Merge commit

java/ql/src/change-notes/2025-06-22-query-escaping.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `java/escaping`, to detect values escaping from classes marked as `@ThreadSafe`.

java/ql/src/change-notes/2025-06-22-query-not-thread-safe.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `java/not-threadsafe`, to detect data races in classes marked as `@ThreadSafe`.

java/ql/src/change-notes/2025-06-22-query-safe-publication.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `java/safe-publication`, to detect unsafe publication in classes marked as `@ThreadSafe`.

java/ql/src/change-notes/2025-10-02-http-only-cookie-promote.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* The `java/sensitive-cookie-not-httponly` query has been promoted from experimental to the main query pack.

java/ql/src/change-notes/2025-10-22-adjust-query-severity.md

@@ -0,0 +1,5 @@
+---
+category: queryMetadata
+---
+* Reduced the `security-severity` score of the `java/overly-large-range` query from 5.0 to 4.0 to better reflect its impact.
+* Reduced the `security-severity` score of the `java/insecure-cookie` query from 5.0 to 4.0 to better reflect its impact.

java/ql/src/change-notes/2025-10-24-request-forgery-matches-sanitizer.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `String.matches` are now treated as sanitizers for the `java/ssrf` query.

java/ql/src/change-notes/2025-11-13-maven-default-java-17

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Java analysis now selects the Java version to use informed by Maven POM files across all project modules. It also tries to use Java 17 or higher for all Maven projects if possible, for improved build compatibility.

java/ql/src/change-notes/released/1.9.0.md

@@ -0,0 +1,12 @@
+## 1.9.0
+
+### New Queries
+
+* The `java/sensitive-cookie-not-httponly` query has been promoted from experimental to the main query pack.
+* Added a new query, `java/escaping`, to detect values escaping from classes marked as `@ThreadSafe`.
+* Added a new query, `java/not-threadsafe`, to detect data races in classes marked as `@ThreadSafe`.
+* Added a new query, `java/safe-publication`, to detect unsafe publication in classes marked as `@ThreadSafe`.
+
+### Minor Analysis Improvements
+
+* Calls to `String.matches` are now treated as sanitizers for the `java/ssrf` query.