hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 19:29:28 +02:00
Code Issues Packages Projects Releases Wiki Activity
86,945 Commits 1,758 Branches 167 Tags
08aced85ba8b8e773f482050ba00f119423bcff0
Commit Graph

86945 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Florin Coada
08aced85ba Add barrier and barrier guard documentation for Rust 
Add barrierModel and barrierGuardModel sections to the Rust library
models documentation, following the pattern established in PR #21523
for other languages.

Includes:
- New extensible predicate descriptions in the overview
- Example: barrier for SQL injection using escape_sql
- Example: barrier guard for path injection using is_safe_path
- Reference material for both barrierModel and barrierGuardModel

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-04-17 11:09:46 +01:00
Florin Coada
6c83ec6e61 docs: Add 'Customizing library models for Rust' documentation 
Add documentation for customizing library models for Rust using data
extension files. This follows the pattern of existing documentation for
other languages (Java, Python, Ruby, Go, C#, C++, JavaScript).

The documentation covers:
- Rust-specific extensible predicates (sourceModel, sinkModel,
  summaryModel, neutralModel) with their simplified schema
- Canonical path syntax for identifying Rust functions and methods
- Examples using real models from the codebase (sqlx, reqwest,
  std::env, std::path, Iterator::map)
- Access path token reference (Argument, Parameter, ReturnValue,
  Element, Field, Reference, Future)
- Source and sink kind reference
- Threat model integration

Also updates codeql-for-rust.rst to include the new page in the
toctree.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-04-17 10:02:34 +01:00
Paolo Tranquilli
5342cc79fb Merge pull request #21574 from github/redsun82/actions/remove-harden-runner-false-positive 
Remove false positive injection sink models for `docker/build-push-action` and `step-security/harden-runner`
 2026-04-17 09:43:45 +02:00
Tom Hvitved
ee34e3353d Merge pull request #21698 from hvitved/rust/type-inference-index-expr 
Rust: Replace special handling of index expressions in type inference
 2026-04-16 09:03:06 +02:00
Jon Janego
f95ee129df Merge pull request #21713 from github/codeql-spark-run-24459914636 
Update changelog documentation site for codeql-cli-2.25.2
 2026-04-15 09:55:53 -05:00
github-actions[bot]
d24fb29ff4 update codeql documentation 2026-04-15 14:23:47 +00:00
Jeroen Ketema
97d8993fc5 Merge pull request #21667 from jketema/jketema/swift-6.3 
Swift: Update to Swift 6.3
 2026-04-15 14:07:23 +02:00
Jeroen Ketema
7d1c62daa6 Swift: Address review comment 2026-04-15 13:37:15 +02:00
Tom Hvitved
597d81038a Merge pull request #21708 from github/copilot/fix-missed-opportunity-to-use-select 
Fix false positive in `MissedSelectOpportunity` when foreach body uses `await`
 2026-04-15 11:32:02 +02:00
Tom Hvitved
069431941e Merge pull request #21596 from hvitved/rust/data-flow-closure-type 
Rust: Track closure types in data flow
 2026-04-15 10:32:05 +02:00
Tom Hvitved
609621f638 Merge pull request #21679 from hvitved/rust/type-inference-forall-checks 
Rust: Replace recursion through `forall` with ranked recursion
 2026-04-15 09:43:37 +02:00
Jeroen Ketema
ae2226345e Merge pull request #21709 from jketema/depr 
C++: Remove deprecated code deprecated more than a year ago
 2026-04-14 17:04:48 +02:00
Owen Mansel-Chan
6e0bee7471 Merge pull request #21691 from github/dependabot/go_modules/go/extractor/extractor-dependencies-2d1b0e128d 
Bump the extractor-dependencies group across 1 directory with 2 updates
 2026-04-14 15:26:00 +01:00
Henry Mercer
cb1fd76a4c Merge pull request #21658 from github/post-release-prep/codeql-cli-2.25.2 
Post-release preparation for codeql-cli-2.25.2
 2026-04-14 15:24:13 +01:00
Tom Hvitved
467933bbb1 Rust: Also add specialized IndexMut implementations 2026-04-14 15:45:14 +02:00
Henry Mercer
43c9b95e6f Merge branch 'main' into post-release-prep/codeql-cli-2.25.2 2026-04-14 13:56:52 +01:00
Tom Hvitved
878cfd720c C#: Use inline test expectations 2026-04-14 14:41:28 +02:00
Geoffrey White
666c8bf87a Merge pull request #21635 from geoffw0/suspicioussizeof2 
C++: Upgrade cpp/suspicious-add-sizeof to high precision
 2026-04-14 13:04:24 +01:00
Jeroen Ketema
07b02942db Merge remote-tracking branch 'upstream/main' into jketema/swift-6.3 2026-04-14 13:54:16 +02:00
Jeroen Ketema
9ef088d423 C++: Add change note 2026-04-14 13:46:43 +02:00
Taus
c748fdf8ee Merge pull request #21694 from github/tausbn/python-add-support-for-pep-810 
Python: Add support for PEP 810
 2026-04-14 13:27:08 +02:00
Tom Hvitved
b749ad645a Merge pull request #21706 from hvitved/rust/type-inference-perf-fixes 
Rust: Improve performance of two type inference predicates
 2026-04-14 13:06:26 +02:00
Jeroen Ketema
12868e5140 C++: Remove deprecated code added more than a year ago 2026-04-14 13:03:10 +02:00
Geoffrey White
fe7e8480b2 Merge branch 'main' into suspicioussizeof2 2026-04-14 10:52:00 +01:00
Anders Schack-Mulligen
e0952948ba Merge pull request #21701 from aschackmull/csharp/intvalue 
C#: Introduce Expr.getIntValue.
 2026-04-14 11:23:29 +02:00
Owen Mansel-Chan
7458674470 Merge pull request #21584 from owen-mc/shared/update-mad-comments 
Shared: update code comments explaining models-as-data format to include barriers and barrier guards
 2026-04-14 09:30:28 +01:00
copilot-swe-agent[bot]
3483050526 Fix false positive in MissedSelectOpportunity for async/await loops 
Agent-Logs-Url: https://github.com/github/codeql/sessions/3e8f4320-2bf4-45f5-b9ea-dad41d522d84

Co-authored-by: hvitved <3667920+hvitved@users.noreply.github.com>
 2026-04-14 08:18:02 +00:00
copilot-swe-agent[bot]
0e66555e37 Initial plan 2026-04-14 08:10:53 +00:00
Jeroen Ketema
0724c22f28 Merge pull request #21702 from jketema/conv-string 
C++: Use new `getConvSpecString` instead of `getConvSpecOffset` and `substring`
 2026-04-14 10:00:51 +02:00
Tom Hvitved
d69be77035 Rust: Avoid expensive regex calls 
Before
```
Pipeline standard for TypeInference::AssocFunctionResolution::AssocFunctionCall.hasIncompatibleTarget/5#85c07422@d5eb7r0w was evaluated in 782 iterations totaling 13208ms (delta sizes total: 20187834).
            1464   ~2%    {7} r1 = JOIN `TypeInference::AssocFunctionResolution::SelfArgIsInstantiationOf::argIsInstantiationOf/6#aaa87ac9#prev_delta` WITH `TypeInference::AssocFunctionResolution::OverloadedCallArgsAreInstantiationsOf::argsAreNotInstantiationsOf/2#6a6070f7#prev` ON FIRST 2 OUTPUT Lhs.5, _, Lhs.0, Lhs.1, Lhs.2, Lhs.3, Lhs.4
            1464   ~0%    {7}    | REWRITE WITH Out.1 := ""
            1464   ~0%    {6}    | JOIN WITH `FunctionType::AssocFunctionType.getTypeAt/1#dispred#d4d46f61` ON FIRST 2 OUTPUT Lhs.2, Lhs.3, Lhs.4, Lhs.5, Lhs.6, Rhs.2

          173691   ~1%    {7} r2 = JOIN `TypeInference::AssocFunctionResolution::OverloadedCallArgsAreInstantiationsOf::argsAreNotInstantiationsOf/2#6a6070f7#prev_delta` WITH `TypeInference::AssocFunctionResolution::SelfArgIsInstantiationOf::argIsInstantiationOf/6#aaa87ac9#prev` ON FIRST 2 OUTPUT Rhs.5, _, Lhs.0, Lhs.1, Rhs.2, Rhs.3, Rhs.4
          173691   ~1%    {7}    | REWRITE WITH Out.1 := ""
          173691   ~1%    {6}    | JOIN WITH `FunctionType::AssocFunctionType.getTypeAt/1#dispred#d4d46f61` ON FIRST 2 OUTPUT Lhs.2, Lhs.3, Lhs.4, Lhs.5, Lhs.6, Rhs.2

        20022454   ~0%    {7} r3 = SCAN `TypeInference::AssocFunctionResolution::SelfArgIsInstantiationOf::argIsNotInstantiationOf/6#1b8e512e#prev_delta` OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, _
        20022454   ~0%    {7}    | REWRITE WITH Out.6 := "^([0-9]+)\\..*$"
        20022175   ~2%    {9}    | JOIN WITH PRIMITIVE regexpCapture#bbff ON Lhs.5,Lhs.6
        20022175   ~2%    {10}    | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, In.6, In.7, In.8, _
                          {9}    | REWRITE WITH Tmp.9 := 1, TEST InOut.7 = Tmp.9 KEEPING 9
        20022175   ~1%    {7}    | SCAN OUTPUT In.8, In.0, In.1, In.2, In.3, In.4, In.5
        20022175   ~1%    {8}    | JOIN WITH `UnboundList::Make<Locations::Location,TypeInference::M1::UnboundListInput>::encode/1#47b2ec3f_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3, Lhs.4, Lhs.5, Lhs.6, Lhs.0
        20022175   ~0%    {10}    | JOIN WITH `Type::Type.getATypeParameter/0#dispred#ddf0e8ff_10#join_rhs` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4, Lhs.5, Rhs.1, _, Lhs.6, Lhs.7, _
                          {7}    | REWRITE WITH Tmp.6 := length(In.8), Tmp.9 := 1, Tmp.6 := (Tmp.6 + Tmp.9), Out.6 := suffix(In.7,Tmp.6) KEEPING 7
        20022175   ~0%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5

        20197330   ~0%    {6} r4 = r1 UNION r2 UNION r3
        20187834   ~0%    {6}    | AND NOT `TypeInference::AssocFunctionResolution::AssocFunctionCall.hasIncompatibleTarget/5#85c07422#prev`(FIRST 6)
                          return r4
```

After
```
Pipeline standard for TypeInference::AssocFunctionResolution::AssocFunctionCall.hasIncompatibleTarget/5#85c07422@a58ce91w was evaluated in 537 iterations totaling 382ms (delta sizes total: 20033950).
        19862347   ~0%    {7} r1 = SCAN `TypeInference::AssocFunctionResolution::SelfArgIsInstantiationOf::argIsNotInstantiationOf/6#1b8e512e#prev_delta` OUTPUT In.5, _, In.0, In.1, In.2, In.3, In.4
        19862347   ~0%    {7}    | REWRITE WITH Out.1 := ""

          174684   ~1%    {7} r2 = SCAN `TypeInference::AssocFunctionResolution::AssocFunctionCall.hasIncompatibleArgsTarget/5#dispred#7d49b9f9#prev_delta` OUTPUT In.5, _, In.0, In.1, In.2, In.3, In.4
          174684   ~1%    {7}    | REWRITE WITH Out.1 := ""

        20037031   ~0%    {7} r3 = r1 UNION r2
        20037031   ~0%    {6}    | JOIN WITH `FunctionType::AssocFunctionType.getTypeAt/1#dispred#d4d46f61` ON FIRST 2 OUTPUT Lhs.2, Lhs.3, Lhs.4, Lhs.5, Lhs.6, Rhs.2
        20033950   ~0%    {6}    | AND NOT `TypeInference::AssocFunctionResolution::AssocFunctionCall.hasIncompatibleTarget/5#85c07422#prev`(FIRST 6)
                          return r3
```
 2026-04-14 09:51:45 +02:00
Tom Hvitved
0db62b2e68 Type inference: Fix bad join 
Before
```
Pipeline standard for TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112@d5eb7x9q was evaluated in 471 iterations totaling 24306ms (delta sizes total: 42097188).
        5676156578   ~1%    {7} r1 = JOIN `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112#prev_delta` WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersEqual/4#a276e5d4#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.1, Lhs.2, Rhs.3, _, Lhs.3, _
                            {5}    | REWRITE WITH Tmp.4 := 1, Out.4 := (Tmp.4 + In.5), Tmp.6 := 0, TEST Out.4 != Tmp.6 KEEPING 5
        5676156578   ~1%    {5}    | SCAN OUTPUT In.1, In.4, In.3, In.0, In.2
          41691564   ~1%    {4}    | JOIN WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::ArgumentTypeAndBlanketOffset,TypeMention::TypeMention,TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::SatisfiesBlanketConstraint::Inp>::TermIsInstantiationOfCondition::getNthTypeParameter/2#40c66343` ON FIRST 3 OUTPUT Lhs.3, Lhs.0, Lhs.4, Lhs.1

          42097188   ~2%    {4} r2 = SCAN `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersEqual/4#a276e5d4#prev_delta` OUTPUT In.1, In.3, In.0, In.2

          42097188   ~1%    {5} r3 = JOIN r2 WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::ArgumentTypeAndBlanketOffset,TypeMention::TypeMention,TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::SatisfiesBlanketConstraint::Inp>::TermIsInstantiationOfCondition::getNthTypeParameter/2#40c66343_021#join_rhs` ON FIRST 2 OUTPUT Lhs.2, Lhs.0, Lhs.3, Rhs.2, _
                            {4}    | REWRITE WITH Tmp.4 := 0, TEST InOut.3 != Tmp.4 KEEPING 4
          41691564   ~1%    {5}    | SCAN OUTPUT In.0, In.1, In.2, _, In.3
          41691564   ~1%    {5}    | REWRITE WITH Tmp.3 := 1, Out.3 := (InOut.4 - Tmp.3)
                 0   ~0%    {4}    | JOIN WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112#prev` ON FIRST 4 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.4

          42097188   ~0%    {6} r4 = JOIN r2 WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::ArgumentTypeAndBlanketOffset,TypeMention::TypeMention,TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::SatisfiesBlanketConstraint::Inp>::TermIsInstantiationOfCondition::getNthTypeParameter/2#40c66343_021#join_rhs` ON FIRST 2 OUTPUT Lhs.2, Lhs.0, Lhs.3, Lhs.1, Rhs.2, _
                            {5}    | REWRITE WITH Tmp.5 := 0, TEST InOut.4 = Tmp.5 KEEPING 5
            405624   ~1%    {5}    | SCAN OUTPUT In.1, _, In.3, In.0, In.2
            405624   ~1%    {5}    | REWRITE WITH Out.1 := 0
            405624   ~0%    {4}    | JOIN WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::ArgumentTypeAndBlanketOffset,TypeMention::TypeMention,TypeInference::AssocFunctionResolution::ArgSatisfiesBlanketLikeConstraint::SatisfiesBlanketConstraint::Inp>::TermIsInstantiationOfCondition::getNthTypeParameter/2#40c66343` ON FIRST 3 OUTPUT Lhs.3, Lhs.0, Lhs.4, _
            405624   ~1%    {4}    | REWRITE WITH Out.3 := 0

          42097188   ~1%    {4} r5 = r1 UNION r3 UNION r4
          42097188   ~1%    {4}    | AND NOT `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112#prev`(FIRST 4)
                            return r5
```

After
```
Pipeline standard for TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112@96df1x2u was evaluated in 471 iterations totaling 4058ms (delta sizes total: 42097188).
        42097188   ~0%    {4} r1 = SCAN `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersEqual/5#ddfcf430#prev_delta` OUTPUT In.3, In.0, In.1, In.2
          405624   ~0%    {4}    | JOIN WITH const_0 ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, _
          405624   ~1%    {4}    | REWRITE WITH Out.3 := 0

        42097188   ~1%    {6} r2 = SCAN `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112#prev_delta` OUTPUT In.0, In.1, In.2, _, In.3, _
        42097188   ~1%    {4}    | REWRITE WITH Tmp.3 := 1, Out.3 := (Tmp.3 + In.4), Tmp.5 := 0, TEST Out.3 != Tmp.5 KEEPING 4
        41691564   ~1%    {4}    | JOIN WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersEqual/5#ddfcf430#prev` ON FIRST 4 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3

        42097188   ~1%    {6} r3 = SCAN `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersEqual/5#ddfcf430#prev_delta` OUTPUT In.0, In.1, In.2, In.3, In.4, _
                          {5}    | REWRITE WITH Tmp.5 := 0, TEST InOut.3 != Tmp.5 KEEPING 5
        41691564   ~1%    {5}    | SCAN OUTPUT In.0, In.1, In.2, _, In.3
        41691564   ~1%    {5}    | REWRITE WITH Tmp.3 := 1, Out.3 := (InOut.4 - Tmp.3)
               0   ~0%    {4}    | JOIN WITH `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112#prev` ON FIRST 4 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.4

        42097188   ~1%    {4} r4 = r1 UNION r2 UNION r3
        42097188   ~1%    {4}    | AND NOT `TypeInference::M2::SatisfiesConstraintWithTypeMatching<TypeInference::FunctionCallMatching::AccessConstraint::RelevantAccess,TypeMention::TypeMention,TypeInference::FunctionCallMatching::AccessConstraint::SatisfiesTypeParameterConstraintInput>::TermIsInstantiationOfCondition::typeParametersHaveEqualInstantiationToIndex/4#dde26112#prev`(FIRST 4)
                          return r4
```
 2026-04-14 09:34:13 +02:00
Jeroen Ketema
26715fc95c C++: Rename rst to convSpec 2026-04-14 08:03:51 +02:00
dependabot[bot]
b19f2c6874 Bump the extractor-dependencies group in /go/extractor with 2 updates 
Bumps the extractor-dependencies group in /go/extractor with 2 updates: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools).


Updates `golang.org/x/mod` from 0.34.0 to 0.35.0
- [Commits](https://github.com/golang/mod/compare/v0.34.0...v0.35.0)

Updates `golang.org/x/tools` from 0.43.0 to 0.44.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.43.0...v0.44.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.35.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-14 03:04:45 +00:00
Tom Hvitved
f6fb613962 Merge pull request #21700 from hvitved/js/fastify-per-route-rate-limiting 
JS: Recognize Fastify per-route rate limiting
 2026-04-13 17:28:34 +02:00
Jeroen Ketema
e0ce5bcf40 Merge pull request #21699 from jketema/join-fix 
C++: Fix `isCompiledAsC` join order
 2026-04-13 16:03:38 +02:00
Jeroen Ketema
19c4b2ff8f C++: Use getConvSpecString instead of getConvSpecOffset and substring 2026-04-13 15:44:41 +02:00
Anders Schack-Mulligen
d3e580fd0e C#: Introduce Expr.getIntValue. 2026-04-13 14:52:38 +02:00
Taus
2eeb31b472 Python: Add tests for lazy from ... import * as well 2026-04-13 11:49:06 +00:00
Taus
81468daf9c Merge pull request #21603 from github/tausbn/python-port-use-of-exit 
Python: Port UseOfExit.ql
 2026-04-13 13:20:29 +02:00
Taus
720ea702fe Merge pull request #21602 from github/tausbn/python-port-modification-of-locals 
Python: Port ModificationOfLocals.ql
 2026-04-13 13:19:40 +02:00
Taus
36bbc8ca14 Merge pull request #21601 from github/tausbn/python-port-unused-exception-object 
Python: Port UnusedExceptionObject.ql
 2026-04-13 13:19:12 +02:00
Taus
cc9bc746a1 Merge pull request #21597 from github/tausbn/python-port-unreachable-code 
Python: Port UnreachableCode.ql
 2026-04-13 13:17:59 +02:00
Tom Hvitved
fcfb8c9c6b Add change note 2026-04-13 12:22:30 +02:00
Tom Hvitved
7a48409e38 JS: Recognize Fastify per-route rate limiting 2026-04-13 11:31:34 +02:00
Tom Hvitved
fef582c858 JS: Add test case for Fastify per-route rate limiting 2026-04-13 11:24:41 +02:00
Jeroen Ketema
bee39c9d51 C++: Fix isCompiledAsC join order 
Before on Abseil Windows for `cpp/too-few-arguments:`:
```
Pipeline standard for TooFewArguments::isCompiledAsC/1#52fe29e8@994f9bgp was evaluated in 12 iterations totaling 2ms (delta sizes total: 50).
        1198778   ~3%    {1} r1 = JOIN `TooFewArguments::isCompiledAsC/1#52fe29e8#prev_delta` WITH `Element::Element.getFile/0#2b8c8740_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1
             83  ~26%    {1}    | JOIN WITH includes ON FIRST 1 OUTPUT Rhs.1
             50   ~4%    {1}    | AND NOT `TooFewArguments::isCompiledAsC/1#52fe29e8#prev`(FIRST 1)
                         return r1
```

After:
```
Pipeline standard for #File::File.getAnIncludedFile/0#dispred#e8d44cd1Plus#bf@b8d290i6 was evaluated in 11 iterations totaling 0ms (delta sizes total: 43).
        47   ~0%    {2} r1 = SCAN `#File::File.getAnIncludedFile/0#dispred#e8d44cd1Plus#bf#prev_delta` OUTPUT In.1, In.0
        78  ~28%    {2}    | JOIN WITH `File::File.getAnIncludedFile/0#dispred#e8d44cd1` ON FIRST 1 OUTPUT Lhs.1, Rhs.1
        43   ~0%    {2}    | AND NOT `#File::File.getAnIncludedFile/0#dispred#e8d44cd1Plus#bf#prev`(FIRST 2)
                    return r1

[2026-04-13 11:05:25] Evaluated non-recursive predicate TooFewArguments::isCompiledAsC/1#52fe29e8@4a3eb9jk in 0ms (size: 49).
Evaluated relational algebra for predicate TooFewArguments::isCompiledAsC/1#52fe29e8@4a3eb9jk with tuple counts:
         1   ~0%    {3} r1 = CONSTANT(unique int, unique string, unique string)[1,"compiled as c","1"]
         1   ~0%    {1}    | JOIN WITH #fileannotationsMerge_1230#join_rhs ON FIRST 3 OUTPUT Rhs.3

        48   ~0%    {1} r2 = JOIN r1 WITH `#File::File.getAnIncludedFile/0#dispred#e8d44cd1Plus#bf` ON FIRST 1 OUTPUT Rhs.1

        49   ~0%    {1} r3 = r1 UNION r2
                    return r3
```
 2026-04-13 11:13:52 +02:00
Tom Hvitved
40eff6525d Rust: Replace special handling of index expressions 2026-04-13 10:30:01 +02:00
Geoffrey White
ae85ada669 Merge pull request #21634 from geoffw0/compwidertype2 
C++: Upgrade cpp/comparison-with-wider-type to high precision
 2026-04-10 16:08:11 +01:00
Taus
86020d9eed Python: Add change note 2026-04-10 14:43:30 +00:00
Taus
6b7d47ee7d Python: Add QL test for the new syntax 2026-04-10 14:39:13 +00:00