mirror of
https://github.com/github/codeql.git
synced 2026-04-25 16:55:19 +02:00
Release preparation for version 2.21.0
This commit is contained in:
github-actions[bot]
@@ -1,3 +1,35 @@
|
||||
## 2.6.0
|
||||
|
||||
### New Features
|
||||
|
||||
* Extraction now supports regular expressions with the `v` flag, using the new operators:
|
||||
- Intersection `&&`
|
||||
- Subtraction `--`
|
||||
- `\q` quoted string
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* Added support for TypeScript 5.8.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Added support for additional `fs-extra` methods as sinks in path-injection queries.
|
||||
* Added support for the newer version of `Hapi` with the `@hapi/hapi` import and `server` function.
|
||||
* Improved modeling of the `node:fs` module: `await`-ed calls to `read` and `readFile` are now supported.
|
||||
* Added support for the `@sap/hana-client`, `@sap/hdbext` and `hdb` packages.
|
||||
* Enhanced `axios` support with new methods (`postForm`, `putForm`, `patchForm`, `getUri`, `create`) and added support for `interceptors.request` and `interceptors.response`.
|
||||
* Improved support for `got` package with `Options`, `paginate()` and `extend()`
|
||||
* Added support for the `ApolloServer` class from `@apollo/server` and similar packages. In particular, the incoming data in a GraphQL resolver is now seen as a source of untrusted user input.
|
||||
* Improved support for `superagent` to handle the case where the package is directly called as a function, or via the `.del()` or `.agent()` method.
|
||||
* Added support for the `underscore.string` package.
|
||||
* Added additional flow step for `unescape()` and `escape()`.
|
||||
* Added support for the `@tanstack/vue-query` package.
|
||||
* Added taint-steps for `unescape()`.
|
||||
* Added support for the `@tanstack/angular-query-experimental` package.
|
||||
* Improved support for the `@angular/common/http` package, detecting outgoing HTTP requests in more cases.
|
||||
* Improved the modeling of the `markdown-table` package to ensure it handles nested arrays properly.
|
||||
* Added support for the `react-relay` library.
|
||||
|
||||
## 2.5.1
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: majorAnalysis
|
||||
---
|
||||
* Added support for TypeScript 5.8.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for the `react-relay` library.
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
category: feature
|
||||
---
|
||||
* Extraction now supports regular expressions with the `v` flag, using the new operators:
|
||||
- Intersection `&&`
|
||||
- Subtraction `--`
|
||||
- `\q` quoted string
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Improved the modeling of the `markdown-table` package to ensure it handles nested arrays properly.
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for the `@tanstack/angular-query-experimental` package.
|
||||
* Improved support for the `@angular/common/http` package, detecting outgoing HTTP requests in more cases.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for the `@tanstack/vue-query` package.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added taint-steps for `unescape()`.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added additional flow step for `unescape()` and `escape()`.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for the `underscore.string` package.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for the `ApolloServer` class from `@apollo/server` and similar packages. In particular, the incoming data in a GraphQL resolver is now seen as a source of untrusted user input.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Improved support for `superagent` to handle the case where the package is directly called as a function, or via the `.del()` or `.agent()` method.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Enhanced `axios` support with new methods (`postForm`, `putForm`, `patchForm`, `getUri`, `create`) and added support for `interceptors.request` and `interceptors.response`.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Improved support for `got` package with `Options`, `paginate()` and `extend()`
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for the newer version of `Hapi` with the `@hapi/hapi` import and `server` function.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Improved modeling of the `node:fs` module: `await`-ed calls to `read` and `readFile` are now supported.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for the `@sap/hana-client`, `@sap/hdbext` and `hdb` packages.
|
||||
@@ -1,4 +0,0 @@
|
||||
---
|
||||
category: minorAnalysis
|
||||
---
|
||||
* Added support for additional `fs-extra` methods as sinks in path-injection queries.
|
||||
31
javascript/ql/lib/change-notes/released/2.6.0.md
Normal file
31
javascript/ql/lib/change-notes/released/2.6.0.md
Normal file
@@ -0,0 +1,31 @@
|
||||
## 2.6.0
|
||||
|
||||
### New Features
|
||||
|
||||
* Extraction now supports regular expressions with the `v` flag, using the new operators:
|
||||
- Intersection `&&`
|
||||
- Subtraction `--`
|
||||
- `\q` quoted string
|
||||
|
||||
### Major Analysis Improvements
|
||||
|
||||
* Added support for TypeScript 5.8.
|
||||
|
||||
### Minor Analysis Improvements
|
||||
|
||||
* Added support for additional `fs-extra` methods as sinks in path-injection queries.
|
||||
* Added support for the newer version of `Hapi` with the `@hapi/hapi` import and `server` function.
|
||||
* Improved modeling of the `node:fs` module: `await`-ed calls to `read` and `readFile` are now supported.
|
||||
* Added support for the `@sap/hana-client`, `@sap/hdbext` and `hdb` packages.
|
||||
* Enhanced `axios` support with new methods (`postForm`, `putForm`, `patchForm`, `getUri`, `create`) and added support for `interceptors.request` and `interceptors.response`.
|
||||
* Improved support for `got` package with `Options`, `paginate()` and `extend()`
|
||||
* Added support for the `ApolloServer` class from `@apollo/server` and similar packages. In particular, the incoming data in a GraphQL resolver is now seen as a source of untrusted user input.
|
||||
* Improved support for `superagent` to handle the case where the package is directly called as a function, or via the `.del()` or `.agent()` method.
|
||||
* Added support for the `underscore.string` package.
|
||||
* Added additional flow step for `unescape()` and `escape()`.
|
||||
* Added support for the `@tanstack/vue-query` package.
|
||||
* Added taint-steps for `unescape()`.
|
||||
* Added support for the `@tanstack/angular-query-experimental` package.
|
||||
* Improved support for the `@angular/common/http` package, detecting outgoing HTTP requests in more cases.
|
||||
* Improved the modeling of the `markdown-table` package to ensure it handles nested arrays properly.
|
||||
* Added support for the `react-relay` library.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 2.5.1
|
||||
lastReleaseVersion: 2.6.0
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/javascript-all
|
||||
version: 2.5.2-dev
|
||||
version: 2.6.0
|
||||
groups: javascript
|
||||
dbscheme: semmlecode.javascript.dbscheme
|
||||
extractor: javascript
|
||||
|
||||
@@ -1,3 +1,17 @@
|
||||
## 1.5.2
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* Fixed a bug, first introduced in `2.20.3`, that would prevent `v-html` attributes in Vue files
|
||||
from being flagged by the `js/xss` query. The original behaviour has been restored and the `v-html`
|
||||
attribute is once again functioning as a sink for the `js/xss` query.
|
||||
* Fixed a bug that would in rare cases cause some regexp-based checks
|
||||
to be seen as generic taint sanitisers, even though the underlying regexp
|
||||
is not restrictive enough. The regexps are now analysed more precisely,
|
||||
and unrestrictive regexp checks will no longer block taint flow.
|
||||
* Fixed a recently-introduced bug that caused `js/server-side-unvalidated-url-redirection` to ignore
|
||||
valid hostname checks and report spurious alerts after such a check. The original behaviour has been restored.
|
||||
|
||||
## 1.5.1
|
||||
|
||||
No user-facing changes.
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
category: fix
|
||||
---
|
||||
* Fixed a recently-introduced bug that caused `js/server-side-unvalidated-url-redirection` to ignore
|
||||
valid hostname checks and report spurious alerts after such a check. The original behaviour has been restored.
|
||||
@@ -1,7 +0,0 @@
|
||||
---
|
||||
category: fix
|
||||
---
|
||||
* Fixed a bug that would in rare cases cause some regexp-based checks
|
||||
to be seen as generic taint sanitisers, even though the underlying regexp
|
||||
is not restrictive enough. The regexps are now analysed more precisely,
|
||||
and unrestrictive regexp checks will no longer block taint flow.
|
||||
@@ -1,6 +0,0 @@
|
||||
---
|
||||
category: fix
|
||||
---
|
||||
* Fixed a bug, first introduced in `2.20.3`, that would prevent `v-html` attributes in Vue files
|
||||
from being flagged by the `js/xss` query. The original behaviour has been restored and the `v-html`
|
||||
attribute is once again functioning as a sink for the `js/xss` query.
|
||||
13
javascript/ql/src/change-notes/released/1.5.2.md
Normal file
13
javascript/ql/src/change-notes/released/1.5.2.md
Normal file
@@ -0,0 +1,13 @@
|
||||
## 1.5.2
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* Fixed a bug, first introduced in `2.20.3`, that would prevent `v-html` attributes in Vue files
|
||||
from being flagged by the `js/xss` query. The original behaviour has been restored and the `v-html`
|
||||
attribute is once again functioning as a sink for the `js/xss` query.
|
||||
* Fixed a bug that would in rare cases cause some regexp-based checks
|
||||
to be seen as generic taint sanitisers, even though the underlying regexp
|
||||
is not restrictive enough. The regexps are now analysed more precisely,
|
||||
and unrestrictive regexp checks will no longer block taint flow.
|
||||
* Fixed a recently-introduced bug that caused `js/server-side-unvalidated-url-redirection` to ignore
|
||||
valid hostname checks and report spurious alerts after such a check. The original behaviour has been restored.
|
||||
@@ -1,2 +1,2 @@
|
||||
---
|
||||
lastReleaseVersion: 1.5.1
|
||||
lastReleaseVersion: 1.5.2
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: codeql/javascript-queries
|
||||
version: 1.5.2-dev
|
||||
version: 1.5.2
|
||||
groups:
|
||||
- javascript
|
||||
- queries
|
||||
|
||||
Reference in New Issue
Block a user