Release preparation for version 2.18.1

javascript/ql/src/CHANGELOG.md

@@ -1,3 +1,17 @@
+## 1.1.0
+
+### New Queries
+
+* Added a new query, `js/insecure-helmet-configuration`, to detect instances where Helmet middleware is configured with important security features disabled.
+
+### Minor Analysis Improvements
+
+* Added a new query, `js/functionality-from-untrusted-domain`, which detects uses in HTML and JavaScript scripts from untrusted domains, including the `polyfill.io` content delivery network
+  * it can be extended to detect other compromised scripts using user-provided data extensions of the `untrustedDomain` predicate, which takes one string argument with the domain to warn on (and will warn on any subdomains too).
+* Modified existing query, `js/functionality-from-untrusted-source`, to allow adding this new query, but reusing the same logic
+  * Added the ability to use data extensions to require SRI on CDN hostnames using the `isCdnDomainWithCheckingRequired` predicate, which takes one string argument of the full hostname to require SRI for.
+* Created a new library, `semmle.javascript.security.FunctionalityFromUntrustedSource`, to support both queries.
+
 ## 1.0.3
 
 ### Minor Analysis Improvements

javascript/ql/src/change-notes/2024-06-19-insecure-helmet-config.md

@@ -1,4 +0,0 @@
----
-category: newQuery
----
-* Added a new query, `js/insecure-helmet-configuration`, to detect instances where Helmet middleware is configured with important security features disabled.

javascript/ql/src/change-notes/released/1.1.0.md

@@ -1,6 +1,11 @@
----
-category: minorAnalysis
----
+## 1.1.0
+
+### New Queries
+
+* Added a new query, `js/insecure-helmet-configuration`, to detect instances where Helmet middleware is configured with important security features disabled.
+
+### Minor Analysis Improvements
+
 * Added a new query, `js/functionality-from-untrusted-domain`, which detects uses in HTML and JavaScript scripts from untrusted domains, including the `polyfill.io` content delivery network
   * it can be extended to detect other compromised scripts using user-provided data extensions of the `untrustedDomain` predicate, which takes one string argument with the domain to warn on (and will warn on any subdomains too).
 * Modified existing query, `js/functionality-from-untrusted-source`, to allow adding this new query, but reusing the same logic

javascript/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.3
+lastReleaseVersion: 1.1.0

javascript/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 1.0.4-dev
+version: 1.1.0
 groups:
   - javascript
   - queries