Rust: query evaluation ~15× slower on 2.26.4 vs 2.26.3 (4 min → 45–60 min, type-inference/data-flow stage)

[tanmaysolanki95]

Description of the issue

After the CodeQL bundle moved from 2.26.3 to 2.26.4, Rust analysis of our workspace went from ~4 minutes to ~45–60 minutes per run, with no change on our side. The extra time is almost entirely in query evaluation — the type-inference / data-flow stage — not extraction.

Setup

• GitHub code scanning default setup (so the bundle version is whatever the action ships; codeql-action v4.37.9 bumped the default bundle to 2.26.4 on 2026-08-26).
• build-mode: none, ubuntu-latest hosted runner (2 vCPU, CODEQL_THREADS=2, CODEQL_RAM=6914).
• Private Rust workspace: 15 crates, ~470k lines of Rust (roughly a third of that under tests/), ~720 packages in Cargo.lock, edition 2021. Standard async web-service stack — nothing exotic in the code.
• The default query suite (36 queries).

What changed / what didn't

We compared the last run on 2.26.3 and the first run on 2.26.4:

• Same github/codeql-action commit, same runner image.
• Same commit of our code (identical merge base; no diff at all in Cargo.toml / Cargo.lock).
• ~150 consecutive runs on 2.26.3 over the preceding four weeks: all 2–4 min. 50+ consecutive runs on 2.26.4 since: all 41–59 min. No overlap.

Timings from the job logs

Stage	2.26.3	2.26.4
total duration (Extract)	12.8 s	59 s
diagnostics/DataFlowConsistencyCounts	2m01s (slowest query)	~30 min
diagnostics/TypeInferenceConsistencyCounts	58 s	~17 min
diagnostics/SsaConsistencyCounts	50 s	~13 min
summary/NodesWithTypeAtLengthLimit	< 1 s	~22 min
diagnostics/UnresolvedMacroCalls	—	6m11s
whole security/* data-flow batch (CWE-089/SqlInjection, CWE-312/CleartextLogging, CWE-319/UseOfHttp, CWE-327/BrokenCryptoAlgorithm, …)	well under a minute each	~30 min each (shared batch)

So extraction got ~5× slower but is still small; evaluation of everything downstream of type inference got roughly 15–30× slower.

Suspected cause

Looking at the Rust changes between codeql-cli/v2.26.3 and codeql-cli/v2.26.4, the ones that touch the stage that regressed are:

• 52cbb679 "Rust: Evaluate mayInvokeCallback in type inference stage"
• e9bd6988 "Rust: Assume callbacks will be invoked in library functions"
• the rust-analyzer upgrade to 0.0.328 (ce360c4f, 5f76c946) and the derive-macro expansion restore (1d6ac57d).

The first two look like they widen the call graph feeding type inference, which is consistent with every data-flow query slowing down together. Happy to be corrected — that's inferred from the commit list, not from profiling.

One other difference we noticed in the extractor output on 2.26.4: a handful of new macro expansion failed for '$crate::count' warnings on the metrics crate's counter!-style macros that did not appear on 2.26.3. Possibly unrelated, mentioning it in case it points at the rust-analyzer upgrade.

What would help

• Is this a known regression in 2.26.4, and is there a tuning knob (e.g. an extractor option, or a way to cap the callback assumption) short of pinning the bundle?
• If profiling output from a run would help, tell me what to collect (--evaluator-log / --tuple-counting etc.) and I'll attach it.

We can pin codeql-bundle-v2.26.3 via advanced setup in the meantime.