Merge pull request #22255 from github/codeql-spark-run-30530195913

Update changelog documentation site for codeql-cli-2.26.2
This commit is contained in:
Óscar San José
2026-07-30 14:06:25 +02:00
committed by GitHub
173 changed files with 488 additions and 112 deletions

View File

@@ -1,3 +1,9 @@
## 0.4.40
### Minor Analysis Improvements
* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
## 0.4.39
No user-facing changes.

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
## 0.4.40
### Minor Analysis Improvements
* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.4.39
lastReleaseVersion: 0.4.40

View File

@@ -1,5 +1,5 @@
name: codeql/actions-all
version: 0.4.40-dev
version: 0.4.40
library: true
warnOnImplicitThis: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 0.6.32
No user-facing changes.
## 0.6.31
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.6.32
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.6.31
lastReleaseVersion: 0.6.32

View File

@@ -1,5 +1,5 @@
name: codeql/actions-queries
version: 0.6.32-dev
version: 0.6.32
library: false
warnOnImplicitThis: true
groups: [actions, queries]

View File

@@ -1,3 +1,7 @@
## 12.0.1
No user-facing changes.
## 12.0.0
### Breaking Changes

View File

@@ -0,0 +1,3 @@
## 12.0.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 12.0.0
lastReleaseVersion: 12.0.1

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 12.0.1-dev
version: 12.0.1
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp

View File

@@ -1,3 +1,9 @@
## 1.8.0
### Query Metadata Changes
* Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query.
## 1.7.0
### Query Metadata Changes

View File

@@ -1,4 +1,5 @@
---
category: queryMetadata
---
## 1.8.0
### Query Metadata Changes
* Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.0
lastReleaseVersion: 1.8.0

View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.7.1-dev
version: 1.8.0
groups:
- cpp
- queries

View File

@@ -1,3 +1,7 @@
## 1.7.71
No user-facing changes.
## 1.7.70
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.71
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.70
lastReleaseVersion: 1.7.71

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
version: 1.7.71-dev
version: 1.7.71
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 1.7.71
No user-facing changes.
## 1.7.70
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.7.71
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.7.70
lastReleaseVersion: 1.7.71

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
version: 1.7.71-dev
version: 1.7.71
groups:
- csharp
- solorigate

View File

@@ -1,3 +1,7 @@
## 7.1.1
No user-facing changes.
## 7.1.0
### Major Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 7.1.1
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 7.1.0
lastReleaseVersion: 7.1.1

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-all
version: 7.1.1-dev
version: 7.1.1
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp

View File

@@ -1,3 +1,13 @@
## 1.9.0
### Query Metadata Changes
* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite.
### Minor Analysis Improvements
* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
## 1.8.0
### Query Metadata Changes

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.

View File

@@ -1,4 +0,0 @@
---
category: queryMetadata
---
* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite.

View File

@@ -0,0 +1,9 @@
## 1.9.0
### Query Metadata Changes
* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite.
### Minor Analysis Improvements
* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.8.0
lastReleaseVersion: 1.9.0

View File

@@ -1,5 +1,5 @@
name: codeql/csharp-queries
version: 1.8.1-dev
version: 1.9.0
groups:
- csharp
- queries

View File

@@ -0,0 +1,79 @@
.. _codeql-cli-2.26.2:
==========================
CodeQL 2.26.2 (2026-07-23)
==========================
.. contents:: Contents
:depth: 2
:local:
:backlinks: none
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
Security Coverage
-----------------
CodeQL 2.26.2 runs a total of 497 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).
CodeQL CLI
----------
Breaking Changes
~~~~~~~~~~~~~~~~
* Removed support for parsing :code:`[[`\ -style links in alert messages. This was an undocumented legacy feature that allowed query authors to embed links inline in select clause message strings using :code:`[["text"|"url"]]` syntax. Queries should use :code:`$@` placeholder pairs instead.
Query Packs
-----------
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
C#
""
* :code:`System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for :code:`cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
Query Metadata Changes
~~~~~~~~~~~~~~~~~~~~~~
C/C++
"""""
* Added the tag :code:`external/cwe/cwe-762` to :code:`cpp/new-free-mismatch`, and removed the tag :code:`external/cwe/cwe-401`. This better matches the behavior of the query.
C#
""
* The query :code:`cs/useless-assignment-to-local` has been removed from the :code:`code-quality` suite, but it remains in the :code:`code-quality-extended` suite.
Language Libraries
------------------
Major Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Swift
"""""
* Upgraded to allow analysis of Swift 6.3.3.
Minor Analysis Improvements
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Golang
""""""
* The function :code:`Rel` in :code:`path/filepath` was incorrectly considered a sanitizer for :code:`go/path-injection` and :code:`go/zipslip`. This has now been fixed, which may lead to more results for those queries.
Java/Kotlin
"""""""""""
* Kotlin versions up to 2.4.10 are now supported.
* :code:`java.io.File.getName()` is no longer treated as a complete sanitizer for :code:`java/path-injection`, since it does not remove a :code:`..` path component (for example :code:`new File("..").getName()` returns :code:`".."`). It is now only recognized as a sanitizer when combined with a subsequent check for :code:`..` components, which may result in new alerts.
GitHub Actions
""""""""""""""
* Altered the logic of :code:`EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: :code:`actions/untrusted-checkout-toctou/high` and :code:`actions/untrusted-checkout-toctou/critical`.

View File

@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
.. toctree::
:maxdepth: 1
codeql-cli-2.26.2
codeql-cli-2.26.1
codeql-cli-2.26.0
codeql-cli-2.25.6

View File

@@ -1,3 +1,7 @@
## 1.0.54
No user-facing changes.
## 1.0.53
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.54
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.53
lastReleaseVersion: 1.0.54

View File

@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
version: 1.0.54-dev
version: 1.0.54
groups:
- go
- queries

View File

@@ -1,3 +1,9 @@
## 7.2.2
### Minor Analysis Improvements
* The function `Rel` in `path/filepath` was incorrectly considered a sanitizer for `go/path-injection` and `go/zipslip`. This has now been fixed, which may lead to more results for those queries.
## 7.2.1
### Minor Analysis Improvements

View File

@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
## 7.2.2
### Minor Analysis Improvements
* The function `Rel` in `path/filepath` was incorrectly considered a sanitizer for `go/path-injection` and `go/zipslip`. This has now been fixed, which may lead to more results for those queries.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 7.2.1
lastReleaseVersion: 7.2.2

View File

@@ -1,5 +1,5 @@
name: codeql/go-all
version: 7.2.2-dev
version: 7.2.2
groups: go
dbscheme: go.dbscheme
extractor: go

View File

@@ -1,3 +1,7 @@
## 1.6.7
No user-facing changes.
## 1.6.6
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.6.7
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.6.6
lastReleaseVersion: 1.6.7

View File

@@ -1,5 +1,5 @@
name: codeql/go-queries
version: 1.6.7-dev
version: 1.6.7
groups:
- go
- queries

View File

@@ -1,3 +1,10 @@
## 9.2.2
### Minor Analysis Improvements
* Kotlin versions up to 2.4.10 are now supported.
* `java.io.File.getName()` is no longer treated as a complete sanitizer for `java/path-injection`, since it does not remove a `..` path component (for example `new File("..").getName()` returns `".."`). It is now only recognized as a sanitizer when combined with a subsequent check for `..` components, which may result in new alerts.
## 9.2.1
### Minor Analysis Improvements

View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* Kotlin versions up to 2.4.10 are now supported.

View File

@@ -1,4 +1,6 @@
---
category: minorAnalysis
---
## 9.2.2
### Minor Analysis Improvements
* Kotlin versions up to 2.4.10 are now supported.
* `java.io.File.getName()` is no longer treated as a complete sanitizer for `java/path-injection`, since it does not remove a `..` path component (for example `new File("..").getName()` returns `".."`). It is now only recognized as a sanitizer when combined with a subsequent check for `..` components, which may result in new alerts.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 9.2.1
lastReleaseVersion: 9.2.2

View File

@@ -1,5 +1,5 @@
name: codeql/java-all
version: 9.2.2-dev
version: 9.2.2
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java

View File

@@ -1,3 +1,7 @@
## 1.11.7
No user-facing changes.
## 1.11.6
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.11.7
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.11.6
lastReleaseVersion: 1.11.7

View File

@@ -1,5 +1,5 @@
name: codeql/java-queries
version: 1.11.7-dev
version: 1.11.7
groups:
- java
- queries

View File

@@ -1,3 +1,7 @@
## 2.8.2
No user-facing changes.
## 2.8.1
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 2.8.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.8.1
lastReleaseVersion: 2.8.2

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-all
version: 2.8.2-dev
version: 2.8.2
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript

View File

@@ -1,3 +1,7 @@
## 2.4.2
No user-facing changes.
## 2.4.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 2.4.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.4.1
lastReleaseVersion: 2.4.2

View File

@@ -1,5 +1,5 @@
name: codeql/javascript-queries
version: 2.4.2-dev
version: 2.4.2
groups:
- javascript
- queries

View File

@@ -1,3 +1,7 @@
## 1.0.54
No user-facing changes.
## 1.0.53
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.0.54
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.53
lastReleaseVersion: 1.0.54

View File

@@ -1,4 +1,4 @@
name: codeql/suite-helpers
version: 1.0.54-dev
version: 1.0.54
groups: shared
warnOnImplicitThis: true

View File

@@ -1,3 +1,7 @@
## 7.2.2
No user-facing changes.
## 7.2.1
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 7.2.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 7.2.1
lastReleaseVersion: 7.2.2

View File

@@ -1,5 +1,5 @@
name: codeql/python-all
version: 7.2.2-dev
version: 7.2.2
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python

View File

@@ -1,3 +1,7 @@
## 1.8.7
No user-facing changes.
## 1.8.6
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.8.7
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.8.6
lastReleaseVersion: 1.8.7

View File

@@ -1,5 +1,5 @@
name: codeql/python-queries
version: 1.8.7-dev
version: 1.8.7
groups:
- python
- queries

View File

@@ -1,3 +1,7 @@
## 6.0.2
No user-facing changes.
## 6.0.1
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 6.0.2
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 6.0.1
lastReleaseVersion: 6.0.2

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-all
version: 6.0.2-dev
version: 6.0.2
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme

View File

@@ -1,3 +1,7 @@
## 1.6.7
No user-facing changes.
## 1.6.6
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 1.6.7
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.6.6
lastReleaseVersion: 1.6.7

View File

@@ -1,5 +1,5 @@
name: codeql/ruby-queries
version: 1.6.7-dev
version: 1.6.7
groups:
- ruby
- queries

View File

@@ -1,3 +1,7 @@
## 0.2.18
No user-facing changes.
## 0.2.17
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.2.18
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.2.17
lastReleaseVersion: 0.2.18

View File

@@ -1,5 +1,5 @@
name: codeql/rust-all
version: 0.2.18-dev
version: 0.2.18
groups: rust
extractor: rust
dbscheme: rust.dbscheme

View File

@@ -1,3 +1,7 @@
## 0.1.39
No user-facing changes.
## 0.1.38
### Minor Analysis Improvements

View File

@@ -0,0 +1,3 @@
## 0.1.39
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.1.38
lastReleaseVersion: 0.1.39

View File

@@ -1,5 +1,5 @@
name: codeql/rust-queries
version: 0.1.39-dev
version: 0.1.39
groups:
- rust
- queries

View File

@@ -1,3 +1,7 @@
## 0.0.28
No user-facing changes.
## 0.0.27
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 0.0.28
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 0.0.27
lastReleaseVersion: 0.0.28

View File

@@ -1,5 +1,5 @@
name: codeql/concepts
version: 0.0.28-dev
version: 0.0.28
groups: shared
library: true
dependencies:

View File

@@ -1,3 +1,7 @@
## 2.0.38
No user-facing changes.
## 2.0.37
No user-facing changes.

View File

@@ -0,0 +1,3 @@
## 2.0.38
No user-facing changes.

View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 2.0.37
lastReleaseVersion: 2.0.38

Some files were not shown because too many files have changed in this diff Show More