Merge from main to resolve conflicts

ruby/ql/lib/change-notes/2024-02-27-process-spawn.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* New command injection sinks have been added, including `Process.spawn`, `Process.exec`, `Terrapin::CommandLine` and the `open4` gem.

ruby/ql/lib/change-notes/2024-03-01-typhoeus-request.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `Typhoeus::Request.new` are now considered as instances of the `Http::Client::Request` concept, with the response body being treated as a remote flow source.

ruby/ql/lib/change-notes/2024-03-08-activerecord-from.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The second argument, `subquery_name`, of the `ActiveRecord::QueryMethods::from` method, is now recognized as an sql injection sink.

ruby/ql/lib/change-notes/2024-03-14-actiondispatch-uploadedfile.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Modeled instances of `ActionDispatch::Http::UploadedFile` that can be obtained from element reads of `ActionController::Parameters`, with calls to `original_filename`, `content_type`, and `read` now propagating taint from their receiver. 

ruby/ql/lib/change-notes/2024-03-19-activerecord-scopes.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Data flow is now tracked through `ActiveRecord` scopes.