[K9VULN-14294] Update to tree-sitter 0.25.8#909
Merged
Conversation
This comment has been minimized.
This comment has been minimized.
jasonforal
force-pushed
the
jf/K9VULN-14294
branch
from
May 11, 2026 13:31
d350438 to
caddf06
Compare
jasonforal
marked this pull request as ready for review
May 11, 2026 13:52
Contributor
There was a problem hiding this comment.
Pull request overview
This PR upgrades the Rust tree-sitter dependency to 0.25.8 and adapts the static analysis kernel to the updated query cursor API (notably replacing the removed timeout_micros with the new callback-based cancellation mechanism).
Changes:
- Bump
tree-sitterto=0.25.8and update lockfile accordingly. - Rework
TSQueryCursor::matchesto useQueryCursorOptionsprogress callbacks for timeouts and return collected matches. - Remove direct
streaming-iteratorusage/dependency in favor oftree_sitter::StreamingIterator, and adjust affected queries/tests.
Reviewed changes
Copilot reviewed 13 out of 14 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| LICENSE-3rdparty.csv | Removes the direct streaming-iterator entry after dependency cleanup. |
| crates/static-analysis-kernel/src/analysis/tree_sitter.rs | Re-implements query timeouts via progress callbacks; changes matches to return Vec; adds a timeout unit test. |
| crates/static-analysis-kernel/src/analysis/languages/python/imports.rs | Switches StreamingIterator import to tree_sitter re-export. |
| crates/static-analysis-kernel/src/analysis/languages/javascript/imports.rs | Adjusts JS imports query patterns for updated tree-sitter behavior and switches StreamingIterator import. |
| crates/static-analysis-kernel/src/analysis/languages/java/imports.rs | Switches StreamingIterator import to tree_sitter re-export. |
| crates/static-analysis-kernel/src/analysis/languages/go/imports.rs | Switches StreamingIterator import to tree_sitter re-export. |
| crates/static-analysis-kernel/src/analysis/languages/csharp/using_directives.rs | Switches StreamingIterator import to tree_sitter re-export. |
| crates/static-analysis-kernel/src/analysis/ddsa_lib/runtime.rs | Updates call sites for TSQueryCursor::matches returning Vec (retain vs iterator filter). |
| crates/static-analysis-kernel/src/analysis/ddsa_lib/js/ts_node.rs | Switches StreamingIterator import to tree_sitter re-export (tests). |
| crates/static-analysis-kernel/src/analysis/ddsa_lib/context/file_tf.rs | Switches StreamingIterator import to tree_sitter re-export. |
| crates/static-analysis-kernel/src/analysis/ddsa_lib/bridge/query_match.rs | Updates call sites for matches returning Vec (tests). |
| crates/static-analysis-kernel/Cargo.toml | Removes direct streaming-iterator dependency. |
| Cargo.toml | Pins tree-sitter to =0.25.8. |
| Cargo.lock | Updates dependency graph for tree-sitter 0.25.8 and related transitive changes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Migrate `QueryCursor::set_timeout_micros` (removed in 0.25) to the new progress-callback-based cancellation via `matches_with_options` + `QueryCursorOptions::progress_callback`. `TSQueryCursor::matches` now returns `Vec<QueryMatch<...>>` so the closure's lifetime is bounded by the function body. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
The alternation arm `name: ((_) "as")` asserted that `"as"` is a child
of the `name:` field's content; in the tree-sitter-javascript grammar
it's a sibling of the field, so the arm never matched cleanly. The
upgrade to tree-sitter 0.25.0 stopped tolerating it and dropped the
match entirely.
Split the alternation into two top-level patterns: one for bare
`import { x }` (anchored, name is the only child) and one for
`import { x as y }` (anchored, name field followed by an `"as"` sibling).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
jasonforal
force-pushed
the
jf/K9VULN-14294
branch
from
May 11, 2026 14:05
caddf06 to
413180b
Compare
bahar-shah
approved these changes
May 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem are you trying to solve?
We're using tree-sitter 0.24.7 (from January 2025). The latest version is 0.26.8 (March 2026), and it contains numerous bug fixes.
What is your solution?
Update to tree-sitter 0.25.8
timeout_microsfrom theQueryCursorAPI. This PR thus re-implements the same functionality using the new callback-based cancellation API.Why not 0.26.8?
There was a non-trivial behavior change from 0.25.8 to 0.25.9 due to a bug in the query engine that was fixed with tree-sitter/tree-sitter#4532. A good amount of our default rules are currently affected by this, and so going from 0.25.8 -> 0.25.9 introduces a regression in true positives/true negatives. It'll require its own migration.
CI Failure
The "check_regressions (golang, go)" CI failure is expected. 0.25.0 fixes a false negative present in 0.24.7 with the go-best-practices/superfluous-else rule. This is due to a bug in how 0.24.7 dealt with alternations and anchors, which was fixed by tree-sitter/tree-sitter#4067. This didn't cause any real regressions (i.e. no false positives or false negatives) within our default rulesets, though it is important to note it might affect a custom rule. I'll add a disclaimer in the release notes.
Notes