Merge branch 'main' into shared-bb-dominates

2025-12-16 16:53:25 +01:00 · 2025-02-11 09:31:06 +01:00
parent 820d2cbeb8 e1c810a50c
commit 7c57962add
214 changed files with 48064 additions and 47643 deletions
--- a/actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md
+++ b/actions/ql/lib/change-notes/2025-01-07-trusted-owner-ext.md
@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* The "Unpinned tag for a non-immutable Action in workflow" query (`actions/unpinned-tag`) now supports expanding the trusted action owner list using data extensions (`extensible: trustedActionsOwnerDataModel`). If you trust an Action publisher, you can include the owner name/organization in a model pack to add it to the allow list for this query. This addition will prevent security alerts when using unpinned tags for Actions published by that owner. For more information on creating a model pack, see [Creating a CodeQL Model Pack](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack).
--- a/actions/ql/lib/codeql/actions/Bash.qll
+++ b/actions/ql/lib/codeql/actions/Bash.qll
@@ -81,7 +81,9 @@ class BashShellScript extends ShellScript {
          "qstr:" + k + ":" + i + ":" + j + ":" + quotedStr.length() + ":" +
            quotedStr.regexpReplaceAll("[^a-zA-Z0-9]", "")
      )
-    )
+    ) and
+    // Only do this for strings that might otherwise disrupt subsequent parsing
+    quotedStr.regexpMatch("[\"'].*[$\n\r'\"" + Bash::separator() + "].*[\"']")
  }

  private predicate rankedQuotedStringReplacements(int i, string old, string new) {
--- a/actions/ql/lib/codeql/actions/config/Config.qll
+++ b/actions/ql/lib/codeql/actions/config/Config.qll
@@ -126,6 +126,15 @@ predicate vulnerableActionsDataModel(
 */
 predicate immutableActionsDataModel(string action) { Extensions::immutableActionsDataModel(action) }

+/**
+ * MaD models for trusted actions owners
+ * Fields:
+ *    - owner: owner name
+ */
+predicate trustedActionsOwnerDataModel(string owner) {
+  Extensions::trustedActionsOwnerDataModel(owner)
+}
+
 /**
 * MaD models for untrusted git commands
 * Fields:
--- a/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll
+++ b/actions/ql/lib/codeql/actions/config/ConfigExtensions.qll
@@ -63,6 +63,11 @@ extensible predicate vulnerableActionsDataModel(
 */
 extensible predicate immutableActionsDataModel(string action);

+/**
+ * Holds for trusted Actions owners.
+ */
+extensible predicate trustedActionsOwnerDataModel(string owner);
+
 /**
 * Holds for git commands that may introduce untrusted data when called on an attacker controlled branch.
 */
--- a/actions/ql/lib/ext/config/trusted_actions_owner.yml
+++ b/actions/ql/lib/ext/config/trusted_actions_owner.yml
@@ -0,0 +1,8 @@
+extensions:
+  - addsTo: 
+      pack: codeql/actions-all
+      extensible: trustedActionsOwnerDataModel
+    data:      
+      - ["actions"]
+      - ["github"]
+      - ["advanced-security"]
--- a/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
+++ b/actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql
@@ -2,9 +2,9 @@
 * @name PATH Enviroment Variable built from user-controlled sources
 * @description Building the PATH environment variable from user-controlled sources may alter the execution of following system commands
 * @kind path-problem
- * @problem.severity warning
+ * @problem.severity error
 * @security-severity 5.0
- * @precision high
+ * @precision medium
 * @id actions/envpath-injection/medium
 * @tags actions
 *       security
--- a/actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql
+++ b/actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql
@@ -2,9 +2,9 @@
 * @name Enviroment Variable built from user-controlled sources
 * @description Building an environment variable from user-controlled sources may alter the execution of following system commands
 * @kind path-problem
- * @problem.severity warning
+ * @problem.severity error
 * @security-severity 5.0
- * @precision high
+ * @precision medium
 * @id actions/envvar-injection/medium
 * @tags actions
 *       security
--- a/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
+++ b/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
@@ -3,11 +3,12 @@
 * @description Workflows should contain permissions to provide a clear understanding has permissions to run the workflow.
 * @kind problem
 * @security-severity 5.0
- * @problem.severity recommendation
+ * @problem.severity warning
 * @precision high
 * @id actions/missing-workflow-permissions
 * @tags actions
 *       maintainability
+ *       security
 *       external/cwe/cwe-275
 */

--- a/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
+++ b/actions/ql/src/Security/CWE-312/ExcessiveSecretsExposure.ql
@@ -2,7 +2,8 @@
 * @name Excessive Secrets Exposure
 * @description All organization and repository secrets are passed to the workflow runner.
 * @kind problem
- * @problem.severity recommendation
+ * @precision high
+ * @problem.severity warning
 * @id actions/excessive-secrets-exposure
 * @tags actions
 *       security
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
@@ -2,8 +2,8 @@
 * @name Artifact poisoning
 * @description An attacker may be able to poison the workflow's artifacts and influence on consequent steps.
 * @kind path-problem
- * @problem.severity warning
- * @precision high
+ * @problem.severity error
+ * @precision medium
 * @security-severity 5.0
 * @id actions/artifact-poisoning/medium
 * @tags actions
--- a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md
+++ b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md
@@ -24,4 +24,4 @@ Pinning an action to a full length commit SHA is currently the only way to use a

 ## References

- [Using third-party actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
+- [Using third-party actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
--- a/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql
+++ b/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql
@@ -3,8 +3,8 @@
 * @description Using a tag for a non-immutable Action that is not pinned to a commit can lead to executing an untrusted Action through a supply chain attack.
 * @kind problem
 * @security-severity 5.0
- * @problem.severity recommendation
- * @precision high
+ * @problem.severity warning
+ * @precision medium
 * @id actions/unpinned-tag
 * @tags security
 *       actions
@@ -17,14 +17,15 @@ import codeql.actions.security.UseOfUnversionedImmutableAction
 bindingset[version]
 private predicate isPinnedCommit(string version) { version.regexpMatch("^[A-Fa-f0-9]{40}$") }

-bindingset[repo]
-private predicate isTrustedOrg(string repo) {
-  repo.matches(["actions", "github", "advanced-security"] + "/%")
+bindingset[nwo]
+private predicate isTrustedOwner(string nwo) {
+  // Gets the segment before the first '/' in the name with owner(nwo) string
+  trustedActionsOwnerDataModel(nwo.substring(0, nwo.indexOf("/")))
 }

-from UsesStep uses, string repo, string version, Workflow workflow, string name
+from UsesStep uses, string nwo, string version, Workflow workflow, string name
 where
-  uses.getCallee() = repo and
+  uses.getCallee() = nwo and
  uses.getEnclosingWorkflow() = workflow and
  (
    workflow.getName() = name
@@ -32,9 +33,9 @@ where
    not exists(workflow.getName()) and workflow.getLocation().getFile().getBaseName() = name
  ) and
  uses.getVersion() = version and
-  not isTrustedOrg(repo) and
+  not isTrustedOwner(nwo) and
  not isPinnedCommit(version) and
-  not isImmutableAction(uses, repo)
+  not isImmutableAction(uses, nwo)
 select uses.getCalleeNode(),
-  "Unpinned 3rd party Action '" + name + "' step $@ uses '" + repo + "' with ref '" + version +
+  "Unpinned 3rd party Action '" + name + "' step $@ uses '" + nwo + "' with ref '" + version +
    "', not a pinned commit hash", uses, uses.toString()
--- a/actions/ql/src/change-notes/2025-02-06-curate-suites.md
+++ b/actions/ql/src/change-notes/2025-02-06-curate-suites.md
@@ -0,0 +1,20 @@
+---
+category: breaking
+---
+* The following queries have been removed from the `code-scanning` and `security-extended` suites.
+  Any existing alerts for these queries will be closed automatically.
+  * `actions/if-expression-always-true/critical`
+  * `actions/if-expression-always-true/high`
+  * `actions/unnecessary-use-of-advanced-config`
+  
+* The following query has been moved from the `code-scanning` suite to the `security-extended`
+  suite. Any existing alerts for this query will be closed automatically unless the analysis is
+  configured to use the `security-extended` suite.
+  * `actions/unpinned-tag`
+* The following queries have been added to the `security-extended` suite.
+  * `actions/unversioned-immutable-action`
+  * `actions/envpath-injection/medium`
+  * `actions/envvar-injection/medium`
+  * `actions/code-injection/medium`
+  * `actions/artifact-poisoning/medium`
+  * `actions/untrusted-checkout/medium`
--- a/actions/ql/src/codeql-suites/actions-code-scanning.qls
+++ b/actions/ql/src/codeql-suites/actions-code-scanning.qls
@@ -1,11 +1,4 @@
 - description: Standard Code Scanning queries for GitHub Actions
- queries: '.'
- include:
-    problem.severity: 
-      - error
-      - recommendation
- exclude:
-    tags contain:
-      - experimental
-      - debug
-      - internal
+- queries: .
+- apply: code-scanning-selectors.yml
+  from: codeql/suite-helpers
--- a/actions/ql/src/codeql-suites/actions-security-extended.qls
+++ b/actions/ql/src/codeql-suites/actions-security-extended.qls
@@ -1,2 +1,4 @@
 - description: Security-extended queries for GitHub Actions
- import: codeql-suites/actions-code-scanning.qls
+- queries: .
+- apply: security-extended-selectors.yml
+  from: codeql/suite-helpers
--- a/actions/ql/src/experimental/Security/CWE-074/OutputClobberingHigh.ql
+++ b/actions/ql/src/experimental/Security/CWE-074/OutputClobberingHigh.ql
--- a/actions/ql/src/experimental/Security/CWE-078/CommandInjectionCritical.ql
+++ b/actions/ql/src/experimental/Security/CWE-078/CommandInjectionCritical.ql
--- a/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql
+++ b/actions/ql/src/experimental/Security/CWE-078/CommandInjectionMedium.ql
--- a/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.md
+++ b/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.md
--- a/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql
+++ b/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql
--- a/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.md
+++ b/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.md
--- a/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
+++ b/actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
--- a/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
+++ b/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
--- a/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
+++ b/actions/ql/src/experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
--- a/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
+++ b/actions/ql/src/experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql
--- a/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql
+++ b/actions/ql/src/experimental/Security/CWE-918/RequestForgery.ql
--- a/actions/ql/test/library-tests/.github/workflows/many_strings.yml
+++ b/actions/ql/test/library-tests/.github/workflows/many_strings.yml
@@ -0,0 +1,18 @@
+on:
+  workflow_run:
+    workflows: ["Prev"]
+    types:
+      - completed
+
+jobs:
+  Test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          # Avoid choking on large chunks of data containing quotes
+          echo '["string1", "string2", "string3", "string4", "string5", "string6", "string7", "string8", "string9", "string10", "string11", "string12", "string13", "string14", "string15", "string16", "string17", "string18", "string19", "string20", "string21", "string22", "string23", "string24", "string25", "string26", "string27", "string28", "string29", "string30", "string31", "string32", "string33", "string34", "string35", "string36", "string37", "string38", "string39", "string40", "string41", "string42", "string43", "string44", "string45", "string46", "string47", "string48", "string49", "string50", "string51", "string52", "string53", "string54", "string55", "string56", "string57", "string58", "string59", "string60", "string61", "string62", "string63", "string64", "string65", "string66", "string67", "string68", "string69", "string70", "string71", "string72", "string73", "string74", "string75", "string76", "string77", "string78", "string79", "string80", "string81", "string82", "string83", "string84", "string85", "string86", "string87", "string88", "string89", "string90", "string91", "string92", "string93", "string94", "string95", "string96", "string97", "string98", "string99", "string100"]'
+          echo "['string1', 'string2', 'string3', 'string4', 'string5', 'string6', 'string7', 'string8', 'string9', 'string10', 'string11', 'string12', 'string13', 'string14', 'string15', 'string16', 'string17', 'string18', 'string19', 'string20', 'string21', 'string22', 'string23', 'string24', 'string25', 'string26', 'string27', 'string28', 'string29', 'string30', 'string31', 'string32', 'string33', 'string34', 'string35', 'string36', 'string37', 'string38', 'string39', 'string40', 'string41', 'string42', 'string43', 'string44', 'string45', 'string46', 'string47', 'string48', 'string49', 'string50', 'string51', 'string52', 'string53', 'string54', 'string55', 'string56', 'string57', 'string58', 'string59', 'string60', 'string61', 'string62', 'string63', 'string64', 'string65', 'string66', 'string67', 'string68', 'string69', 'string70', 'string71', 'string72', 'string73', 'string74', 'string75', 'string76', 'string77', 'string78', 'string79', 'string80', 'string81', 'string82', 'string83', 'string84', 'string85', 'string86', 'string87', 'string88', 'string89', 'string90', 'string91', 'string92', 'string93', 'string94', 'string95', 'string96', 'string97', 'string98', 'string99', 'string100']"
+
+          # Same as above but where each line has an unbalanced internal quote near the end
+          echo '["string1", "string2", "string3", "string4", "string5", "string6", "string7", "string8", "string9", "string10", "string11", "string12", "string13", "string14", "string15", "string16", "string17", "string18", "string19", "string20", "string21", "string22", "string23", "string24", "string25", "string26", "string27", "string28", "string29", "string30", "string31", "string32", "string33", "string34", "string35", "string36", "string37", "string38", "string39", "string40", "string41", "string42", "string43", "string44", "string45", "string46", "string47", "string48", "string49", "string50", "string51", "string52", "string53", "string54", "string55", "string56", "string57", "string58", "string59", "string60", "string61", "string62", "string63", "string64", "string65", "string66", "string67", "string68", "string69", "string70", "string71", "string72", "string73", "string74", "string75", "string76", "string77", "string78", "string79", "string80", "string81", "string82", "string83", "string84", "string85", "string86", "string87", "string88", "string89", "string90", "string91", "string92", "string93", "string94", "string95", "string96", "string97", "string98", "string99", "string100"]"'
+          echo "['string1', 'string2', 'string3', 'string4', 'string5', 'string6', 'string7', 'string8', 'string9', 'string10', 'string11', 'string12', 'string13', 'string14', 'string15', 'string16', 'string17', 'string18', 'string19', 'string20', 'string21', 'string22', 'string23', 'string24', 'string25', 'string26', 'string27', 'string28', 'string29', 'string30', 'string31', 'string32', 'string33', 'string34', 'string35', 'string36', 'string37', 'string38', 'string39', 'string40', 'string41', 'string42', 'string43', 'string44', 'string45', 'string46', 'string47', 'string48', 'string49', 'string50', 'string51', 'string52', 'string53', 'string54', 'string55', 'string56', 'string57', 'string58', 'string59', 'string60', 'string61', 'string62', 'string63', 'string64', 'string65', 'string66', 'string67', 'string68', 'string69', 'string70', 'string71', 'string72', 'string73', 'string74', 'string75', 'string76', 'string77', 'string78', 'string79', 'string80', 'string81', 'string82', 'string83', 'string84', 'string85', 'string86', 'string87', 'string88', 'string89', 'string90', 'string91', 'string92', 'string93', 'string94', 'string95', 'string96', 'string97', 'string98', 'string99', 'string100']'"
--- a/actions/ql/test/library-tests/commands.expected
+++ b/actions/ql/test/library-tests/commands.expected
@@ -25,6 +25,10 @@
 | .github/workflows/expression_nodes.yml:16:9:20:6 | Run Step | LINE 2 echo '${{github.event.issue.body}}' |
 | .github/workflows/expression_nodes.yml:16:9:20:6 | Run Step | LINE 3 echo '${{ github.event.comment.body }}' |
 | .github/workflows/expression_nodes.yml:20:9:21:47 | Run Step | LINE 1 echo '${{ github.event.comment.body }}' echo '${{github.event.issue.body}}' |
+| .github/workflows/many_strings.yml:11:9:18:1211 | Run Step | echo "['string1', 'string2', 'string3', 'string4', 'string5', 'string6', 'string7', 'string8', 'string9', 'string10', 'string11', 'string12', 'string13', 'string14', 'string15', 'string16', 'string17', 'string18', 'string19', 'string20', 'string21', 'string22', 'string23', 'string24', 'string25', 'string26', 'string27', 'string28', 'string29', 'string30', 'string31', 'string32', 'string33', 'string34', 'string35', 'string36', 'string37', 'string38', 'string39', 'string40', 'string41', 'string42', 'string43', 'string44', 'string45', 'string46', 'string47', 'string48', 'string49', 'string50', 'string51', 'string52', 'string53', 'string54', 'string55', 'string56', 'string57', 'string58', 'string59', 'string60', 'string61', 'string62', 'string63', 'string64', 'string65', 'string66', 'string67', 'string68', 'string69', 'string70', 'string71', 'string72', 'string73', 'string74', 'string75', 'string76', 'string77', 'string78', 'string79', 'string80', 'string81', 'string82', 'string83', 'string84', 'string85', 'string86', 'string87', 'string88', 'string89', 'string90', 'string91', 'string92', 'string93', 'string94', 'string95', 'string96', 'string97', 'string98', 'string99', 'string100']" |
+| .github/workflows/many_strings.yml:11:9:18:1211 | Run Step | echo "['string1', 'string2', 'string3', 'string4', 'string5', 'string6', 'string7', 'string8', 'string9', 'string10', 'string11', 'string12', 'string13', 'string14', 'string15', 'string16', 'string17', 'string18', 'string19', 'string20', 'string21', 'string22', 'string23', 'string24', 'string25', 'string26', 'string27', 'string28', 'string29', 'string30', 'string31', 'string32', 'string33', 'string34', 'string35', 'string36', 'string37', 'string38', 'string39', 'string40', 'string41', 'string42', 'string43', 'string44', 'string45', 'string46', 'string47', 'string48', 'string49', 'string50', 'string51', 'string52', 'string53', 'string54', 'string55', 'string56', 'string57', 'string58', 'string59', 'string60', 'string61', 'string62', 'string63', 'string64', 'string65', 'string66', 'string67', 'string68', 'string69', 'string70', 'string71', 'string72', 'string73', 'string74', 'string75', 'string76', 'string77', 'string78', 'string79', 'string80', 'string81', 'string82', 'string83', 'string84', 'string85', 'string86', 'string87', 'string88', 'string89', 'string90', 'string91', 'string92', 'string93', 'string94', 'string95', 'string96', 'string97', 'string98', 'string99', 'string100']'" |
+| .github/workflows/many_strings.yml:11:9:18:1211 | Run Step | echo '["string1", "string2", "string3", "string4", "string5", "string6", "string7", "string8", "string9", "string10", "string11", "string12", "string13", "string14", "string15", "string16", "string17", "string18", "string19", "string20", "string21", "string22", "string23", "string24", "string25", "string26", "string27", "string28", "string29", "string30", "string31", "string32", "string33", "string34", "string35", "string36", "string37", "string38", "string39", "string40", "string41", "string42", "string43", "string44", "string45", "string46", "string47", "string48", "string49", "string50", "string51", "string52", "string53", "string54", "string55", "string56", "string57", "string58", "string59", "string60", "string61", "string62", "string63", "string64", "string65", "string66", "string67", "string68", "string69", "string70", "string71", "string72", "string73", "string74", "string75", "string76", "string77", "string78", "string79", "string80", "string81", "string82", "string83", "string84", "string85", "string86", "string87", "string88", "string89", "string90", "string91", "string92", "string93", "string94", "string95", "string96", "string97", "string98", "string99", "string100"]"' |
+| .github/workflows/many_strings.yml:11:9:18:1211 | Run Step | echo '["string1", "string2", "string3", "string4", "string5", "string6", "string7", "string8", "string9", "string10", "string11", "string12", "string13", "string14", "string15", "string16", "string17", "string18", "string19", "string20", "string21", "string22", "string23", "string24", "string25", "string26", "string27", "string28", "string29", "string30", "string31", "string32", "string33", "string34", "string35", "string36", "string37", "string38", "string39", "string40", "string41", "string42", "string43", "string44", "string45", "string46", "string47", "string48", "string49", "string50", "string51", "string52", "string53", "string54", "string55", "string56", "string57", "string58", "string59", "string60", "string61", "string62", "string63", "string64", "string65", "string66", "string67", "string68", "string69", "string70", "string71", "string72", "string73", "string74", "string75", "string76", "string77", "string78", "string79", "string80", "string81", "string82", "string83", "string84", "string85", "string86", "string87", "string88", "string89", "string90", "string91", "string92", "string93", "string94", "string95", "string96", "string97", "string98", "string99", "string100"]' |
 | .github/workflows/multiline2.yml:11:9:15:6 | Run Step | echo "CHANGELOGEOF" |
 | .github/workflows/multiline2.yml:11:9:15:6 | Run Step | echo "changelog< |
 | .github/workflows/multiline2.yml:11:9:15:6 | Run Step | echo -e "$FILTERED_CHANGELOG" |
--- a/actions/ql/test/library-tests/test.expected
+++ b/actions/ql/test/library-tests/test.expected
--- a/actions/ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-074/OutputClobberingHigh.qlref
@@ -1 +1 @@
-Security/CWE-074/OutputClobberingHigh.ql
+experimental/Security/CWE-074/OutputClobberingHigh.ql
--- a/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-078/CommandInjectionCritical.ql
+experimental/Security/CWE-078/CommandInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-078/CommandInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-078/CommandInjectionMedium.ql
+experimental/Security/CWE-078/CommandInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionCritical.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionCritical.qlref
@@ -1 +1 @@
-Security/CWE-088/ArgumentInjectionCritical.ql
+experimental/Security/CWE-088/ArgumentInjectionCritical.ql
--- a/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionMedium.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-088/ArgumentInjectionMedium.qlref
@@ -1 +1 @@
-Security/CWE-088/ArgumentInjectionMedium.ql
+experimental/Security/CWE-088/ArgumentInjectionMedium.ql
--- a/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.qlref
@@ -1,2 +1,2 @@
-Security/CWE-200/SecretExfiltration.ql
+experimental/Security/CWE-200/SecretExfiltration.ql

--- a/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-284/CodeExecutionOnSelfHostedRunner.qlref
@@ -1,2 +1,2 @@
-Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql
+experimental/Security/CWE-284/CodeExecutionOnSelfHostedRunner.ql

--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningPathTraversal.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningPathTraversal.qlref
@@ -1,2 +1,2 @@
-Security/CWE-829/ArtifactPoisoningPathTraversal.ql
+experimental/Security/CWE-829/ArtifactPoisoningPathTraversal.ql

--- a/actions/ql/test/query-tests/Security/CWE-918/RequestForgery.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-918/RequestForgery.qlref
@@ -1 +1 @@
-Security/CWE-918/RequestForgery.ql
+experimental/Security/CWE-918/RequestForgery.ql
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
@@ -769,8 +769,4 @@ module InputSigCommon {
  BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }

  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
-
-  class ExitBasicBlock extends BasicBlock {
-    ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
-  }
 }
--- a/csharp/ql/lib/change-notes/2025-02-03-blazor-routing-parameters.md
+++ b/csharp/ql/lib/change-notes/2025-02-03-blazor-routing-parameters.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Blazor `[Parameter]` fields bound to a variable from the route specified in the `@page` directive are now modeled as remote flow sources.
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/PreSsa.qll
@@ -90,7 +90,7 @@ module PreSsa {

    BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }

-    class ExitBasicBlock extends BasicBlock {
+    private class ExitBasicBlock extends BasicBlock {
      ExitBasicBlock() { scopeLast(_, this.getLastElement(), _) }
    }

--- a/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll
@@ -345,7 +345,7 @@ module Ssa {
     * - The read of `this.Field` on line 11 is a last read of the phi node
     *   between lines 9 and 10.
     */
-    final AssignableRead getALastRead() { result = this.getALastReadAtNode(_) }
+    deprecated final AssignableRead getALastRead() { result = this.getALastReadAtNode(_) }

    /**
     * Gets a last read of the source variable underlying this SSA definition at
@@ -375,7 +375,7 @@ module Ssa {
     * - The read of `this.Field` on line 11 is a last read of the phi node
     *   between lines 9 and 10.
     */
-    final AssignableRead getALastReadAtNode(ControlFlow::Node cfn) {
+    deprecated final AssignableRead getALastReadAtNode(ControlFlow::Node cfn) {
      SsaImpl::lastReadSameVar(this, cfn) and
      result.getAControlFlowNode() = cfn
    }
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/BaseSSA.qll
@@ -55,8 +55,6 @@ module BaseSsa {

    BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }

-    class ExitBasicBlock extends BasicBlock, ControlFlow::BasicBlocks::ExitBlock { }
-
    class SourceVariable = PreSsa::SimpleLocalScopeVariable;

    predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -17,8 +17,6 @@ private module SsaInput implements SsaImplCommon::InputSig<Location> {

  BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }

-  class ExitBasicBlock extends BasicBlock, ControlFlow::BasicBlocks::ExitBlock { }
-
  class SourceVariable = Ssa::SourceVariable;

  /**
@@ -784,7 +782,9 @@ private predicate adjacentDefReachesUncertainRead(

 /** Same as `lastRefRedef`, but skips uncertain reads. */
 pragma[nomagic]
-private predicate lastRefSkipUncertainReads(Definition def, SsaInput::BasicBlock bb, int i) {
+deprecated private predicate lastRefSkipUncertainReads(
+  Definition def, SsaInput::BasicBlock bb, int i
+) {
  Impl::lastRef(def, bb, i) and
  not SsaInput::variableRead(bb, i, def.getSourceVariable(), false)
  or
@@ -794,6 +794,15 @@ private predicate lastRefSkipUncertainReads(Definition def, SsaInput::BasicBlock
  )
 }

+pragma[nomagic]
+deprecated predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
+  exists(ControlFlow::BasicBlock bb, int i |
+    lastRefSkipUncertainReads(def, bb, i) and
+    variableReadActual(bb, i, _) and
+    cfn = bb.getNode(i)
+  )
+}
+
 cached
 private module Cached {
  cached
@@ -957,15 +966,6 @@ private module Cached {
    )
  }

-  cached
-  predicate lastReadSameVar(Definition def, ControlFlow::Node cfn) {
-    exists(ControlFlow::BasicBlock bb, int i |
-      lastRefSkipUncertainReads(def, bb, i) and
-      variableReadActual(bb, i, _) and
-      cfn = bb.getNode(i)
-    )
-  }
-
  cached
  Definition uncertainWriteDefinitionInput(UncertainWriteDefinition def) {
    Impl::uncertainWriteDefinitionInput(def, result)
--- a/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
+++ b/csharp/ql/lib/semmle/code/csharp/frameworks/microsoft/aspnetcore/Components.qll
@@ -0,0 +1,135 @@
+/** Provides classes for working with `Microsoft.AspNetCore.Components` */
+
+import csharp
+import semmle.code.csharp.frameworks.Microsoft
+import semmle.code.csharp.frameworks.microsoft.AspNetCore
+
+/** The `Microsoft.AspNetCore.Components` namespace */
+class MicrosoftAspNetCoreComponentsNamespace extends Namespace {
+  MicrosoftAspNetCoreComponentsNamespace() {
+    this.getParentNamespace() instanceof MicrosoftAspNetCoreNamespace and
+    this.hasName("Components")
+  }
+}
+
+/**
+ * A class in the `Microsoft.AspNetCore.Components` namespace.
+ */
+private class MicrosoftAspNetCoreComponentsClass extends Class {
+  MicrosoftAspNetCoreComponentsClass() {
+    this.getNamespace() instanceof MicrosoftAspNetCoreComponentsNamespace
+  }
+}
+
+/** The `Microsoft.AspNetCore.Components.CascadingParameterAttributeBase` class. */
+class MicrosoftAspNetCoreComponentsCascadingParameterAttributeBaseClass extends MicrosoftAspNetCoreComponentsClass
+{
+  MicrosoftAspNetCoreComponentsCascadingParameterAttributeBaseClass() {
+    this.hasName("CascadingParameterAttributeBase")
+  }
+}
+
+/** The `Microsoft.AspNetCore.Components.ComponentBase` class. */
+class MicrosoftAspNetCoreComponentsComponentBaseClass extends MicrosoftAspNetCoreComponentsClass {
+  MicrosoftAspNetCoreComponentsComponentBaseClass() { this.hasName("ComponentBase") }
+}
+
+/** The `Microsoft.AspNetCore.Components.IComponent` interface. */
+class MicrosoftAspNetCoreComponentsIComponentInterface extends Interface {
+  MicrosoftAspNetCoreComponentsIComponentInterface() {
+    this.getNamespace() instanceof MicrosoftAspNetCoreComponentsNamespace and
+    this.hasName("IComponent")
+  }
+}
+
+/** The `Microsoft.AspNetCore.Components.RouteAttribute` attribute. */
+private class MicrosoftAspNetCoreComponentsRouteAttribute extends Attribute {
+  MicrosoftAspNetCoreComponentsRouteAttribute() {
+    this.getType().getNamespace() instanceof MicrosoftAspNetCoreComponentsNamespace and
+    this.getType().hasName("RouteAttribute")
+  }
+}
+
+/** The `Microsoft.AspNetCore.Components.ParameterAttribute` attribute. */
+private class MicrosoftAspNetCoreComponentsParameterAttribute extends Attribute {
+  MicrosoftAspNetCoreComponentsParameterAttribute() {
+    this.getType().getNamespace() instanceof MicrosoftAspNetCoreComponentsNamespace and
+    this.getType().hasName("ParameterAttribute")
+  }
+}
+
+/** An ASP.NET Core (Blazor) component. */
+class MicrosoftAspNetCoreComponentsComponent extends Class {
+  MicrosoftAspNetCoreComponentsComponent() {
+    this.getABaseType+() instanceof MicrosoftAspNetCoreComponentsComponentBaseClass or
+    this.getABaseType+() instanceof MicrosoftAspNetCoreComponentsIComponentInterface
+  }
+
+  /** Gets a property whose value cascades down the component hierarchy. */
+  Property getACascadingParameterProperty() {
+    result = this.getAProperty() and
+    result.getAnAttribute().getType().getBaseClass() instanceof
+      MicrosoftAspNetCoreComponentsCascadingParameterAttributeBaseClass
+  }
+
+  /** Gets the url for the route from the `Microsoft.AspNetCore.Components.RouteAttribute` of the component. */
+  private string getRouteAttributeUrl() {
+    exists(MicrosoftAspNetCoreComponentsRouteAttribute a | a = this.getAnAttribute() |
+      result = a.getArgument(0).getValue()
+    )
+  }
+
+  /**
+   * Gets a route parameter from the `Microsoft.AspNetCore.Components.RouteAttribute` of the component.
+   *
+   * A route parameter is defined in the URL by wrapping its name in a pair of { braces } when adding a component's @page declaration.
+   * There are various extensions that can be added next to the parameter name, such as `:int` or `?` to make the parameter optional.
+   * Optionally, the parameter name can start with a `*` to make it a catch-all parameter.
+   *
+   * An example of a route parameter is `@page "/counter/{id:int}/{other?}/{*rest}"`, from this we're getting the `id`, `other` and `rest` parameters.
+   */
+  pragma[nomagic]
+  private string getARouteParameter() {
+    exists(string s |
+      s = this.getRouteAttributeUrl().splitAt("{").regexpCapture("\\*?([^:?}]+)[:?}](.*)", 1) and
+      result = s.toLowerCase()
+    )
+  }
+
+  /** Gets a property attributed with `[Parameter]` attribute. */
+  pragma[nomagic]
+  private Property getAParameterProperty(string name) {
+    result = this.getAProperty() and
+    result.getAnAttribute() instanceof MicrosoftAspNetCoreComponentsParameterAttribute and
+    name = result.getName().toLowerCase()
+  }
+
+  /** Gets a property whose value is populated from route parameters. */
+  Property getARouteParameterProperty() {
+    exists(string name | name = this.getARouteParameter() |
+      result = this.getAParameterProperty(name)
+    )
+  }
+}
+
+private module Sources {
+  private import semmle.code.csharp.security.dataflow.flowsources.Remote
+
+  /**
+   * A property with a `[Parameter]` attribute in an ASP.NET Core component which
+   * is populated from a route parameter.
+   */
+  private class AspNetCoreComponentRouteParameterFlowSource extends AspNetRemoteFlowSource,
+    DataFlow::ExprNode
+  {
+    AspNetCoreComponentRouteParameterFlowSource() {
+      exists(MicrosoftAspNetCoreComponentsComponent c, Property p |
+        p = c.getARouteParameterProperty()
+      |
+        this.asExpr() = p.getGetter().getACall()
+      )
+    }
+
+    override string getSourceType() { result = "ASP.NET Core component route parameter" }
+  }
+}
--- a/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
+++ b/csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll
@@ -26,7 +26,8 @@ abstract class RemoteFlowSource extends SourceNode {
 * A module for importing frameworks that defines remote flow sources.
 */
 private module RemoteFlowSources {
-  private import semmle.code.csharp.frameworks.ServiceStack
+  private import semmle.code.csharp.frameworks.ServiceStack as ServiceStack
+  private import semmle.code.csharp.frameworks.microsoft.aspnetcore.Components as Blazor
 }

 /** A data flow source of remote user input (ASP.NET). */
--- a/csharp/ql/src/Telemetry/DatabaseQuality.qll
+++ b/csharp/ql/src/Telemetry/DatabaseQuality.qll
@@ -4,33 +4,7 @@
 */

 import csharp
-
-signature module StatsSig {
-  int getNumberOfOk();
-
-  int getNumberOfNotOk();
-
-  string getOkText();
-
-  string getNotOkText();
-}
-
-module ReportStats<StatsSig Stats> {
-  predicate numberOfOk(string key, int value) {
-    value = Stats::getNumberOfOk() and
-    key = "Number of " + Stats::getOkText()
-  }
-
-  predicate numberOfNotOk(string key, int value) {
-    value = Stats::getNumberOfNotOk() and
-    key = "Number of " + Stats::getNotOkText()
-  }
-
-  predicate percentageOfOk(string key, float value) {
-    value = Stats::getNumberOfOk() * 100.0 / (Stats::getNumberOfOk() + Stats::getNumberOfNotOk()) and
-    key = "Percentage of " + Stats::getOkText()
-  }
-}
+import codeql.util.ReportStats

 module CallTargetStats implements StatsSig {
  int getNumberOfOk() { result = count(Call c | exists(c.getTarget())) }
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.expected
@@ -1,259 +0,0 @@
-| Capture.cs:10:16:10:16 | a | Capture.cs:10:16:27:9 | SSA def(a) | Capture.cs:46:12:46:12 | access to local variable a |
-| Capture.cs:17:17:17:17 | y | Capture.cs:17:17:17:21 | SSA def(y) | Capture.cs:26:17:26:17 | access to local variable y |
-| Capture.cs:17:17:17:17 | y | Capture.cs:19:24:23:13 | SSA capture def(y) | Capture.cs:22:21:22:21 | access to local variable y |
-| Capture.cs:19:20:19:20 | b | Capture.cs:19:20:23:13 | SSA def(b) | Capture.cs:25:13:25:13 | access to local variable b |
-| Capture.cs:30:16:30:16 | c | Capture.cs:30:16:30:35 | SSA def(c) | Capture.cs:32:9:32:9 | access to local variable c |
-| Capture.cs:52:16:52:16 | b | Capture.cs:52:16:52:43 | SSA def(b) | Capture.cs:53:9:53:9 | access to local variable b |
-| Capture.cs:57:57:57:63 | strings | Capture.cs:57:57:57:63 | SSA param(strings) | Capture.cs:61:9:61:15 | access to parameter strings |
-| Capture.cs:60:27:60:27 | e | Capture.cs:60:27:60:38 | SSA def(e) | Capture.cs:61:24:61:24 | access to local variable e |
-| Capture.cs:65:45:65:51 | strings | Capture.cs:65:45:65:51 | SSA param(strings) | Capture.cs:70:9:70:15 | access to parameter strings |
-| Capture.cs:67:13:67:13 | c | Capture.cs:68:32:68:49 | SSA capture def(c) | Capture.cs:68:48:68:48 | access to local variable c |
-| Capture.cs:67:13:67:13 | c | Capture.cs:69:9:69:62 | SSA capture def(c) | Capture.cs:69:48:69:48 | access to local variable c |
-| Capture.cs:68:32:68:32 | s | Capture.cs:68:32:68:32 | SSA param(s) | Capture.cs:68:37:68:37 | access to parameter s |
-| Capture.cs:69:25:69:25 | s | Capture.cs:69:25:69:25 | SSA param(s) | Capture.cs:69:59:69:59 | access to parameter s |
-| Capture.cs:73:67:73:73 | strings | Capture.cs:73:67:73:73 | SSA param(strings) | Capture.cs:77:9:77:15 | access to parameter strings |
-| Capture.cs:76:63:76:63 | e | Capture.cs:76:63:76:81 | SSA def(e) | Capture.cs:77:24:77:24 | access to local variable e |
-| Capture.cs:81:28:81:28 | i | Capture.cs:81:28:81:28 | SSA param(i) | Capture.cs:81:34:81:34 | access to parameter i |
-| Capture.cs:83:65:83:71 | strings | Capture.cs:83:65:83:71 | SSA param(strings) | Capture.cs:87:9:87:15 | access to parameter strings |
-| Capture.cs:85:13:85:13 | b | Capture.cs:86:68:86:73 | SSA capture def(b) | Capture.cs:86:73:86:73 | access to local variable b |
-| Capture.cs:86:64:86:64 | e | Capture.cs:86:64:86:73 | SSA def(e) | Capture.cs:87:23:87:23 | access to local variable e |
-| Capture.cs:92:18:92:18 | d | Capture.cs:92:18:92:18 | SSA param(d) | Capture.cs:92:24:92:24 | access to parameter d |
-| Capture.cs:94:13:94:13 | y | Capture.cs:96:12:100:9 | SSA capture def(y) | Capture.cs:98:21:98:21 | access to local variable y |
-| Capture.cs:98:17:98:17 | x | Capture.cs:98:17:98:21 | SSA def(x) | Capture.cs:99:20:99:20 | access to local variable x |
-| Capture.cs:114:13:114:13 | a | Capture.cs:115:9:119:9 | SSA capture def(a) | Capture.cs:117:21:117:21 | access to local variable a |
-| Capture.cs:117:17:117:17 | x | Capture.cs:117:17:117:21 | SSA def(x) | Capture.cs:118:17:118:17 | access to local variable x |
-| Capture.cs:162:13:162:13 | g | Capture.cs:163:9:166:9 | SSA capture def(g) | Capture.cs:165:17:165:17 | access to local variable g |
-| Capture.cs:182:17:182:17 | i | Capture.cs:183:13:186:13 | SSA capture def(i) | Capture.cs:185:21:185:21 | access to local variable i |
-| Capture.cs:197:17:197:17 | i | Capture.cs:198:33:198:44 | SSA capture def(i) | Capture.cs:198:43:198:43 | access to local variable i |
-| Capture.cs:197:17:197:17 | i | Capture.cs:203:34:203:45 | SSA capture def(i) | Capture.cs:203:44:203:44 | access to local variable i |
-| Capture.cs:198:28:198:29 | eh | Capture.cs:198:28:198:44 | SSA def(eh) | Capture.cs:199:27:199:28 | access to local variable eh |
-| Capture.cs:203:28:203:30 | eh2 | Capture.cs:203:28:203:45 | SSA def(eh2) | Capture.cs:204:27:204:29 | access to local variable eh2 |
-| Capture.cs:209:17:209:17 | i | Capture.cs:212:39:212:71 | SSA capture def(i) | Capture.cs:212:70:212:70 | access to local variable i |
-| Capture.cs:210:24:210:24 | p | Capture.cs:210:24:210:59 | SSA def(p) | Capture.cs:213:17:213:17 | access to local variable p |
-| Capture.cs:212:30:212:35 | exited | Capture.cs:212:30:212:71 | SSA def(exited) | Capture.cs:213:29:213:34 | access to local variable exited |
-| Consistency.cs:7:25:7:25 | b | Consistency.cs:7:25:7:25 | SSA param(b) | Consistency.cs:11:17:11:17 | access to parameter b |
-| Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i |
-| Consistency.cs:15:17:15:17 | i | Consistency.cs:15:17:15:21 | [finally: exception(Exception)] SSA def(i) | Consistency.cs:16:17:16:17 | access to local variable i |
-| Consistency.cs:25:29:25:29 | c | Consistency.cs:25:29:25:29 | SSA def(c) | Consistency.cs:27:13:27:13 | access to local variable c |
-| Consistency.cs:26:13:26:19 | c.Field | Consistency.cs:25:29:25:29 | SSA qualifier def(c.Field) | Consistency.cs:27:13:27:19 | access to field Field |
-| Consistency.cs:30:30:30:30 | c | Consistency.cs:32:9:32:29 | SSA def(c) | Consistency.cs:33:9:33:9 | access to parameter c |
-| Consistency.cs:44:11:44:11 | s | Consistency.cs:44:11:44:11 | SSA def(s) | Consistency.cs:46:13:46:13 | access to local variable s |
-| Consistency.cs:49:30:49:30 | a | Consistency.cs:49:30:49:30 | SSA param(a) | Consistency.cs:49:47:49:47 | access to parameter a |
-| Consistency.cs:49:37:49:37 | i | Consistency.cs:49:37:49:37 | SSA param(i) | Consistency.cs:49:49:49:49 | access to parameter i |
-| Consistency.cs:51:20:51:20 | a | Consistency.cs:51:20:51:20 | SSA param(a) | Consistency.cs:56:36:56:36 | access to parameter a |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:3:26:3:26 | SSA param(w) | DefUse.cs:9:13:9:13 | access to parameter w |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:19:13:19:18 | SSA def(w) | DefUse.cs:20:17:20:17 | access to parameter w |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:23:9:23:15 | SSA phi(w) | DefUse.cs:24:13:24:13 | access to parameter w |
-| DefUse.cs:3:26:3:26 | w | DefUse.cs:29:13:29:18 | SSA def(w) | DefUse.cs:53:17:53:17 | access to parameter w |
-| DefUse.cs:5:13:5:13 | x | DefUse.cs:5:13:5:17 | SSA def(x) | DefUse.cs:26:13:26:13 | access to local variable x |
-| DefUse.cs:5:13:5:13 | x | DefUse.cs:5:13:5:17 | SSA def(x) | DefUse.cs:56:16:56:16 | access to local variable x |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:6:14:6:19 | SSA def(y) | DefUse.cs:8:13:8:13 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:13:13:13:18 | SSA def(y) | DefUse.cs:14:17:14:17 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:23:9:23:15 | SSA phi(y) | DefUse.cs:23:13:23:13 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:28:13:28:18 | SSA def(y) | DefUse.cs:34:13:34:13 | access to local variable y |
-| DefUse.cs:6:14:6:14 | y | DefUse.cs:42:9:42:15 | SSA phi(y) | DefUse.cs:42:13:42:13 | access to local variable y |
-| DefUse.cs:44:13:44:13 | z | DefUse.cs:44:13:44:17 | SSA def(z) | DefUse.cs:45:13:45:13 | access to local variable z |
-| DefUse.cs:44:13:44:13 | z | DefUse.cs:47:23:47:23 | SSA def(z) | DefUse.cs:50:23:50:23 | access to local variable z |
-| DefUse.cs:44:13:44:13 | z | DefUse.cs:50:23:50:23 | SSA def(z) | DefUse.cs:51:13:51:13 | access to local variable z |
-| DefUse.cs:53:9:53:13 | this.Field | DefUse.cs:53:9:53:17 | SSA def(this.Field) | DefUse.cs:54:13:54:17 | access to field Field |
-| DefUse.cs:56:9:56:12 | this.Prop | DefUse.cs:56:9:56:16 | SSA def(this.Prop) | DefUse.cs:57:13:57:16 | access to property Prop |
-| DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:64:13:64:18 | access to field Field2 |
-| DefUse.cs:63:9:63:14 | this.Field2 | DefUse.cs:63:9:63:18 | SSA def(this.Field2) | DefUse.cs:80:37:80:42 | access to field Field2 |
-| DefUse.cs:66:9:66:14 | this.Field3 | DefUse.cs:66:9:66:18 | SSA def(this.Field3) | DefUse.cs:69:13:69:18 | access to field Field3 |
-| DefUse.cs:67:19:67:20 | tc | DefUse.cs:67:19:67:27 | SSA def(tc) | DefUse.cs:68:9:68:10 | access to local variable tc |
-| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA def(x1) | DefUse.cs:81:13:81:14 | access to local variable x1 |
-| DefUse.cs:79:13:79:14 | x1 | DefUse.cs:80:30:80:31 | SSA phi(x1) | DefUse.cs:80:30:80:31 | access to local variable x1 |
-| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:83:13:83:18 | SSA def(x2) | DefUse.cs:85:15:85:16 | access to local variable x2 |
-| DefUse.cs:83:13:83:14 | x2 | DefUse.cs:85:15:85:16 | SSA def(x2) | DefUse.cs:87:13:87:14 | access to local variable x2 |
-| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:89:13:89:18 | SSA def(x3) | DefUse.cs:92:15:92:16 | access to local variable x3 |
-| DefUse.cs:89:13:89:14 | x3 | DefUse.cs:92:15:92:16 | SSA def(x3) | DefUse.cs:94:13:94:14 | access to local variable x3 |
-| DefUse.cs:90:13:90:14 | x4 | DefUse.cs:93:15:93:16 | SSA def(x4) | DefUse.cs:95:13:95:14 | access to local variable x4 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:16:98:17 | SSA phi(x5) | DefUse.cs:101:18:101:19 | access to local variable x5 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:98:16:98:17 | SSA phi(x5) | DefUse.cs:104:9:104:10 | access to local variable x5 |
-| DefUse.cs:97:13:97:14 | x5 | DefUse.cs:104:9:104:15 | SSA def(x5) | DefUse.cs:105:13:105:14 | access to local variable x5 |
-| DefUse.cs:118:45:118:45 | i | DefUse.cs:118:45:118:45 | SSA param(i) | DefUse.cs:118:65:118:65 | access to parameter i |
-| DefUse.cs:128:19:128:19 | i | DefUse.cs:128:19:128:19 | SSA param(i) | DefUse.cs:129:19:129:19 | access to parameter i |
-| DefUse.cs:134:22:134:22 | d | DefUse.cs:134:22:134:22 | SSA param(d) | DefUse.cs:135:14:135:14 | access to parameter d |
-| DefUse.cs:142:68:142:69 | ie | DefUse.cs:142:68:142:69 | SSA param(ie) | DefUse.cs:144:27:144:28 | access to parameter ie |
-| DefUse.cs:144:22:144:22 | x | DefUse.cs:144:22:144:22 | SSA def(x) | DefUse.cs:147:17:147:17 | access to local variable x |
-| DefUse.cs:155:9:155:14 | this.Field4 | DefUse.cs:155:9:155:18 | SSA def(this.Field4) | DefUse.cs:157:13:157:18 | access to field Field4 |
-| DefUse.cs:162:13:162:18 | this.Field4 | DefUse.cs:160:10:160:16 | SSA entry def(this.Field4) | DefUse.cs:163:13:163:18 | access to field Field4 |
-| DefUse.cs:171:23:171:23 | a | DefUse.cs:171:23:180:9 | SSA def(a) | DefUse.cs:181:9:181:9 | access to local variable a |
-| DefUse.cs:171:23:171:23 | a | DefUse.cs:186:9:190:9 | SSA def(a) | DefUse.cs:191:9:191:9 | access to local variable a |
-| DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:184:9:184:18 | SSA def(this.Field5) | DefUse.cs:185:13:185:18 | access to field Field5 |
-| DefUse.cs:184:9:184:14 | this.Field5 | DefUse.cs:191:9:191:11 | SSA call def(this.Field5) | DefUse.cs:192:13:192:18 | access to field Field5 |
-| DefUse.cs:188:13:188:18 | this.Field5 | DefUse.cs:188:13:188:22 | SSA def(this.Field5) | DefUse.cs:189:17:189:22 | access to field Field5 |
-| Example.cs:6:23:6:23 | i | Example.cs:6:23:6:23 | SSA param(i) | Example.cs:11:26:11:26 | access to parameter i |
-| Example.cs:6:23:6:23 | i | Example.cs:6:23:6:23 | SSA param(i) | Example.cs:12:18:12:18 | access to parameter i |
-| Example.cs:8:9:8:18 | this.Field | Example.cs:8:9:8:22 | SSA def(this.Field) | Example.cs:9:13:9:22 | access to field Field |
-| Example.cs:8:9:8:18 | this.Field | Example.cs:14:9:14:24 | SSA phi(this.Field) | Example.cs:15:13:15:22 | access to field Field |
-| Example.cs:18:16:18:16 | p | Example.cs:18:16:18:16 | SSA param(p) | Example.cs:22:17:22:17 | access to parameter p |
-| Example.cs:18:16:18:16 | p | Example.cs:25:9:25:15 | SSA phi(p) | Example.cs:25:13:25:13 | access to parameter p |
-| Example.cs:18:24:18:24 | b | Example.cs:18:24:18:24 | SSA param(b) | Example.cs:20:13:20:13 | access to parameter b |
-| Fields.cs:18:15:18:15 | x | Fields.cs:20:9:20:14 | SSA def(x) | Fields.cs:21:13:21:13 | access to local variable x |
-| Fields.cs:18:19:18:20 | this.xs | Fields.cs:16:17:16:17 | SSA entry def(this.xs) | Fields.cs:18:19:18:20 | access to field xs |
-| Fields.cs:18:19:18:20 | this.xs | Fields.cs:19:9:19:13 | SSA call def(this.xs) | Fields.cs:20:13:20:14 | access to field xs |
-| Fields.cs:18:19:18:20 | this.xs | Fields.cs:23:9:23:20 | SSA phi(this.xs) | Fields.cs:23:13:23:19 | access to field xs |
-| Fields.cs:18:19:18:20 | this.xs | Fields.cs:24:9:24:23 | SSA def(this.xs) | Fields.cs:25:13:25:14 | access to field xs |
-| Fields.cs:30:13:30:13 | f | Fields.cs:30:13:30:28 | SSA def(f) | Fields.cs:46:13:46:13 | access to local variable f |
-| Fields.cs:30:13:30:13 | f | Fields.cs:50:9:50:17 | SSA phi(f) | Fields.cs:52:13:52:13 | access to local variable f |
-| Fields.cs:31:19:31:22 | f.xs | Fields.cs:30:13:30:28 | SSA qualifier def(f.xs) | Fields.cs:31:19:31:22 | access to field xs |
-| Fields.cs:31:19:31:22 | f.xs | Fields.cs:34:9:34:16 | SSA call def(f.xs) | Fields.cs:35:13:35:16 | access to field xs |
-| Fields.cs:31:19:31:22 | f.xs | Fields.cs:38:9:38:13 | SSA call def(f.xs) | Fields.cs:43:13:43:16 | access to field xs |
-| Fields.cs:31:19:31:22 | f.xs | Fields.cs:45:9:45:25 | SSA def(f.xs) | Fields.cs:46:13:46:16 | access to field xs |
-| Fields.cs:31:19:31:22 | f.xs | Fields.cs:50:9:50:17 | SSA phi(f.xs) | Fields.cs:52:13:52:16 | access to field xs |
-| Fields.cs:32:15:32:15 | z | Fields.cs:47:9:47:14 | SSA def(z) | Fields.cs:48:13:48:13 | access to local variable z |
-| Fields.cs:32:19:32:20 | this.xs | Fields.cs:28:17:28:17 | SSA entry def(this.xs) | Fields.cs:32:19:32:20 | access to field xs |
-| Fields.cs:32:19:32:20 | this.xs | Fields.cs:34:9:34:16 | SSA call def(this.xs) | Fields.cs:36:13:36:14 | access to field xs |
-| Fields.cs:32:19:32:20 | this.xs | Fields.cs:38:9:38:13 | SSA call def(this.xs) | Fields.cs:40:13:40:14 | access to field xs |
-| Fields.cs:32:19:32:20 | this.xs | Fields.cs:42:9:42:23 | SSA def(this.xs) | Fields.cs:53:13:53:14 | access to field xs |
-| Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:30:17:30:28 | SSA call def(Fields.stat) | Fields.cs:33:19:33:22 | access to field stat |
-| Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:34:9:34:16 | SSA call def(Fields.stat) | Fields.cs:37:13:37:16 | access to field stat |
-| Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:38:9:38:13 | SSA call def(Fields.stat) | Fields.cs:41:13:41:16 | access to field stat |
-| Fields.cs:33:19:33:22 | Fields.stat | Fields.cs:51:9:51:20 | SSA call def(Fields.stat) | Fields.cs:54:13:54:16 | access to field stat |
-| Fields.cs:65:24:65:32 | this.LoopField | Fields.cs:61:17:61:17 | SSA entry def(this.LoopField) | Fields.cs:65:24:65:32 | access to field LoopField |
-| Fields.cs:71:17:71:35 | this.SingleAccessedField | Fields.cs:61:17:61:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:71:17:71:35 | access to field SingleAccessedField |
-| Fields.cs:76:20:76:38 | this.SingleAccessedField | Fields.cs:74:17:74:17 | SSA entry def(this.SingleAccessedField) | Fields.cs:76:20:76:38 | access to field SingleAccessedField |
-| Fields.cs:77:13:77:13 | f | Fields.cs:77:13:77:45 | SSA def(f) | Fields.cs:90:19:90:19 | access to local variable f |
-| Fields.cs:77:13:77:13 | f | Fields.cs:78:27:78:54 | SSA capture def(f) | Fields.cs:78:35:78:35 | access to local variable f |
-| Fields.cs:78:23:78:23 | a | Fields.cs:78:23:78:54 | SSA def(a) | Fields.cs:81:9:81:9 | access to local variable a |
-| Fields.cs:78:23:78:23 | a | Fields.cs:86:24:86:46 | SSA capture def(a) | Fields.cs:86:31:86:31 | access to local variable a |
-| Fields.cs:79:23:79:23 | b | Fields.cs:79:23:79:35 | SSA def(b) | Fields.cs:84:9:84:9 | access to local variable b |
-| Fields.cs:79:23:79:23 | b | Fields.cs:89:24:89:46 | SSA capture def(b) | Fields.cs:89:31:89:31 | access to local variable b |
-| Fields.cs:80:9:80:12 | f.xs | Fields.cs:81:9:81:11 | SSA call def(f.xs) | Fields.cs:82:19:82:22 | access to field xs |
-| Fields.cs:80:9:80:12 | f.xs | Fields.cs:83:9:83:25 | SSA def(f.xs) | Fields.cs:85:19:85:22 | access to field xs |
-| Fields.cs:80:9:80:12 | f.xs | Fields.cs:86:9:86:47 | SSA call def(f.xs) | Fields.cs:87:19:87:22 | access to field xs |
-| Fields.cs:80:9:80:12 | f.xs | Fields.cs:88:9:88:25 | SSA def(f.xs) | Fields.cs:90:19:90:22 | access to field xs |
-| Fields.cs:82:9:82:15 | this.xs | Fields.cs:85:9:85:22 | SSA def(this.xs) | Fields.cs:86:9:86:15 | access to field xs |
-| Fields.cs:82:9:82:15 | this.xs | Fields.cs:87:9:87:22 | SSA def(this.xs) | Fields.cs:89:9:89:15 | access to field xs |
-| Fields.cs:95:19:95:19 | f | Fields.cs:95:19:95:19 | SSA param(f) | Fields.cs:102:22:102:22 | access to parameter f |
-| Fields.cs:97:9:97:15 | f.Field | Fields.cs:97:9:97:30 | SSA def(f.Field) | Fields.cs:102:22:102:28 | access to field Field |
-| Fields.cs:98:20:98:32 | f.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field) | Fields.cs:101:16:101:28 | access to field Field |
-| Fields.cs:99:16:99:34 | f.Field.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field) | Fields.cs:101:16:101:34 | access to field Field |
-| Fields.cs:100:16:100:40 | f.Field.Field.Field.Field | Fields.cs:97:9:97:30 | SSA qualifier def(f.Field.Field.Field.Field) | Fields.cs:101:16:101:40 | access to field Field |
-| Fields.cs:102:9:102:18 | this.Field | Fields.cs:102:9:102:28 | SSA def(this.Field) | Fields.cs:104:16:104:25 | access to field Field |
-| Fields.cs:107:33:107:33 | f | Fields.cs:107:33:107:33 | SSA param(f) | Fields.cs:107:38:107:38 | access to parameter f |
-| Fields.cs:115:20:115:29 | this.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field) | Fields.cs:117:17:117:26 | access to field Field |
-| Fields.cs:115:20:115:35 | this.Field.Field | Fields.cs:114:9:114:22 | SSA call def(this.Field.Field) | Fields.cs:117:17:117:32 | access to field Field |
-| Fields.cs:116:21:116:39 | this.Field.Field.xs | Fields.cs:114:9:114:22 | SSA qualifier def(this.Field.Field.xs) | Fields.cs:117:17:117:35 | access to field xs |
-| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationA.cs:5:22:5:22 | SSA param(x) | MultiImplementationA.cs:5:28:5:28 | access to parameter x |
-| MultiImplementationA.cs:5:22:5:22 | x | MultiImplementationB.cs:3:22:3:22 | SSA param(x) | MultiImplementationB.cs:3:28:3:28 | access to parameter x |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:9:13:9:17 | SSA def(j) | OutRef.cs:10:32:10:32 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:10:32:10:32 | SSA def(j) | OutRef.cs:22:29:22:29 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:22:22:22:22 | SSA def(j) | OutRef.cs:24:29:24:29 | access to local variable j |
-| OutRef.cs:9:13:9:13 | j | OutRef.cs:24:29:24:29 | SSA def(j) | OutRef.cs:25:13:25:13 | access to local variable j |
-| OutRef.cs:10:25:10:25 | i | OutRef.cs:10:25:10:25 | SSA def(i) | OutRef.cs:11:13:11:13 | access to local variable i |
-| OutRef.cs:10:25:10:25 | i | OutRef.cs:13:21:13:21 | SSA def(i) | OutRef.cs:14:13:14:13 | access to local variable i |
-| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:7:10:7:10 | SSA entry def(this.Field) | OutRef.cs:13:28:13:32 | access to field Field |
-| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:13:28:13:32 | SSA def(this.Field) | OutRef.cs:16:32:16:36 | access to field Field |
-| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:16:21:16:25 | SSA def(this.Field) | OutRef.cs:17:13:17:17 | access to field Field |
-| OutRef.cs:13:28:13:32 | this.Field | OutRef.cs:19:21:19:25 | SSA def(this.Field) | OutRef.cs:20:13:20:17 | access to field Field |
-| OutRef.cs:18:13:18:13 | t | OutRef.cs:18:13:18:28 | SSA def(t) | OutRef.cs:21:13:21:13 | access to local variable t |
-| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:18:13:18:28 | SSA qualifier def(t.Field) | OutRef.cs:19:32:19:38 | access to field Field |
-| OutRef.cs:19:32:19:38 | t.Field | OutRef.cs:19:32:19:38 | SSA def(t.Field) | OutRef.cs:21:13:21:19 | access to field Field |
-| OutRef.cs:28:37:28:37 | j | OutRef.cs:28:37:28:37 | SSA param(j) | OutRef.cs:30:13:30:13 | access to parameter j |
-| OutRef.cs:34:38:34:38 | j | OutRef.cs:34:38:34:38 | SSA param(j) | OutRef.cs:36:13:36:13 | access to parameter j |
-| OutRef.cs:39:24:39:24 | b | OutRef.cs:39:24:39:24 | SSA param(b) | OutRef.cs:41:13:41:13 | access to parameter b |
-| Patterns.cs:7:16:7:16 | o | Patterns.cs:7:16:7:23 | SSA def(o) | Patterns.cs:20:17:20:17 | access to local variable o |
-| Patterns.cs:8:22:8:23 | i1 | Patterns.cs:8:18:8:23 | SSA def(i1) | Patterns.cs:10:38:10:39 | access to local variable i1 |
-| Patterns.cs:12:30:12:31 | s1 | Patterns.cs:12:23:12:31 | SSA def(s1) | Patterns.cs:14:41:14:42 | access to local variable s1 |
-| Patterns.cs:24:22:24:23 | i2 | Patterns.cs:24:18:24:23 | SSA def(i2) | Patterns.cs:24:30:24:31 | access to local variable i2 |
-| Patterns.cs:24:22:24:23 | i2 | Patterns.cs:24:18:24:23 | SSA def(i2) | Patterns.cs:25:47:25:48 | access to local variable i2 |
-| Patterns.cs:27:22:27:23 | i3 | Patterns.cs:27:18:27:23 | SSA def(i3) | Patterns.cs:28:42:28:43 | access to local variable i3 |
-| Patterns.cs:30:25:30:26 | s2 | Patterns.cs:30:18:30:26 | SSA def(s2) | Patterns.cs:31:45:31:46 | access to local variable s2 |
-| Properties.cs:18:15:18:15 | x | Properties.cs:20:9:20:14 | SSA def(x) | Properties.cs:21:13:21:13 | access to local variable x |
-| Properties.cs:18:19:18:20 | this.xs | Properties.cs:16:17:16:17 | SSA entry def(this.xs) | Properties.cs:18:19:18:20 | access to property xs |
-| Properties.cs:18:19:18:20 | this.xs | Properties.cs:19:9:19:13 | SSA call def(this.xs) | Properties.cs:20:13:20:14 | access to property xs |
-| Properties.cs:18:19:18:20 | this.xs | Properties.cs:23:9:23:20 | SSA phi(this.xs) | Properties.cs:23:13:23:19 | access to property xs |
-| Properties.cs:18:19:18:20 | this.xs | Properties.cs:24:9:24:23 | SSA def(this.xs) | Properties.cs:25:13:25:14 | access to property xs |
-| Properties.cs:30:13:30:13 | f | Properties.cs:30:13:30:32 | SSA def(f) | Properties.cs:46:13:46:13 | access to local variable f |
-| Properties.cs:30:13:30:13 | f | Properties.cs:50:9:50:17 | SSA phi(f) | Properties.cs:52:13:52:13 | access to local variable f |
-| Properties.cs:31:19:31:22 | f.xs | Properties.cs:30:13:30:32 | SSA qualifier def(f.xs) | Properties.cs:31:19:31:22 | access to property xs |
-| Properties.cs:31:19:31:22 | f.xs | Properties.cs:34:9:34:16 | SSA call def(f.xs) | Properties.cs:35:13:35:16 | access to property xs |
-| Properties.cs:31:19:31:22 | f.xs | Properties.cs:38:9:38:13 | SSA call def(f.xs) | Properties.cs:43:13:43:16 | access to property xs |
-| Properties.cs:31:19:31:22 | f.xs | Properties.cs:45:9:45:25 | SSA def(f.xs) | Properties.cs:46:13:46:16 | access to property xs |
-| Properties.cs:31:19:31:22 | f.xs | Properties.cs:50:9:50:17 | SSA phi(f.xs) | Properties.cs:52:13:52:16 | access to property xs |
-| Properties.cs:32:15:32:15 | z | Properties.cs:47:9:47:14 | SSA def(z) | Properties.cs:48:13:48:13 | access to local variable z |
-| Properties.cs:32:19:32:20 | this.xs | Properties.cs:28:17:28:17 | SSA entry def(this.xs) | Properties.cs:32:19:32:20 | access to property xs |
-| Properties.cs:32:19:32:20 | this.xs | Properties.cs:34:9:34:16 | SSA call def(this.xs) | Properties.cs:36:13:36:14 | access to property xs |
-| Properties.cs:32:19:32:20 | this.xs | Properties.cs:38:9:38:13 | SSA call def(this.xs) | Properties.cs:40:13:40:14 | access to property xs |
-| Properties.cs:32:19:32:20 | this.xs | Properties.cs:42:9:42:23 | SSA def(this.xs) | Properties.cs:53:13:53:14 | access to property xs |
-| Properties.cs:33:19:33:22 | Properties.stat | Properties.cs:30:17:30:32 | SSA call def(Properties.stat) | Properties.cs:33:19:33:22 | access to property stat |
-| Properties.cs:33:19:33:22 | Properties.stat | Properties.cs:34:9:34:16 | SSA call def(Properties.stat) | Properties.cs:37:13:37:16 | access to property stat |
-| Properties.cs:33:19:33:22 | Properties.stat | Properties.cs:38:9:38:13 | SSA call def(Properties.stat) | Properties.cs:41:13:41:16 | access to property stat |
-| Properties.cs:33:19:33:22 | Properties.stat | Properties.cs:51:9:51:24 | SSA call def(Properties.stat) | Properties.cs:54:13:54:16 | access to property stat |
-| Properties.cs:61:23:61:23 | i | Properties.cs:63:16:63:16 | SSA phi(i) | Properties.cs:63:16:63:16 | access to parameter i |
-| Properties.cs:65:24:65:31 | this.LoopProp | Properties.cs:61:17:61:17 | SSA entry def(this.LoopProp) | Properties.cs:65:24:65:31 | access to property LoopProp |
-| Properties.cs:67:21:67:38 | this.SingleAccessedProp | Properties.cs:61:17:61:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:67:21:67:38 | access to property SingleAccessedProp |
-| Properties.cs:72:20:72:37 | this.SingleAccessedProp | Properties.cs:70:17:70:17 | SSA entry def(this.SingleAccessedProp) | Properties.cs:72:20:72:37 | access to property SingleAccessedProp |
-| Properties.cs:73:13:73:13 | f | Properties.cs:73:13:73:32 | SSA def(f) | Properties.cs:86:19:86:19 | access to local variable f |
-| Properties.cs:73:13:73:13 | f | Properties.cs:74:27:74:54 | SSA capture def(f) | Properties.cs:74:35:74:35 | access to local variable f |
-| Properties.cs:74:23:74:23 | a | Properties.cs:74:23:74:54 | SSA def(a) | Properties.cs:77:9:77:9 | access to local variable a |
-| Properties.cs:74:23:74:23 | a | Properties.cs:82:24:82:46 | SSA capture def(a) | Properties.cs:82:31:82:31 | access to local variable a |
-| Properties.cs:75:23:75:23 | b | Properties.cs:75:23:75:35 | SSA def(b) | Properties.cs:80:9:80:9 | access to local variable b |
-| Properties.cs:75:23:75:23 | b | Properties.cs:85:24:85:46 | SSA capture def(b) | Properties.cs:85:31:85:31 | access to local variable b |
-| Properties.cs:76:9:76:12 | f.xs | Properties.cs:77:9:77:11 | SSA call def(f.xs) | Properties.cs:78:19:78:22 | access to property xs |
-| Properties.cs:76:9:76:12 | f.xs | Properties.cs:79:9:79:25 | SSA def(f.xs) | Properties.cs:81:19:81:22 | access to property xs |
-| Properties.cs:76:9:76:12 | f.xs | Properties.cs:82:9:82:47 | SSA call def(f.xs) | Properties.cs:83:19:83:22 | access to property xs |
-| Properties.cs:76:9:76:12 | f.xs | Properties.cs:84:9:84:25 | SSA def(f.xs) | Properties.cs:86:19:86:22 | access to property xs |
-| Properties.cs:78:9:78:15 | this.xs | Properties.cs:81:9:81:22 | SSA def(this.xs) | Properties.cs:82:9:82:15 | access to property xs |
-| Properties.cs:78:9:78:15 | this.xs | Properties.cs:83:9:83:22 | SSA def(this.xs) | Properties.cs:85:9:85:15 | access to property xs |
-| Properties.cs:106:37:106:37 | p | Properties.cs:106:37:106:37 | SSA param(p) | Properties.cs:106:42:106:42 | access to parameter p |
-| Properties.cs:114:20:114:29 | this.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props) | Properties.cs:116:17:116:26 | access to field Props |
-| Properties.cs:114:20:114:35 | this.Props.Props | Properties.cs:113:9:113:22 | SSA call def(this.Props.Props) | Properties.cs:116:17:116:32 | access to field Props |
-| Properties.cs:115:21:115:39 | this.Props.Props.xs | Properties.cs:113:9:113:22 | SSA qualifier def(this.Props.Props.xs) | Properties.cs:116:17:116:35 | access to property xs |
-| Splitting.cs:3:18:3:18 | b | Splitting.cs:3:18:3:18 | SSA param(b) | Splitting.cs:15:13:15:13 | access to parameter b |
-| Splitting.cs:5:13:5:13 | x | Splitting.cs:7:13:7:19 | [b (line 3): true] SSA def(x) | Splitting.cs:17:13:17:13 | access to local variable x |
-| Splitting.cs:5:13:5:13 | x | Splitting.cs:10:13:10:19 | [b (line 3): false] SSA def(x) | Splitting.cs:14:9:14:9 | access to local variable x |
-| Splitting.cs:22:18:22:18 | b | Splitting.cs:22:18:22:18 | SSA param(b) | Splitting.cs:35:13:35:13 | access to parameter b |
-| Splitting.cs:24:13:24:13 | x | Splitting.cs:29:13:29:19 | [b (line 22): false] SSA def(x) | Splitting.cs:30:13:30:13 | access to local variable x |
-| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): false] SSA def(x) | Splitting.cs:34:9:34:9 | access to local variable x |
-| Splitting.cs:24:13:24:13 | x | Splitting.cs:32:9:32:15 | [b (line 22): true] SSA def(x) | Splitting.cs:37:13:37:13 | access to local variable x |
-| Splitting.cs:42:18:42:18 | b | Splitting.cs:42:18:42:18 | SSA param(b) | Splitting.cs:52:13:52:13 | access to parameter b |
-| Splitting.cs:44:13:44:13 | x | Splitting.cs:49:13:49:19 | [b (line 42): false] SSA def(x) | Splitting.cs:50:13:50:13 | access to local variable x |
-| Splitting.cs:44:13:44:13 | x | Splitting.cs:54:9:54:21 | SSA phi(x) | Splitting.cs:55:9:55:9 | access to local variable x |
-| Test.cs:5:15:5:20 | param1 | Test.cs:5:15:5:20 | SSA param(param1) | Test.cs:11:13:11:18 | access to parameter param1 |
-| Test.cs:5:15:5:20 | param1 | Test.cs:25:16:25:16 | SSA phi(param1) | Test.cs:27:17:27:22 | access to parameter param1 |
-| Test.cs:5:15:5:20 | param1 | Test.cs:39:9:42:9 | SSA phi(param1) | Test.cs:41:13:41:18 | access to parameter param1 |
-| Test.cs:5:67:5:72 | param2 | Test.cs:5:67:5:72 | SSA param(param2) | Test.cs:39:27:39:32 | access to parameter param2 |
-| Test.cs:7:9:7:13 | this.field | Test.cs:24:9:24:15 | SSA phi(this.field) | Test.cs:33:13:33:17 | access to field field |
-| Test.cs:8:13:8:13 | x | Test.cs:8:13:8:17 | SSA def(x) | Test.cs:13:13:13:13 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:13:13:13:15 | SSA def(x) | Test.cs:14:19:14:19 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:24:9:24:15 | SSA phi(x) | Test.cs:25:16:25:16 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:34:25:34:25 | SSA phi(x) | Test.cs:36:13:36:13 | access to local variable x |
-| Test.cs:8:13:8:13 | x | Test.cs:34:25:34:25 | SSA phi(x) | Test.cs:43:16:43:16 | access to local variable x |
-| Test.cs:9:13:9:13 | y | Test.cs:19:13:19:17 | SSA def(y) | Test.cs:20:13:20:13 | access to local variable y |
-| Test.cs:9:13:9:13 | y | Test.cs:25:16:25:16 | SSA phi(y) | Test.cs:31:13:31:13 | access to local variable y |
-| Test.cs:9:13:9:13 | y | Test.cs:25:16:25:16 | SSA phi(y) | Test.cs:43:20:43:20 | access to local variable y |
-| Test.cs:10:13:10:13 | z | Test.cs:24:9:24:15 | SSA phi(z) | Test.cs:24:13:24:13 | access to local variable z |
-| Test.cs:34:18:34:18 | i | Test.cs:34:25:34:25 | SSA phi(i) | Test.cs:34:25:34:25 | access to local variable i |
-| Test.cs:34:18:34:18 | i | Test.cs:34:25:34:25 | SSA phi(i) | Test.cs:34:33:34:33 | access to local variable i |
-| Test.cs:39:22:39:22 | w | Test.cs:39:22:39:22 | SSA def(w) | Test.cs:41:23:41:23 | access to local variable w |
-| Test.cs:46:16:46:18 | in | Test.cs:46:16:46:18 | SSA param(in) | Test.cs:48:13:48:15 | access to parameter in |
-| Test.cs:56:13:56:17 | this.field | Test.cs:46:10:46:10 | SSA entry def(this.field) | Test.cs:56:13:56:17 | access to field field |
-| Test.cs:56:13:56:17 | this.field | Test.cs:57:9:57:17 | SSA def(this.field) | Test.cs:58:13:58:17 | access to field field |
-| Test.cs:62:16:62:16 | x | Test.cs:62:16:62:16 | SSA param(x) | Test.cs:66:28:66:28 | access to parameter x |
-| Test.cs:68:45:68:45 | e | Test.cs:68:45:68:45 | [exception: DivideByZeroException] SSA def(e) | Test.cs:70:17:70:17 | access to local variable e |
-| Test.cs:76:24:76:25 | b1 | Test.cs:76:24:76:25 | SSA param(b1) | Test.cs:80:13:80:14 | access to parameter b1 |
-| Test.cs:76:33:76:34 | b2 | Test.cs:76:33:76:34 | SSA param(b2) | Test.cs:84:18:84:19 | access to parameter b2 |
-| Test.cs:76:42:76:43 | b3 | Test.cs:76:42:76:43 | SSA param(b3) | Test.cs:90:13:90:14 | access to parameter b3 |
-| Test.cs:76:51:76:52 | b4 | Test.cs:76:51:76:52 | SSA param(b4) | Test.cs:94:18:94:19 | access to parameter b4 |
-| Test.cs:76:60:76:61 | b5 | Test.cs:76:60:76:61 | SSA param(b5) | Test.cs:102:13:102:14 | access to parameter b5 |
-| Test.cs:76:69:76:70 | b6 | Test.cs:76:69:76:70 | SSA param(b6) | Test.cs:113:13:113:14 | access to parameter b6 |
-| Test.cs:78:13:78:13 | x | Test.cs:78:13:78:17 | SSA def(x) | Test.cs:99:13:99:13 | access to local variable x |
-| Test.cs:78:13:78:13 | x | Test.cs:78:13:78:17 | SSA def(x) | Test.cs:104:17:104:17 | access to local variable x |
-| Test.cs:78:13:78:13 | x | Test.cs:108:13:108:17 | SSA def(x) | Test.cs:109:17:109:17 | access to local variable x |
-| Test.cs:78:13:78:13 | x | Test.cs:113:9:116:9 | SSA phi(x) | Test.cs:115:17:115:17 | access to local variable x |
-| Tuples.cs:10:14:10:14 | x | Tuples.cs:10:9:10:54 | SSA def(x) | Tuples.cs:11:13:11:13 | access to local variable x |
-| Tuples.cs:10:14:10:14 | x | Tuples.cs:14:9:14:32 | SSA def(x) | Tuples.cs:15:13:15:13 | access to local variable x |
-| Tuples.cs:10:14:10:14 | x | Tuples.cs:23:9:23:37 | SSA def(x) | Tuples.cs:24:13:24:13 | access to local variable x |
-| Tuples.cs:10:23:10:23 | b | Tuples.cs:10:9:10:54 | SSA def(b) | Tuples.cs:12:13:12:13 | access to local variable b |
-| Tuples.cs:10:23:10:23 | b | Tuples.cs:14:9:14:32 | SSA def(b) | Tuples.cs:16:13:16:13 | access to local variable b |
-| Tuples.cs:10:33:10:33 | s | Tuples.cs:10:9:10:54 | SSA def(s) | Tuples.cs:13:13:13:13 | access to local variable s |
-| Tuples.cs:10:33:10:33 | s | Tuples.cs:14:9:14:32 | SSA def(s) | Tuples.cs:17:13:17:13 | access to local variable s |
-| Tuples.cs:18:40:18:44 | tuple | Tuples.cs:18:40:18:57 | SSA def(tuple) | Tuples.cs:19:13:19:17 | access to local variable tuple |
-| Tuples.cs:20:10:20:17 | this.Property | Tuples.cs:20:9:20:34 | SSA def(this.Property) | Tuples.cs:21:13:21:20 | access to property Property |
-| Tuples.cs:20:20:20:24 | this.Field | Tuples.cs:20:9:20:34 | SSA def(this.Field) | Tuples.cs:22:13:22:17 | access to field Field |
-| Tuples.cs:20:20:20:24 | this.Field | Tuples.cs:26:9:26:33 | SSA def(this.Field) | Tuples.cs:27:13:27:17 | access to field Field |
-| Tuples.cs:25:13:25:13 | t | Tuples.cs:25:13:25:28 | SSA def(t) | Tuples.cs:28:13:28:13 | access to local variable t |
-| Tuples.cs:26:17:26:23 | t.Field | Tuples.cs:26:9:26:33 | SSA def(t.Field) | Tuples.cs:28:13:28:19 | access to field Field |
--- a/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.ql
+++ b/csharp/ql/test/library-tests/dataflow/ssa/SsaDefLastRead.ql
@@ -1,5 +0,0 @@
-import csharp
-
-from Ssa::Definition def, AssignableRead read
-where read = def.getALastRead()
-select def.getSourceVariable(), def, read
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_MyInput_razor.g.cs
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_MyInput_razor.g.cs
@@ -0,0 +1,124 @@
+// <auto-generated/>
+#pragma warning disable 1591
+namespace BlazorTest.Components
+{
+#line default
+    using global::System;
+    using global::System.Collections.Generic;
+    using global::System.Linq;
+    using global::System.Threading.Tasks;
+    using global::Microsoft.AspNetCore.Components;
+#nullable restore
+    using System.Net.Http
+
+#nullable disable
+        ;
+#nullable restore
+    using System.Net.Http.Json
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Forms
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Routing
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Web
+
+#nullable disable
+        ;
+#nullable restore
+    using static Microsoft.AspNetCore.Components.Web.RenderMode
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Web.Virtualization
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.JSInterop
+
+#nullable disable
+        ;
+#nullable restore
+    using BlazorTest
+
+#nullable disable
+        ;
+#nullable restore
+    using BlazorTest.Components
+
+#line default
+#line hidden
+#nullable disable
+        ;
+    [global::BlazorTest.Components.MyInput.__PrivateComponentRenderModeAttribute]
+#nullable restore
+    public partial class MyInput : global::Microsoft.AspNetCore.Components.ComponentBase
+#nullable disable
+    {
+#pragma warning disable 1998
+        protected override void BuildRenderTree(global::Microsoft.AspNetCore.Components.Rendering.RenderTreeBuilder __builder)
+        {
+            __builder.OpenElement(0, "input");
+            __builder.AddAttribute(1, "value", global::Microsoft.AspNetCore.Components.BindConverter.FormatValue(
+#nullable restore
+Param1
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddAttribute(2, "onchange", global::Microsoft.AspNetCore.Components.EventCallback.Factory.CreateBinder(this, global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.CreateInferredBindSetter(callback: __value =>
+            {
+                Param1 = __value; return global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.InvokeAsynchronousDelegate(callback:
+#nullable restore
+Fire
+
+#line default
+#line hidden
+#nullable disable
+            );
+            }, value: Param1), Param1));
+            __builder.SetUpdatesAttributeName("value");
+            __builder.CloseElement();
+        }
+#pragma warning restore 1998
+#nullable restore
+
+        [Parameter]
+        public string? Param1 { get; set; } = "";
+
+        [Parameter]
+        public EventCallback<string?> ValueChanged { get; set; }
+
+        [Parameter]
+        public EventCallback<string?> Param1Changed { get; set; }
+
+        private void Fire()
+        {
+            ValueChanged.InvokeAsync(Param1);
+            Param1Changed.InvokeAsync(Param1);
+        }
+
+#line default
+#line hidden
+#nullable disable
+
+        private sealed class __PrivateComponentRenderModeAttribute : global::Microsoft.AspNetCore.Components.RenderModeAttribute
+        {
+            private static global::Microsoft.AspNetCore.Components.IComponentRenderMode ModeImpl => InteractiveServer
+            ;
+            public override global::Microsoft.AspNetCore.Components.IComponentRenderMode Mode => ModeImpl;
+        }
+    }
+}
+#pragma warning restore 1591
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_MyOutput_razor.g.cs
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_MyOutput_razor.g.cs
@@ -0,0 +1,115 @@
+// <auto-generated/>
+#pragma warning disable 1591
+namespace BlazorTest.Components
+{
+#line default
+    using global::System;
+    using global::System.Collections.Generic;
+    using global::System.Linq;
+    using global::System.Threading.Tasks;
+    using global::Microsoft.AspNetCore.Components;
+#nullable restore
+    using System.Net.Http
+
+#nullable disable
+        ;
+#nullable restore
+    using System.Net.Http.Json
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Forms
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Routing
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Web
+
+#nullable disable
+        ;
+#nullable restore
+    using static Microsoft.AspNetCore.Components.Web.RenderMode
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Web.Virtualization
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.JSInterop
+
+#nullable disable
+        ;
+#nullable restore
+    using BlazorTest
+
+#nullable disable
+        ;
+#nullable restore
+    using BlazorTest.Components
+
+#line default
+#line hidden
+#nullable disable
+        ;
+    [global::BlazorTest.Components.MyOutput.__PrivateComponentRenderModeAttribute]
+#nullable restore
+    public partial class MyOutput : global::Microsoft.AspNetCore.Components.ComponentBase
+#nullable disable
+    {
+#pragma warning disable 1998
+        protected override void BuildRenderTree(global::Microsoft.AspNetCore.Components.Rendering.RenderTreeBuilder __builder)
+        {
+            __builder.OpenElement(0, "div");
+            __builder.OpenElement(1, "p");
+            __builder.AddContent(2, "Value from InputText: ");
+            __builder.AddContent(3,
+#nullable restore
+Value
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(4, "\n    ");
+            __builder.OpenElement(5, "p");
+            __builder.AddContent(6, "Raw value from InputText: ");
+            __builder.AddContent(7,
+#nullable restore
+new MarkupString(Value)
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+        }
+#pragma warning restore 1998
+#nullable restore
+
+        [Parameter]
+        public string Value { get; set; } = "";
+
+#line default
+#line hidden
+#nullable disable
+
+        private sealed class __PrivateComponentRenderModeAttribute : global::Microsoft.AspNetCore.Components.RenderModeAttribute
+        {
+            private static global::Microsoft.AspNetCore.Components.IComponentRenderMode ModeImpl => InteractiveServer
+            ;
+            public override global::Microsoft.AspNetCore.Components.IComponentRenderMode Mode => ModeImpl;
+        }
+    }
+}
+#pragma warning restore 1591
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_Pages_TestPage_razor.g.cs
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/Components_Pages_TestPage_razor.g.cs
@@ -0,0 +1,567 @@
+// <auto-generated/>
+#pragma warning disable 1591
+namespace BlazorTest.Components.Pages
+{
+#line default
+    using global::System;
+    using global::System.Collections.Generic;
+    using global::System.Linq;
+    using global::System.Threading.Tasks;
+    using global::Microsoft.AspNetCore.Components;
+#nullable restore
+    using System.Net.Http
+
+#nullable disable
+        ;
+#nullable restore
+    using System.Net.Http.Json
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Forms
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Routing
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Web
+
+#nullable disable
+        ;
+#nullable restore
+    using static Microsoft.AspNetCore.Components.Web.RenderMode
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.AspNetCore.Components.Web.Virtualization
+
+#nullable disable
+        ;
+#nullable restore
+    using Microsoft.JSInterop
+
+#nullable disable
+        ;
+#nullable restore
+    using BlazorTest
+
+#nullable disable
+        ;
+#nullable restore
+    using BlazorTest.Components
+
+#line default
+#line hidden
+#nullable disable
+        ;
+    [global::Microsoft.AspNetCore.Components.RouteAttribute(
+    // language=Route,Component
+#nullable restore
+"/"
+
+#line default
+#line hidden
+#nullable disable
+    )]
+    [global::Microsoft.AspNetCore.Components.RouteAttribute(
+    // language=Route,Component
+#nullable restore
+"/test/{urlParam?}"
+
+#line default
+#line hidden
+#nullable disable
+    )]
+    [global::BlazorTest.Components.Pages.TestPage.__PrivateComponentRenderModeAttribute]
+#nullable restore
+    public partial class TestPage : global::Microsoft.AspNetCore.Components.ComponentBase
+#nullable disable
+    {
+#pragma warning disable 1998
+        protected override void BuildRenderTree(global::Microsoft.AspNetCore.Components.Rendering.RenderTreeBuilder __builder)
+        {
+            __builder.OpenComponent<global::Microsoft.AspNetCore.Components.Web.PageTitle>(0);
+            __builder.AddAttribute(1, "ChildContent", (global::Microsoft.AspNetCore.Components.RenderFragment)((__builder2) =>
+            {
+                __builder2.AddContent(2, "TestPage");
+            }
+            ));
+            __builder.CloseComponent();
+            __builder.AddMarkupContent(3, "\n\n");
+            __builder.OpenElement(4, "div");
+            __builder.AddMarkupContent(5, "<h3>Route parameter</h3>\n    ");
+            __builder.OpenElement(6, "p");
+            __builder.AddContent(7, "Go to: ");
+            __builder.OpenElement(8, "a");
+            __builder.AddAttribute(9, "href", "/test/" + (
+#nullable restore
+XssUrl
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddContent(10, "/test/");
+            __builder.AddContent(11,
+#nullable restore
+XssUrl
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(12, "\n    ");
+            __builder.OpenElement(13, "p");
+            __builder.AddContent(14, "Parameter from URL: ");
+            __builder.AddContent(15,
+#nullable restore
+UrlParam
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(16, "\n    ");
+            __builder.OpenElement(17, "p");
+            __builder.AddContent(18, "Raw parameter from URL: ");
+            __builder.AddContent(19,
+#nullable restore
+(MarkupString)UrlParam
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(20, "\n\n<hr>\n\n");
+            __builder.OpenElement(21, "div");
+            __builder.AddMarkupContent(22, "<h3>Query parameter</h3>\n    ");
+            __builder.OpenElement(23, "p");
+            __builder.AddContent(24, "Go to: ");
+            __builder.OpenElement(25, "a");
+            __builder.AddAttribute(26, "href", "/test/?qs=" + (
+#nullable restore
+XssUrl
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddContent(27, "/test/?qs=");
+            __builder.AddContent(28,
+#nullable restore
+XssUrl
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(29, "\n    ");
+            __builder.OpenElement(30, "p");
+            __builder.AddContent(31, "Parameter from query string: ");
+            __builder.AddContent(32,
+#nullable restore
+QueryParam
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(33, "\n    ");
+            __builder.OpenElement(34, "p");
+            __builder.AddContent(35, "Raw parameter from query string: ");
+            __builder.AddContent(36,
+#nullable restore
+new MarkupString(QueryParam)
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(37, "\n\n<hr>\n\n");
+            __builder.OpenElement(38, "div");
+            __builder.AddMarkupContent(39, "<h3>Bind InputText component</h3>\n    ");
+            __builder.OpenComponent<global::Microsoft.AspNetCore.Components.Forms.InputText>(40);
+            __builder.AddComponentParameter(41, nameof(global::Microsoft.AspNetCore.Components.Forms.InputText.
+#nullable restore
+Value
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.String>(
+#nullable restore
+InputValue1
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddComponentParameter(42, nameof(global::Microsoft.AspNetCore.Components.Forms.InputText.ValueChanged), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::Microsoft.AspNetCore.Components.EventCallback<global::System.String>>(global::Microsoft.AspNetCore.Components.EventCallback.Factory.Create<global::System.String>(this, global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.CreateInferredEventCallback(this, __value => InputValue1 = __value, InputValue1))));
+            __builder.AddComponentParameter(43, nameof(global::Microsoft.AspNetCore.Components.Forms.InputText.ValueExpression), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.Linq.Expressions.Expression<global::System.Func<global::System.String>>>(() => InputValue1));
+            __builder.CloseComponent();
+            __builder.AddMarkupContent(44, "\n    ");
+            __builder.OpenElement(45, "p");
+            __builder.AddContent(46, "Value from InputText: ");
+            __builder.AddContent(47,
+#nullable restore
+InputValue1
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(48, "\n    ");
+            __builder.OpenElement(49, "p");
+            __builder.AddContent(50, "Raw value from InputText: ");
+            __builder.AddContent(51,
+#nullable restore
+new MarkupString(InputValue1)
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(52, "\n\n<hr>\n\n");
+            __builder.OpenElement(53, "div");
+            __builder.AddMarkupContent(54, "<h3>Bind input element</h3>\n    ");
+            __builder.OpenElement(55, "input");
+            __builder.AddAttribute(56, "value", global::Microsoft.AspNetCore.Components.BindConverter.FormatValue(
+#nullable restore
+InputValue2
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddAttribute(57, "onchange", global::Microsoft.AspNetCore.Components.EventCallback.Factory.CreateBinder(this, __value => InputValue2 = __value, InputValue2));
+            __builder.SetUpdatesAttributeName("value");
+            __builder.CloseElement();
+            __builder.AddMarkupContent(58, "\n    ");
+            __builder.OpenElement(59, "p");
+            __builder.AddContent(60, "Value from InputText: ");
+            __builder.AddContent(61,
+#nullable restore
+InputValue2
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(62, "\n    ");
+            __builder.OpenElement(63, "p");
+            __builder.AddContent(64, "Raw value from InputText: ");
+            __builder.AddContent(65,
+#nullable restore
+new MarkupString(InputValue2)
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(66, "\n\n<hr>\n\n");
+            __builder.OpenElement(67, "div");
+            __builder.AddMarkupContent(68, "<h3>Bind through object property</h3>\n    ");
+            __builder.OpenElement(69, "input");
+            __builder.AddAttribute(70, "value", global::Microsoft.AspNetCore.Components.BindConverter.FormatValue(
+#nullable restore
+Container1.Value
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddAttribute(71, "onchange", global::Microsoft.AspNetCore.Components.EventCallback.Factory.CreateBinder(this, __value => Container1.Value = __value, Container1.Value));
+            __builder.SetUpdatesAttributeName("value");
+            __builder.CloseElement();
+            __builder.AddMarkupContent(72, "\n    ");
+            __builder.OpenElement(73, "p");
+            __builder.AddContent(74, "Value from InputText: ");
+            __builder.AddContent(75,
+#nullable restore
+Container1.Value
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(76, "\n    ");
+            __builder.OpenElement(77, "p");
+            __builder.AddContent(78, "Raw value from InputText: ");
+            __builder.AddContent(79,
+#nullable restore
+new MarkupString(Container1.Value)
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(80, "\n\n<hr>\n\n");
+            __builder.OpenElement(81, "div");
+            __builder.AddMarkupContent(82, "<h3>Input component with custom event</h3>\n    ");
+            __builder.OpenComponent<global::BlazorTest.Components.MyInput>(83);
+            __builder.AddComponentParameter(84, nameof(global::BlazorTest.Components.MyInput.
+#nullable restore
+Param1
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.String>(
+#nullable restore
+InputValue3
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddComponentParameter(85, nameof(global::BlazorTest.Components.MyInput.
+#nullable restore
+ValueChanged
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::Microsoft.AspNetCore.Components.EventCallback<global::System.String>>(global::Microsoft.AspNetCore.Components.EventCallback.Factory.Create<global::System.String>(this,
+#nullable restore
+MyInputChanged
+
+#line default
+#line hidden
+#nullable disable
+            )));
+            __builder.CloseComponent();
+            __builder.AddMarkupContent(86, "\n    ");
+            __builder.OpenElement(87, "p");
+            __builder.AddContent(88, "Value from InputText: ");
+            __builder.AddContent(89,
+#nullable restore
+InputValue3
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(90, "\n    ");
+            __builder.OpenElement(91, "p");
+            __builder.AddContent(92, "Raw value from InputText: ");
+            __builder.AddContent(93,
+#nullable restore
+new MarkupString(InputValue3)
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(94, "\n\n<hr>\n\n");
+            __builder.OpenElement(95, "div");
+            __builder.AddMarkupContent(96, "<h3>Input component with binding</h3>\n    ");
+            __builder.OpenComponent<global::BlazorTest.Components.MyInput>(97);
+            __builder.AddComponentParameter(98, nameof(global::BlazorTest.Components.MyInput.
+#nullable restore
+Param1
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.String>(
+#nullable restore
+InputValue4
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddComponentParameter(99, nameof(global::BlazorTest.Components.MyInput.Param1Changed), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::Microsoft.AspNetCore.Components.EventCallback<global::System.String>>(global::Microsoft.AspNetCore.Components.EventCallback.Factory.Create<global::System.String>(this, global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.CreateInferredEventCallback(this, __value => InputValue4 = __value, InputValue4))));
+            __builder.CloseComponent();
+            __builder.AddMarkupContent(100, "\n    ");
+            __builder.OpenElement(101, "p");
+            __builder.AddContent(102, "Value from InputText: ");
+            __builder.AddContent(103,
+#nullable restore
+InputValue4
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.AddMarkupContent(104, "\n    ");
+            __builder.OpenElement(105, "p");
+            __builder.AddContent(106, "Raw value from InputText: ");
+            __builder.AddContent(107,
+#nullable restore
+new MarkupString(InputValue4)
+
+#line default
+#line hidden
+#nullable disable
+            );
+            __builder.CloseElement();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(108, "\n\n<hr>\n\n");
+            __builder.OpenElement(109, "div");
+            __builder.AddMarkupContent(110, "<h3>Input, Output components</h3>\n    ");
+            __builder.OpenComponent<global::BlazorTest.Components.MyInput>(111);
+            __builder.AddComponentParameter(112, nameof(global::BlazorTest.Components.MyInput.
+#nullable restore
+Param1
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.String>(
+#nullable restore
+InputValue5
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddComponentParameter(113, nameof(global::BlazorTest.Components.MyInput.Param1Changed), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::Microsoft.AspNetCore.Components.EventCallback<global::System.String>>(global::Microsoft.AspNetCore.Components.EventCallback.Factory.Create<global::System.String>(this, global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.CreateInferredEventCallback(this, __value => InputValue5 = __value, InputValue5))));
+            __builder.CloseComponent();
+            __builder.AddMarkupContent(114, "\n    ");
+            __builder.OpenComponent<global::BlazorTest.Components.MyOutput>(115);
+            __builder.AddComponentParameter(116, nameof(global::BlazorTest.Components.MyOutput.
+#nullable restore
+Value
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.String>(
+#nullable restore
+InputValue5
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.CloseComponent();
+            __builder.CloseElement();
+            __builder.AddMarkupContent(117, "\n\n<hr>\n\n");
+            __builder.OpenElement(118, "div");
+            __builder.AddMarkupContent(119, "<h3>Bind InputText, Output component</h3>\n    ");
+            __builder.OpenComponent<global::Microsoft.AspNetCore.Components.Forms.InputText>(120);
+            __builder.AddComponentParameter(121, nameof(global::Microsoft.AspNetCore.Components.Forms.InputText.
+#nullable restore
+Value
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.String>(
+#nullable restore
+InputValue6
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.AddComponentParameter(122, nameof(global::Microsoft.AspNetCore.Components.Forms.InputText.ValueChanged), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::Microsoft.AspNetCore.Components.EventCallback<global::System.String>>(global::Microsoft.AspNetCore.Components.EventCallback.Factory.Create<global::System.String>(this, global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.CreateInferredEventCallback(this, __value => InputValue6 = __value, InputValue6))));
+            __builder.AddComponentParameter(123, nameof(global::Microsoft.AspNetCore.Components.Forms.InputText.ValueExpression), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.Linq.Expressions.Expression<global::System.Func<global::System.String>>>(() => InputValue6));
+            __builder.CloseComponent();
+            __builder.AddMarkupContent(124, "\n    ");
+            __builder.OpenComponent<global::BlazorTest.Components.MyOutput>(125);
+            __builder.AddComponentParameter(126, nameof(global::BlazorTest.Components.MyOutput.
+#nullable restore
+Value
+
+#line default
+#line hidden
+#nullable disable
+            ), global::Microsoft.AspNetCore.Components.CompilerServices.RuntimeHelpers.TypeCheck<global::System.String>(
+#nullable restore
+InputValue6
+
+#line default
+#line hidden
+#nullable disable
+            ));
+            __builder.CloseComponent();
+            __builder.CloseElement();
+        }
+#pragma warning restore 1998
+#nullable restore
+
+
+        public class Container
+        {
+            public string? Value { get; set; } = "";
+        }
+
+        private const string XssUrl = "<b>aaaa<%2Fb>";
+        private const string XssUrl2 = "<b>aaaa</b>";
+
+        [Parameter]
+        public string UrlParam { get; set; } = "";
+
+        [SupplyParameterFromQuery(Name = "qs")]
+        public string QueryParam { get; set; } = "";
+
+        public string InputValue1 { get; set; } = "";
+        public string InputValue2 { get; set; } = "";
+        public string InputValue3 { get; set; } = "";
+        public string InputValue4 { get; set; } = "";
+        public string InputValue5 { get; set; } = "";
+        public string InputValue6 { get; set; } = "";
+
+        public Container Container1 { get; set; } = new Container();
+
+        protected override void OnInitialized()
+        {
+            InputValue1 = XssUrl2;
+            InputValue2 = XssUrl2;
+            Container1.Value = XssUrl2;
+            InputValue3 = XssUrl2;
+            InputValue4 = XssUrl2;
+            InputValue5 = XssUrl2;
+            InputValue6 = XssUrl2;
+
+        }
+
+        private void MyInputChanged(string value)
+        {
+            InputValue3 = value;
+        }
+
+#line default
+#line hidden
+#nullable disable
+
+        private sealed class __PrivateComponentRenderModeAttribute : global::Microsoft.AspNetCore.Components.RenderModeAttribute
+        {
+            private static global::Microsoft.AspNetCore.Components.IComponentRenderMode ModeImpl => InteractiveServer
+            ;
+            public override global::Microsoft.AspNetCore.Components.IComponentRenderMode Mode => ModeImpl;
+        }
+    }
+}
+#pragma warning restore 1591
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/options
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/options
@@ -0,0 +1,2 @@
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj
+semmle-extractor-options: /nostdlib /noconfig
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/remoteFlowSource.expected
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/remoteFlowSource.expected
@@ -0,0 +1,4 @@
+| Components_Pages_TestPage_razor.g.cs:126:1:126:8 | access to property UrlParam | ASP.NET Core component route parameter |
+| Components_Pages_TestPage_razor.g.cs:138:15:138:22 | access to property UrlParam | ASP.NET Core component route parameter |
+| Components_Pages_TestPage_razor.g.cs:176:1:176:10 | access to property QueryParam | external |
+| Components_Pages_TestPage_razor.g.cs:188:18:188:27 | access to property QueryParam | external |
--- a/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/remoteFlowSource.ql
+++ b/csharp/ql/test/library-tests/frameworks/microsoft/aspnetcore/blazor/remoteFlowSource.ql
@@ -0,0 +1,7 @@
+import semmle.code.csharp.security.dataflow.flowsources.Remote
+
+from RemoteFlowSource source, File f
+where
+  source.getLocation().getFile() = f and
+  f.fromSource()
+select source, source.getSourceType()
--- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.2.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.2.rst
@@ -74,6 +74,7 @@ Golang

 *   Added member predicates :code:`StructTag.hasOwnFieldWithTag` and :code:`Field.getTag`, which enable CodeQL queries to examine struct field tags.
 *   Added member predicate :code:`InterfaceType.hasPrivateMethodWithQualifiedName`, which enables CodeQL queries to distinguish interfaces with matching non-exported method names that are declared in different packages, and are therefore incompatible.
+*   Local source models with the :code:`stdin` source kind have been added for the variable :code:`os.Stdin` and the functions :code:`fmt.Scan`, :code:`fmt.Scanf` and :code:`fmt.Scanln`. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see `Analyzing your code with CodeQL queries <https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data%3E>`__ and `Customizing your advanced setup for code scanning <https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models>`__.

 Python
 """"""
--- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.1.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.1.rst
@@ -56,8 +56,8 @@ Python

 *   The Server Side Template Injection query (:code:`py/template-injection`), originally contributed to the experimental query pack by @porcupineyhairs, has been promoted to the main query suite. This query finds instances of templates for a template engine such as Jinja being constructed with user input.

-Actions
-"""""""
+GitHub Actions
+""""""""""""""

 *   Initial public preview release

@@ -149,8 +149,8 @@ Python

 *   Added support for parameter annotations in API graphs. This means that in a function definition such as :code:`def foo(x: Bar): ...`, you can now use the :code:`getInstanceFromAnnotation()` method to step from :code:`Bar` to :code:`x`. In addition to this, the :code:`getAnInstance` method now also includes instances arising from parameter annotations.

-Actions
-"""""""
+GitHub Actions
+""""""""""""""

 *   Initial public preview release

--- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.4.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.4.rst
@@ -0,0 +1,223 @@
+.. _codeql-cli-2.20.4:
+
+==========================
+CodeQL 2.20.4 (2025-02-06)
+==========================
+
+.. contents:: Contents
+   :depth: 2
+   :local:
+   :backlinks: none
+
+This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
+
+Security Coverage
+-----------------
+
+CodeQL 2.20.4 runs a total of 454 security queries when configured with the Default suite (covering 168 CWE). The Extended suite enables an additional 128 queries (covering 34 more CWE).
+
+CodeQL CLI
+----------
+
+Bug Fixes
+~~~~~~~~~
+
+*   Fixed a bug where CodeQL for Java would fail with an SSL exception while trying to download :code:`maven`.
+
+New Features
+~~~~~~~~~~~~
+
+*   Using the :code:`actions` language (for analysis of GitHub Actions workflows) no longer requires the :code:`CODEQL_ENABLE_EXPERIMENTAL_FEATURES` environment variable to be set. Support for analysis of GitHub Actions workflows remains in public preview.
+
+Miscellaneous
+~~~~~~~~~~~~~
+
+*   The build of the `logback-core <https://logback.qos.ch/>`__ library that is used for logging in the CodeQL CLI has been updated to version 1.3.15.
+
+Query Packs
+-----------
+
+Bug Fixes
+~~~~~~~~~
+
+JavaScript/TypeScript
+"""""""""""""""""""""
+
+*   Fixed a bug that would occur when TypeScript code was found in an HTML-like file, such as a :code:`.vue` file,
+    but where it could not be associated with any :code:`tsconfig.json` file. Previously the embedded code was not extracted in this case, but should now be extracted properly.
+
+Major Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+JavaScript/TypeScript
+"""""""""""""""""""""
+
+*   Improved support for NestJS applications that make use of dependency injection with custom providers.
+    Calls to methods on an injected service should now be resolved properly.
+*   TypeScript extraction is now better at analyzing projects where the main :code:`tsconfig.json` file does not include any source files, but references other :code:`tsconfig.json`\ -like files that do include source files.
+*   The :code:`js/incorrect-suffix-check` query now recognises some good patterns of the form :code:`origin.indexOf("." + allowedOrigin)` that were previously falsely flagged.
+*   Added a new threat model kind called :code:`view-component-input`, which can enabled with `advanced setup <https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models>`__.
+    When enabled, all React props, Vue props, and input fields in an Angular component are seen as taint sources, even if none of the corresponding instantiation sites appear to pass in a tainted value.
+    Some users may prefer this as a "defense in depth" option but note that it may result in false positives.
+    Regardless of whether the threat model is enabled, CodeQL will propagate taint from the instantiation sites of such components into the components themselves.
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   The "Wrong type of arguments to formatting function" query (:code:`cpp/wrong-type-format-argument`) now produces fewer FPs if the formatting function has multiple definitions.
+*   The "Call to memory access function may overflow buffer" query (:code:`cpp/overflow-buffer`) now produces fewer FPs involving non-static member variables.
+
+C#
+""
+
+*   All *experimental* queries have been deprecated. The queries are instead available as part of the *default* query suite in `CodeQL-Community-Packs <https://github.com/GitHubSecurityLab/CodeQL-Community-Packs>`__.
+
+Java/Kotlin
+"""""""""""
+
+*   All *experimental* queries have been deprecated. The queries are instead available as part of the *default* query suite in `CodeQL-Community-Packs <https://github.com/GitHubSecurityLab/CodeQL-Community-Packs>`__.
+
+Language Libraries
+------------------
+
+Bug Fixes
+~~~~~~~~~
+
+GitHub Actions
+""""""""""""""
+
+*   Fixed data for vulnerable versions of :code:`actions/download-artifact` and :code:`rlespinasse/github-slug-action` (following GHSA-cxww-7g56-2vh6 and GHSA-6q4m-7476-932w).
+*   Improved :code:`untrustedGhCommandDataModel` regex for :code:`gh pr view` and Bash taint analysis in GitHub Actions.
+
+Breaking Changes
+~~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   Deleted the deprecated :code:`getAllocatorCall` predicate from :code:`DeleteOrDeleteArrayExpr`, use :code:`getDeallocatorCall` instead.
+
+C#
+""
+
+*   Deleted the deprecated :code:`getInstanceType` predicate from the :code:`UnboundGenericType` class.
+*   Deleted the deprecated :code:`getElement` predicate from the :code:`Node` class in :code:`ControlFlowGraph.qll`, use :code:`getAstNode` instead.
+
+Golang
+""""""
+
+*   Deleted the deprecated :code:`describeBitSize` predicate from :code:`IncorrectIntegerConversionLib.qll`
+
+Java/Kotlin
+"""""""""""
+
+*   Deleted the deprecated :code:`isLValue` and :code:`isRValue` predicates from the :code:`VarAccess` class, use :code:`isVarWrite` and :code:`isVarRead` respectively instead.
+*   Deleted the deprecated :code:`getRhs` predicate from the :code:`VarWrite` class, use :code:`getASource` instead.
+*   Deleted the deprecated :code:`LValue` and :code:`RValue` classes, use :code:`VarWrite` and :code:`VarRead` respectively instead.
+*   Deleted a lot of deprecated classes ending in ``*Access``, use the corresponding ``*Call`` classes instead.
+*   Deleted a lot of deprecated predicates ending in ``*Access``, use the corresponding ``*Call`` predicates instead.
+*   Deleted the deprecated :code:`EnvInput` and :code:`DatabaseInput` classes from :code:`FlowSources.qll`, use the threat models feature instead.
+*   Deleted some deprecated API predicates from :code:`SensitiveApi.qll`, use the Sink classes from that file instead.
+
+Python
+""""""
+
+*   Deleted the old deprecated TypeTracking library.
+*   Deleted the deprecated :code:`classRef` predicate from the :code:`FieldStorage` module, use :code:`subclassRef` instead.
+*   Deleted a lot of deprecated modules and predicates from :code:`Stdlib.qll`, use API-graphs directly instead.
+
+Ruby
+""""
+
+*   Deleted the deprecated :code:`getCallNode` predicate from :code:`API::Node`, use :code:`asCall()` instead.
+*   Deleted the deprecated :code:`getASubclass`, :code:`getAnImmediateSubclass`, :code:`getASuccessor`, :code:`getAPredecessor`, :code:`getASuccessor`, :code:`getDepth`, and :code:`getPath` predicates from :code:`API::Node`.
+*   Deleted the deprecated :code:`Root`, :code:`Use`, and :code:`Def` classes from :code:`ApiGraphs.qll`.
+*   Deleted the deprecated :code:`Label` module from :code:`ApiGraphs.qll`.
+*   Deleted the deprecated :code:`getAUse`, :code:`getAnImmediateUse`, :code:`getARhs`, and :code:`getAValueReachingRhs` predicates from :code:`API::Node`, use :code:`getAValueReachableFromSource`, :code:`asSource`, :code:`asSink`, and :code:`getAValueReachingSink` instead.
+*   Deleted the deprecated :code:`getAVariable` predicate from the :code:`ExprNode` class, use :code:`getVariable` instead.
+*   Deleted the deprecated :code:`getAPotentialFieldAccessMethod` predicate from the :code:`ActiveRecordModelClass` class.
+*   Deleted the deprecated :code:`ActiveRecordModelClassMethodCall` class from :code:`ActiveRecord.qll`, use :code:`ActiveRecordModelClass.getClassNode().trackModule().getMethod()` instead.
+*   Deleted the deprecated :code:`PotentiallyUnsafeSqlExecutingMethodCall` class from :code:`ActiveRecord.qll`, use the :code:`SqlExecution` concept instead.
+*   Deleted the deprecated :code:`ModelClass` and :code:`ModelInstance` classes from :code:`ActiveResource.qll`, use :code:`ModelClassNode` and :code:`ModelClassNode.getAnInstanceReference()` instead.
+*   Deleted the deprecated :code:`Collection` class from :code:`ActiveResource.qll`, use :code:`CollectionSource` instead.
+*   Deleted the deprecated :code:`ServiceInstantiation` and :code:`ClientInstantiation` classes from :code:`Twirp.qll`.
+*   Deleted a lot of deprecated dataflow modules from ``*Query.qll`` files.
+*   Deleted the old deprecated TypeTracking library.
+
+Swift
+"""""
+
+*   Deleted the deprecated :code:`ArrayContent` class from the dataflow library, use :code:`CollectionContent` instead.
+*   Deleted the deprecated :code:`getOptionsInput`, :code:`getRegexInput`, and :code:`getStringInput` predicates from the regexp library, use :code:`getAnOptionsInput`, :code:`getRegexInputNode`, and :code:`getStringInputNode` instead.
+
+Major Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+JavaScript/TypeScript
+"""""""""""""""""""""
+
+*   Added new XSS sink where :code:`innerHTML` or :code:`outerHTML` is assigned to with the Angular Renderer2 API, plus modeled this API as a general attribute setter
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+C#
+""
+
+*   C# 13: Added MaD models for some overload implementations using :code:`ReadOnlySpan` parameters (like :code:`String.Format(System.String, System.ReadOnlySpan<System.Object>))`).
+*   C# 13: Added support for the overload resolution priority attribute (:code:`OverloadResolutionPriority`). Usages of the attribute and the corresponding priority can be found using the QL class :code:`SystemRuntimeCompilerServicesOverloadResolutionPriorityAttribute`.
+*   C# 13: Added support for partial properties and indexers.
+
+Golang
+""""""
+
+*   Models-as-data models using "Parameter", "Parameter[n]" or "Parameter[n1..n2]" as the output now work correctly.
+*   By implementing :code:`ImplicitFieldReadNode` it is now possible to declare a dataflow node that reads any content (fields, array members, map keys and values). For example, this is appropriate for modelling a serialization method that flattens a potentially deep data structure into a string or byte array.
+*   The :code:`Template.Execute[Template]` methods of the :code:`text/template` package now correctly convey taint from any nested fields to their result. This may produce more results from any taint-tracking query when the :code:`text/template` package is in use.
+*   Added the `rs cors <https://github.com/rs/cors>`__ library to the CorsMisconfiguration.ql query
+
+Java/Kotlin
+"""""""""""
+
+*   We now allow classes which don't have any JAX-RS annotations to inherit JAX-RS annotations from superclasses or interfaces. This is not allowed in the JAX-RS specification, but some implementations, like Apache CXF, allow it. This may lead to more alerts being found.
+
+Python
+""""""
+
+*   Additional data flow models for the builtin functions :code:`map`, :code:`filter`, :code:`zip`, and :code:`enumerate` have been added.
+
+New Features
+~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   A new predicate :code:`getOffsetInClass` was added to the :code:`Field` class, which computes the byte offset of a field relative to a given :code:`Class`.
+*   New classes :code:`PreprocessorElifdef` and :code:`PreprocessorElifndef` were introduced, which represents the C23/C++23 :code:`#elifdef` and :code:`#elifndef` preprocessor directives.
+*   A new class :code:`TypeLibraryImport` was introduced, which represents the :code:`#import` preprocessor directive as used by the Microsoft Visual C++ for importing type libraries.
+
+Shared Libraries
+----------------
+
+Breaking Changes
+~~~~~~~~~~~~~~~~
+
+Dataflow Analysis
+"""""""""""""""""
+
+*   Deleted the deprecated :code:`Make` and :code:`MakeWithState` modules, use :code:`Global` and :code:`GlobalWithState` instead.
+*   Deleted the deprecated :code:`hasFlow`, :code:`hasFlowPath`, :code:`hasFlowTo`, and :code:`hasFlowToExpr` predicates, use :code:`flow`, :code:`flowPath`, :code:`flowTo`, and :code:`flowToExpr` respectively instead.
+
+Control Flow Analysis
+"""""""""""""""""""""
+
+*   Added a basic block construction as part of the library. This is currently considered an internal unstable API. The input signature to the control flow graph now requires two additional predicates: :code:`idOfAstNode` and
+    :code:`idOfCfgScope`.
+
+Type Trackers
+"""""""""""""
+
+*   Deleted the deprecated :code:`ConsistencyChecks` module.
--- a/docs/codeql/codeql-overview/codeql-changelog/index.rst
+++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst
@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
 .. toctree::
   :maxdepth: 1

+   codeql-cli-2.20.4
   codeql-cli-2.20.3
   codeql-cli-2.20.2
   codeql-cli-2.20.1
--- a/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/maven-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/maven-fetches.expected
@@ -11,23 +11,23 @@ Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferst
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/fasterxml/jackson/jackson-bom/2.14.1/jackson-bom-2.14.1.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/fasterxml/jackson/jackson-parent/2.14/jackson-parent-2.14.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/fasterxml/oss-parent/48/oss-parent-48.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3/depgraph-maven-plugin-4.0.3.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3/depgraph-maven-plugin-4.0.3.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3-CodeQL/depgraph-maven-plugin-4.0.3-CodeQL.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3-CodeQL/depgraph-maven-plugin-4.0.3-CodeQL.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.11.0/error_prone_annotations-2.11.0.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.11.0/error_prone_annotations-2.11.0.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_parent/2.11.0/error_prone_parent-2.11.0.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.36.0/error_prone_annotations-2.36.0.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.36.0/error_prone_annotations-2.36.0.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_parent/2.36.0/error_prone_parent-2.36.0.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.2/failureaccess-1.0.2.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.2/failureaccess-1.0.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava-parent/26.0-android/guava-parent-26.0-android.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava-parent/31.1-jre/guava-parent-31.1-jre.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/31.1-jre/guava-31.1-jre.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava-parent/33.4.0-jre/guava-parent-33.4.0-jre.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/33.4.0-jre/guava-33.4.0-jre.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/33.4.0-jre/guava-33.4.0-jre.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/1.3/j2objc-annotations-1.3.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/1.3/j2objc-annotations-1.3.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/3.0.0/j2objc-annotations-3.0.0.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/3.0.0/j2objc-annotations-3.0.0.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/javax/annotation/javax.annotation-api/1.2/javax.annotation-api-1.2.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/javax/annotation/javax.annotation-api/1.2/javax.annotation-api-1.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/net/java/jvnet-parent/3/jvnet-parent-3.pom
@@ -49,8 +49,8 @@ Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferst
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/apache/maven/shared/maven-common-artifact-filters/3.3.2/maven-common-artifact-filters-3.3.2.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/apache/maven/shared/maven-common-artifact-filters/3.3.2/maven-common-artifact-filters-3.3.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/apache/maven/shared/maven-shared-components/37/maven-shared-components-37.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.12.0/checker-qual-3.12.0.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.12.0/checker-qual-3.12.0.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.43.0/checker-qual-3.43.0.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.43.0/checker-qual-3.43.0.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/codehaus/plexus/plexus-classworlds/2.5.2/plexus-classworlds-2.5.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/codehaus/plexus/plexus-classworlds/2.6.0/plexus-classworlds-2.6.0.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/codehaus/plexus/plexus-classworlds/2.6.0/plexus-classworlds-2.6.0.pom
--- a/java/ql/integration-tests/java/buildless-maven-timeout/diagnostics.expected
+++ b/java/ql/integration-tests/java/buildless-maven-timeout/diagnostics.expected
@@ -83,7 +83,7 @@
  }
 }
 {
-  "markdownMessage": "Running the Maven plugin `com.github.ferstl:depgraph-maven-plugin:4.0.3:graph` failed. This means precise dependency information will be unavailable, and so dependencies will be guessed based on Java package names. Consider investigating why this plugin fails to run.",
+  "markdownMessage": "Running the Maven plugin `com.github.ferstl:depgraph-maven-plugin:4.0.3-CodeQL:graph` failed. This means precise dependency information will be unavailable, and so dependencies will be guessed based on Java package names. Consider investigating why this plugin fails to run.",
  "severity": "note",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/diagnostics.expected
+++ b/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/diagnostics.expected
@@ -97,7 +97,7 @@
  }
 }
 {
-  "markdownMessage": "Running the Maven plugin `com.github.ferstl:depgraph-maven-plugin:4.0.3:graph` yielded an artifact transfer exception. This means some dependency information will be unavailable, and so some dependencies will be guessed based on Java package names. Consider investigating why this plugin encountered errors retrieving dependencies.",
+  "markdownMessage": "Running the Maven plugin `com.github.ferstl:depgraph-maven-plugin:4.0.3-CodeQL:graph` yielded an artifact transfer exception. This means some dependency information will be unavailable, and so some dependencies will be guessed based on Java package names. Consider investigating why this plugin encountered errors retrieving dependencies.",
  "severity": "note",
  "source": {
    "extractorName": "java",
--- a/java/ql/integration-tests/java/buildless-maven/maven-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven/maven-fetches.expected
@@ -11,23 +11,23 @@ Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferst
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/fasterxml/jackson/jackson-bom/2.14.1/jackson-bom-2.14.1.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/fasterxml/jackson/jackson-parent/2.14/jackson-parent-2.14.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/fasterxml/oss-parent/48/oss-parent-48.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3/depgraph-maven-plugin-4.0.3.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3/depgraph-maven-plugin-4.0.3.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3-CodeQL/depgraph-maven-plugin-4.0.3-CodeQL.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/github/ferstl/depgraph-maven-plugin/4.0.3-CodeQL/depgraph-maven-plugin-4.0.3-CodeQL.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.11.0/error_prone_annotations-2.11.0.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.11.0/error_prone_annotations-2.11.0.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_parent/2.11.0/error_prone_parent-2.11.0.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.36.0/error_prone_annotations-2.36.0.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_annotations/2.36.0/error_prone_annotations-2.36.0.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/errorprone/error_prone_parent/2.36.0/error_prone_parent-2.36.0.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.2/failureaccess-1.0.2.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/failureaccess/1.0.2/failureaccess-1.0.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava-parent/26.0-android/guava-parent-26.0-android.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava-parent/31.1-jre/guava-parent-31.1-jre.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/31.1-jre/guava-31.1-jre.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/31.1-jre/guava-31.1-jre.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava-parent/33.4.0-jre/guava-parent-33.4.0-jre.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/33.4.0-jre/guava-33.4.0-jre.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/guava/33.4.0-jre/guava-33.4.0-jre.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/1.3/j2objc-annotations-1.3.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/1.3/j2objc-annotations-1.3.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/3.0.0/j2objc-annotations-3.0.0.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/com/google/j2objc/j2objc-annotations/3.0.0/j2objc-annotations-3.0.0.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/javax/annotation/javax.annotation-api/1.2/javax.annotation-api-1.2.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/javax/annotation/javax.annotation-api/1.2/javax.annotation-api-1.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/net/java/jvnet-parent/3/jvnet-parent-3.pom
@@ -49,8 +49,8 @@ Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferst
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/apache/maven/shared/maven-common-artifact-filters/3.3.2/maven-common-artifact-filters-3.3.2.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/apache/maven/shared/maven-common-artifact-filters/3.3.2/maven-common-artifact-filters-3.3.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/apache/maven/shared/maven-shared-components/37/maven-shared-components-37.pom
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.12.0/checker-qual-3.12.0.jar
-Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.12.0/checker-qual-3.12.0.pom
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.43.0/checker-qual-3.43.0.jar
+Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/checkerframework/checker-qual/3.43.0/checker-qual-3.43.0.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/codehaus/plexus/plexus-classworlds/2.5.2/plexus-classworlds-2.5.2.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/codehaus/plexus/plexus-classworlds/2.6.0/plexus-classworlds-2.6.0.jar
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/codehaus/plexus/plexus-classworlds/2.6.0/plexus-classworlds-2.6.0.pom
--- a/java/ql/src/Telemetry/DatabaseQuality.qll
+++ b/java/ql/src/Telemetry/DatabaseQuality.qll
@@ -4,33 +4,7 @@
 */

 import java
-
-signature module StatsSig {
-  int getNumberOfOk();
-
-  int getNumberOfNotOk();
-
-  string getOkText();
-
-  string getNotOkText();
-}
-
-module ReportStats<StatsSig Stats> {
-  predicate numberOfOk(string key, int value) {
-    value = Stats::getNumberOfOk() and
-    key = "Number of " + Stats::getOkText()
-  }
-
-  predicate numberOfNotOk(string key, int value) {
-    value = Stats::getNumberOfNotOk() and
-    key = "Number of " + Stats::getNotOkText()
-  }
-
-  predicate percentageOfOk(string key, float value) {
-    value = Stats::getNumberOfOk() * 100.0 / (Stats::getNumberOfOk() + Stats::getNumberOfNotOk()) and
-    key = "Percentage of " + Stats::getOkText()
-  }
-}
+import codeql.util.ReportStats

 module CallTargetStats implements StatsSig {
  int getNumberOfOk() { result = count(Call c | exists(c.getCallee())) }
--- a/javascript/extractor/src/com/semmle/js/extractor/CFGExtractor.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/CFGExtractor.java
@@ -586,14 +586,6 @@ public class CFGExtractor {
    public static List<Identifier> of(Program p) {
      return of(p.getBody());
    }
-
-    public static List<Identifier> of(IFunction fn) {
-      Node body = fn.getBody();
-      if (body instanceof BlockStatement) return of(((BlockStatement) body).getBody());
-      // if the body of the function is missing or is an expression, then there are
-      // no hoisted functions
-      return Collections.emptyList();
-    }
  }

  /**
@@ -1096,8 +1088,6 @@ public class CFGExtractor {
      if (nd.hasRest()) paramsAndDefaults.add((Expression) nd.getRest());

      Node entry = getEntryNode(nd);
-      List<Identifier> fns = HoistedFunDecls.of(nd);
-      hoistedFns.addAll(fns);

      // if this is the constructor of a class without a superclass, we need to
      // initialise all fields before running the body of the constructor
@@ -1117,7 +1107,7 @@ public class CFGExtractor {
      if (firstField != null) fst = Collections.singleton(First.of(firstField));
      fst =
          visitSequence(
-              nd instanceof FunctionDeclaration ? null : nd.getId(), paramsAndDefaults, fns, fst);
+              nd instanceof FunctionDeclaration ? null : nd.getId(), paramsAndDefaults, fst);
      writeSuccessors(entry, fst);

      this.ctxt.pop();
@@ -1255,9 +1245,12 @@ public class CFGExtractor {

    @Override
    public Void visit(BlockStatement nd, SuccessorInfo i) {
-      if (nd.getBody().isEmpty()) writeSuccessors(nd, i.getAllSuccessors());
-      else writeSuccessor(nd, First.of(nd.getBody().get(0)));
-      visitSequence(nd.getBody(), i.getAllSuccessors());
+      // Hoist function declarations in a block statement to the top of the block.
+      // This reflects non-standard behaviour implemented by most engines.
+      // See also: ECMAScript "B.3.2 Block-Level Function Declarations Web Legacy Compatibility Semantics".
+      List<Identifier> hoisted = HoistedFunDecls.of(nd.getBody());
+      hoistedFns.addAll(hoisted);
+      writeSuccessors(nd, visitSequence(hoisted, nd.getBody(), i.getAllSuccessors()));
      return null;
    }

--- a/javascript/extractor/src/com/semmle/js/extractor/Main.java
+++ b/javascript/extractor/src/com/semmle/js/extractor/Main.java
@@ -42,7 +42,7 @@ public class Main {
   * A version identifier that should be updated every time the extractor changes in such a way that
   * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
   */
-  public static final String EXTRACTOR_VERSION = "2025-01-21";
+  public static final String EXTRACTOR_VERSION = "2025-02-03";

  public static final Pattern NEWLINE = Pattern.compile("\n");

--- a/javascript/extractor/tests/cfg/output/trap/classexpr3.js.trap
+++ b/javascript/extractor/tests/cfg/output/trap/classexpr3.js.trap
@@ -163,12 +163,12 @@ hasLocation(#20044,#20028)
 #20045=*
 exit_cfg_node(#20045,#20030)
 hasLocation(#20045,#20028)
-successor(#20035,#20036)
 successor(#20036,#20038)
 successor(#20040,#20039)
 successor(#20039,#20037)
 successor(#20038,#20040)
 successor(#20037,#20045)
+successor(#20035,#20036)
 successor(#20033,#20035)
 successor(#20044,#20033)
 successor(#20029,#20030)
--- a/javascript/extractor/tests/cfg/output/trap/classexpr4.js.trap
+++ b/javascript/extractor/tests/cfg/output/trap/classexpr4.js.trap
@@ -184,12 +184,12 @@ hasLocation(#20050,#20034)
 #20051=*
 exit_cfg_node(#20051,#20036)
 hasLocation(#20051,#20034)
-successor(#20041,#20042)
 successor(#20042,#20044)
 successor(#20046,#20045)
 successor(#20045,#20043)
 successor(#20044,#20046)
 successor(#20043,#20051)
+successor(#20041,#20042)
 successor(#20039,#20041)
 successor(#20050,#20039)
 successor(#20035,#20036)
--- a/javascript/extractor/tests/cfg/output/trap/fields.js.trap
+++ b/javascript/extractor/tests/cfg/output/trap/fields.js.trap
@@ -671,7 +671,6 @@ exit_cfg_node(#20215,#20188)
 #20216=@"loc,{#10000},16,4,16,3"
 locations_default(#20216,#10000,16,4,16,3)
 hasLocation(#20215,#20216)
-successor(#20192,#20194)
 successor(#20203,#20205)
 successor(#20205,#20215)
 successor(#20198,#20202)
@@ -680,6 +679,7 @@ successor(#20207,#20203)
 successor(#20200,#20209)
 successor(#20194,#20196)
 successor(#20196,#20198)
+successor(#20192,#20194)
 successor(#20213,#20192)
 successor(#20187,#20188)
 successor(#20185,#20180)
@@ -729,9 +729,9 @@ exit_cfg_node(#20227,#20146)
 #20228=@"loc,{#10000},4,4,4,3"
 locations_default(#20228,#10000,4,4,4,3)
 hasLocation(#20227,#20228)
-successor(#20150,#20152)
 successor(#20152,#20154)
 successor(#20154,#20227)
+successor(#20150,#20152)
 successor(#20225,#20158)
 successor(#20145,#20146)
 successor(#20143,#20164)
--- a/javascript/extractor/tests/cfg/output/trap/tst.js.trap
+++ b/javascript/extractor/tests/cfg/output/trap/tst.js.trap
@@ -1425,30 +1425,30 @@ successor(#20455,#20457)
 successor(#20457,#20461)
 successor(#20432,#20434)
 successor(#20434,#20436)
-successor(#20436,#20438)
 successor(#20438,#20442)
 successor(#20442,#20440)
 successor(#20440,#20443)
+successor(#20436,#20438)
 successor(#20414,#20416)
-successor(#20416,#20420)
 successor(#20420,#20418)
 successor(#20418,#20422)
 successor(#20418,#20432)
 successor(#20424,#20418)
 successor(#20422,#20424)
+successor(#20416,#20420)
 successor(#20425,#20429)
 successor(#20430,#20432)
 successor(#20429,#20430)
 successor(#20392,#20394)
 successor(#20394,#20412)
 successor(#20396,#20400)
-successor(#20401,#20403)
 successor(#20403,#20409)
 successor(#20411,#20407)
 successor(#20409,#20411)
 successor(#20407,#20412)
 successor(#20407,#20405)
 successor(#20405,#20412)
+successor(#20401,#20403)
 successor(#20400,#20401)
 successor(#20412,#20414)
 successor(#20371,#20392)
@@ -1462,7 +1462,6 @@ exit_cfg_node(#20468,#20371)
 #20469=@"loc,{#10000},18,2,18,1"
 locations_default(#20469,#10000,18,2,18,1)
 hasLocation(#20468,#20469)
-successor(#20379,#20383)
 successor(#20383,#20381)
 successor(#20381,#20384)
 successor(#20381,#20468)
@@ -1481,6 +1480,7 @@ successor(#20391,#20381)
 successor(#20384,#20387)
 successor(#20387,#20386)
 successor(#20386,#20388)
+successor(#20379,#20383)
 successor(#20377,#20379)
 successor(#20466,#20377)
 successor(#20365,#20367)
@@ -1504,7 +1504,6 @@ exit_cfg_node(#20475,#20322)
 #20476=@"loc,{#10000},10,2,10,1"
 locations_default(#20476,#10000,10,2,10,1)
 hasLocation(#20475,#20476)
-successor(#20328,#20330)
 successor(#20356,#20358)
 successor(#20358,#20359)
 successor(#20359,#20361)
@@ -1539,6 +1538,7 @@ successor(#20330,#20334)
 successor(#20335,#20332)
 successor(#20334,#20335)
 successor(#20332,#20336)
+successor(#20328,#20330)
 successor(#20474,#20328)
 successor(#20373,#20322)
 successor(#20324,#20373)
--- a/javascript/extractor/tests/es2015/output/trap/array_pattern_with_rest.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/array_pattern_with_rest.js.trap
@@ -235,7 +235,6 @@ hasLocation(#20074,#20072)
 #20075=*
 exit_cfg_node(#20075,#20051)
 hasLocation(#20075,#20048)
-successor(#20058,#20060)
 successor(#20070,#20068)
 successor(#20068,#20075)
 successor(#20060,#20067)
@@ -243,6 +242,7 @@ successor(#20064,#20066)
 successor(#20066,#20062)
 successor(#20067,#20064)
 successor(#20062,#20070)
+successor(#20058,#20060)
 successor(#20056,#20058)
 successor(#20074,#20056)
 successor(#20052,#20051)
--- a/javascript/extractor/tests/es2015/output/trap/arrowfn.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/arrowfn.js.trap
@@ -509,11 +509,11 @@ exit_cfg_node(#20163,#20143)
 #20164=@"loc,{#10000},3,40,3,39"
 locations_default(#20164,#10000,3,40,3,39)
 hasLocation(#20163,#20164)
-successor(#20146,#20148)
 successor(#20148,#20152)
 successor(#20154,#20150)
 successor(#20152,#20154)
 successor(#20150,#20163)
+successor(#20146,#20148)
 successor(#20161,#20146)
 successor(#20141,#20143)
 successor(#20139,#20160)
--- a/javascript/extractor/tests/es2015/output/trap/class_accessors.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/class_accessors.js.trap
@@ -434,7 +434,6 @@ exit_cfg_node(#20134,#20101)
 #20135=@"loc,{#10000},7,4,7,3"
 locations_default(#20135,#10000,7,4,7,3)
 hasLocation(#20134,#20135)
-successor(#20107,#20109)
 successor(#20109,#20115)
 successor(#20119,#20117)
 successor(#20117,#20111)
@@ -442,6 +441,7 @@ successor(#20116,#20113)
 successor(#20115,#20116)
 successor(#20113,#20119)
 successor(#20111,#20134)
+successor(#20107,#20109)
 successor(#20105,#20107)
 successor(#20132,#20105)
 successor(#20100,#20101)
@@ -457,11 +457,11 @@ exit_cfg_node(#20138,#20086)
 #20139=@"loc,{#10000},4,4,4,3"
 locations_default(#20139,#10000,4,4,4,3)
 hasLocation(#20138,#20139)
-successor(#20090,#20096)
 successor(#20097,#20094)
 successor(#20096,#20097)
 successor(#20094,#20092)
 successor(#20092,#20138)
+successor(#20090,#20096)
 successor(#20136,#20090)
 successor(#20085,#20086)
 successor(#20083,#20100)
--- a/javascript/extractor/tests/es2015/output/trap/class_ctor.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/class_ctor.js.trap
@@ -246,13 +246,13 @@ exit_cfg_node(#20076,#20054)
 #20077=@"loc,{#10000},4,4,4,3"
 locations_default(#20077,#10000,4,4,4,3)
 hasLocation(#20076,#20077)
-successor(#20060,#20062)
 successor(#20062,#20068)
 successor(#20070,#20064)
 successor(#20069,#20066)
 successor(#20068,#20069)
 successor(#20066,#20070)
 successor(#20064,#20076)
+successor(#20060,#20062)
 successor(#20058,#20060)
 successor(#20074,#20058)
 successor(#20053,#20054)
--- a/javascript/extractor/tests/es2015/output/trap/class_extends.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/class_extends.js.trap
@@ -159,12 +159,12 @@ hasLocation(#20042,#20026)
 #20043=*
 exit_cfg_node(#20043,#20028)
 hasLocation(#20043,#20026)
-successor(#20033,#20034)
 successor(#20034,#20036)
 successor(#20038,#20037)
 successor(#20037,#20035)
 successor(#20036,#20038)
 successor(#20035,#20043)
+successor(#20033,#20034)
 successor(#20031,#20033)
 successor(#20042,#20031)
 successor(#20027,#20028)
--- a/javascript/extractor/tests/es2015/output/trap/class_extends2.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/class_extends2.js.trap
@@ -261,12 +261,12 @@ hasLocation(#20075,#20059)
 #20076=*
 exit_cfg_node(#20076,#20061)
 hasLocation(#20076,#20059)
-successor(#20066,#20067)
 successor(#20067,#20069)
 successor(#20071,#20070)
 successor(#20070,#20068)
 successor(#20069,#20071)
 successor(#20068,#20076)
+successor(#20066,#20067)
 successor(#20064,#20066)
 successor(#20075,#20064)
 successor(#20060,#20061)
--- a/javascript/extractor/tests/es2015/output/trap/class_method.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/class_method.js.trap
@@ -253,11 +253,11 @@ exit_cfg_node(#20076,#20050)
 #20077=@"loc,{#10000},4,4,4,3"
 locations_default(#20077,#10000,4,4,4,3)
 hasLocation(#20076,#20077)
-successor(#20054,#20060)
 successor(#20061,#20058)
 successor(#20060,#20061)
 successor(#20058,#20056)
 successor(#20056,#20076)
+successor(#20054,#20060)
 successor(#20074,#20054)
 successor(#20049,#20050)
 successor(#20047,#20064)
--- a/javascript/extractor/tests/es2015/output/trap/class_static.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/class_static.js.trap
@@ -243,9 +243,9 @@ exit_cfg_node(#20073,#20048)
 #20074=@"loc,{#10000},4,4,4,3"
 locations_default(#20074,#10000,4,4,4,3)
 hasLocation(#20073,#20074)
-successor(#20052,#20056)
 successor(#20056,#20054)
 successor(#20054,#20073)
+successor(#20052,#20056)
 successor(#20071,#20052)
 successor(#20047,#20048)
 successor(#20045,#20061)
--- a/javascript/extractor/tests/es2015/output/trap/delegating_yield.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/delegating_yield.js.trap
@@ -171,11 +171,11 @@ hasLocation(#20054,#20052)
 #20055=*
 exit_cfg_node(#20055,#20037)
 hasLocation(#20055,#20034)
-successor(#20041,#20043)
 successor(#20043,#20049)
 successor(#20049,#20047)
 successor(#20047,#20045)
 successor(#20045,#20055)
+successor(#20041,#20043)
 successor(#20054,#20041)
 successor(#20038,#20037)
 successor(#20051,#20038)
--- a/javascript/extractor/tests/es2015/output/trap/destructuring.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/destructuring.js.trap
@@ -822,7 +822,6 @@ hasLocation(#20266,#20267)
 #20268=*
 exit_cfg_node(#20268,#20230)
 hasLocation(#20268,#20173)
-successor(#20247,#20249)
 successor(#20262,#20260)
 successor(#20260,#20268)
 successor(#20249,#20259)
@@ -832,6 +831,7 @@ successor(#20257,#20258)
 successor(#20255,#20251)
 successor(#20259,#20253)
 successor(#20251,#20262)
+successor(#20247,#20249)
 successor(#20237,#20240)
 successor(#20245,#20242)
 successor(#20244,#20245)
@@ -849,21 +849,20 @@ exit_cfg_node(#20270,#20177)
 #20271=@"loc,{#10000},8,2,8,1"
 locations_default(#20271,#10000,8,2,8,1)
 hasLocation(#20270,#20271)
-successor(#20190,#20192)
 successor(#20203,#20205)
-successor(#20205,#20209)
 successor(#20209,#20211)
 successor(#20212,#20207)
 successor(#20211,#20212)
 successor(#20207,#20213)
+successor(#20205,#20209)
 successor(#20213,#20217)
-successor(#20218,#20220)
 successor(#20220,#20226)
 successor(#20229,#20222)
 successor(#20228,#20224)
 successor(#20226,#20228)
 successor(#20224,#20229)
 successor(#20222,#20270)
+successor(#20218,#20220)
 successor(#20217,#20218)
 successor(#20192,#20202)
 successor(#20196,#20198)
@@ -872,6 +871,7 @@ successor(#20201,#20194)
 successor(#20198,#20199)
 successor(#20202,#20196)
 successor(#20194,#20203)
+successor(#20190,#20192)
 successor(#20185,#20187)
 successor(#20188,#20190)
 successor(#20187,#20188)
--- a/javascript/extractor/tests/es2015/output/trap/forof.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/forof.js.trap
@@ -436,7 +436,6 @@ exit_cfg_node(#20140,#20118)
 #20141=@"loc,{#10000},7,2,7,1"
 locations_default(#20141,#10000,7,2,7,1)
 hasLocation(#20140,#20141)
-successor(#20124,#20128)
 successor(#20128,#20126)
 successor(#20126,#20130)
 successor(#20126,#20140)
@@ -444,6 +443,7 @@ successor(#20134,#20126)
 successor(#20130,#20133)
 successor(#20133,#20132)
 successor(#20132,#20134)
+successor(#20124,#20128)
 successor(#20138,#20124)
 successor(#20094,#20096)
 successor(#20098,#20092)
@@ -451,13 +451,13 @@ successor(#20097,#20098)
 successor(#20096,#20097)
 successor(#20092,#20101)
 successor(#20092,#20118)
-successor(#20105,#20109)
 successor(#20109,#20113)
 successor(#20117,#20114)
 successor(#20116,#20117)
 successor(#20114,#20111)
 successor(#20113,#20116)
 successor(#20111,#20092)
+successor(#20105,#20109)
 successor(#20101,#20104)
 successor(#20104,#20103)
 successor(#20103,#20105)
--- a/javascript/extractor/tests/es2015/output/trap/let.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/let.js.trap
@@ -673,8 +673,6 @@ hasLocation(#20210,#20211)
 #20212=*
 exit_cfg_node(#20212,#20001)
 hasLocation(#20212,#20135)
-successor(#20137,#20140)
-successor(#20146,#20150)
 successor(#20195,#20199)
 successor(#20200,#20197)
 successor(#20199,#20200)
@@ -705,7 +703,6 @@ hasLocation(#20214,#20161)
 successor(#20214,#20195)
 successor(#20160,#20213)
 successor(#20160,#20214)
-successor(#20173,#20177)
 successor(#20183,#20189)
 successor(#20192,#20185)
 successor(#20191,#20187)
@@ -716,14 +713,17 @@ successor(#20177,#20181)
 successor(#20182,#20179)
 successor(#20181,#20182)
 successor(#20179,#20183)
+successor(#20173,#20177)
 successor(#20150,#20154)
 successor(#20155,#20152)
 successor(#20154,#20155)
 successor(#20152,#20156)
+successor(#20146,#20150)
 successor(#20140,#20144)
 successor(#20145,#20142)
 successor(#20144,#20145)
 successor(#20142,#20146)
+successor(#20137,#20140)
 successor(#20210,#20137)
 numlines(#10000,12,12,0)
 filetype(#10000,"javascript")
--- a/javascript/extractor/tests/es2015/output/trap/nested_import.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/nested_import.js.trap
@@ -352,13 +352,13 @@ hasLocation(#20107,#20033)
 successor(#20107,#20105)
 successor(#20080,#20106)
 successor(#20080,#20107)
-successor(#20083,#20089)
 successor(#20097,#20101)
 successor(#20102,#20099)
 successor(#20101,#20102)
 successor(#20099,#20105)
 successor(#20089,#20094)
 successor(#20094,#20097)
+successor(#20083,#20089)
 successor(#20071,#20078)
 successor(#20075,#20071)
 successor(#20103,#20075)
--- a/javascript/extractor/tests/es2015/output/trap/new_target.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/new_target.js.trap
@@ -167,11 +167,11 @@ hasLocation(#20054,#20052)
 #20055=*
 exit_cfg_node(#20055,#20037)
 hasLocation(#20055,#20034)
-successor(#20041,#20049)
 successor(#20049,#20047)
 successor(#20047,#20045)
 successor(#20045,#20043)
 successor(#20043,#20055)
+successor(#20041,#20049)
 successor(#20054,#20041)
 successor(#20038,#20037)
 successor(#20051,#20038)
--- a/javascript/extractor/tests/es2015/output/trap/odasa-2593.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/odasa-2593.js.trap
@@ -189,13 +189,13 @@ hasLocation(#20058,#20056)
 #20059=*
 exit_cfg_node(#20059,#20039)
 hasLocation(#20059,#20036)
-successor(#20043,#20045)
 successor(#20048,#20052)
 successor(#20054,#20050)
 successor(#20052,#20054)
 successor(#20050,#20059)
 successor(#20045,#20047)
 successor(#20047,#20048)
+successor(#20043,#20045)
 successor(#20058,#20043)
 successor(#20040,#20039)
 successor(#20055,#20040)
--- a/javascript/extractor/tests/es2015/output/trap/properties.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/properties.js.trap
@@ -403,9 +403,9 @@ exit_cfg_node(#20126,#20112)
 #20127=@"loc,{#10000},5,27,5,26"
 locations_default(#20127,#10000,5,27,5,26)
 hasLocation(#20126,#20127)
-successor(#20116,#20120)
 successor(#20120,#20118)
 successor(#20118,#20126)
+successor(#20116,#20120)
 successor(#20124,#20116)
 successor(#20111,#20112)
 successor(#20109,#20088)
--- a/javascript/extractor/tests/es2015/output/trap/super_call.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/super_call.js.trap
@@ -332,12 +332,12 @@ hasLocation(#20098,#20082)
 #20099=*
 exit_cfg_node(#20099,#20084)
 hasLocation(#20099,#20082)
-successor(#20089,#20090)
 successor(#20090,#20092)
 successor(#20094,#20093)
 successor(#20093,#20091)
 successor(#20092,#20094)
 successor(#20091,#20099)
+successor(#20089,#20090)
 successor(#20087,#20089)
 successor(#20098,#20087)
 successor(#20083,#20084)
@@ -353,7 +353,6 @@ exit_cfg_node(#20102,#20064)
 #20103=@"loc,{#10000},4,4,4,3"
 locations_default(#20103,#10000,4,4,4,3)
 hasLocation(#20102,#20103)
-successor(#20068,#20078)
 successor(#20080,#20072)
 successor(#20079,#20076)
 successor(#20078,#20079)
@@ -361,6 +360,7 @@ successor(#20076,#20074)
 successor(#20074,#20080)
 successor(#20072,#20070)
 successor(#20070,#20102)
+successor(#20068,#20078)
 successor(#20100,#20068)
 successor(#20063,#20064)
 successor(#20061,#20083)
--- a/javascript/extractor/tests/es2015/output/trap/super_ctor.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/super_ctor.js.trap
@@ -233,11 +233,11 @@ exit_cfg_node(#20073,#20056)
 #20074=@"loc,{#10000},4,4,4,3"
 locations_default(#20074,#10000,4,4,4,3)
 hasLocation(#20073,#20074)
-successor(#20060,#20062)
 successor(#20062,#20066)
 successor(#20067,#20064)
 successor(#20066,#20067)
 successor(#20064,#20073)
+successor(#20060,#20062)
 successor(#20071,#20060)
 successor(#20055,#20056)
 successor(#20053,#20048)
--- a/javascript/extractor/tests/es2015/output/trap/templates.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/templates.js.trap
@@ -729,7 +729,6 @@ exit_cfg_node(#20221,#20157)
 #20222=@"loc,{#10000},3,2,3,1"
 locations_default(#20222,#10000,3,2,3,1)
 hasLocation(#20221,#20222)
-successor(#20166,#20172)
 successor(#20179,#20173)
 successor(#20178,#20175)
 successor(#20177,#20178)
@@ -738,6 +737,7 @@ successor(#20173,#20170)
 successor(#20172,#20177)
 successor(#20170,#20168)
 successor(#20168,#20221)
+successor(#20166,#20172)
 successor(#20164,#20166)
 successor(#20162,#20164)
 successor(#20220,#20162)
--- a/javascript/extractor/tests/es2015/output/trap/unknown_meta_property.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/unknown_meta_property.js.trap
@@ -138,9 +138,9 @@ hasLocation(#20044,#20042)
 #20045=*
 exit_cfg_node(#20045,#20031)
 hasLocation(#20045,#20028)
-successor(#20035,#20037)
 successor(#20037,#20039)
 successor(#20039,#20045)
+successor(#20035,#20037)
 successor(#20044,#20035)
 successor(#20032,#20031)
 successor(#20041,#20032)
--- a/javascript/extractor/tests/es2015/output/trap/yield.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/yield.js.trap
@@ -287,7 +287,6 @@ hasLocation(#20090,#20088)
 #20091=*
 exit_cfg_node(#20091,#20061)
 hasLocation(#20091,#20058)
-successor(#20066,#20068)
 successor(#20074,#20078)
 successor(#20080,#20086)
 successor(#20086,#20084)
@@ -309,6 +308,7 @@ successor(#20068,#20072)
 successor(#20073,#20070)
 successor(#20072,#20073)
 successor(#20070,#20074)
+successor(#20066,#20068)
 successor(#20090,#20066)
 successor(#20062,#20061)
 successor(#20087,#20062)
--- a/javascript/extractor/tests/es2015/output/trap/yield2.js.trap
+++ b/javascript/extractor/tests/es2015/output/trap/yield2.js.trap
@@ -137,9 +137,9 @@ exit_cfg_node(#20043,#20029)
 #20044=@"loc,{#10000},3,2,3,1"
 locations_default(#20044,#10000,3,2,3,1)
 hasLocation(#20043,#20044)
-successor(#20034,#20036)
 successor(#20036,#20038)
 successor(#20038,#20043)
+successor(#20034,#20036)
 successor(#20042,#20034)
 successor(#20031,#20029)
 successor(#20039,#20031)
--- a/javascript/extractor/tests/es2016/output/trap/usestrict.js.trap
+++ b/javascript/extractor/tests/es2016/output/trap/usestrict.js.trap
@@ -148,9 +148,9 @@ hasLocation(#20046,#20044)
 #20047=*
 exit_cfg_node(#20047,#20029)
 hasLocation(#20047,#20027)
-successor(#20036,#20038)
 successor(#20038,#20040)
 successor(#20040,#20047)
+successor(#20036,#20038)
 successor(#20033,#20036)
 successor(#20035,#20033)
 successor(#20046,#20035)
--- a/javascript/extractor/tests/es2017/output/trap/async-await.js.trap
+++ b/javascript/extractor/tests/es2017/output/trap/async-await.js.trap
@@ -333,18 +333,18 @@ exit_cfg_node(#20107,#20073)
 #20108=@"loc,{#10000},7,2,7,1"
 locations_default(#20108,#10000,7,2,7,1)
 hasLocation(#20107,#20108)
-successor(#20080,#20082)
 successor(#20082,#20084)
-successor(#20084,#20086)
 successor(#20086,#20090)
 successor(#20090,#20088)
 successor(#20088,#20091)
 successor(#20088,#20107)
+successor(#20084,#20086)
 successor(#20091,#20095)
-successor(#20096,#20100)
 successor(#20100,#20098)
 successor(#20098,#20107)
+successor(#20096,#20100)
 successor(#20095,#20096)
+successor(#20080,#20082)
 successor(#20078,#20080)
 successor(#20105,#20078)
 successor(#20075,#20071)
--- a/javascript/extractor/tests/esnext/output/trap/async-generators.js.trap
+++ b/javascript/extractor/tests/esnext/output/trap/async-generators.js.trap
@@ -303,7 +303,6 @@ exit_cfg_node(#20099,#20076)
 #20100=@"loc,{#10000},6,2,6,1"
 locations_default(#20100,#10000,6,2,6,1)
 hasLocation(#20099,#20100)
-successor(#20082,#20088)
 successor(#20088,#20086)
 successor(#20086,#20084)
 successor(#20084,#20089)
@@ -312,6 +311,7 @@ successor(#20093,#20084)
 successor(#20089,#20092)
 successor(#20092,#20091)
 successor(#20091,#20093)
+successor(#20082,#20088)
 successor(#20097,#20082)
 successor(#20069,#20076)
 #20101=*
--- a/javascript/extractor/tests/esnext/output/trap/catchNoBinding.js.trap
+++ b/javascript/extractor/tests/esnext/output/trap/catchNoBinding.js.trap
@@ -253,18 +253,18 @@ hasLocation(#20085,#20086)
 exit_cfg_node(#20087,#20001)
 hasLocation(#20087,#20054)
 successor(#20056,#20058)
-successor(#20058,#20060)
 successor(#20060,#20062)
 successor(#20062,#20087)
 successor(#20064,#20067)
 successor(#20067,#20087)
+successor(#20058,#20060)
 successor(#20069,#20072)
-successor(#20072,#20074)
 successor(#20074,#20076)
 successor(#20076,#20083)
 successor(#20078,#20081)
 successor(#20081,#20083)
 successor(#20083,#20087)
+successor(#20072,#20074)
 successor(#20085,#20056)
 numlines(#10000,5,5,0)
 filetype(#10000,"javascript")
--- a/javascript/extractor/tests/esnext/output/trap/fields.js.trap
+++ b/javascript/extractor/tests/esnext/output/trap/fields.js.trap
@@ -499,13 +499,13 @@ hasLocation(#20147,#20116)
 #20148=*
 exit_cfg_node(#20148,#20109)
 hasLocation(#20148,#20116)
-successor(#20122,#20123)
 successor(#20123,#20125)
 successor(#20127,#20126)
 successor(#20126,#20124)
 successor(#20125,#20127)
 successor(#20107,#20148)
 successor(#20124,#20110)
+successor(#20122,#20123)
 successor(#20120,#20122)
 successor(#20147,#20120)
 successor(#20117,#20109)
--- a/javascript/extractor/tests/esnext/output/trap/for-await.js.trap
+++ b/javascript/extractor/tests/esnext/output/trap/for-await.js.trap
@@ -416,10 +416,10 @@ hasLocation(#20134,#20089)
 successor(#20118,#20116)
 successor(#20116,#20121)
 successor(#20116,#20134)
-successor(#20125,#20127)
 successor(#20127,#20131)
 successor(#20131,#20129)
 successor(#20129,#20116)
+successor(#20125,#20127)
 successor(#20121,#20124)
 successor(#20124,#20123)
 successor(#20123,#20125)
@@ -432,17 +432,17 @@ exit_cfg_node(#20136,#20092)
 #20137=@"loc,{#10000},5,2,5,1"
 locations_default(#20137,#10000,5,2,5,1)
 hasLocation(#20136,#20137)
-successor(#20097,#20101)
 successor(#20101,#20099)
 successor(#20099,#20105)
 successor(#20099,#20136)
-successor(#20109,#20111)
 successor(#20111,#20115)
 successor(#20115,#20113)
 successor(#20113,#20099)
+successor(#20109,#20111)
 successor(#20105,#20108)
 successor(#20108,#20107)
 successor(#20107,#20109)
+successor(#20097,#20101)
 successor(#20135,#20097)
 successor(#20094,#20092)
 successor(#20132,#20094)
--- a/javascript/extractor/tests/esnext/output/trap/optional-chaining_short-circuiting.js.trap
+++ b/javascript/extractor/tests/esnext/output/trap/optional-chaining_short-circuiting.js.trap
@@ -1575,12 +1575,12 @@ successor(#20492,#20481)
 successor(#20471,#20491)
 successor(#20471,#20492)
 successor(#20473,#20481)
-successor(#20476,#20478)
 successor(#20478,#20480)
 successor(#20480,#20488)
-successor(#20481,#20483)
+successor(#20476,#20478)
 successor(#20483,#20485)
 successor(#20485,#20488)
+successor(#20481,#20483)
 successor(#20445,#20451)
 successor(#20452,#20449)
 successor(#20451,#20452)
@@ -1596,12 +1596,12 @@ hasLocation(#20494,#20450)
 successor(#20494,#20458)
 successor(#20447,#20493)
 successor(#20447,#20494)
-successor(#20453,#20455)
 successor(#20455,#20457)
 successor(#20457,#20463)
-successor(#20458,#20460)
+successor(#20453,#20455)
 successor(#20460,#20462)
 successor(#20462,#20463)
+successor(#20458,#20460)
 successor(#20429,#20433)
 successor(#20434,#20431)
 successor(#20433,#20434)
@@ -1616,12 +1616,12 @@ successor(#20496,#20440)
 successor(#20431,#20495)
 successor(#20431,#20496)
 successor(#20433,#20440)
-successor(#20435,#20437)
 successor(#20437,#20439)
 successor(#20439,#20445)
-successor(#20440,#20442)
+successor(#20435,#20437)
 successor(#20442,#20444)
 successor(#20444,#20445)
+successor(#20440,#20442)
 successor(#20404,#20415)
 successor(#20428,#20405)
 successor(#20427,#20409)
--- a/javascript/extractor/tests/esnext/output/trap/yield-import.js.trap
+++ b/javascript/extractor/tests/esnext/output/trap/yield-import.js.trap
@@ -171,11 +171,11 @@ exit_cfg_node(#20054,#20035)
 #20055=@"loc,{#10000},3,2,3,1"
 locations_default(#20055,#10000,3,2,3,1)
 hasLocation(#20054,#20055)
-successor(#20040,#20042)
 successor(#20042,#20047)
 successor(#20047,#20045)
 successor(#20045,#20044)
 successor(#20044,#20054)
+successor(#20040,#20042)
 successor(#20053,#20040)
 successor(#20037,#20035)
 successor(#20050,#20037)
--- a/Show More
+++ b/Show More