Release preparation for version 2.12.1

java/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.5.1
+
+### Minor Analysis Improvements
+
+* Added sink models for the constructors of `org.springframework.jdbc.object.MappingSqlQuery` and `org.springframework.jdbc.object.MappingSqlQueryWithParameters`.
+* Added more dataflow models for frequently-used JDK APIs.
+* Removed summary model for `java.lang.String#endsWith(String)` and added neutral model for this API.
+* Added additional taint step for `java.lang.String#endsWith(String)` to `ConditionalBypassFlowConfig`.
+* Added `AllowContentAccessMethod` to represent the `setAllowContentAccess` method of the `android.webkit.WebSettings` class.
+* Added an external flow source for the parameters of methods annotated with `android.webkit.JavascriptInterface`.
+
 ## 0.5.0
 
 ### Minor Analysis Improvements

java/ql/lib/change-notes/2022-01-13-android-javascriptinterface-parameters-remote-sources.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added an external flow source for the parameters of methods annotated with `android.webkit.JavascriptInterface`.

java/ql/lib/change-notes/2022-12-21-allowcontentaccessmethod.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added `AllowContentAccessMethod` to represent the `setAllowContentAccess` method of the `android.webkit.WebSettings` class.

java/ql/lib/change-notes/2023-01-03-add-more-top-jdk-models.md

@@ -1,6 +0,0 @@
----
-category: minorAnalysis
----
-* Added more dataflow models for frequently-used JDK APIs.
-* Removed summary model for `java.lang.String#endsWith(String)` and added neutral model for this API.
-* Added additional taint step for `java.lang.String#endsWith(String)` to `ConditionalBypassFlowConfig`.

java/ql/lib/change-notes/2023-01-05-fix-mad-typos.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added sink models for the constructors of `org.springframework.jdbc.object.MappingSqlQuery` and `org.springframework.jdbc.object.MappingSqlQueryWithParameters`.

java/ql/lib/change-notes/released/0.5.1.md

@@ -0,0 +1,10 @@
+## 0.5.1
+
+### Minor Analysis Improvements
+
+* Added sink models for the constructors of `org.springframework.jdbc.object.MappingSqlQuery` and `org.springframework.jdbc.object.MappingSqlQueryWithParameters`.
+* Added more dataflow models for frequently-used JDK APIs.
+* Removed summary model for `java.lang.String#endsWith(String)` and added neutral model for this API.
+* Added additional taint step for `java.lang.String#endsWith(String)` to `ConditionalBypassFlowConfig`.
+* Added `AllowContentAccessMethod` to represent the `setAllowContentAccess` method of the `android.webkit.WebSettings` class.
+* Added an external flow source for the parameters of methods annotated with `android.webkit.JavascriptInterface`.

java/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.5.1

java/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 0.5.1-dev
+version: 0.5.1
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

java/ql/src/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.5.1
+
+### New Queries
+
+* Added a new query `java/android/websettings-allow-content-access` to detect Android WebViews which do not disable access to `content://` urls.
+
+### Minor Analysis Improvements
+
+* The name, description and alert message for the query `java/concatenated-sql-query` have been altered to emphasise that the query flags the use of string concatenation to construct SQL queries, not the lack of appropriate escaping. The query's files have been renamed from `SqlUnescaped.ql` and `SqlUnescapedLib.qll` to `SqlConcatenated.ql` and `SqlConcatenatedLib.qll` respectively; in the unlikely event your custom configuration or queries refer to either of these files by name, those references will need to be adjusted. The query id remains `java/concatenated-sql-query`, so alerts should not be re-raised as a result of this change.
+
 ## 0.5.0
 
 ### New Queries

java/ql/src/change-notes/2022-12-21-android-allowcontentaccess-query.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query `java/android/websettings-allow-content-access` to detect Android WebViews which do not disable access to `content://` urls.

java/ql/src/change-notes/released/0.5.1.md

@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 0.5.1
+
+### New Queries
+
+* Added a new query `java/android/websettings-allow-content-access` to detect Android WebViews which do not disable access to `content://` urls.
+
+### Minor Analysis Improvements
+
 * The name, description and alert message for the query `java/concatenated-sql-query` have been altered to emphasise that the query flags the use of string concatenation to construct SQL queries, not the lack of appropriate escaping. The query's files have been renamed from `SqlUnescaped.ql` and `SqlUnescapedLib.qll` to `SqlConcatenated.ql` and `SqlConcatenatedLib.qll` respectively; in the unlikely event your custom configuration or queries refer to either of these files by name, those references will need to be adjusted. The query id remains `java/concatenated-sql-query`, so alerts should not be re-raised as a result of this change.

java/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.5.1

java/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 0.5.1-dev
+version: 0.5.1
 groups: 
   - java
   - queries