Bump actions/cache from 3 to 5

Bumps [actions/cache](https://github.com/actions/cache) from 3 to 5. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/v3...v5) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Merge pull request #21510 from hvitved/ci/remove-ruby-checks
2026-05-18 13:17:08 +02:00 · 2026-03-21 07:05:46 +00:00 · 2026-03-21 08:04:17 +01:00 · 2026-03-20 15:14:24 +01:00 · 2026-03-20 14:12:59 +01:00 · 2026-03-20 12:04:27 +01:00
541 changed files with 3461 additions and 2820 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -45,3 +45,5 @@ updates:
    directory: "/"
    schedule:
      interval: weekly
+    exclude-paths:
+      - "misc/bazel/registry/**"
--- a/.github/workflows/compile-queries.yml
+++ b/.github/workflows/compile-queries.yml
@@ -1,78 +0,0 @@
-name: "Compile all queries using the latest stable CodeQL CLI"
-
-on:
-  push:
-    branches:  # makes sure the cache gets populated - running on the branches people tend to merge into.
-      - main
-      - "rc/*"
-      - "codeql-cli-*"
-  pull_request:
-    paths:
-      - '**.ql'
-      - '**.qll'
-      - '**/qlpack.yml'
-      - '**.dbscheme'
-
-permissions:
-  contents: read
-
-jobs:
-  detect-changes:
-    if: github.repository_owner == 'github'
-    runs-on: ubuntu-latest
-    outputs:
-      languages: ${{ steps.detect.outputs.languages }}
-    steps:
-      - uses: actions/checkout@v5
-      - name: Detect changed languages
-        id: detect
-        run: |
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            # For PRs, detect which languages have changes
-            changed_files=$(gh pr view ${{ github.event.pull_request.number }} --json files --jq '.files.[].path')
-            languages=()
-            for lang in actions cpp csharp go java javascript python ql ruby rust swift; do
-              if echo "$changed_files" | grep -qE "^($lang/|shared/)" ; then
-                languages+=("$lang")
-              fi
-            done
-            echo "languages=$(jq -c -n '$ARGS.positional' --args "${languages[@]}")" >> $GITHUB_OUTPUT
-          else
-            # For pushes to main/rc branches, run all languages
-            echo 'languages=["actions","cpp","csharp","go","java","javascript","python","ql","ruby","rust","swift"]' >> $GITHUB_OUTPUT
-          fi
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-  compile-queries:
-    needs: detect-changes
-    if: github.repository_owner == 'github' && needs.detect-changes.outputs.languages != '[]'
-    runs-on: ubuntu-latest-xl
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ${{ fromJson(needs.detect-changes.outputs.languages) }}
-
-    steps:
-      - uses: actions/checkout@v5
-      - name: Setup CodeQL
-        uses: ./.github/actions/fetch-codeql
-        with:
-          channel: 'release'
-      - name: Cache compilation cache
-        id: query-cache
-        uses: ./.github/actions/cache-query-compilation
-        with: 
-          key: ${{ matrix.language }}-queries
-      - name: check formatting
-        run: find shared ${{ matrix.language }}/ql -type f \( -name "*.qll" -o -name "*.ql" \) -print0 | xargs -0 -n 3000 -P 10 codeql query format -q --check-only
-      - name: compile queries - check-only
-        # run with --check-only if running in a PR (github.sha != main)
-        if : ${{ github.event_name == 'pull_request' }}
-        shell: bash
-        run: codeql query compile -q -j0 ${{ matrix.language }}/ql/{src,examples} --keep-going --warnings=error --check-only --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" --compilation-cache-size=500 --ram=56000
-      - name: compile queries - full
-        # do full compile if running on main - this populates the cache
-        if : ${{ github.event_name != 'pull_request' }}
-        shell: bash
-        run: codeql query compile -q -j0 ${{ matrix.language }}/ql/{src,examples} --keep-going --warnings=error --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" --compilation-cache-size=500 --ram=56000
--- a/.github/workflows/ql-for-ql-build.yml
+++ b/.github/workflows/ql-for-ql-build.yml
@@ -33,7 +33,7 @@ jobs:
      ### Build the extractor ###
      - name: Cache entire extractor
        id: cache-extractor
-        uses: actions/cache@v3
+        uses: actions/cache@v5
        with:
          path: |
            ql/extractor-pack/
@@ -41,7 +41,7 @@ jobs:
          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ql/**/*.rs') }}
      - name: Cache cargo
        if: steps.cache-extractor.outputs.cache-hit != 'true'
-        uses: actions/cache@v3
+        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
--- a/.github/workflows/ql-for-ql-dataset_measure.yml
+++ b/.github/workflows/ql-for-ql-dataset_measure.yml
@@ -34,7 +34,7 @@ jobs:
          languages: javascript # does not matter
      - uses: ./.github/actions/os-version
        id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
--- a/.github/workflows/ql-for-ql-tests.yml
+++ b/.github/workflows/ql-for-ql-tests.yml
@@ -33,7 +33,7 @@ jobs:
          tools: nightly
      - uses: ./.github/actions/os-version
        id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
@@ -79,7 +79,7 @@ jobs:
          tools: nightly
      - uses: ./.github/actions/os-version
        id: os_version
-      - uses: actions/cache@v3
+      - uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
--- a/.github/workflows/ruby-build.yml
+++ b/.github/workflows/ruby-build.yml
@@ -1,236 +0,0 @@
-name: "Ruby: Build"
-
-on:
-  push:
-    paths:
-      - "ruby/**"
-      - .github/workflows/ruby-build.yml
-      - .github/actions/fetch-codeql/action.yml
-      - codeql-workspace.yml
-      - "shared/tree-sitter-extractor/**"
-    branches:
-      - main
-      - "rc/*"
-  pull_request:
-    paths:
-      - "ruby/**"
-      - .github/workflows/ruby-build.yml
-      - .github/actions/fetch-codeql/action.yml
-      - codeql-workspace.yml
-      - "shared/tree-sitter-extractor/**"
-    branches:
-      - main
-      - "rc/*"
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Version tag to create"
-        required: false
-
-env:
-  CARGO_TERM_COLOR: always
-
-defaults:
-  run:
-    working-directory: ruby
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-
-    runs-on: ${{ matrix.os }}
-
-    steps:
-      - uses: actions/checkout@v5
-      - name: Install GNU tar
-        if: runner.os == 'macOS'
-        run: |
-          brew install gnu-tar
-          echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
-      - name: Prepare Windows
-        if: runner.os == 'Windows'
-        shell: powershell
-        run: |
-          git config --global core.longpaths true
-      - uses: ./.github/actions/os-version
-        id: os_version
-      - name: Cache entire extractor
-        uses: actions/cache@v3
-        id: cache-extractor
-        with:
-          path: |
-            target/release/codeql-extractor-ruby
-            target/release/codeql-extractor-ruby.exe
-            ruby/extractor/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-extractor-${{ hashFiles('ruby/extractor/rust-toolchain.toml', 'ruby/extractor/Cargo.lock') }}-${{ hashFiles('shared/tree-sitter-extractor') }}-${{ hashFiles('ruby/extractor/**/*.rs') }}
-      - uses: actions/cache@v3
-        if: steps.cache-extractor.outputs.cache-hit != 'true'
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            target
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-rust-cargo-${{ hashFiles('ruby/extractor/rust-toolchain.toml', 'ruby/extractor/**/Cargo.lock') }}
-      - name: Check formatting
-        if: steps.cache-extractor.outputs.cache-hit != 'true'
-        run: cd extractor && cargo fmt -- --check
-      - name: Build
-        if: steps.cache-extractor.outputs.cache-hit != 'true'
-        run: cd extractor && cargo build --verbose
-      - name: Run tests
-        if: steps.cache-extractor.outputs.cache-hit != 'true'
-        run: cd extractor && cargo test --verbose
-      - name: Release build
-        if: steps.cache-extractor.outputs.cache-hit != 'true'
-        run: cd extractor && cargo build --release
-      - name: Generate dbscheme
-        if: ${{ matrix.os == 'ubuntu-latest' && steps.cache-extractor.outputs.cache-hit != 'true'}}
-        run: ../target/release/codeql-extractor-ruby generate --dbscheme ql/lib/ruby.dbscheme --library ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
-      - uses: actions/upload-artifact@v4
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        with:
-          name: ruby.dbscheme
-          path: ruby/ql/lib/ruby.dbscheme
-      - uses: actions/upload-artifact@v4
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        with:
-          name: TreeSitter.qll
-          path: ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
-      - uses: actions/upload-artifact@v4
-        with:
-          name: extractor-${{ matrix.os }}
-          path: |
-            target/release/codeql-extractor-ruby
-            target/release/codeql-extractor-ruby.exe
-          retention-days: 1
-  compile-queries:
-    if: github.repository_owner == 'github'
-    runs-on: ubuntu-latest-xl
-    steps:
-      - uses: actions/checkout@v5
-      - name: Fetch CodeQL
-        uses: ./.github/actions/fetch-codeql
-      - name: Cache compilation cache
-        id: query-cache
-        uses: ./.github/actions/cache-query-compilation
-        with:
-          key: ruby-build
-      - name: Build Query Pack
-        run: |
-          PACKS=${{ runner.temp }}/query-packs
-          rm -rf $PACKS
-          codeql pack create ../misc/suite-helpers --output "$PACKS"
-          codeql pack create ../shared/regex --output "$PACKS"
-          codeql pack create ../shared/ssa --output "$PACKS"
-          codeql pack create ../shared/tutorial --output "$PACKS"
-          codeql pack create ql/lib --output "$PACKS"
-          codeql pack create -j0 ql/src --output "$PACKS" --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
-          PACK_FOLDER=$(readlink -f "$PACKS"/codeql/ruby-queries/*)
-          codeql generate query-help --format=sarifv2.1.0 --output="${PACK_FOLDER}/rules.sarif" ql/src
-          (cd ql/src; find queries \( -name '*.qhelp' -o -name '*.rb' -o -name '*.erb' \) -exec bash -c 'mkdir -p "'"${PACK_FOLDER}"'/$(dirname "{}")"' \; -exec cp "{}" "${PACK_FOLDER}/{}" \;)
-      - uses: actions/upload-artifact@v4
-        with:
-          name: codeql-ruby-queries
-          path: |
-            ${{ runner.temp }}/query-packs/*
-          retention-days: 1
-          include-hidden-files: true
-
-  package:
-    runs-on: ubuntu-latest
-    needs: [build, compile-queries]
-    steps:
-      - uses: actions/checkout@v5
-      - uses: actions/download-artifact@v4
-        with:
-          name: ruby.dbscheme
-          path: ruby/ruby
-      - uses: actions/download-artifact@v4
-        with:
-          name: extractor-ubuntu-latest
-          path: ruby/linux64
-      - uses: actions/download-artifact@v4
-        with:
-          name: extractor-windows-latest
-          path: ruby/win64
-      - uses: actions/download-artifact@v4
-        with:
-          name: extractor-macos-latest
-          path: ruby/osx64
-      - run: |
-          mkdir -p ruby
-          cp -r codeql-extractor.yml tools ql/lib/ruby.dbscheme.stats ruby/
-          mkdir -p ruby/tools/{linux64,osx64,win64}
-          cp linux64/codeql-extractor-ruby ruby/tools/linux64/extractor
-          cp osx64/codeql-extractor-ruby ruby/tools/osx64/extractor
-          cp win64/codeql-extractor-ruby.exe ruby/tools/win64/extractor.exe
-          chmod +x ruby/tools/{linux64,osx64}/extractor
-          zip -rq codeql-ruby.zip ruby
-      - uses: actions/upload-artifact@v4
-        with:
-          name: codeql-ruby-pack
-          path: ruby/codeql-ruby.zip
-          retention-days: 1
-          include-hidden-files: true
-      - uses: actions/download-artifact@v4
-        with:
-          name: codeql-ruby-queries
-          path: ruby/qlpacks
-      - run: |
-          echo '{
-            "provide": [
-            "ruby/codeql-extractor.yml",
-            "qlpacks/*/*/*/qlpack.yml"
-            ]
-          }' > .codeqlmanifest.json
-          zip -rq codeql-ruby-bundle.zip .codeqlmanifest.json ruby qlpacks
-      - uses: actions/upload-artifact@v4
-        with:
-          name: codeql-ruby-bundle
-          path: ruby/codeql-ruby-bundle.zip
-          retention-days: 1
-          include-hidden-files: true
-
-  test:
-    defaults:
-      run:
-        working-directory: ${{ github.workspace }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-
-    runs-on: ${{ matrix.os }}
-    needs: [package]
-    steps:
-      - uses: actions/checkout@v5
-      - name: Fetch CodeQL
-        uses: ./.github/actions/fetch-codeql
-
-      - name: Download Ruby bundle
-        uses: actions/download-artifact@v4
-        with:
-          name: codeql-ruby-bundle
-          path: ${{ runner.temp }}
-      - name: Unzip Ruby bundle
-        shell: bash
-        run: unzip -q -d "${{ runner.temp }}/ruby-bundle" "${{ runner.temp }}/codeql-ruby-bundle.zip"
-
-      - name: Run QL test
-        shell: bash
-        run: |
-          codeql test run --search-path "${{ runner.temp }}/ruby-bundle" --additional-packs "${{ runner.temp }}/ruby-bundle" ruby/ql/test/library-tests/ast/constants/
-      - name: Create database
-        shell: bash
-        run: |
-          codeql database create --search-path "${{ runner.temp }}/ruby-bundle" --language ruby --source-root ruby/ql/test/library-tests/ast/constants/ ../database
-      - name: Analyze database
-        shell: bash
-        run: |
-          codeql database analyze --search-path "${{ runner.temp }}/ruby-bundle" --format=sarifv2.1.0 --output=out.sarif ../database ruby-code-scanning.qls
--- a/.github/workflows/ruby-dataset-measure.yml
+++ b/.github/workflows/ruby-dataset-measure.yml
@@ -1,75 +0,0 @@
-name: "Ruby: Collect database stats"
-
-on:
-  push:
-    branches:
-      - main
-      - "rc/*"
-    paths:
-      - ruby/ql/lib/ruby.dbscheme
-      - .github/workflows/ruby-dataset-measure.yml
-  pull_request:
-    branches:
-      - main
-      - "rc/*"
-    paths:
-      - ruby/ql/lib/ruby.dbscheme
-      - .github/workflows/ruby-dataset-measure.yml
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  measure:
-    env:
-      CODEQL_THREADS: 4 # TODO: remove this once it's set by the CLI
-    strategy:
-      fail-fast: false
-      matrix:
-        repo: [rails/rails, discourse/discourse, spree/spree, ruby/ruby]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-
-      - uses: ./.github/actions/fetch-codeql
-
-      - uses: ./ruby/actions/create-extractor-pack
-
-      - name: Checkout ${{ matrix.repo }}
-        uses: actions/checkout@v5
-        with:
-          repository: ${{ matrix.repo }}
-          path: ${{ github.workspace }}/repo
-      - name: Create database
-        run: |
-          codeql database create \
-            --search-path "${{ github.workspace }}" \
-            --threads 4 \
-            --language ruby --source-root "${{ github.workspace }}/repo" \
-            "${{ runner.temp }}/database"
-      - name: Measure database
-        run: |
-          mkdir -p "stats/${{ matrix.repo }}"
-          codeql dataset measure --threads 4 --output "stats/${{ matrix.repo }}/stats.xml" "${{ runner.temp }}/database/db-ruby"
-      - uses: actions/upload-artifact@v4
-        with:
-          name: measurements-${{ hashFiles('stats/**') }}
-          path: stats
-          retention-days: 1
-
-  merge:
-    runs-on: ubuntu-latest
-    needs: measure
-    steps:
-      - uses: actions/checkout@v5
-      - uses: actions/download-artifact@v4
-        with:
-          path: stats
-      - run: |
-          python -m pip install --user lxml
-          find stats -name 'stats.xml' | sort | xargs python ruby/scripts/merge_stats.py --output ruby/ql/lib/ruby.dbscheme.stats --normalise ruby_tokeninfo
-      - uses: actions/upload-artifact@v4
-        with:
-          name: ruby.dbscheme.stats
-          path: ruby/ql/lib/ruby.dbscheme.stats
--- a/.github/workflows/ruby-qltest-rtjo.yml
+++ b/.github/workflows/ruby-qltest-rtjo.yml
@@ -1,40 +0,0 @@
-name: "Ruby: Run RTJO Language Tests"
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - labeled
-
-env:
-  CARGO_TERM_COLOR: always
-
-defaults:
-  run:
-    working-directory: ruby
-
-permissions:
-  contents: read
-
-jobs:
-  qltest-rtjo:
-    if: "github.repository_owner == 'github' && github.event.label.name == 'Run: RTJO Language Tests'"
-    runs-on: ubuntu-latest-xl
-    strategy:
-      fail-fast: false
-    steps:
-      - uses: actions/checkout@v5
-      - uses: ./.github/actions/fetch-codeql
-      - uses: ./ruby/actions/create-extractor-pack
-      - name: Cache compilation cache
-        id: query-cache
-        uses: ./.github/actions/cache-query-compilation
-        with:
-          key: ruby-qltest
-      - name: Run QL tests
-        run: |
-          codeql test run --dynamic-join-order-mode=all --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
--- a/.github/workflows/ruby-qltest.yml
+++ b/.github/workflows/ruby-qltest.yml
@@ -1,73 +0,0 @@
-name: "Ruby: Run QL Tests"
-
-on:
-  push:
-    paths:
-      - "ruby/**"
-      - "shared/**"
-      - .github/workflows/ruby-build.yml
-      - .github/actions/fetch-codeql/action.yml
-      - codeql-workspace.yml
-    branches:
-      - main
-      - "rc/*"
-  pull_request:
-    paths:
-      - "ruby/**"
-      - "shared/**"
-      - .github/workflows/ruby-qltest.yml
-      - .github/actions/fetch-codeql/action.yml
-      - codeql-workspace.yml
-    branches:
-      - main
-      - "rc/*"
-
-env:
-  CARGO_TERM_COLOR: always
-
-defaults:
-  run:
-    working-directory: ruby
-
-permissions:
-  contents: read
-
-jobs:
-  qlupgrade:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - uses: ./.github/actions/fetch-codeql
-      - name: Check DB upgrade scripts
-        run: |
-          echo >empty.trap
-          codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
-          codeql dataset upgrade testdb --additional-packs ql/lib
-          diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme
-      - name: Check DB downgrade scripts
-        run: |
-          echo >empty.trap
-          rm -rf testdb; codeql dataset import -S ql/lib/ruby.dbscheme testdb empty.trap
-          codeql resolve upgrades --format=lines --allow-downgrades --additional-packs downgrades \
-           --dbscheme=ql/lib/ruby.dbscheme --target-dbscheme=downgrades/initial/ruby.dbscheme |
-           xargs codeql execute upgrades testdb
-          diff -q testdb/ruby.dbscheme downgrades/initial/ruby.dbscheme
-  qltest:
-    if: github.repository_owner == 'github'
-    runs-on: ubuntu-latest-xl
-    strategy:
-      fail-fast: false
-    steps:
-      - uses: actions/checkout@v5
-      - uses: ./.github/actions/fetch-codeql
-      - uses: ./ruby/actions/create-extractor-pack
-      - name: Cache compilation cache
-        id: query-cache
-        uses: ./.github/actions/cache-query-compilation
-        with:
-          key: ruby-qltest
-      - name: Run QL tests
-        run: |
-          codeql test run --threads=0 --ram 50000 --search-path "${{ github.workspace }}" --check-databases --check-diff-informed --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -15,14 +15,14 @@ local_path_override(
 # see https://registry.bazel.build/ for a list of available packages

 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "rules_cc", version = "0.2.16")
-bazel_dep(name = "rules_go", version = "0.59.0")
-bazel_dep(name = "rules_java", version = "9.0.3")
-bazel_dep(name = "rules_pkg", version = "1.0.1")
+bazel_dep(name = "rules_cc", version = "0.2.17")
+bazel_dep(name = "rules_go", version = "0.60.0")
+bazel_dep(name = "rules_java", version = "9.6.1")
+bazel_dep(name = "rules_pkg", version = "1.2.0")
 bazel_dep(name = "rules_nodejs", version = "6.7.3")
 bazel_dep(name = "rules_python", version = "1.9.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
-bazel_dep(name = "bazel_skylib", version = "1.8.1")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "abseil-cpp", version = "20260107.1", repo_name = "absl")
 bazel_dep(name = "nlohmann_json", version = "3.11.3", repo_name = "json")
 bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
@@ -30,7 +30,7 @@ bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")
 bazel_dep(name = "gazelle", version = "0.47.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
-bazel_dep(name = "rules_rust", version = "0.68.1.codeql.1")
+bazel_dep(name = "rules_rust", version = "0.69.0")
 bazel_dep(name = "zstd", version = "1.5.7.bcr.1")

 bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.30
+version: 0.4.31-dev
 library: true
 warnOnImplicitThis: true
 dependencies:
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.22
+version: 0.6.23-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]
--- a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
+++ b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
@@ -52,5 +52,6 @@ ql/cpp/ql/src/Summary/LinesOfUserCode.ql
 ql/cpp/ql/src/Telemetry/CompilerErrors.ql
 ql/cpp/ql/src/Telemetry/DatabaseQuality.ql
 ql/cpp/ql/src/Telemetry/ExtractionMetrics.ql
+ql/cpp/ql/src/Telemetry/ExtractorInformation.ql
 ql/cpp/ql/src/Telemetry/MissingIncludes.ql
 ql/cpp/ql/src/Telemetry/SucceededIncludes.ql
--- a/cpp/ql/integration-tests/query-suite/cpp-security-and-quality.qls.expected
+++ b/cpp/ql/integration-tests/query-suite/cpp-security-and-quality.qls.expected
@@ -160,6 +160,7 @@ ql/cpp/ql/src/Summary/LinesOfUserCode.ql
 ql/cpp/ql/src/Telemetry/CompilerErrors.ql
 ql/cpp/ql/src/Telemetry/DatabaseQuality.ql
 ql/cpp/ql/src/Telemetry/ExtractionMetrics.ql
+ql/cpp/ql/src/Telemetry/ExtractorInformation.ql
 ql/cpp/ql/src/Telemetry/MissingIncludes.ql
 ql/cpp/ql/src/Telemetry/SucceededIncludes.ql
 ql/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.ql
--- a/cpp/ql/integration-tests/query-suite/cpp-security-extended.qls.expected
+++ b/cpp/ql/integration-tests/query-suite/cpp-security-extended.qls.expected
@@ -93,5 +93,6 @@ ql/cpp/ql/src/Summary/LinesOfUserCode.ql
 ql/cpp/ql/src/Telemetry/CompilerErrors.ql
 ql/cpp/ql/src/Telemetry/DatabaseQuality.ql
 ql/cpp/ql/src/Telemetry/ExtractionMetrics.ql
+ql/cpp/ql/src/Telemetry/ExtractorInformation.ql
 ql/cpp/ql/src/Telemetry/MissingIncludes.ql
 ql/cpp/ql/src/Telemetry/SucceededIncludes.ql
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 8.0.1
+version: 8.0.2-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
--- a/cpp/ql/lib/semmle/code/cpp/Function.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Function.qll
@@ -524,6 +524,12 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
      not exists(NewOrNewArrayExpr new | e = new.getAllocatorCall().getArgument(0))
    )
  }
+
+  /**
+   * Holds if this function has an ambiguous return type, meaning that zero or multiple return
+   * types for this function are present in the database (this can occur in `build-mode: none`).
+   */
+  predicate hasAmbiguousReturnType() { count(this.getType()) != 1 }
 }

 pragma[noinline]
--- a/Bugs/Arithmetic/IntMultToLong.ql
+++ b/Bugs/Arithmetic/IntMultToLong.ql
@@ -218,7 +218,9 @@ where
  // only report if we cannot prove that the result of the
  // multiplication will be less (resp. greater) than the
  // maximum (resp. minimum) number we can compute.
-  overflows(me, t1)
+  overflows(me, t1) and
+  // exclude cases where the expression type may not have been extracted accurately
+  not me.getParent().(Call).getTarget().hasAmbiguousReturnType()
 select me,
  "Multiplication result may overflow '" + me.getType().toString() + "' before it is converted to '"
    + me.getFullyConverted().getType().toString() + "'."
--- a/Bugs/Format/WrongTypeFormatArguments.ql
+++ b/Bugs/Format/WrongTypeFormatArguments.ql
@@ -168,9 +168,11 @@ where
    formatOtherArgType(ffc, n, expected, arg, actual) and
    not actual.getUnspecifiedType().(IntegralType).getSize() = sizeof_IntType()
  ) and
+  // Exclude some cases where we're less confident the result is correct / clear / valuable
  not arg.isAffectedByMacro() and
  not arg.isFromUninstantiatedTemplate(_) and
  not actual.stripType() instanceof ErroneousType and
+  not arg.getType().stripType().(RoutineType).getReturnType() instanceof ErroneousType and
  not arg.(Call).mayBeFromImplicitlyDeclaredFunction() and
  // Make sure that the format function definition is consistent
  count(ffc.getTarget().getFormatParameterIndex()) = 1
--- a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
+++ b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
@@ -4,7 +4,7 @@
 *              allows for a cross-site scripting vulnerability.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision high
 * @id cpp/cgi-xss
 * @tags security
--- a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
@@ -23,13 +23,31 @@ import Flow::PathGraph

 predicate isSource(FlowSource source, string sourceType) { sourceType = source.getSourceType() }

+/**
+ * Holds if `f` is a printf-like function or a (possibly nested) wrapper
+ * that forwards a format-string parameter to one.
+ *
+ * Functions that *implement* printf-like behavior (e.g. a custom
+ * `vsnprintf` variant) internally parse the caller-supplied format string
+ * and build small, bounded, local format strings such as `"%d"` or `"%ld"`
+ * for inner `sprintf` calls.  Taint that reaches those inner calls via the
+ * parsed format specifier is not exploitable, so sinks inside such
+ * functions should be excluded.
+ */
+private predicate isPrintfImplementation(Function f) {
+  f instanceof PrintfLikeFunction
+  or
+  exists(PrintfLikeFunction printf | printf.wrapperFunction(f, _, _))
+}
+
 module Config implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node node) { isSource(node, _) }

  predicate isSink(DataFlow::Node node) {
    exists(PrintfLikeFunction printf |
      printf.outermostWrapperFunctionCall([node.asExpr(), node.asIndirectExpr()], _)
-    )
+    ) and
+    not isPrintfImplementation([node.asExpr(), node.asIndirectExpr()].getEnclosingFunction())
  }

  private predicate isArithmeticNonCharType(ArithmeticType type) {
--- a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
+++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
@@ -18,7 +18,8 @@ import IncorrectPointerScalingCommon
 private predicate isCharSzPtrExpr(Expr e) {
  exists(PointerType pt | pt = e.getFullyConverted().getUnspecifiedType() |
    pt.getBaseType() instanceof CharType or
-    pt.getBaseType() instanceof VoidType
+    pt.getBaseType() instanceof VoidType or
+    pt.getBaseType() instanceof ErroneousType // this could be char / void type in a successful compilation
  )
 }

--- a/cpp/ql/src/Telemetry/DatabaseQuality.qll
+++ b/cpp/ql/src/Telemetry/DatabaseQuality.qll
@@ -0,0 +1,25 @@
+import cpp
+import codeql.util.ReportStats
+
+module CallTargetStats implements StatsSig {
+  private class RelevantCall extends Call {
+    RelevantCall() { this.getFile() = any(File f | f.fromSource() and exists(f.getRelativePath())) }
+  }
+
+  // We assume that calls with an implicit target are calls that could not be
+  // resolved. This is accurate in the vast majority of cases, but is inaccurate
+  // for calls that deliberately rely on implicitly declared functions.
+  private predicate hasImplicitTarget(RelevantCall call) {
+    call.getTarget().getADeclarationEntry().isImplicit()
+  }
+
+  int getNumberOfOk() { result = count(RelevantCall call | not hasImplicitTarget(call)) }
+
+  int getNumberOfNotOk() { result = count(RelevantCall call | hasImplicitTarget(call)) }
+
+  string getOkText() { result = "calls with call target" }
+
+  string getNotOkText() { result = "calls with missing call target" }
+}
+
+module CallTargetStatsReport = ReportStats<CallTargetStats>;
--- a/cpp/ql/src/Telemetry/ExtractorInformation.ql
+++ b/cpp/ql/src/Telemetry/ExtractorInformation.ql
@@ -0,0 +1,25 @@
+/**
+ * @name C/C++ extraction information
+ * @description Information about the extraction for a C/C++ database
+ * @kind metric
+ * @tags summary telemetry
+ * @id cpp/telemetry/extraction-information
+ */
+
+import cpp
+import DatabaseQuality
+
+from string key, float value
+where
+  (
+    CallTargetStatsReport::numberOfOk(key, value) or
+    CallTargetStatsReport::numberOfNotOk(key, value) or
+    CallTargetStatsReport::percentageOfOk(key, value)
+  ) and
+  /* Infinity */
+  value != 1.0 / 0.0 and
+  /* -Infinity */
+  value != -1.0 / 0.0 and
+  /* NaN */
+  value != 0.0 / 0.0
+select key, value
--- a/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
+++ b/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed an issue with the "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query causing false positive results in `build-mode: none` databases.
--- a/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* The `@security-severity` metadata of `cpp/cgi-xss` has been increased from 6.1 (medium) to 7.8 (high).
--- a/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
+++ b/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed an issue with the "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query causing false positive results in `build-mode: none` databases.
--- a/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
+++ b/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed an issue with the "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query causing false positive results in `build-mode: none` databases.
--- a/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
+++ b/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Fixed an issue with the "Uncontrolled format string" (`cpp/tainted-format-string`) query involving certain kinds of formatting function implementations.
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.5.13
+version: 1.5.14-dev
 groups:
  - cpp
  - queries
--- a/Bugs/Arithmetic/IntMultToLong/Buildless.c
+++ b/Bugs/Arithmetic/IntMultToLong/Buildless.c
@@ -0,0 +1,28 @@
+// semmle-extractor-options: --expect_errors
+
+void test_float_double1(float f, double d) {
+    float r1 = f * f; // GOOD
+    float r2 = f * d; // GOOD
+    double r3 = f * f; // BAD
+    double r4 = f * d; // GOOD
+
+    float f1 = fabsf(f * f); // GOOD
+    float f2 = fabsf(f * d); // GOOD
+    double f3 = fabs(f * f); // BAD [NOT DETECTED]
+    double f4 = fabs(f * d); // GOOD
+}
+
+double fabs(double f);
+float fabsf(float f);
+
+void test_float_double2(float f, double d) {
+    float r1 = f * f; // GOOD
+    float r2 = f * d; // GOOD
+    double r3 = f * f; // BAD
+    double r4 = f * d; // GOOD
+
+    float f1 = fabsf(f * f); // GOOD
+    float f2 = fabsf(f * d); // GOOD
+    double f3 = fabs(f * f); // BAD [NOT DETECTED]
+    double f4 = fabs(f * d); // GOOD
+}
--- a/Bugs/Arithmetic/IntMultToLong/IntMultToLong.expected
+++ b/Bugs/Arithmetic/IntMultToLong/IntMultToLong.expected
@@ -1,3 +1,5 @@
+| Buildless.c:6:17:6:21 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
+| Buildless.c:21:17:21:21 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
 | IntMultToLong.c:4:10:4:14 | ... * ... | Multiplication result may overflow 'int' before it is converted to 'long long'. |
 | IntMultToLong.c:7:16:7:20 | ... * ... | Multiplication result may overflow 'int' before it is converted to 'long long'. |
 | IntMultToLong.c:18:19:18:23 | ... * ... | Multiplication result may overflow 'float' before it is converted to 'double'. |
--- a/Bugs/Format/WrongTypeFormatArguments/Buildless/WrongTypeFormatArguments.expected
+++ b/Bugs/Format/WrongTypeFormatArguments/Buildless/WrongTypeFormatArguments.expected
@@ -1 +1,3 @@
+| second.cpp:26:18:26:39 | ... - ... | This format specifier for type 'int' does not match the argument type 'long'. |
+| second.cpp:29:18:29:39 | ... - ... | This format specifier for type 'unsigned int' does not match the argument type 'long'. |
 | tests.c:7:18:7:18 | 1 | This format specifier for type 'char *' does not match the argument type 'int'. |
--- a/Bugs/Format/WrongTypeFormatArguments/Buildless/first.cpp
+++ b/Bugs/Format/WrongTypeFormatArguments/Buildless/first.cpp
@@ -0,0 +1,3 @@
+
+// defines type size_t plausibly
+typedef unsigned long size_t;
--- a/Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp
+++ b/Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp
@@ -0,0 +1,32 @@
+// semmle-extractor-options: --expect_errors
+
+int printf(const char * format, ...);
+
+// defines type `myFunctionPointerType`, referencing `size_t`
+typedef size_t (*myFunctionPointerType) ();
+
+void test_size_t() {
+    size_t s = 0;
+
+    printf("%zd", s); // GOOD
+    printf("%zi", s); // GOOD
+    printf("%zu", s); // GOOD (we generally permit signedness changes)
+    printf("%zx", s); // GOOD (we generally permit signedness changes)
+    printf("%d", s); // BAD [NOT DETECTED]
+    printf("%ld", s); // DUBIOUS [NOT DETECTED]
+    printf("%lld", s); // DUBIOUS [NOT DETECTED]
+    printf("%u", s); // BAD [NOT DETECTED]
+
+    char buffer[1024];
+
+    printf("%zd", &buffer[1023] - buffer); // GOOD
+    printf("%zi", &buffer[1023] - buffer); // GOOD
+    printf("%zu", &buffer[1023] - buffer); // GOOD
+    printf("%zx", &buffer[1023] - buffer); // GOOD
+    printf("%d", &buffer[1023] - buffer); // BAD
+    printf("%ld", &buffer[1023] - buffer); // DUBIOUS [NOT DETECTED]
+    printf("%lld", &buffer[1023] - buffer); // DUBIOUS [NOT DETECTED]
+    printf("%u", &buffer[1023] - buffer); // BAD
+    // (for the `%ld` and `%lld` cases, the signedness and type sizes match, `%zd` would be most correct
+    //  and robust but the developer may know enough to make this safe)
+}
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/SuspiciousAddWithSizeof.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/SuspiciousAddWithSizeof.expected
@@ -1,3 +1,5 @@
+| buildless.cpp:5:15:5:25 | sizeof(int) | Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@. | file://:0:0:0:0 | const short * | const short * |
+| buildless.cpp:6:13:6:23 | sizeof(int) | Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@. | file://:0:0:0:0 | const int * | const int * |
 | test.cpp:6:30:6:40 | sizeof(int) | Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@. | file://:0:0:0:0 | int * | int * |
 | test.cpp:14:30:14:40 | sizeof(int) | Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@. | file://:0:0:0:0 | int * | int * |
 | test.cpp:22:25:22:35 | sizeof(int) | Suspicious sizeof offset in a pointer arithmetic expression. The type of the pointer is $@. | file://:0:0:0:0 | int * | int * |
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp
@@ -0,0 +1,10 @@
+// semmle-extractor-options: --expect_errors
+
+void test_buildless(const char *p_c, const short *p_short, const int *p_int, const uint8_t *p_8, const uint16_t *p_16, const uint32_t *p_32) {
+  *(p_c + sizeof(int)); // GOOD (`sizeof(char)` is 1)
+  *(p_short + sizeof(int)); // BAD
+  *(p_int + sizeof(int)); // BAD
+  *(p_8 + sizeof(int)); // GOOD (`sizeof(uint8_t)` is 1, but there's an error in the type)
+  *(p_16 + sizeof(int)); // BAD [NOT DETECTED]
+  *(p_32 + sizeof(int)); // BAD [NOT DETECTED]
+}
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/test.cpp
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/test.cpp
@@ -93,3 +93,9 @@ private:
  myChar * const myCharsPointer;
  myInt * const myIntsPointer;
 };
+
+typedef unsigned char uint8_t;
+typedef unsigned short uint16_t;
+typedef unsigned int uint32_t;
+
+void test_buildless(const char *p_c, const short *p_short, const int *p_int, const uint8_t *p_8, const uint16_t *p_16, const uint32_t *p_32);
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.61
+version: 1.7.62-dev
 groups:
  - csharp
  - solorigate
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.61
+version: 1.7.62-dev
 groups:
  - csharp
  - solorigate
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 5.4.9
+version: 5.4.10-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp
--- a/csharp/ql/lib/semmle/code/csharp/Callable.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Callable.qll
@@ -336,6 +336,22 @@ class ExtensionTypeExtensionMethod extends ExtensionMethodImpl {
  ExtensionTypeExtensionMethod() { this.isInExtension() }
 }

+/**
+ * A non-static member with an initializer, for example a field `int Field = 0`.
+ */
+private class InitializedInstanceMember extends Member {
+  private AssignExpr ae;
+
+  InitializedInstanceMember() {
+    not this.isStatic() and
+    expr_parent_top_level(ae, _, this) and
+    not ae = getExpressionBody(_)
+  }
+
+  /** Gets the initializer expression. */
+  AssignExpr getInitializer() { result = ae }
+}
+
 /**
 * An object initializer method.
 *
@@ -347,6 +363,17 @@ class ExtensionTypeExtensionMethod extends ExtensionMethodImpl {
 */
 class ObjectInitMethod extends Method {
  ObjectInitMethod() { this.getName() = "<object initializer>" }
+
+  /**
+   * Holds if this object initializer method performs the initialization
+   * of a member via assignment `init`.
+   */
+  predicate initializes(AssignExpr init) {
+    exists(InitializedInstanceMember m |
+      this.getDeclaringType().getAMember() = m and
+      init = m.getInitializer()
+    )
+  }
 }

 /**
--- a/csharp/ql/lib/semmle/code/csharp/ExprOrStmtParent.qll
+++ b/csharp/ql/lib/semmle/code/csharp/ExprOrStmtParent.qll
@@ -214,6 +214,8 @@ private module Cached {
    parent*(enclosingStart(cfe), c.(Constructor).getInitializer())
    or
    parent*(cfe, c.(Constructor).getObjectInitializerCall())
+    or
+    parent*(cfe, any(AssignExpr init | c.(ObjectInitMethod).initializes(init)))
  }

  /** Holds if the enclosing statement of expression `e` is `s`. */
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/ControlFlowGraphImpl.qll
@@ -10,42 +10,15 @@ private import semmle.code.csharp.ExprOrStmtParent
 private import semmle.code.csharp.commons.Compilation

 private module Initializers {
-  /**
-   * A non-static member with an initializer, for example a field `int Field = 0`.
-   */
-  class InitializedInstanceMember extends Member {
-    private AssignExpr ae;
-
-    InitializedInstanceMember() {
-      not this.isStatic() and
-      expr_parent_top_level(ae, _, this) and
-      not ae = any(Callable c).getExpressionBody()
-    }
-
-    /** Gets the initializer expression. */
-    AssignExpr getInitializer() { result = ae }
-  }
-
-  /**
-   * Holds if `obinit` is an object initializer method that performs the initialization
-   * of a member via assignment `init`.
-   */
-  predicate obinitInitializes(ObjectInitMethod obinit, AssignExpr init) {
-    exists(InitializedInstanceMember m |
-      obinit.getDeclaringType().getAMember() = m and
-      init = m.getInitializer()
-    )
-  }
-
  /**
   * Gets the `i`th member initializer expression for object initializer method `obinit`
   * in compilation `comp`.
   */
  AssignExpr initializedInstanceMemberOrder(ObjectInitMethod obinit, CompilationExt comp, int i) {
-    obinitInitializes(obinit, result) and
+    obinit.initializes(result) and
    result =
      rank[i + 1](AssignExpr ae0, Location l |
-        obinitInitializes(obinit, ae0) and
+        obinit.initializes(ae0) and
        l = ae0.getLocation() and
        getCompilation(l.getFile()) = comp
      |
@@ -74,7 +47,7 @@ class CfgScope extends Element, @top_level_exprorstmt_parent {
        any(Callable c |
          c.(Constructor).hasInitializer()
          or
-          Initializers::obinitInitializes(c, _)
+          c.(ObjectInitMethod).initializes(_)
          or
          c.hasBody()
        )
--- a/Features/CWE-079/XSS.ql
+++ b/Features/CWE-079/XSS.ql
@@ -4,7 +4,7 @@
 *              allows for a cross-site scripting vulnerability.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision high
 * @id cs/web/xss
 * @tags security
--- a/Features/CWE-117/LogForging.ql
+++ b/Features/CWE-117/LogForging.ql
@@ -4,7 +4,7 @@
 *              insertion of forged log entries by a malicious user.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 7.8
+ * @security-severity 6.1
 * @precision high
 * @id cs/log-forging
 * @tags security
--- a/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
@@ -0,0 +1,5 @@
+---
+category: queryMetadata
+---
+* The `@security-severity` metadata of `cs/log-forging` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `cs/web/xss` has been increased from 6.1 (medium) to 7.8 (high).
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.6.4
+version: 1.6.5-dev
 groups:
  - csharp
  - queries
--- a/csharp/ql/test/library-tests/dispatch/CallGraph.expected
+++ b/csharp/ql/test/library-tests/dispatch/CallGraph.expected
@@ -24,6 +24,7 @@
 | ExactCallable.cs:15:25:15:35 | Run`2 | ExactCallable.cs:172:21:172:33 | MethodWithOut |
 | ExactCallable.cs:15:25:15:35 | Run`2 | ExactCallable.cs:177:21:177:34 | MethodWithOut2 |
 | ExactCallable.cs:182:21:182:22 | M1 | ExactCallable.cs:187:21:187:22 | M2 |
+| TypeFlow.cs:3:7:3:14 | <object initializer> | TypeFlow.cs:22:20:22:22 | set_Prop |
 | TypeFlow.cs:5:5:5:12 | TypeFlow | TypeFlow.cs:24:10:24:12 | Run |
 | TypeFlow.cs:24:10:24:12 | Run | TypeFlow.cs:12:29:12:34 | Method |
 | TypeFlow.cs:24:10:24:12 | Run | TypeFlow.cs:17:30:17:35 | Method |
--- a/csharp/ql/test/library-tests/structuralcomparison/structuralComparison.expected
+++ b/csharp/ql/test/library-tests/structuralcomparison/structuralComparison.expected
@@ -56,11 +56,11 @@ gvn
 | StructuralComparison.cs:3:14:3:18 | this access | (kind:Expr(12),false,Class) |
 | StructuralComparison.cs:3:14:3:18 | {...} | (kind:Stmt(1)) |
 | StructuralComparison.cs:5:26:5:26 | access to field x | (kind:Expr(16),true,x) |
-| StructuralComparison.cs:5:26:5:26 | this access | (kind:Expr(12)) |
+| StructuralComparison.cs:5:26:5:26 | this access | (kind:Expr(12),false,Class) |
 | StructuralComparison.cs:5:26:5:30 | ... = ... | ((kind:Expr(16),true,x) :: (0 :: (kind:Expr(63)))) |
 | StructuralComparison.cs:5:30:5:30 | 0 | 0 |
 | StructuralComparison.cs:6:26:6:26 | access to field y | (kind:Expr(16),true,y) |
-| StructuralComparison.cs:6:26:6:26 | this access | (kind:Expr(12)) |
+| StructuralComparison.cs:6:26:6:26 | this access | (kind:Expr(12),false,Class) |
 | StructuralComparison.cs:6:26:6:30 | ... = ... | ((kind:Expr(16),true,y) :: (1 :: (kind:Expr(63)))) |
 | StructuralComparison.cs:6:30:6:30 | 1 | 1 |
 | StructuralComparison.cs:8:24:8:24 | 0 | 0 |
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.44
+version: 1.0.45-dev
 groups:
  - go
  - queries
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 7.0.2
+version: 7.0.3-dev
 groups: go
 dbscheme: go.dbscheme
 extractor: go
--- a/go/ql/src/Security/CWE-079/HtmlTemplateEscapingBypassXss.ql
+++ b/go/ql/src/Security/CWE-079/HtmlTemplateEscapingBypassXss.ql
@@ -5,7 +5,7 @@
 *              scripting vulnerability.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision high
 * @id go/html-template-escaping-bypass-xss
 * @tags security
--- a/go/ql/src/Security/CWE-079/ReflectedXss.ql
+++ b/go/ql/src/Security/CWE-079/ReflectedXss.ql
@@ -4,7 +4,7 @@
 *              a cross-site scripting vulnerability.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision high
 * @id go/reflected-xss
 * @tags security
--- a/go/ql/src/Security/CWE-079/StoredXss.ql
+++ b/go/ql/src/Security/CWE-079/StoredXss.ql
@@ -4,7 +4,7 @@
 *              a stored cross-site scripting vulnerability.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision low
 * @id go/stored-xss
 * @tags security
--- a/go/ql/src/Security/CWE-117/LogInjection.ql
+++ b/go/ql/src/Security/CWE-117/LogInjection.ql
@@ -4,7 +4,7 @@
 *              insertion of forged log entries by a malicious user.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 7.8
+ * @security-severity 6.1
 * @precision medium
 * @id go/log-injection
 * @tags security
--- a/go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
@@ -0,0 +1,5 @@
+---
+category: queryMetadata
+---
+* The `@security-severity` metadata of `go/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `go/html-template-escaping-bypass-xss`, `go/reflected-xss` and `go/stored-xss` has been increased from 6.1 (medium) to 7.8 (high).
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.5.8
+version: 1.5.9-dev
 groups:
  - go
  - queries
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 9.0.0
+version: 9.0.1-dev
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java
--- a/java/ql/src/Security/CWE/CWE-079/AndroidWebViewAddJavascriptInterface.ql
+++ b/java/ql/src/Security/CWE/CWE-079/AndroidWebViewAddJavascriptInterface.ql
@@ -4,7 +4,7 @@
 * @description Exposing a Java object in a WebView with a JavaScript interface can lead to malicious JavaScript controlling the application.
 * @kind problem
 * @problem.severity warning
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision medium
 * @tags security
 *       external/cwe/cwe-079
--- a/java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.ql
+++ b/java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.ql
@@ -4,7 +4,7 @@
 * @kind problem
 * @id java/android/websettings-javascript-enabled
 * @problem.severity warning
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision medium
 * @tags security
 *       external/cwe/cwe-079
--- a/java/ql/src/Security/CWE/CWE-079/XSS.ql
+++ b/java/ql/src/Security/CWE/CWE-079/XSS.ql
@@ -4,7 +4,7 @@
 *              allows for a cross-site scripting vulnerability.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 6.1
+ * @security-severity 7.8
 * @precision high
 * @id java/xss
 * @tags security
--- a/java/ql/src/Security/CWE/CWE-117/LogInjection.ql
+++ b/java/ql/src/Security/CWE/CWE-117/LogInjection.ql
@@ -4,7 +4,7 @@
 *              insertion of forged log entries by malicious users.
 * @kind path-problem
 * @problem.severity error
- * @security-severity 7.8
+ * @security-severity 6.1
 * @precision medium
 * @id java/log-injection
 * @tags security
--- a/java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
@@ -0,0 +1,5 @@
+---
+category: queryMetadata
+---
+* The `@security-severity` metadata of `java/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `java/android/webview-addjavascriptinterface`, `java/android/websettings-javascript-enabled` and `java/xss` has been increased from 6.1 (medium) to 7.8 (high).
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 1.10.9
+version: 1.10.10-dev
 groups:
  - java
  - queries
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/javascript-all
-version: 2.6.24
+version: 2.6.25-dev
 groups: javascript
 dbscheme: semmlecode.javascript.dbscheme
 extractor: javascript
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 2.3.4
+version: 2.3.5-dev
 groups:
  - javascript
  - queries
--- a/misc/bazel/3rdparty/py_deps/BUILD.aho-corasick-1.1.3.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.aho-corasick-1.1.3.bazel
@@ -65,6 +65,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.anstream-0.6.18.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.anstream-0.6.18.bazel
@@ -66,6 +66,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.anstyle-1.0.10.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.anstyle-1.0.10.bazel
@@ -65,6 +65,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.anstyle-parse-0.2.6.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.anstyle-parse-0.2.6.bazel
@@ -65,6 +65,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.anstyle-query-1.1.2.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.anstyle-query-1.1.2.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.anstyle-wincon-3.0.7.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.anstyle-wincon-3.0.7.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.anyhow-1.0.95.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.anyhow-1.0.95.bazel
@@ -69,6 +69,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.cc-1.2.14.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.cc-1.2.14.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.clap-4.5.30.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.clap-4.5.30.bazel
@@ -70,6 +70,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.clap_builder-4.5.30.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.clap_builder-4.5.30.bazel
@@ -69,6 +69,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.clap_lex-0.7.4.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.clap_lex-0.7.4.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.colorchoice-1.0.3.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.colorchoice-1.0.3.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.is_terminal_polyfill-1.70.1.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.is_terminal_polyfill-1.70.1.bazel
@@ -64,6 +64,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.itoa-1.0.14.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.itoa-1.0.14.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.log-0.4.25.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.log-0.4.25.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.memchr-2.7.4.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.memchr-2.7.4.bazel
@@ -65,6 +65,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.once_cell-1.20.3.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.once_cell-1.20.3.bazel
@@ -67,6 +67,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.proc-macro2-1.0.93.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.proc-macro2-1.0.93.bazel
@@ -69,6 +69,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.quote-1.0.38.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.quote-1.0.38.bazel
@@ -65,6 +65,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.regex-1.11.1.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.regex-1.11.1.bazel
@@ -80,6 +80,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.regex-automata-0.4.9.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.regex-automata-0.4.9.bazel
@@ -85,6 +85,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.regex-syntax-0.8.5.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.regex-syntax-0.8.5.bazel
@@ -73,6 +73,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.ryu-1.0.19.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.ryu-1.0.19.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.serde-1.0.217.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.serde-1.0.217.bazel
@@ -69,6 +69,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.serde_derive-1.0.217.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.serde_derive-1.0.217.bazel
@@ -61,6 +61,7 @@ rust_proc_macro(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.serde_json-1.0.138.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.serde_json-1.0.138.bazel
@@ -69,6 +69,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.shlex-1.3.0.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.shlex-1.3.0.bazel
@@ -65,6 +65,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.smallvec-1.14.0.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.smallvec-1.14.0.bazel
@@ -64,6 +64,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.streaming-iterator-0.1.9.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.streaming-iterator-0.1.9.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.strsim-0.11.1.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.strsim-0.11.1.bazel
@@ -61,6 +61,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.syn-2.0.98.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.syn-2.0.98.bazel
@@ -69,6 +69,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.thiserror-1.0.69.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.thiserror-1.0.69.bazel
@@ -68,6 +68,7 @@ rust_library(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/misc/bazel/3rdparty/py_deps/BUILD.thiserror-impl-1.0.69.bazel
+++ b/misc/bazel/3rdparty/py_deps/BUILD.thiserror-impl-1.0.69.bazel
@@ -61,6 +61,7 @@ rust_proc_macro(
        "@rules_rust//rust/platform:aarch64-unknown-nto-qnx710": [],
        "@rules_rust//rust/platform:aarch64-unknown-uefi": [],
        "@rules_rust//rust/platform:arm-unknown-linux-gnueabi": [],
+        "@rules_rust//rust/platform:arm-unknown-linux-musleabi": [],
        "@rules_rust//rust/platform:armv7-linux-androideabi": [],
        "@rules_rust//rust/platform:armv7-unknown-linux-gnueabi": [],
        "@rules_rust//rust/platform:i686-apple-darwin": [],
--- a/Show More
+++ b/Show More