Merge pull request #18668 from github/post-release-prep/codeql-cli-2.20.4

Post-release preparation for codeql-cli-2.20.4

javascript/ql/src/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 1.4.0
+
+### Major Analysis Improvements
+
+* Improved support for NestJS applications that make use of dependency injection with custom providers.
+  Calls to methods on an injected service should now be resolved properly.
+* TypeScript extraction is now better at analyzing projects where the main `tsconfig.json` file does not include any
+  source files, but references other `tsconfig.json`-like files that do include source files.
+* The `js/incorrect-suffix-check` query now recognises some good patterns of the form `origin.indexOf("." + allowedOrigin)` that were previously falsely flagged.
+* Added a new threat model kind called `view-component-input`, which can enabled with [advanced setup](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
+  When enabled, all React props, Vue props, and input fields in an Angular component are seen as taint sources, even if none of the corresponding instantiation sites appear to pass in a tainted value.
+  Some users may prefer this as a "defense in depth" option but note that it may result in false positives.
+  Regardless of whether the threat model is enabled, CodeQL will propagate taint from the instantiation sites of such components into the components themselves.
+
+### Bug Fixes
+
+* Fixed a bug that would occur when TypeScript code was found in an HTML-like file, such as a `.vue` file,
+  but where it could not be associated with any `tsconfig.json` file. Previously the embedded code was not
+  extracted in this case, but should now be extracted properly.
+
 ## 1.3.0
 
 ### Major Analysis Improvements

javascript/ql/src/change-notes/2025-01-21-vue-ts-notsconfig.md

@@ -1,6 +0,0 @@
----
-category: fix
----
-* Fixed a bug that would occur when TypeScript code was found in an HTML-like file, such as a `.vue` file,
-  but where it could not be associated with any `tsconfig.json` file. Previously the embedded code was not
-  extracted in this case, but should now be extracted properly.

javascript/ql/src/change-notes/2025-01-22-indexof-suffix-check.md

@@ -1,4 +0,0 @@
----
-category: majorAnalysis
----
-* The `js/incorrect-suffix-check` query now recognises some good patterns of the form `origin.indexOf("." + allowedOrigin)` that were previously falsely flagged.

javascript/ql/src/change-notes/2025-01-22-view-component-inputs.md

@@ -1,7 +0,0 @@
----
-category: majorAnalysis
----
-* Added a new threat model kind called `view-component-input`, which can enabled with [advanced setup](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
-  When enabled, all React props, Vue props, and input fields in an Angular component are seen as taint sources, even if none of the corresponding instantiation sites appear to pass in a tainted value.
-  Some users may prefer this as a "defense in depth" option but note that it may result in false positives.
-  Regardless of whether the threat model is enabled, CodeQL will propagate taint from the instantiation sites of such components into the components themselves.

javascript/ql/src/change-notes/2025-01-30-nest-di.md

@@ -1,5 +0,0 @@
----
-category: majorAnalysis
----
-* Improved support for NestJS applications that make use of dependency injection with custom providers.
-  Calls to methods on an injected service should now be resolved properly.

javascript/ql/src/change-notes/2025-01-30-typescript-tsconfig-names.md

@@ -1,5 +0,0 @@
----
-category: majorAnalysis
----
-* TypeScript extraction is now better at analyzing projects where the main `tsconfig.json` file does not include any
-  source files, but references other `tsconfig.json`-like files that do include source files.

javascript/ql/src/change-notes/released/1.4.0.md

@@ -0,0 +1,19 @@
+## 1.4.0
+
+### Major Analysis Improvements
+
+* Improved support for NestJS applications that make use of dependency injection with custom providers.
+  Calls to methods on an injected service should now be resolved properly.
+* TypeScript extraction is now better at analyzing projects where the main `tsconfig.json` file does not include any
+  source files, but references other `tsconfig.json`-like files that do include source files.
+* The `js/incorrect-suffix-check` query now recognises some good patterns of the form `origin.indexOf("." + allowedOrigin)` that were previously falsely flagged.
+* Added a new threat model kind called `view-component-input`, which can enabled with [advanced setup](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
+  When enabled, all React props, Vue props, and input fields in an Angular component are seen as taint sources, even if none of the corresponding instantiation sites appear to pass in a tainted value.
+  Some users may prefer this as a "defense in depth" option but note that it may result in false positives.
+  Regardless of whether the threat model is enabled, CodeQL will propagate taint from the instantiation sites of such components into the components themselves.
+
+### Bug Fixes
+
+* Fixed a bug that would occur when TypeScript code was found in an HTML-like file, such as a `.vue` file,
+  but where it could not be associated with any `tsconfig.json` file. Previously the embedded code was not
+  extracted in this case, but should now be extracted properly.

javascript/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.3.0
+lastReleaseVersion: 1.4.0

javascript/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 1.3.1-dev
+version: 1.4.1-dev
 groups:
   - javascript
   - queries