diff --git a/actions/ql/lib/CHANGELOG.md b/actions/ql/lib/CHANGELOG.md index c00be74a85e..630b089310b 100644 --- a/actions/ql/lib/CHANGELOG.md +++ b/actions/ql/lib/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.4.40 + +### Minor Analysis Improvements + +* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`. + ## 0.4.39 No user-facing changes. diff --git a/actions/ql/lib/change-notes/2026-07-09-environment-check-alteration.md b/actions/ql/lib/change-notes/released/0.4.40.md similarity index 83% rename from actions/ql/lib/change-notes/2026-07-09-environment-check-alteration.md rename to actions/ql/lib/change-notes/released/0.4.40.md index e7b49abddf7..219b69c26f5 100644 --- a/actions/ql/lib/change-notes/2026-07-09-environment-check-alteration.md +++ b/actions/ql/lib/change-notes/released/0.4.40.md @@ -1,4 +1,5 @@ ---- -category: minorAnalysis ---- -* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`. \ No newline at end of file +## 0.4.40 + +### Minor Analysis Improvements + +* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`. diff --git a/actions/ql/lib/codeql-pack.release.yml b/actions/ql/lib/codeql-pack.release.yml index 6c1c9d9a739..8f5be10acbe 100644 --- a/actions/ql/lib/codeql-pack.release.yml +++ b/actions/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.39 +lastReleaseVersion: 0.4.40 diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml index fec6a9446d0..f581f735dd6 100644 --- a/actions/ql/lib/qlpack.yml +++ b/actions/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/actions-all -version: 0.4.40-dev +version: 0.4.40 library: true warnOnImplicitThis: true dependencies: diff --git a/actions/ql/src/CHANGELOG.md b/actions/ql/src/CHANGELOG.md index 502c9aefe9d..bc013b962f8 100644 --- a/actions/ql/src/CHANGELOG.md +++ b/actions/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.6.32 + +No user-facing changes. + ## 0.6.31 No user-facing changes. diff --git a/actions/ql/src/change-notes/released/0.6.32.md b/actions/ql/src/change-notes/released/0.6.32.md new file mode 100644 index 00000000000..dcb9b3ba7d3 --- /dev/null +++ b/actions/ql/src/change-notes/released/0.6.32.md @@ -0,0 +1,3 @@ +## 0.6.32 + +No user-facing changes. diff --git a/actions/ql/src/codeql-pack.release.yml b/actions/ql/src/codeql-pack.release.yml index 565446e48f2..6c5978280b0 100644 --- a/actions/ql/src/codeql-pack.release.yml +++ b/actions/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.6.31 +lastReleaseVersion: 0.6.32 diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml index 2d53972a2ea..6449c6f5a40 100644 --- a/actions/ql/src/qlpack.yml +++ b/actions/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/actions-queries -version: 0.6.32-dev +version: 0.6.32 library: false warnOnImplicitThis: true groups: [actions, queries] diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md index daaa1e03fcb..f5f7d195fa6 100644 --- a/cpp/ql/lib/CHANGELOG.md +++ b/cpp/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 12.0.1 + +No user-facing changes. + ## 12.0.0 ### Breaking Changes diff --git a/cpp/ql/lib/change-notes/released/12.0.1.md b/cpp/ql/lib/change-notes/released/12.0.1.md new file mode 100644 index 00000000000..e585bb568c9 --- /dev/null +++ b/cpp/ql/lib/change-notes/released/12.0.1.md @@ -0,0 +1,3 @@ +## 12.0.1 + +No user-facing changes. diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml index 5bc9fd40be3..95ce69d8d49 100644 --- a/cpp/ql/lib/codeql-pack.release.yml +++ b/cpp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 12.0.0 +lastReleaseVersion: 12.0.1 diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml index 73226a267c9..3f588d95957 100644 --- a/cpp/ql/lib/qlpack.yml +++ b/cpp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-all -version: 12.0.1-dev +version: 12.0.1 groups: cpp dbscheme: semmlecode.cpp.dbscheme extractor: cpp diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md index 2fe576d89c7..945a605d7e3 100644 --- a/cpp/ql/src/CHANGELOG.md +++ b/cpp/ql/src/CHANGELOG.md @@ -1,3 +1,9 @@ +## 1.8.0 + +### Query Metadata Changes + +* Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query. + ## 1.7.0 ### Query Metadata Changes diff --git a/cpp/ql/src/change-notes/2026-07-13-new-free.md b/cpp/ql/src/change-notes/released/1.8.0.md similarity index 80% rename from cpp/ql/src/change-notes/2026-07-13-new-free.md rename to cpp/ql/src/change-notes/released/1.8.0.md index aef5a58aa48..ba2bbf5d9f9 100644 --- a/cpp/ql/src/change-notes/2026-07-13-new-free.md +++ b/cpp/ql/src/change-notes/released/1.8.0.md @@ -1,4 +1,5 @@ ---- -category: queryMetadata ---- +## 1.8.0 + +### Query Metadata Changes + * Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query. diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml index d1184cc6750..dc8a37cc443 100644 --- a/cpp/ql/src/codeql-pack.release.yml +++ b/cpp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.7.0 +lastReleaseVersion: 1.8.0 diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml index b193e3ea360..57b8e535aeb 100644 --- a/cpp/ql/src/qlpack.yml +++ b/cpp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-queries -version: 1.7.1-dev +version: 1.8.0 groups: - cpp - queries diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md index 69004620f59..a8774769b98 100644 --- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.7.71 + +No user-facing changes. + ## 1.7.70 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.71.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.71.md new file mode 100644 index 00000000000..bdc2f60ba0f --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.71.md @@ -0,0 +1,3 @@ +## 1.7.71 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml index af6d36d8096..9cb59142890 100644 --- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.7.70 +lastReleaseVersion: 1.7.71 diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml index e33ebfaa5cc..5a0ebdc92e6 100644 --- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-all -version: 1.7.71-dev +version: 1.7.71 groups: - csharp - solorigate diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md index 69004620f59..a8774769b98 100644 --- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.7.71 + +No user-facing changes. + ## 1.7.70 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.71.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.71.md new file mode 100644 index 00000000000..bdc2f60ba0f --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.71.md @@ -0,0 +1,3 @@ +## 1.7.71 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml index af6d36d8096..9cb59142890 100644 --- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.7.70 +lastReleaseVersion: 1.7.71 diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml index b25077c1667..a0d3ba43b9e 100644 --- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-queries -version: 1.7.71-dev +version: 1.7.71 groups: - csharp - solorigate diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md index 3f8f2d91d17..3ea969a9e9a 100644 --- a/csharp/ql/lib/CHANGELOG.md +++ b/csharp/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 7.1.1 + +No user-facing changes. + ## 7.1.0 ### Major Analysis Improvements diff --git a/csharp/ql/lib/change-notes/released/7.1.1.md b/csharp/ql/lib/change-notes/released/7.1.1.md new file mode 100644 index 00000000000..849fd4da328 --- /dev/null +++ b/csharp/ql/lib/change-notes/released/7.1.1.md @@ -0,0 +1,3 @@ +## 7.1.1 + +No user-facing changes. diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml index dcaaa76112a..8e970df6cae 100644 --- a/csharp/ql/lib/codeql-pack.release.yml +++ b/csharp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 7.1.0 +lastReleaseVersion: 7.1.1 diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml index 0a034f90073..715b17a5c20 100644 --- a/csharp/ql/lib/qlpack.yml +++ b/csharp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-all -version: 7.1.1-dev +version: 7.1.1 groups: csharp dbscheme: semmlecode.csharp.dbscheme extractor: csharp diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md index 931690b863e..f3aee337480 100644 --- a/csharp/ql/src/CHANGELOG.md +++ b/csharp/ql/src/CHANGELOG.md @@ -1,3 +1,13 @@ +## 1.9.0 + +### Query Metadata Changes + +* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite. + +### Minor Analysis Improvements + +* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results. + ## 1.8.0 ### Query Metadata Changes diff --git a/csharp/ql/src/change-notes/2026-07-13-CWE-601.md b/csharp/ql/src/change-notes/2026-07-13-CWE-601.md deleted file mode 100644 index 237ee562a52..00000000000 --- a/csharp/ql/src/change-notes/2026-07-13-CWE-601.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: minorAnalysis ---- -* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results. diff --git a/csharp/ql/src/change-notes/2026-07-15-code-quality-useless-assignment.md b/csharp/ql/src/change-notes/2026-07-15-code-quality-useless-assignment.md deleted file mode 100644 index d1fa51ea3bf..00000000000 --- a/csharp/ql/src/change-notes/2026-07-15-code-quality-useless-assignment.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: queryMetadata ---- -* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite. diff --git a/csharp/ql/src/change-notes/released/1.9.0.md b/csharp/ql/src/change-notes/released/1.9.0.md new file mode 100644 index 00000000000..6ea6704d659 --- /dev/null +++ b/csharp/ql/src/change-notes/released/1.9.0.md @@ -0,0 +1,9 @@ +## 1.9.0 + +### Query Metadata Changes + +* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite. + +### Minor Analysis Improvements + +* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results. diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml index dc8a37cc443..df17dc3a366 100644 --- a/csharp/ql/src/codeql-pack.release.yml +++ b/csharp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.8.0 +lastReleaseVersion: 1.9.0 diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml index ee88fc20f70..abd86552bb0 100644 --- a/csharp/ql/src/qlpack.yml +++ b/csharp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-queries -version: 1.8.1-dev +version: 1.9.0 groups: - csharp - queries diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.2.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.2.rst new file mode 100644 index 00000000000..845988894f0 --- /dev/null +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.2.rst @@ -0,0 +1,79 @@ +.. _codeql-cli-2.26.2: + +========================== +CodeQL 2.26.2 (2026-07-23) +========================== + +.. contents:: Contents + :depth: 2 + :local: + :backlinks: none + +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog `__, `relevant GitHub Changelog updates `__, `changes in the CodeQL extension for Visual Studio Code `__, and the `CodeQL Action changelog `__. + +Security Coverage +----------------- + +CodeQL 2.26.2 runs a total of 497 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE). + +CodeQL CLI +---------- + +Breaking Changes +~~~~~~~~~~~~~~~~ + +* Removed support for parsing :code:`[[`\ -style links in alert messages. This was an undocumented legacy feature that allowed query authors to embed links inline in select clause message strings using :code:`[["text"|"url"]]` syntax. Queries should use :code:`$@` placeholder pairs instead. + +Query Packs +----------- + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C# +"" + +* :code:`System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for :code:`cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results. + +Query Metadata Changes +~~~~~~~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* Added the tag :code:`external/cwe/cwe-762` to :code:`cpp/new-free-mismatch`, and removed the tag :code:`external/cwe/cwe-401`. This better matches the behavior of the query. + +C# +"" + +* The query :code:`cs/useless-assignment-to-local` has been removed from the :code:`code-quality` suite, but it remains in the :code:`code-quality-extended` suite. + +Language Libraries +------------------ + +Major Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Swift +""""" + +* Upgraded to allow analysis of Swift 6.3.3. + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Golang +"""""" + +* The function :code:`Rel` in :code:`path/filepath` was incorrectly considered a sanitizer for :code:`go/path-injection` and :code:`go/zipslip`. This has now been fixed, which may lead to more results for those queries. + +Java/Kotlin +""""""""""" + +* Kotlin versions up to 2.4.10 are now supported. +* :code:`java.io.File.getName()` is no longer treated as a complete sanitizer for :code:`java/path-injection`, since it does not remove a :code:`..` path component (for example :code:`new File("..").getName()` returns :code:`".."`). It is now only recognized as a sanitizer when combined with a subsequent check for :code:`..` components, which may result in new alerts. + +GitHub Actions +"""""""""""""" + +* Altered the logic of :code:`EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: :code:`actions/untrusted-checkout-toctou/high` and :code:`actions/untrusted-checkout-toctou/critical`. diff --git a/docs/codeql/codeql-overview/codeql-changelog/index.rst b/docs/codeql/codeql-overview/codeql-changelog/index.rst index 837fa757368..a0a2e1832d8 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/index.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst @@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here