update-codeql-query-dataflow-java

Migrate Java/Kotlin CodeQL dataflow queries from v1 to v2 API.

30|3|Updated Feb 4, 2026

Search Tags:#java #kotlin #modularization #migrate #codeql #tests #dataflow

Ready to run

npx skills add https://github.com/advanced-security/codeql-development-mcp-server --skill update-codeql-query-dataflow-java

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: update-codeql-query-dataflow-java
Source: https://github.com/advanced-security/codeql-development-mcp-server/tree/main/.github/skills/update-codeql-query-dataflow-java
Command: npx skills add https://github.com/advanced-security/codeql-development-mcp-server --skill update-codeql-query-dataflow-java

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Java and Kotlin CodeQL queries often rely on the legacy v1 dataflow API, which makes maintenance and modernization difficult. This skill provides a clear migration path to the modern v2 API using DataFlow::ConfigSig modules while preserving query results.

Core Features & Use Cases

Convert v1 DataFlow::Configuration implementations to v2 DataFlow::ConfigSig modules.
Rename predicates: isSanitizer to isBarrier and isAdditionalTaintStep to isAdditionalFlowStep, with behavior preserved.
Replace cfg.hasFlow calls with module-based flow predicates (e.g., MyFlow::flow) and update path queries accordingly.
Enable a TDD-driven migration workflow: establish baselines, run migrations, verify exact result equivalence, and update query metadata.
Address Java/Kotlin-specific patterns (RemoteFlowSource, Spring/Servlet sources, lambdas, streams) during migration.

Quick Start

Perform a mechanical migration of a sample Java/Kotlin dataflow query from v1 to v2, convert configuration classes to modules, and run tests to verify equivalence with the original baseline.

Frequently Asked Questions about update-codeql-query-dataflow-java

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I migrate CodeQL dataflow queries from v1 to v2 for Java and Kotlin?▼

Migrate CodeQL dataflow queries by converting legacy DataFlow::Configuration classes to v2 DataFlow::ConfigSig modules. This involves renaming predicates like isSanitizer to isBarrier and replacing cfg.hasFlow with module-based flow predicates while preserving query results.

What is the difference between DataFlow::Configuration and DataFlow::ConfigSig in CodeQL?▼

DataFlow::Configuration is the legacy v1 API relying on class-based configurations, whereas DataFlow::ConfigSig is the modern v2 API using module-based structures. Migrating to ConfigSig enables better modularization and easier maintenance of Java and Kotlin dataflow patterns.

How do I replace isSanitizer and isAdditionalTaintStep predicates during CodeQL dataflow migration?▼

Replace isSanitizer with isBarrier and isAdditionalTaintStep with isAdditionalFlowStep when migrating to the v2 ConfigSig API. This predicate renaming preserves the original dataflow behavior while aligning with the modern CodeQL module structure.

Can I use a TDD workflow to verify CodeQL dataflow v1 to v2 migration results?▼

Yes, you can establish baseline test results from v1 queries, perform the mechanical migration to v2 ConfigSig modules, and run tests to verify exact result equivalence. This TDD-driven approach ensures the migration preserves the original dataflow analysis outcomes.

Does CodeQL dataflow v2 migration support Java and Kotlin specific patterns like lambdas and Spring sources?▼

Yes, the v2 migration addresses Java and Kotlin-specific patterns including RemoteFlowSource, Spring and Servlet sources, lambdas, and streams. Converting legacy configurations to ConfigSig modules ensures these framework-specific sources integrate correctly into the modernized dataflow analysis.

Why do my CodeQL path queries break after migrating from cfg.hasFlow to module-based flow predicates?▼

Path queries break because v2 migration replaces cfg.hasFlow calls with module-based flow predicates like MyFlow::flow. You must update path queries to reference the new module predicates directly, ensuring the dataflow configuration transitions correctly without losing query results.