Release preparation for version 2.22.2

go/ql/consistency-queries/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.0.27
+
+No user-facing changes.
+
 ## 1.0.26
 
 No user-facing changes.

go/ql/consistency-queries/change-notes/released/1.0.27.md

@@ -0,0 +1,3 @@
+## 1.0.27
+
+No user-facing changes.

go/ql/consistency-queries/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.26
+lastReleaseVersion: 1.0.27

go/ql/consistency-queries/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.27-dev
+version: 1.0.27
 groups:
   - go
   - queries

go/ql/lib/CHANGELOG.md

@@ -1,3 +1,15 @@
+## 4.3.0
+
+### Deprecated APIs
+
+* The class `BuiltinType` is now deprecated. Use the new replacement `BuiltinTypeEntity` instead.
+* The class `DeclaredType` is now deprecated. Use the new replacement `DeclaredTypeEntity` instead.
+
+### Minor Analysis Improvements
+
+* Added models for the `Head` function and the `Client.Head` method, from the `net/http` package, to the `Http::ClientRequest` class. This means that they will be recognized as sinks for the query `go/request-forgery` and the experimental query `go/ssrf`.
+* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.
+
 ## 4.2.8
 
 No user-facing changes.

go/ql/lib/change-notes/2025-06-03-fix-definedtype-getbasetype.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.

go/ql/lib/change-notes/2025-06-05-deprecate-DeclaredType-BuiltinType.md

@@ -1,5 +0,0 @@
----
-category: deprecated
----
-* The class `BuiltinType` is now deprecated. Use the new replacement `BuiltinTypeEntity` instead.
-* The class `DeclaredType` is now deprecated. Use the new replacement `DeclaredTypeEntity` instead.

go/ql/lib/change-notes/2025-07-08-request-forgery-sinks.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added models for the `Head` function and the `Client.Head` method, from the `net/http` package, to the `Http::ClientRequest` class. This means that they will be recognized as sinks for the query `go/request-forgery` and the experimental query `go/ssrf`.

go/ql/lib/change-notes/released/4.3.0.md

@@ -0,0 +1,11 @@
+## 4.3.0
+
+### Deprecated APIs
+
+* The class `BuiltinType` is now deprecated. Use the new replacement `BuiltinTypeEntity` instead.
+* The class `DeclaredType` is now deprecated. Use the new replacement `DeclaredTypeEntity` instead.
+
+### Minor Analysis Improvements
+
+* Added models for the `Head` function and the `Client.Head` method, from the `net/http` package, to the `Http::ClientRequest` class. This means that they will be recognized as sinks for the query `go/request-forgery` and the experimental query `go/ssrf`.
+* Previously, `DefinedType.getBaseType` gave the underlying type. It now gives the right hand side of the type declaration, as the documentation indicated that it should.

go/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 4.2.8
+lastReleaseVersion: 4.3.0

go/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 4.2.9-dev
+version: 4.3.0
 groups: go
 dbscheme: go.dbscheme
 extractor: go

go/ql/src/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 1.4.1
+
+### Minor Analysis Improvements
+
+* `filepath.IsLocal` is now recognised as a sanitizer against path-traversal and related vulnerabilities.
+
 ## 1.4.0
 
 ### Query Metadata Changes

go/ql/src/change-notes/released/1.4.1.md

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 1.4.1
+
+### Minor Analysis Improvements
+
 * `filepath.IsLocal` is now recognised as a sanitizer against path-traversal and related vulnerabilities.

go/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.0
+lastReleaseVersion: 1.4.1

go/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.4.1-dev
+version: 1.4.1
 groups:
   - go
   - queries