Release preparation for version 2.25.3

This commit is contained in:
github-actions[bot]
2026-04-27 10:01:23 +00:00
parent 6787beb8e7
commit 019ec0caf7
174 changed files with 437 additions and 151 deletions

View File

@@ -1,3 +1,9 @@
## 0.4.34
### Minor Analysis Improvements
* Removed false positive injection sink models for the `context` input of `docker/build-push-action` and the `allowed-endpoints` input of `step-security/harden-runner`.
## 0.4.33
No user-facing changes.

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
## 0.4.34
### Minor Analysis Improvements
* Removed false positive injection sink models for the `context` input of `docker/build-push-action` and the `allowed-endpoints` input of `step-security/harden-runner`.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.4.33
lastReleaseVersion: 0.4.34

View File

@@ -1,5 +1,5 @@
name: codeql/actions-all
version: 0.4.34-dev
version: 0.4.34
library: true
warnOnImplicitThis: true
dependencies:

View File

@@ -1,3 +1,13 @@
## 0.6.26
### Major Analysis Improvements
* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also clarify the wording to make it clear that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed. Also change the alert location to be the source, to align more with other queries reporting an artifact (e.g. zipslip) which is more useful.
### Minor Analysis Improvements
* The query `actions/missing-workflow-permissions` no longer produces false positive results on reusable workflows where all callers set permissions.
## 0.6.25
No user-facing changes.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The query `actions/missing-workflow-permissions` no longer produces false positive results on reusable workflows where all callers set permissions.

View File

@@ -1,4 +1,9 @@
---
category: majorAnalysis
---
* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also clarify the wording to make it clear that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed. Also change the alert location to be the source, to align more with other queries reporting an artifact (e.g. zipslip) which is more useful.
## 0.6.26
### Major Analysis Improvements
* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also clarify the wording to make it clear that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed. Also change the alert location to be the source, to align more with other queries reporting an artifact (e.g. zipslip) which is more useful.
### Minor Analysis Improvements
* The query `actions/missing-workflow-permissions` no longer produces false positive results on reusable workflows where all callers set permissions.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.6.25
lastReleaseVersion: 0.6.26

View File

@@ -1,5 +1,5 @@
name: codeql/actions-queries
version: 0.6.26-dev
version: 0.6.26
library: false
warnOnImplicitThis: true
groups: [actions, queries]

View File

@@ -1,3 +1,14 @@
## 10.0.0
### Breaking Changes
* The deprecated `NonThrowingFunction` class has been removed, use `NonCppThrowingFunction` instead.
* The deprecated `ThrowingFunction` class has been removed, use `AlwaysSehThrowingFunction` instead.
### New Features
* Added a subclass `AutoconfConfigureTestFile` of `ConfigurationTestFile` that represents files created by GNU autoconf configure scripts to test the build configuration.
## 9.0.0
### Breaking Changes

View File

@@ -1,4 +0,0 @@
---
category: feature
---
* Added a subclass `AutoconfConfigureTestFile` of `ConfigurationTestFile` that represents files created by GNU autoconf configure scripts to test the build configuration.

View File

@@ -1,5 +0,0 @@
---
category: breaking
---
* The deprecated `NonThrowingFunction` class has been removed, use `NonCppThrowingFunction` instead.
* The deprecated `ThrowingFunction` class has been removed, use `AlwaysSehThrowingFunction` instead.

View File

@@ -0,0 +1,10 @@
## 10.0.0
### Breaking Changes
* The deprecated `NonThrowingFunction` class has been removed, use `NonCppThrowingFunction` instead.
* The deprecated `ThrowingFunction` class has been removed, use `AlwaysSehThrowingFunction` instead.
### New Features
* Added a subclass `AutoconfConfigureTestFile` of `ConfigurationTestFile` that represents files created by GNU autoconf configure scripts to test the build configuration.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 9.0.0
lastReleaseVersion: 10.0.0

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 9.0.1-dev
version: 10.0.0
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp

View File

@@ -1,3 +1,15 @@
## 1.6.1
### Minor Analysis Improvements
* Added `AllocationFunction` models for `aligned_alloc`, `std::aligned_alloc`, and `bsl::aligned_alloc`.
* The "Comparison of narrow type with wide type in loop condition" (`cpp/comparison-with-wider-type`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been upgraded to `high` precision.
* The "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.
## 1.6.0
### Query Metadata Changes

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Comparison of narrow type with wide type in loop condition" (`cpp/comparison-with-wider-type`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been upgraded to `high` precision.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Added `AllocationFunction` models for `aligned_alloc`, `std::aligned_alloc`, and `bsl::aligned_alloc`.

View File

@@ -0,0 +1,11 @@
## 1.6.1
### Minor Analysis Improvements
* Added `AllocationFunction` models for `aligned_alloc`, `std::aligned_alloc`, and `bsl::aligned_alloc`.
* The "Comparison of narrow type with wide type in loop condition" (`cpp/comparison-with-wider-type`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been upgraded to `high` precision.
* The "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.6.0
lastReleaseVersion: 1.6.1

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.6.1-dev
version: 1.6.1
groups:
- cpp
- queries

View File

@@ -1,3 +1,7 @@
## 1.7.65
No user-facing changes.
## 1.7.64
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.65
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.64
lastReleaseVersion: 1.7.65

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
version: 1.7.65-dev
version: 1.7.65
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 1.7.65
No user-facing changes.
## 1.7.64
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.65
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.64
lastReleaseVersion: 1.7.65

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
version: 1.7.65-dev
version: 1.7.65
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,9 @@
## 5.5.0
### Deprecated APIs
* The predicates `get[L|R]Value` in the class `Assignment` have been deprecated. Use `get[Left|Right]Operand` instead.
## 5.4.12
### Minor Analysis Improvements

View File

@@ -1,4 +1,5 @@
---
category: deprecated
---
## 5.5.0
### Deprecated APIs
* The predicates `get[L|R]Value` in the class `Assignment` have been deprecated. Use `get[Left|Right]Operand` instead.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 5.4.12
lastReleaseVersion: 5.5.0

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-all
version: 5.4.13-dev
version: 5.5.0
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp

View File

@@ -1,3 +1,12 @@
## 1.7.1
### Minor Analysis Improvements
* The query `cs/useless-tostring-call` has been updated to avoid false
positive results in calls to `StringBuilder.AppendLine` and calls of
the form `base.ToString()`. Moreover, the alert message has been
made more precise.
## 1.7.0
### Query Metadata Changes

View File

@@ -1,6 +1,7 @@
---
category: minorAnalysis
---
## 1.7.1
### Minor Analysis Improvements
* The query `cs/useless-tostring-call` has been updated to avoid false
positive results in calls to `StringBuilder.AppendLine` and calls of
the form `base.ToString()`. Moreover, the alert message has been

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.0
lastReleaseVersion: 1.7.1

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-queries
version: 1.7.1-dev
version: 1.7.1
groups:
- csharp
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.48
No user-facing changes.
## 1.0.47
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.48
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.47
lastReleaseVersion: 1.0.48

View File

@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
version: 1.0.48-dev
version: 1.0.48
groups:
- go
- queries

View File

@@ -1,3 +1,7 @@
## 7.0.6
No user-facing changes.
## 7.0.5
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 7.0.6
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 7.0.5
lastReleaseVersion: 7.0.6

View File

@@ -1,5 +1,5 @@
name: codeql/go-all
version: 7.0.6-dev
version: 7.0.6
groups: go
dbscheme: go.dbscheme
extractor: go

View File

@@ -1,3 +1,7 @@
## 1.6.1
No user-facing changes.
## 1.6.0
### Query Metadata Changes

View File

@@ -0,0 +1,3 @@
## 1.6.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.6.0
lastReleaseVersion: 1.6.1

View File

@@ -1,5 +1,5 @@
name: codeql/go-queries
version: 1.6.1-dev
version: 1.6.1
groups:
- go
- queries

View File

@@ -1,3 +1,9 @@
## 9.0.4
### Minor Analysis Improvements
* The queries "Resolving XML external entity in user-controlled data" (`java/xxe`) and "Resolving XML external entity in user-controlled data from local source" (`java/xxe-local`) now recognize sinks in the Woodstox StAX library when `com.ctc.wstx.stax.WstxInputFactory` or `org.codehaus.stax2.XMLInputFactory2` are used directly.
## 9.0.3
### Minor Analysis Improvements

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
## 9.0.4
### Minor Analysis Improvements
* The queries "Resolving XML external entity in user-controlled data" (`java/xxe`) and "Resolving XML external entity in user-controlled data from local source" (`java/xxe-local`) now recognize sinks in the Woodstox StAX library when `com.ctc.wstx.stax.WstxInputFactory` or `org.codehaus.stax2.XMLInputFactory2` are used directly.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 9.0.3
lastReleaseVersion: 9.0.4

View File

@@ -1,5 +1,5 @@
name: codeql/java-all
version: 9.0.4-dev
version: 9.0.4
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java

View File

@@ -1,3 +1,7 @@
## 1.11.1
No user-facing changes.
## 1.11.0
### Query Metadata Changes

View File

@@ -0,0 +1,3 @@
## 1.11.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.11.0
lastReleaseVersion: 1.11.1

View File

@@ -1,5 +1,5 @@
name: codeql/java-queries
version: 1.11.1-dev
version: 1.11.1
groups:
- java
- queries

View File

@@ -1,3 +1,7 @@
## 2.6.28
No user-facing changes.
## 2.6.27
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 2.6.28
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.6.27
lastReleaseVersion: 2.6.28

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-all
version: 2.6.28-dev
version: 2.6.28
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript

View File

@@ -1,3 +1,10 @@
## 2.3.8
### Minor Analysis Improvements
* The query `js/missing-rate-limiting` now takes Fastify per-route
rate limiting into account.
## 2.3.7
No user-facing changes.

View File

@@ -1,5 +1,6 @@
---
category: minorAnalysis
---
## 2.3.8
### Minor Analysis Improvements
* The query `js/missing-rate-limiting` now takes Fastify per-route
rate limiting into account.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.3.7
lastReleaseVersion: 2.3.8

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-queries
version: 2.3.8-dev
version: 2.3.8
groups:
- javascript
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.48
No user-facing changes.
## 1.0.47
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.48
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.47
lastReleaseVersion: 1.0.48

View File

@@ -1,4 +1,4 @@
name: codeql/suite-helpers
version: 1.0.48-dev
version: 1.0.48
groups: shared
warnOnImplicitThis: true

View File

@@ -1,3 +1,9 @@
## 7.0.5
### Minor Analysis Improvements
- The Python extractor now supports the new `lazy import ...` and `lazy from ... import ...` (as defined in [PEP-810](https://peps.python.org/pep-0810/)) that will be part of Python 3.15.
## 7.0.4
### Bug Fixes

View File

@@ -1,5 +1,5 @@
---
category: minorAnalysis
---
## 7.0.5
### Minor Analysis Improvements
- The Python extractor now supports the new `lazy import ...` and `lazy from ... import ...` (as defined in [PEP-810](https://peps.python.org/pep-0810/)) that will be part of Python 3.15.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 7.0.4
lastReleaseVersion: 7.0.5

View File

@@ -1,5 +1,5 @@
name: codeql/python-all
version: 7.0.5-dev
version: 7.0.5
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python

View File

@@ -1,3 +1,9 @@
## 1.8.1
### Minor Analysis Improvements
- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognized as socket binding operations.
## 1.8.0
### Query Metadata Changes

View File

@@ -1,5 +1,5 @@
---
category: minorAnalysis
---
## 1.8.1
### Minor Analysis Improvements
- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognized as socket binding operations.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.8.0
lastReleaseVersion: 1.8.1

View File

@@ -1,5 +1,5 @@
name: codeql/python-queries
version: 1.8.1-dev
version: 1.8.1
groups:
- python
- queries

View File

@@ -1,3 +1,7 @@
## 5.1.16
No user-facing changes.
## 5.1.15
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 5.1.16
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 5.1.15
lastReleaseVersion: 5.1.16

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-all
version: 5.1.16-dev
version: 5.1.16
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme

View File

@@ -1,3 +1,7 @@
## 1.6.1
No user-facing changes.
## 1.6.0
### Query Metadata Changes

View File

@@ -0,0 +1,3 @@
## 1.6.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.6.0
lastReleaseVersion: 1.6.1

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-queries
version: 1.6.1-dev
version: 1.6.1
groups:
- ruby
- queries

View File

@@ -1,3 +1,7 @@
## 0.2.12
No user-facing changes.
## 0.2.11
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.2.12
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.2.11
lastReleaseVersion: 0.2.12

View File

@@ -1,5 +1,5 @@
name: codeql/rust-all
version: 0.2.12-dev
version: 0.2.12
groups: rust
extractor: rust
dbscheme: rust.dbscheme

View File

@@ -1,3 +1,7 @@
## 0.1.33
No user-facing changes.
## 0.1.32
### Query Metadata Changes

View File

@@ -0,0 +1,3 @@
## 0.1.33
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.1.32
lastReleaseVersion: 0.1.33

View File

@@ -1,5 +1,5 @@
name: codeql/rust-queries
version: 0.1.33-dev
version: 0.1.33
groups:
- rust
- queries

View File

@@ -1,3 +1,7 @@
## 0.0.22
No user-facing changes.
## 0.0.21
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.0.22
No user-facing changes.

Some files were not shown because too many files have changed in this diff Show More