausbn · Pull Request #21714 · github/codeql

tausbn · 2026-04-15T14:59:25Z

WIP. Let's see what the CI thinks of this. (For the avoidance of doubt, Copilot wrote all of the code, and I'm still working my way through the changes themselves.)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…scripts - Fix Meta usage: Meta is now abstract with subtypes (PathMeta, KeyValueMeta, TokenTreeMeta, etc.) - Fix FormatArgsArg: getName() replaced by getArgName() returning FormatArgsArgName - Add upgrade script (old → new) and downgrade script (new → old) - Update Definitions.qll, PathResolution.qll, BadCtorInitialization.ql, FormatTemplateVariableAccessConstructor.qll Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Re-run cargo fmt after clippy --fix to ensure consistent formatting. Re-run codegen to update generated file tracking for MetaImpl.qll. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Setting proc_macro_processes to 0 causes an index-out-of-bounds panic in ProcMacroServerPool::new when the proc macro server is enabled. Use the same defaults as rust-analyzer itself (1 each). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Remove format_args_arg_names from upgrade delete list (table exists in both schemas with different columns) - Accept updated .expected files for schema changes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Exclude macro-expanded and attribute paths from PathResolutionConsistency (tokio::main and similar attribute macros resolve to multiple proc macro fns) - Exclude "macro expansion failed" warnings from ExtractionConsistency (compile_error! and undefined macros are expected to fail expansion) - Update pre-existing consistency expectations (net multipleResolvedTargets) - Update type-inference.expected for new RA results Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

geoffw0

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300).

Yeah, I feel that, though I suspect some of these files visible in the diff are generated code not marked as such. I've skimmed through all the changes anyway, but I'll have to rely mostly on testing (automated and manual) to build confidence here.

Can I get confirmation:

that the Copilot-written changes have been reviewed by the author?
that the upgrade / downgrade scripts have been tested?

geoffw0 · 2026-05-22T16:58:30Z

@@ -8,6 +8,9 @@ private import PathResolution
 /** Holds if `p` may resolve to multiple items including `i`. */
 query predicate multiplePathResolutions(Path p, ItemNode i) {
  p.fromSource() and
+  not p.(AstNode).isInMacroExpansion() and
+  // exclude paths inside attributes (e.g. `#[tokio::main]`)
+  not p.getParentNode*() instanceof Attr and


Why do we exclude paths inside attributes?

good point, that does seem like sweeping a problem under the rug

geoffw0 · 2026-05-22T17:02:40Z

 encoding = "0.2"
 lazy_static = "1.5.0"
-serde_json = "1.0.145"
+serde_json = "1.0.149"


Why do we change files in ruby and shared? Do they have to all reference the same versions?

The default instruction go for a generic update of everything using the Cargo.toml workspace at the root, which includes ruby/shared. We could probably limit to just rust-analyzer, or at least separate rust-analyzer from everything else

Do you think this one is worth doing in this pull request?

these updates all seem pretty harmless. I'm ok with both limiting this PR to just the rust-analyzer one or keeping these in, your call

I don't have much of an opinion here, happy with how it is as long as the consequences are understood (and not a mistake).

Adds upgrade.ql with transformations for all schema changes from rust-analyzer 0.0.301 to 0.0.328: - Meta split into PathMeta/KeyValueMeta/TokenTreeMeta/UnsafeMeta - TraitAlias merged into Trait - BlockExpr.isTry() -> TryBlockModifier - StructField.getDefault() -> getDefaultVal() returning ConstArg - Variant.getDiscriminant() -> getConstArg() returning ConstArg - FormatArgsArg.getName() -> getArgName() returning FormatArgsArgName Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

redsun82 · 2026-05-27T15:39:07Z

Rerun has been triggered: 4 restarted 🚀

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

geoffw0

New commits (the full upgrade / downgrade scripts) LGTM, though it's fiddly code - I'm glad you created tests for them.

I've made a couple of new comments, and there are still some incomplete discussions above I think.

geoffw0 · 2026-06-01T16:29:37Z

@@ -15855,3 +15847,18 @@ inferType
 | regressions.rs:179:24:179:27 | S(...) | T | {EXTERNAL LOCATION} | i32 |
 | regressions.rs:179:26:179:26 | 1 |  | {EXTERNAL LOCATION} | i32 |
 testFailures
+| main.rs:1308:44:1308:62 | //... | Missing result: target=default |


We lose a bunch of results for this type inference test. Whether or not they're important results (@hvitved), we should update the expectation comments to MISSING:.

I believe this is because derive macros are not properly expanded; should definitely be fixed before merging.

geoffw0 · 2026-06-01T16:32:19Z

 subpaths
+testFailures
+| main.rs:58:47:58:57 | //... | Missing result: Source |
+| main.rs:59:25:59:56 | //... | Missing result: Alert[rust/insecure-cookie] |


We appear to be losing ~~all~~ many query results for this query. Unless you already have an intuition what's wrong here, I should probably look into it.

... I got as far as determining that the source and sinks are recognized, but flow is lost because we're missing some calls to clone() in the database ...

hvitved

It appears there are various macro expansion issues that need to be resolved.

hvitved · 2026-06-02T08:47:53Z

@@ -4,9 +4,6 @@
 | lib.rs:1:1:1:18 | mod anonymous | test::anonymous |
 | lib.rs:2:1:2:16 | mod regular | test::regular |
 | regular.rs:1:1:2:18 | struct Struct | test::regular::Struct |
-| regular.rs:2:12:2:17 | fn eq | <test::regular::Struct as core::cmp::PartialEq>::eq |
-| regular.rs:2:12:2:17 | impl ...::Eq for Struct::<...> { ... } | <test::regular::Struct as core::cmp::Eq> |
-| regular.rs:2:12:2:17 | impl ...::PartialEq for Struct::<...> { ... } | <test::regular::Struct as core::cmp::PartialEq> |


It looks like derive macros are no longer expanded; getDeriveMacroExpansion does not have any results on this test case.

hvitved · 2026-06-02T08:49:42Z

@@ -15855,3 +15847,18 @@ inferType
 | regressions.rs:179:24:179:27 | S(...) | T | {EXTERNAL LOCATION} | i32 |
 | regressions.rs:179:26:179:26 | 1 |  | {EXTERNAL LOCATION} | i32 |
 testFailures
+| main.rs:1308:44:1308:62 | //... | Missing result: target=default |


I believe this is because derive macros are not properly expanded; should definitely be fixed before merging.

…uery.

tausbn and others added 6 commits April 15, 2026 12:54

Cargo: upgrade dependencies

ab75d99

Bazel: regenerate vendored cargo dependencies

1234471

Rust: update rust-analyzer source and run codegen

5f76c94

Rust: adapt extractor to rust-analyzer 0.0.328 API changes

ce360c4

Rust: update toolchain to 1.91 and apply lint fixes

35fc6fb

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions Bot added Ruby Rust Pull requests that update Rust code labels Apr 15, 2026

tausbn changed the title ~~Rust: Upgrade to rusts-analyzer 0.328~~ Rust: Upgrade to rust-analyzer 0.328 Apr 15, 2026

github-advanced-security AI found potential problems Apr 15, 2026

View reviewed changes

tausbn and others added 5 commits April 15, 2026 15:12

Rust: fix formatting and codegen drift

8747228

Re-run cargo fmt after clippy --fix to ensure consistent formatting. Re-run codegen to update generated file tracking for MetaImpl.qll. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: fix downgrade script (same format_args_arg_names issue)

1bd0821

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tausbn force-pushed the tausbn/rust-upgrade-to-rust-analyzer-0.0.328 branch from c990d17 to ac27c20 Compare April 16, 2026 14:15

tausbn and others added 2 commits April 16, 2026 20:31

Rust: fix downgrade script - add missing block_expr_try_block_modifiers

f66f82c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge origin/main into rust analyzer upgrade

60bffd0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-advanced-security AI found potential problems May 22, 2026

View reviewed changes

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Rust: accept test changes

a2ecf65

redsun82 marked this pull request as ready for review May 22, 2026 15:35

Copilot AI review requested due to automatic review settings May 22, 2026 15:35

redsun82 requested review from a team as code owners May 22, 2026 15:35

Copilot AI reviewed May 22, 2026

View reviewed changes

redsun82 requested a review from geoffw0 May 22, 2026 15:58

geoffw0 reviewed May 22, 2026

View reviewed changes

hvitved mentioned this pull request May 26, 2026

CodeQL fails to detect rust/insecure-cookie in Rust code github/codeql-action#3915

Open

redsun82 and others added 5 commits May 26, 2026 15:06

Merge branch 'main' into tausbn/rust-upgrade-to-rust-analyzer-0.0.328

e87c034

Rust: Add full downgrade script for dbscheme migration

25ab2e0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: Filter downgraded comments on removed nodes

f4faf4c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: Drop locations for downgraded comments

b89d9ad

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: Format downgrade query

63d8bb7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

geoffw0 reviewed Jun 1, 2026

View reviewed changes

hvitved requested changes Jun 2, 2026

View reviewed changes

geoffw0 added 3 commits June 2, 2026 16:54

Rust: Undo hiding some warnings in the extraction consistency check q…

612b923

…uery.

Rust: Remove redundant brackets.

9024cba

Rust: More impacted test expectations.

db9d781

Conversation

tausbn commented Apr 15, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

geoffw0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

redsun82 commented May 27, 2026 • edited by codeql-ci Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geoffw0 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geoffw0 Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

redsun82 commented May 27, 2026 •

edited by codeql-ci

Loading

geoffw0 Jun 1, 2026 •

edited

Loading