Merge branch 'main' into max-schaefer/improve-command-injection-qhelp

javascript/ql/src/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.7.0
+
+### Bug Fixes
+
+* The query "Arbitrary file write during zip extraction ("Zip Slip")" (`js/zipslip`) has been renamed to "Arbitrary file access during archive extraction ("Zip Slip")."
+
+## 0.6.4
+
+No user-facing changes.
+
 ## 0.6.3
 
 ### Minor Analysis Improvements

javascript/ql/src/change-notes/2023-07-10-path-join-spread.md

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* The `fs/promises` package is now recognised as an alias for `require('fs').promises`.
+* The `js/path-injection` query can now track taint through calls to `path.join()` with a spread argument, such as `path.join(baseDir, ...args)`.

javascript/ql/src/change-notes/released/0.6.4.md

@@ -0,0 +1,3 @@
+## 0.6.4
+
+No user-facing changes.

javascript/ql/src/change-notes/released/0.7.0.md

@@ -1,4 +1,5 @@
----
-category: fix
----
+## 0.7.0
+
+### Bug Fixes
+
 * The query "Arbitrary file write during zip extraction ("Zip Slip")" (`js/zipslip`) has been renamed to "Arbitrary file access during archive extraction ("Zip Slip")."

javascript/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.3
+lastReleaseVersion: 0.7.0

javascript/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 0.6.4-dev
+version: 0.7.1-dev
 groups: 
   - javascript
   - queries