Merge pull request #21692 from github/copilot/update-codeql-query-for-composite-actions

Extend `actions/unpinned-tag` to analyze composite action metadata (`action.yml` / `action.yaml`)

actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql

@@ -1,5 +1,5 @@
 /**
- * @name Unpinned tag for a non-immutable Action in workflow
+ * @name Unpinned tag for a non-immutable Action in workflow or composite action
  * @description Using a tag for a non-immutable Action that is not pinned to a commit can lead to executing an untrusted Action through a supply chain attack.
  * @kind problem
  * @security-severity 5.0
@@ -31,15 +31,26 @@ private predicate isPinnedContainer(string version) {
 bindingset[nwo]
 private predicate isContainerImage(string nwo) { nwo.regexpMatch("^docker://.+") }
 
-from UsesStep uses, string nwo, string version, Workflow workflow, string name
+private predicate getStepContainerName(UsesStep uses, string name) {
+  exists(Workflow workflow |
+    uses.getEnclosingWorkflow() = workflow and
+    (
+      workflow.getName() = name
+      or
+      not exists(workflow.getName()) and workflow.getLocation().getFile().getBaseName() = name
+    )
+  )
+  or
+  exists(CompositeAction action |
+    uses.getEnclosingCompositeAction() = action and
+    name = action.getLocation().getFile().getBaseName()
+  )
+}
+
+from UsesStep uses, string nwo, string version, string name
 where
   uses.getCallee() = nwo and
-  uses.getEnclosingWorkflow() = workflow and
-  (
-    workflow.getName() = name
-    or
-    not exists(workflow.getName()) and workflow.getLocation().getFile().getBaseName() = name
-  ) and
+  getStepContainerName(uses, name) and
   uses.getVersion() = version and
   not isTrustedOwner(nwo) and
   not (if isContainerImage(nwo) then isPinnedContainer(version) else isPinnedCommit(version)) and

actions/ql/src/change-notes/2026-04-20-unpinned-tag-composite-actions.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `actions/unpinned-tag` query now analyzes composite action metadata (`action.yml`/`action.yaml` files) in addition to workflow files, providing more comprehensive detection of unpinned action references across the entire Actions ecosystem.

actions/ql/test/query-tests/Security/CWE-829/.github/actions/unpinned-tag/action.yml

@@ -0,0 +1,6 @@
+name: Composite unpinned tag test
+runs:
+  using: "composite"
+  steps:
+    - uses: foo/bar@v2
+    - uses: foo/bar@25b062c917b0c75f8b47d8469aff6c94ffd89abb

actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.expected

@@ -1,3 +1,4 @@
+| .github/actions/unpinned-tag/action.yml:5:13:5:22 | foo/bar@v2 | Unpinned 3rd party Action 'action.yml' step $@ uses 'foo/bar' with ref 'v2', not a pinned commit hash | .github/actions/unpinned-tag/action.yml:5:7:6:4 | Uses Step | Uses Step |
 | .github/workflows/actor_trusted_checkout.yml:19:13:19:36 | completely/fakeaction@v2 | Unpinned 3rd party Action 'actor_trusted_checkout.yml' step $@ uses 'completely/fakeaction' with ref 'v2', not a pinned commit hash | .github/workflows/actor_trusted_checkout.yml:19:7:23:4 | Uses Step | Uses Step |
 | .github/workflows/actor_trusted_checkout.yml:23:13:23:37 | fakerepo/comment-on-pr@v1 | Unpinned 3rd party Action 'actor_trusted_checkout.yml' step $@ uses 'fakerepo/comment-on-pr' with ref 'v1', not a pinned commit hash | .github/workflows/actor_trusted_checkout.yml:23:7:26:21 | Uses Step | Uses Step |
 | .github/workflows/artifactpoisoning21.yml:13:15:13:49 | dawidd6/action-download-artifact@v2 | Unpinned 3rd party Action 'Pull Request Open' step $@ uses 'dawidd6/action-download-artifact' with ref 'v2', not a pinned commit hash | .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | Uses Step |

actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected

@@ -8,6 +8,7 @@ edges
 | .github/actions/download-artifact/action.yaml:25:7:29:4 | Run Step | .github/actions/download-artifact/action.yaml:29:7:32:18 | Run Step |
 | .github/actions/download-artifact/action.yaml:29:7:32:18 | Run Step | .github/workflows/artifactpoisoning91.yml:19:9:25:6 | Run Step: metadata |
 | .github/actions/download-artifact/action.yaml:29:7:32:18 | Run Step | .github/workflows/resolve-args.yml:22:9:36:13 | Run Step: resolve-step |
+| .github/actions/unpinned-tag/action.yml:5:7:6:4 | Uses Step | .github/actions/unpinned-tag/action.yml:6:7:6:61 | Uses Step |
 | .github/workflows/actor_trusted_checkout.yml:9:7:14:4 | Uses Step | .github/workflows/actor_trusted_checkout.yml:14:7:15:4 | Uses Step |
 | .github/workflows/actor_trusted_checkout.yml:14:7:15:4 | Uses Step | .github/workflows/actor_trusted_checkout.yml:15:7:19:4 | Run Step |
 | .github/workflows/actor_trusted_checkout.yml:15:7:19:4 | Run Step | .github/workflows/actor_trusted_checkout.yml:19:7:23:4 | Uses Step |

cpp/ql/lib/change-notes/2026-05-15-hasSocketInput-for-fscanf.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `RemoteFlowSourceFunction` model for `fscanf` (and variants) now implements `hasSocketInput` to reflect that these functions may read from a socket.

cpp/ql/lib/semmle/code/cpp/models/implementations/Scanf.qll

@@ -87,6 +87,10 @@ private class FscanfModel extends ScanfFunctionModel, RemoteFlowSourceFunction i
     output.isParameterDeref(any(int i | i >= this.getArgsStartPosition())) and
     description = "value read by " + this.getName()
   }
+
+  override predicate hasSocketInput(FunctionInput input) {
+    input.isParameterDeref(super.getInputParameterIndex())
+  }
 }
 
 /**

cpp/ql/src/change-notes/2026-05-15-cleartext-transmission-fp.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The 'Cleartext transmission of sensitive information' query (`cpp/cleartext-transmission`) no longer raises an alert on calls to `fscanf` (and variants) when the call reads from an "obviously local" `FILE` stream such as `stdin`.

cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp

@@ -577,3 +577,10 @@ void tests3()
 	str = get_home_address();
 	send(val(), str, strlen(str), val()); // BAD
 }
+
+int fscanf(FILE* stream, const char* format, ... );
+
+void test_scanf() {
+	char password[256];
+	fscanf(stdin, "%255s", password); // GOOD: this is not a remote source
+}

csharp/ql/src/Security Features/CWE-502/UnsafeDeserialization.qhelp

@@ -7,6 +7,17 @@
 <p>Deserializing an object from untrusted input may result in security problems, such
 as denial of service or remote code execution.</p>
 
+<p>
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally not tracked by this query. Such
+frameworks are generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution. However, care must be taken to ensure the schema
+strictly limits the allowed types. Permitting common standard library classes
+can still leave the application vulnerable to gadget-chain attacks.
+</p>
+
 </overview>
 <recommendation>
 

csharp/ql/src/Security Features/CWE-502/UnsafeDeserializationUntrustedInput.qhelp

@@ -7,6 +7,17 @@
 <p>Deserializing an object from untrusted input may result in security problems, such
 as denial of service or remote code execution.</p>
 
+<p>
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally not tracked by this query. Such
+frameworks are generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution. However, care must be taken to ensure the schema
+strictly limits the allowed types. Permitting common standard library classes
+can still leave the application vulnerable to gadget-chain attacks.
+</p>
+
 </overview>
 <recommendation>
 

docs/codeql/codeql-language-guides/codeql-for-rust.rst

@@ -12,9 +12,12 @@ Experiment and learn how to write effective and efficient queries for CodeQL dat
    basic-query-for-rust-code
    codeql-library-for-rust
    analyzing-data-flow-in-rust
+   customizing-library-models-for-rust
 
 -  :doc:`Basic query for Rust code <basic-query-for-rust-code>`: Learn to write and run a simple CodeQL query.
 
 -  :doc:`CodeQL library for Rust <codeql-library-for-rust>`: When analyzing Rust code, you can make use of the large collection of classes in the CodeQL library for Rust.
 
 -  :doc:`Analyzing data flow in Rust <analyzing-data-flow-in-rust>`: You can use CodeQL to track the flow of data through a Rust program to places where the data is used.
+
+-  :doc:`Customizing library models for Rust <customizing-library-models-for-rust>`: You can model frameworks and libraries that your codebase depends on using data extensions and publish them as CodeQL model packs.

docs/codeql/codeql-language-guides/customizing-library-models-for-rust.rst

@@ -0,0 +1,567 @@
+.. _customizing-library-models-for-rust:
+
+Customizing library models for Rust
+====================================
+
+You can model the functions and methods that control data flow in any framework or library. This is especially useful for custom frameworks or niche libraries that are not supported by the standard CodeQL libraries.
+
+.. include:: ../reusables/beta-note-customizing-library-models.rst
+
+About this article
+------------------
+
+This article contains reference material about how to define custom models for sources, sinks, and flow summaries for Rust dependencies in data extension files.
+
+About data extensions
+---------------------
+
+You can customize analysis by defining models (summaries, sinks, and sources) of your code's Rust dependencies in data extension files. Each model defines the behavior of one or more elements of your library or framework, such as functions and methods. When you run dataflow analysis, these models expand the potential sources and sinks tracked by dataflow analysis and improve the precision of results.
+
+Most of the security queries search for paths from a source of untrusted input to a sink that represents a vulnerability. This is known as taint tracking. Each source is a starting point for dataflow analysis to track tainted data and each sink is an end point.
+
+Taint tracking queries also need to know how data can flow through elements that are not included in the source code. These are modeled as summaries. A summary model enables queries to synthesize the flow behavior through elements in dependency code that is not stored in your repository.
+
+Syntax used to define an element in an extension file
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Each model of an element is defined using a data extension where each tuple constitutes a model.
+A data extension file to extend the standard Rust queries included with CodeQL is a YAML file with the form:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: <name of extensible predicate>
+      data:
+        - <tuple1>
+        - <tuple2>
+        - ...
+
+Each YAML file may contain one or more top-level extensions.
+
+- ``addsTo`` defines the CodeQL pack name and extensible predicate that the extension is injected into.
+- ``data`` defines one or more rows of tuples that are injected as values into the extensible predicate. The number of columns and their types must match the definition of the extensible predicate.
+
+Data extensions use union semantics, which means that the tuples of all extensions for a single extensible predicate are combined, duplicates are removed, and all of the remaining tuples are queryable by referencing the extensible predicate.
+
+Publish data extension files in a CodeQL model pack to share
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can group one or more data extension files into a CodeQL model pack and publish it to the GitHub Container Registry. This makes it easy for anyone to download the model pack and use it to extend their analysis. For more information, see `Creating a CodeQL model pack <https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/creating-and-working-with-codeql-packs#creating-a-codeql-model-pack>`__ and `Publishing and using CodeQL packs <https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/publishing-and-using-codeql-packs/>`__ in the CodeQL CLI documentation.
+
+Extensible predicates used to create custom models in Rust
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The CodeQL library for Rust analysis exposes the following extensible predicates:
+
+- ``sourceModel(path, output, kind, provenance)``. This is used to model sources of potentially tainted data. The ``kind`` of the sources defined using this predicate determine which threat model they are associated with. Different threat models can be used to customize the sources used in an analysis. For more information, see ":ref:`Threat models <threat-models-rust>`."
+- ``sinkModel(path, input, kind, provenance)``. This is used to model sinks where tainted data may be used in a way that makes the code vulnerable.
+- ``summaryModel(path, input, output, kind, provenance)``. This is used to model flow through elements.
+- ``neutralModel(path, kind, provenance)``. This is similar to a summary model but used to indicate that a callable has no flow for a given category. Manual neutral models (those with a provenance such as ``manual``) can be used to override generated summary, source, or sink models (those with a provenance such as ``df-generated``), so that the generated model will be ignored.
+- ``barrierModel(path, output, kind, provenance)``. This is used to model barriers, which are elements that stop the flow of taint.
+- ``barrierGuardModel(path, input, acceptingValue, kind, provenance)``. This is used to model barrier guards, which are elements that can stop the flow of taint depending on a conditional check.
+
+The extensible predicates are populated using the models defined in data extension files.
+
+Canonical paths
+~~~~~~~~~~~~~~~
+
+In Rust models, each callable is identified by its **canonical path** — the fully-qualified path to the function or method. The canonical path follows the internal module structure of the crate, which may differ from the public re-export path.
+
+Canonical paths take the following forms:
+
+- **Free functions**: ``crate::module::function``, for example ``std::env::var`` or ``std::fs::read_to_string``.
+- **Inherent methods**: ``<Type>::method``, for example ``<std::fs::File>::open``.
+- **Trait methods with a concrete type**: ``<Type as Trait>::method``, for example ``<std::fs::File as std::io::Read>::read_to_end``.
+- **Trait methods with a wildcard type**: ``<_ as Trait>::method``, for example ``<_ as core::clone::Clone>::clone``. This form matches any type that implements the trait and is useful for modeling broadly applicable trait methods. For a type that has a specific model (<Type as Trait>::method), that model will take precedence over the trait model.
+
+Examples of custom model definitions
+-------------------------------------
+
+The examples in this section are based on models from the standard CodeQL Rust query pack published by GitHub. They demonstrate how to add tuples to extend extensible predicates that are used by the standard queries.
+
+Example: Taint sink for SQL injection in the ``sqlx`` crate
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how the Rust query pack models the first argument of the ``sqlx::query`` function as a SQL injection sink. The ``query`` function accepts a SQL query string that will be executed against a database.
+
+.. code-block:: rust
+
+  use sqlx;
+
+  async fn run_query(pool: &sqlx::PgPool, user_input: &str) {
+      sqlx::query(user_input) // The argument to this function is a SQL injection sink.
+          .execute(pool)
+          .await
+          .unwrap();
+  }
+
+We need to add a tuple to the ``sinkModel(path, input, kind, provenance)`` extensible predicate by updating a data extension file.
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: sinkModel
+      data:
+        - ["sqlx_core::query::query", "Argument[0]", "sql-injection", "manual"]
+
+
+- The first value ``sqlx_core::query::query`` is the canonical path of the function to model. Note that this is the internal module path (``sqlx_core::query::query``), not the public re-export path (``sqlx::query``).
+- The second value ``Argument[0]`` is the access path to the first argument of the function call, which is the SQL query string. This is the location of the sink.
+- The third value ``sql-injection`` is the kind of the sink. The sink kind is used to define the queries where the sink is in scope.
+- The fourth value ``manual`` is the provenance of the sink, which is used to identify the origin of the sink.
+
+Example: Taint source from the ``reqwest`` crate
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how the Rust query pack models the return value of the ``reqwest::get`` function as a ``remote`` source. This function makes an HTTP GET request to a remote server.
+
+.. code-block:: rust
+
+  async fn fetch_data(url: &str) -> Result<reqwest::Response, reqwest::Error> {
+      let response = reqwest::get(url).await?; // The return value is a remote source of taint.
+      Ok(response)
+  }
+
+We need to add a tuple to the ``sourceModel(path, output, kind, provenance)`` extensible predicate by updating a data extension file.
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: sourceModel
+      data:
+        - ["reqwest::get", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "remote", "manual"]
+
+
+- The first value ``reqwest::get`` is the canonical path of the function.
+- The second value ``ReturnValue.Future.Field[core::result::Result::Ok(0)]`` is the access path to the output. This compound path is read left to right:
+
+  - ``ReturnValue`` selects the return value of the function call. Since ``reqwest::get`` is an ``async`` function, the return value is a ``Future``.
+  - ``Future`` unwraps the ``Future`` to reach the value that will be available after ``.await``.
+  - ``Field[core::result::Result::Ok(0)]`` selects the first positional field of the ``Ok`` variant of the ``Result`` — that is, the ``reqwest::Response`` value.
+
+- The third value ``remote`` is the kind of the source. ``remote`` indicates that this source represents data that originates from a remote network request. For more information, see ":ref:`Threat models <threat-models-rust>`."
+- The fourth value ``manual`` is the provenance of the source.
+
+Example: Taint source from environment variables
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how the Rust query pack models the return value of ``std::env::var`` as a source of data from the environment.
+
+.. code-block:: rust
+
+  fn get_config() {
+      let db_url = std::env::var("DATABASE_URL").unwrap(); // The return value is a source of environment data.
+      // ...
+  }
+
+We need to add a tuple to the ``sourceModel(path, output, kind, provenance)`` extensible predicate by updating a data extension file.
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: sourceModel
+      data:
+        - ["std::env::var", "ReturnValue.Field[core::result::Result::Ok(0)]", "environment", "manual"]
+
+- The first value ``std::env::var`` is the canonical path to the ``var`` function in the ``std::env`` module.
+- The second value ``ReturnValue.Field[core::result::Result::Ok(0)]`` selects the ``Ok`` variant of the returned ``Result<String, VarError>``.
+- The third value ``environment`` is the source kind. This is a subcategory of the ``local`` threat model. For more information, see ":ref:`Threat models <threat-models-rust>`."
+- The fourth value ``manual`` is the provenance of the source.
+
+Example: Add flow through the ``Response::text`` method
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how the Rust query pack models taint flow through the ``text`` method of ``reqwest::Response``, which reads the response body as a string.
+
+.. code-block:: rust
+
+  async fn read_body(response: reqwest::Response) {
+      let body = response.text().await.unwrap(); // There is taint flow from response to body.
+      // ...
+  }
+
+We need to add a tuple to the ``summaryModel(path, input, output, kind, provenance)`` extensible predicate by updating a data extension file:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: summaryModel
+      data:
+        - ["<reqwest::response::Response>::text", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
+
+
+- The first value ``<reqwest::response::Response>::text`` is the canonical path. Note the format ``<Type>::method`` used for inherent methods. Also note that the canonical path uses the internal module path ``reqwest::response::Response``, not just ``reqwest::Response``.
+- The second value ``Argument[self]`` is the access path to the input. ``Argument[self]`` refers to the receiver of the method call (``response`` in the example).
+- The third value ``ReturnValue.Future.Field[core::result::Result::Ok(0)]`` is the access path to the output. This models the fact that ``text()`` is an ``async`` method returning ``impl Future<Output = Result<String, Error>>``, so we follow through ``Future`` and then unwrap the ``Ok`` variant.
+- The fourth value ``taint`` is the kind of the flow. ``taint`` means that taint is propagated through the call — the output is derived from the input but may not be identical to it.
+- The fifth value ``manual`` is the provenance of the summary.
+
+Example: Add flow through the ``Path::join`` method
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how the Rust query pack models taint flow through the ``join`` method of ``std::path::Path``, where both the receiver and argument contribute to the result.
+
+.. code-block:: rust
+
+  use std::path::Path;
+
+  fn build_path(base: &Path, user_input: &str) {
+      let full_path = base.join(user_input); // There is taint flow from both base and user_input to full_path.
+      // ...
+  }
+
+We need to add tuples to the ``summaryModel(path, input, output, kind, provenance)`` extensible predicate by updating a data extension file:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: summaryModel
+      data:
+        - ["<std::path::Path>::join", "Argument[self].Reference", "ReturnValue", "taint", "manual"]
+        - ["<std::path::Path>::join", "Argument[0]", "ReturnValue", "taint", "manual"]
+
+Since we are adding flow through a method, we need to add tuples to the ``summaryModel`` extensible predicate. Each tuple defines flow from one input to the output. The first row defines flow from the receiver and the second row defines flow from the first argument.
+
+- The first value ``<std::path::Path>::join`` is the canonical path, the same for both rows.
+- The second value differs:
+
+  - ``Argument[self].Reference`` is the access path to the receiver. Since ``join`` takes ``&self``, we use ``Argument[self]`` to select the ``self`` reference, and then ``Reference`` to follow through the reference to the underlying ``Path`` value.
+  - ``Argument[0]`` is the access path to the first argument (``user_input`` in the example).
+
+- The third value ``ReturnValue`` is the access path to the output — the return value of the method call.
+- The fourth value ``taint`` is the kind of flow. Since ``join`` combines the path and the argument, the output is derived from the inputs but is not identical to either one.
+- The fifth value ``manual`` is the provenance of the summary.
+
+.. note::
+
+  When using ``Argument[self]`` to refer to the receiver, the ``Reference`` token may need to be appended to follow through the ``&self`` or ``&mut self`` reference to the underlying value. This depends on whether the data you want to track is on the reference itself or on the value behind the reference.
+
+Example: Add flow through the ``Iterator::map`` method
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how the Rust query pack models a more complex flow through a higher-order method. Here we model flow through the ``map`` method of the ``Iterator`` trait, which takes a closure and applies it to each element.
+
+.. code-block:: rust
+
+  fn transform(items: Vec<String>) {
+      let results: Vec<String> = items.into_iter().map(|item| {
+          item.to_uppercase() // There is value flow from elements of `items` to `item`.
+      }).collect();
+  }
+
+We need to add tuples to the ``summaryModel(path, input, output, kind, provenance)`` extensible predicate by updating a data extension file:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: summaryModel
+      data:
+        - ["<_ as core::iter::traits::iterator::Iterator>::map", "Argument[self].Element", "Argument[0].Parameter[0]", "value", "manual"]
+
+
+- The first value ``<_ as core::iter::traits::iterator::Iterator>::map`` is the canonical path. The ``<_ as Trait>::method`` form uses a wildcard type (``_``) to match any type that implements the ``Iterator`` trait.
+- The second value ``Argument[self].Element`` is the access path to the input — the elements of the iterator (the receiver).
+- The third value ``Argument[0].Parameter[0]`` is the access path to the output:
+
+  - ``Argument[0]`` selects the closure argument to ``map``.
+  - ``Parameter[0]`` selects the first parameter of the closure (``item`` in the example).
+
+- The fourth value ``value`` is the kind of flow. ``value`` means the value is preserved as it flows — each element of the iterator flows unchanged into the closure parameter.
+- The fifth value ``manual`` is the provenance of the summary.
+
+Example: Add a ``neutral`` model
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how the Rust query pack models the ``Option::map`` method as neutral with respect to sinks.
+
+A neutral model prevents generated or inherited models of a specific category (``source``, ``sink``, or ``summary``) from being applied to a callable. This is useful when an automatically generated model incorrectly identifies a callable as, for example, a sink.
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: neutralModel
+      data:
+        - ["<core::option::Option>::map", "sink", "manual"]
+
+Since we are adding a neutral model, we need to add a tuple to the ``neutralModel`` extensible predicate. The tuple has three values:
+
+- The first value ``<core::option::Option>::map`` is the canonical path of the function.
+- The second value ``sink`` is the category of model to suppress. This means that any generated sink model for ``Option::map`` will be ignored. The category can be ``source``, ``sink``, or ``summary``.
+- The third value ``manual`` is the provenance of the neutral model.
+
+Example: Add a barrier for SQL injection
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how to model a barrier that stops the flow of taint. A barrier model is used to define that the flow of taint stops at the modeled element for the specified kind of query.
+
+Consider a hypothetical function ``my_crate::sanitize::escape_sql`` which escapes a SQL string, making it safe to use in a SQL query.
+
+.. code-block:: rust
+
+  fn run_query(pool: &sqlx::PgPool, user_input: &str) {
+      let safe_input = my_crate::sanitize::escape_sql(user_input); // The return value is safe to use in SQL.
+      let query = format!("SELECT * FROM users WHERE name = '{}'", safe_input);
+      // ...
+  }
+
+We need to add a tuple to the ``barrierModel(path, output, kind, provenance)`` extensible predicate by updating a data extension file.
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: barrierModel
+      data:
+        - ["my_crate::sanitize::escape_sql", "ReturnValue", "sql-injection", "manual"]
+
+
+- The first value ``my_crate::sanitize::escape_sql`` is the canonical path of the function.
+- The second value ``ReturnValue`` is the access path to the output of the barrier, which means that the return value is considered sanitized.
+- The third value ``sql-injection`` is the kind of the barrier. The barrier kind must match the kind used in the query where the barrier should take effect. In this case, it matches the ``sql-injection`` sink kind used by SQL injection queries.
+- The fourth value ``manual`` is the provenance of the barrier.
+
+Example: Add a barrier guard
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This example shows how to model a barrier guard that stops the flow of taint when a conditional check is performed on data.
+A barrier guard model is used when a function returns a boolean that indicates whether the data is safe to use.
+
+Consider a hypothetical function ``my_crate::validate::is_safe_path`` which returns ``true`` when the given path is safe to use in a file system access.
+
+.. code-block:: rust
+
+  fn read_file(user_path: &str) {
+      if my_crate::validate::is_safe_path(user_path) { // The check guards the use, so the input is safe.
+          let contents = std::fs::read_to_string(user_path).unwrap();
+          // ...
+      }
+  }
+
+We need to add a tuple to the ``barrierGuardModel(path, input, acceptingValue, kind, provenance)`` extensible predicate by updating a data extension file.
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: barrierGuardModel
+      data:
+        - ["my_crate::validate::is_safe_path", "Argument[0]", "true", "path-injection", "manual"]
+
+
+- The first value ``my_crate::validate::is_safe_path`` is the canonical path of the function.
+- The second value ``Argument[0]`` is the access path to the input whose flow is blocked. In this case, the first argument to the function (``user_path`` in the example).
+- The third value ``true`` is the accepting value of the barrier guard. This is the value that the conditional check must return for the barrier to apply. In this case, when ``is_safe_path`` returns ``true``, the input is considered safe.
+- The fourth value ``path-injection`` is the kind of the barrier guard. The barrier guard kind must match the kind used in the query where the barrier guard should take effect. In this case, it matches the ``path-injection`` sink kind used by tainted path queries.
+- The fifth value ``manual`` is the provenance of the barrier guard.
+
+.. _threat-models-rust:
+
+Threat models
+-------------
+
+.. include:: ../reusables/threat-model-description.rst
+
+Reference material
+------------------
+
+The following sections provide reference material for extensible predicates, access paths, and kinds.
+
+Extensible predicates
+---------------------
+
+sourceModel(path, output, kind, provenance)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Adds a new taint source. Most taint-tracking queries will use the new source.
+
+- **path**: Canonical path of the function or method.
+- **output**: Access path leading to the source value.
+- **kind**: Kind of source to add. See ":ref:`Threat models <threat-models-rust>`" for available source kinds.
+- **provenance**: Origin of the model. Use ``manual`` for custom models.
+
+Example:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: sourceModel
+      data:
+        - ["std::env::var", "ReturnValue.Field[core::result::Result::Ok(0)]", "environment", "manual"]
+
+sinkModel(path, input, kind, provenance)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Adds a new taint sink. Sinks are query-specific and will typically affect one or two queries.
+
+- **path**: Canonical path of the function or method.
+- **input**: Access path leading to the sink value.
+- **kind**: Kind of sink to add. See the section on sink kinds for a list of commonly used kinds.
+- **provenance**: Origin of the model. Use ``manual`` for custom models.
+
+Example:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: sinkModel
+      data:
+        - ["sqlx_core::query::query", "Argument[0]", "sql-injection", "manual"]
+
+summaryModel(path, input, output, kind, provenance)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Adds flow through a function or method call.
+
+- **path**: Canonical path of the function or method.
+- **input**: Access path leading to the input of the flow (where data flows from).
+- **output**: Access path leading to the output of the flow (where data flows to).
+- **kind**: Kind of summary to add. Can be ``taint`` for taint-propagating flow, or ``value`` for value-preserving flow.
+- **provenance**: Origin of the model. Use ``manual`` for custom models.
+
+Example:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: summaryModel
+      data:
+        - ["<reqwest::response::Response>::text", "Argument[self]", "ReturnValue.Future.Field[core::result::Result::Ok(0)]", "taint", "manual"]
+
+neutralModel(path, kind, provenance)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Prevents generated or inherited models of the specified category from being applied to the callable.
+
+- **path**: Canonical path of the function or method.
+- **kind**: The category of model to suppress: ``source``, ``sink``, or ``summary``.
+- **provenance**: Origin of the model. Use ``manual`` for custom models.
+
+Example:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: neutralModel
+      data:
+        - ["<core::option::Option>::map", "sink", "manual"]
+
+barrierModel(path, output, kind, provenance)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Adds a new barrier that stops the flow of taint at the specified element.
+
+- **path**: Canonical path of the function or method.
+- **output**: Access path leading to the output of the barrier (the value that is considered sanitized).
+- **kind**: Kind of barrier to add. The barrier kind must match the kind used in the query where the barrier should take effect.
+- **provenance**: Origin of the model. Use ``manual`` for custom models.
+
+Example:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: barrierModel
+      data:
+        - ["my_crate::sanitize::escape_sql", "ReturnValue", "sql-injection", "manual"]
+
+barrierGuardModel(path, input, acceptingValue, kind, provenance)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Adds a new barrier guard that stops the flow of taint when a conditional check is performed on data.
+
+- **path**: Canonical path of the function or method.
+- **input**: Access path to the input whose flow is blocked.
+- **acceptingValue**: The value that the conditional check must return for the barrier to apply. Usually ``"true"`` or ``"false"``.
+- **kind**: Kind of barrier guard to add. The barrier guard kind must match the kind used in the query where the barrier guard should take effect.
+- **provenance**: Origin of the model. Use ``manual`` for custom models.
+
+Example:
+
+.. code-block:: yaml
+
+  extensions:
+    - addsTo:
+        pack: codeql/rust-all
+        extensible: barrierGuardModel
+      data:
+        - ["my_crate::validate::is_safe_path", "Argument[0]", "true", "path-injection", "manual"]
+
+Access paths
+------------
+
+The ``input`` and ``output`` columns consist of a ``.``-separated list of access path tokens, which is evaluated from left to right, with each step selecting a new set of values derived from the previous set.
+
+The following tokens are commonly used:
+
+- **Argument[**\ ``n``\ **]** selects the ``n``-th argument to a call (0-indexed). May be a range of the form ``x..y`` (inclusive) and/or a comma-separated list.
+- **Argument[self]** selects the receiver (``self``) of a method call.
+- **Parameter[**\ ``n``\ **]** selects the ``n``-th parameter of a callback. May be a range of the form ``x..y`` (inclusive) and/or a comma-separated list.
+- **ReturnValue** selects the return value of a function call.
+- **Element** selects an element in a collection (such as a ``Vec``, ``HashMap``, or iterator).
+- **Field[**\ ``type::field``\ **]** selects a named field of a struct or enum variant. For example, ``Field[ihex::Record::Data::value]`` selects the field ``value`` of the ``ihex::Record::Data`` variant.
+- **Field[**\ ``type(i)``\ **]** selects the ``i``-th positional field of a tuple struct or tuple enum variant. For example, ``Field[core::result::Result::Ok(0)]`` selects the first positional value inside ``Ok``.
+- **Field[**\ ``i``\ **]** selects the ``i``-th element of a tuple.
+- **Reference** follows through a reference (``&T`` or ``&mut T``) to reach the referenced value.
+- **Future** follows through a ``Future`` to reach the value that will be available after ``.await``.
+
+Additional notes about the syntax:
+
+- Multiple operands may be given to a single token, as a shorthand for the union of the operands. For example, ``Argument[0,1]`` matches both ``Argument[0]`` and ``Argument[1]``.
+- Numeric operands to ``Argument`` and ``Parameter`` may be given as a range. For example, ``Argument[0..2]`` matches arguments 0, 1, and 2.
+
+Kinds
+-----
+
+Source kinds
+~~~~~~~~~~~~
+
+See ":ref:`Threat models <threat-models-rust>`" for available source kinds.
+
+Sink kinds
+~~~~~~~~~~
+
+Unlike sources, sinks tend to be highly query-specific, rarely affecting more than one or two queries. Not every query supports customizable sinks.
+
+Commonly used sink kinds for Rust include:
+
+- **sql-injection**: A sink for SQL injection, such as an argument to ``sqlx::query``.
+- **path-injection**: A sink for path injection in a file system access, such as an argument to ``std::fs::read``.
+- **log-injection**: A sink for log injection, such as an argument to a logging function.
+- **html-injection**: A sink for HTML injection (cross-site scripting), such as a response body.
+- **command-injection**: A sink for command injection, such as an argument to ``std::process::Command``.
+- **request-url**: A sink for server-side request forgery, such as a URL passed to an HTTP client.
+- **regex-use**: A sink for regex injection, such as a pattern passed to a regex constructor.
+
+Summary kinds
+~~~~~~~~~~~~~
+
+- **taint**: A summary that propagates taint. This means the output is not necessarily equal to the input, but it was derived from the input in an unrestrictive way. An attacker who controls the input will have significant control over the output as well.
+- **value**: A summary that preserves the value of the input or creates a copy of the input such that all of its properties are preserved.

go/extractor/toolchain/toolchain.go

@@ -130,7 +130,13 @@ func parseGoVersion(data string) string {
 	for sc.Scan() {
 		lastLine = sc.Text()
 	}
-	return strings.Fields(lastLine)[2]
+
+	var goVersion = strings.Fields(lastLine)[2]
+
+	// Drop custom build suffixes.
+	goVersion, _, _ = strings.Cut(goVersion, "-")
+
+	return goVersion
 }
 
 // Returns a value indicating whether the system Go toolchain supports workspaces.

go/extractor/toolchain/toolchain_test.go

@@ -8,7 +8,9 @@ import (
 
 func TestParseGoVersion(t *testing.T) {
 	tests := map[string]string{
-		"go version go1.18.9 linux/amd64": "go1.18.9",
+		"go version go1.18.9 linux/amd64":            "go1.18.9",
+		"go version go1.26.3-X:nodwarf5 linux/amd64": "go1.26.3",
+		"go version go1.26.3rc1 linux/amd64":         "go1.26.3rc1",
 		"warning: GOPATH set to GOROOT (/usr/local/go) has no effect\ngo version go1.18.9 linux/amd64": "go1.18.9",
 	}
 	for input, expected := range tests {

java/documentation/library-coverage/coverage.csv

@@ -1,296 +1,296 @@
-package,sink,source,summary,sink:bean-validation,sink:command-injection,sink:credentials-key,sink:credentials-password,sink:credentials-username,sink:encryption-iv,sink:encryption-salt,sink:environment-injection,sink:file-content-store,sink:fragment-injection,sink:groovy-injection,sink:hostname-verification,sink:html-injection,sink:information-leak,sink:intent-redirection,sink:jexl-injection,sink:jndi-injection,sink:js-injection,sink:ldap-injection,sink:log-injection,sink:mvel-injection,sink:notification,sink:ognl-injection,sink:path-injection,sink:pending-intents,sink:regex-use,sink:regex-use[-1],sink:regex-use[0],sink:regex-use[],sink:regex-use[f-1],sink:regex-use[f1],sink:regex-use[f],sink:request-forgery,sink:response-splitting,sink:sql-injection,sink:template-injection,sink:trust-boundary-violation,sink:unsafe-deserialization,sink:url-forward,sink:url-redirection,sink:xpath-injection,sink:xslt-injection,source:android-external-storage-dir,source:contentprovider,source:database,source:environment,source:file,source:remote,summary:taint,summary:value
-actions.osgi,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
-android.app,77,,103,,,,,,,,,,11,,,,,7,,,,,,,42,,,17,,,,,,,,,,,,,,,,,,,,,,,,18,85
-android.content,24,31,154,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,8,,,,,,,,4,27,,,,,63,91
-android.database,59,,41,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,59,,,,,,,,,,,,,,41,
-android.net,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,15
-android.os,1,2,122,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,2,,,,,,41,81
-android.support.v4.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-android.util,6,16,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,16,,
-android.webkit,3,2,,,,,,,,,,,,,,2,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
-android.widget,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,1,
-androidx.core.app,47,,95,,,,,,,,,,,,,,,,,,,,,,41,,,6,,,,,,,,,,,,,,,,,,,,,,,,12,83
-androidx.fragment.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-androidx.slice,2,5,88,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,5,,,,,27,61
-antlr,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-ch.ethz.ssh2,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-cn.hutool.core.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.alibaba.com.caucho.hessian.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
-com.alibaba.druid.sql,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,1,
-com.alibaba.fastjson2,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.amazonaws.auth,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.auth0.jwt.algorithms,6,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.azure.identity,3,,,,,1,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.caucho.burlap.io,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
-com.caucho.hessian.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
-com.cedarsoftware.util.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
-com.couchbase.client.core.env,15,,1,,,,9,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.couchbase.client.java,10,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,
-com.esotericsoftware.kryo.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.esotericsoftware.kryo5.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.esotericsoftware.yamlbeans,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
-com.fasterxml.jackson.core,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-com.fasterxml.jackson.databind,2,,8,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,8,
-com.google.common.base,4,,87,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,1,,,,,,,,,,,,,,,,,,,,63,24
-com.google.common.cache,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17
-com.google.common.collect,,,553,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,551
-com.google.common.flogger,29,,,,,,,,,,,,,,,,,,,,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.google.common.io,10,,73,,,,,,,,,1,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,,,,,,,,,,,72,1
-com.google.gson,,,52,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,38,14
-com.hubspot.jinjava,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,
-com.jcraft.jsch,5,,1,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,1,
-com.microsoft.sqlserver.jdbc,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.mitchellbosecke.pebble,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,
-com.mongodb,10,,,,,,4,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.opensymphony.xwork2,56,,961,,,,,,,,,,,,,,,,,,,,,,,56,,,,,,,,,,,,,,,,,,,,,,,,,,867,94
-com.rabbitmq.client,,21,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,7,
-com.sshtools.j2ssh.authentication,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.crypto.provider,19,,,,,17,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.jndi.ldap,4,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.net.httpserver,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.net.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.rowset,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.security.auth.module,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.security.ntlm,5,,,,,,3,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.sun.security.sasl.digest,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.thoughtworks.xstream,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.trilead.ssh2,13,,,,,2,4,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.unboundid.ldap.sdk,17,,,,,,,,,,,,,,,,,,,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-com.zaxxer.hikari,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
-flexjson,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
-freemarker.cache,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
-freemarker.template,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7,,,,,,,,,,,,,,
-groovy.lang,26,,,,,,,,,,,,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-groovy.text,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-groovy.util,5,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-hudson,75,9,2648,,4,,,,,,3,2,,,,4,,,,,,,,,,,56,,,,,,,,,6,,,,,,,,,,,,,,5,4,2572,76
-io.jsonwebtoken,,2,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4,
-io.netty.bootstrap,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,
-io.netty.buffer,,,207,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,130,77
-io.netty.channel,9,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,2,,
-io.netty.handler.codec,4,13,259,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,3,,,,,,,,,,,,,,,13,143,116
-io.netty.handler.ssl,4,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,
-io.netty.handler.stream,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-io.netty.resolver,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-io.netty.util,2,,23,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,21,2
-io.undertow.server.handlers.resource,1,,3,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,3,
-jakarta.activation,2,,2,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,2,
-jakarta.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,7,,
-jakarta.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
-jakarta.persistence,2,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,1,
-jakarta.servlet,2,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,26,,
-jakarta.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
-jakarta.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
-jakarta.ws.rs.core,2,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
-jakarta.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
-java.applet,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,
-java.awt,1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,3
-java.beans,1,,177,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,82,95
-java.io,66,1,225,,,,,,,,,22,,,,,,,,,,,,,,,44,,,,,,,,,,,,,,,,,,,,,,,1,,202,23
-java.lang,38,3,790,,13,,,,,,1,,,,,,,,,,,,8,,,,11,,,4,,,1,,,,,,,,,,,,,,,,3,,,510,280
-java.math,,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9
-java.net,23,3,347,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,,,,,,,,,,,,,,,3,248,99
-java.nio,47,,499,,,,,,,,,5,,,,,,,,,,,,,,,41,,,,,,,,,1,,,,,,,,,,,,,,,,302,197
-java.rmi,,,68,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,23
-java.security,21,,583,,,11,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,285,298
-java.sql,15,1,292,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,9,,,,,,,,,,1,,,,274,18
-java.text,,,154,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,72,82
-java.time,,,131,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,27,104
-java.util,48,2,1340,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,5,2,,1,2,,,,,,,,,,,,,,2,,,558,782
-javafx.scene.web,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
-javax.accessibility,,,63,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,28,35
-javax.activation,2,,7,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,7,
-javax.annotation.processing,,,28,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,3
-javax.crypto,19,,140,,,12,3,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,76,64
-javax.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,7,,
-javax.imageio,1,,304,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,138,166
-javax.jms,,9,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,57,
-javax.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
-javax.lang.model,,,277,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,217,60
-javax.management,2,,766,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,363,403
-javax.naming,7,,341,,,,,,,,,,,,,,,,,6,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,191,150
-javax.net,4,,136,,,,2,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,87,49
-javax.portlet,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,
-javax.print,2,,133,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,102,31
-javax.rmi.ssl,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6
-javax.script,1,,50,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,14,36
-javax.security.auth,7,,147,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,50,97
-javax.security.cert,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,
-javax.security.sasl,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,42,7
-javax.servlet,10,29,3,,,,,,,,,,,,,,1,,,,,,,,,,2,,,,,,,,,,3,,,2,,2,,,,,,,,,29,3,
-javax.smartcardio,,,34,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,24,10
-javax.sound.midi,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,51,9
-javax.sound.sampled,,,90,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,53,37
-javax.sql,7,,126,,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,68,58
-javax.tools,,,66,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,62,4
-javax.transaction.xa,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-javax.validation,1,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
-javax.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
-javax.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
-javax.ws.rs.core,3,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,2,,,,,,,,,94,55
-javax.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
-javax.xml.catalog,,,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,1
-javax.xml.crypto,,,269,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,172,97
-javax.xml.datatype,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,1
-javax.xml.namespace,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,10
-javax.xml.parsers,,,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35,2
-javax.xml.stream,,,221,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,201,20
-javax.xml.transform,2,,134,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,1,,,,,,,72,62
-javax.xml.validation,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,29,
-javax.xml.xpath,3,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,26,
-jenkins,,,523,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,500,23
-jodd.json,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10
-kotlin,16,,1849,,,,,,,,,,,,,,,,,,,,,,,,14,,,,,,,,,2,,,,,,,,,,,,,,,,1836,13
-liquibase.database.jvm,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
-liquibase.statement.core,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
-net.lingala.zip4j,2,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,
-net.schmizz.sshj,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-net.sf.json,2,,338,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,321,17
-net.sf.saxon.s9api,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,
-ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,
-okhttp3,4,,50,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,23,27
-org.acegisecurity,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,49,
-org.antlr.runtime,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.codec,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
-org.apache.commons.collections,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
-org.apache.commons.collections4,,,806,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,789
-org.apache.commons.compress.archivers.tar,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
-org.apache.commons.exec,10,,,,6,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.fileupload,,11,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,4,
-org.apache.commons.httpclient.util,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.commons.io,124,,570,,,,,,,,,4,,,,,,,,,,,,,,,105,,,,,,,,,15,,,,,,,,,,,,,,,,556,14
-org.apache.commons.jelly,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,
-org.apache.commons.jexl2,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.jexl3,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.lang,1,,767,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,596,171
-org.apache.commons.lang3,7,,425,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,1,,,,,,,,,,,294,131
-org.apache.commons.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.net,13,12,,,,,2,2,,,,,,,,,,,,,,,,,,,3,,,,,,,,,6,,,,,,,,,,,,,,,12,,
-org.apache.commons.ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.commons.text,,,272,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,220,52
-org.apache.cxf.catalog,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
-org.apache.cxf.common.classloader,3,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,2,,,,,,,,,,,,,,,,,
-org.apache.cxf.common.jaxb,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.common.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.configuration.jsse,2,,,,,,,,,,,,,,1,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.helpers,10,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,,5,,,,,,,,,
-org.apache.cxf.resource,9,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,5,,,,,,,,,,,,,,,,,
-org.apache.cxf.staxutils,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.tools.corba.utils,4,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.tools.util,10,,,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.cxf.transform,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,
-org.apache.directory.ldap.client.api,1,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.hadoop.fs,3,,11,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,11,
-org.apache.hadoop.hive.metastore,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,
-org.apache.hadoop.hive.ql.exec,1,,1,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.hadoop.hive.ql.metadata,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.hc.client5.http.async.methods,84,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,84,,,,,,,,,,,,,,,,,
-org.apache.hc.client5.http.classic.methods,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,37,,,,,,,,,,,,,,,,,
-org.apache.hc.client5.http.fluent,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,,,,
-org.apache.hc.core5.benchmark,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
-org.apache.hc.core5.function,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.hc.core5.http,73,2,45,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,72,,,,,,,,,,,,,,,2,45,
-org.apache.hc.core5.net,,,18,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,
-org.apache.hc.core5.util,,,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,6
-org.apache.hive.hcatalog.templeton,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
-org.apache.http,48,3,95,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,46,,,,,,,,,,,,,,,3,86,9
-org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,57,
-org.apache.ibatis.mapping,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.log4j,11,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.logging.log4j,359,,8,,,,,,,,,,,,,,,,,,,,359,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,4
-org.apache.shiro.authc,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
-org.apache.shiro.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.shiro.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.shiro.mgt,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.sshd.client.session,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.struts.beanvalidation.validation.interceptor,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
-org.apache.struts2,14,,3873,,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,3,,,,,,,,,,,,3839,34
-org.apache.tools.ant,14,,,,1,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.apache.tools.zip,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.apache.velocity.app,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,
-org.apache.velocity.runtime,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,
-org.codehaus.cargo.container.installer,3,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,1,,,,,,,,,,,,,,,,,
-org.codehaus.groovy.control,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.dom4j,20,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,20,,,,,,,,,
-org.eclipse.jetty.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
-org.exolab.castor.xml,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
-org.fusesource.leveldbjni,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.geogebra.web.full.main,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,
-org.gradle.api.file,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-org.hibernate,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,
-org.ho.yaml,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,,,,,
-org.influxdb,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
-org.jabsorb,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
-org.jboss.logging,324,,,,,,,,,,,,,,,,,,,,,,324,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.jboss.vfs,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.jdbi.v3.core,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,
-org.jenkins.ui.icon,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48,1
-org.jenkins.ui.symbol,,,33,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,8
-org.jooq,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
-org.json,,,236,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,198,38
-org.keycloak.models.map.storage,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
-org.kohsuke.stapler,20,24,363,,,,,,,,,,,,,2,,,,,,,,,,,9,,,,,,,,,3,,,,,,1,5,,,,,,,,24,352,11
-org.lastaflute.web,,1,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,4,
-org.mvel2,16,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.openjdk.jmh.runner.options,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.owasp.esapi,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.pac4j.jwt.config.encryption,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.pac4j.jwt.config.signature,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.scijava.log,13,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.slf4j,55,,6,,,,,,,,,,,,,,,,,,,,55,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4
-org.springframework.beans,,,30,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,30
-org.springframework.boot.jdbc,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
-org.springframework.cache,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13
-org.springframework.context,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-org.springframework.core.io,17,,6,,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,1,,,,,,,,,,,,,,,,6,
-org.springframework.data.repository,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
-org.springframework.http,14,,77,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,14,,,,,,,,,,,,,,,,67,10
-org.springframework.jdbc.core,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,,
-org.springframework.jdbc.datasource,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,
-org.springframework.jdbc.object,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,
-org.springframework.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.springframework.ldap,47,,,,,,,,,,,,,,,,,,,33,,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.springframework.security.core.userdetails,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-org.springframework.security.web.savedrequest,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,
-org.springframework.ui,,,32,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,32
-org.springframework.util,10,,142,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,,,,,90,52
-org.springframework.validation,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,
-org.springframework.web.client,13,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,3,,
-org.springframework.web.context.request,,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,,
-org.springframework.web.multipart,,12,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,12,12,
-org.springframework.web.portlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
-org.springframework.web.reactive.function.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
-org.springframework.web.servlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
-org.springframework.web.socket,,8,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,6,
-org.springframework.web.util,,9,159,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,134,25
-org.thymeleaf,2,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,2,
-org.xml.sax,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-org.xmlpull.v1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,
-org.yaml.snakeyaml,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
-play.libs.ws,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
-play.mvc,1,13,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,13,24,
-ratpack.core.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-ratpack.core.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
-ratpack.core.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
-ratpack.exec,,,48,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48
-ratpack.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
-ratpack.func,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
-ratpack.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
-ratpack.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
-ratpack.util,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
-retrofit2,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,1,
-software.amazon.awssdk.transfer.s3.model,8,,,,,,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.jvmstat.perfdata.monitor.protocol.local,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.jvmstat.perfdata.monitor.protocol.rmi,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.misc,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.net.ftp,5,,,,,,2,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.net.www.protocol.http,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.acl,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.jgss.krb5,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.krb5,9,,,,,3,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.pkcs,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.pkcs11,3,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.provider,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.security.x509,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
-sun.tools.jconsole,28,,,,,,13,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+package,sink,source,summary,sink:bean-validation,sink:command-injection,sink:credentials-key,sink:credentials-password,sink:credentials-username,sink:encryption-iv,sink:encryption-salt,sink:environment-injection,sink:file-content-store,sink:fragment-injection,sink:groovy-injection,sink:hostname-verification,sink:html-injection,sink:information-leak,sink:intent-redirection,sink:jexl-injection,sink:jndi-injection,sink:js-injection,sink:ldap-injection,sink:log-injection,sink:mvel-injection,sink:notification,sink:ognl-injection,sink:path-injection,sink:path-injection[read],sink:pending-intents,sink:regex-use,sink:regex-use[-1],sink:regex-use[0],sink:regex-use[],sink:regex-use[f-1],sink:regex-use[f1],sink:regex-use[f],sink:request-forgery,sink:response-splitting,sink:sql-injection,sink:template-injection,sink:trust-boundary-violation,sink:unsafe-deserialization,sink:url-forward,sink:url-redirection,sink:xpath-injection,sink:xslt-injection,source:android-external-storage-dir,source:contentprovider,source:database,source:environment,source:file,source:remote,summary:taint,summary:value
+actions.osgi,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
+android.app,77,,103,,,,,,,,,,11,,,,,7,,,,,,,42,,,,17,,,,,,,,,,,,,,,,,,,,,,,,18,85
+android.content,24,31,154,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,4,27,,,,,63,91
+android.database,59,,41,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,59,,,,,,,,,,,,,,41,
+android.net,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,15
+android.os,1,2,122,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,2,,,,,,41,81
+android.support.v4.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+android.util,6,16,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,16,,
+android.webkit,3,2,,,,,,,,,,,,,,2,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
+android.widget,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,1,
+androidx.core.app,47,,95,,,,,,,,,,,,,,,,,,,,,,41,,,,6,,,,,,,,,,,,,,,,,,,,,,,,12,83
+androidx.fragment.app,11,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+androidx.slice,2,5,88,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,5,,,,,27,61
+antlr,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+ch.ethz.ssh2,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+cn.hutool.core.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.alibaba.com.caucho.hessian.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
+com.alibaba.druid.sql,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,1,
+com.alibaba.fastjson2,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.amazonaws.auth,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.auth0.jwt.algorithms,6,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.azure.identity,3,,,,,1,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.caucho.burlap.io,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+com.caucho.hessian.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
+com.cedarsoftware.util.io,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,
+com.couchbase.client.core.env,15,,1,,,,9,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.couchbase.client.java,10,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,
+com.esotericsoftware.kryo.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.esotericsoftware.kryo5.io,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.esotericsoftware.yamlbeans,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+com.fasterxml.jackson.core,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+com.fasterxml.jackson.databind,2,,8,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,8,
+com.google.common.base,4,,87,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,1,,,,,,,,,,,,,,,,,,,,63,24
+com.google.common.cache,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17
+com.google.common.collect,,,553,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,551
+com.google.common.flogger,29,,,,,,,,,,,,,,,,,,,,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.google.common.io,10,,73,,,,,,,,,1,,,,,,,,,,,,,,,4,5,,,,,,,,,,,,,,,,,,,,,,,,,72,1
+com.google.gson,,,52,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,38,14
+com.hubspot.jinjava,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,
+com.jcraft.jsch,5,,1,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,1,
+com.microsoft.sqlserver.jdbc,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.mitchellbosecke.pebble,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,
+com.mongodb,10,,,,,,4,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.opensymphony.xwork2,56,,961,,,,,,,,,,,,,,,,,,,,,,,56,,,,,,,,,,,,,,,,,,,,,,,,,,,867,94
+com.rabbitmq.client,,21,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,7,
+com.sshtools.j2ssh.authentication,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.crypto.provider,19,,,,,17,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.jndi.ldap,4,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.net.httpserver,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.net.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.rowset,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.security.auth.module,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.security.ntlm,5,,,,,,3,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.sun.security.sasl.digest,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.thoughtworks.xstream,1,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.trilead.ssh2,13,,,,,2,4,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.unboundid.ldap.sdk,17,,,,,,,,,,,,,,,,,,,,,17,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+com.zaxxer.hikari,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+flexjson,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
+freemarker.cache,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,
+freemarker.template,7,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,7,,,,,,,,,,,,,,
+groovy.lang,26,,,,,,,,,,,,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+groovy.text,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+groovy.util,5,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+hudson,75,9,2648,,4,,,,,,3,2,,,,4,,,,,,,,,,,39,17,,,,,,,,,6,,,,,,,,,,,,,,5,4,2572,76
+io.jsonwebtoken,,2,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4,
+io.netty.bootstrap,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,
+io.netty.buffer,,,207,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,130,77
+io.netty.channel,9,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,2,,
+io.netty.handler.codec,4,13,259,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,3,,,,,,,,,,,,,,,13,143,116
+io.netty.handler.ssl,4,,,,,,,,,,,,,,,,,,,,,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,
+io.netty.handler.stream,1,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
+io.netty.resolver,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+io.netty.util,2,,23,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,1,,,,,,,,,,,,,,,,21,2
+io.undertow.server.handlers.resource,1,,3,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+jakarta.activation,2,,2,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,1,,,,,,,,,,,,,,,,2,
+jakarta.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,7,,
+jakarta.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
+jakarta.persistence,2,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,1,
+jakarta.servlet,2,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,26,,
+jakarta.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+jakarta.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
+jakarta.ws.rs.core,2,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,94,55
+jakarta.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
+java.applet,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,
+java.awt,1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,3
+java.beans,1,,177,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,82,95
+java.io,66,1,225,,,,,,,,,22,,,,,,,,,,,,,,,29,15,,,,,,,,,,,,,,,,,,,,,,,1,,202,23
+java.lang,38,3,790,,13,,,,,,1,,,,,,,,,,,,8,,,,2,9,,,4,,,1,,,,,,,,,,,,,,,,3,,,510,280
+java.math,,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9
+java.net,23,3,347,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,21,,,,,,,,,,,,,,,3,248,99
+java.nio,47,,499,,,,,,,,,5,,,,,,,,,,,,,,,25,16,,,,,,,,,1,,,,,,,,,,,,,,,,302,197
+java.rmi,,,68,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,45,23
+java.security,21,,583,,,11,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,285,298
+java.sql,15,1,292,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,9,,,,,,,,,,1,,,,274,18
+java.text,,,154,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,72,82
+java.time,,,131,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,27,104
+java.util,48,2,1340,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,,5,2,,1,2,,,,,,,,,,,,,,2,,,558,782
+javafx.scene.web,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+javax.accessibility,,,63,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,28,35
+javax.activation,2,,7,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,1,,,,,,,,,,,,,,,,7,
+javax.annotation.processing,,,28,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,3
+javax.crypto,19,,140,,,12,3,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,76,64
+javax.faces.context,4,7,,,,,,,,,,,,,,2,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,7,,
+javax.imageio,1,,304,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,138,166
+javax.jms,,9,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,57,
+javax.json,,,123,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,100,23
+javax.lang.model,,,277,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,217,60
+javax.management,2,,766,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,363,403
+javax.naming,7,,341,,,,,,,,,,,,,,,,,6,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,191,150
+javax.net,4,,136,,,,2,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,87,49
+javax.portlet,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,
+javax.print,2,,133,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,102,31
+javax.rmi.ssl,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6
+javax.script,1,,50,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,14,36
+javax.security.auth,7,,147,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,50,97
+javax.security.cert,,,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,
+javax.security.sasl,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,42,7
+javax.servlet,10,29,3,,,,,,,,,,,,,,1,,,,,,,,,,,2,,,,,,,,,,3,,,2,,2,,,,,,,,,29,3,
+javax.smartcardio,,,34,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,24,10
+javax.sound.midi,,,60,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,51,9
+javax.sound.sampled,,,90,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,53,37
+javax.sql,7,,126,,,,4,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,68,58
+javax.tools,,,66,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,62,4
+javax.transaction.xa,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+javax.validation,1,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
+javax.ws.rs.client,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+javax.ws.rs.container,,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,
+javax.ws.rs.core,3,,149,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,2,,,,,,,,,94,55
+javax.xml.bind.attachment,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,
+javax.xml.catalog,,,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,1
+javax.xml.crypto,,,269,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,172,97
+javax.xml.datatype,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,1
+javax.xml.namespace,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,10
+javax.xml.parsers,,,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35,2
+javax.xml.stream,,,221,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,201,20
+javax.xml.transform,2,,134,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,1,,,,,,,72,62
+javax.xml.validation,,,29,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,29,
+javax.xml.xpath,3,,26,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,26,
+jenkins,,,523,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,500,23
+jodd.json,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10
+kotlin,16,,1849,,,,,,,,,,,,,,,,,,,,,,,,11,3,,,,,,,,,2,,,,,,,,,,,,,,,,1836,13
+liquibase.database.jvm,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+liquibase.statement.core,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+net.lingala.zip4j,2,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,
+net.schmizz.sshj,4,,,,,,2,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+net.sf.json,2,,338,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,321,17
+net.sf.saxon.s9api,5,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,
+ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+okhttp3,4,,50,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,23,27
+org.acegisecurity,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,49,
+org.antlr.runtime,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.codec,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
+org.apache.commons.collections,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
+org.apache.commons.collections4,,,806,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,789
+org.apache.commons.compress.archivers.tar,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
+org.apache.commons.exec,10,,,,6,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.fileupload,,11,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,4,
+org.apache.commons.httpclient.util,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.commons.io,124,,570,,,,,,,,,4,,,,,,,,,,,,,,,102,3,,,,,,,,,15,,,,,,,,,,,,,,,,556,14
+org.apache.commons.jelly,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,
+org.apache.commons.jexl2,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.jexl3,15,,,,,,,,,,,,,,,,,,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.lang,1,,767,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,596,171
+org.apache.commons.lang3,7,,425,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,1,,,,,,,,,,,294,131
+org.apache.commons.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.net,13,12,,,,,2,2,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,6,,,,,,,,,,,,,,,12,,
+org.apache.commons.ognl,6,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.commons.text,,,272,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,220,52
+org.apache.cxf.catalog,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.apache.cxf.common.classloader,3,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+org.apache.cxf.common.jaxb,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.common.logging,6,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.configuration.jsse,2,,,,,,,,,,,,,,1,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.helpers,10,,,,,,,,,,,,,,,,,,,,,,,,,,5,,,,,,,,,,,,,,,,,,5,,,,,,,,,
+org.apache.cxf.resource,9,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,5,,,,,,,,,,,,,,,,,
+org.apache.cxf.staxutils,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.tools.corba.utils,4,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.tools.util,10,,,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.cxf.transform,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,
+org.apache.directory.ldap.client.api,1,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.hadoop.fs,3,,11,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,11,
+org.apache.hadoop.hive.metastore,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,,,,,,,,,,,,,,
+org.apache.hadoop.hive.ql.exec,1,,1,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.hadoop.hive.ql.metadata,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.hc.client5.http.async.methods,84,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,84,,,,,,,,,,,,,,,,,
+org.apache.hc.client5.http.classic.methods,37,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,37,,,,,,,,,,,,,,,,,
+org.apache.hc.client5.http.fluent,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,,,,
+org.apache.hc.core5.benchmark,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.apache.hc.core5.function,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.hc.core5.http,73,2,45,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,72,,,,,,,,,,,,,,,2,45,
+org.apache.hc.core5.net,,,18,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,
+org.apache.hc.core5.util,,,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,18,6
+org.apache.hive.hcatalog.templeton,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+org.apache.http,48,3,95,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,,,,,46,,,,,,,,,,,,,,,3,86,9
+org.apache.ibatis.jdbc,6,,57,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,57,
+org.apache.ibatis.mapping,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.log4j,11,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.logging.log4j,359,,8,,,,,,,,,,,,,,,,,,,,359,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,4
+org.apache.shiro.authc,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,
+org.apache.shiro.codec,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.shiro.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.shiro.mgt,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.sshd.client.session,3,,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.struts.beanvalidation.validation.interceptor,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
+org.apache.struts2,14,,3873,,,,,,,,,,,,,,,,,,,,,,,11,,,,,,,,,,,,,,,3,,,,,,,,,,,,3839,34
+org.apache.tools.ant,14,,,,1,,,,,,,,,,,,,,,,,,,,,,5,8,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.apache.tools.zip,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.apache.velocity.app,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,
+org.apache.velocity.runtime,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,
+org.codehaus.cargo.container.installer,3,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.codehaus.groovy.control,1,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.dom4j,20,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,20,,,,,,,,,
+org.eclipse.jetty.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+org.exolab.castor.xml,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+org.fusesource.leveldbjni,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.geogebra.web.full.main,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,
+org.gradle.api.file,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+org.hibernate,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,,,,,,,,,,,,,,,
+org.ho.yaml,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,,,,,
+org.influxdb,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.jabsorb,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,
+org.jboss.logging,324,,,,,,,,,,,,,,,,,,,,,,324,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.jboss.vfs,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.jdbi.v3.core,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,,,,,,,,,,,,,,,,
+org.jenkins.ui.icon,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48,1
+org.jenkins.ui.symbol,,,33,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,25,8
+org.jooq,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+org.json,,,236,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,198,38
+org.keycloak.models.map.storage,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,
+org.kohsuke.stapler,20,24,363,,,,,,,,,,,,,2,,,,,,,,,,,8,1,,,,,,,,,3,,,,,,1,5,,,,,,,,24,352,11
+org.lastaflute.web,,1,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,4,
+org.mvel2,16,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.openjdk.jmh.runner.options,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.owasp.esapi,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.pac4j.jwt.config.encryption,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.pac4j.jwt.config.signature,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.scijava.log,13,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.slf4j,55,,6,,,,,,,,,,,,,,,,,,,,55,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,4
+org.springframework.beans,,,30,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,30
+org.springframework.boot.jdbc,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
+org.springframework.cache,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13
+org.springframework.context,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+org.springframework.core.io,17,,6,,,,,,,,,,,,,,,,,,,,,,,,16,,,,,,,,,,1,,,,,,,,,,,,,,,,6,
+org.springframework.data.repository,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1
+org.springframework.http,14,,77,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,14,,,,,,,,,,,,,,,,67,10
+org.springframework.jdbc.core,19,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,19,,,,,,,,,,,,,,,
+org.springframework.jdbc.datasource,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,,,,,,,,,,,,,,,,
+org.springframework.jdbc.object,9,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,,,,,,,,,,,,,,,
+org.springframework.jndi,1,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.springframework.ldap,47,,,,,,,,,,,,,,,,,,,33,,14,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.springframework.security.core.userdetails,2,,,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+org.springframework.security.web.savedrequest,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,,
+org.springframework.ui,,,32,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,32
+org.springframework.util,10,,142,,,,,,,,,,,,,,,,,,,,,,,,9,1,,,,,,,,,,,,,,,,,,,,,,,,,90,52
+org.springframework.validation,,,13,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,
+org.springframework.web.client,13,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,13,,,,,,,,,,,,,,,3,,
+org.springframework.web.context.request,,8,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,,
+org.springframework.web.multipart,,12,12,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,12,12,
+org.springframework.web.portlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
+org.springframework.web.reactive.function.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+org.springframework.web.servlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
+org.springframework.web.socket,,8,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,6,
+org.springframework.web.util,,9,159,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,134,25
+org.thymeleaf,2,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,2,
+org.xml.sax,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+org.xmlpull.v1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,
+org.yaml.snakeyaml,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
+play.libs.ws,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
+play.mvc,1,13,24,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,13,24,
+ratpack.core.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+ratpack.core.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
+ratpack.core.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
+ratpack.exec,,,48,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,48
+ratpack.form,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,
+ratpack.func,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
+ratpack.handling,,6,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,4,
+ratpack.http,,10,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,10,10,
+ratpack.util,,,35,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,35
+retrofit2,1,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,1,
+software.amazon.awssdk.transfer.s3.model,8,,,,,,,,,,,,,,,,,,,,,,,,,,8,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.jvmstat.perfdata.monitor.protocol.local,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.jvmstat.perfdata.monitor.protocol.rmi,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.misc,3,,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.net.ftp,5,,,,,,2,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.net.www.protocol.http,3,,,,,,2,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.acl,1,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.jgss.krb5,2,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.krb5,9,,,,,3,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.pkcs,4,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.pkcs11,3,,,,,1,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.provider,2,,,,,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.ssl,3,,,,,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.security.x509,1,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
+sun.tools.jconsole,28,,,,,,13,15,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.file.model.yml

@@ -1,14 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#892d6997dcb65627560b04bd76c5a3dd97666cdf by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sinkModel
-    data:
-      - ["org.apache.avro.file", "DataFileReader", True, "openReader", "(File,DatumReader)", "", "Argument[0]", "path-injection", "ai-generated"]
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sourceModel
-    data:
-      - ["org.apache.avro.file", "DataFileReader12", True, "next", "(Object)", "", "ReturnValue", "file", "ai-generated"]
-      - ["org.apache.avro.file", "DataFileStream", True, "next", "(Object)", "", "ReturnValue", "file", "ai-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.generic.model.yml

@@ -1,9 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#892d6997dcb65627560b04bd76c5a3dd97666cdf by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sinkModel
-    data:
-      - ["org.apache.avro.generic", "GenericDatumReader", True, "read", "(Object,Decoder)", "", "Argument[1]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.generic", "GenericDatumReader", True, "read", "(Object,Schema,ResolvingDecoder)", "", "Argument[2]", "unsafe-deserialization", "ai-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.io.model.yml

@@ -1,8 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#d3072c20b9e38a9c0ceb11009eadfb2a8e420583 by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sinkModel
-    data:
-      - ["org.apache.avro.io", "DatumReader", True, "read", "(Object,Decoder)", "", "Argument[1]", "unsafe-deserialization", "ai-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.message.model.yml

@@ -1,19 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#892d6997dcb65627560b04bd76c5a3dd97666cdf by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sinkModel
-    data:
-      - ["org.apache.avro.message", "MessageDecoder", True, "decode", "(ByteBuffer)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder", True, "decode", "(ByteBuffer,Object)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder", True, "decode", "(InputStream)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder", True, "decode", "(InputStream,Object)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder", True, "decode", "(byte[])", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder", True, "decode", "(byte[],Object)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder$BaseDecoder", True, "decode", "(ByteBuffer)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder$BaseDecoder", True, "decode", "(ByteBuffer,Object)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder$BaseDecoder", True, "decode", "(InputStream)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder$BaseDecoder", True, "decode", "(byte[])", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "MessageDecoder$BaseDecoder", True, "decode", "(byte[],Object)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]
-      - ["org.apache.avro.message", "RawMessageDecoder", True, "decode", "(InputStream,Object)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.model.yml

@@ -1,16 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#892d6997dcb65627560b04bd76c5a3dd97666cdf by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sinkModel
-    data:
-      - ["org.apache.avro", "Protocol", True, "parse", "(File)", "", "Argument[0]", "path-injection", "ai-generated"]
-      - ["org.apache.avro", "SchemaParser", True, "parse", "(Path,Charset)", "", "Argument[0]", "path-injection", "ai-generated"]
-      - ["org.apache.avro", "SchemaParser", True, "parse", "(URI,Charset)", "", "Argument[0]", "request-forgery", "ai-generated"]
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sourceModel
-    data:
-      - ["org.apache.avro", "Protocol", True, "parse", "(File)", "", "ReturnValue", "file", "ai-generated"]
-      - ["org.apache.avro", "SchemaParser", True, "parse", "(Path,Charset)", "", "ReturnValue", "file", "ai-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.reflect.model.yml

@@ -1,8 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#892d6997dcb65627560b04bd76c5a3dd97666cdf by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sinkModel
-    data:
-      - ["org.apache.avro.reflect", "ReflectDatumReader", True, "read", "(Object,Schema,ResolvingDecoder)", "", "Argument[2]", "unsafe-deserialization", "ai-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.specific.model.yml

@@ -1,8 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#892d6997dcb65627560b04bd76c5a3dd97666cdf by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sinkModel
-    data:
-      - ["org.apache.avro.specific", "SpecificRecordBase", True, "readExternal", "(ObjectInput)", "", "Argument[0]", "unsafe-deserialization", "ai-generated"]

java/ql/lib/ext/generated/llmgenerator/org.apache.avro.util.model.yml

@@ -1,8 +0,0 @@
-# THIS FILE IS AN AUTO-GENERATED MODELS AS DATA FILE. DO NOT EDIT.
-# Generated from https://github.com/apache/avro.git#d3072c20b9e38a9c0ceb11009eadfb2a8e420583 by codeql-mads-via-llm
-extensions:
-  - addsTo:
-      pack: codeql/java-all
-      extensible: sourceModel
-    data:
-      - ["org.apache.avro.util", "RandomData", True, "main", "(String[])", "", "Argument[0]", "commandargs", "ai-generated"]

java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp

@@ -5,26 +5,37 @@
 <p>
 Deserializing untrusted data using any deserialization framework that
 allows the construction of arbitrary serializable objects is easily exploitable
-and in many cases allows an attacker to execute arbitrary code.  Even before a
+and in many cases allows an attacker to execute arbitrary code. Even before a
 deserialized object is returned to the caller of a deserialization method a lot
 of code may have been executed, including static initializers, constructors,
-and finalizers.  Automatic deserialization of fields means that an attacker may
+and finalizers. Automatic deserialization of fields means that an attacker may
 craft a nested combination of objects on which the executed initialization code
 may have unforeseen effects, such as the execution of arbitrary code.
 </p>
 <p>
-There are many different serialization frameworks.  This query currently
+There are many different serialization frameworks. This query currently
 supports Kryo, XmlDecoder, XStream, SnakeYaml, JYaml, JsonIO, YAMLBeans, HessianBurlap, Castor, Burlap,
 Jackson, Jabsorb, Jodd JSON, Flexjson, Gson, JMS, and Java IO serialization through
 <code>ObjectInputStream</code>/<code>ObjectOutputStream</code>.
 </p>
+<p>
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally not tracked by this query. For
+example, Apache Avro's deserialization methods follow a schema and are
+therefore generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution. However, care must be taken to ensure the schema
+strictly limits the allowed types. Permitting common standard library classes
+can still leave the application vulnerable to gadget-chain attacks.
+</p>
 </overview>
 
 <recommendation>
 <p>
-Avoid deserialization of untrusted data if at all possible.  If the
+Avoid deserialization of untrusted data if at all possible. If the
 architecture permits it then use other formats instead of serialized objects,
-for example JSON or XML.  However, these formats should not be deserialized
+for example JSON or XML. However, these formats should not be deserialized
 into complex objects because this provides further opportunities for attack.
 For example, XML-based deserialization attacks
 are possible through libraries such as XStream and XmlDecoder.
@@ -43,7 +54,7 @@ Recommendations specific to particular frameworks supported by this query:
         <li><b>Recommendation</b>: Call <code>com.alibaba.fastjson.parser.ParserConfig#setSafeMode</code> with the argument <code>true</code> before deserializing untrusted data.</li>
     </ul>
 <p></p>
-<p><b>FasterXML</b> -  <code>com.fasterxml.jackson.core:jackson-databind</code></p>
+<p><b>FasterXML</b> - <code>com.fasterxml.jackson.core:jackson-databind</code></p>
     <ul>
         <li><b>Secure by Default</b>: Yes</li>
         <li><b>Recommendation</b>: Don't call <code>com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping</code> and don't annotate any object fields with <code>com.fasterxml.jackson.annotation.JsonTypeInfo</code> passing either the <code>CLASS</code> or <code>MINIMAL_CLASS</code> values to the annotation.
@@ -56,16 +67,16 @@ Recommendations specific to particular frameworks supported by this query:
         <li><b>Recommendation</b>: Don't call <code>com.esotericsoftware.kryo(5).Kryo#setRegistrationRequired</code> with the argument <code>false</code> on any <code>Kryo</code> instance that may deserialize untrusted data.</li>
     </ul>
 <p></p>
-<p><b>ObjectInputStream</b> -  <code>Java Standard Library</code></p>
+<p><b>ObjectInputStream</b> - <code>Java Standard Library</code></p>
     <ul>
         <li><b>Secure by Default</b>: No</li>
-        <li><b>Recommendation</b>: Use a validating input stream, such as  <code>org.apache.commons.io.serialization.ValidatingObjectInputStream</code>.</li>
+        <li><b>Recommendation</b>: Use a validating input stream, such as <code>org.apache.commons.io.serialization.ValidatingObjectInputStream</code>.</li>
     </ul>
 <p></p>
 <p><b>SnakeYAML</b> - <code>org.yaml:snakeyaml</code></p>
     <ul>
         <li><b>Secure by Default</b>: As of version 2.0.</li>
-        <li><b>Recommendation</b>: For versions before 2.0, pass an instance of <code>org.yaml.snakeyaml.constructor.SafeConstructor</code> to  <code>org.yaml.snakeyaml.Yaml</code>'s constructor before using it to deserialize untrusted data.</li>
+        <li><b>Recommendation</b>: For versions before 2.0, pass an instance of <code>org.yaml.snakeyaml.constructor.SafeConstructor</code> to <code>org.yaml.snakeyaml.Yaml</code>'s constructor before using it to deserialize untrusted data.</li>
     </ul>
 <p></p>
 <p><b>XML Decoder</b> - <code>Standard Java Library</code></p>

python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp

@@ -5,22 +5,32 @@
 <p>
 Deserializing untrusted data using any deserialization framework that
 allows the construction of arbitrary serializable objects is easily exploitable
-and in many cases allows an attacker to execute arbitrary code.  Even before a
+and in many cases allows an attacker to execute arbitrary code. Even before a
 deserialized object is returned to the caller of a deserialization method a lot
 of code may have been executed, including static initializers, constructors,
-and finalizers.  Automatic deserialization of fields means that an attacker may
+and finalizers. Automatic deserialization of fields means that an attacker may
 craft a nested combination of objects on which the executed initialization code
 may have unforeseen effects, such as the execution of arbitrary code.
 </p>
 <p>
-There are many different serialization frameworks.  This query currently
+There are many different serialization frameworks. This query currently
 supports Pickle, Marshal and Yaml.
 </p>
+<p>
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally not tracked by this query. Such
+frameworks are generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution. However, care must be taken to ensure the schema
+strictly limits the allowed types. Permitting common standard library classes
+can still leave the application vulnerable to gadget-chain attacks.
+</p>
 </overview>
 
 <recommendation>
 <p>
-Avoid deserialization of untrusted data if at all possible.  If the
+Avoid deserialization of untrusted data if at all possible. If the
 architecture permits it then use other formats instead of serialized objects,
 for example JSON.
 </p>

ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp

@@ -7,6 +7,16 @@ Deserializing untrusted data using any method that allows the construction of
 arbitrary objects is easily exploitable and, in many cases, allows an attacker
 to execute arbitrary code.
 </p>
+<p>
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes or objects. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally not tracked by this query. Such
+frameworks are generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution. However, care must be taken to ensure the schema
+strictly limits the allowed types. Permitting common standard library classes
+can still leave the application vulnerable to gadget-chain attacks.
+</p>
 </overview>
 
 <recommendation>
@@ -31,7 +41,7 @@ safely be used.
 If deserializing an untrusted XML document using the <code>ox</code> gem,
 do not use <code>parse_obj</code> and <code>load</code> using the non-default :object mode.
 Instead use the <code>load</code> method in the default mode or better explicitly set a safe
-mode such as :hash. 
+mode such as :hash.
 </p>
 
 <p>

shared/threat-models/ext/supported-threat-models.model.yml

@@ -4,4 +4,3 @@ extensions:
       extensible: threatModelConfiguration
     data:
       - ["default", true, -2147483648] # The "default" threat model is included by default
-      - ["local", true, 0]

shared/tree-sitter-extractor/src/extractor/mod.rs

@@ -479,13 +479,14 @@ impl<'a> Visitor<'a> {
         let (id, _, child_nodes) = self.stack.pop().expect("Vistor: empty stack");
         let loc = location_for(self, self.file_label, node);
         let loc_label = location_label(self.trap_writer, loc);
+        let type_name = TypeName {
+            kind: node.kind().to_owned(),
+            named: node.is_named(),
+        };
         let table = self
             .schema
-            .get(&TypeName {
-                kind: node.kind().to_owned(),
-                named: node.is_named(),
-            })
-            .unwrap();
+            .get(&type_name)
+            .unwrap_or_else(|| panic!("missing extractor schema entry for {type_name:?}"));
         let mut valid = true;
         let parent_info = match self.stack.last_mut() {
             Some(p) if !node.is_extra() => {

unified/AGENTS.md

@@ -5,6 +5,21 @@ This is a CodeQL extractor based on tree-sitter.
 ## Building
 To build the extractor, run `scripts/create-extractor-pack.sh`
 
+## Editing the Swift grammar
+The vendored tree-sitter-swift grammar lives at
+`extractor/tree-sitter-swift/`. After editing `grammar.js` (or any other
+grammar source), run `scripts/regenerate-grammar.sh` to:
+- regenerate `extractor/tree-sitter-swift/src/{parser.c, grammar.json,
+  node-types.json}` (and the `src/tree_sitter/*.h` headers) via
+  `tree-sitter generate`; and
+- refresh `extractor/tree-sitter-swift/node-types.yml`, the
+  human-readable companion to `src/node-types.json` produced by yeast's
+  `node_types_yaml` binary.
+
+`node-types.yml` is the recommended review surface for grammar changes —
+it shows the impact of a grammar tweak on the named node kinds, fields,
+and child types in a form much easier to read than the raw JSON.
+
 ## Testing
 - If you changed the extractor code, always rebuild it before running tests.
 

unified/extractor/tree-sitter-swift/grammar.js

@@ -84,18 +84,26 @@ if (tree_sitter_version_supports_emoji()) {
 
 module.exports = grammar({
   name: "swift",
+  supertypes: ($) => [
+    $.expression,
+    $.unannotated_type,
+    $.global_declaration,
+    $.type_level_declaration,
+    $.local_declaration,
+    $.protocol_member_declaration,
+  ],
   conflicts: ($) => [
     // @Type(... could either be an annotation constructor invocation or an annotated expression
     [$.attribute],
     [$._attribute_argument],
     // Is `foo { ... }` a constructor invocation or function invocation?
-    [$._simple_user_type, $._expression],
+    [$._simple_user_type, $.expression],
     // To support nested types A.B not being interpreted as `(navigation_expression ... (type_identifier)) (navigation_suffix)`
     [$.user_type],
     // How to tell the difference between Foo.bar(with:and:), and Foo.bar(with: smth, and: other)? You need GLR
     [$.value_argument],
     // { (foo, bar) ...
-    [$._expression, $.lambda_parameter],
+    [$.expression, $.lambda_parameter],
     [$._primary_expression, $.lambda_parameter],
     // (start: start, end: end)
     [$._tuple_type_item_identifier, $.tuple_expression],
@@ -105,10 +113,10 @@ module.exports = grammar({
     // `+(...)` is ambigously either "call the function produced by a reference to the operator `+`" or "use the unary
     // operator `+` on the result of the parenthetical expression."
     [$._additive_operator, $._prefix_unary_operator],
-    [$._referenceable_operator, $._prefix_unary_operator],
+    [$.referenceable_operator, $._prefix_unary_operator],
     // `{ [self, b, c] ...` could be a capture list or an array literal depending on what else happens.
-    [$.capture_list_item, $._expression],
-    [$.capture_list_item, $._expression, $._simple_user_type],
+    [$.capture_list_item, $.expression],
+    [$.capture_list_item, $.expression, $._simple_user_type],
     [$._primary_expression, $.capture_list_item],
     // a ? b : c () could be calling c(), or it could be calling a function that's produced by the result of
     // `(a ? b : c)`. We have a small hack to force it to be the former of these by intentionally introducing a
@@ -119,10 +127,10 @@ module.exports = grammar({
     // `if try foo { } ...` should award its braces to the `if`. In order to make this actually happen, we need to parse
     // all the options and pick the best one that doesn't error out.
     [$.try_expression, $._unary_expression],
-    [$.try_expression, $._expression],
+    [$.try_expression, $.expression],
     // await {expression} has the same special cases as `try`.
     [$.await_expression, $._unary_expression],
-    [$.await_expression, $._expression],
+    [$.await_expression, $.expression],
     // In a computed property, when you see an @attribute, it's not yet clear if that's going to be for a
     // locally-declared class or a getter / setter specifier.
     [
@@ -400,13 +408,15 @@ module.exports = grammar({
     type_annotation: ($) =>
       seq(":", field("type", $._possibly_implicitly_unwrapped_type)),
     _possibly_implicitly_unwrapped_type: ($) =>
-      seq($._type, optional(token.immediate("!"))),
-    _type: ($) =>
+      choice($.type, $.implicitly_unwrapped_type),
+    implicitly_unwrapped_type: ($) =>
+      seq($.type, token.immediate("!")),
+    type: ($) =>
       prec.right(
         PRECS.ty,
-        seq(optional($.type_modifiers), field("name", $._unannotated_type))
+        seq(field("modifiers", optional($.type_modifiers)), field("name", $.unannotated_type))
       ),
-    _unannotated_type: ($) =>
+    unannotated_type: ($) =>
       prec.right(
         PRECS.ty,
         choice(
@@ -450,7 +460,7 @@ module.exports = grammar({
         seq(
           optional($._tuple_type_item_identifier),
           optional($.parameter_modifiers),
-          field("type", $._type)
+          field("type", $.type)
         )
       ),
     _tuple_type_item_identifier: ($) =>
@@ -464,15 +474,15 @@ module.exports = grammar({
       ),
     function_type: ($) =>
       seq(
-        field("params", choice($.tuple_type, $._unannotated_type)),
+        field("params", choice($.tuple_type, $.unannotated_type)),
         optional($._async_keyword),
         optional(choice($.throws_clause, $.throws)),
         $._arrow_operator,
-        field("return_type", $._type)
+        field("return_type", $.type)
       ),
-    array_type: ($) => seq("[", field("element", $._type), "]"),
+    array_type: ($) => seq("[", field("element", $.type), "]"),
     dictionary_type: ($) =>
-      seq("[", field("key", $._type), ":", field("value", $._type), "]"),
+      seq("[", field("key", $.type), ":", field("value", $.type), "]"),
     optional_type: ($) =>
       prec.left(
         seq(
@@ -483,18 +493,18 @@ module.exports = grammar({
           repeat1(alias($._immediate_quest, "?"))
         )
       ),
-    metatype: ($) => seq($._unannotated_type, ".", choice("Type", "Protocol")),
+    metatype: ($) => seq($.unannotated_type, ".", choice("Type", "Protocol")),
     _quest: ($) => "?",
     _immediate_quest: ($) => token.immediate("?"),
-    opaque_type: ($) => prec.right(seq("some", $._unannotated_type)),
-    existential_type: ($) => prec.right(seq("any", $._unannotated_type)),
-    type_parameter_pack: ($) => prec.left(seq("each", $._unannotated_type)),
-    type_pack_expansion: ($) => prec.left(seq("repeat", $._unannotated_type)),
+    opaque_type: ($) => prec.right(seq("some", $.unannotated_type)),
+    existential_type: ($) => prec.right(seq("any", $.unannotated_type)),
+    type_parameter_pack: ($) => prec.left(seq("each", $.unannotated_type)),
+    type_pack_expansion: ($) => prec.left(seq("repeat", $.unannotated_type)),
     protocol_composition_type: ($) =>
       prec.left(
         seq(
-          $._unannotated_type,
-          repeat1(seq("&", prec.right($._unannotated_type)))
+          $.unannotated_type,
+          repeat1(seq("&", prec.right($.unannotated_type)))
         )
       ),
     suppressed_constraint: ($) =>
@@ -507,7 +517,7 @@ module.exports = grammar({
     ////////////////////////////////
     // Expressions - https://docs.swift.org/swift-book/ReferenceManual/Expressions.html
     ////////////////////////////////
-    _expression: ($) =>
+    expression: ($) =>
       prec(
         PRECS.expr,
         choice(
@@ -521,9 +531,11 @@ module.exports = grammar({
           $.assignment,
           $.value_parameter_pack,
           $.value_pack_expansion,
-          seq($._expression, alias($._immediate_quest, "?"))
+          $.optional_chain_marker
         )
       ),
+    optional_chain_marker: ($) =>
+      seq($.expression, alias($._immediate_quest, "?")),
     // Unary expressions
     _unary_expression: ($) =>
       choice(
@@ -544,7 +556,7 @@ module.exports = grammar({
       prec.left(
         PRECS.postfix_operations,
         seq(
-          field("target", $._expression),
+          field("target", $.expression),
           field("operation", $._postfix_unary_operator)
         )
       ),
@@ -562,10 +574,7 @@ module.exports = grammar({
     _parenthesized_type: ($) =>
       seq(
         "(",
-        field(
-          "element",
-          choice($.opaque_type, $.existential_type, $.dictionary_type)
-        ),
+        choice($.opaque_type, $.existential_type, $.dictionary_type),
         ")"
       ),
     navigation_expression: ($) =>
@@ -576,7 +585,7 @@ module.exports = grammar({
             "target",
             choice(
               $._navigable_type_expression,
-              $._expression,
+              $.expression,
               $._parenthesized_type
             )
           ),
@@ -590,7 +599,7 @@ module.exports = grammar({
         PRECS.range,
         seq(
           $._range_operator,
-          prec.right(PRECS.range_suffix, field("end", $._expression))
+          prec.right(PRECS.range_suffix, field("end", $.expression))
         )
       ),
     _range_operator: ($) =>
@@ -598,7 +607,7 @@ module.exports = grammar({
     open_end_range_expression: ($) =>
       prec.right(
         PRECS.range,
-        seq(field("start", $._expression), $._three_dot_operator)
+        seq(field("start", $.expression), $._three_dot_operator)
       ),
     prefix_expression: ($) =>
       prec.left(
@@ -608,8 +617,8 @@ module.exports = grammar({
           field(
             "target",
             choice(
-              $._expression,
-              alias(choice("async", "if", "switch"), $._expression)
+              $.expression,
+              alias(choice("async", "if", "switch"), $.expression)
             )
           )
         )
@@ -617,7 +626,7 @@ module.exports = grammar({
     as_expression: ($) =>
       prec.left(
         PRECS.as,
-        seq(field("expr", $._expression), $.as_operator, field("type", $._type))
+        seq(field("expr", $.expression), $.as_operator, field("type", $.type))
       ),
     selector_expression: ($) =>
       seq(
@@ -625,7 +634,7 @@ module.exports = grammar({
         "selector",
         "(",
         optional(choice("getter:", "setter:")),
-        $._expression,
+        $.expression,
         ")"
       ),
     // Binary expressions
@@ -647,25 +656,25 @@ module.exports = grammar({
       prec.left(
         PRECS.multiplication,
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $._multiplicative_operator),
-          field("rhs", $._expression)
+          field("rhs", $.expression)
         )
       ),
     additive_expression: ($) =>
       prec.left(
         PRECS.addition,
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $._additive_operator),
-          field("rhs", $._expression)
+          field("rhs", $.expression)
         )
       ),
     range_expression: ($) =>
       prec.right(
         PRECS.range,
         seq(
-          field("start", $._expression),
+          field("start", $.expression),
           field("op", $._range_operator),
           field("end", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -674,7 +683,7 @@ module.exports = grammar({
       prec.left(
         PRECS.infix_operations,
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $.custom_operator),
           field("rhs", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -683,7 +692,7 @@ module.exports = grammar({
       prec.right(
         PRECS.nil_coalescing,
         seq(
-          field("value", $._expression),
+          field("value", $.expression),
           $._nil_coalescing_operator,
           field("if_nil", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -692,15 +701,15 @@ module.exports = grammar({
       prec.left(
         PRECS.check,
         seq(
-          field("target", $._expression),
+          field("target", $.expression),
           field("op", $._is_operator),
-          field("type", $._type)
+          field("type", $.type)
         )
       ),
     comparison_expression: ($) =>
       prec.left(
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $._comparison_operator),
           field("rhs", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -709,7 +718,7 @@ module.exports = grammar({
       prec.left(
         PRECS.equality,
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $._equality_operator),
           field("rhs", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -718,7 +727,7 @@ module.exports = grammar({
       prec.left(
         PRECS.conjunction,
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $._conjunction_operator),
           field("rhs", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -727,7 +736,7 @@ module.exports = grammar({
       prec.left(
         PRECS.disjunction,
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $._disjunction_operator),
           field("rhs", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -735,7 +744,7 @@ module.exports = grammar({
     bitwise_operation: ($) =>
       prec.left(
         seq(
-          field("lhs", $._expression),
+          field("lhs", $.expression),
           field("op", $._bitwise_binary_operator),
           field("rhs", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -772,7 +781,7 @@ module.exports = grammar({
       seq("(", optional(sep1Opt($.value_argument, ",")), ")"),
     _fn_call_lambda_arguments: ($) =>
       sep1($.lambda_literal, seq(field("name", $.simple_identifier), ":")),
-    type_arguments: ($) => prec.left(seq("<", sep1Opt($._type, ","), ">")),
+    type_arguments: ($) => prec.left(seq("<", sep1Opt($.type, ","), ">")),
     value_arguments: ($) =>
       seq(
         choice(
@@ -800,7 +809,7 @@ module.exports = grammar({
             ),
             seq(
               optional(seq(field("name", $.value_argument_label), ":")),
-              field("value", $._expression)
+              field("value", $.expression)
             )
           )
         )
@@ -816,7 +825,7 @@ module.exports = grammar({
               // Prefer direct calls, e.g. `try foo()`, over indirect like `try a ? b() : c`. This allows us to have
               // left associativity for the direct calls, which is technically wrong but is the only way to resolve the
               // ambiguity of `if foo { ... }` in the correct direction.
-              prec.right(-2, $._expression),
+              prec.right(-2, $.expression),
               prec.left(0, $._binary_expression),
               prec.left(0, $.call_expression),
               // Similarly special case the ternary expression, where `try` may come earlier than it is actually needed.
@@ -838,7 +847,7 @@ module.exports = grammar({
             "expr",
             choice(
               // Prefer direct calls over indirect (same as with `try`).
-              prec.right(-2, $._expression),
+              prec.right(-2, $.expression),
               prec.left(0, $.call_expression),
               // Special case ternary to `await` the whole thing (same as with `try`).
               prec.dynamic(1, prec.left(-1, $.ternary_expression))
@@ -851,9 +860,9 @@ module.exports = grammar({
       prec.right(
         PRECS.ternary,
         seq(
-          field("condition", $._expression),
+          field("condition", $.expression),
           $._quest,
-          field("if_true", $._expression),
+          field("if_true", $.expression),
           ":",
           field("if_false", $._expr_hack_at_ternary_binary_suffix)
         )
@@ -862,13 +871,13 @@ module.exports = grammar({
       prec.left(
         PRECS.ternary_binary_suffix,
         choice(
-          $._expression,
+          $.expression,
           alias($.expr_hack_at_ternary_binary_call, $.call_expression)
         )
       ),
     expr_hack_at_ternary_binary_call: ($) =>
       seq(
-        $._expression,
+        $.expression,
         alias($.expr_hack_at_ternary_binary_call_suffix, $.call_suffix)
       ),
     expr_hack_at_ternary_binary_call_suffix: ($) =>
@@ -876,7 +885,7 @@ module.exports = grammar({
     call_expression: ($) =>
       prec(
         PRECS.call,
-        prec.dynamic(DYNAMIC_PRECS.call, seq($._expression, $.call_suffix))
+        prec.dynamic(DYNAMIC_PRECS.call, seq($.expression, $.call_suffix))
       ),
     macro_invocation: ($) =>
       prec(
@@ -904,7 +913,7 @@ module.exports = grammar({
         $.super_expression,
         $.try_expression,
         $.await_expression,
-        $._referenceable_operator,
+        $.referenceable_operator,
         $.key_path_expression,
         $.key_path_string_expression,
         prec.right(
@@ -920,7 +929,7 @@ module.exports = grammar({
           sep1Opt(
             seq(
               optional(seq(field("name", $.simple_identifier), ":")),
-              field("value", $._expression)
+              field("value", $.expression)
             ),
             ","
           ),
@@ -928,7 +937,7 @@ module.exports = grammar({
         )
       ),
     array_literal: ($) =>
-      seq("[", optional(sep1Opt(field("element", $._expression), ",")), "]"),
+      seq("[", optional(sep1Opt(field("element", $.expression), ",")), "]"),
     dictionary_literal: ($) =>
       seq(
         "[",
@@ -937,7 +946,7 @@ module.exports = grammar({
         "]"
       ),
     _dictionary_literal_item: ($) =>
-      seq(field("key", $._expression), ":", field("value", $._expression)),
+      seq(field("key", $.expression), ":", field("value", $.expression)),
     special_literal: ($) =>
       seq(
         $._hash_symbol,
@@ -956,7 +965,7 @@ module.exports = grammar({
         $._hash_symbol,
         choice("colorLiteral", "fileLiteral", "imageLiteral"),
         "(",
-        sep1Opt(seq($.simple_identifier, ":", $._expression), ","),
+        sep1Opt(seq($.simple_identifier, ":", $.expression), ","),
         ")"
       ),
     lambda_literal: ($) =>
@@ -985,7 +994,7 @@ module.exports = grammar({
           seq(
             optional($.ownership_modifier),
             field("name", $.simple_identifier),
-            optional(seq($._equal_sign, field("value", $._expression)))
+            optional(seq($._equal_sign, field("value", $.expression)))
           )
         )
       ),
@@ -1033,17 +1042,17 @@ module.exports = grammar({
         PRECS["if"],
         seq(
           "if",
-          sep1(field("condition", $._if_condition_sequence_item), ","),
+          sep1(field("condition", $.if_condition), ","),
           $._block,
           optional(seq($["else"], $._else_options))
         )
       ),
-    _if_condition_sequence_item: ($) =>
-      choice($._if_let_binding, $._expression, $.availability_condition),
-    _if_let_binding: ($) =>
+    if_condition: ($) =>
+      choice($.if_let_binding, $.expression, $.availability_condition),
+    if_let_binding: ($) =>
       seq(
         $._direct_or_indirect_binding,
-        optional(seq($._equal_sign, $._expression)),
+        optional(seq($._equal_sign, $.expression)),
         optional($.where_clause)
       ),
     guard_statement: ($) =>
@@ -1051,7 +1060,7 @@ module.exports = grammar({
         PRECS["if"],
         seq(
           "guard",
-          sep1(field("condition", $._if_condition_sequence_item), ","),
+          sep1(field("condition", $.if_condition), ","),
           $["else"],
           $._block
         )
@@ -1061,7 +1070,7 @@ module.exports = grammar({
         PRECS["switch"],
         seq(
           "switch",
-          field("expr", $._expression),
+          field("expr", $.expression),
           "{",
           repeat($.switch_entry),
           "}"
@@ -1075,7 +1084,7 @@ module.exports = grammar({
             "case",
             seq(
               $.switch_pattern,
-              optional(seq($.where_keyword, $._expression))
+              optional(seq($.where_keyword, $.expression))
             ),
             repeat(seq(",", $.switch_pattern))
           ),
@@ -1095,7 +1104,7 @@ module.exports = grammar({
         optional($.where_clause),
         $._block
       ),
-    where_clause: ($) => prec.left(seq($.where_keyword, $._expression)),
+    where_clause: ($) => prec.left(seq($.where_keyword, $.expression)),
     key_path_expression: ($) =>
       prec.right(
         PRECS.keypath,
@@ -1108,7 +1117,7 @@ module.exports = grammar({
         )
       ),
     key_path_string_expression: ($) =>
-      prec.left(seq($._hash_symbol, "keyPath", "(", $._expression, ")")),
+      prec.left(seq($._hash_symbol, "keyPath", "(", $.expression, ")")),
     _key_path_component: ($) =>
       prec.left(
         choice(
@@ -1164,7 +1173,7 @@ module.exports = grammar({
       ),
     _bitwise_binary_operator: ($) => choice("&", "|", "^", "<<", ">>"),
     _postfix_unary_operator: ($) => choice("++", "--", $.bang),
-    directly_assignable_expression: ($) => $._expression,
+    directly_assignable_expression: ($) => $.expression,
 
     ////////////////////////////////
     // Statements - https://docs.swift.org/swift-book/ReferenceManual/Statements.html
@@ -1180,15 +1189,15 @@ module.exports = grammar({
       ),
     _local_statement: ($) =>
       choice(
-        $._expression,
-        $._local_declaration,
+        $.expression,
+        $.local_declaration,
         $._labeled_statement,
         $.control_transfer_statement
       ),
     _top_level_statement: ($) =>
       choice(
-        $._expression,
-        $._global_declaration,
+        $.expression,
+        $.global_declaration,
         $._labeled_statement,
         $._throw_statement
       ),
@@ -1227,15 +1236,15 @@ module.exports = grammar({
       // the opposite, though, since function calls may contain trailing code blocks, which are undesirable here.
       //
       // To fix that, we simply undo the special casing by defining our own `await_expression`.
-      choice($._expression, alias($.for_statement_await, $.await_expression)),
-    for_statement_await: ($) => seq($._await_operator, $._expression),
+      choice($.expression, alias($.for_statement_await, $.await_expression)),
+    for_statement_await: ($) => seq($._await_operator, $.expression),
 
     while_statement: ($) =>
       prec(
         PRECS.loop,
         seq(
           "while",
-          sep1(field("condition", $._if_condition_sequence_item), ","),
+          sep1(field("condition", $.if_condition), ","),
           "{",
           optional($.statements),
           "}"
@@ -1252,7 +1261,7 @@ module.exports = grammar({
           // Make sure we make it to the `while` before assuming this is a parameter pack.
           repeat($._implicit_semi),
           "while",
-          sep1(field("condition", $._if_condition_sequence_item), ",")
+          sep1(field("condition", $.if_condition), ",")
         )
       ),
     control_transfer_statement: ($) =>
@@ -1262,11 +1271,11 @@ module.exports = grammar({
           PRECS.control_transfer,
           seq(
             $._optionally_valueful_control_keyword,
-            field("result", optional($._expression))
+            field("result", optional($.expression))
           )
         )
       ),
-    _throw_statement: ($) => seq($.throw_keyword, $._expression),
+    _throw_statement: ($) => seq($.throw_keyword, $.expression),
     throw_keyword: ($) => "throw",
     _optionally_valueful_control_keyword: ($) =>
       choice("return", "continue", "break", "yield"),
@@ -1276,13 +1285,13 @@ module.exports = grammar({
         seq(
           field("target", $.directly_assignable_expression),
           field("operator", $._assignment_and_operator),
-          field("result", $._expression)
+          field("result", $.expression)
         )
       ),
     value_parameter_pack: ($) =>
-      prec.left(PRECS.parameter_pack, seq("each", $._expression)),
+      prec.left(PRECS.parameter_pack, seq("each", $.expression)),
     value_pack_expansion: ($) =>
-      prec.left(PRECS.parameter_pack, seq("repeat", $._expression)),
+      prec.left(PRECS.parameter_pack, seq("repeat", $.expression)),
     availability_condition: ($) =>
       seq(
         $._hash_symbol,
@@ -1296,7 +1305,7 @@ module.exports = grammar({
     ////////////////////////////////
     // Declarations - https://docs.swift.org/swift-book/ReferenceManual/Declarations.html
     ////////////////////////////////
-    _global_declaration: ($) =>
+    global_declaration: ($) =>
       choice(
         $.import_declaration,
         $.property_declaration,
@@ -1310,7 +1319,7 @@ module.exports = grammar({
         $.associatedtype_declaration,
         $.macro_declaration
       ),
-    _type_level_declaration: ($) =>
+    type_level_declaration: ($) =>
       choice(
         $.import_declaration,
         $.property_declaration,
@@ -1325,7 +1334,7 @@ module.exports = grammar({
         $.precedence_group_declaration,
         $.associatedtype_declaration
       ),
-    _local_declaration: ($) =>
+    local_declaration: ($) =>
       choice(
         alias($._local_property_declaration, $.property_declaration),
         alias($._local_typealias_declaration, $.typealias_declaration),
@@ -1412,12 +1421,12 @@ module.exports = grammar({
         1,
         seq(
           $._equal_sign,
-          field("value", $._expression),
+          field("value", $.expression),
           $.willset_didset_block
         )
       ),
     _expression_without_willset_didset: ($) =>
-      seq($._equal_sign, field("value", $._expression)),
+      seq($._equal_sign, field("value", $.expression)),
     willset_didset_block: ($) =>
       choice(
         seq("{", $.willset_clause, optional($.didset_clause), "}"),
@@ -1445,7 +1454,7 @@ module.exports = grammar({
         field("name", alias($.simple_identifier, $.type_identifier)),
         optional($.type_parameters),
         $._equal_sign,
-        field("value", $._type)
+        field("value", $.type)
       ),
     function_declaration: ($) =>
       prec.right(
@@ -1495,12 +1504,12 @@ module.exports = grammar({
     _macro_signature: ($) =>
       seq(
         $._function_value_parameters,
-        optional(seq($._arrow_operator, $._unannotated_type))
+        optional(seq($._arrow_operator, $.unannotated_type))
       ),
     macro_definition: ($) =>
       seq(
         $._equal_sign,
-        field("body", choice($._expression, $.external_macro_definition))
+        field("body", choice($.expression, $.external_macro_definition))
       ),
 
     external_macro_definition: ($) =>
@@ -1521,7 +1530,7 @@ module.exports = grammar({
           ),
           seq(
             field("declaration_kind", "extension"),
-            field("name", $._unannotated_type),
+            field("name", $.unannotated_type),
             optional($.type_parameters),
             optional(seq(":", $._inheritance_specifiers)),
             optional($.type_constraints),
@@ -1561,7 +1570,7 @@ module.exports = grammar({
       seq(
         optional($.type_parameter_modifiers),
         $._type_parameter_possibly_packed,
-        optional(seq(":", $._type))
+        optional(seq(":", $.type))
       ),
     _type_parameter_possibly_packed: ($) =>
       choice(
@@ -1585,20 +1594,18 @@ module.exports = grammar({
         repeat($.attribute),
         field("constrained_type", $._constrained_type),
         choice($._equal_sign, $._eq_eq),
-        field("must_equal", $._type)
+        field("must_equal", $.type)
       ),
-    _constrained_type: ($) =>
-      choice(
-        $.identifier,
-        seq(
-          $._unannotated_type,
-          optional(seq(".", sep1($.simple_identifier, ".")))
-        )
+    _constrained_type: ($) => choice($.identifier, $.nested_type_identifier),
+    nested_type_identifier: ($) =>
+      seq(
+        $.unannotated_type,
+        optional(seq(".", sep1($.simple_identifier, ".")))
       ),
     _class_member_separator: ($) => choice($._semi, $.multiline_comment),
     _class_member_declarations: ($) =>
       seq(
-        sep1($._type_level_declaration, $._class_member_separator),
+        sep1($.type_level_declaration, $._class_member_separator),
         optional($._class_member_separator)
       ),
     _function_value_parameters: ($) =>
@@ -1609,7 +1616,7 @@ module.exports = grammar({
       seq(
         optional($.attribute),
         $.parameter,
-        optional(seq($._equal_sign, field("default_value", $._expression)))
+        optional(seq($._equal_sign, field("default_value", $.expression)))
       ),
     parameter: ($) =>
       seq(
@@ -1623,16 +1630,15 @@ module.exports = grammar({
     _non_constructor_function_decl: ($) =>
       seq(
         "func",
-        field("name", choice($.simple_identifier, $._referenceable_operator))
+        field("name", choice($.simple_identifier, $.referenceable_operator))
       ),
-    _referenceable_operator: ($) =>
+    referenceable_operator: ($) =>
       choice(
         $.custom_operator,
         $._comparison_operator,
         $._additive_operator,
         $._multiplicative_operator,
         $._equality_operator,
-        $._comparison_operator,
         $._assignment_and_operator,
         "++",
         "--",
@@ -1665,9 +1671,9 @@ module.exports = grammar({
     _async_modifier: ($) => token("async"),
     throws: ($) => choice($._throws_keyword, $._rethrows_keyword),
     throws_clause: ($) =>
-      seq($._throws_keyword, "(", field("type", $._unannotated_type), ")"),
+      seq($._throws_keyword, "(", field("type", $.unannotated_type), ")"),
     enum_class_body: ($) =>
-      seq("{", repeat(choice($.enum_entry, $._type_level_declaration)), "}"),
+      seq("{", repeat(choice($.enum_entry, $.type_level_declaration)), "}"),
     enum_entry: ($) =>
       seq(
         optional($.modifiers),
@@ -1685,7 +1691,7 @@ module.exports = grammar({
     _enum_entry_suffix: ($) =>
       choice(
         field("data_contents", $.enum_type_parameters),
-        seq($._equal_sign, field("raw_value", $._expression))
+        seq($._equal_sign, field("raw_value", $.expression))
       ),
     enum_type_parameters: ($) =>
       seq(
@@ -1696,8 +1702,8 @@ module.exports = grammar({
               optional(
                 seq(optional($.wildcard_pattern), $.simple_identifier, ":")
               ),
-              $._type,
-              optional(seq($._equal_sign, $._expression))
+              $.type,
+              optional(seq($._equal_sign, $.expression))
             ),
             ","
           )
@@ -1719,16 +1725,10 @@ module.exports = grammar({
     protocol_body: ($) =>
       seq("{", optional($._protocol_member_declarations), "}"),
     _protocol_member_declarations: ($) =>
-      seq(sep1($._protocol_member_declaration, $._semi), optional($._semi)),
-    _protocol_member_declaration: ($) =>
+      seq(sep1($.protocol_member_declaration, $._semi), optional($._semi)),
+    protocol_member_declaration: ($) =>
       choice(
-        alias(
-          seq(
-            $._bodyless_function_declaration,
-            optional(field("body", $.function_body))
-          ),
-          $.protocol_function_declaration
-        ),
+        $.protocol_function_declaration,
         $.init_declaration,
         $.deinit_declaration,
         $.protocol_property_declaration,
@@ -1736,6 +1736,11 @@ module.exports = grammar({
         $.associatedtype_declaration,
         $.subscript_declaration
       ),
+    protocol_function_declaration: ($) =>
+      seq(
+        $._bodyless_function_declaration,
+        optional(field("body", $.function_body))
+      ),
     init_declaration: ($) =>
       prec.right(
         seq(
@@ -1804,7 +1809,7 @@ module.exports = grammar({
       seq(
         choice("prefix", "infix", "postfix"),
         "operator",
-        $._referenceable_operator,
+        $.referenceable_operator,
         optional(seq(":", $.simple_identifier)),
         optional($.deprecated_operator_declaration_body)
       ),
@@ -1831,9 +1836,9 @@ module.exports = grammar({
         optional($.modifiers),
         "associatedtype",
         field("name", alias($.simple_identifier, $.type_identifier)),
-        optional(seq(":", field("must_inherit", $._type))),
+        optional(seq(":", field("must_inherit", $.type))),
         optional($.type_constraints),
-        optional(seq($._equal_sign, field("default_value", $._type)))
+        optional(seq($._equal_sign, field("default_value", $.type)))
       ),
     ////////////////////////////////
     // Attributes - https://docs.swift.org/swift-book/ReferenceManual/Attributes.html
@@ -1848,9 +1853,9 @@ module.exports = grammar({
     _attribute_argument: ($) =>
       choice(
         // labeled function parameters, used in custom property wrappers
-        seq($.simple_identifier, ":", $._expression),
+        seq($.simple_identifier, ":", $.expression),
         // Unlabeled function parameters, simple identifiers, or `*`
-        $._expression,
+        $.expression,
         // References to param names (used in `@objc(foo:bar:)`)
         repeat1(seq($.simple_identifier, ":")),
         // Version restrictions (iOS 3.4.5, Swift 5.0.0)
@@ -1887,13 +1892,13 @@ module.exports = grammar({
         choice(
           $._universally_allowed_pattern,
           $._binding_pattern,
-          $._expression
+          $.expression
         ),
         optional($._quest)
       ),
     _non_binding_pattern_with_expr: ($) =>
       seq(
-        choice($._universally_allowed_pattern, $._expression),
+        choice($._universally_allowed_pattern, $.expression),
         optional($._quest)
       ),
     _direct_or_indirect_binding: ($) =>
@@ -1932,8 +1937,8 @@ module.exports = grammar({
       ),
     _type_casting_pattern: ($) =>
       choice(
-        seq("is", $._type),
-        seq(alias($._binding_pattern_no_expr, $.pattern), $._as, $._type)
+        seq("is", $.type),
+        seq(alias($._binding_pattern_no_expr, $.pattern), $._as, $.type)
       ),
     _binding_pattern: ($) =>
       seq(

unified/extractor/tree-sitter-swift/node-types.yml

@@ -0,0 +1,728 @@
+supertypes:
+  expression:
+    - additive_expression
+    - array_literal
+    - as_expression
+    - assignment
+    - await_expression
+    - bin_literal
+    - bitwise_operation
+    - boolean_literal
+    - call_expression
+    - check_expression
+    - comparison_expression
+    - conjunction_expression
+    - constructor_expression
+    - diagnostic
+    - dictionary_literal
+    - directive
+    - disjunction_expression
+    - equality_expression
+    - fully_open_range
+    - hex_literal
+    - if_statement
+    - infix_expression
+    - integer_literal
+    - key_path_expression
+    - key_path_string_expression
+    - lambda_literal
+    - line_string_literal
+    - macro_invocation
+    - multi_line_string_literal
+    - multiplicative_expression
+    - navigation_expression
+    - "nil"
+    - nil_coalescing_expression
+    - oct_literal
+    - open_end_range_expression
+    - open_start_range_expression
+    - optional_chain_marker
+    - playground_literal
+    - postfix_expression
+    - prefix_expression
+    - range_expression
+    - raw_string_literal
+    - real_literal
+    - referenceable_operator
+    - regex_literal
+    - selector_expression
+    - self_expression
+    - simple_identifier
+    - special_literal
+    - super_expression
+    - switch_statement
+    - ternary_expression
+    - try_expression
+    - tuple_expression
+    - value_pack_expansion
+    - value_parameter_pack
+  global_declaration:
+    - associatedtype_declaration
+    - class_declaration
+    - function_declaration
+    - import_declaration
+    - init_declaration
+    - macro_declaration
+    - operator_declaration
+    - precedence_group_declaration
+    - property_declaration
+    - protocol_declaration
+    - typealias_declaration
+  local_declaration:
+    - class_declaration
+    - function_declaration
+    - property_declaration
+    - typealias_declaration
+  protocol_member_declaration:
+    - associatedtype_declaration
+    - deinit_declaration
+    - init_declaration
+    - protocol_function_declaration
+    - protocol_property_declaration
+    - subscript_declaration
+    - typealias_declaration
+  type_level_declaration:
+    - associatedtype_declaration
+    - class_declaration
+    - deinit_declaration
+    - function_declaration
+    - import_declaration
+    - init_declaration
+    - operator_declaration
+    - precedence_group_declaration
+    - property_declaration
+    - protocol_declaration
+    - subscript_declaration
+    - typealias_declaration
+  unannotated_type:
+    - array_type
+    - dictionary_type
+    - existential_type
+    - function_type
+    - metatype
+    - opaque_type
+    - optional_type
+    - protocol_composition_type
+    - suppressed_constraint
+    - tuple_type
+    - type_pack_expansion
+    - type_parameter_pack
+    - user_type
+
+named:
+  additive_expression:
+    lhs: expression
+    op: ["+", "-"]
+    rhs: expression
+  array_literal:
+    element*: expression
+  array_type:
+    element: type
+  as_expression:
+    $children: as_operator
+    expr: expression
+    type: type
+  as_operator:
+  assignment:
+    operator: ["%=", "*=", "+=", "-=", "/=", "="]
+    result: expression
+    target: directly_assignable_expression
+  associatedtype_declaration:
+    $children*: [modifiers, type_constraints]
+    default_value?: type
+    must_inherit?: type
+    name: type_identifier
+  attribute:
+    $children+: [expression, user_type]
+  availability_condition:
+    $children*: [identifier, integer_literal]
+  await_expression:
+    $children?: expression
+    expr?: expression
+  bang:
+  bin_literal:
+  bitwise_operation:
+    lhs: expression
+    op: ["&", "<<", ">>", "^", "|"]
+    rhs: expression
+  boolean_literal:
+  call_expression:
+    $children+: [call_suffix, expression]
+  call_suffix:
+    $children+: [lambda_literal, value_arguments]
+    name*: simple_identifier
+  capture_list:
+    $children+: capture_list_item
+  capture_list_item:
+    $children?: ownership_modifier
+    name: [self_expression, simple_identifier]
+    value?: expression
+  catch_block:
+    $children+: [catch_keyword, statements, where_clause]
+    error?: pattern
+  catch_keyword:
+  check_expression:
+    op: "is"
+    target: expression
+    type: type
+  class_body:
+    $children*: [multiline_comment, type_level_declaration]
+  class_declaration:
+    $children*: [attribute, inheritance_modifier, inheritance_specifier, modifiers, ownership_modifier, property_behavior_modifier, type_constraints, type_parameters]
+    body: [class_body, enum_class_body]
+    declaration_kind: ["actor", "class", "enum", "extension", "struct"]
+    name: [type_identifier, unannotated_type]
+  comment:
+  comparison_expression:
+    lhs: expression
+    op: ["<", "<=", ">", ">="]
+    rhs: expression
+  computed_getter:
+    $children+: [attribute, getter_specifier, statements]
+  computed_modify:
+    $children+: [attribute, modify_specifier, statements]
+  computed_property:
+    $children*: [computed_getter, computed_modify, computed_setter, statements]
+  computed_setter:
+    $children+: [attribute, setter_specifier, simple_identifier, statements]
+  conjunction_expression:
+    lhs: expression
+    op: "&&"
+    rhs: expression
+  constructor_expression:
+    $children: constructor_suffix
+    constructed_type: [array_type, dictionary_type, user_type]
+  constructor_suffix:
+    $children+: [lambda_literal, value_arguments]
+    name*: simple_identifier
+  control_transfer_statement:
+    $children*: [expression, throw_keyword]
+    result?: expression
+  custom_operator:
+  default_keyword:
+  deinit_declaration:
+    $children?: modifiers
+    body: function_body
+  deprecated_operator_declaration_body:
+    $children*: [bin_literal, boolean_literal, hex_literal, integer_literal, line_string_literal, multi_line_string_literal, oct_literal, raw_string_literal, real_literal, regex_literal, simple_identifier]
+  diagnostic:
+  dictionary_literal:
+    key*: expression
+    value*: expression
+  dictionary_type:
+    key: type
+    value: type
+  didset_clause:
+    $children*: [modifiers, simple_identifier, statements]
+  directive:
+    $children*: [boolean_literal, integer_literal, simple_identifier]
+  directly_assignable_expression:
+    $children: expression
+  disjunction_expression:
+    lhs: expression
+    op: "||"
+    rhs: expression
+  do_statement:
+    $children*: [catch_block, statements]
+  else:
+  enum_class_body:
+    $children*: [enum_entry, type_level_declaration]
+  enum_entry:
+    $children?: modifiers
+    data_contents*: enum_type_parameters
+    name+: simple_identifier
+    raw_value*: expression
+  enum_type_parameters:
+    $children*: [expression, type, wildcard_pattern]
+  equality_constraint:
+    $children*: attribute
+    constrained_type: [identifier, nested_type_identifier]
+    must_equal: type
+  equality_expression:
+    lhs: expression
+    op: ["!=", "!==", "==", "==="]
+    rhs: expression
+  existential_type:
+    $children: unannotated_type
+  external_macro_definition:
+    $children: value_arguments
+  for_statement:
+    $children*: [statements, try_operator, type_annotation, where_clause]
+    collection: expression
+    item: pattern
+  fully_open_range:
+  function_body:
+    $children?: statements
+  function_declaration:
+    $children*: [attribute, inheritance_modifier, modifiers, ownership_modifier, parameter, property_behavior_modifier, throws, throws_clause, type_constraints, type_parameters]
+    body: function_body
+    default_value*: expression
+    name: [referenceable_operator, simple_identifier]
+    return_type?: [implicitly_unwrapped_type, type]
+  function_modifier:
+  function_type:
+    $children?: [throws, throws_clause]
+    params: unannotated_type
+    return_type: type
+  getter_specifier:
+    $children*: [mutation_modifier, throws, throws_clause]
+  guard_statement:
+    $children+: [else, statements]
+    condition+: if_condition
+  hex_literal:
+  identifier:
+    $children+: simple_identifier
+  if_condition:
+    $children: [availability_condition, expression, if_let_binding]
+  if_let_binding:
+    $children*: [expression, pattern, type, type_annotation, user_type, value_binding_pattern, where_clause, wildcard_pattern]
+    bound_identifier?: simple_identifier
+  if_statement:
+    $children*: [else, if_statement, statements]
+    condition+: if_condition
+  implicitly_unwrapped_type:
+    $children: type
+  import_declaration:
+    $children+: [identifier, modifiers]
+  infix_expression:
+    lhs: expression
+    op: custom_operator
+    rhs: expression
+  inheritance_constraint:
+    $children*: attribute
+    constrained_type: [identifier, nested_type_identifier]
+    inherits_from: [implicitly_unwrapped_type, type]
+  inheritance_modifier:
+  inheritance_specifier:
+    inherits_from: [function_type, suppressed_constraint, user_type]
+  init_declaration:
+    $children*: [attribute, bang, modifiers, parameter, throws, throws_clause, type_constraints, type_parameters]
+    body?: function_body
+    default_value*: expression
+    name: "init"
+  integer_literal:
+  interpolated_expression:
+    $children?: type_modifiers
+    name?: value_argument_label
+    reference_specifier*: value_argument_label
+    value?: expression
+  key_path_expression:
+    $children*: [array_type, bang, dictionary_type, simple_identifier, type_arguments, type_identifier, value_argument]
+  key_path_string_expression:
+    $children: expression
+  lambda_function_type:
+    $children*: [lambda_function_type_parameters, throws, throws_clause]
+    return_type?: [implicitly_unwrapped_type, type]
+  lambda_function_type_parameters:
+    $children+: lambda_parameter
+  lambda_literal:
+    $children*: [attribute, statements]
+    captures?: capture_list
+    type?: lambda_function_type
+  lambda_parameter:
+    $children?: [parameter_modifiers, self_expression]
+    external_name?: simple_identifier
+    name?: simple_identifier
+    type?: [implicitly_unwrapped_type, type]
+  line_str_text:
+  line_string_literal:
+    interpolation*: interpolated_expression
+    text*: [line_str_text, str_escaped_char]
+  macro_declaration:
+    $children+: [attribute, modifiers, parameter, simple_identifier, type_constraints, type_parameters, unannotated_type]
+    default_value*: expression
+    definition?: macro_definition
+  macro_definition:
+    body: [expression, external_macro_definition]
+  macro_invocation:
+    $children+: [call_suffix, simple_identifier, type_parameters]
+  member_modifier:
+  metatype:
+    $children: unannotated_type
+  modifiers:
+    $children+: [attribute, function_modifier, inheritance_modifier, member_modifier, mutation_modifier, ownership_modifier, parameter_modifier, property_behavior_modifier, property_modifier, visibility_modifier]
+  modify_specifier:
+    $children?: mutation_modifier
+  multi_line_str_text:
+  multi_line_string_literal:
+    interpolation*: interpolated_expression
+    text*: ["\"", multi_line_str_text, str_escaped_char]
+  multiline_comment:
+  multiplicative_expression:
+    lhs: expression
+    op: ["%", "*", "/"]
+    rhs: expression
+  mutation_modifier:
+  navigation_expression:
+    suffix: navigation_suffix
+    target+: ["(", ")", array_type, dictionary_type, existential_type, expression, opaque_type, user_type]
+  navigation_suffix:
+    suffix: [integer_literal, simple_identifier]
+  nested_type_identifier:
+    $children+: [simple_identifier, unannotated_type]
+  nil_coalescing_expression:
+    if_nil: expression
+    value: expression
+  oct_literal:
+  opaque_type:
+    $children: unannotated_type
+  open_end_range_expression:
+    start: expression
+  open_start_range_expression:
+    end: expression
+  operator_declaration:
+    $children+: [deprecated_operator_declaration_body, referenceable_operator, simple_identifier]
+  optional_chain_marker:
+    $children: expression
+  optional_type:
+    wrapped: [array_type, dictionary_type, tuple_type, user_type]
+  ownership_modifier:
+  parameter:
+    $children?: parameter_modifiers
+    external_name?: simple_identifier
+    name: simple_identifier
+    type: [implicitly_unwrapped_type, type]
+  parameter_modifier:
+  parameter_modifiers:
+    $children+: parameter_modifier
+  pattern:
+    $children*: [expression, pattern, type, user_type, value_binding_pattern, wildcard_pattern]
+    bound_identifier?: simple_identifier
+  playground_literal:
+    $children+: expression
+  postfix_expression:
+    operation: ["++", "--", bang]
+    target: expression
+  precedence_group_attribute:
+    $children+: [boolean_literal, simple_identifier]
+  precedence_group_attributes:
+    $children+: precedence_group_attribute
+  precedence_group_declaration:
+    $children+: [precedence_group_attributes, simple_identifier]
+  prefix_expression:
+    operation: ["&", "+", "++", "-", "--", ".", bang, custom_operator, "~"]
+    target: expression
+  property_behavior_modifier:
+  property_declaration:
+    $children*: [attribute, inheritance_modifier, modifiers, ownership_modifier, property_behavior_modifier, type_annotation, type_constraints, value_binding_pattern, willset_didset_block]
+    computed_value*: computed_property
+    name+: pattern
+    value*: expression
+  property_modifier:
+  protocol_body:
+    $children*: protocol_member_declaration
+  protocol_composition_type:
+    $children+: unannotated_type
+  protocol_declaration:
+    $children*: [attribute, inheritance_specifier, modifiers, type_constraints, type_parameters]
+    body: protocol_body
+    declaration_kind: "protocol"
+    name: type_identifier
+  protocol_function_declaration:
+    $children*: [attribute, modifiers, parameter, throws, throws_clause, type_constraints, type_parameters]
+    body?: function_body
+    default_value*: expression
+    name: [referenceable_operator, simple_identifier]
+    return_type?: [implicitly_unwrapped_type, type]
+  protocol_property_declaration:
+    $children+: [modifiers, protocol_property_requirements, type_annotation, type_constraints]
+    name: pattern
+  protocol_property_requirements:
+    $children*: [getter_specifier, setter_specifier]
+  range_expression:
+    end: expression
+    op: ["...", "..<"]
+    start: expression
+  raw_str_continuing_indicator:
+  raw_str_end_part:
+  raw_str_interpolation:
+    $children: raw_str_interpolation_start
+    interpolation+: interpolated_expression
+  raw_str_interpolation_start:
+  raw_str_part:
+  raw_string_literal:
+    $children*: raw_str_continuing_indicator
+    interpolation*: raw_str_interpolation
+    text+: [raw_str_end_part, raw_str_part]
+  real_literal:
+  referenceable_operator:
+    $children?: [bang, custom_operator]
+  regex_literal:
+  repeat_while_statement:
+    $children?: statements
+    condition+: if_condition
+  selector_expression:
+    $children: expression
+  self_expression:
+  setter_specifier:
+    $children?: mutation_modifier
+  shebang_line:
+  simple_identifier:
+  source_file:
+    $children*: [do_statement, expression, for_statement, global_declaration, guard_statement, repeat_while_statement, shebang_line, statement_label, throw_keyword, while_statement]
+  special_literal:
+  statement_label:
+  statements:
+    $children+: [control_transfer_statement, do_statement, expression, for_statement, guard_statement, local_declaration, repeat_while_statement, statement_label, while_statement]
+  str_escaped_char:
+  subscript_declaration:
+    $children+: [attribute, computed_property, modifiers, parameter, type_constraints, type_parameters]
+    default_value*: expression
+    return_type?: [implicitly_unwrapped_type, type]
+  super_expression:
+  suppressed_constraint:
+    suppressed: type_identifier
+  switch_entry:
+    $children+: [default_keyword, expression, modifiers, statements, switch_pattern, where_keyword]
+  switch_pattern:
+    $children: pattern
+  switch_statement:
+    $children*: switch_entry
+    expr: expression
+  ternary_expression:
+    condition: expression
+    if_false: expression
+    if_true: expression
+  throw_keyword:
+  throws:
+  throws_clause:
+    type: unannotated_type
+  try_expression:
+    $children: try_operator
+    expr: expression
+  try_operator:
+  tuple_expression:
+    name*: simple_identifier
+    value+: expression
+  tuple_type:
+    $children?: tuple_type_item
+    element*: tuple_type_item
+  tuple_type_item:
+    $children*: [dictionary_type, existential_type, opaque_type, parameter_modifiers, wildcard_pattern]
+    name?: simple_identifier
+    type?: type
+  type:
+    modifiers?: type_modifiers
+    name: unannotated_type
+  type_annotation:
+    type: [implicitly_unwrapped_type, type]
+  type_arguments:
+    $children+: type
+  type_constraint:
+    $children: [equality_constraint, inheritance_constraint]
+  type_constraints:
+    $children+: [type_constraint, where_keyword]
+  type_identifier:
+  type_modifiers:
+    $children+: attribute
+  type_pack_expansion:
+    $children: unannotated_type
+  type_parameter:
+    $children+: [type, type_identifier, type_parameter_modifiers, type_parameter_pack]
+  type_parameter_modifiers:
+    $children+: attribute
+  type_parameter_pack:
+    $children: unannotated_type
+  type_parameters:
+    $children+: [type_constraints, type_parameter]
+  typealias_declaration:
+    $children*: [attribute, inheritance_modifier, modifiers, ownership_modifier, property_behavior_modifier, type_parameters]
+    name: type_identifier
+    value: type
+  user_type:
+    $children+: [type_arguments, type_identifier]
+  value_argument:
+    $children?: type_modifiers
+    name?: value_argument_label
+    reference_specifier*: value_argument_label
+    value?: expression
+  value_argument_label:
+    $children: simple_identifier
+  value_arguments:
+    $children*: value_argument
+  value_binding_pattern:
+    mutability: ["let", "var"]
+  value_pack_expansion:
+    $children: expression
+  value_parameter_pack:
+    $children: expression
+  visibility_modifier:
+  where_clause:
+    $children+: [expression, where_keyword]
+  where_keyword:
+  while_statement:
+    $children?: statements
+    condition+: if_condition
+  wildcard_pattern:
+  willset_clause:
+    $children*: [modifiers, simple_identifier, statements]
+  willset_didset_block:
+    $children+: [didset_clause, willset_clause]
+
+unnamed:
+  - "?"
+  - "!"
+  - "!="
+  - "!=="
+  - "\""
+  - "\"\"\""
+  - "#"
+  - "#else"
+  - "#elseif"
+  - "#endif"
+  - "#if"
+  - "%"
+  - "%="
+  - "&"
+  - "&&"
+  - "("
+  - ")"
+  - "*"
+  - "*="
+  - "+"
+  - "++"
+  - "+="
+  - ","
+  - "-"
+  - "--"
+  - "-="
+  - "->"
+  - "."
+  - "..."
+  - "..<"
+  - "/"
+  - "/="
+  - ":"
+  - ";"
+  - "<"
+  - "<<"
+  - "<="
+  - "="
+  - "=="
+  - "==="
+  - ">"
+  - ">="
+  - ">>"
+  - "?"
+  - "??"
+  - "@"
+  - "@autoclosure"
+  - "@escaping"
+  - "Protocol"
+  - "Type"
+  - "["
+  - "\\"
+  - "\\("
+  - "]"
+  - "^"
+  - "^{"
+  - "_modify"
+  - "actor"
+  - "any"
+  - "arch"
+  - "as"
+  - "as!"
+  - "as?"
+  - "associatedtype"
+  - "async"
+  - "available"
+  - "await"
+  - "borrowing"
+  - "break"
+  - "canImport"
+  - "case"
+  - "class"
+  - "colorLiteral"
+  - "column"
+  - "compiler"
+  - "consuming"
+  - "continue"
+  - "convenience"
+  - "deinit"
+  - "didSet"
+  - "distributed"
+  - "do"
+  - "dsohandle"
+  - "dynamic"
+  - "each"
+  - "enum"
+  - "extension"
+  - "externalMacro"
+  - "fallthrough"
+  - "false"
+  - "file"
+  - "fileID"
+  - "fileLiteral"
+  - "filePath"
+  - "fileprivate"
+  - "final"
+  - "for"
+  - "func"
+  - "function"
+  - "get"
+  - "getter:"
+  - "guard"
+  - "if"
+  - "imageLiteral"
+  - "import"
+  - "in"
+  - "indirect"
+  - "infix"
+  - "init"
+  - "inout"
+  - "internal"
+  - "is"
+  - "keyPath"
+  - "lazy"
+  - "let"
+  - "line"
+  - "macro"
+  - "mutating"
+  - "nil"
+  - "nonisolated"
+  - "nonmutating"
+  - "open"
+  - "operator"
+  - "optional"
+  - "os"
+  - "override"
+  - "package"
+  - "postfix"
+  - "precedencegroup"
+  - "prefix"
+  - "private"
+  - "protocol"
+  - "public"
+  - "repeat"
+  - "required"
+  - "return"
+  - "selector"
+  - "self"
+  - "set"
+  - "setter:"
+  - "some"
+  - "static"
+  - "struct"
+  - "subscript"
+  - "super"
+  - "swift"
+  - "switch"
+  - "targetEnvironment"
+  - "true"
+  - "try"
+  - "typealias"
+  - "u"
+  - "unavailable"
+  - "unowned"
+  - "unowned(safe)"
+  - "unowned(unsafe)"
+  - "var"
+  - "weak"
+  - "while"
+  - "willSet"
+  - "yield"
+  - "{"
+  - "|"
+  - "||"
+  - "}"
+  - "~"

unified/scripts/regenerate-grammar.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# Regenerate the vendored tree-sitter-swift parser tables from grammar.js,
+# then refresh the human-readable node-types.yml companion file.
+#
+# Run this after editing
+# unified/extractor/tree-sitter-swift/grammar.js so that:
+#   * src/parser.c, src/grammar.json, src/node-types.json (and the
+#     src/tree_sitter/*.h headers) reflect the current grammar; and
+#   * node-types.yml shows the same information in a form that's
+#     pleasant to review in PR diffs.
+#
+# Requirements: tree-sitter CLI on PATH, and a working cargo toolchain.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+SWIFT_DIR="extractor/tree-sitter-swift"
+
+(
+    cd "$SWIFT_DIR"
+    tree-sitter generate
+)
+
+# Build yeast's node_types_yaml binary and use it to convert the freshly
+# generated src/node-types.json into the human-readable node-types.yml.
+cargo run --release --quiet -p yeast --bin node_types_yaml -- \
+    --from-json "$SWIFT_DIR/src/node-types.json" > "$SWIFT_DIR/node-types.yml"
+
+echo "Regenerated $SWIFT_DIR/{src/parser.c,src/grammar.json,src/node-types.json,node-types.yml}"