Revert "Release preparation for version 2.18.2"

java/ql/automodel/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.0.5
-
-No user-facing changes.
-
 ## 1.0.4
 
 No user-facing changes.

java/ql/automodel/src/change-notes/released/1.0.5.md

@@ -1,3 +0,0 @@
-## 1.0.5
-
-No user-facing changes.

java/ql/automodel/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.5
+lastReleaseVersion: 1.0.4

java/ql/automodel/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-automodel-queries
-version: 1.0.5
+version: 1.0.5-dev
 groups:
     - java
     - automodel

java/ql/lib/CHANGELOG.md

@@ -1,23 +1,3 @@
-## 3.0.0
-
-### Breaking Changes
-
-* The Java and Kotlin extractors no longer support the `SOURCE_ARCHIVE` and `TRAP_FOLDER` legacy environment variable.
-
-### New Features
-
-* Java support for `build-mode: none` is now out of beta, and generally available.
-
-### Major Analysis Improvements
-
-* We previously considered reverse DNS resolutions (IP address -> domain name) as sources of untrusted data, since compromised/malicious DNS servers could potentially return malicious responses to arbitrary requests. We have now removed this source from the default set of untrusted sources and made a new threat model kind for them, called "reverse-dns". You can optionally include other threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
-
-### Minor Analysis Improvements
-
-* Added flow through some methods of the class `java.net.URL` by ensuring that the fields of a URL are tainted.
-* Added path-injection sinks for `org.apache.tools.ant.taskdefs.Property.setFile` and `org.apache.tools.ant.taskdefs.Property.setResource`.
-* Adds models for request handlers using the `org.lastaflute.web` web framework.
-
 ## 2.0.0
 
 ### Breaking Changes

java/ql/lib/change-notes/2024-06-14-reverse-dns-separate-threat-model-kind.md

@@ -1,19 +1,4 @@
-## 3.0.0
-
-### Breaking Changes
-
-* The Java and Kotlin extractors no longer support the `SOURCE_ARCHIVE` and `TRAP_FOLDER` legacy environment variable.
-
-### New Features
-
-* Java support for `build-mode: none` is now out of beta, and generally available.
-
-### Major Analysis Improvements
-
+---
+category: majorAnalysis
+---
 * We previously considered reverse DNS resolutions (IP address -> domain name) as sources of untrusted data, since compromised/malicious DNS servers could potentially return malicious responses to arbitrary requests. We have now removed this source from the default set of untrusted sources and made a new threat model kind for them, called "reverse-dns". You can optionally include other threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
-
-### Minor Analysis Improvements
-
-* Added flow through some methods of the class `java.net.URL` by ensuring that the fields of a URL are tainted.
-* Added path-injection sinks for `org.apache.tools.ant.taskdefs.Property.setFile` and `org.apache.tools.ant.taskdefs.Property.setResource`.
-* Adds models for request handlers using the `org.lastaflute.web` web framework.

java/ql/lib/change-notes/2024-07-16-add-models-for-the-lastaflute-framework.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Adds models for request handlers using the `org.lastaflute.web` web framework.

java/ql/lib/change-notes/2024-07-19-apache-ant-property-sinks.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added path-injection sinks for `org.apache.tools.ant.taskdefs.Property.setFile` and `org.apache.tools.ant.taskdefs.Property.setResource`.

java/ql/lib/change-notes/2024-07-24-url-fields-inherit-taint.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added flow through some methods of the class `java.net.URL` by ensuring that the fields of a URL are tainted.

java/ql/lib/change-notes/2024-07-25-env-vars.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The Java and Kotlin extractors no longer support the `SOURCE_ARCHIVE` and `TRAP_FOLDER` legacy environment variable.

java/ql/lib/change-notes/2024-08-02-buildless-ga.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Java support for `build-mode: none` is now out of beta, and generally available.

java/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 3.0.0
+lastReleaseVersion: 2.0.0

java/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 3.0.0
+version: 2.0.1-dev
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

java/ql/src/CHANGELOG.md

@@ -1,12 +1,3 @@
-## 1.1.2
-
-### Minor Analysis Improvements
-
-* Variables names containing the string "tokenizer" (case-insensitively) are no longer sources for the `java/sensitive-log` query. They normally relate to things like `java.util.StringTokenizer`, which are not sensitive information. This should fix some false positive alerts.
-* The query "Unused classes and interfaces" (`java/unused-reference-type`) now recognizes that if a method of a class has an annotation then it may be accessed reflectively. This should remove false positive alerts, especially for JUnit 4-style tests annotated with `@test`.
-* Alerts about exposing `exception.getMessage()` in servlet responses are now split out of `java/stack-trace-exposure` into its own query `java/error-message-exposure`.
-* Added the extensible abstract class `SensitiveLoggerSource`. Now this class can be extended to add more sources to the `java/sensitive-log` query or for customizations overrides.
-
 ## 1.1.1
 
 ### Minor Analysis Improvements
@@ -334,7 +325,7 @@ No user-facing changes.
 ### New Queries
 
 * Added a new query, `java/android/incomplete-provider-permissions`, to detect if an Android ContentProvider is not protected with a correct set of permissions.
-* A new query "Uncontrolled data used in content resolution" (`java/androd/unsafe-content-uri-resolution`) has been added. This query finds paths from user-provided data to URI resolution operations in Android's `ContentResolver` without previous validation or sanitization.
+* A new query "Uncontrolled data used in content resolution" (`java/android/unsafe-content-uri-resolution`) has been added. This query finds paths from user-provided data to URI resolution operations in Android's `ContentResolver` without previous validation or sanitization.
 
 ## 0.4.1
 

java/ql/src/change-notes/2024-07-23-java-sensitivelogging-source.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added the extensible abstract class `SensitiveLoggerSource`. Now this class can be extended to add more sources to the `java/sensitive-log` query or for customizations overrides.

java/ql/src/change-notes/2024-07-25-java-error-message-exposure.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Alerts about exposing `exception.getMessage()` in servlet responses are now split out of `java/stack-trace-exposure` into its own query `java/error-message-exposure`.

java/ql/src/change-notes/2024-07-30-sensitive-log-whitelist-tokenizer.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Variables names containing the string "tokenizer" (case-insensitively) are no longer sources for the `java/sensitive-log` query. They normally relate to things like `java.util.StringTokenizer`, which are not sensitive information. This should fix some false positive alerts.

java/ql/src/change-notes/2024-07-30-unused.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query "Unused classes and interfaces" (`java/unused-reference-type`) now recognizes that if a method of a class has an annotation then it may be accessed reflectively. This should remove false positive alerts, especially for JUnit 4-style tests annotated with `@test`.

java/ql/src/change-notes/released/1.1.2.md

@@ -1,8 +0,0 @@
-## 1.1.2
-
-### Minor Analysis Improvements
-
-* Variables names containing the string "tokenizer" (case-insensitively) are no longer sources for the `java/sensitive-log` query. They normally relate to things like `java.util.StringTokenizer`, which are not sensitive information. This should fix some false positive alerts.
-* The query "Unused classes and interfaces" (`java/unused-reference-type`) now recognizes that if a method of a class has an annotation then it may be accessed reflectively. This should remove false positive alerts, especially for JUnit 4-style tests annotated with `@test`.
-* Alerts about exposing `exception.getMessage()` in servlet responses are now split out of `java/stack-trace-exposure` into its own query `java/error-message-exposure`.
-* Added the extensible abstract class `SensitiveLoggerSource`. Now this class can be extended to add more sources to the `java/sensitive-log` query or for customizations overrides.

java/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.1.2
+lastReleaseVersion: 1.1.1

java/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 1.1.2
+version: 1.1.2-dev
 groups:
   - java
   - queries