Release preparation for version 2.11.1

ruby/ql/lib/CHANGELOG.md

@@ -1,3 +1,26 @@
+## 0.4.1
+
+### Minor Analysis Improvements
+
+* The following classes have been moved from `codeql.ruby.frameworks.ActionController` to `codeql.ruby.frameworks.Rails`:
+    * `ParamsCall`, now accessed as `Rails::ParamsCall`.
+    * `CookieCall`, now accessed as `Rails::CookieCall`.
+* The following classes have been moved from `codeql.ruby.frameworks.ActionView` to `codeql.ruby.frameworks.Rails`:
+    * `HtmlSafeCall`, now accessed as `Rails::HtmlSafeCall`.
+    * `HtmlEscapeCall`, now accessed as `Rails::HtmlEscapeCall`.
+    * `RenderCall`, now accessed as `Rails::RenderCall`.
+    * `RenderToCall`, now accessed as `Rails::RenderToCall`.
+* Subclasses of `ActionController::Metal` are now recognised as controllers.
+* `ActionController::DataStreaming::send_file` is now recognized as a
+  `FileSystemAccess`.
+* Various XSS sinks in the ActionView library are now recognized.
+* Calls to `ActiveRecord::Base.create` are now recognized as model
+  instantiations.
+* Various code executions, command executions and HTTP requests in the
+  ActiveStorage library are now recognized.
+* `MethodBase` now has two new predicates related to visibility: `isPublic` and
+  `isProtected`. These hold, respectively, if the method is public or protected.
+
 ## 0.4.0
 
 ### Breaking Changes

ruby/ql/lib/change-notes/2022-08-16-protected-methods.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* `MethodBase` now has two new predicates related to visibility: `isPublic` and
-  `isProtected`. These hold, respectively, if the method is public or protected.

ruby/ql/lib/change-notes/2022-08-30-activestorage.md

@@ -1,6 +0,0 @@
----
-category: minorAnalysis
----
-* Various code executions, command executions and HTTP requests in the
-  ActiveStorage library are now recognized.
-

ruby/ql/lib/change-notes/2022-09-27-actionview.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Various XSS sinks in the ActionView library are now recognized.

ruby/ql/lib/change-notes/2022-09-27-activerecord-create.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-* Calls to `ActiveRecord::Base.create` are now recognized as model
-  instantiations.

ruby/ql/lib/change-notes/2022-09-28-actioncontroller-metal.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Subclasses of `ActionController::Metal` are now recognised as controllers.

ruby/ql/lib/change-notes/2022-09-28-actioncontroller-sendfile.md

@@ -1,6 +0,0 @@
----
-category: minorAnalysis
----
-* `ActionController::DataStreaming::send_file` is now recognized as a
-  `FileSystemAccess`.
-

ruby/ql/lib/change-notes/2022-10-04-actionview-controller-renames.md

@@ -1,11 +0,0 @@
----
-category: minorAnalysis
----
-* The following classes have been moved from `codeql.ruby.frameworks.ActionController` to `codeql.ruby.frameworks.Rails`:
-    * `ParamsCall`, now accessed as `Rails::ParamsCall`.
-    * `CookieCall`, now accessed as `Rails::CookieCall`.
-* The following classes have been moved from `codeql.ruby.frameworks.ActionView` to `codeql.ruby.frameworks.Rails`:
-    * `HtmlSafeCall`, now accessed as `Rails::HtmlSafeCall`.
-    * `HtmlEscapeCall`, now accessed as `Rails::HtmlEscapeCall`.
-    * `RenderCall`, now accessed as `Rails::RenderCall`.
-    * `RenderToCall`, now accessed as `Rails::RenderToCall`.

ruby/ql/lib/change-notes/released/0.4.1.md

@@ -0,0 +1,22 @@
+## 0.4.1
+
+### Minor Analysis Improvements
+
+* The following classes have been moved from `codeql.ruby.frameworks.ActionController` to `codeql.ruby.frameworks.Rails`:
+    * `ParamsCall`, now accessed as `Rails::ParamsCall`.
+    * `CookieCall`, now accessed as `Rails::CookieCall`.
+* The following classes have been moved from `codeql.ruby.frameworks.ActionView` to `codeql.ruby.frameworks.Rails`:
+    * `HtmlSafeCall`, now accessed as `Rails::HtmlSafeCall`.
+    * `HtmlEscapeCall`, now accessed as `Rails::HtmlEscapeCall`.
+    * `RenderCall`, now accessed as `Rails::RenderCall`.
+    * `RenderToCall`, now accessed as `Rails::RenderToCall`.
+* Subclasses of `ActionController::Metal` are now recognised as controllers.
+* `ActionController::DataStreaming::send_file` is now recognized as a
+  `FileSystemAccess`.
+* Various XSS sinks in the ActionView library are now recognized.
+* Calls to `ActiveRecord::Base.create` are now recognized as model
+  instantiations.
+* Various code executions, command executions and HTTP requests in the
+  ActiveStorage library are now recognized.
+* `MethodBase` now has two new predicates related to visibility: `isPublic` and
+  `isProtected`. These hold, respectively, if the method is public or protected.

ruby/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.0
+lastReleaseVersion: 0.4.1

ruby/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ruby-all
-version: 0.4.1-dev
+version: 0.4.1
 groups: ruby
 extractor: ruby
 dbscheme: ruby.dbscheme

ruby/ql/src/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 0.4.1
+
+### Minor Analysis Improvements
+
+* The `rb/xxe` query has been updated to add the following sinks for XML external entity expansion:
+    1. Calls to parse XML using `LibXML` when its `default_substitute_entities` option is enabled.
+    2. Uses of the Rails methods `ActiveSupport::XmlMini.parse`, `Hash.from_xml`, and `Hash.from_trusted_xml` when `ActiveSupport::XmlMini` is configured to use `LibXML` as its backend, and its `default_substitute_entities` option is enabled.
+
 ## 0.4.0
 
 ### New Queries

ruby/ql/src/change-notes/released/0.4.1.md

@@ -1,6 +1,7 @@
----
-category: minorAnalysis
----
+## 0.4.1
+
+### Minor Analysis Improvements
+
 * The `rb/xxe` query has been updated to add the following sinks for XML external entity expansion:
     1. Calls to parse XML using `LibXML` when its `default_substitute_entities` option is enabled.
-    2. Uses of the Rails methods `ActiveSupport::XmlMini.parse`, `Hash.from_xml`, and `Hash.from_trusted_xml` when `ActiveSupport::XmlMini` is configured to use `LibXML` as its backend, and its `default_substitute_entities` option is enabled.
+    2. Uses of the Rails methods `ActiveSupport::XmlMini.parse`, `Hash.from_xml`, and `Hash.from_trusted_xml` when `ActiveSupport::XmlMini` is configured to use `LibXML` as its backend, and its `default_substitute_entities` option is enabled.

ruby/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.0
+lastReleaseVersion: 0.4.1

ruby/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ruby-queries
-version: 0.4.1-dev
+version: 0.4.1
 groups: 
   - ruby
   - queries