Rust: Upgrade to rust-analyzer 0.328 by tausbn · Pull Request #21714 · github/codeql

tausbn · 2026-04-15T14:59:25Z

WIP. Let's see what the CI thinks of this. (For the avoidance of doubt, Copilot wrote all of the code, and I'm still working my way through the changes themselves.)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…scripts - Fix Meta usage: Meta is now abstract with subtypes (PathMeta, KeyValueMeta, TokenTreeMeta, etc.) - Fix FormatArgsArg: getName() replaced by getArgName() returning FormatArgsArgName - Add upgrade script (old → new) and downgrade script (new → old) - Update Definitions.qll, PathResolution.qll, BadCtorInitialization.ql, FormatTemplateVariableAccessConstructor.qll Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Re-run cargo fmt after clippy --fix to ensure consistent formatting. Re-run codegen to update generated file tracking for MetaImpl.qll. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Setting proc_macro_processes to 0 causes an index-out-of-bounds panic in ProcMacroServerPool::new when the proc macro server is enabled. Use the same defaults as rust-analyzer itself (1 each). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Remove format_args_arg_names from upgrade delete list (table exists in both schemas with different columns) - Accept updated .expected files for schema changes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Exclude macro-expanded and attribute paths from PathResolutionConsistency (tokio::main and similar attribute macros resolve to multiple proc macro fns) - Exclude "macro expansion failed" warnings from ExtractionConsistency (compile_error! and undefined macros are expected to fail expansion) - Update pre-existing consistency expectations (net multipleResolvedTargets) - Update type-inference.expected for new RA results Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

geoffw0

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300).

Yeah, I feel that, though I suspect some of these files visible in the diff are generated code not marked as such. I've skimmed through all the changes anyway, but I'll have to rely mostly on testing (automated and manual) to build confidence here.

Can I get confirmation:

that the Copilot-written changes have been reviewed by the author?
that the upgrade / downgrade scripts have been tested?

Adds upgrade.ql with transformations for all schema changes from rust-analyzer 0.0.301 to 0.0.328: - Meta split into PathMeta/KeyValueMeta/TokenTreeMeta/UnsafeMeta - TraitAlias merged into Trait - BlockExpr.isTry() -> TryBlockModifier - StructField.getDefault() -> getDefaultVal() returning ConstArg - Variant.getDiscriminant() -> getConstArg() returning ConstArg - FormatArgsArg.getName() -> getArgName() returning FormatArgsArgName Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

redsun82 · 2026-05-27T15:39:07Z

Rerun has been triggered: 4 restarted 🚀

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

geoffw0

New commits (the full upgrade / downgrade scripts) LGTM, though it's fiddly code - I'm glad you created tests for them.

I've made a couple of new comments, and there are still some incomplete discussions above I think.

geoffw0 · 2026-06-01T16:29:37Z

@@ -15855,3 +15847,18 @@ inferType
 | regressions.rs:179:24:179:27 | S(...) | T | {EXTERNAL LOCATION} | i32 |
 | regressions.rs:179:26:179:26 | 1 |  | {EXTERNAL LOCATION} | i32 |
 testFailures
+| main.rs:1308:44:1308:62 | //... | Missing result: target=default |


We lose a bunch of results for this type inference test. Whether or not they're important results (@hvitved), we should update the expectation comments to MISSING:.

I believe this is because derive macros are not properly expanded; should definitely be fixed before merging.

geoffw0 · 2026-06-01T16:32:19Z

 subpaths
+testFailures
+| main.rs:58:47:58:57 | //... | Missing result: Source |
+| main.rs:59:25:59:56 | //... | Missing result: Alert[rust/insecure-cookie] |


We appear to be losing ~~all~~ many query results for this query. Unless you already have an intuition what's wrong here, I should probably look into it.

... I got as far as determining that the source and sinks are recognized, but flow is lost because we're missing some calls to clone() in the database ...

hvitved

It appears there are various macro expansion issues that need to be resolved.

hvitved · 2026-06-02T08:47:53Z

@@ -4,9 +4,6 @@
 | lib.rs:1:1:1:18 | mod anonymous | test::anonymous |
 | lib.rs:2:1:2:16 | mod regular | test::regular |
 | regular.rs:1:1:2:18 | struct Struct | test::regular::Struct |
-| regular.rs:2:12:2:17 | fn eq | <test::regular::Struct as core::cmp::PartialEq>::eq |
-| regular.rs:2:12:2:17 | impl ...::Eq for Struct::<...> { ... } | <test::regular::Struct as core::cmp::Eq> |
-| regular.rs:2:12:2:17 | impl ...::PartialEq for Struct::<...> { ... } | <test::regular::Struct as core::cmp::PartialEq> |


It looks like derive macros are no longer expanded; getDeriveMacroExpansion does not have any results on this test case.

hvitved · 2026-06-02T08:49:42Z

@@ -15855,3 +15847,18 @@ inferType
 | regressions.rs:179:24:179:27 | S(...) | T | {EXTERNAL LOCATION} | i32 |
 | regressions.rs:179:26:179:26 | 1 |  | {EXTERNAL LOCATION} | i32 |
 testFailures
+| main.rs:1308:44:1308:62 | //... | Missing result: target=default |


I believe this is because derive macros are not properly expanded; should definitely be fixed before merging.

…uery.

…-to-rust-analyzer-0.0.328

redsun82 · 2026-06-10T10:10:05Z

I dug a bit more into this, and I think the missing derive expansions are actually expected with this rust-analyzer version (although it is a bit unfortunate for our current extraction model).

The relevant bit seems to be the new built-in derive fast path. In ra_ap_hir_def::builtin_derive rust-analyzer explicitly says that built-in derives are not really expanded anymore, to save time and memory. Instead, nameres/collector.rs records a BuiltinDeriveImplId, and hir-ty then teaches trait solving and method resolution about those synthetic impls directly.

That also explains the exact shape of the diff here: custom proc-macro derives still go through a real MacroCallId, so MyTrait is still emitted. But built-ins like Debug, PartialEq, and Eq become Either::Right(BuiltinDeriveImplId), and Semantics::expand_derive_macro only keeps the Either::Left(MacroCallId) case.

There is semantic information available for these impls through hir::Impl (trait_, trait_ref, self_ty, items, etc.), but there is no ast::Impl source for them (HasSource::source returns None, and source_with_range only points back to the derive range). For our current type_item_derive_macro_expansions relation, I guess the options are either:

accept this expectation change for built-in derives, and make sure the QL library works with that (@hvitved, any insight on what would it take?) or
ask rust-analyzer for a supported API to expose the synthetic built-in derive syntax again,
ship this as is now, track 1. or 2. as follow ups.

Trying to recreate the old AST expansion in the extractor looks possible in theory, but pretty risky in practice, since we would be duplicating rust-analyzer's built-in derive expansion/token-tree setup and could easily drift from it.

cc @geoffw0

hvitved · 2026-06-10T11:14:17Z

I dug a bit more into this, and I think the missing derive expansions are actually expected with this rust-analyzer version (although it is a bit unfortunate for our current extraction model).

Thanks for investigating, Paolo.

We don't really need the bodies of the derived impl blocks, we only need the signatures; is there any hope we could perhaps still get that?

redsun82 · 2026-06-10T13:55:20Z

@hvitved: derive impls always have the signature from the trait definition. We should see if we can have a fallback to that in QL, and failing that in the extractor. As there's no overloading, a simple name search in the trait should do, so I have the feeling a simple QL fallback (impl has no signature -> get signature from implemented trait looking up the method by name). Wdyt?

hvitved · 2026-06-10T17:38:27Z

@hvitved: derive impls always have the signature from the trait definition. We should see if we can have a fallback to that in QL, and failing that in the extractor. As there's no overloading, a simple name search in the trait should do, so I have the feeling a simple QL fallback (impl has no signature -> get signature from implemented trait looking up the method by name). Wdyt?

While we can certainly do it in QL, it would complicate things quite a lot; so far we have relied on everything being AstNodes, but we would then have to synthesize nodes on top.

redsun82 · 2026-06-10T21:43:32Z

hmm, two options then I think:

we add synth nodes in the codegen layer (so in QL, but generated)
we synthesize thse in the extractor, a bit like we synthesize library stubs for dependencies already

I'll mull this over

tausbn and others added 6 commits April 15, 2026 12:54

Cargo: upgrade dependencies

ab75d99

Bazel: regenerate vendored cargo dependencies

1234471

Rust: update rust-analyzer source and run codegen

5f76c94

Rust: adapt extractor to rust-analyzer 0.0.328 API changes

ce360c4

Rust: update toolchain to 1.91 and apply lint fixes

35fc6fb

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions Bot added Ruby Rust Pull requests that update Rust code labels Apr 15, 2026

tausbn changed the title ~~Rust: Upgrade to rusts-analyzer 0.328~~ Rust: Upgrade to rust-analyzer 0.328 Apr 15, 2026

github-advanced-security AI found potential problems Apr 15, 2026

View reviewed changes

tausbn and others added 5 commits April 15, 2026 15:12

Rust: fix formatting and codegen drift

8747228

Re-run cargo fmt after clippy --fix to ensure consistent formatting. Re-run codegen to update generated file tracking for MetaImpl.qll. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: fix upgrade script and update test expectations

6057c79

- Remove format_args_arg_names from upgrade delete list (table exists in both schemas with different columns) - Accept updated .expected files for schema changes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: fix downgrade script (same format_args_arg_names issue)

1bd0821

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tausbn force-pushed the tausbn/rust-upgrade-to-rust-analyzer-0.0.328 branch from c990d17 to ac27c20 Compare April 16, 2026 14:15

tausbn and others added 2 commits April 16, 2026 20:31

Rust: fix downgrade script - add missing block_expr_try_block_modifiers

f66f82c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge origin/main into rust analyzer upgrade

60bffd0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-advanced-security AI found potential problems May 22, 2026

View reviewed changes

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Comment thread rust/ql/lib/codeql/rust/elements.qll Dismissed

Rust: accept test changes

a2ecf65

redsun82 marked this pull request as ready for review May 22, 2026 15:35

Copilot AI review requested due to automatic review settings May 22, 2026 15:35

redsun82 requested review from a team as code owners May 22, 2026 15:35

Copilot AI reviewed May 22, 2026

redsun82 requested a review from geoffw0 May 22, 2026 15:58

geoffw0 reviewed May 22, 2026

View reviewed changes

hvitved mentioned this pull request May 26, 2026

CodeQL fails to detect rust/insecure-cookie in Rust code github/codeql-action#3915

Open

redsun82 and others added 5 commits May 26, 2026 15:06

Merge branch 'main' into tausbn/rust-upgrade-to-rust-analyzer-0.0.328

e87c034

Rust: Add full downgrade script for dbscheme migration

25ab2e0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: Filter downgraded comments on removed nodes

f4faf4c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: Drop locations for downgraded comments

b89d9ad

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rust: Format downgrade query

63d8bb7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

geoffw0 reviewed Jun 1, 2026

View reviewed changes

hvitved requested changes Jun 2, 2026

View reviewed changes

geoffw0 added 6 commits June 2, 2026 16:54

Rust: Undo hiding some warnings in the extraction consistency check q…

612b923

…uery.

Rust: Remove redundant brackets.

9024cba

Rust: More impacted test expectations.

db9d781

Rust: More impacted test expectations (2).

00d2976

Rust: Undo another change to the consistency check queries.

85b2fce

Merge remote-tracking branch 'upstream/main' into tausbn/rust-upgrade…

701cf10

…-to-rust-analyzer-0.0.328

Conversation

tausbn commented Apr 15, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

geoffw0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

redsun82 commented May 27, 2026 • edited by codeql-ci Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geoffw0 left a comment

Choose a reason for hiding this comment

Uh oh!

geoffw0 Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

hvitved Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

geoffw0 Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geoffw0 Jun 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

hvitved Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

hvitved Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

redsun82 commented Jun 10, 2026

Uh oh!

hvitved commented Jun 10, 2026

Uh oh!

redsun82 commented Jun 10, 2026

Uh oh!

hvitved commented Jun 10, 2026

Uh oh!

redsun82 commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

redsun82 commented May 27, 2026 •

edited by codeql-ci

Loading

geoffw0 Jun 1, 2026 •

edited

Loading