[aschackmull]

A recent performance improvement in data flow (#22392) accidentally introduced an upper bound of the supported access path limit values in configurations equal to the language default access path limit.

While the performance improvement necessitates an up-front configuration-independent upper bound, we might as well bump that a bit, so configurations can opt to increase the limit if so desired.

See also the reported issues #23041 and #23042.

[Copilot]

🟡 Changes recommended

The existing default-limit test does not cover the restored above-default behavior or configuration-specific boundaries, including lower-limit and new-cap cases.

1 open issue

• Add tests for configurable access-path limit boundaries · New

What changed in this PR

This PR addresses the above-default access-path limit regression introduced by #22392, allowing custom data-flow configurations to track longer paths while retaining a configuration-independent upper bound.

Changes:

• Raises the cached access-path length cap to the greater of 10 or twice the language default.
• Uses the configured limit in forward and reverse access-path length checks.

File	Description
shared/​dataflow/​codeql/​dataflow/​internal/​DataFlowImplCommon.qll	Expands exact and approximate access-path front domains using the new cap.
shared/​dataflow/​codeql/​dataflow/​internal/​DataFlowImpl.qll	Applies configuration-specific limits to forward and reverse flow checks.

_{Review effort: Balanced (auto)}