Merge remote-tracking branch 'upstream/main' into 'rc/3.14'

java/ql/lib/change-notes/2024-06-13-kotlin-qltest-support.md

@@ -0,0 +1,5 @@
+---
+category: fix
+---
+
+* Support for `codeql test run` for Kotlin sources has been fixed.

java/ql/lib/change-notes/2024-06-14-exclude-loopback-from-reverse-dns.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Excluded reverse DNS from the loopback address as a source of untrusted data.

java/ql/lib/change-notes/2024-06-17-ffbl-implicit-this.md

@@ -0,0 +1,7 @@
+---
+category: minorAnalysis
+---
+* A bug has been fixed in the heuristic identification of uncertain control
+  flow, which is used to filter data flow in order to improve performance and
+  reduce false positives. This fix means that slightly more code is identified
+  and hence pruned from data flow.

java/ql/lib/change-notes/2024-06-28-resource-models.md

@@ -0,0 +1,11 @@
+---
+category: minorAnalysis
+---
+* Added models for the following packages:
+
+  * io.undertow.server.handlers.resource
+  * jakarta.faces.context
+  * javax.faces.context
+  * javax.servlet
+  * org.jboss.vfs
+  * org.springframework.core.io