C# 14: Implicit span conversions.

[michaelnebel]

In this PR we introduce support for implicit span conversions. The feature is documented here.
That is, C# now supports implicit conversions like (and more). Some of these were previously supported by implicit operators, but now they are an integrated part of the language.

string[] arr;
Span<string> span = arr;
ReadOnlySpan<string> rospan = arr; 

There is out-of-the-box extractor support for this.

DCA looks good. Even though the content of the PR might affect some queries (like cs/useless-upcast) it doesn't look like there are any changes to results.

[Copilot]

Pull request overview

This PR adds support for implicit span conversions in C# 14, allowing automatic conversions between arrays, Span<T>, and ReadOnlySpan<T> types. This language feature is now integrated into the CodeQL library to properly model these conversions during analysis.

Key changes:

• Implemented convSpan predicate to handle implicit span conversions including array-to-span, span-to-readonly-span, and string-to-readonly-span-of-char conversions
• Added covariance support for span conversions through new convCovariance helper predicate
• Added comprehensive test cases covering various span conversion scenarios

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
csharp/ql/lib/semmle/code/csharp/Conversion.qll	Core implementation of span conversion logic and covariance helper
csharp/ql/test/library-tests/conversion/span/Span.cs	Test cases demonstrating various span conversion scenarios
csharp/ql/test/library-tests/conversion/span/span.ql	Query to verify span conversions are correctly identified
csharp/ql/test/library-tests/conversion/span/span.expected	Expected output for span conversion test cases
csharp/ql/lib/change-notes/2025-12-18-implicit-span-conversions.md	Release note documenting the new feature

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The SimpleArrayType class lacks documentation explaining what distinguishes it from other array types. Add a docstring clarifying that this represents single-dimensional, zero-based arrays (SZ arrays), as getRank() = 1 and getDimension() = 1 restricts it to this specific array form.

[Copilot]

The convCovariance predicate lacks documentation explaining its purpose and relationship to convVariance. Add a docstring clarifying that this predicate specifically checks for covariance conversions (where all type parameters must be covariant/out), distinguishing it from general variance conversions which may include contravariance.