Description of the false positive
CodeQL seems to produce false positives for Rust variables in format strings.
Code samples or links to source code
On 2026-08-13, the folllowing Rust snippet got flagged by CodeQL on alltheplaces/osm-diffs#660. CodeQL posted a notice, claiming Variable 'name' is not used. However, the variable does get used in this snippet, via a format! macro. We also check for unused variables with clippy, which does not flag an unused variable for this code. So, this looks like a false positive from CodeQL.
let producers: Vec<_> = sources
.into_iter()
.map(|(name, reader)| {
let tx = tx.clone();
s.spawn(move || -> Result<()> {
for record in reader.iter()? {
let bytes = record?;
let fti = FeatureToIndex::decode(bytes.as_slice()).with_context(|| {
format!("failed to decode a FeatureToIndex record from {name}")
})?;
tx.send(fti)?;
progress_bar.inc(1);
}
Ok(())
})
})
.collect();
URL to the alert on GitHub code scanning (optional)
https://github.com/alltheplaces/osm-diffs/security/code-scanning/30
Reactions are currently unavailable
Description of the false positive
CodeQL seems to produce false positives for Rust variables in format strings.
Code samples or links to source code
On 2026-08-13, the folllowing Rust snippet got flagged by CodeQL on alltheplaces/osm-diffs#660. CodeQL posted a notice, claiming Variable 'name' is not used. However, the variable does get used in this snippet, via a format! macro. We also check for unused variables with clippy, which does not flag an unused variable for this code. So, this looks like a false positive from CodeQL.
URL to the alert on GitHub code scanning (optional)
https://github.com/alltheplaces/osm-diffs/security/code-scanning/30