Merge branch 'main' of https://github.com/github/codeql into oscarsj/merge-back-rc-3.21

ruby/ql/lib/change-notes/2026-03-05-inline-expectation-space-after-$.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Inline expectations test comments, which are of the form `# $ tag` or `# $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the `$` symbol.

ruby/ql/lib/codeql/ruby/security/InsecureDownloadCustomizations.qll

@@ -163,7 +163,7 @@ module InsecureDownload {
       //
       // ```rb
       // f = File.open("foo.exe")
-      // f.write(Excon.get(...).body) # $BAD=
+      // f.write(Excon.get(...).body) # $ BAD=
       // ```
       //
       // `f` is the `FileSystemAccess` and the call `f.write` is the `IO::FileWriter`.