mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
Merge pull request #20099 from github/nickrolfe/revert-2.22.2-prep
Revert post-release preparation for codeql-cli-2.22.2
This commit is contained in:
Nick Rolfe
@@ -1,7 +1,3 @@
|
||||
## 0.4.13
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.4.12
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 0.4.13
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 0.4.13
|
||||
lastReleaseVersion: 0.4.12
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/actions-all
|
||||
version: 0.4.14-dev
|
||||
version: 0.4.13-dev
|
||||
library: true
|
||||
warnOnImplicitThis: true
|
||||
dependencies:
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 0.6.5
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 0.6.4
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 0.6.5
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 0.6.5
|
||||
lastReleaseVersion: 0.6.4
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/actions-queries
|
||||
version: 0.6.6-dev
|
||||
version: 0.6.5-dev
|
||||
library: false
|
||||
warnOnImplicitThis: true
|
||||
groups: [actions, queries]
|
||||
|
||||
@@ -1,15 +1,3 @@
|
||||
## 5.3.0
|
||||
|
||||
### Deprecated APIs
|
||||
|
||||
* The `UnknownDefaultLocation`, `UnknownExprLocation`, and `UnknownStmtLocation` classes have been deprecated. Use `UnknownLocation` instead.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The analysis of C/C++ code targeting 64-bit Arm platforms has been improved. This includes support for the Arm-specific builtin functions, support for the `arm_neon.h` header and Neon vector types, and support for the `fp8` scalar type. The `arm_sve.h` header and scalable vectors are only partially supported at this point.
|
||||
* Added support for `__fp16 _Complex` and `__bf16 _Complex` types
|
||||
* Added `sql-injection` sink models for the Oracle Call Interface (OCI) database library functions `OCIStmtPrepare` and `OCIStmtPrepare2`.
|
||||
|
||||
## 5.2.0
|
||||
|
||||
### Deprecated APIs
|
||||
|
||||
4
cpp/ql/lib/change-notes/2025-06-20-oracle-oci-models.md
Normal file
4
cpp/ql/lib/change-notes/2025-06-20-oracle-oci-models.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added `sql-injection` sink models for the Oracle Call Interface (OCI) database library functions `OCIStmtPrepare` and `OCIStmtPrepare2`.
|
||||
4
cpp/ql/lib/change-notes/2025-06-24-arm64.md
Normal file
4
cpp/ql/lib/change-notes/2025-06-24-arm64.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The analysis of C/C++ code targeting 64-bit Arm platforms has been improved. This includes support for the Arm-specific builtin functions, support for the `arm_neon.h` header and Neon vector types, and support for the `fp8` scalar type. The `arm_sve.h` header and scalable vectors are only partially supported at this point.
|
||||
4
cpp/ql/lib/change-notes/2025-06-24-float16.md
Normal file
4
cpp/ql/lib/change-notes/2025-06-24-float16.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for `__fp16 _Complex` and `__bf16 _Complex` types
|
||||
4
cpp/ql/lib/change-notes/2025-06-27-locations.md
Normal file
4
cpp/ql/lib/change-notes/2025-06-27-locations.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: deprecated
|
||||
---
|
||||
* The `UnknownDefaultLocation`, `UnknownExprLocation`, and `UnknownStmtLocation` classes have been deprecated. Use `UnknownLocation` instead.
|
||||
@@ -1,11 +0,0 @@
|
||||
## 5.3.0
|
||||
|
||||
### Deprecated APIs
|
||||
|
||||
* The `UnknownDefaultLocation`, `UnknownExprLocation`, and `UnknownStmtLocation` classes have been deprecated. Use `UnknownLocation` instead.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* The analysis of C/C++ code targeting 64-bit Arm platforms has been improved. This includes support for the Arm-specific builtin functions, support for the `arm_neon.h` header and Neon vector types, and support for the `fp8` scalar type. The `arm_sve.h` header and scalable vectors are only partially supported at this point.
|
||||
* Added support for `__fp16 _Complex` and `__bf16 _Complex` types
|
||||
* Added `sql-injection` sink models for the Oracle Call Interface (OCI) database library functions `OCIStmtPrepare` and `OCIStmtPrepare2`.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 5.3.0
|
||||
lastReleaseVersion: 5.2.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/cpp-all
|
||||
version: 5.3.1-dev
|
||||
version: 5.2.1-dev
|
||||
groups: cpp
|
||||
dbscheme: semmlecode.cpp.dbscheme
|
||||
extractor: cpp
|
||||
|
||||
@@ -1,12 +1,3 @@
|
||||
## 1.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Added flow models for the Win32 API functions `CreateThread`, `CreateRemoteThread`, and `CreateRemoteThreadEx`.
|
||||
* Added flow models for the GNU C Library.
|
||||
* Fixed a number of false positives and false negatives in `cpp/global-use-before-init`. Note that this query is not part of any of the default query suites.
|
||||
* The query `cpp/sql-injection` now can be extended using the `sql-injection` Models as Data (MaD) sink kind.
|
||||
|
||||
## 1.4.3
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* The query `cpp/sql-injection` now can be extended using the `sql-injection` Models as Data (MaD) sink kind.
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Fixed a number of false positives and false negatives in `cpp/global-use-before-init`. Note that this query is not part of any of the default query suites.
|
||||
4
cpp/ql/src/change-notes/2025-07-04-create-thread.md
Normal file
4
cpp/ql/src/change-notes/2025-07-04-create-thread.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added flow models for the GNU C Library.
|
||||
4
cpp/ql/src/change-notes/2025-07-12-create-thread.md
Normal file
4
cpp/ql/src/change-notes/2025-07-12-create-thread.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added flow models for the Win32 API functions `CreateThread`, `CreateRemoteThread`, and `CreateRemoteThreadEx`.
|
||||
@@ -1,8 +0,0 @@
|
||||
## 1.4.4
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Added flow models for the Win32 API functions `CreateThread`, `CreateRemoteThread`, and `CreateRemoteThreadEx`.
|
||||
* Added flow models for the GNU C Library.
|
||||
* Fixed a number of false positives and false negatives in `cpp/global-use-before-init`. Note that this query is not part of any of the default query suites.
|
||||
* The query `cpp/sql-injection` now can be extended using the `sql-injection` Models as Data (MaD) sink kind.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.4.4
|
||||
lastReleaseVersion: 1.4.3
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/cpp-queries
|
||||
version: 1.4.5-dev
|
||||
version: 1.4.4-dev
|
||||
groups:
|
||||
- cpp
|
||||
- queries
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 1.7.44
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.7.43
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 1.7.44
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.7.44
|
||||
lastReleaseVersion: 1.7.43
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/csharp-solorigate-all
|
||||
version: 1.7.45-dev
|
||||
version: 1.7.44-dev
|
||||
groups:
|
||||
- csharp
|
||||
- solorigate
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 1.7.44
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.7.43
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 1.7.44
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.7.44
|
||||
lastReleaseVersion: 1.7.43
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/csharp-solorigate-queries
|
||||
version: 1.7.45-dev
|
||||
version: 1.7.44-dev
|
||||
groups:
|
||||
- csharp
|
||||
- solorigate
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 5.1.10
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 5.1.9
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 5.1.10
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 5.1.10
|
||||
lastReleaseVersion: 5.1.9
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/csharp-all
|
||||
version: 5.1.11-dev
|
||||
version: 5.1.10-dev
|
||||
groups: csharp
|
||||
dbscheme: semmlecode.csharp.dbscheme
|
||||
extractor: csharp
|
||||
|
||||
@@ -1,9 +1,3 @@
|
||||
## 1.3.1
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Added explicit SQL injection Models as Data models for `Microsoft.Data.SqlClient.SqlCommand` and `Microsoft.Data.SqlClient.SqlDataAdapter`. This reduces false negatives for the query `cs/sql-injection`.
|
||||
|
||||
## 1.3.0
|
||||
|
||||
### Query Metadata Changes
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
## 1.3.1
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added explicit SQL injection Models as Data models for `Microsoft.Data.SqlClient.SqlCommand` and `Microsoft.Data.SqlClient.SqlDataAdapter`. This reduces false negatives for the query `cs/sql-injection`.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.3.1
|
||||
lastReleaseVersion: 1.3.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/csharp-queries
|
||||
version: 1.3.2-dev
|
||||
version: 1.3.1-dev
|
||||
groups:
|
||||
- csharp
|
||||
- queries
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 1.0.27
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.0.26
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 1.0.27
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.0.27
|
||||
lastReleaseVersion: 1.0.26
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql-go-consistency-queries
|
||||
version: 1.0.28-dev
|
||||
version: 1.0.27-dev
|
||||
groups:
|
||||
- go
|
||||
- queries
|
||||
|
||||
@@ -1,14 +1,3 @@
|
||||
## 4.3.0
|
||||
|
||||
### Deprecated APIs
|
||||
|
||||
* The class `BuiltinType` is now deprecated. Use the new replacement `BuiltinTypeEntity` instead.
|
||||
* The class `DeclaredType` is now deprecated. Use the new replacement `DeclaredTypeEntity` instead.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.
|
||||
|
||||
## 4.2.8
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
category: deprecated
|
||||
---
|
||||
* The class `BuiltinType` is now deprecated. Use the new replacement `BuiltinTypeEntity` instead.
|
||||
* The class `DeclaredType` is now deprecated. Use the new replacement `DeclaredTypeEntity` instead.
|
||||
@@ -1,10 +0,0 @@
|
||||
## 4.3.0
|
||||
|
||||
### Deprecated APIs
|
||||
|
||||
* The class `BuiltinType` is now deprecated. Use the new replacement `BuiltinTypeEntity` instead.
|
||||
* The class `DeclaredType` is now deprecated. Use the new replacement `DeclaredTypeEntity` instead.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 4.3.0
|
||||
lastReleaseVersion: 4.2.8
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/go-all
|
||||
version: 4.3.1-dev
|
||||
version: 4.2.9-dev
|
||||
groups: go
|
||||
dbscheme: go.dbscheme
|
||||
extractor: go
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 1.4.1
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.4.0
|
||||
|
||||
### Query Metadata Changes
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 1.4.1
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.4.1
|
||||
lastReleaseVersion: 1.4.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/go-queries
|
||||
version: 1.4.2-dev
|
||||
version: 1.4.1-dev
|
||||
groups:
|
||||
- go
|
||||
- queries
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 7.3.3
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 7.3.2
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 7.3.3
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 7.3.3
|
||||
lastReleaseVersion: 7.3.2
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/java-all
|
||||
version: 7.3.4-dev
|
||||
version: 7.3.3-dev
|
||||
groups: java
|
||||
dbscheme: config/semmlecode.dbscheme
|
||||
extractor: java
|
||||
|
||||
@@ -1,9 +1,3 @@
|
||||
## 1.6.1
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Java analysis of guards has been switched to use the new and improved shared guards library. This improves precision of a number of queries, in particular `java/dereferenced-value-may-be-null`, which now has fewer false positives, and `java/useless-null-check` and `java/constant-comparison`, which gain additional true positives.
|
||||
|
||||
## 1.6.0
|
||||
|
||||
### Query Metadata Changes
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
## 1.6.1
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Java analysis of guards has been switched to use the new and improved shared guards library. This improves precision of a number of queries, in particular `java/dereferenced-value-may-be-null`, which now has fewer false positives, and `java/useless-null-check` and `java/constant-comparison`, which gain additional true positives.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.6.1
|
||||
lastReleaseVersion: 1.6.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/java-queries
|
||||
version: 1.6.2-dev
|
||||
version: 1.6.1-dev
|
||||
groups:
|
||||
- java
|
||||
- queries
|
||||
|
||||
@@ -1,9 +1,3 @@
|
||||
## 2.6.7
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Enhanced modeling for the `execa` library, adding support for command execution methods `execaCommand`, `execaCommandSync`, `$`, and `$.sync`, as well as file system operations through `inputFile`, `pipeStdout`, `pipeAll`, and `pipeStderr`.
|
||||
|
||||
## 2.6.6
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
## 2.6.7
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Enhanced modeling for the `execa` library, adding support for command execution methods `execaCommand`, `execaCommandSync`, `$`, and `$.sync`, as well as file system operations through `inputFile`, `pipeStdout`, `pipeAll`, and `pipeStderr`.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 2.6.7
|
||||
lastReleaseVersion: 2.6.6
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/javascript-all
|
||||
version: 2.6.8-dev
|
||||
version: 2.6.7-dev
|
||||
groups: javascript
|
||||
dbscheme: semmlecode.javascript.dbscheme
|
||||
extractor: javascript
|
||||
|
||||
@@ -1,29 +1,3 @@
|
||||
## 2.0.0
|
||||
|
||||
### Breaking Changes
|
||||
|
||||
* The `Type` and `Symbol` classes have been deprecated and will be empty in newly extracted databases, since the TypeScript extractor no longer populates them.
|
||||
This is a breaking change for custom queries that explicitly relied on these classes.
|
||||
Such queries will still compile, but with deprecation warnings, and may have different query results due to type information no longer being available.
|
||||
We expect most custom queries will not be affected, however. If a custom query has no deprecation warnings, it should not be affected by this change.
|
||||
Uses of `getType()` should be rewritten to use the new `getTypeBinding()` or `getNameBinding()` APIs instead.
|
||||
If the new API is not sufficient, please consider opening an issue in `github/codeql` describing your use-case.
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* The TypeScript extractor no longer relies on the TypeScript compiler for extracting type information.
|
||||
Instead, the information we need from types is now derived by an algorithm written in QL.
|
||||
This results in more robust extraction with faster extraction times, in some cases significantly faster.
|
||||
* Taint is now tracked through the React `use` function.
|
||||
* Parameters of React server functions, marked with the `"use server"` directive, are now seen as taint sources.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Removed three queries from the JS qlpack, which have been superseded by newer queries that are part of the Actions qlpack:
|
||||
* `js/actions/pull-request-target` has been superseded by `actions/untrusted-checkout/{medium,high,critical}`
|
||||
* `js/actions/actions-artifact-leak` has been superseded by `actions/secrets-in-artifacts`
|
||||
* `js/actions/command-injection` has been superseded by `actions/command-injection/{medium,critical}`
|
||||
|
||||
## 1.7.0
|
||||
|
||||
### Query Metadata Changes
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
---
|
||||
category: majorAnalysis
|
||||
---
|
||||
* Taint is now tracked through the React `use` function.
|
||||
* Parameters of React server functions, marked with the `"use server"` directive, are now seen as taint sources.
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Removed three queries from the JS qlpack, which have been superseded by newer queries that are part of the Actions qlpack:
|
||||
* `js/actions/pull-request-target` has been superseded by `actions/untrusted-checkout/{medium,high,critical}`
|
||||
* `js/actions/actions-artifact-leak` has been superseded by `actions/secrets-in-artifacts`
|
||||
* `js/actions/command-injection` has been superseded by `actions/command-injection/{medium,critical}`
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
category: breaking
|
||||
---
|
||||
* The `Type` and `Symbol` classes have been deprecated and will be empty in newly extracted databases, since the TypeScript extractor no longer populates them.
|
||||
This is a breaking change for custom queries that explicitly relied on these classes.
|
||||
Such queries will still compile, but with deprecation warnings, and may have different query results due to type information no longer being available.
|
||||
We expect most custom queries will not be affected, however. If a custom query has no deprecation warnings, it should not be affected by this change.
|
||||
Uses of `getType()` should be rewritten to use the new `getTypeBinding()` or `getNameBinding()` APIs instead.
|
||||
If the new API is not sufficient, please consider opening an issue in `github/codeql` describing your use-case.
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
category: majorAnalysis
|
||||
---
|
||||
* The TypeScript extractor no longer relies on the TypeScript compiler for extracting type information.
|
||||
Instead, the information we need from types is now derived by an algorithm written in QL.
|
||||
This results in more robust extraction with faster extraction times, in some cases significantly faster.
|
||||
@@ -1,25 +0,0 @@
|
||||
## 2.0.0
|
||||
|
||||
### Breaking Changes
|
||||
|
||||
* The `Type` and `Symbol` classes have been deprecated and will be empty in newly extracted databases, since the TypeScript extractor no longer populates them.
|
||||
This is a breaking change for custom queries that explicitly relied on these classes.
|
||||
Such queries will still compile, but with deprecation warnings, and may have different query results due to type information no longer being available.
|
||||
We expect most custom queries will not be affected, however. If a custom query has no deprecation warnings, it should not be affected by this change.
|
||||
Uses of `getType()` should be rewritten to use the new `getTypeBinding()` or `getNameBinding()` APIs instead.
|
||||
If the new API is not sufficient, please consider opening an issue in `github/codeql` describing your use-case.
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* The TypeScript extractor no longer relies on the TypeScript compiler for extracting type information.
|
||||
Instead, the information we need from types is now derived by an algorithm written in QL.
|
||||
This results in more robust extraction with faster extraction times, in some cases significantly faster.
|
||||
* Taint is now tracked through the React `use` function.
|
||||
* Parameters of React server functions, marked with the `"use server"` directive, are now seen as taint sources.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Removed three queries from the JS qlpack, which have been superseded by newer queries that are part of the Actions qlpack:
|
||||
* `js/actions/pull-request-target` has been superseded by `actions/untrusted-checkout/{medium,high,critical}`
|
||||
* `js/actions/actions-artifact-leak` has been superseded by `actions/secrets-in-artifacts`
|
||||
* `js/actions/command-injection` has been superseded by `actions/command-injection/{medium,critical}`
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 2.0.0
|
||||
lastReleaseVersion: 1.7.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/javascript-queries
|
||||
version: 2.0.1-dev
|
||||
version: 1.7.1-dev
|
||||
groups:
|
||||
- javascript
|
||||
- queries
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 1.0.27
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.0.26
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 1.0.27
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.0.27
|
||||
lastReleaseVersion: 1.0.26
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
name: codeql/suite-helpers
|
||||
version: 1.0.28-dev
|
||||
version: 1.0.27-dev
|
||||
groups: shared
|
||||
warnOnImplicitThis: true
|
||||
|
||||
@@ -1,9 +1,3 @@
|
||||
## 4.0.11
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
- The Python parser is now able to correctly parse expressions such as `match[1]` and `match()` where `match` is not used as a keyword.
|
||||
|
||||
## 4.0.10
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
## 4.0.11
|
||||
|
||||
### Bug Fixes
|
||||
---
|
||||
category: fix
|
||||
---
|
||||
|
||||
- The Python parser is now able to correctly parse expressions such as `match[1]` and `match()` where `match` is not used as a keyword.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 4.0.11
|
||||
lastReleaseVersion: 4.0.10
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/python-all
|
||||
version: 4.0.12-dev
|
||||
version: 4.0.11-dev
|
||||
groups: python
|
||||
dbscheme: semmlecode.python.dbscheme
|
||||
extractor: python
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 1.6.1
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.6.0
|
||||
|
||||
### Query Metadata Changes
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 1.6.1
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.6.1
|
||||
lastReleaseVersion: 1.6.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/python-queries
|
||||
version: 1.6.2-dev
|
||||
version: 1.6.1-dev
|
||||
groups:
|
||||
- python
|
||||
- queries
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 4.1.10
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 4.1.9
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 4.1.10
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 4.1.10
|
||||
lastReleaseVersion: 4.1.9
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/ruby-all
|
||||
version: 4.1.11-dev
|
||||
version: 4.1.10-dev
|
||||
groups: ruby
|
||||
extractor: ruby
|
||||
dbscheme: ruby.dbscheme
|
||||
|
||||
@@ -1,7 +1,3 @@
|
||||
## 1.4.1
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
## 1.4.0
|
||||
|
||||
### Query Metadata Changes
|
||||
|
||||
@@ -1,3 +0,0 @@
|
||||
## 1.4.1
|
||||
|
||||
No user-facing changes.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.4.1
|
||||
lastReleaseVersion: 1.4.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/ruby-queries
|
||||
version: 1.4.2-dev
|
||||
version: 1.4.1-dev
|
||||
groups:
|
||||
- ruby
|
||||
- queries
|
||||
|
||||
@@ -1,11 +1,3 @@
|
||||
## 0.1.12
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Implemented support for data flow through trait functions. For the purpose of data flow, calls to trait functions dispatch to all possible implementations.
|
||||
* `AssocItem` and `ExternItem` are now proper subclasses of `Item`.
|
||||
* Added type inference for `for` loops and array expressions.
|
||||
|
||||
## 0.1.11
|
||||
|
||||
### New Features
|
||||
|
||||
4
rust/ql/lib/change-notes/2025-06-24-type-inference.md
Normal file
4
rust/ql/lib/change-notes/2025-06-24-type-inference.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added type inference for `for` loops and array expressions.
|
||||
4
rust/ql/lib/change-notes/2025-06-25-item-reorg.md.md
Normal file
4
rust/ql/lib/change-notes/2025-06-25-item-reorg.md.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* `AssocItem` and `ExternItem` are now proper subclasses of `Item`.
|
||||
4
rust/ql/lib/change-notes/2025-06-26-dataflow-traits.md
Normal file
4
rust/ql/lib/change-notes/2025-06-26-dataflow-traits.md
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Implemented support for data flow through trait functions. For the purpose of data flow, calls to trait functions dispatch to all possible implementations.
|
||||
@@ -1,7 +0,0 @@
|
||||
## 0.1.12
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Implemented support for data flow through trait functions. For the purpose of data flow, calls to trait functions dispatch to all possible implementations.
|
||||
* `AssocItem` and `ExternItem` are now proper subclasses of `Item`.
|
||||
* Added type inference for `for` loops and array expressions.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 0.1.12
|
||||
lastReleaseVersion: 0.1.11
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user