github-actions[bot]
5576d30780
Add changed framework coverage reports
2026-06-04 01:04:50 +00:00
Owen Mansel-Chan
da999ee440
Address review comments
2026-06-03 21:24:16 +01:00
Tom Hvitved
3da195f50f
Merge pull request #21918 from hvitved/rust/expose-resolution
...
Rust: Add `Impl::getSelf()` and `Impl::getTrait()`
2026-06-03 20:18:05 +02:00
Henry Mercer
93a4b427e3
Merge pull request #21933 from github/post-release-prep/codeql-cli-2.25.6
...
Post-release preparation for codeql-cli-2.25.6
2026-06-03 16:57:48 +01:00
Tom Hvitved
0430c71318
Merge pull request #21922 from hvitved/rust/static-const-resolution
...
Rust: Path resolution for `static` items
2026-06-03 17:48:21 +02:00
Owen Mansel-Chan
52f2a5825a
Merge pull request #21804 from github/copilot/add-tests-for-models
...
Java: Update CWE-918 model coverage for Apache HttpClient `execute` sinks
2026-06-03 12:55:56 +01:00
Owen Mansel-Chan
d55ff83568
Merge pull request #21269 from owen-mc/go/improve-tests-for-varargs-flow
...
Go: improve tests for varargs flow
2026-06-03 12:39:46 +01:00
BazookaMusic
f34275636c
No duplicate Ssa and remove release changenot
2026-06-03 11:54:24 +02:00
BazookaMusic
0a801440b9
review comments
2026-06-03 10:48:50 +02:00
Asger F
7edf0100cc
Merge pull request #21924 from asgerf/asgerf/yeast-changes
...
Yeast: some fixes
2026-06-03 10:32:38 +02:00
Owen Mansel-Chan
167c837088
Merge pull request #21914 from owen-mc/shared/cfg/if-init
...
Shared CFG: allow init stmts for IfStmt
2026-06-02 22:01:02 +01:00
Owen Mansel-Chan
6f2cc43f32
Remove imprecise model for tuple()
2026-06-02 21:59:48 +01:00
Owen Mansel-Chan
5042fdee84
Remove imprecise model for list()
2026-06-02 21:59:46 +01:00
Owen Mansel-Chan
04341c47bd
Tweak model for str.join
2026-06-02 21:59:44 +01:00
Tom Hvitved
af45e53e77
Rust: Rename parameter in DB upgrade script
2026-06-02 21:18:53 +02:00
Owen Mansel-Chan
b27d08ee32
Update edges in expected test output
2026-06-02 18:29:56 +01:00
Jeroen Ketema
d11fc3a00e
Merge pull request #21932 from jketema/jketema/vue
...
JS: Add Vue to `file_coverage_languages` and `github_api_languages`
2026-06-02 17:53:25 +02:00
Owen Mansel-Chan
20ce679d61
Accept changed edges in test output
...
No changes to alerts
2026-06-02 16:15:08 +01:00
Owen Mansel-Chan
f62ebef9e0
Adjust expected test output
2026-06-02 16:15:06 +01:00
Owen Mansel-Chan
c3ef1ddd64
Add MaD models for lxml and xml etree.fromstringlist
2026-06-02 16:15:01 +01:00
Owen Mansel-Chan
dede5bc49b
Track flow through tuple() with list with tainted elements
2026-06-02 16:14:59 +01:00
Owen Mansel-Chan
ad97b6dd64
Use access path for str.join model
2026-06-02 16:14:56 +01:00
Jeroen Ketema
9d5dfea5c5
JS: Add Vue to file_coverage_languages and github_api_languages
2026-06-02 16:57:51 +02:00
yoff
f7c4e61956
Apply suggestions from code review
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-02 15:12:41 +02:00
Tom Hvitved
dc0c7d7ec2
Fix commment typos
2026-06-02 14:41:27 +02:00
yoff
575ece6ae2
Python: Add change note
2026-06-02 13:50:31 +02:00
yoff
f6ed5c19be
Python: fix sub class test
2026-06-02 13:50:31 +02:00
yoff
4298b70f1c
Python: add test for sub class
2026-06-02 13:49:25 +02:00
yoff
e88b8c53f3
Python: Add test for instances
2026-06-02 13:49:24 +02:00
Owen Mansel-Chan
aaa3b363e1
Merge pull request #21929 from owen-mc/go/no-ret-functions
...
Go: Recognize more non-returning logging functions
2026-06-02 10:39:28 +01:00
Sotiris Dragonas
61a5cece56
Merge branch 'main' into bazookamusic/range-analysis-bound-move-to-shared
2026-06-02 10:41:49 +02:00
BazookaMusic
566a92e555
formatting again
2026-06-02 10:41:10 +02:00
Owen Mansel-Chan
9dbe9adb00
Update tests
2026-06-02 09:34:03 +01:00
Owen Mansel-Chan
be9c785cb2
Fix incorrect QLDoc
...
Co-authored-by: Tom Hvitved <hvitved@github.com >
2026-06-02 09:26:13 +01:00
yoff
ac5fa629ef
Python: inline init_module_submodule_defn into ImportResolution
...
The new-dataflow ImportResolution module only used
semmle.python.essa.SsaDefinitions for the 5-line helper predicate
SsaSource::init_module_submodule_defn. Inline it locally and drop the
dependency on legacy SsaDefinitions. This is the only remaining direct
import of semmle.python.essa.* in the new dataflow stack, so dropping
it makes the layering cleaner.
Semantic noop on the current SSA: SsaSourceVariable.getName() and
GlobalVariable.getId() both project the same DB column
(variable(_,_,result)), and the old call's 'init.getEntryNode() = f'
join was just constraining init = package via Scope.getEntryNode()'s
functional uniqueness. RA dump of accesses.ql confirms only the
expected predicate-rename shuffle; all 70 dataflow + ApiGraphs library
tests pass.
This factors out commit 8cab5a20f21 from the larger shared-CFG
migration #21925 .
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com >
2026-06-02 08:24:17 +00:00
Tom Hvitved
1fd31d0ddd
Rust: Data flow for consts and statics
2026-06-02 09:55:51 +02:00
Tom Hvitved
c319680589
Ruby: Fix bug in implicitAssignmentNode
2026-06-02 09:03:59 +02:00
Tom Hvitved
434850edd3
Ruby: More variable tests
2026-06-02 09:03:57 +02:00
Tom Hvitved
c4e3720d8a
Rust: Run codegen
2026-06-02 09:02:57 +02:00
Tom Hvitved
0547e9c98d
Rust: Path resolution for static items
2026-06-02 09:02:56 +02:00
Owen Mansel-Chan
703cea2b65
Model panicking log functions better
2026-06-02 01:32:00 +01:00
Owen Mansel-Chan
e6e8e3d005
Taint doesn't flow through panicking functions
2026-06-02 01:31:44 +01:00
Owen Mansel-Chan
adc9b7714b
Accept changed test output
2026-06-02 00:57:06 +01:00
Owen Mansel-Chan
e706c5f444
Improve test for non-returning fns
2026-06-02 00:56:12 +01:00
Owen Mansel-Chan
8a1e6d4f64
Add missing QLDocs
2026-06-02 00:41:48 +01:00
Owen Mansel-Chan
1a747dd8be
(Trivial) Fix QLDoc grammar
2026-06-02 00:39:25 +01:00
Owen Mansel-Chan
28bb1a6870
Add change note
2026-06-02 00:16:23 +01:00
Owen Mansel-Chan
45b1253b23
Improve glog and klog tests
2026-06-02 00:16:21 +01:00
Owen Mansel-Chan
c99dab1d71
Improve glog (and klog) modelling
2026-06-02 00:16:19 +01:00
Owen Mansel-Chan
f3e3647209
Improve noretFunctions test
2026-06-02 00:16:17 +01:00
