Kotlin: add Kotlin 2.4.0 support by andersfugmann · Pull Request #21970 · github/codeql

andersfugmann · 2026-06-11T07:34:38Z

Add extractor support for Kotlin 2.4.0 and adjust the integration tests that depend on a pre-2.4 compiler.

Changes

Extractor support for 2.4.0. Adds the Kotlin 2.4.0 compiler-plugin variant (component registrar, IR compatibility shims, and version-specific utilities), bundles the 2.4.0 compiler dependencies, updates the build wiring (BUILD.bazel, versions.bzl, MODULE.bazel, dev/wrapper.py), refreshes the supported-versions documentation, and raises the "Kotlin version too new" diagnostic bound from 2.3.30 to 2.4.10.
Mark kotlin1 integration tests. Six integration tests pass -language-version 1.9, which Kotlin 2.4 no longer accepts. They are marked with @pytest.mark.kotlin1 so CI can run them on a pinned pre-2.4 compiler.

Notes

This PR does not change query results: the only expected-file change is the version bound in the kotlin-version-too-new diagnostic.
The known K2 mixed Java/Kotlin extractor differences (which become visible once -language-version 1.9 is no longer available) are a needed follow-up investigation.

Copilot

Pull request overview

This pull request updates the Java/Kotlin extractor and its test infrastructure to support Kotlin 2.4.0, while dropping Kotlin 1.x support (minimum Kotlin version becomes 2.0.0) and updating baselines/docs accordingly.

Changes:

Add Kotlin 2.4.0 compiler/stdlib dependencies and extractor compatibility shims for Kotlin IR API changes in 2.4.0.
Switch Kotlin integration tests that previously used Kotlin 1.x language mode to use -language-version 2.0, and update expected outputs.
Update docs and change notes to reflect the new supported Kotlin version range and deprecation of Kotlin < 2.0.

Show a summary per file

File	Description
MODULE.bazel	Adds Bazel repos for Kotlin 2.4.0 compiler/embeddable/stdlib artifacts.
java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/DB-CHECK.expected	Updated test baseline output (dbcheck).
java/ql/test/query-tests/security/CWE-312/android/CleartextStorage/CleartextStorageSharedPrefsTest.expected	Updated test baseline output.
java/ql/test/library-tests/pathsanitizer/test.expected	Updated test baseline output.
java/ql/test/library-tests/pathsanitizer/DB-CHECK.expected	Updated test baseline output (dbcheck).
java/ql/lib/change-notes/2026-06-08-kotlin-drop-1x.md	Adds change note deprecating Kotlin < 2.0.
java/ql/lib/change-notes/2026-06-04-kotlin-2.4.0.md	Adds change note for Kotlin 2.4.0 support.
java/ql/integration-tests/kotlin/all-platforms/kotlin_java_lowering_wildcards/test.py	Moves test compilation to `-language-version 2.0`.
java/ql/integration-tests/kotlin/all-platforms/kotlin_java_lowering_wildcards/test.expected	Updates expected output for wildcard lowering changes.
java/ql/integration-tests/kotlin/all-platforms/kotlin_java_lowering_wildcards/DB-CHECK.expected	Updated test baseline output (dbcheck).
java/ql/integration-tests/kotlin/all-platforms/java-interface-redeclares-tostring/test.py	Moves test compilation to `-language-version 2.0`.
java/ql/integration-tests/kotlin/all-platforms/java-interface-redeclares-tostring/test.expected	Updates expected output for interface `toString` redeclare scenario.
java/ql/integration-tests/kotlin/all-platforms/file_classes/test.py	Moves test compilation to `-language-version 2.0`.
java/ql/integration-tests/kotlin/all-platforms/file_classes/classes.expected	Updates expected class extraction output.
java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin1/test.py	Moves test compilation to `-language-version 2.0`.
java/ql/integration-tests/kotlin/all-platforms/extractor_information_kotlin1/ExtractorInformation.expected	Updates expected extractor info (Uses Kotlin 2 flag).
java/ql/integration-tests/kotlin/all-platforms/external-property-overloads/test.py	Moves test compilation to `-language-version 2.0`.
java/ql/integration-tests/kotlin/all-platforms/external-property-overloads/test.expected	Updates expected external binary location formatting.
java/ql/integration-tests/kotlin/all-platforms/enhanced-nullability/test.py	Moves test compilation to `-language-version 2.0`.
java/ql/integration-tests/kotlin/all-platforms/enhanced-nullability/test.expected	Updates expected output for enhanced nullability extraction.
java/ql/integration-tests/kotlin/all-platforms/enhanced-nullability/DB-CHECK.expected	Updated test baseline output (dbcheck).
java/ql/integration-tests/kotlin/all-platforms/diagnostics/kotlin-version-too-new/diagnostics.expected	Updates max-supported-version diagnostic message.
java/kotlin-extractor/versions.bzl	Adds 2.4.0 to supported versions list; adjusts language-version mapping.
java/kotlin-extractor/src/main/resources/META-INF/services/org.jetbrains.kotlin.compiler.plugin.CompilerPluginRegistrar	Adds service registration for Kotlin 2.4+ compiler plugin registrar.
java/kotlin-extractor/src/main/kotlin/utils/versions/v_2_4_0/parameterIndexExcludingReceivers.kt	Adds Kotlin 2.4.0-specific parameter indexing logic (handles new receiver kinds).
java/kotlin-extractor/src/main/kotlin/utils/versions/v_2_4_0/Kotlin2ComponentRegistrar.kt	Introduces Kotlin 2.4.0 `CompilerPluginRegistrar`-based registration path.
java/kotlin-extractor/src/main/kotlin/utils/versions/v_2_4_0/IrCompat.kt	Adds Kotlin 2.4.0 IR compatibility accessors for removed APIs.
java/kotlin-extractor/src/main/kotlin/utils/versions/v_1_9_0-Beta/Kotlin2ComponentRegistrar.kt	Refactors older registrar to route through `doRegisterExtensions` and centralize extension registration.
java/kotlin-extractor/src/main/kotlin/utils/versions/v_1_8_0/Kotlin2ComponentRegistrar.kt	Refactors older registrar to route through `doRegisterExtensions`.
java/kotlin-extractor/src/main/kotlin/utils/versions/v_1_8_0/IrCompat.kt	Adds pre-2.4.0 IR compatibility wrappers matching the new shim API.
java/kotlin-extractor/src/main/kotlin/utils/TypeSubstitution.kt	Switches annotation handling to compatibility wrappers (`codeQlAddAnnotations` / `codeQlAnnotationFromSymbolOwner`).
java/kotlin-extractor/src/main/kotlin/utils/JvmNames.kt	Switches annotation argument access to compatibility wrappers.
java/kotlin-extractor/src/main/kotlin/TrapWriter.kt	Switches extension receiver access to compatibility wrapper.
java/kotlin-extractor/src/main/kotlin/MetaAnnotationSupport.kt	Switches IR annotation construction/mutation to compatibility wrappers.
java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt	Switches parameter/receiver access to compatibility wrappers.
java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt	Switches multiple IR access patterns to compatibility wrappers; updates related comment/docs.
java/kotlin-extractor/src/main/kotlin/KotlinExtractorComponentRegistrar.kt	Refactors registrar to use `doRegisterExtensions` and centralized extension registration.
java/kotlin-extractor/src/main/kotlin/comments/CommentExtractor.kt	Switches extension receiver detection to compatibility wrapper.
java/kotlin-extractor/dev/wrapper.py	Bumps default wrapper Kotlin version to 2.4.0.
java/kotlin-extractor/deps/kotlin-stdlib-2.4.0.jar	Adds Kotlin 2.4.0 stdlib (LFS pointer).
java/kotlin-extractor/deps/kotlin-compiler-embeddable-2.4.0.jar	Adds Kotlin 2.4.0 embeddable compiler (LFS pointer).
java/kotlin-extractor/deps/kotlin-compiler-2.4.0.jar	Adds Kotlin 2.4.0 compiler (LFS pointer).
java/kotlin-extractor/BUILD.bazel	Conditionally packages `CompilerPluginRegistrar` service file for Kotlin >= 2.4.0.
docs/codeql/reusables/supported-versions-compilers.rst	Updates documented supported Kotlin version range to 2.0.0–2.4.x.

Copilot's findings

Files reviewed: 44/44 changed files
Comments generated: 4

             *       this.dispatchReceiver = dispatchReceiver
-             *       this.extensionReceiver = extensionReceiver
+             *       this.codeQlExtensionReceiver = extensionReceiver
             *   }


Add the Kotlin 2.4.0 compiler plugin variant (component registrar, IR compatibility shims, and version-specific utilities), bundle the 2.4.0 compiler dependencies, and update the build wiring, supported version metadata and the too-new diagnostic bound. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Mark the integration tests that require a Kotlin 1.x language version with @pytest.mark.kotlin1 so CI can run them on a pinned pre-2.4 compiler (Kotlin 2.4 no longer accepts -language-version 1.9). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

jketema

Some comments and questions. Nothing major here.

jketema · 2026-06-18T08:48:57Z

+        // Register with LoadingOrder.LAST to ensure the extractor runs after other
+        // IR generation plugins (like kotlinx.serialization) have generated their code.


This comment is here, but not in the 1.8 version. Should we make this uniform?

IIRC, there were some changes on how the component was registered so we needed this for force that our plugin last. I agree it would make sense to see if we can make this more uniform.

The code looks identical to me between 1.8 and 1.9, or are there differences?

jketema · 2026-06-18T08:54:21Z

+    get() = parameters.firstOrNull { it.kind == org.jetbrains.kotlin.ir.declarations.IrParameterKind.ExtensionReceiver }
+
+// Helper: get the offset of value arguments in the arguments list
+// In 2.4.0, arguments[] includes dispatch/extension receivers before regular params


This comment about arguments[] is important, but seems a bit misplaced. Should probably be attached to the next three functions.

Feel free to update.

jketema · 2026-06-18T08:56:01Z

+// For IrCall/IrFunctionReference, look at symbol.owner (IrFunction) directly.
+// For IrPropertyReference, symbol.owner is IrProperty; use the getter's parameters instead.


I'm not able to related this to this implementation of this function. Is this supposed to be about the next function?

You are right. Its related to the lookup logic in extensionReceiverParameterIndex() , not the getter specifically.
Should we change it to:

// Re-add accessor for the extensionReceiver property removed in Kotlin 2.4.0.extensionReceiver property. val IrMemberAccessExpression<*>.codeQlExtensionReceiver: IrExpression? {

and

// Find the argument index corresponding to the extension receiver parameter. // Calls and function references expose an IrFunction owner directly; property // references need to look through their getter or setter. private fun IrMemberAccessExpression<*>.extensionReceiverParameterIndex(): Int? {

That would make sense to me. If you're changing this, it's probably best if you also address https://github.com/github/codeql/pull/21970/files#r3434446772

jketema · 2026-06-18T08:59:03Z

+private fun IrMemberAccessExpression<*>.extensionReceiverParameterIndex(): Int? {
+    // Direct function owner (IrCall, IrFunctionReference, etc.)
+    (symbol.owner as? IrFunction)?.codeQlExtensionReceiverParameter?.let {
+        return it.indexInParameters


This is me being naive about Kotlin: where is it coming from?

Kotlin automatically binds 'it' to ....codeQlExtensionReceiverParameter inside the let { ... } construct when evaluating the body when its not null.

We chould make it more explicit by changing it to

private fun IrMemberAccessExpression<*>.extensionReceiverParameterIndex(): Int? { // Direct function owner (IrCall, IrFunctionReference, etc.) (symbol.owner as? IrFunction)?.codeQlExtensionReceiverParameter?.let { extensionReceiverParameter -> return extensionReceiverParameter.indexInParameters }

to increase readability

I think it's fine as it is. I would only change it if it were uncommon Kotlin idiom, but I doubt that's the case.

jketema · 2026-06-18T09:04:32Z

+fun parameterIndexExcludingReceivers(vp: IrValueParameter): Int {
+    val offset =
+        (vp.parent as? IrFunction)?.let { f ->
+            f.parameters.count { it.kind == IrParameterKind.DispatchReceiver || it.kind == IrParameterKind.ExtensionReceiver || it.kind == IrParameterKind.Context }
+        } ?: 0
+    return vp.indexInParameters - offset
+}


Is there a reason this is not in IrCompat.kt?

Not particular reason. I'd have to ask the LLM.

Looking futher, I think it could very well be rolled into IrCompat.kt to reduce number of files.

jketema · 2026-06-18T09:06:54Z

@@ -1,5 +1,5 @@
 {
-  "markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 2.3.30.",
+  "markdownMessage": "The Kotlin version installed (`999.999.999`) is too recent for this version of CodeQL. Install a version lower than 2.4.10.",


There's probably a better place to comment on this, but given what I read here about Kotlin release numbering, would it make sense to just allow anything below 2.5.0?

I don't have an opinion on that tbh. It's following the existing pattern that has been used for previous kotlin updates.

That's fine. I'm just wondering out loud here, and this is not something we necessarily need to address here.

jketema

We generally do not leave empty lines between imports in integration tests.

jketema · 2026-06-18T12:27:38Z

 import pathlib

+import pytest


Suggested change

import pathlib

import pytest

import pathlib

import pytest

jketema · 2026-06-18T12:27:50Z

 import commands

+import pytest


Suggested change

import commands

import pytest

import commands

import pytest

jketema · 2026-06-18T12:28:03Z

 import commands

+import pytest


Suggested change

import commands

import pytest

import commands

import pytest

jketema · 2026-06-18T12:28:13Z

 import commands

+import pytest


Suggested change

import commands

import pytest

import commands

import pytest

jketema · 2026-06-18T12:28:22Z

 import commands

+import pytest


Suggested change

import commands

import pytest

import commands

import pytest

Copilot AI review requested due to automatic review settings June 11, 2026 07:34

andersfugmann requested review from a team as code owners June 11, 2026 07:34

Copilot started reviewing on behalf of andersfugmann June 11, 2026 07:34 View session

github-actions Bot added documentation Java Kotlin labels Jun 11, 2026

Copilot AI reviewed Jun 11, 2026

View reviewed changes

andersfugmann force-pushed the andersfugmann/kotlin-2.4-v2 branch 2 times, most recently from 30b0a30 to 547c78f Compare June 12, 2026 09:53

andersfugmann marked this pull request as draft June 12, 2026 14:09

hfhbd mentioned this pull request Jun 13, 2026

Support Kotlin 2.4.0 #21938

Open

andersfugmann and others added 2 commits June 16, 2026 16:24

andersfugmann force-pushed the andersfugmann/kotlin-2.4-v2 branch from 79437b8 to 1b785a8 Compare June 16, 2026 14:25

andersfugmann changed the title ~~Kotlin support 2.4.0 and drop 1.x test mode~~ Kotlin: add Kotlin 2.4.0 support Jun 17, 2026

andersfugmann marked this pull request as ready for review June 17, 2026 08:16

jketema reviewed Jun 18, 2026

View reviewed changes

github deleted a comment from jketema Jun 18, 2026

andersfugmann commented Jun 18, 2026

View reviewed changes

Comment thread java/kotlin-extractor/BUILD.bazel

jketema reviewed Jun 18, 2026

View reviewed changes

		// Register with LoadingOrder.LAST to ensure the extractor runs after other
		// IR generation plugins (like kotlinx.serialization) have generated their code.

		// For IrCall/IrFunctionReference, look at symbol.owner (IrFunction) directly.
		// For IrPropertyReference, symbol.owner is IrProperty; use the getter's parameters instead.

Conversation

andersfugmann commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jketema left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andersfugmann Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jketema left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andersfugmann commented Jun 11, 2026 •

edited

Loading

andersfugmann Jun 18, 2026 •

edited

Loading