Python: visit function parameter and return annotations in new CFG

The new (shared-CFG-based) Python control flow graph in `semmle.python.controlflow.internal.Cfg` previously did not emit CFG nodes for parameter type annotations (`def f(x: T): ...`) or for the return type annotation (`-> T`). The legacy CFG emitted both, and a small number of framework models rely on this: `LocalSources.qll`'s `annotatedInstance` walks the parameter annotation expression by way of its CFG node to track that a parameter receives an instance of the annotated class. After the dataflow flip to the new CFG/SSA this regression manifested as lost flows in any test exercising annotation-based parameter tracking: FastAPI `Depends()` receivers, Pydantic request bodies, Starlette `WebSocket`, the call-graph type-annotation test, and so on. Extend `FunctionDefExpr` to visit each annotation as a child of the function-def expression, in CPython evaluation order: positional parameter annotations, `*args` annotation, keyword-only parameter annotations, `**kwargs` annotation, then the return annotation. (Lambda expressions have no annotations in Python syntax, so `LambdaExpr` is unchanged.) PEP 695 type parameters remain out of scope; they belong to the inner annotation scope, not the enclosing CFG. Restored test results across `framework/aiohttp`, `framework/fastapi`, `framework/lxml`, the `CallGraph-type-annotations` test, and `CWE-022-PathInjection`. Two FastAPI list-comprehension MISSING markers become positive (`taint_test.py:41,55`). CPython CFG consistency remains clean. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Python: model exception edges for raise-prone expressions inside try/with
2026-06-23 21:57:01 +02:00 · 2026-06-22 13:47:04 +00:00 · 2026-06-22 13:46:51 +00:00 · 2026-06-22 13:46:43 +00:00 · 2026-06-22 13:38:40 +00:00 · 2026-06-22 13:38:30 +00:00
354 changed files with 11229 additions and 7125 deletions
--- a/go/ql/test/library-tests/semmle/go/concepts/LoggerCall/logrus.go
+++ b/go/ql/test/library-tests/semmle/go/concepts/LoggerCall/logrus.go
@@ -13,7 +13,7 @@ func logSomething(entry *logrus.Entry) {
 	entry.Traceln(text) // $ logger=text
 }

-func logrusCalls(selector int) {
+func logrusCalls() {
 	err := errors.New("Error")
 	var fields logrus.Fields = nil
 	var fn logrus.LogFunction = nil
@@ -27,15 +27,11 @@ func logrusCalls(selector int) {
 	tmp = logrus.WithFields(fields) // $ logger=fields
 	logSomething(tmp)

-	logrus.Error(text)      // $ logger=text
-	logrus.Infof(fmt, text) // $ logger=fmt logger=text
-	if selector == 0 {
-		logrus.Fatalf(fmt, text) // $ logger=fmt logger=text
-	} else if selector == 1 {
-		logrus.Panicln(text) // $ logger=text
-	} else if selector == 2 {
-		logrus.FatalFn(fn) // $ logger=fn
-	}
+	logrus.Error(text)       // $ logger=text
+	logrus.Fatalf(fmt, text) // $ logger=fmt logger=text
+	logrus.Panicln(text)     // $ logger=text
+	logrus.Infof(fmt, text)  // $ logger=fmt logger=text
+	logrus.FatalFn(fn)       // $ logger=fn

 	// components corresponding to the format specifier "%T" are not considered vulnerable
 	logrus.Infof("%s: found type %T", text, v)  // $ logger="%s: found type %T" logger=text type-logger=v
--- a/go/ql/test/library-tests/semmle/go/concepts/LoggerCall/main.go
+++ b/go/ql/test/library-tests/semmle/go/concepts/LoggerCall/main.go
@@ -8,6 +8,6 @@ var v []byte

 func main() {
 	glogTest(len(v))
-	stdlib(len(v))
+	stdlib()
 	slogTest()
 }
--- a/go/ql/test/library-tests/semmle/go/concepts/LoggerCall/stdlib.go
+++ b/go/ql/test/library-tests/semmle/go/concepts/LoggerCall/stdlib.go
@@ -4,69 +4,37 @@ import (
 	"log"
 )

-func stdlib(selector int) {
+func stdlib() {
 	var logger log.Logger
 	logger.SetPrefix("prefix: ")
-	switch selector {
-	case 0:
-		logger.Fatal(text) // $ logger=text
-	case 1:
-		logger.Fatalf(fmt, text) // $ logger=fmt logger=text
-	case 2:
-		logger.Fatalln(text) // $ logger=text
-	case 3:
-		logger.Panic(text) // $ logger=text
-	case 4:
-		logger.Panicf(fmt, text) // $ logger=fmt logger=text
-	case 5:
-		logger.Panicln(text) // $ logger=text
-	case 6:
-		logger.Print(text) // $ logger=text
-	case 7:
-		logger.Printf(fmt, text) // $ logger=fmt logger=text
-	case 8:
-		logger.Println(text) // $ logger=text
-	}
+	logger.Fatal(text)       // $ logger=text
+	logger.Fatalf(fmt, text) // $ logger=fmt logger=text
+	logger.Fatalln(text)     // $ logger=text
+	logger.Panic(text)       // $ logger=text
+	logger.Panicf(fmt, text) // $ logger=fmt logger=text
+	logger.Panicln(text)     // $ logger=text
+	logger.Print(text)       // $ logger=text
+	logger.Printf(fmt, text) // $ logger=fmt logger=text
+	logger.Println(text)     // $ logger=text

 	// components corresponding to the format specifier "%T" are not considered vulnerable
-	switch selector {
-	case 9:
-		logger.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 10:
-		logger.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 11:
-		logger.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	}
+	logger.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	logger.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	logger.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v

 	log.SetPrefix("prefix: ")
-	switch selector {
-	case 12:
-		log.Fatal(text) // $ logger=text
-	case 13:
-		log.Fatalf(fmt, text) // $ logger=fmt logger=text
-	case 14:
-		log.Fatalln(text) // $ logger=text
-	case 15:
-		log.Panic(text) // $ logger=text
-	case 16:
-		log.Panicf(fmt, text) // $ logger=fmt logger=text
-	case 17:
-		log.Panicln(text) // $ logger=text
-	case 18:
-		log.Print(text) // $ logger=text
-	case 19:
-		log.Printf(fmt, text) // $ logger=fmt logger=text
-	case 20:
-		log.Println(text) // $ logger=text
-	}
+	log.Fatal(text)       // $ logger=text
+	log.Fatalf(fmt, text) // $ logger=fmt logger=text
+	log.Fatalln(text)     // $ logger=text
+	log.Panic(text)       // $ logger=text
+	log.Panicf(fmt, text) // $ logger=fmt logger=text
+	log.Panicln(text)     // $ logger=text
+	log.Print(text)       // $ logger=text
+	log.Printf(fmt, text) // $ logger=fmt logger=text
+	log.Println(text)     // $ logger=text

 	// components corresponding to the format specifier "%T" are not considered vulnerable
-	switch selector {
-	case 21:
-		log.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 22:
-		log.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	case 23:
-		log.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
-	}
+	log.Fatalf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	log.Panicf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
+	log.Printf("%s: found type %T", text, v) // $ logger="%s: found type %T" logger=text type-logger=v
 }
--- a/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/ControlFlowNode_getASuccessor.expected
+++ b/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/ControlFlowNode_getASuccessor.expected
@@ -34,265 +34,6 @@
 | DuplicateSwitchCase.go:16:1:16:14 | function declaration | DuplicateSwitchCase.go:0:0:0:0 | exit |
 | DuplicateSwitchCase.go:16:6:16:9 | skip | DuplicateSwitchCase.go:16:1:16:14 | function declaration |
 | DuplicateSwitchCase.go:16:13:16:14 | skip | DuplicateSwitchCase.go:16:1:16:14 | exit |
-| epilogues.go:0:0:0:0 | entry | epilogues.go:3:1:3:12 | skip |
-| epilogues.go:3:1:3:12 | skip | epilogues.go:8:1:10:1 | skip |
-| epilogues.go:8:1:10:1 | skip | epilogues.go:12:21:12:23 | skip |
-| epilogues.go:12:1:14:1 | entry | epilogues.go:12:7:12:7 | argument corresponding to l |
-| epilogues.go:12:1:14:1 | function declaration | epilogues.go:16:20:16:27 | skip |
-| epilogues.go:12:7:12:7 | argument corresponding to l | epilogues.go:12:7:12:7 | initialization of l |
-| epilogues.go:12:7:12:7 | initialization of l | epilogues.go:12:25:12:27 | argument corresponding to msg |
-| epilogues.go:12:21:12:23 | skip | epilogues.go:12:1:14:1 | function declaration |
-| epilogues.go:12:25:12:27 | argument corresponding to msg | epilogues.go:12:25:12:27 | initialization of msg |
-| epilogues.go:12:25:12:27 | initialization of msg | epilogues.go:12:37:12:40 | argument corresponding to code |
-| epilogues.go:12:37:12:40 | argument corresponding to code | epilogues.go:12:37:12:40 | initialization of code |
-| epilogues.go:12:37:12:40 | initialization of code | epilogues.go:13:2:13:12 | selection of Println |
-| epilogues.go:13:2:13:12 | selection of Println | epilogues.go:13:14:13:14 | l |
-| epilogues.go:13:2:13:33 | call to Println | epilogues.go:12:1:14:1 | exit |
-| epilogues.go:13:14:13:14 | implicit dereference | epilogues.go:12:1:14:1 | exit |
-| epilogues.go:13:14:13:14 | implicit dereference | epilogues.go:13:14:13:21 | selection of prefix |
-| epilogues.go:13:14:13:14 | l | epilogues.go:13:14:13:14 | implicit dereference |
-| epilogues.go:13:14:13:21 | selection of prefix | epilogues.go:13:24:13:26 | msg |
-| epilogues.go:13:24:13:26 | msg | epilogues.go:13:29:13:32 | code |
-| epilogues.go:13:29:13:32 | code | epilogues.go:13:2:13:33 | call to Println |
-| epilogues.go:16:1:18:1 | entry | epilogues.go:16:7:16:7 | argument corresponding to l |
-| epilogues.go:16:1:18:1 | function declaration | epilogues.go:23:6:23:15 | skip |
-| epilogues.go:16:7:16:7 | argument corresponding to l | epilogues.go:16:7:16:7 | initialization of l |
-| epilogues.go:16:7:16:7 | initialization of l | epilogues.go:16:29:16:31 | argument corresponding to msg |
-| epilogues.go:16:20:16:27 | skip | epilogues.go:16:1:18:1 | function declaration |
-| epilogues.go:16:29:16:31 | argument corresponding to msg | epilogues.go:16:29:16:31 | initialization of msg |
-| epilogues.go:16:29:16:31 | initialization of msg | epilogues.go:17:2:17:12 | selection of Println |
-| epilogues.go:17:2:17:12 | selection of Println | epilogues.go:17:14:17:14 | l |
-| epilogues.go:17:2:17:27 | call to Println | epilogues.go:16:1:18:1 | exit |
-| epilogues.go:17:14:17:14 | l | epilogues.go:17:14:17:21 | selection of prefix |
-| epilogues.go:17:14:17:21 | selection of prefix | epilogues.go:17:24:17:26 | msg |
-| epilogues.go:17:24:17:26 | msg | epilogues.go:17:2:17:27 | call to Println |
-| epilogues.go:23:1:27:1 | entry | epilogues.go:24:5:24:5 | skip |
-| epilogues.go:23:1:27:1 | function declaration | epilogues.go:31:6:31:13 | skip |
-| epilogues.go:23:6:23:15 | skip | epilogues.go:23:1:27:1 | function declaration |
-| epilogues.go:24:5:24:5 | assignment to r | epilogues.go:24:21:24:21 | r |
-| epilogues.go:24:5:24:5 | skip | epilogues.go:24:10:24:16 | recover |
-| epilogues.go:24:10:24:16 | recover | epilogues.go:24:10:24:18 | call to recover |
-| epilogues.go:24:10:24:18 | call to recover | epilogues.go:24:5:24:5 | assignment to r |
-| epilogues.go:24:21:24:21 | r | epilogues.go:24:26:24:28 | nil |
-| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:23:1:27:1 | exit |
-| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:24:21:24:28 | ...!=... is false |
-| epilogues.go:24:21:24:28 | ...!=... | epilogues.go:24:21:24:28 | ...!=... is true |
-| epilogues.go:24:21:24:28 | ...!=... is false | epilogues.go:23:1:27:1 | exit |
-| epilogues.go:24:21:24:28 | ...!=... is true | epilogues.go:25:3:25:13 | selection of Println |
-| epilogues.go:24:26:24:28 | nil | epilogues.go:24:21:24:28 | ...!=... |
-| epilogues.go:25:3:25:13 | selection of Println | epilogues.go:25:15:25:26 | "recovered:" |
-| epilogues.go:25:3:25:30 | call to Println | epilogues.go:23:1:27:1 | exit |
-| epilogues.go:25:15:25:26 | "recovered:" | epilogues.go:25:29:25:29 | r |
-| epilogues.go:25:29:25:29 | r | epilogues.go:25:3:25:30 | call to Println |
-| epilogues.go:31:1:33:1 | entry | epilogues.go:31:15:31:15 | argument corresponding to x |
-| epilogues.go:31:1:33:1 | function declaration | epilogues.go:36:6:36:12 | skip |
-| epilogues.go:31:6:31:13 | skip | epilogues.go:31:1:33:1 | function declaration |
-| epilogues.go:31:15:31:15 | argument corresponding to x | epilogues.go:31:15:31:15 | initialization of x |
-| epilogues.go:31:15:31:15 | initialization of x | epilogues.go:32:9:32:9 | x |
-| epilogues.go:32:2:32:13 | return statement | epilogues.go:31:1:33:1 | exit |
-| epilogues.go:32:9:32:9 | x | epilogues.go:32:13:32:13 | 2 |
-| epilogues.go:32:9:32:13 | ...*... | epilogues.go:32:2:32:13 | return statement |
-| epilogues.go:32:13:32:13 | 2 | epilogues.go:32:9:32:13 | ...*... |
-| epilogues.go:36:1:38:1 | entry | epilogues.go:37:2:37:12 | selection of Println |
-| epilogues.go:36:1:38:1 | function declaration | epilogues.go:42:6:42:18 | skip |
-| epilogues.go:36:6:36:12 | skip | epilogues.go:36:1:38:1 | function declaration |
-| epilogues.go:37:2:37:12 | selection of Println | epilogues.go:37:14:37:19 | "void" |
-| epilogues.go:37:2:37:20 | call to Println | epilogues.go:36:1:38:1 | exit |
-| epilogues.go:37:14:37:19 | "void" | epilogues.go:37:2:37:20 | call to Println |
-| epilogues.go:42:1:48:1 | entry | epilogues.go:42:20:42:20 | argument corresponding to x |
-| epilogues.go:42:1:48:1 | function declaration | epilogues.go:51:6:51:21 | skip |
-| epilogues.go:42:6:42:18 | skip | epilogues.go:42:1:48:1 | function declaration |
-| epilogues.go:42:20:42:20 | argument corresponding to x | epilogues.go:42:20:42:20 | initialization of x |
-| epilogues.go:42:20:42:20 | initialization of x | epilogues.go:42:28:42:33 | zero value for result |
-| epilogues.go:42:28:42:33 | implicit read of result | epilogues.go:42:40:42:42 | implicit read of err |
-| epilogues.go:42:28:42:33 | initialization of result | epilogues.go:42:40:42:42 | zero value for err |
-| epilogues.go:42:28:42:33 | zero value for result | epilogues.go:42:28:42:33 | initialization of result |
-| epilogues.go:42:40:42:42 | implicit read of err | epilogues.go:42:1:48:1 | exit |
-| epilogues.go:42:40:42:42 | initialization of err | epilogues.go:43:5:43:5 | x |
-| epilogues.go:42:40:42:42 | zero value for err | epilogues.go:42:40:42:42 | initialization of err |
-| epilogues.go:43:5:43:5 | x | epilogues.go:43:9:43:9 | 0 |
-| epilogues.go:43:5:43:9 | ...<... | epilogues.go:43:5:43:9 | ...<... is false |
-| epilogues.go:43:5:43:9 | ...<... | epilogues.go:43:5:43:9 | ...<... is true |
-| epilogues.go:43:5:43:9 | ...<... is false | epilogues.go:47:9:47:9 | x |
-| epilogues.go:43:5:43:9 | ...<... is true | epilogues.go:44:3:44:8 | skip |
-| epilogues.go:43:9:43:9 | 0 | epilogues.go:43:5:43:9 | ...<... |
-| epilogues.go:44:3:44:8 | assignment to result | epilogues.go:45:3:45:8 | return statement |
-| epilogues.go:44:3:44:8 | skip | epilogues.go:44:13:44:13 | x |
-| epilogues.go:44:12:44:13 | -... | epilogues.go:44:3:44:8 | assignment to result |
-| epilogues.go:44:13:44:13 | x | epilogues.go:44:12:44:13 | -... |
-| epilogues.go:45:3:45:8 | return statement | epilogues.go:42:28:42:33 | implicit read of result |
-| epilogues.go:47:2:47:14 | return statement | epilogues.go:42:28:42:33 | implicit read of result |
-| epilogues.go:47:9:47:9 | implicit write of result | epilogues.go:47:12:47:14 | nil |
-| epilogues.go:47:9:47:9 | x | epilogues.go:47:9:47:9 | implicit write of result |
-| epilogues.go:47:12:47:14 | implicit write of err | epilogues.go:47:2:47:14 | return statement |
-| epilogues.go:47:12:47:14 | nil | epilogues.go:47:12:47:14 | implicit write of err |
-| epilogues.go:51:1:54:1 | entry | epilogues.go:51:23:51:23 | argument corresponding to x |
-| epilogues.go:51:1:54:1 | function declaration | epilogues.go:59:6:59:25 | skip |
-| epilogues.go:51:6:51:21 | skip | epilogues.go:51:1:54:1 | function declaration |
-| epilogues.go:51:23:51:23 | argument corresponding to x | epilogues.go:51:23:51:23 | initialization of x |
-| epilogues.go:51:23:51:23 | initialization of x | epilogues.go:51:31:51:31 | zero value for n |
-| epilogues.go:51:31:51:31 | implicit read of n | epilogues.go:51:1:54:1 | exit |
-| epilogues.go:51:31:51:31 | initialization of n | epilogues.go:52:2:52:2 | skip |
-| epilogues.go:51:31:51:31 | zero value for n | epilogues.go:51:31:51:31 | initialization of n |
-| epilogues.go:52:2:52:2 | assignment to n | epilogues.go:53:2:53:7 | return statement |
-| epilogues.go:52:2:52:2 | skip | epilogues.go:52:6:52:6 | x |
-| epilogues.go:52:6:52:6 | x | epilogues.go:52:10:52:10 | 1 |
-| epilogues.go:52:6:52:10 | ...+... | epilogues.go:52:2:52:2 | assignment to n |
-| epilogues.go:52:10:52:10 | 1 | epilogues.go:52:6:52:10 | ...+... |
-| epilogues.go:53:2:53:7 | return statement | epilogues.go:51:31:51:31 | implicit read of n |
-| epilogues.go:59:1:62:1 | entry | epilogues.go:59:27:59:27 | argument corresponding to l |
-| epilogues.go:59:1:62:1 | function declaration | epilogues.go:66:6:66:26 | skip |
-| epilogues.go:59:6:59:25 | skip | epilogues.go:59:1:62:1 | function declaration |
-| epilogues.go:59:27:59:27 | argument corresponding to l | epilogues.go:59:27:59:27 | initialization of l |
-| epilogues.go:59:27:59:27 | initialization of l | epilogues.go:59:41:59:45 | argument corresponding to items |
-| epilogues.go:59:41:59:45 | argument corresponding to items | epilogues.go:59:41:59:45 | initialization of items |
-| epilogues.go:59:41:59:45 | initialization of items | epilogues.go:60:8:60:8 | l |
-| epilogues.go:60:2:60:33 | defer statement | epilogues.go:61:2:61:12 | selection of Println |
-| epilogues.go:60:8:60:8 | l | epilogues.go:60:8:60:12 | selection of log |
-| epilogues.go:60:8:60:12 | selection of log | epilogues.go:60:14:60:20 | "count" |
-| epilogues.go:60:8:60:33 | call to log | epilogues.go:59:1:62:1 | exit |
-| epilogues.go:60:14:60:20 | "count" | epilogues.go:60:23:60:25 | len |
-| epilogues.go:60:23:60:25 | len | epilogues.go:60:27:60:31 | items |
-| epilogues.go:60:23:60:32 | call to len | epilogues.go:60:2:60:33 | defer statement |
-| epilogues.go:60:27:60:31 | items | epilogues.go:60:23:60:32 | call to len |
-| epilogues.go:61:2:61:12 | selection of Println | epilogues.go:61:14:61:25 | "processing" |
-| epilogues.go:61:2:61:38 | call to Println | epilogues.go:60:8:60:33 | call to log |
-| epilogues.go:61:14:61:25 | "processing" | epilogues.go:61:28:61:30 | len |
-| epilogues.go:61:28:61:30 | len | epilogues.go:61:32:61:36 | items |
-| epilogues.go:61:28:61:37 | call to len | epilogues.go:61:2:61:38 | call to Println |
-| epilogues.go:61:32:61:36 | items | epilogues.go:61:28:61:37 | call to len |
-| epilogues.go:66:1:71:1 | entry | epilogues.go:66:28:66:33 | argument corresponding to prefix |
-| epilogues.go:66:1:71:1 | function declaration | epilogues.go:77:6:77:20 | skip |
-| epilogues.go:66:6:66:26 | skip | epilogues.go:66:1:71:1 | function declaration |
-| epilogues.go:66:28:66:33 | argument corresponding to prefix | epilogues.go:66:28:66:33 | initialization of prefix |
-| epilogues.go:66:28:66:33 | initialization of prefix | epilogues.go:67:2:67:2 | skip |
-| epilogues.go:67:2:67:2 | assignment to l | epilogues.go:68:8:68:8 | l |
-| epilogues.go:67:2:67:2 | skip | epilogues.go:67:7:67:31 | struct literal |
-| epilogues.go:67:7:67:31 | struct literal | epilogues.go:67:25:67:30 | prefix |
-| epilogues.go:67:17:67:30 | init of key-value pair | epilogues.go:67:2:67:2 | assignment to l |
-| epilogues.go:67:25:67:30 | prefix | epilogues.go:67:17:67:30 | init of key-value pair |
-| epilogues.go:68:2:68:24 | defer statement | epilogues.go:69:10:69:10 | l |
-| epilogues.go:68:8:68:8 | l | epilogues.go:68:8:68:17 | selection of logValue |
-| epilogues.go:68:8:68:17 | selection of logValue | epilogues.go:68:19:68:23 | "bye" |
-| epilogues.go:68:8:68:24 | call to logValue | epilogues.go:66:1:71:1 | exit |
-| epilogues.go:68:19:68:23 | "bye" | epilogues.go:68:2:68:24 | defer statement |
-| epilogues.go:69:2:69:25 | defer statement | epilogues.go:70:2:70:12 | selection of Println |
-| epilogues.go:69:8:69:15 | selection of log | epilogues.go:69:17:69:21 | "ptr" |
-| epilogues.go:69:8:69:25 | call to log | epilogues.go:68:8:68:24 | call to logValue |
-| epilogues.go:69:9:69:10 | &... | epilogues.go:69:8:69:15 | selection of log |
-| epilogues.go:69:10:69:10 | l | epilogues.go:69:9:69:10 | &... |
-| epilogues.go:69:17:69:21 | "ptr" | epilogues.go:69:24:69:24 | 7 |
-| epilogues.go:69:24:69:24 | 7 | epilogues.go:69:2:69:25 | defer statement |
-| epilogues.go:70:2:70:12 | selection of Println | epilogues.go:70:14:70:19 | "body" |
-| epilogues.go:70:2:70:20 | call to Println | epilogues.go:69:8:69:25 | call to log |
-| epilogues.go:70:14:70:19 | "body" | epilogues.go:70:2:70:20 | call to Println |
-| epilogues.go:77:1:82:1 | entry | epilogues.go:77:22:77:22 | argument corresponding to x |
-| epilogues.go:77:1:82:1 | function declaration | epilogues.go:87:6:87:20 | skip |
-| epilogues.go:77:6:77:20 | skip | epilogues.go:77:1:82:1 | function declaration |
-| epilogues.go:77:22:77:22 | argument corresponding to x | epilogues.go:77:22:77:22 | initialization of x |
-| epilogues.go:77:22:77:22 | initialization of x | epilogues.go:78:8:80:2 | function literal |
-| epilogues.go:78:2:80:15 | defer statement | epilogues.go:81:2:81:12 | selection of Println |
-| epilogues.go:78:8:80:2 | entry | epilogues.go:78:13:78:17 | argument corresponding to label |
-| epilogues.go:78:8:80:2 | function literal | epilogues.go:80:4:80:9 | "done" |
-| epilogues.go:78:8:80:15 | function call | epilogues.go:77:1:82:1 | exit |
-| epilogues.go:78:13:78:17 | argument corresponding to label | epilogues.go:78:13:78:17 | initialization of label |
-| epilogues.go:78:13:78:17 | initialization of label | epilogues.go:78:27:78:27 | argument corresponding to n |
-| epilogues.go:78:27:78:27 | argument corresponding to n | epilogues.go:78:27:78:27 | initialization of n |
-| epilogues.go:78:27:78:27 | initialization of n | epilogues.go:79:3:79:13 | selection of Println |
-| epilogues.go:79:3:79:13 | selection of Println | epilogues.go:79:15:79:19 | label |
-| epilogues.go:79:3:79:23 | call to Println | epilogues.go:78:8:80:2 | exit |
-| epilogues.go:79:15:79:19 | label | epilogues.go:79:22:79:22 | n |
-| epilogues.go:79:22:79:22 | n | epilogues.go:79:3:79:23 | call to Println |
-| epilogues.go:80:4:80:9 | "done" | epilogues.go:80:12:80:12 | x |
-| epilogues.go:80:12:80:12 | x | epilogues.go:80:14:80:14 | 1 |
-| epilogues.go:80:12:80:14 | ...+... | epilogues.go:78:2:80:15 | defer statement |
-| epilogues.go:80:14:80:14 | 1 | epilogues.go:80:12:80:14 | ...+... |
-| epilogues.go:81:2:81:12 | selection of Println | epilogues.go:81:14:81:19 | "body" |
-| epilogues.go:81:2:81:23 | call to Println | epilogues.go:78:8:80:15 | function call |
-| epilogues.go:81:14:81:19 | "body" | epilogues.go:81:22:81:22 | x |
-| epilogues.go:81:22:81:22 | x | epilogues.go:81:2:81:23 | call to Println |
-| epilogues.go:87:1:98:1 | entry | epilogues.go:87:22:87:22 | argument corresponding to x |
-| epilogues.go:87:1:98:1 | function declaration | epilogues.go:102:6:102:24 | skip |
-| epilogues.go:87:6:87:20 | skip | epilogues.go:87:1:98:1 | function declaration |
-| epilogues.go:87:22:87:22 | argument corresponding to x | epilogues.go:87:22:87:22 | initialization of x |
-| epilogues.go:87:22:87:22 | initialization of x | epilogues.go:87:30:87:35 | zero value for result |
-| epilogues.go:87:30:87:35 | implicit read of result | epilogues.go:87:1:98:1 | exit |
-| epilogues.go:87:30:87:35 | initialization of result | epilogues.go:88:8:92:2 | function literal |
-| epilogues.go:87:30:87:35 | zero value for result | epilogues.go:87:30:87:35 | initialization of result |
-| epilogues.go:88:2:92:4 | defer statement | epilogues.go:93:5:93:5 | x |
-| epilogues.go:88:8:92:2 | entry | epilogues.go:89:6:89:6 | skip |
-| epilogues.go:88:8:92:2 | function literal | epilogues.go:88:2:92:4 | defer statement |
-| epilogues.go:88:8:92:4 | function call | epilogues.go:87:1:98:1 | exit |
-| epilogues.go:88:8:92:4 | function call | epilogues.go:87:30:87:35 | implicit read of result |
-| epilogues.go:89:6:89:6 | assignment to r | epilogues.go:89:22:89:22 | r |
-| epilogues.go:89:6:89:6 | skip | epilogues.go:89:11:89:17 | recover |
-| epilogues.go:89:11:89:17 | recover | epilogues.go:89:11:89:19 | call to recover |
-| epilogues.go:89:11:89:19 | call to recover | epilogues.go:89:6:89:6 | assignment to r |
-| epilogues.go:89:22:89:22 | r | epilogues.go:89:27:89:29 | nil |
-| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:88:8:92:2 | exit |
-| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:89:22:89:29 | ...!=... is false |
-| epilogues.go:89:22:89:29 | ...!=... | epilogues.go:89:22:89:29 | ...!=... is true |
-| epilogues.go:89:22:89:29 | ...!=... is false | epilogues.go:88:8:92:2 | exit |
-| epilogues.go:89:22:89:29 | ...!=... is true | epilogues.go:90:4:90:9 | skip |
-| epilogues.go:89:27:89:29 | nil | epilogues.go:89:22:89:29 | ...!=... |
-| epilogues.go:90:4:90:9 | assignment to result | epilogues.go:88:8:92:2 | exit |
-| epilogues.go:90:4:90:9 | skip | epilogues.go:90:13:90:14 | -... |
-| epilogues.go:90:13:90:14 | -... | epilogues.go:90:4:90:9 | assignment to result |
-| epilogues.go:93:5:93:5 | x | epilogues.go:93:9:93:9 | 0 |
-| epilogues.go:93:5:93:9 | ...<... | epilogues.go:93:5:93:9 | ...<... is false |
-| epilogues.go:93:5:93:9 | ...<... | epilogues.go:93:5:93:9 | ...<... is true |
-| epilogues.go:93:5:93:9 | ...<... is false | epilogues.go:96:2:96:7 | skip |
-| epilogues.go:93:5:93:9 | ...<... is true | epilogues.go:94:3:94:7 | panic |
-| epilogues.go:93:9:93:9 | 0 | epilogues.go:93:5:93:9 | ...<... |
-| epilogues.go:94:3:94:7 | panic | epilogues.go:94:9:94:13 | "neg" |
-| epilogues.go:94:3:94:14 | call to panic | epilogues.go:88:8:92:4 | function call |
-| epilogues.go:94:9:94:13 | "neg" | epilogues.go:94:3:94:14 | call to panic |
-| epilogues.go:96:2:96:7 | assignment to result | epilogues.go:97:9:97:14 | result |
-| epilogues.go:96:2:96:7 | skip | epilogues.go:96:11:96:11 | x |
-| epilogues.go:96:11:96:11 | x | epilogues.go:96:15:96:15 | x |
-| epilogues.go:96:11:96:15 | ...*... | epilogues.go:96:2:96:7 | assignment to result |
-| epilogues.go:96:15:96:15 | x | epilogues.go:96:11:96:15 | ...*... |
-| epilogues.go:97:2:97:14 | return statement | epilogues.go:88:8:92:4 | function call |
-| epilogues.go:97:9:97:14 | implicit write of result | epilogues.go:97:2:97:14 | return statement |
-| epilogues.go:97:9:97:14 | result | epilogues.go:97:9:97:14 | implicit write of result |
-| epilogues.go:102:1:110:1 | entry | epilogues.go:102:26:102:26 | argument corresponding to x |
-| epilogues.go:102:1:110:1 | function declaration | epilogues.go:115:6:115:22 | skip |
-| epilogues.go:102:6:102:24 | skip | epilogues.go:102:1:110:1 | function declaration |
-| epilogues.go:102:26:102:26 | argument corresponding to x | epilogues.go:102:26:102:26 | initialization of x |
-| epilogues.go:102:26:102:26 | initialization of x | epilogues.go:102:34:102:35 | zero value for ok |
-| epilogues.go:102:34:102:35 | implicit read of ok | epilogues.go:102:43:102:43 | implicit read of n |
-| epilogues.go:102:34:102:35 | initialization of ok | epilogues.go:102:43:102:43 | zero value for n |
-| epilogues.go:102:34:102:35 | zero value for ok | epilogues.go:102:34:102:35 | initialization of ok |
-| epilogues.go:102:43:102:43 | implicit read of n | epilogues.go:102:1:110:1 | exit |
-| epilogues.go:102:43:102:43 | initialization of n | epilogues.go:103:8:103:17 | epiRecover |
-| epilogues.go:102:43:102:43 | zero value for n | epilogues.go:102:43:102:43 | initialization of n |
-| epilogues.go:103:2:103:19 | defer statement | epilogues.go:104:5:104:5 | x |
-| epilogues.go:103:8:103:17 | epiRecover | epilogues.go:103:2:103:19 | defer statement |
-| epilogues.go:103:8:103:19 | call to epiRecover | epilogues.go:102:1:110:1 | exit |
-| epilogues.go:103:8:103:19 | call to epiRecover | epilogues.go:102:34:102:35 | implicit read of ok |
-| epilogues.go:104:5:104:5 | x | epilogues.go:104:10:104:10 | 0 |
-| epilogues.go:104:5:104:10 | ...==... | epilogues.go:104:5:104:10 | ...==... is false |
-| epilogues.go:104:5:104:10 | ...==... | epilogues.go:104:5:104:10 | ...==... is true |
-| epilogues.go:104:5:104:10 | ...==... is false | epilogues.go:107:2:107:2 | skip |
-| epilogues.go:104:5:104:10 | ...==... is true | epilogues.go:105:3:105:8 | return statement |
-| epilogues.go:104:10:104:10 | 0 | epilogues.go:104:5:104:10 | ...==... |
-| epilogues.go:105:3:105:8 | return statement | epilogues.go:103:8:103:19 | call to epiRecover |
-| epilogues.go:107:2:107:2 | assignment to n | epilogues.go:108:2:108:3 | skip |
-| epilogues.go:107:2:107:2 | skip | epilogues.go:107:6:107:6 | x |
-| epilogues.go:107:6:107:6 | x | epilogues.go:107:2:107:2 | assignment to n |
-| epilogues.go:108:2:108:3 | assignment to ok | epilogues.go:109:2:109:7 | return statement |
-| epilogues.go:108:2:108:3 | skip | epilogues.go:108:7:108:10 | true |
-| epilogues.go:108:7:108:10 | true | epilogues.go:108:2:108:3 | assignment to ok |
-| epilogues.go:109:2:109:7 | return statement | epilogues.go:103:8:103:19 | call to epiRecover |
-| epilogues.go:115:1:118:1 | entry | epilogues.go:116:8:116:17 | epiRecover |
-| epilogues.go:115:1:118:1 | function declaration | epilogues.go:0:0:0:0 | exit |
-| epilogues.go:115:6:115:22 | skip | epilogues.go:115:1:118:1 | function declaration |
-| epilogues.go:116:2:116:19 | defer statement | epilogues.go:117:2:117:6 | panic |
-| epilogues.go:116:8:116:17 | epiRecover | epilogues.go:116:2:116:19 | defer statement |
-| epilogues.go:116:8:116:19 | call to epiRecover | epilogues.go:115:1:118:1 | exit |
-| epilogues.go:117:2:117:6 | panic | epilogues.go:117:8:117:13 | "boom" |
-| epilogues.go:117:2:117:14 | call to panic | epilogues.go:116:8:116:19 | call to epiRecover |
-| epilogues.go:117:8:117:13 | "boom" | epilogues.go:117:2:117:14 | call to panic |
 | equalitytests.go:0:0:0:0 | entry | equalitytests.go:3:1:5:1 | skip |
 | equalitytests.go:3:1:5:1 | skip | equalitytests.go:7:1:9:1 | skip |
 | equalitytests.go:7:1:9:1 | skip | equalitytests.go:11:6:11:18 | skip |
--- a/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/NoretFunctions.expected
+++ b/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/NoretFunctions.expected
@@ -1,4 +1,3 @@
-| epilogues.go:115:6:115:22 | epiRecoverUnnamed | github.com/github/codeql-go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph.epiRecoverUnnamed |
 | file://:0:0:0:0 | Exit | os.Exit |
 | file://:0:0:0:0 | Fatal | log.Fatal |
 | file://:0:0:0:0 | Fatal | log.Logger.Fatal |
--- a/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/epilogues.go
+++ b/go/ql/test/library-tests/semmle/go/controlflow/ControlFlowGraph/epilogues.go
@@ -1,118 +0,0 @@
-package main
-
-import "fmt"
-
-// epiLogger has methods with both pointer and value receivers, used to check
-// that the receiver and arguments of a deferred call are evaluated at the
-// `defer` statement rather than in the function epilogue.
-type epiLogger struct {
-	prefix string
-}
-
-func (l *epiLogger) log(msg string, code int) {
-	fmt.Println(l.prefix, msg, code)
-}
-
-func (l epiLogger) logValue(msg string) {
-	fmt.Println(l.prefix, msg)
-}
-
-// epiRecover recovers from a panic. It is used as a deferred function so we can
-// check that control flow returns to the result-read nodes and the normal exit
-// node after recovering.
-func epiRecover() {
-	if r := recover(); r != nil {
-		fmt.Println("recovered:", r)
-	}
-}
-
-// epiPlain has no named result variable and a single `return` with a child
-// expression.
-func epiPlain(x int) int {
-	return x * 2
-}
-
-// epiVoid has no named result variable and no `return` statement at all.
-func epiVoid() {
-	fmt.Println("void")
-}
-
-// epiNamedMixed has named result variables and a mix of a bare `return` (no
-// child expressions) and a `return` with child expressions.
-func epiNamedMixed(x int) (result int, err error) {
-	if x < 0 {
-		result = -x
-		return
-	}
-	return x, nil
-}
-
-// epiNamedBareOnly has a named result variable and only a bare `return`.
-func epiNamedBareOnly(x int) (n int) {
-	n = x + 1
-	return
-}
-
-// epiDeferReceiverArgs has a deferred call with a (pointer) receiver and
-// arguments that are expressions, so we can check the receiver `l` and the
-// arguments `"count"` and `len(items)` are evaluated at the `defer` statement.
-func epiDeferReceiverArgs(l *epiLogger, items []int) {
-	defer l.log("count", len(items))
-	fmt.Println("processing", len(items))
-}
-
-// epiDeferValueReceiver has deferred calls with a value receiver and an
-// address-of receiver, both with arguments evaluated at the `defer` statement.
-func epiDeferValueReceiver(prefix string) {
-	l := epiLogger{prefix: prefix}
-	defer l.logValue("bye")
-	defer (&l).log("ptr", 7)
-	fmt.Println("body")
-}
-
-// epiDeferFuncLit has a deferred function literal with parameters, so we can
-// check that the arguments `"done"` and `x+1` are evaluated at the `defer`
-// statement and that control flow enters the function literal body when it is
-// invoked at the function epilogue.
-func epiDeferFuncLit(x int) {
-	defer func(label string, n int) {
-		fmt.Println(label, n)
-	}("done", x+1)
-	fmt.Println("body", x)
-}
-
-// epiRecoverNamed has a named result variable and a deferred closure containing
-// `recover()`. After recovering on the panic path, control flow should return
-// to the result-read nodes and the normal exit node.
-func epiRecoverNamed(x int) (result int) {
-	defer func() {
-		if r := recover(); r != nil {
-			result = -1
-		}
-	}()
-	if x < 0 {
-		panic("neg")
-	}
-	result = x * x
-	return result
-}
-
-// epiRecoverNamedBare has named result variables, a deferred function
-// containing `recover()`, and only bare `return` statements.
-func epiRecoverNamedBare(x int) (ok bool, n int) {
-	defer epiRecover()
-	if x == 0 {
-		return
-	}
-	n = x
-	ok = true
-	return
-}
-
-// epiRecoverUnnamed has no named result variables and a deferred function
-// containing `recover()`; after recovering, control flow should reach the
-// normal exit node directly (there are no result-read nodes).
-func epiRecoverUnnamed() {
-	defer epiRecover()
-	panic("boom")
-}
--- a/java/ql/integration-tests/java/buildless-maven-executable-war/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven-executable-war/buildless-fetches.expected
@@ -1,27 +1,27 @@
 https://repo.jenkins-ci.org/releases/org/jenkins-ci/main/jenkins-war/2.249/jenkins-war-2.249.war
-https://maven-central.storage-download.googleapis.com/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.jar
-https://maven-central.storage-download.googleapis.com/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
+https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
+https://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
+https://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
+https://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
+https://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
+https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
+https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
+https://repo.maven.apache.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
+https://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
+https://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
--- a/java/ql/integration-tests/java/buildless-maven-executable-war/settings.xml
+++ b/java/ql/integration-tests/java/buildless-maven-executable-war/settings.xml
@@ -1,10 +0,0 @@
-<settings>
-  <mirrors>
-    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
-    </mirror>
-  </mirrors>
-</settings>
--- a/java/ql/integration-tests/java/buildless-maven-executable-war/test.py
+++ b/java/ql/integration-tests/java/buildless-maven-executable-war/test.py
@@ -1,10 +1,7 @@
-import os.path
-
 def test(codeql, java, check_diagnostics_java):
    codeql.database.create(
        _env={
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS": "true",
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_CLASSPATH_FROM_BUILD_FILES": "true",
-            "LGTM_INDEX_MAVEN_SETTINGS_FILE": os.path.join(os.path.dirname(os.path.realpath(__file__)), "settings.xml")
        }
    )
--- a/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/buildless-fetches.expected
@@ -1,26 +1,26 @@
-https://maven-central.storage-download.googleapis.com/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.jar
-https://maven-central.storage-download.googleapis.com/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
+https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
+https://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
+https://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
+https://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
+https://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
+https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
+https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
+https://repo.maven.apache.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
+https://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
+https://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
--- a/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/home-dir-with-maven-settings/.m2/settings.xml
+++ b/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/home-dir-with-maven-settings/.m2/settings.xml
@@ -1,13 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <settings>
-    <mirrors>
-        <mirror>
-            <id>google-maven-central</id>
-            <name>GCS Maven Central mirror</name>
-            <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-            <mirrorOf>central</mirrorOf>
-        </mirror>
-    </mirrors>
    <profiles>
        <profile>
            <id>preexisting-profile</id>
--- a/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/settings-xml.expected
+++ b/java/ql/integration-tests/java/buildless-maven-existing-settings-xml/settings-xml.expected
@@ -1,13 +1,6 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <settings>
-    <mirrors>
-        <mirror>
-            <id>google-maven-central</id>
-            <name>GCS Maven Central mirror</name>
-            <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-            <mirrorOf>central</mirrorOf>
-        </mirror>
-    </mirrors>
+        
    <profiles>
                
        <profile>
--- a/java/ql/integration-tests/java/buildless-maven-mirrorof/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven-mirrorof/buildless-fetches.expected
@@ -1,26 +1,26 @@
-https://maven-central.storage-download.googleapis.com/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
+https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
+https://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
+https://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
+https://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
+https://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
+https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
+https://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
+https://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
+https://repo1.maven.org/maven2/junit/junit/4.11/junit-4.11.jar
+https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
--- a/java/ql/integration-tests/java/buildless-maven-mirrorof/maven-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven-mirrorof/maven-fetches.expected
@@ -73,6 +73,6 @@ Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferst
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/sonatype/oss/oss-parent/7/oss-parent-7.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/sonatype/oss/oss-parent/9/oss-parent-9.pom
 Downloaded from codeql-depgraph-plugin-repo: file://[dist-root]/java/tools/ferstl-depgraph-dependencies/org/sonatype/spice/spice-parent/17/spice-parent-17.pom
-Downloaded from GCS Maven Central mirror: https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.pom
-Downloaded from GCS Maven Central mirror: https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.pom
-Downloaded from GCS Maven Central mirror: https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-parent/1.3/hamcrest-parent-1.3.pom
+Downloaded from mirror-force-central: https://repo1.maven.org/maven2/junit/junit/4.11/junit-4.11.pom
+Downloaded from mirror-force-central: https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.pom
+Downloaded from mirror-force-central: https://repo1.maven.org/maven2/org/hamcrest/hamcrest-parent/1.3/hamcrest-parent-1.3.pom
--- a/java/ql/integration-tests/java/buildless-maven-mirrorof/settings-xml.expected
+++ b/java/ql/integration-tests/java/buildless-maven-mirrorof/settings-xml.expected
@@ -5,13 +5,13 @@
            
        <mirror>
                  
-            <id>google-maven-central</id>
+            <id>mirror-force-central</id>
                  
-            <name>GCS Maven Central mirror</name>
+            <name>Mirror Repository</name>
                  
-            <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
+            <url>https://repo1.maven.org/maven2</url>
                  
-            <mirrorOf>central,!codeql-depgraph-plugin-repo</mirrorOf>
+            <mirrorOf>*,!codeql-depgraph-plugin-repo</mirrorOf>
                
        </mirror>
          
--- a/java/ql/integration-tests/java/buildless-maven-mirrorof/settings.xml
+++ b/java/ql/integration-tests/java/buildless-maven-mirrorof/settings.xml
@@ -1,10 +1,10 @@
 <settings>
  <mirrors>
    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
+      <id>mirror-force-central</id>
+      <name>Mirror Repository</name>
+      <url>https://repo1.maven.org/maven2</url>
+      <mirrorOf>*</mirrorOf>
    </mirror>
  </mirrors>
 </settings>
--- a/java/ql/integration-tests/java/buildless-maven-multimodule/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven-multimodule/buildless-fetches.expected
@@ -1,27 +1,27 @@
-https://maven-central.storage-download.googleapis.com/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.jar
-https://maven-central.storage-download.googleapis.com/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
+https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
+https://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
+https://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
+https://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
+https://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
+https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
+https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
+https://repo.maven.apache.org/maven2/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar
+https://repo.maven.apache.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
+https://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
+https://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
--- a/java/ql/integration-tests/java/buildless-maven-multimodule/settings.xml
+++ b/java/ql/integration-tests/java/buildless-maven-multimodule/settings.xml
@@ -1,10 +0,0 @@
-<settings>
-  <mirrors>
-    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
-    </mirror>
-  </mirrors>
-</settings>
--- a/java/ql/integration-tests/java/buildless-maven-multimodule/test.py
+++ b/java/ql/integration-tests/java/buildless-maven-multimodule/test.py
@@ -1,10 +1,7 @@
-import os.path
-
 def test(codeql, java, check_diagnostics_java):
    codeql.database.create(
        _env={
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS": "true",
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_CLASSPATH_FROM_BUILD_FILES": "true",
-            "LGTM_INDEX_MAVEN_SETTINGS_FILE": os.path.join(os.path.dirname(os.path.realpath(__file__)), "settings.xml")
        }
    )
--- a/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/buildless-fetches.expected
@@ -1,5 +1,5 @@
-https://maven-central.storage-download.googleapis.com/maven2/com/blazegraph/junit-ext/2.1.4/junit-ext-2.1.4.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/greghaskins/spectrum/1.2.0/spectrum-1.2.0-tests.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/pyx4me/cldcunit/2.0.4/cldcunit-2.0.4.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.13.2/junit-4.13.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/9.9.9/junit-9.9.9.jar
+https://repo.maven.apache.org/maven2/com/blazegraph/junit-ext/2.1.4/junit-ext-2.1.4.jar
+https://repo.maven.apache.org/maven2/com/greghaskins/spectrum/1.2.0/spectrum-1.2.0-tests.jar
+https://repo.maven.apache.org/maven2/com/pyx4me/cldcunit/2.0.4/cldcunit-2.0.4.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
+https://repo1.maven.org/maven2/junit/junit/9.9.9/junit-9.9.9.jar
--- a/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/settings.xml
+++ b/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/settings.xml
@@ -1,10 +0,0 @@
-<settings>
-  <mirrors>
-    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
-    </mirror>
-  </mirrors>
-</settings>
--- a/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/test.py
+++ b/java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/test.py
@@ -1,7 +1,4 @@
-import os.path
-
 def test(codeql, java, check_diagnostics_java):
    codeql.database.create(
        build_mode="none",
-        _env={"LGTM_INDEX_MAVEN_SETTINGS_FILE": os.path.join(os.path.dirname(os.path.realpath(__file__)), "settings.xml")}
    )
--- a/java/ql/integration-tests/java/buildless-maven/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-maven/buildless-fetches.expected
@@ -1,26 +1,26 @@
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
+https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
+https://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
+https://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
+https://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
+https://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
+https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
+https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
+https://repo.maven.apache.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
+https://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
+https://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
--- a/java/ql/integration-tests/java/buildless-maven/settings-xml.expected
+++ b/java/ql/integration-tests/java/buildless-maven/settings-xml.expected
@@ -1,13 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <settings>
-    <mirrors>
-        <mirror>
-            <id>google-maven-central</id>
-            <name>GCS Maven Central mirror</name>
-            <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-            <mirrorOf>central</mirrorOf>
-        </mirror>
-    </mirrors>
    <profiles>
        <profile>
            <id>codeql-depgraph-plugin-repo</id>
--- a/java/ql/integration-tests/java/buildless-maven/settings.xml
+++ b/java/ql/integration-tests/java/buildless-maven/settings.xml
@@ -1,10 +0,0 @@
-<settings>
-  <mirrors>
-    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
-    </mirror>
-  </mirrors>
-</settings>
--- a/java/ql/integration-tests/java/buildless-maven/test.py
+++ b/java/ql/integration-tests/java/buildless-maven/test.py
@@ -4,7 +4,6 @@ import os.path
 def test(codeql, java, check_diagnostics_java):
    codeql.database.create(build_mode = "none",
        _env={
-            "_JAVA_OPTIONS": "-Duser.home=" + os.path.join(os.getcwd(), "empty-home"),
-            "LGTM_INDEX_MAVEN_SETTINGS_FILE": os.path.join(os.path.dirname(os.path.realpath(__file__)), "settings.xml")
+            "_JAVA_OPTIONS": "-Duser.home=" + os.path.join(os.getcwd(), "empty-home")
        }
    )
--- a/java/ql/integration-tests/java/buildless-proxy-maven/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-proxy-maven/buildless-fetches.expected
@@ -1,26 +1,26 @@
-https://maven-central.storage-download.googleapis.com/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.jar
-https://maven-central.storage-download.googleapis.com/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
+https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
+https://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
+https://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
+https://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
+https://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
+https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
+https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
+https://repo.maven.apache.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
+https://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
+https://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
--- a/java/ql/integration-tests/java/buildless-proxy-maven/settings.xml
+++ b/java/ql/integration-tests/java/buildless-proxy-maven/settings.xml
@@ -1,10 +0,0 @@
-<settings>
-  <mirrors>
-    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
-    </mirror>
-  </mirrors>
-</settings>
--- a/java/ql/integration-tests/java/buildless-proxy-maven/test.py
+++ b/java/ql/integration-tests/java/buildless-proxy-maven/test.py
@@ -1,10 +1,7 @@
-import os.path
-
 def test(codeql, java, codeql_mitm_proxy, check_diagnostics_java):
    codeql.database.create(
        _env={
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS": "true",
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_CLASSPATH_FROM_BUILD_FILES": "true",
-            "LGTM_INDEX_MAVEN_SETTINGS_FILE": os.path.join(os.path.dirname(os.path.realpath(__file__)), "settings.xml")
        }
    )
--- a/java/ql/integration-tests/java/buildless-sibling-projects/buildless-fetches.expected
+++ b/java/ql/integration-tests/java/buildless-sibling-projects/buildless-fetches.expected
@@ -1,28 +1,28 @@
 https://jcenter.bintray.com/junit/junit/4.12/junit-4.12.jar
 https://jcenter.bintray.com/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
 https://jcenter.bintray.com/org/slf4j/slf4j-api/1.7.21/slf4j-api-1.7.21.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.jar
-https://maven-central.storage-download.googleapis.com/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
-https://maven-central.storage-download.googleapis.com/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
+https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
+https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
+https://repo.maven.apache.org/maven2/com/intuit/benten/benten-examples/0.1.5/benten-examples-0.1.5.jar
+https://repo.maven.apache.org/maven2/com/jakewharton/twirl/sample-runtime/1.2.0/sample-runtime-1.2.0.jar
+https://repo.maven.apache.org/maven2/com/mattunderscore/code/generation/specky/plugin-example/0.8.0/plugin-example-0.8.0.jar
+https://repo.maven.apache.org/maven2/com/microsoft/tang/tang-test-jarAB/0.9/tang-test-jarAB-0.9.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/rx-redis-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
+https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
+https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
+https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-json/0.5.10/minijax-example-json-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-mustache/0.5.10/minijax-example-mustache-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-petclinic/0.5.10/minijax-example-petclinic-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-security/0.5.10/minijax-example-security-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-ssl/0.5.10/minijax-example-ssl-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-todo-backend/0.5.10/minijax-example-todo-backend-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/minijax/minijax-example-websocket/0.5.10/minijax-example-websocket-0.5.10.jar
+https://repo.maven.apache.org/maven2/org/scalamock/scalamock-examples_2.10/3.6.0/scalamock-examples_2.10-3.6.0.jar
+https://repo.maven.apache.org/maven2/org/somda/sdc/glue-examples/4.0.0/glue-examples-4.0.0.jar
+https://repo.maven.apache.org/maven2/us/fatehi/schemacrawler-examplecode/16.20.2/schemacrawler-examplecode-16.20.2.jar
--- a/java/ql/integration-tests/java/buildless-sibling-projects/settings.xml
+++ b/java/ql/integration-tests/java/buildless-sibling-projects/settings.xml
@@ -1,10 +0,0 @@
-<settings>
-  <mirrors>
-    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
-    </mirror>
-  </mirrors>
-</settings>
--- a/java/ql/integration-tests/java/buildless-sibling-projects/test.py
+++ b/java/ql/integration-tests/java/buildless-sibling-projects/test.py
@@ -1,5 +1,3 @@
-import os.path
-
 def test(codeql, use_java_11, java, actions_toolchains_file, check_diagnostics_java):
    # The version of gradle used doesn't work on java 17
    codeql.database.create(
@@ -7,6 +5,5 @@ def test(codeql, use_java_11, java, actions_toolchains_file, check_diagnostics_j
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS": "true",
            "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_CLASSPATH_FROM_BUILD_FILES": "true",
            "LGTM_INDEX_MAVEN_TOOLCHAINS_FILE": str(actions_toolchains_file),
-            "LGTM_INDEX_MAVEN_SETTINGS_FILE": os.path.join(os.path.dirname(os.path.realpath(__file__)), "settings.xml")
        }
    )
--- a/python/ql/consistency-queries/CfgConsistency.ql
+++ b/python/ql/consistency-queries/CfgConsistency.ql
@@ -0,0 +1,2 @@
+import semmle.python.controlflow.internal.AstNodeImpl
+import ControlFlow::Consistency
--- a/python/ql/consistency-queries/DataFlowConsistency.ql
+++ b/python/ql/consistency-queries/DataFlowConsistency.ql
@@ -9,6 +9,7 @@ private import semmle.python.dataflow.new.internal.DataFlowImplSpecific
 private import semmle.python.dataflow.new.internal.DataFlowDispatch
 private import semmle.python.dataflow.new.internal.TaintTrackingImplSpecific
 private import codeql.dataflow.internal.DataFlowImplConsistency
+private import semmle.python.controlflow.internal.Cfg as Cfg

 private module Input implements InputSig<Location, PythonDataFlow> {
  private import Private
@@ -74,7 +75,7 @@ private module Input implements InputSig<Location, PythonDataFlow> {
    // resolve to multiple functions), but we only make _one_ ArgumentNode for each
    // argument in the CallNode, we end up violating this consistency check in those
    // cases. (see `getCallArg` in DataFlowDispatch.qll)
-    exists(DataFlowCall other, CallNode cfgCall | other != call |
+    exists(DataFlowCall other, Cfg::CallNode cfgCall | other != call |
      call.getNode() = cfgCall and
      other.getNode() = cfgCall and
      isArgumentNode(arg, call, _) and
@@ -90,16 +91,16 @@ private module Input implements InputSig<Location, PythonDataFlow> {
      // allow it instead.
      (
        call.getScope() = attr.getScope() and
-        any(CfgNode n | n.asCfgNode() = call.getNode().(CallNode).getFunction()).getALocalSource() =
-          attr
+        any(CfgNode n | n.asCfgNode() = call.getNode().(Cfg::CallNode).getFunction())
+            .getALocalSource() = attr
        or
        not exists(call.getScope().(Function).getDefinition()) and
        call.getScope().getScope+() = attr.getScope()
      ) and
      (
        other.getScope() = attr.getScope() and
-        any(CfgNode n | n.asCfgNode() = other.getNode().(CallNode).getFunction()).getALocalSource() =
-          attr
+        any(CfgNode n | n.asCfgNode() = other.getNode().(Cfg::CallNode).getFunction())
+            .getALocalSource() = attr
        or
        not exists(other.getScope().(Function).getDefinition()) and
        other.getScope().getScope+() = attr.getScope()
--- a/python/ql/lib/change-notes/2026-05-19-add-shared-cfg.md
+++ b/python/ql/lib/change-notes/2026-05-19-add-shared-cfg.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* A new Python control flow graph implementation has been added under `semmle.python.controlflow.internal.Cfg` (backed by `AstNodeImpl.qll`), built on the shared `codeql.controlflow.ControlFlowGraph` library. It is not yet used by the dataflow library or any production query; the legacy CFG in `semmle/python/Flow.qll` remains the default. The new library is exposed for tests and for upcoming migrations.
--- a/python/ql/lib/change-notes/2026-05-19-add-shared-ssa.md
+++ b/python/ql/lib/change-notes/2026-05-19-add-shared-ssa.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* A new SSA adapter has been added under `semmle.python.dataflow.new.internal.SsaImpl`, built on the shared `codeql.ssa.Ssa` library and the new shared CFG (`semmle.python.controlflow.internal.Cfg`). It is not yet used by the dataflow library or any production query; the legacy ESSA SSA in `semmle/python/essa/*` remains the default. The new SSA adapter is exposed for tests and for the upcoming dataflow migration.
--- a/python/ql/lib/change-notes/2026-06-02-deprecated-flow-nodes-use-new-cfg.md
+++ b/python/ql/lib/change-notes/2026-06-02-deprecated-flow-nodes-use-new-cfg.md
@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The deprecated `AstNode.getAFlowNode()` and `Function.getAReturnValueFlowNode()` predicates now return nodes from the new shared CFG (`Cfg::ControlFlowNode`) rather than from the legacy CFG (`ControlFlowNode`). Callers that still rely on these deprecated APIs and feed the result into legacy-CFG-aware predicates will no longer type-check; migrate to `n.getNode() = e` (or, for return values, the explicit `Return` pattern shown in the deprecation message) to get nodes from the dataflow library's current CFG.
--- a/python/ql/lib/change-notes/2026-06-04-cfg-parameter-annotations.md
+++ b/python/ql/lib/change-notes/2026-06-04-cfg-parameter-annotations.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The new (shared-CFG-based) Python control flow graph now visits parameter and return type annotations as CFG nodes for function definitions, matching the legacy CFG. This restores annotation-based type tracking through framework models such as FastAPI's `Depends()`, Pydantic request models, Starlette `WebSocket` handlers, and any other models that flow a class reference through `Parameter.getAnnotation()` to identify instances of the annotated class.
--- a/python/ql/lib/printCfgNew.ql
+++ b/python/ql/lib/printCfgNew.ql
@@ -0,0 +1,45 @@
+/**
+ * @name Print CFG (New)
+ * @description Produces a representation of a file's Control Flow Graph
+ *              using the new shared control flow library.
+ *              This query is used by the VS Code extension.
+ * @id python/print-cfg
+ * @kind graph
+ * @tags ide-contextual-queries/print-cfg
+ */
+
+private import python as Py
+import semmle.python.controlflow.internal.AstNodeImpl
+
+external string selectedSourceFile();
+
+private predicate selectedSourceFileAlias = selectedSourceFile/0;
+
+external int selectedSourceLine();
+
+private predicate selectedSourceLineAlias = selectedSourceLine/0;
+
+external int selectedSourceColumn();
+
+private predicate selectedSourceColumnAlias = selectedSourceColumn/0;
+
+module ViewCfgQueryInput implements ControlFlow::ViewCfgQueryInputSig<Py::File> {
+  predicate selectedSourceFile = selectedSourceFileAlias/0;
+
+  predicate selectedSourceLine = selectedSourceLineAlias/0;
+
+  predicate selectedSourceColumn = selectedSourceColumnAlias/0;
+
+  predicate cfgScopeSpan(
+    Ast::Callable callable, Py::File file, int startLine, int startColumn, int endLine,
+    int endColumn
+  ) {
+    exists(Py::Scope scope |
+      scope = callable.asScope() and
+      file = scope.getLocation().getFile() and
+      scope.getLocation().hasLocationInfo(_, startLine, startColumn, endLine, endColumn)
+    )
+  }
+}
+
+import ControlFlow::ViewCfgQuery<Py::File, ViewCfgQueryInput>
--- a/python/ql/lib/semmle/python/ApiGraphs.qll
+++ b/python/ql/lib/semmle/python/ApiGraphs.qll
@@ -6,8 +6,9 @@
 * directed and labeled; they specify how the components represented by nodes relate to each other.
 */

-// Importing python under the `py` namespace to avoid importing `CallNode` from `Flow.qll` and thereby having a naming conflict with `API::CallNode`.
+// Importing python under the `PY` namespace to avoid pulling in `CallNode` from `Flow.qll` (via `import python`) and thereby having a naming conflict with `API::CallNode`.
 private import python as PY
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import semmle.python.dataflow.new.DataFlow
 private import semmle.python.internal.CachedStages

@@ -282,7 +283,7 @@ module API {
      index = this.getIndex() and
      (
        // subscripting
-        exists(PY::SubscriptNode subscript |
+        exists(Cfg::SubscriptNode subscript |
          subscript.getObject() = this.getAValueReachableFromSource().asCfgNode() and
          subscript.getIndex() = index.asSink().asCfgNode()
        |
@@ -290,7 +291,7 @@ module API {
          subscript = result.asSource().asCfgNode()
          or
          // writing
-          subscript.(PY::DefinitionNode).getValue() = result.asSink().asCfgNode()
+          subscript.(Cfg::DefinitionNode).getValue() = result.asSink().asCfgNode()
        )
        or
        // dictionary literals
@@ -684,7 +685,7 @@ module API {
     * Ignores relative imports, such as `from ..foo.bar import baz`.
     */
    private predicate imports(DataFlow::CfgNode imp, string name) {
-      exists(PY::ImportExprNode iexpr |
+      exists(Cfg::ImportExprNode iexpr |
        imp.getNode() = iexpr and
        not iexpr.getNode().isRelative() and
        name = iexpr.getNode().getImportedModuleName()
@@ -775,7 +776,7 @@ module API {
        // list literals, from `x` to `[x]`
        // TODO: once convenient, this should be done at a higher level than the AST,
        // at least at the CFG layer, to take splitting into account.
-        // Also consider `SequenceNode for generality.
+        // Also consider `Cfg::SequenceNode` for generality.
        exists(PY::List list | list = pred.(DataFlow::ExprNode).getNode().getNode() |
          rhs.(DataFlow::ExprNode).getNode().getNode() = list.getAnElt() and
          lbl = Label::subscript()
@@ -805,7 +806,7 @@ module API {
        subscript = trackUseNode(src).getSubscript(index)
      |
        // from `x` to a definition of `x[...]`
-        rhs.asCfgNode() = subscript.asCfgNode().(PY::DefinitionNode).getValue() and
+        rhs.asCfgNode() = subscript.asCfgNode().(Cfg::DefinitionNode).getValue() and
        lbl = Label::subscript()
        or
        // from `x` to `"key"` in `x["key"]`
--- a/python/ql/lib/semmle/python/AstExtended.qll
+++ b/python/ql/lib/semmle/python/AstExtended.qll
@@ -3,6 +3,7 @@ module;

 import python
 private import semmle.python.internal.CachedStages
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /** A syntactic node (Class, Function, Module, Expr, Stmt or Comprehension) corresponding to a flow node */
 abstract class AstNode extends AstNode_ {
@@ -19,17 +20,16 @@ abstract class AstNode extends AstNode_ {
  /**
   * DEPRECATED: use `ControlFlowNode.getNode()` from the other direction instead;
   * that is, replace `e.getAFlowNode() = n` with `n.getNode() = e`. This API is
-   * being removed to untangle the AST and CFG hierarchies in preparation for
-   * migrating the dataflow library off the legacy CFG.
+   * being removed to untangle the AST and CFG hierarchies.
   *
-   * Gets a flow node corresponding directly to this node.
-   * NOTE: For some statements and other purely syntactic elements,
-   * there may not be a `ControlFlowNode`.
+   * Gets a flow node corresponding directly to this node, from the new
+   * (shared) CFG. NOTE: For some statements and other purely syntactic
+   * elements, there may not be a `ControlFlowNode`.
   */
  cached
-  deprecated ControlFlowNode getAFlowNode() {
+  deprecated Cfg::ControlFlowNode getAFlowNode() {
    Stages::AST::ref() and
-    py_flow_bb_node(result, this, _, _)
+    result.getNode() = this
  }

  /** Gets the location for this AST node */
--- a/python/ql/lib/semmle/python/Concepts.qll
+++ b/python/ql/lib/semmle/python/Concepts.qll
@@ -5,6 +5,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.DataFlowImplSpecific
 private import semmle.python.dataflow.new.RemoteFlowSources
@@ -214,7 +215,7 @@ module Path {
    SafeAccessCheck() { this = DataFlow::BarrierGuard<safeAccessCheck/3>::getABarrierNode() }
  }

-  private predicate safeAccessCheck(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
+  private predicate safeAccessCheck(DataFlow::GuardNode g, Cfg::ControlFlowNode node, boolean branch) {
    g.(SafeAccessCheck::Range).checks(node, branch)
  }

@@ -223,7 +224,7 @@ module Path {
    /** A data-flow node that checks that a path is safe to access in some way, for example by having a controlled prefix. */
    abstract class Range extends DataFlow::GuardNode {
      /** Holds if this guard validates `node` upon evaluating to `branch`. */
-      abstract predicate checks(ControlFlowNode node, boolean branch);
+      abstract predicate checks(Cfg::ControlFlowNode node, boolean branch);
    }
  }
 }
--- a/python/ql/lib/semmle/python/Exprs.qll
+++ b/python/ql/lib/semmle/python/Exprs.qll
@@ -3,6 +3,7 @@ module;

 private import python
 private import semmle.python.internal.CachedStages
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /** An expression */
 class Expr extends Expr_, AstNode {
@@ -70,7 +71,7 @@ class Attribute extends Attribute_ {
  /* syntax: Expr.name */
  override Expr getASubExpression() { result = this.getObject() }

-  deprecated override AttrNode getAFlowNode() { result = super.getAFlowNode() }
+  deprecated override Cfg::AttrNode getAFlowNode() { result = super.getAFlowNode() }

  /** Gets the name of this attribute. That is the `name` in `obj.name` */
  string getName() { result = Attribute_.super.getAttr() }
@@ -99,7 +100,7 @@ class Subscript extends Subscript_ {

  Expr getObject() { result = Subscript_.super.getValue() }

-  deprecated override SubscriptNode getAFlowNode() { result = super.getAFlowNode() }
+  deprecated override Cfg::SubscriptNode getAFlowNode() { result = super.getAFlowNode() }
 }

 /** A call expression, such as `func(...)` */
@@ -115,7 +116,7 @@ class Call extends Call_ {

  override string toString() { result = this.getFunc().toString() + "()" }

-  deprecated override CallNode getAFlowNode() { result = super.getAFlowNode() }
+  deprecated override Cfg::CallNode getAFlowNode() { result = super.getAFlowNode() }

  /** Gets a tuple (*) argument of this call. */
  Expr getStarargs() { result = this.getAPositionalArg().(Starred).getValue() }
@@ -203,7 +204,7 @@ class IfExp extends IfExp_ {
    result = this.getTest() or result = this.getBody() or result = this.getOrelse()
  }

-  deprecated override IfExprNode getAFlowNode() { result = super.getAFlowNode() }
+  deprecated override Cfg::IfExprNode getAFlowNode() { result = super.getAFlowNode() }
 }

 /** A starred expression, such as the `*rest` in the assignment `first, *rest = seq` */
@@ -413,7 +414,7 @@ class PlaceHolder extends PlaceHolder_ {

  override string toString() { result = "$" + this.getId() }

-  deprecated override NameNode getAFlowNode() { result = super.getAFlowNode() }
+  deprecated override Cfg::NameNode getAFlowNode() { result = super.getAFlowNode() }
 }

 /** A tuple expression such as `( 1, 3, 5, 7, 9 )` */
@@ -480,7 +481,7 @@ class Name extends Name_ {

  override string toString() { result = this.getId() }

-  deprecated override NameNode getAFlowNode() { result = super.getAFlowNode() }
+  deprecated override Cfg::NameNode getAFlowNode() { result = super.getAFlowNode() }

  override predicate isArtificial() {
    /* Artificial variable names in comprehensions all start with "." */
@@ -587,7 +588,7 @@ abstract class NameConstant extends Name, ImmutableLiteral {

  override predicate isConstant() { any() }

-  deprecated override NameConstantNode getAFlowNode() { result = Name.super.getAFlowNode() }
+  deprecated override Cfg::NameConstantNode getAFlowNode() { result = Name.super.getAFlowNode() }

  override predicate isArtificial() { none() }
 }
--- a/python/ql/lib/semmle/python/Flow.qll
+++ b/python/ql/lib/semmle/python/Flow.qll
@@ -1,7 +1,7 @@
 overlay[local]
 module;

-import python
+import python as Py
 private import semmle.python.internal.CachedStages
 private import codeql.controlflow.BasicBlock as BB

@@ -17,7 +17,7 @@ private import codeql.controlflow.BasicBlock as BB
 */

 private predicate augstore(ControlFlowNode load, ControlFlowNode store) {
-  exists(Expr load_store | exists(AugAssign aa | aa.getTarget() = load_store) |
+  exists(Py::Expr load_store | exists(Py::AugAssign aa | aa.getTarget() = load_store) |
    toAst(load) = load_store and
    toAst(store) = load_store and
    load.strictlyDominates(store)
@@ -25,7 +25,7 @@ private predicate augstore(ControlFlowNode load, ControlFlowNode store) {
 }

 /** A non-dispatched getNode() to avoid negative recursion issues */
-private AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }
+private Py::AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }

 /**
 * A control flow node. Control flow nodes have a many-to-one relation with syntactic nodes,
@@ -35,19 +35,19 @@ private AstNode toAst(ControlFlowNode n) { py_flow_bb_node(n, result, _, _) }
 class ControlFlowNode extends @py_flow_node {
  /** Whether this control flow node is a load (including those in augmented assignments) */
  predicate isLoad() {
-    exists(Expr e | e = toAst(this) | py_expr_contexts(_, 3, e) and not augstore(_, this))
+    exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 3, e) and not augstore(_, this))
  }

  /** Whether this control flow node is a store (including those in augmented assignments) */
  predicate isStore() {
-    exists(Expr e | e = toAst(this) | py_expr_contexts(_, 5, e) or augstore(_, this))
+    exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 5, e) or augstore(_, this))
  }

  /** Whether this control flow node is a delete */
-  predicate isDelete() { exists(Expr e | e = toAst(this) | py_expr_contexts(_, 2, e)) }
+  predicate isDelete() { exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 2, e)) }

  /** Whether this control flow node is a parameter */
-  predicate isParameter() { exists(Expr e | e = toAst(this) | py_expr_contexts(_, 4, e)) }
+  predicate isParameter() { exists(Py::Expr e | e = toAst(this) | py_expr_contexts(_, 4, e)) }

  /** Whether this control flow node is a store in an augmented assignment */
  predicate isAugStore() { augstore(_, this) }
@@ -57,61 +57,61 @@ class ControlFlowNode extends @py_flow_node {

  /** Whether this flow node corresponds to a literal */
  predicate isLiteral() {
-    toAst(this) instanceof Bytes
+    toAst(this) instanceof Py::Bytes
    or
-    toAst(this) instanceof Dict
+    toAst(this) instanceof Py::Dict
    or
-    toAst(this) instanceof DictComp
+    toAst(this) instanceof Py::DictComp
    or
-    toAst(this) instanceof Set
+    toAst(this) instanceof Py::Set
    or
-    toAst(this) instanceof SetComp
+    toAst(this) instanceof Py::SetComp
    or
-    toAst(this) instanceof Ellipsis
+    toAst(this) instanceof Py::Ellipsis
    or
-    toAst(this) instanceof GeneratorExp
+    toAst(this) instanceof Py::GeneratorExp
    or
-    toAst(this) instanceof Lambda
+    toAst(this) instanceof Py::Lambda
    or
-    toAst(this) instanceof ListComp
+    toAst(this) instanceof Py::ListComp
    or
-    toAst(this) instanceof List
+    toAst(this) instanceof Py::List
    or
-    toAst(this) instanceof Num
+    toAst(this) instanceof Py::Num
    or
-    toAst(this) instanceof Tuple
+    toAst(this) instanceof Py::Tuple
    or
-    toAst(this) instanceof Unicode
+    toAst(this) instanceof Py::Unicode
    or
-    toAst(this) instanceof NameConstant
+    toAst(this) instanceof Py::NameConstant
  }

  /** Whether this flow node corresponds to an attribute expression */
-  predicate isAttribute() { toAst(this) instanceof Attribute }
+  predicate isAttribute() { toAst(this) instanceof Py::Attribute }

  /** Whether this flow node corresponds to an subscript expression */
-  predicate isSubscript() { toAst(this) instanceof Subscript }
+  predicate isSubscript() { toAst(this) instanceof Py::Subscript }

  /** Whether this flow node corresponds to an import member */
-  predicate isImportMember() { toAst(this) instanceof ImportMember }
+  predicate isImportMember() { toAst(this) instanceof Py::ImportMember }

  /** Whether this flow node corresponds to a call */
-  predicate isCall() { toAst(this) instanceof Call }
+  predicate isCall() { toAst(this) instanceof Py::Call }

  /** Whether this flow node is the first in a module */
-  predicate isModuleEntry() { this.isEntryNode() and toAst(this) instanceof Module }
+  predicate isModuleEntry() { this.isEntryNode() and toAst(this) instanceof Py::Module }

  /** Whether this flow node corresponds to an import */
-  predicate isImport() { toAst(this) instanceof ImportExpr }
+  predicate isImport() { toAst(this) instanceof Py::ImportExpr }

  /** Whether this flow node corresponds to a conditional expression */
-  predicate isIfExp() { toAst(this) instanceof IfExp }
+  predicate isIfExp() { toAst(this) instanceof Py::IfExp }

  /** Whether this flow node corresponds to a function definition expression */
-  predicate isFunction() { toAst(this) instanceof FunctionExpr }
+  predicate isFunction() { toAst(this) instanceof Py::FunctionExpr }

  /** Whether this flow node corresponds to a class definition expression */
-  predicate isClass() { toAst(this) instanceof ClassExpr }
+  predicate isClass() { toAst(this) instanceof Py::ClassExpr }

  /** Gets a predecessor of this flow node */
  ControlFlowNode getAPredecessor() { this = result.getASuccessor() }
@@ -123,25 +123,25 @@ class ControlFlowNode extends @py_flow_node {
  ControlFlowNode getImmediateDominator() { py_idoms(this, result) }

  /** Gets the syntactic element corresponding to this flow node */
-  AstNode getNode() { py_flow_bb_node(this, result, _, _) }
+  Py::AstNode getNode() { py_flow_bb_node(this, result, _, _) }

  /** Gets a textual representation of this element. */
  cached
  string toString() {
    Stages::AST::ref() and
    // Since modules can have ambigous names, entry nodes can too, if we do not collate them.
-    exists(Scope s | s.getEntryNode() = this |
+    exists(Py::Scope s | s.getEntryNode() = this |
      result = "Entry node for " + concat( | | s.toString(), ",")
    )
    or
-    exists(Scope s | s.getANormalExit() = this | result = "Exit node for " + s.toString())
+    exists(Py::Scope s | s.getANormalExit() = this | result = "Exit node for " + s.toString())
    or
-    not exists(Scope s | s.getEntryNode() = this or s.getANormalExit() = this) and
+    not exists(Py::Scope s | s.getEntryNode() = this or s.getANormalExit() = this) and
    result = "ControlFlowNode for " + this.getNode().toString()
  }

  /** Gets the location of this ControlFlowNode */
-  Location getLocation() { result = this.getNode().getLocation() }
+  Py::Location getLocation() { result = this.getNode().getLocation() }

  /** Whether this flow node is the first in its scope */
  predicate isEntryNode() { py_scope_flow(this, _, -1) }
@@ -151,9 +151,9 @@ class ControlFlowNode extends @py_flow_node {

  /** Gets the scope containing this flow node */
  cached
-  Scope getScope() {
+  Py::Scope getScope() {
    Stages::AST::ref() and
-    if this.getNode() instanceof Scope
+    if this.getNode() instanceof Py::Scope
    then
      /* Entry or exit node */
      result = this.getNode()
@@ -161,7 +161,7 @@ class ControlFlowNode extends @py_flow_node {
  }

  /** Gets the enclosing module */
-  Module getEnclosingModule() { result = this.getScope().getEnclosingModule() }
+  Py::Module getEnclosingModule() { result = this.getScope().getEnclosingModule() }

  /** Gets a successor for this node if the relevant condition is True. */
  ControlFlowNode getATrueSuccessor() {
@@ -188,7 +188,7 @@ class ControlFlowNode extends @py_flow_node {
  }

  /** Whether the scope may be exited as a result of this node raising an exception */
-  predicate isExceptionalExit(Scope s) { py_scope_flow(this, s, 1) }
+  predicate isExceptionalExit(Py::Scope s) { py_scope_flow(this, s, 1) }

  /** Whether this node is a normal (non-exceptional) exit */
  predicate isNormalExit() { py_scope_flow(this, _, 0) or py_scope_flow(this, _, 2) }
@@ -236,7 +236,7 @@ class ControlFlowNode extends @py_flow_node {
  /* join-ordering helper for `getAChild() */
  pragma[noinline]
  private ControlFlowNode getExprChild(BasicBlock dom) {
-    this.getNode().(Expr).getAChildNode() = result.getNode() and
+    this.getNode().(Py::Expr).getAChildNode() = result.getNode() and
    result.getBasicBlock().dominates(dom) and
    not this instanceof UnaryExprNode
  }
@@ -249,16 +249,16 @@ class ControlFlowNode extends @py_flow_node {
 */

 private class AnyNode extends ControlFlowNode {
-  override AstNode getNode() { result = super.getNode() }
+  override Py::AstNode getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a call expression, such as `func(...)` */
 class CallNode extends ControlFlowNode {
-  CallNode() { toAst(this) instanceof Call }
+  CallNode() { toAst(this) instanceof Py::Call }

  /** Gets the flow node corresponding to the function expression for the call corresponding to this flow node */
  ControlFlowNode getFunction() {
-    exists(Call c |
+    exists(Py::Call c |
      this.getNode() = c and
      c.getFunc() = result.getNode() and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -267,7 +267,7 @@ class CallNode extends ControlFlowNode {

  /** Gets the flow node corresponding to the n'th positional argument of the call corresponding to this flow node */
  ControlFlowNode getArg(int n) {
-    exists(Call c |
+    exists(Py::Call c |
      this.getNode() = c and
      c.getArg(n) = result.getNode() and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -276,7 +276,7 @@ class CallNode extends ControlFlowNode {

  /** Gets the flow node corresponding to the named argument of the call corresponding to this flow node */
  ControlFlowNode getArgByName(string name) {
-    exists(Call c, Keyword k |
+    exists(Py::Call c, Py::Keyword k |
      this.getNode() = c and
      k = c.getANamedArg() and
      k.getValue() = result.getNode() and
@@ -292,7 +292,7 @@ class CallNode extends ControlFlowNode {
    result = this.getArgByName(_)
  }

-  override Call getNode() { result = super.getNode() }
+  override Py::Call getNode() { result = super.getNode() }

  predicate isDecoratorCall() {
    this.isClassDecoratorCall()
@@ -301,11 +301,11 @@ class CallNode extends ControlFlowNode {
  }

  predicate isClassDecoratorCall() {
-    exists(ClassExpr cls | this.getNode() = cls.getADecoratorCall())
+    exists(Py::ClassExpr cls | this.getNode() = cls.getADecoratorCall())
  }

  predicate isFunctionDecoratorCall() {
-    exists(FunctionExpr func | this.getNode() = func.getADecoratorCall())
+    exists(Py::FunctionExpr func | this.getNode() = func.getADecoratorCall())
  }

  /** Gets the first tuple (*) argument of this call, if any. */
@@ -323,11 +323,11 @@ class CallNode extends ControlFlowNode {

 /** A control flow corresponding to an attribute expression, such as `value.attr` */
 class AttrNode extends ControlFlowNode {
-  AttrNode() { toAst(this) instanceof Attribute }
+  AttrNode() { toAst(this) instanceof Py::Attribute }

  /** Gets the flow node corresponding to the object of the attribute expression corresponding to this flow node */
  ControlFlowNode getObject() {
-    exists(Attribute a |
+    exists(Py::Attribute a |
      this.getNode() = a and
      a.getObject() = result.getNode() and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -339,7 +339,7 @@ class AttrNode extends ControlFlowNode {
   * with the matching name
   */
  ControlFlowNode getObject(string name) {
-    exists(Attribute a |
+    exists(Py::Attribute a |
      this.getNode() = a and
      a.getObject() = result.getNode() and
      a.getName() = name and
@@ -348,57 +348,57 @@ class AttrNode extends ControlFlowNode {
  }

  /** Gets the attribute name of the attribute expression corresponding to this flow node */
-  string getName() { exists(Attribute a | this.getNode() = a and a.getName() = result) }
+  string getName() { exists(Py::Attribute a | this.getNode() = a and a.getName() = result) }

-  override Attribute getNode() { result = super.getNode() }
+  override Py::Attribute getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a `from ... import ...` expression */
 class ImportMemberNode extends ControlFlowNode {
-  ImportMemberNode() { toAst(this) instanceof ImportMember }
+  ImportMemberNode() { toAst(this) instanceof Py::ImportMember }

  /**
   * Gets the flow node corresponding to the module in the import-member expression corresponding to this flow node,
   * with the matching name
   */
  ControlFlowNode getModule(string name) {
-    exists(ImportMember i | this.getNode() = i and i.getModule() = result.getNode() |
+    exists(Py::ImportMember i | this.getNode() = i and i.getModule() = result.getNode() |
      i.getName() = name and
      result.getBasicBlock().dominates(this.getBasicBlock())
    )
  }

-  override ImportMember getNode() { result = super.getNode() }
+  override Py::ImportMember getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to an artificial expression representing an import */
 class ImportExprNode extends ControlFlowNode {
-  ImportExprNode() { toAst(this) instanceof ImportExpr }
+  ImportExprNode() { toAst(this) instanceof Py::ImportExpr }

-  override ImportExpr getNode() { result = super.getNode() }
+  override Py::ImportExpr getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a `from ... import *` statement */
 class ImportStarNode extends ControlFlowNode {
-  ImportStarNode() { toAst(this) instanceof ImportStar }
+  ImportStarNode() { toAst(this) instanceof Py::ImportStar }

  /** Gets the flow node corresponding to the module in the import-star corresponding to this flow node */
  ControlFlowNode getModule() {
-    exists(ImportStar i | this.getNode() = i and i.getModuleExpr() = result.getNode() |
+    exists(Py::ImportStar i | this.getNode() = i and i.getModuleExpr() = result.getNode() |
      result.getBasicBlock().dominates(this.getBasicBlock())
    )
  }

-  override ImportStar getNode() { result = super.getNode() }
+  override Py::ImportStar getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a subscript expression, such as `value[slice]` */
 class SubscriptNode extends ControlFlowNode {
-  SubscriptNode() { toAst(this) instanceof Subscript }
+  SubscriptNode() { toAst(this) instanceof Py::Subscript }

  /** flow node corresponding to the value of the sequence in a subscript operation */
  ControlFlowNode getObject() {
-    exists(Subscript s |
+    exists(Py::Subscript s |
      this.getNode() = s and
      s.getObject() = result.getNode() and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -407,23 +407,23 @@ class SubscriptNode extends ControlFlowNode {

  /** flow node corresponding to the index in a subscript operation */
  ControlFlowNode getIndex() {
-    exists(Subscript s |
+    exists(Py::Subscript s |
      this.getNode() = s and
      s.getIndex() = result.getNode() and
      result.getBasicBlock().dominates(this.getBasicBlock())
    )
  }

-  override Subscript getNode() { result = super.getNode() }
+  override Py::Subscript getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a comparison operation, such as `x<y` */
 class CompareNode extends ControlFlowNode {
-  CompareNode() { toAst(this) instanceof Compare }
+  CompareNode() { toAst(this) instanceof Py::Compare }

  /** Whether left and right are a pair of operands for this comparison */
-  predicate operands(ControlFlowNode left, Cmpop op, ControlFlowNode right) {
-    exists(Compare c, Expr eleft, Expr eright |
+  predicate operands(ControlFlowNode left, Py::Cmpop op, ControlFlowNode right) {
+    exists(Py::Compare c, Py::Expr eleft, Py::Expr eright |
      this.getNode() = c and left.getNode() = eleft and right.getNode() = eright
    |
      eleft = c.getLeft() and eright = c.getComparator(0) and op = c.getOp(0)
@@ -436,26 +436,26 @@ class CompareNode extends ControlFlowNode {
    right.getBasicBlock().dominates(this.getBasicBlock())
  }

-  override Compare getNode() { result = super.getNode() }
+  override Py::Compare getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a conditional expression such as, `body if test else orelse` */
 class IfExprNode extends ControlFlowNode {
-  IfExprNode() { toAst(this) instanceof IfExp }
+  IfExprNode() { toAst(this) instanceof Py::IfExp }

  /** flow node corresponding to one of the operands of an if-expression */
  ControlFlowNode getAnOperand() { result = this.getAPredecessor() }

-  override IfExp getNode() { result = super.getNode() }
+  override Py::IfExp getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to an assignment expression such as `lhs := rhs`. */
 class AssignmentExprNode extends ControlFlowNode {
-  AssignmentExprNode() { toAst(this) instanceof AssignExpr }
+  AssignmentExprNode() { toAst(this) instanceof Py::AssignExpr }

  /** Gets the flow node corresponding to the left-hand side of the assignment expression */
  ControlFlowNode getTarget() {
-    exists(AssignExpr a |
+    exists(Py::AssignExpr a |
      this.getNode() = a and
      a.getTarget() = result.getNode() and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -464,27 +464,27 @@ class AssignmentExprNode extends ControlFlowNode {

  /** Gets the flow node corresponding to the right-hand side of the assignment expression */
  ControlFlowNode getValue() {
-    exists(AssignExpr a |
+    exists(Py::AssignExpr a |
      this.getNode() = a and
      a.getValue() = result.getNode() and
      result.getBasicBlock().dominates(this.getBasicBlock())
    )
  }

-  override AssignExpr getNode() { result = super.getNode() }
+  override Py::AssignExpr getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a binary expression, such as `x + y` */
 class BinaryExprNode extends ControlFlowNode {
-  BinaryExprNode() { toAst(this) instanceof BinaryExpr }
+  BinaryExprNode() { toAst(this) instanceof Py::BinaryExpr }

  /** flow node corresponding to one of the operands of a binary expression */
  ControlFlowNode getAnOperand() { result = this.getLeft() or result = this.getRight() }

-  override BinaryExpr getNode() { result = super.getNode() }
+  override Py::BinaryExpr getNode() { result = super.getNode() }

  ControlFlowNode getLeft() {
-    exists(BinaryExpr b |
+    exists(Py::BinaryExpr b |
      this.getNode() = b and
      result.getNode() = b.getLeft() and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -492,7 +492,7 @@ class BinaryExprNode extends ControlFlowNode {
  }

  ControlFlowNode getRight() {
-    exists(BinaryExpr b |
+    exists(Py::BinaryExpr b |
      this.getNode() = b and
      result.getNode() = b.getRight() and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -500,11 +500,11 @@ class BinaryExprNode extends ControlFlowNode {
  }

  /** Gets the operator of this binary expression node. */
-  Operator getOp() { result = this.getNode().getOp() }
+  Py::Operator getOp() { result = this.getNode().getOp() }

  /** Whether left and right are a pair of operands for this binary expression */
-  predicate operands(ControlFlowNode left, Operator op, ControlFlowNode right) {
-    exists(BinaryExpr b, Expr eleft, Expr eright |
+  predicate operands(ControlFlowNode left, Py::Operator op, ControlFlowNode right) {
+    exists(Py::BinaryExpr b, Py::Expr eleft, Py::Expr eright |
      this.getNode() = b and left.getNode() = eleft and right.getNode() = eright
    |
      eleft = b.getLeft() and eright = b.getRight() and op = b.getOp()
@@ -516,20 +516,20 @@ class BinaryExprNode extends ControlFlowNode {

 /** A control flow node corresponding to a boolean shortcut (and/or) operation */
 class BoolExprNode extends ControlFlowNode {
-  BoolExprNode() { toAst(this) instanceof BoolExpr }
+  BoolExprNode() { toAst(this) instanceof Py::BoolExpr }

  /** flow node corresponding to one of the operands of a boolean expression */
  ControlFlowNode getAnOperand() {
-    exists(BoolExpr b | this.getNode() = b and result.getNode() = b.getAValue()) and
+    exists(Py::BoolExpr b | this.getNode() = b and result.getNode() = b.getAValue()) and
    this.getBasicBlock().dominates(result.getBasicBlock())
  }

-  override BoolExpr getNode() { result = super.getNode() }
+  override Py::BoolExpr getNode() { result = super.getNode() }
 }

 /** A control flow node corresponding to a unary expression: (`+x`), (`-x`) or (`~x`) */
 class UnaryExprNode extends ControlFlowNode {
-  UnaryExprNode() { toAst(this) instanceof UnaryExpr }
+  UnaryExprNode() { toAst(this) instanceof Py::UnaryExpr }

  /**
   * Gets flow node corresponding to the operand of a unary expression.
@@ -540,7 +540,7 @@ class UnaryExprNode extends ControlFlowNode {
   */
  ControlFlowNode getOperand() { result = this.getAPredecessor() }

-  override UnaryExpr getNode() { result = super.getNode() }
+  override Py::UnaryExpr getNode() { result = super.getNode() }

  override ControlFlowNode getAChild() { result = this.getAPredecessor() }
 }
@@ -555,22 +555,22 @@ class DefinitionNode extends ControlFlowNode {
  cached
  DefinitionNode() {
    Stages::AST::ref() and
-    exists(Assign a | this.getNode() = a.getATarget())
+    exists(Py::Assign a | this.getNode() = a.getATarget())
    or
-    exists(AssignExpr a | this.getNode() = a.getTarget())
+    exists(Py::AssignExpr a | this.getNode() = a.getTarget())
    or
-    exists(AnnAssign a | this.getNode() = a.getTarget() and exists(a.getValue()))
+    exists(Py::AnnAssign a | this.getNode() = a.getTarget() and exists(a.getValue()))
    or
-    exists(Alias a | this.getNode() = a.getAsname())
+    exists(Py::Alias a | this.getNode() = a.getAsname())
    or
    augstore(_, this)
    or
    // `x, y = 1, 2` where LHS is a combination of list or tuples
-    exists(Assign a | this.getNode() = list_or_tuple_nested_element(a.getATarget()))
+    exists(Py::Assign a | this.getNode() = list_or_tuple_nested_element(a.getATarget()))
    or
-    exists(For for | this.getNode() = for.getTarget())
+    exists(Py::For for | this.getNode() = for.getTarget())
    or
-    exists(Parameter param | this.getNode() = param.asName() and exists(param.getDefault()))
+    exists(Py::Parameter param | this.getNode() = param.asName() and exists(param.getDefault()))
  }

  /** flow node corresponding to the value assigned for the definition corresponding to this flow node */
@@ -584,16 +584,16 @@ class DefinitionNode extends ControlFlowNode {
      // since the default value for a parameter is evaluated in the same basic block as
      // the function definition, but the parameter belongs to the basic block of the function,
      // there is no dominance relationship between the two.
-      exists(Parameter param | this.getNode() = param.asName())
+      exists(Py::Parameter param | this.getNode() = param.asName())
    )
  }
 }

-private Expr list_or_tuple_nested_element(Expr list_or_tuple) {
-  exists(Expr elt |
-    elt = list_or_tuple.(Tuple).getAnElt()
+private Py::Expr list_or_tuple_nested_element(Py::Expr list_or_tuple) {
+  exists(Py::Expr elt |
+    elt = list_or_tuple.(Py::Tuple).getAnElt()
    or
-    elt = list_or_tuple.(List).getAnElt()
+    elt = list_or_tuple.(Py::List).getAnElt()
  |
    result = elt
    or
@@ -603,12 +603,12 @@ private Expr list_or_tuple_nested_element(Expr list_or_tuple) {

 /**
 * A control flow node corresponding to a deletion statement, such as `del x`.
- * There can be multiple `DeletionNode`s for each `Delete` such that each
+ * There can be multiple `DeletionNode`s for each `Py::Delete` such that each
 * target has own `DeletionNode`. The CFG for `del a, x.y` looks like:
 * `NameNode('a') -> DeletionNode -> NameNode('b') -> AttrNode('y') -> DeletionNode`.
 */
 class DeletionNode extends ControlFlowNode {
-  DeletionNode() { toAst(this) instanceof Delete }
+  DeletionNode() { toAst(this) instanceof Py::Delete }

  /** Gets the unique target of this deletion node. */
  ControlFlowNode getTarget() { result.getASuccessor() = this }
@@ -617,9 +617,9 @@ class DeletionNode extends ControlFlowNode {
 /** A control flow node corresponding to a sequence (tuple or list) literal */
 abstract class SequenceNode extends ControlFlowNode {
  SequenceNode() {
-    toAst(this) instanceof Tuple
+    toAst(this) instanceof Py::Tuple
    or
-    toAst(this) instanceof List
+    toAst(this) instanceof Py::List
  }

  /** Gets the control flow node for an element of this sequence */
@@ -632,11 +632,11 @@ abstract class SequenceNode extends ControlFlowNode {

 /** A control flow node corresponding to a tuple expression such as `( 1, 3, 5, 7, 9 )` */
 class TupleNode extends SequenceNode {
-  TupleNode() { toAst(this) instanceof Tuple }
+  TupleNode() { toAst(this) instanceof Py::Tuple }

  override ControlFlowNode getElement(int n) {
    Stages::AST::ref() and
-    exists(Tuple t | this.getNode() = t and result.getNode() = t.getElt(n)) and
+    exists(Py::Tuple t | this.getNode() = t and result.getNode() = t.getElt(n)) and
    (
      result.getBasicBlock().dominates(this.getBasicBlock())
      or
@@ -647,10 +647,10 @@ class TupleNode extends SequenceNode {

 /** A control flow node corresponding to a list expression, such as `[ 1, 3, 5, 7, 9 ]` */
 class ListNode extends SequenceNode {
-  ListNode() { toAst(this) instanceof List }
+  ListNode() { toAst(this) instanceof Py::List }

  override ControlFlowNode getElement(int n) {
-    exists(List l | this.getNode() = l and result.getNode() = l.getElt(n)) and
+    exists(Py::List l | this.getNode() = l and result.getNode() = l.getElt(n)) and
    (
      result.getBasicBlock().dominates(this.getBasicBlock())
      or
@@ -661,10 +661,10 @@ class ListNode extends SequenceNode {

 /** A control flow node corresponding to a set expression, such as `{ 1, 3, 5, 7, 9 }` */
 class SetNode extends ControlFlowNode {
-  SetNode() { toAst(this) instanceof Set }
+  SetNode() { toAst(this) instanceof Py::Set }

  ControlFlowNode getAnElement() {
-    exists(Set s | this.getNode() = s and result.getNode() = s.getElt(_)) and
+    exists(Py::Set s | this.getNode() = s and result.getNode() = s.getElt(_)) and
    (
      result.getBasicBlock().dominates(this.getBasicBlock())
      or
@@ -675,20 +675,20 @@ class SetNode extends ControlFlowNode {

 /** A control flow node corresponding to a dictionary literal, such as `{ 'a': 1, 'b': 2 }` */
 class DictNode extends ControlFlowNode {
-  DictNode() { toAst(this) instanceof Dict }
+  DictNode() { toAst(this) instanceof Py::Dict }

  /**
   * Gets a key of this dictionary literal node, for those items that have keys
   * E.g, in {'a':1, **b} this returns only 'a'
   */
  ControlFlowNode getAKey() {
-    exists(Dict d | this.getNode() = d and result.getNode() = d.getAKey()) and
+    exists(Py::Dict d | this.getNode() = d and result.getNode() = d.getAKey()) and
    result.getBasicBlock().dominates(this.getBasicBlock())
  }

  /** Gets a value of this dictionary literal node */
  ControlFlowNode getAValue() {
-    exists(Dict d | this.getNode() = d and result.getNode() = d.getAValue()) and
+    exists(Py::Dict d | this.getNode() = d and result.getNode() = d.getAValue()) and
    result.getBasicBlock().dominates(this.getBasicBlock())
  }
 }
@@ -712,21 +712,23 @@ class IterableNode extends ControlFlowNode {
  }
 }

-private AstNode assigned_value(Expr lhs) {
+private Py::AstNode assigned_value(Py::Expr lhs) {
  /* lhs = result */
-  exists(Assign a | a.getATarget() = lhs and result = a.getValue())
+  exists(Py::Assign a | a.getATarget() = lhs and result = a.getValue())
  or
  /* lhs := result */
-  exists(AssignExpr a | a.getTarget() = lhs and result = a.getValue())
+  exists(Py::AssignExpr a | a.getTarget() = lhs and result = a.getValue())
  or
  /* lhs : annotation = result */
-  exists(AnnAssign a | a.getTarget() = lhs and result = a.getValue())
+  exists(Py::AnnAssign a | a.getTarget() = lhs and result = a.getValue())
  or
  /* import result as lhs */
-  exists(Alias a | a.getAsname() = lhs and result = a.getValue())
+  exists(Py::Alias a | a.getAsname() = lhs and result = a.getValue())
  or
  /* lhs += x  =>  result = (lhs + x) */
-  exists(AugAssign a, BinaryExpr b | b = a.getOperation() and result = b and lhs = b.getLeft())
+  exists(Py::AugAssign a, Py::BinaryExpr b |
+    b = a.getOperation() and result = b and lhs = b.getLeft()
+  )
  or
  /*
   * ..., lhs, ... = ..., result, ...
@@ -734,31 +736,31 @@ private AstNode assigned_value(Expr lhs) {
   * ..., (..., lhs, ...), ... = ..., (..., result, ...), ...
   */

-  exists(Assign a | nested_sequence_assign(a.getATarget(), a.getValue(), lhs, result))
+  exists(Py::Assign a | nested_sequence_assign(a.getATarget(), a.getValue(), lhs, result))
  or
  /* for lhs in seq: => `result` is the `for` node, representing the `iter(next(seq))` operation. */
-  result.(For).getTarget() = lhs
+  result.(Py::For).getTarget() = lhs
  or
-  exists(Parameter param | lhs = param.asName() and result = param.getDefault())
+  exists(Py::Parameter param | lhs = param.asName() and result = param.getDefault())
 }

 predicate nested_sequence_assign(
-  Expr left_parent, Expr right_parent, Expr left_result, Expr right_result
+  Py::Expr left_parent, Py::Expr right_parent, Py::Expr left_result, Py::Expr right_result
 ) {
-  exists(Assign a |
+  exists(Py::Assign a |
    a.getATarget().getASubExpression*() = left_parent and
    a.getValue().getASubExpression*() = right_parent
  ) and
-  exists(int i, Expr left_elem, Expr right_elem |
+  exists(int i, Py::Expr left_elem, Py::Expr right_elem |
    (
-      left_elem = left_parent.(Tuple).getElt(i)
+      left_elem = left_parent.(Py::Tuple).getElt(i)
      or
-      left_elem = left_parent.(List).getElt(i)
+      left_elem = left_parent.(Py::List).getElt(i)
    ) and
    (
-      right_elem = right_parent.(Tuple).getElt(i)
+      right_elem = right_parent.(Py::Tuple).getElt(i)
      or
-      right_elem = right_parent.(List).getElt(i)
+      right_elem = right_parent.(Py::List).getElt(i)
    )
  |
    left_result = left_elem and right_result = right_elem
@@ -769,9 +771,9 @@ predicate nested_sequence_assign(

 /** A flow node for a `for` statement. */
 class ForNode extends ControlFlowNode {
-  ForNode() { toAst(this) instanceof For }
+  ForNode() { toAst(this) instanceof Py::For }

-  override For getNode() { result = super.getNode() }
+  override Py::For getNode() { result = super.getNode() }

  /** Holds if this `for` statement causes iteration over `sequence` storing each step of the iteration in `target` */
  predicate iterates(ControlFlowNode target, ControlFlowNode sequence) {
@@ -782,7 +784,7 @@ class ForNode extends ControlFlowNode {

  /** Gets the sequence node for this `for` statement. */
  ControlFlowNode getSequence() {
-    exists(For for |
+    exists(Py::For for |
      toAst(this) = for and
      for.getIter() = result.getNode()
    |
@@ -792,7 +794,7 @@ class ForNode extends ControlFlowNode {

  /** A possible `target` for this `for` statement, not accounting for loop unrolling */
  private ControlFlowNode possibleTarget() {
-    exists(For for |
+    exists(Py::For for |
      toAst(this) = for and
      for.getTarget() = result.getNode() and
      this.getBasicBlock().dominates(result.getBasicBlock())
@@ -809,11 +811,11 @@ class ForNode extends ControlFlowNode {

 /** A flow node for a `raise` statement */
 class RaiseStmtNode extends ControlFlowNode {
-  RaiseStmtNode() { toAst(this) instanceof Raise }
+  RaiseStmtNode() { toAst(this) instanceof Py::Raise }

  /** Gets the control flow node for the exception raised by this raise statement */
  ControlFlowNode getException() {
-    exists(Raise r |
+    exists(Py::Raise r |
      r = toAst(this) and
      r.getException() = toAst(result) and
      result.getBasicBlock().dominates(this.getBasicBlock())
@@ -827,36 +829,36 @@ class RaiseStmtNode extends ControlFlowNode {
 */
 class NameNode extends ControlFlowNode {
  NameNode() {
-    exists(Name n | py_flow_bb_node(this, n, _, _))
+    exists(Py::Name n | py_flow_bb_node(this, n, _, _))
    or
-    exists(PlaceHolder p | py_flow_bb_node(this, p, _, _))
+    exists(Py::PlaceHolder p | py_flow_bb_node(this, p, _, _))
  }

  /** Whether this flow node defines the variable `v`. */
-  predicate defines(Variable v) {
-    exists(Name d | this.getNode() = d and d.defines(v)) and
+  predicate defines(Py::Variable v) {
+    exists(Py::Name d | this.getNode() = d and d.defines(v)) and
    not this.isLoad()
  }

  /** Whether this flow node deletes the variable `v`. */
-  predicate deletes(Variable v) { exists(Name d | this.getNode() = d and d.deletes(v)) }
+  predicate deletes(Py::Variable v) { exists(Py::Name d | this.getNode() = d and d.deletes(v)) }

  /** Whether this flow node uses the variable `v`. */
-  predicate uses(Variable v) {
+  predicate uses(Py::Variable v) {
    this.isLoad() and
-    exists(Name u | this.getNode() = u and u.uses(v))
+    exists(Py::Name u | this.getNode() = u and u.uses(v))
    or
-    exists(PlaceHolder u |
-      this.getNode() = u and u.getVariable() = v and u.getCtx() instanceof Load
+    exists(Py::PlaceHolder u |
+      this.getNode() = u and u.getVariable() = v and u.getCtx() instanceof Py::Load
    )
    or
    Scopes::use_of_global_variable(this, v.getScope(), v.getId())
  }

  string getId() {
-    result = this.getNode().(Name).getId()
+    result = this.getNode().(Py::Name).getId()
    or
-    result = this.getNode().(PlaceHolder).getId()
+    result = this.getNode().(Py::PlaceHolder).getId()
  }

  /** Whether this is a use of a local variable. */
@@ -868,37 +870,39 @@ class NameNode extends ControlFlowNode {
  /** Whether this is a use of a global (including builtin) variable. */
  predicate isGlobal() { Scopes::use_of_global_variable(this, _, _) }

-  predicate isSelf() { exists(SsaVariable selfvar | selfvar.isSelf() and selfvar.getAUse() = this) }
+  predicate isSelf() {
+    exists(Py::SsaVariable selfvar | selfvar.isSelf() and selfvar.getAUse() = this)
+  }
 }

 /** A control flow node corresponding to a named constant, one of `None`, `True` or `False`. */
 class NameConstantNode extends NameNode {
-  NameConstantNode() { exists(NameConstant n | py_flow_bb_node(this, n, _, _)) }
+  NameConstantNode() { exists(Py::NameConstant n | py_flow_bb_node(this, n, _, _)) }
  /*
   * We ought to override uses as well, but that has
   * a serious performance impact.
-   *    deprecated predicate uses(Variable v) { none() }
+   *    deprecated predicate uses(Py::Variable v) { none() }
   */

  }

 /** A control flow node corresponding to a starred expression, `*a`. */
 class StarredNode extends ControlFlowNode {
-  StarredNode() { toAst(this) instanceof Starred }
+  StarredNode() { toAst(this) instanceof Py::Starred }

-  ControlFlowNode getValue() { toAst(result) = toAst(this).(Starred).getValue() }
+  ControlFlowNode getValue() { toAst(result) = toAst(this).(Py::Starred).getValue() }
 }

 /** The ControlFlowNode for an 'except' statement. */
 class ExceptFlowNode extends ControlFlowNode {
-  ExceptFlowNode() { this.getNode() instanceof ExceptStmt }
+  ExceptFlowNode() { this.getNode() instanceof Py::ExceptStmt }

  /**
   * Gets the type handled by this exception handler.
-   * `ExceptionType` in `except ExceptionType as e:`
+   * `Py::ExceptionType` in `except Py::ExceptionType as e:`
   */
  ControlFlowNode getType() {
-    exists(ExceptStmt ex |
+    exists(Py::ExceptStmt ex |
      this.getBasicBlock().dominates(result.getBasicBlock()) and
      ex = this.getNode() and
      result.getNode() = ex.getType()
@@ -907,10 +911,10 @@ class ExceptFlowNode extends ControlFlowNode {

  /**
   * Gets the name assigned to the handled exception, if any.
-   * `e` in `except ExceptionType as e:`
+   * `e` in `except Py::ExceptionType as e:`
   */
  ControlFlowNode getName() {
-    exists(ExceptStmt ex |
+    exists(Py::ExceptStmt ex |
      this.getBasicBlock().dominates(result.getBasicBlock()) and
      ex = this.getNode() and
      result.getNode() = ex.getName()
@@ -920,30 +924,30 @@ class ExceptFlowNode extends ControlFlowNode {

 /** The ControlFlowNode for an 'except*' statement. */
 class ExceptGroupFlowNode extends ControlFlowNode {
-  ExceptGroupFlowNode() { this.getNode() instanceof ExceptGroupStmt }
+  ExceptGroupFlowNode() { this.getNode() instanceof Py::ExceptGroupStmt }

  /**
   * Gets the type handled by this exception handler.
-   * `ExceptionType` in `except* ExceptionType as e:`
+   * `Py::ExceptionType` in `except* Py::ExceptionType as e:`
   */
  ControlFlowNode getType() {
    this.getBasicBlock().dominates(result.getBasicBlock()) and
-    result.getNode() = this.getNode().(ExceptGroupStmt).getType()
+    result.getNode() = this.getNode().(Py::ExceptGroupStmt).getType()
  }

  /**
   * Gets the name assigned to the handled exception, if any.
-   * `e` in `except* ExceptionType as e:`
+   * `e` in `except* Py::ExceptionType as e:`
   */
  ControlFlowNode getName() {
    this.getBasicBlock().dominates(result.getBasicBlock()) and
-    result.getNode() = this.getNode().(ExceptGroupStmt).getName()
+    result.getNode() = this.getNode().(Py::ExceptGroupStmt).getName()
  }
 }

 private module Scopes {
  private predicate fast_local(NameNode n) {
-    exists(FastLocalVariable v |
+    exists(Py::FastLocalVariable v |
      n.uses(v) and
      v.getScope() = n.getScope()
    )
@@ -952,15 +956,15 @@ private module Scopes {
  predicate local(NameNode n) {
    fast_local(n)
    or
-    exists(SsaVariable var |
+    exists(Py::SsaVariable var |
      var.getAUse() = n and
-      n.getScope() instanceof Class and
+      n.getScope() instanceof Py::Class and
      exists(var.getDefinition())
    )
  }

  predicate non_local(NameNode n) {
-    exists(FastLocalVariable flv |
+    exists(Py::FastLocalVariable flv |
      flv.getALoad() = n.getNode() and
      not flv.getScope() = n.getScope()
    )
@@ -968,20 +972,20 @@ private module Scopes {

  // magic is fine, but we get questionable join-ordering of it
  pragma[nomagic]
-  predicate use_of_global_variable(NameNode n, Module scope, string name) {
+  predicate use_of_global_variable(NameNode n, Py::Module scope, string name) {
    n.isLoad() and
    not non_local(n) and
-    not exists(SsaVariable var | var.getAUse() = n |
-      var.getVariable() instanceof FastLocalVariable
+    not exists(Py::SsaVariable var | var.getAUse() = n |
+      var.getVariable() instanceof Py::FastLocalVariable
      or
-      n.getScope() instanceof Class and
+      n.getScope() instanceof Py::Class and
      not maybe_undefined(var)
    ) and
    name = n.getId() and
    scope = n.getEnclosingModule()
  }

-  private predicate maybe_undefined(SsaVariable var) {
+  private predicate maybe_undefined(Py::SsaVariable var) {
    not exists(var.getDefinition()) and not py_ssa_phi(var, _)
    or
    var.getDefinition().isDelete()
@@ -1058,13 +1062,13 @@ class BasicBlock extends @py_flow_node {
  private predicate oneNodeBlock() { this.firstNode() = this.getLastNode() }

  private predicate startLocationInfo(string file, int line, int col) {
-    if this.firstNode().getNode() instanceof Scope
+    if this.firstNode().getNode() instanceof Py::Scope
    then this.firstNode().getASuccessor().getLocation().hasLocationInfo(file, line, col, _, _)
    else this.firstNode().getLocation().hasLocationInfo(file, line, col, _, _)
  }

  private predicate endLocationInfo(int endl, int endc) {
-    if this.getLastNode().getNode() instanceof Scope and not this.oneNodeBlock()
+    if this.getLastNode().getNode() instanceof Py::Scope and not this.oneNodeBlock()
    then this.getLastNode().getAPredecessor().getLocation().hasLocationInfo(_, _, _, endl, endc)
    else this.getLastNode().getLocation().hasLocationInfo(_, _, _, endl, endc)
  }
@@ -1081,7 +1085,7 @@ class BasicBlock extends @py_flow_node {

  /** Whether flow from this basic block reaches a normal exit from its scope */
  predicate reachesExit() {
-    exists(Scope s | s.getANormalExit().getBasicBlock() = this)
+    exists(Py::Scope s | s.getANormalExit().getBasicBlock() = this)
    or
    this.getASuccessor().reachesExit()
  }
@@ -1122,7 +1126,7 @@ class BasicBlock extends @py_flow_node {

  /** Gets the scope of this block */
  pragma[nomagic]
-  Scope getScope() {
+  Py::Scope getScope() {
    exists(ControlFlowNode n | n.getBasicBlock() = this |
      /* Take care not to use an entry or exit node as that node's scope will be the outer scope */
      not py_scope_flow(n, _, -1) and
@@ -1145,17 +1149,17 @@ class BasicBlock extends @py_flow_node {
  predicate reaches(BasicBlock other) { this = other or this.strictlyReaches(other) }

  /**
-   * Gets the `ConditionBlock`, if any, that controls this block and
-   * does not control any other `ConditionBlock`s that control this block.
-   * That is the `ConditionBlock` that is closest dominator.
+   * Gets the `Py::ConditionBlock`, if any, that controls this block and
+   * does not control any other `Py::ConditionBlock`s that control this block.
+   * That is the `Py::ConditionBlock` that is closest dominator.
   */
-  ConditionBlock getImmediatelyControllingBlock() {
+  Py::ConditionBlock getImmediatelyControllingBlock() {
    result = this.nonControllingImmediateDominator*().getImmediateDominator()
  }

  private BasicBlock nonControllingImmediateDominator() {
    result = this.getImmediateDominator() and
-    not result.(ConditionBlock).controls(this, _)
+    not result.(Py::ConditionBlock).controls(this, _)
  }

  /**
@@ -1175,7 +1179,7 @@ private class ControlFlowNodeAlias = ControlFlowNode;

 final private class FinalBasicBlock = BasicBlock;

-module Cfg implements BB::CfgSig<Location> {
+module Cfg implements BB::CfgSig<Py::Location> {
  private import codeql.controlflow.SuccessorType

  class ControlFlowNode = ControlFlowNodeAlias;
@@ -1186,7 +1190,7 @@ module Cfg implements BB::CfgSig<Location> {
    // Using the location of the first node is simple
    // and we just need a way to identify the basic block
    // during debugging, so this will be serviceable.
-    Location getLocation() { result = super.getNode(0).getLocation() }
+    Py::Location getLocation() { result = super.getNode(0).getLocation() }

    int length() { result = count(int i | exists(this.getNode(i))) }

--- a/python/ql/lib/semmle/python/Function.qll
+++ b/python/ql/lib/semmle/python/Function.qll
@@ -2,6 +2,7 @@ overlay[local]
 module;

 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /**
 * A function, independent of defaults and binding.
@@ -157,12 +158,12 @@ class Function extends Function_, Scope, AstNode {
   * DEPRECATED: bind a `Return` node explicitly instead, e.g.
   * `exists(Return ret | ret.getScope() = this and n.getNode() = ret.getValue())`.
   * This API is being phased out together with `AstNode.getAFlowNode()` to
-   * untangle the AST and CFG hierarchies in preparation for migrating the
-   * dataflow library off the legacy CFG.
+   * untangle the AST and CFG hierarchies.
   *
-   * Gets a control flow node for a return value of this function.
+   * Gets a control flow node for a return value of this function, from the
+   * new (shared) CFG.
   */
-  deprecated ControlFlowNode getAReturnValueFlowNode() {
+  deprecated Cfg::ControlFlowNode getAReturnValueFlowNode() {
    exists(Return ret |
      ret.getScope() = this and
      ret.getValue() = result.getNode()
--- a/python/ql/lib/semmle/python/Import.qll
+++ b/python/ql/lib/semmle/python/Import.qll
@@ -4,6 +4,7 @@ module;
 import python
 private import semmle.python.types.Builtins
 private import semmle.python.internal.CachedStages
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /**
 * An alias in an import statement, the `mod as name` part of `import mod as name`. May be artificial;
@@ -163,7 +164,7 @@ class ImportMember extends ImportMember_ {
    result = this.getModule().(ImportExpr).getImportedModuleName() + "." + this.getName()
  }

-  deprecated override ImportMemberNode getAFlowNode() { result = super.getAFlowNode() }
+  deprecated override Cfg::ImportMemberNode getAFlowNode() { result = super.getAFlowNode() }
 }

 /** An import statement */
--- a/python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll
+++ b/python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll
--- a/python/ql/lib/semmle/python/controlflow/internal/Cfg.qll
+++ b/python/ql/lib/semmle/python/controlflow/internal/Cfg.qll
--- a/python/ql/lib/semmle/python/dataflow/new/BarrierGuards.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/BarrierGuards.qll
@@ -1,11 +1,12 @@
 /** Provides commonly used BarrierGuards. */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow

-private predicate constCompare(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
-  exists(CompareNode cn | cn = g |
-    exists(ImmutableLiteral const, Cmpop op, ControlFlowNode c |
+private predicate constCompare(DataFlow::GuardNode g, Cfg::ControlFlowNode node, boolean branch) {
+  exists(Cfg::CompareNode cn | cn = g |
+    exists(ImmutableLiteral const, Cmpop op, Cfg::ControlFlowNode c |
      c.getNode() = const and
      (
        op = any(Eq eq) and branch = true
@@ -18,7 +19,7 @@ private predicate constCompare(DataFlow::GuardNode g, ControlFlowNode node, bool
      cn.operands(node, op, c)
    )
    or
-    exists(NameConstant const, Cmpop op, ControlFlowNode c |
+    exists(NameConstant const, Cmpop op, Cfg::ControlFlowNode c |
      c.getNode() = const and
      (
        op = any(Is is_) and branch = true
@@ -31,12 +32,12 @@ private predicate constCompare(DataFlow::GuardNode g, ControlFlowNode node, bool
      cn.operands(node, op, c)
    )
    or
-    exists(IterableNode const_iterable, Cmpop op |
+    exists(Cfg::IterableNode const_iterable, Cmpop op |
      op = any(In in_) and branch = true
      or
      op = any(NotIn ni) and branch = false
    |
-      forall(ControlFlowNode elem | elem = const_iterable.getAnElement() |
+      forall(Cfg::ControlFlowNode elem | elem = const_iterable.getAnElement() |
        elem.getNode() instanceof ImmutableLiteral
      ) and
      cn.operands(node, op, const_iterable)
--- a/python/ql/lib/semmle/python/dataflow/new/SensitiveDataSources.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/SensitiveDataSources.qll
@@ -4,6 +4,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 // Need to import `semmle.python.Frameworks` since frameworks can extend `SensitiveDataSource::Range`
 private import semmle.python.Frameworks
@@ -105,7 +106,7 @@ private module SensitiveDataModeling {
      or
      // to cover functions that we don't have the definition for, and where the
      // reference to the function has not already been marked as being sensitive
-      this.getFunction().asCfgNode().(NameNode).getId() = sensitiveString(classification)
+      this.getFunction().asCfgNode().(Cfg::NameNode).getId() = sensitiveString(classification)
    }

    override SensitiveDataClassification getClassification() { result = classification }
@@ -251,12 +252,12 @@ private module SensitiveDataModeling {
    SensitiveDataClassification classification;

    SensitiveVariableAssignment() {
-      exists(DefinitionNode def |
-        def.(NameNode).getId() = sensitiveString(classification) and
+      exists(Cfg::DefinitionNode def |
+        def.(Cfg::NameNode).getId() = sensitiveString(classification) and
        (
          this.asCfgNode() = def.getValue()
          or
-          this.asCfgNode() = def.getValue().(ForNode).getSequence()
+          this.asCfgNode() = def.getValue().(Cfg::ForNode).getSequence()
        ) and
        not this.asExpr() instanceof FunctionExpr and
        not this.asExpr() instanceof ClassExpr
@@ -293,7 +294,7 @@ private module SensitiveDataModeling {
    SensitiveDataClassification classification;

    SensitiveSubscript() {
-      this.asCfgNode().(SubscriptNode).getIndex() =
+      this.asCfgNode().(Cfg::SubscriptNode).getIndex() =
        sensitiveLookupStringConst(classification).asCfgNode()
    }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/Attributes.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/Attributes.qll
@@ -3,6 +3,7 @@ overlay[local]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import DataFlowUtil
 import DataFlowPublic
 private import DataFlowPrivate
@@ -83,9 +84,9 @@ abstract class AttrWrite extends AttrRef {
 * ```python
 * object.attr = value
 * ```
- * Also gives access to the `value` being written, by extending `DefinitionNode`.
+ * Also gives access to the `value` being written, by extending `Cfg::DefinitionNode`.
 */
-private class AttributeAssignmentNode extends DefinitionNode, AttrNode { }
+private class AttributeAssignmentNode extends Cfg::DefinitionNode, Cfg::AttrNode { }

 /** A simple attribute assignment: `object.attr = value`. */
 private class AttributeAssignmentAsAttrWrite extends AttrWrite, CfgNode {
@@ -131,13 +132,13 @@ private class GlobalAttributeAssignmentAsAttrWrite extends AttrWrite, CfgNode {
  override string getAttributeName() { result = node.getName() }
 }

-/** Represents `CallNode`s that may refer to calls to built-in functions or classes. */
-private class BuiltInCallNode extends CallNode {
+/** Represents `Cfg::CallNode`s that may refer to calls to built-in functions or classes. */
+private class BuiltInCallNode extends Cfg::CallNode {
  string name;

  BuiltInCallNode() {
    // TODO disallow instances where the name of the built-in may refer to an in-scope variable of that name.
-    exists(NameNode id |
+    exists(Cfg::NameNode id |
      name = Builtins::getBuiltinName() and
      this.getFunction() = id and
      id.getId() = name and
@@ -145,7 +146,7 @@ private class BuiltInCallNode extends CallNode {
    )
  }

-  /** Gets the name of the built-in function that is called at this `CallNode` */
+  /** Gets the name of the built-in function that is called at this `Cfg::CallNode` */
  string getBuiltinName() { result = name }
 }

@@ -157,20 +158,20 @@ private class BuiltinAttrCallNode extends BuiltInCallNode {
  BuiltinAttrCallNode() { name in ["setattr", "getattr", "hasattr", "delattr"] }

  /** Gets the control flow node for object on which the attribute is accessed. */
-  ControlFlowNode getObject() { result in [this.getArg(0), this.getArgByName("object")] }
+  Cfg::ControlFlowNode getObject() { result in [this.getArg(0), this.getArgByName("object")] }

  /**
   * Gets the control flow node for the value that is being written to the attribute.
   * Only relevant for `setattr` calls.
   */
-  ControlFlowNode getValue() {
+  Cfg::ControlFlowNode getValue() {
    // only valid for `setattr`
    name = "setattr" and
    result in [this.getArg(2), this.getArgByName("value")]
  }

  /** Gets the control flow node that defines the name of the attribute being accessed. */
-  ControlFlowNode getName() { result in [this.getArg(1), this.getArgByName("name")] }
+  Cfg::ControlFlowNode getName() { result in [this.getArg(1), this.getArgByName("name")] }
 }

 /** Represents calls to the built-in `setattr`. */
@@ -205,10 +206,10 @@ private class SetAttrCallAsAttrWrite extends AttrWrite, CfgNode {
 *     attr = value
 *     ...
 * ```
- * Instances of this class correspond to the `NameNode` for `attr`, and also gives access to `value` by
- * virtue of being a `DefinitionNode`.
+ * Instances of this class correspond to the `Cfg::NameNode` for `attr`, and also gives access to `value` by
+ * virtue of being a `Cfg::DefinitionNode`.
 */
-private class ClassAttributeAssignmentNode extends DefinitionNode, NameNode {
+private class ClassAttributeAssignmentNode extends Cfg::DefinitionNode, Cfg::NameNode {
  ClassAttributeAssignmentNode() { this.getScope() = any(ClassExpr c).getInnerScope() }
 }

@@ -248,7 +249,7 @@ abstract class AttrRead extends AttrRef, Node, LocalSourceNode {

 /** A simple attribute read, e.g. `object.attr` */
 private class AttributeReadAsAttrRead extends AttrRead, CfgNode {
-  override AttrNode node;
+  override Cfg::AttrNode node;

  AttributeReadAsAttrRead() { node.isLoad() }

@@ -285,7 +286,7 @@ private class GetAttrCallAsAttrRead extends AttrRead, CfgNode {
 * is treated as if it is a read of the attribute `module.attr`, even if `module` is not imported directly.
 */
 private class ModuleAttributeImportAsAttrRead extends AttrRead, CfgNode {
-  override ImportMemberNode node;
+  override Cfg::ImportMemberNode node;

  override Node getObject() { result.asCfgNode() = node.getModule(_) }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/Builtins.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/Builtins.qll
@@ -3,6 +3,7 @@ overlay[local]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.ImportStar

@@ -67,7 +68,7 @@ module Builtins {
  DataFlow::CfgNode likelyBuiltin(string name) {
    exists(Module m |
      result.getNode() =
-        any(NameNode n |
+        any(Cfg::NameNode n |
          possible_builtin_accessed_in_module(n, name, m) and
          not possible_builtin_defined_in_module(name, m)
        )
@@ -87,7 +88,7 @@ module Builtins {
   * Holds if `n` is an access of a global variable called `name` (which is also the name of a
   * built-in) inside the module `m`.
   */
-  private predicate possible_builtin_accessed_in_module(NameNode n, string name, Module m) {
+  private predicate possible_builtin_accessed_in_module(Cfg::NameNode n, string name, Module m) {
    n.isGlobal() and
    n.isLoad() and
    name = n.getId() and
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowDispatch.qll
@@ -25,7 +25,7 @@
 * what callable this call might end up targeting.
 *
 * Specifically this means that we cannot use type-backtrackers from the function of a
- * `CallNode`, since there is no `CallNode` to backtrack from for `func` in the example
+ * `Cfg::CallNode`, since there is no `Cfg::CallNode` to backtrack from for `func` in the example
 * above.
 *
 * Note: This hasn't been 100% realized yet, so we don't currently expose a predicate to
@@ -35,6 +35,7 @@ overlay[local?]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import DataFlowPublic
 private import DataFlowPrivate
 private import FlowSummaryImpl as FlowSummaryImpl
@@ -162,7 +163,7 @@ newtype TArgumentPosition =
   */
  TLambdaSelfArgumentPosition() or
  TPositionalArgumentPosition(int index) {
-    exists(any(CallNode c).getArg(index))
+    exists(any(Cfg::CallNode c).getArg(index))
    or
    // since synthetic calls within a summarized callable could use a unique argument
    // position, we need to ensure we make these available (these are specified as
@@ -174,7 +175,7 @@ newtype TArgumentPosition =
    index = 0
  } or
  TKeywordArgumentPosition(string name) {
-    exists(any(CallNode c).getArgByName(name))
+    exists(any(Cfg::CallNode c).getArgByName(name))
    or
    // see comment for TPositionalArgumentPosition
    FlowSummaryImpl::ParsePositions::isParsedKeywordParameterPosition(_, name)
@@ -297,10 +298,12 @@ predicate hasPropertyDecorator(Function func) {
 */
 overlay[local]
 predicate hasContextmanagerDecorator(Function func) {
-  exists(ControlFlowNode contextmanager |
-    contextmanager.(NameNode).getId() = "contextmanager" and contextmanager.(NameNode).isGlobal()
+  exists(Cfg::ControlFlowNode contextmanager |
+    contextmanager.(Cfg::NameNode).getId() = "contextmanager" and
+    contextmanager.(Cfg::NameNode).isGlobal()
    or
-    contextmanager.(AttrNode).getObject("contextmanager").(NameNode).getId() = "contextlib"
+    contextmanager.(Cfg::AttrNode).getObject("contextmanager").(Cfg::NameNode).getId() =
+      "contextlib"
  |
    func.getADecorator() = contextmanager.getNode()
  )
@@ -316,10 +319,10 @@ predicate hasContextmanagerDecorator(Function func) {
 */
 overlay[local]
 private predicate hasOverloadDecorator(Function func) {
-  exists(ControlFlowNode overload |
-    overload.(NameNode).getId() = "overload" and overload.(NameNode).isGlobal()
+  exists(Cfg::ControlFlowNode overload |
+    overload.(Cfg::NameNode).getId() = "overload" and overload.(Cfg::NameNode).isGlobal()
    or
-    overload.(AttrNode).getObject("overload").(NameNode).isGlobal()
+    overload.(Cfg::AttrNode).getObject("overload").(Cfg::NameNode).isGlobal()
  |
    func.getADecorator() = overload.getNode()
  )
@@ -538,7 +541,7 @@ class LibraryCallableValue extends DataFlowCallable, TLibraryCallable {
 // =============================================================================
 /** Gets a call to `type`. */
 private CallCfgNode getTypeCall() {
-  exists(NameNode id | id.getId() = "type" and id.isGlobal() |
+  exists(Cfg::NameNode id | id.getId() = "type" and id.isGlobal() |
    result.getFunction().asCfgNode() = id
  )
 }
@@ -550,7 +553,7 @@ private CallCfgNode getSuperCall() {
  // link below), but otherwise only 2 edgecases. Overall it seems ok to ignore this complexity.
  //
  // https://github.com/python/cpython/blob/18b1782192f85bd26db89f5bc850f8bee4247c1a/Lib/unittest/mock.py#L48-L50
-  exists(NameNode id | id.getId() = "super" and id.isGlobal() |
+  exists(Cfg::NameNode id | id.getId() = "super" and id.isGlobal() |
    result.getFunction().asCfgNode() = id
  )
 }
@@ -1036,7 +1039,7 @@ private module MethodCalls {
   */
  pragma[nomagic]
  private predicate directCall(
-    CallNode call, Function target, string functionName, Class cls, AttrRead attr, Node self
+    Cfg::CallNode call, Function target, string functionName, Class cls, AttrRead attr, Node self
  ) {
    target = findFunctionAccordingToMroKnownStartingClass(cls, functionName) and
    directCall_join(call, functionName, cls, attr, self)
@@ -1045,7 +1048,7 @@ private module MethodCalls {
  /** Extracted to give good join order */
  pragma[nomagic]
  private predicate directCall_join(
-    CallNode call, string functionName, Class cls, AttrRead attr, Node self
+    Cfg::CallNode call, string functionName, Class cls, AttrRead attr, Node self
  ) {
    call.getFunction() = attrReadTracker(attr).asCfgNode() and
    attr.accesses(self, functionName) and
@@ -1062,7 +1065,7 @@ private module MethodCalls {
   */
  pragma[nomagic]
  private predicate callWithinMethodImplicitSelfOrCls(
-    CallNode call, Function target, string functionName, Class classWithMethod, AttrRead attr,
+    Cfg::CallNode call, Function target, string functionName, Class classWithMethod, AttrRead attr,
    Node self
  ) {
    target = findFunctionAccordingToMro(getADirectSubclass*(classWithMethod), functionName) and
@@ -1072,7 +1075,7 @@ private module MethodCalls {
  /** Extracted to give good join order */
  pragma[nomagic]
  private predicate callWithinMethodImplicitSelfOrCls_join(
-    CallNode call, string functionName, Class classWithMethod, AttrRead attr, Node self
+    Cfg::CallNode call, string functionName, Class classWithMethod, AttrRead attr, Node self
  ) {
    call.getFunction() = attrReadTracker(attr).asCfgNode() and
    attr.accesses(self, functionName) and
@@ -1084,7 +1087,7 @@ private module MethodCalls {
   * resolve the call to a known target (since the only super class might be the
   * builtin `object`, so we never have the implementation of `__new__` in the DB).
   */
-  predicate fromSuperNewCall(CallNode call, Class classUsedInSuper, AttrRead attr, Node self) {
+  predicate fromSuperNewCall(Cfg::CallNode call, Class classUsedInSuper, AttrRead attr, Node self) {
    fromSuper_join(call, "__new__", classUsedInSuper, attr, self) and
    self in [classTracker(_), clsArgumentTracker(_)]
  }
@@ -1106,7 +1109,7 @@ private module MethodCalls {
   */
  pragma[nomagic]
  predicate fromSuper(
-    CallNode call, Function target, string functionName, Class classUsedInSuper, AttrRead attr,
+    Cfg::CallNode call, Function target, string functionName, Class classUsedInSuper, AttrRead attr,
    Node self
  ) {
    target = findFunctionAccordingToMro(getNextClassInMro(classUsedInSuper), functionName) and
@@ -1116,7 +1119,7 @@ private module MethodCalls {
  /** Extracted to give good join order */
  pragma[nomagic]
  private predicate fromSuper_join(
-    CallNode call, string functionName, Class classUsedInSuper, AttrRead attr, Node self
+    Cfg::CallNode call, string functionName, Class classUsedInSuper, AttrRead attr, Node self
  ) {
    call.getFunction() = attrReadTracker(attr).asCfgNode() and
    (
@@ -1135,7 +1138,7 @@ private module MethodCalls {
    )
  }

-  predicate resolveMethodCall(CallNode call, Function target, CallType type, Node self) {
+  predicate resolveMethodCall(Cfg::CallNode call, Function target, CallType type, Node self) {
    (
      directCall(call, target, _, _, _, self)
      or
@@ -1182,7 +1185,7 @@ import MethodCalls
 * NOTE: We have this predicate mostly to be able to compare with old point-to
 * call-graph resolution. So it could be removed in the future.
 */
-predicate resolveClassCall(CallNode call, Class cls) {
+predicate resolveClassCall(Cfg::CallNode call, Class cls) {
  call.getFunction() = classTracker(cls).asCfgNode()
  or
  // `cls()` inside a classmethod (which also contains `type(self)()` inside a method)
@@ -1212,7 +1215,7 @@ Function invokedFunctionFromClassConstruction(Class cls, string funcName) {
 *
 * See https://docs.python.org/3/reference/datamodel.html#object.__call__
 */
-predicate resolveClassInstanceCall(CallNode call, Function target, Node self) {
+predicate resolveClassInstanceCall(Cfg::CallNode call, Function target, Node self) {
  exists(Class cls |
    call.getFunction() = classInstanceTracker(cls).asCfgNode() and
    target = findFunctionAccordingToMroKnownStartingClass(cls, "__call__")
@@ -1231,7 +1234,7 @@ predicate resolveClassInstanceCall(CallNode call, Function target, Node self) {
 * Holds if `call` is a call to the `target`, with call-type `type`.
 */
 cached
-predicate resolveCall(CallNode call, Function target, CallType type) {
+predicate resolveCall(Cfg::CallNode call, Function target, CallType type) {
  Stages::DataFlow::ref() and
  (
    type instanceof CallTypePlainFunction and
@@ -1256,11 +1259,11 @@ predicate resolveCall(CallNode call, Function target, CallType type) {
 // =============================================================================
 /**
 * Holds if the argument of `call` at position `apos` is `arg`. This is just a helper
- * predicate that maps ArgumentPositions to the arguments of the underlying `CallNode`.
+ * predicate that maps ArgumentPositions to the arguments of the underlying `Cfg::CallNode`.
 */
 overlay[local]
 cached
-predicate normalCallArg(CallNode call, Node arg, ArgumentPosition apos) {
+predicate normalCallArg(Cfg::CallNode call, Node arg, ArgumentPosition apos) {
  exists(int index |
    apos.isPositional(index) and
    arg.asCfgNode() = call.getArg(index)
@@ -1275,7 +1278,7 @@ predicate normalCallArg(CallNode call, Node arg, ArgumentPosition apos) {
  exists(int index |
    apos.isStarArgs(index) and
    arg.asCfgNode() = call.getStarArg() and
-    // since `CallNode.getArg` doesn't include `*args`, we need to drop to the AST level
+    // since `Cfg::CallNode.getArg` doesn't include `*args`, we need to drop to the AST level
    // to get the index. Notice that we only use the AST for getting the index, so we
    // don't need to check for dominance in regards to splitting.
    call.getStarArg().getNode() = call.getNode().getPositionalArg(index).(Starred).getValue()
@@ -1349,7 +1352,9 @@ predicate normalCallArg(CallNode call, Node arg, ArgumentPosition apos) {
 * translated into `l.clear()`, and we can still have use-use flow.
 */
 cached
-predicate getCallArg(CallNode call, Function target, CallType type, Node arg, ArgumentPosition apos) {
+predicate getCallArg(
+  Cfg::CallNode call, Function target, CallType type, Node arg, ArgumentPosition apos
+) {
  Stages::DataFlow::ref() and
  resolveCall(call, target, type) and
  (
@@ -1442,10 +1447,12 @@ private predicate sameEnclosingCallable(Node node1, Node node2) {
 // DataFlowCall
 // =============================================================================
 newtype TDataFlowCall =
-  TNormalCall(CallNode call, Function target, CallType type) { resolveCall(call, target, type) } or
+  TNormalCall(Cfg::CallNode call, Function target, CallType type) {
+    call.injects(_) and resolveCall(call, target, type)
+  } or
  /** A call to the generated function inside a comprehension */
  TComprehensionCall(Comp c) or
-  TPotentialLibraryCall(CallNode call) or
+  TPotentialLibraryCall(Cfg::CallNode call) { call.injects(_) } or
  /** A synthesized call inside a summarized callable */
  TSummaryCall(
    FlowSummaryImpl::Public::SummarizedCallable c, FlowSummaryImpl::Private::SummaryNode receiver
@@ -1465,7 +1472,7 @@ abstract class DataFlowCall extends TDataFlowCall {
  abstract ArgumentNode getArgument(ArgumentPosition apos);

  /** Get the control flow node representing this call, if any. */
-  abstract ControlFlowNode getNode();
+  abstract Cfg::ControlFlowNode getNode();

  /** Gets the enclosing callable of this call. */
  DataFlowCallable getEnclosingCallable() { result = getCallableScope(this.getScope()) }
@@ -1496,28 +1503,28 @@ abstract class ExtractedDataFlowCall extends DataFlowCall {
 }

 /**
- * A resolved call in source code with an underlying `CallNode`.
+ * A resolved call in source code with an underlying `Cfg::CallNode`.
 *
 * This is considered normal, compared with special calls such as `obj[0]` calling the
 * `__getitem__` method on the object. However, this also includes calls that go to the
 * `__call__` special method.
 */
 class NormalCall extends ExtractedDataFlowCall, TNormalCall {
-  CallNode call;
+  Cfg::CallNode call;
  Function target;
  CallType type;

  NormalCall() { this = TNormalCall(call, target, type) }

  override string toString() {
-    // note: if we used toString directly on the CallNode we would get
-    //     `ControlFlowNode for func()`
-    // but the `ControlFlowNode` part is just clutter, so we go directly to the AST node
+    // note: if we used toString directly on the Cfg::CallNode we would get
+    //     `Cfg::ControlFlowNode for func()`
+    // but the `Cfg::ControlFlowNode` part is just clutter, so we go directly to the AST node
    // instead.
    result = call.getNode().toString()
  }

-  override ControlFlowNode getNode() { result = call }
+  override Cfg::ControlFlowNode getNode() { result = call }

  override Scope getScope() { result = call.getScope() }

@@ -1545,7 +1552,7 @@ class ComprehensionCall extends ExtractedDataFlowCall, TComprehensionCall {

  override string toString() { result = "comprehension call" }

-  override ControlFlowNode getNode() { result.getNode() = c }
+  override Cfg::ControlFlowNode getNode() { result.getNode() = c }

  override Scope getScope() { result = c.getScope() }

@@ -1568,14 +1575,14 @@ class ComprehensionCall extends ExtractedDataFlowCall, TComprehensionCall {
 * in this class.
 */
 class PotentialLibraryCall extends ExtractedDataFlowCall, TPotentialLibraryCall {
-  CallNode call;
+  Cfg::CallNode call;

  PotentialLibraryCall() { this = TPotentialLibraryCall(call) }

  override string toString() {
-    // note: if we used toString directly on the CallNode we would get
-    //     `ControlFlowNode for func()`
-    // but the `ControlFlowNode` part is just clutter, so we go directly to the AST node
+    // note: if we used toString directly on the Cfg::CallNode we would get
+    //     `Cfg::ControlFlowNode for func()`
+    // but the `Cfg::ControlFlowNode` part is just clutter, so we go directly to the AST node
    // instead.
    result = call.getNode().toString()
  }
@@ -1592,10 +1599,10 @@ class PotentialLibraryCall extends ExtractedDataFlowCall, TPotentialLibraryCall
    // potential self argument, from `foo.bar()` -- note that this could also just be a
    // module reference, but we really don't have a good way of knowing :|
    apos.isSelf() and
-    result.asCfgNode() = call.getFunction().(AttrNode).getObject()
+    result.asCfgNode() = call.getFunction().(Cfg::AttrNode).getObject()
  }

-  override ControlFlowNode getNode() { result = call }
+  override Cfg::ControlFlowNode getNode() { result = call }

  override Scope getScope() { result = call.getScope() }
 }
@@ -1627,7 +1634,7 @@ class SummaryCall extends DataFlowCall, TSummaryCall {

  override ArgumentNode getArgument(ArgumentPosition apos) { none() }

-  override ControlFlowNode getNode() { none() }
+  override Cfg::ControlFlowNode getNode() { none() }

  override string toString() { result = "[summary] call to " + receiver + " in " + c }

@@ -1769,12 +1776,12 @@ private class SummaryPostUpdateNode extends FlowSummaryNode, PostUpdateNodeImpl
 * This is used for tracking flow through captured variables.
 */
 class SynthCapturedVariablesArgumentNode extends Node, TSynthCapturedVariablesArgumentNode {
-  ControlFlowNode callable;
+  Cfg::ControlFlowNode callable;

  SynthCapturedVariablesArgumentNode() { this = TSynthCapturedVariablesArgumentNode(callable) }

-  /** Gets the `CallNode` corresponding to this captured variables argument node. */
-  CallNode getCallNode() { result.getFunction() = callable }
+  /** Gets the `Cfg::CallNode` corresponding to this captured variables argument node. */
+  Cfg::CallNode getCallNode() { result.getFunction() = callable }

  /** Gets the `CfgNode` that corresponds to this synthetic node. */
  CfgNode getUnderlyingNode() { result.asCfgNode() = callable }
@@ -1792,7 +1799,7 @@ class CapturedVariablesArgumentNodeAsArgumentNode extends ArgumentNode,
 {
  overlay[global]
  override predicate argumentOf(DataFlowCall call, ArgumentPosition pos) {
-    exists(CallNode callNode | callNode = this.getCallNode() |
+    exists(Cfg::CallNode callNode | callNode = this.getCallNode() |
      callNode = call.getNode() and
      exists(Function target | resolveCall(callNode, target, _) |
        target = any(VariableCapture::CapturedVariable v).getACapturingScope()
@@ -1806,7 +1813,7 @@ class CapturedVariablesArgumentNodeAsArgumentNode extends ArgumentNode,
 class SynthCapturedVariablesArgumentPostUpdateNode extends PostUpdateNodeImpl,
  TSynthCapturedVariablesArgumentPostUpdateNode
 {
-  ControlFlowNode callable;
+  Cfg::ControlFlowNode callable;

  SynthCapturedVariablesArgumentPostUpdateNode() {
    this = TSynthCapturedVariablesArgumentPostUpdateNode(callable)
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPrivate.qll
@@ -2,8 +2,9 @@ overlay[local?]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import DataFlowPublic
-private import semmle.python.essa.SsaCompute
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
 private import semmle.python.dataflow.new.internal.ImportResolution
 private import FlowSummaryImpl as FlowSummaryImpl
 private import semmle.python.frameworks.data.ModelsAsData
@@ -43,13 +44,28 @@ predicate isArgumentNode(ArgumentNode arg, DataFlowCall c, ArgumentPosition pos)
 // Nodes
 //--------
 overlay[local]
-predicate isExpressionNode(ControlFlowNode node) { node.getNode() instanceof Expr }
+predicate isExpressionNode(Cfg::ControlFlowNode node) {
+  // Restrict to the `injects` representative so the dataflow layer creates
+  // exactly one `TCfgNode` per AST expression.
+  node.injects(_) and
+  (
+    node.getNode() instanceof Expr
+    or
+    // `Cfg::ForNode` wraps a `For` statement's iter position, but
+    // overrides `.getNode()` to return the `Py::For` statement (for
+    // legacy parity). The underlying AST is still an `Expr` (the iter
+    // expression); we want a dataflow node here so that for-loop
+    // content reads (`for y in l`) have a source expression node to
+    // read content from.
+    node instanceof Cfg::ForNode
+  )
+}

 // =============================================================================
 // SyntheticPreUpdateNode
 // =============================================================================
 class SyntheticPreUpdateNode extends Node, TSyntheticPreUpdateNode {
-  CallNode node;
+  Cfg::CallNode node;

  SyntheticPreUpdateNode() { this = TSyntheticPreUpdateNode(node) }

@@ -151,7 +167,7 @@ predicate synthStarArgsElementParameterNodeStoreStep(
 * been passed in a `**kwargs` argument.
 */
 class SynthDictSplatArgumentNode extends Node, TSynthDictSplatArgumentNode {
-  CallNode node;
+  Cfg::CallNode node;

  SynthDictSplatArgumentNode() { this = TSynthDictSplatArgumentNode(node) }

@@ -165,7 +181,7 @@ class SynthDictSplatArgumentNode extends Node, TSynthDictSplatArgumentNode {
 private predicate synthDictSplatArgumentNodeStoreStep(
  ArgumentNode nodeFrom, DictionaryElementContent c, SynthDictSplatArgumentNode nodeTo
 ) {
-  exists(string name, CallNode call, ArgumentPosition keywordPos |
+  exists(string name, Cfg::CallNode call, ArgumentPosition keywordPos |
    nodeTo = TSynthDictSplatArgumentNode(call) and
    getCallArg(call, _, _, nodeFrom, keywordPos) and
    keywordPos.isKeyword(name) and
@@ -289,7 +305,7 @@ abstract class PostUpdateNodeImpl extends Node {
 * Synthetic post-update nodes for synthetic nodes need to be listed one by one.
 */
 class SyntheticPostUpdateNode extends PostUpdateNodeImpl, TSyntheticPostUpdateNode {
-  ControlFlowNode node;
+  Cfg::ControlFlowNode node;

  SyntheticPostUpdateNode() { this = TSyntheticPostUpdateNode(node) }

@@ -333,16 +349,42 @@ module LocalFlow {
    //   `x = f(42)`
    //   nodeFrom is `f(42)`
    //   nodeTo is `x`
-    exists(AssignmentDefinition def |
+    //
+    // We use the CFG-level `DefinitionNode.getValue()` directly rather
+    // than going through SSA, because the new SSA library prunes write
+    // definitions that have no subsequent read in the same scope (e.g.
+    // a module-level `def f():` whose `f` is only read inside other
+    // functions). The CFG-level link is unconditional.
+    //
+    // The Name-target restriction mirrors legacy ESSA's
+    // `SsaDefinitions::assignment_definition`, which required
+    // `defn.(NameNode).defines(v)`. Subscript and attribute writes
+    // (`x[i] = 42`, `obj.attr = 42`) are intentionally excluded — their
+    // value flow is handled by the content-flow / `AttrWrite` machinery,
+    // not by a local-flow step *into* the Subscript/Attribute expression.
+    // Excluding them is essential for keeping augmented-assignment
+    // targets (`x[i] += 42`) classifiable as `LocalSourceNode` on the
+    // read side: the single canonical CFG node is both a load and a
+    // store, and any incoming local-flow step would disqualify it from
+    // being a local source.
+    exists(Cfg::DefinitionNode def |
      nodeFrom.(CfgNode).getNode() = def.getValue() and
-      nodeTo.(CfgNode).getNode() = def.getDefiningNode()
+      nodeTo.(CfgNode).getNode() = def and
+      def instanceof Cfg::NameNode and
+      // Parameter defaults are evaluated in the enclosing scope, while the
+      // parameter itself lives in the function's scope. The cross-scope
+      // edge is provided by `runtimeJumpStep` instead.
+      not exists(Py::Parameter param | def.getNode() = param.asName())
    )
    or
    // With definition
    //   `with f(42) as x:`
    //   nodeFrom is `f(42)`
    //   nodeTo is `x`
-    exists(With with, ControlFlowNode contextManager, WithDefinition withDef, ControlFlowNode var |
+    exists(
+      With with, Cfg::ControlFlowNode contextManager, SsaImpl::WithDefinition withDef,
+      Cfg::ControlFlowNode var
+    |
      var = withDef.getDefiningNode()
    |
      nodeFrom.(CfgNode).getNode() = contextManager and
@@ -361,13 +403,13 @@ module LocalFlow {

  predicate expressionFlowStep(Node nodeFrom, Node nodeTo) {
    // If expressions
-    nodeFrom.asCfgNode() = nodeTo.asCfgNode().(IfExprNode).getAnOperand()
+    nodeFrom.asCfgNode() = nodeTo.asCfgNode().(Cfg::IfExprNode).getAnOperand()
    or
    // Assignment expressions
-    nodeFrom.asCfgNode() = nodeTo.asCfgNode().(AssignmentExprNode).getValue()
+    nodeFrom.asCfgNode() = nodeTo.asCfgNode().(Cfg::AssignmentExprNode).getValue()
    or
    // boolean inline expressions such as `x or y` or `x and y`
-    nodeFrom.asCfgNode() = nodeTo.asCfgNode().(BoolExprNode).getAnOperand()
+    nodeFrom.asCfgNode() = nodeTo.asCfgNode().(Cfg::BoolExprNode).getAnOperand()
    or
    // Flow inside an unpacking assignment
    iterableUnpackingFlowStep(nodeFrom, nodeTo)
@@ -376,12 +418,25 @@ module LocalFlow {
    matchFlowStep(nodeFrom, nodeTo)
  }

-  predicate useToNextUse(NameNode nodeFrom, NameNode nodeTo) {
-    AdjacentUses::adjacentUseUse(nodeFrom, nodeTo)
+  predicate useToNextUse(Cfg::NameNode nodeFrom, Cfg::NameNode nodeTo) {
+    // The SSA-level adjacent-use predicate works on specific CFG variants
+    // (e.g. boolean-outcome `[true]`/`[false]` or emptiness `[empty]`/`[non-empty]`
+    // splits of the same AST node), but dataflow values are insensitive to
+    // those splits — there is at most one `CfgNode` per AST. Project both
+    // ends through `.getNode()` so all variants contribute their use-use
+    // edges to the canonical pair.
+    exists(Cfg::NameNode fromVariant, Cfg::NameNode toVariant |
+      SsaImpl::AdjacentUses::adjacentUseUse(fromVariant, toVariant) and
+      fromVariant.getNode() = nodeFrom.getNode() and
+      toVariant.getNode() = nodeTo.getNode()
+    )
  }

-  predicate defToFirstUse(EssaVariable var, NameNode nodeTo) {
-    AdjacentUses::firstUse(var.getDefinition(), nodeTo)
+  predicate defToFirstUse(SsaImpl::EssaVariable var, Cfg::NameNode nodeTo) {
+    exists(Cfg::NameNode toVariant |
+      SsaImpl::AdjacentUses::firstUse(var.getDefinition(), toVariant) and
+      toVariant.getNode() = nodeTo.getNode()
+    )
  }

  predicate useUseFlowStep(Node nodeFrom, Node nodeTo) {
@@ -390,12 +445,13 @@ module LocalFlow {
    //   `x = f(y)`
    //   nodeFrom is `y` on first line
    //   nodeTo is `y` on second line
-    exists(EssaDefinition def |
-      nodeFrom.(CfgNode).getNode() = def.(EssaNodeDefinition).getDefiningNode()
+    exists(SsaImpl::EssaDefinition def, Cfg::NameNode toVariant |
+      nodeFrom.(CfgNode).getNode() = def.(SsaImpl::EssaNodeDefinition).getDefiningNode()
      or
      nodeFrom.(ScopeEntryDefinitionNode).getDefinition() = def
    |
-      AdjacentUses::firstUse(def, nodeTo.(CfgNode).getNode())
+      SsaImpl::AdjacentUses::firstUse(def, toVariant) and
+      toVariant.getNode() = nodeTo.(CfgNode).getNode().getNode()
    )
    or
    // Next use after use
@@ -557,9 +613,9 @@ predicate runtimeJumpStep(Node nodeFrom, Node nodeTo) {
  // a parameter with a default value, since the parameter will be in the scope of the
  // function, while the default value itself will be in the scope that _defines_ the
  // function.
-  exists(ParameterDefinition param |
+  exists(SsaImpl::ParameterDefinition param |
    // note: we go to the _control-flow node_ of the parameter, and not the ESSA node of the parameter, since for type-tracking, the ESSA node is not a LocalSourceNode, so we would get in trouble.
-    nodeFrom.asCfgNode() = param.getDefault() and
+    nodeFrom.asCfgNode().getNode() = param.getParameter().(Parameter).getDefault() and
    nodeTo.asCfgNode() = param.getDefiningNode()
  )
  or
@@ -663,7 +719,7 @@ predicate neverSkipInPathGraph(Node n) {
  // ```
  // we would end up saying that the path MUST not skip the x in `y = x`, which is just
  // annoying and doesn't help the path explanation become clearer.
-  n.asCfgNode() = any(EssaNodeDefinition def).getDefiningNode()
+  n.asCfgNode() = any(SsaImpl::EssaNodeDefinition def).getDefiningNode()
 }

 /**
@@ -874,7 +930,7 @@ predicate listStoreStep(CfgNode nodeFrom, ListElementContent c, CfgNode nodeTo)
  //   nodeFrom is `42`, cfg node
  //   nodeTo is the list, `[..., 42, ...]`, cfg node
  //   c denotes element of list
-  nodeTo.getNode().(ListNode).getAnElement() = nodeFrom.getNode() and
+  nodeTo.getNode().(Cfg::ListNode).getAnElement() = nodeFrom.getNode() and
  not nodeTo.getNode() instanceof UnpackingAssignmentSequenceTarget and
  // Suppress unused variable warning
  c = c
@@ -887,7 +943,7 @@ predicate setStoreStep(CfgNode nodeFrom, SetElementContent c, CfgNode nodeTo) {
  //   nodeFrom is `42`, cfg node
  //   nodeTo is the set, `{..., 42, ...}`, cfg node
  //   c denotes element of list
-  nodeTo.getNode().(SetNode).getAnElement() = nodeFrom.getNode() and
+  nodeTo.getNode().(Cfg::SetNode).getAnElement() = nodeFrom.getNode() and
  // Suppress unused variable warning
  c = c
 }
@@ -900,7 +956,7 @@ predicate tupleStoreStep(CfgNode nodeFrom, TupleElementContent c, CfgNode nodeTo
  //   nodeTo is the tuple, `(..., 42, ...)`, cfg node
  //   c denotes element of tuple and index of nodeFrom
  exists(int n |
-    nodeTo.getNode().(TupleNode).getElement(n) = nodeFrom.getNode() and
+    nodeTo.getNode().(Cfg::TupleNode).getElement(n) = nodeFrom.getNode() and
    not nodeTo.getNode() instanceof UnpackingAssignmentSequenceTarget and
    c.getIndex() = n
  )
@@ -914,7 +970,7 @@ predicate dictStoreStep(CfgNode nodeFrom, DictionaryElementContent c, Node nodeT
  //   nodeTo is the dict, `{..., "key" = 42, ...}`, cfg node
  //   c denotes element of dictionary and the key `"key"`
  exists(KeyValuePair item |
-    item = nodeTo.asCfgNode().(DictNode).getNode().(Dict).getAnItem() and
+    item = nodeTo.asCfgNode().(Cfg::DictNode).getNode().(Dict).getAnItem() and
    nodeFrom.getNode().getNode() = item.getValue() and
    c.getKey() = item.getKey().(StringLiteral).getS()
  )
@@ -929,9 +985,9 @@ predicate dictStoreStep(CfgNode nodeFrom, DictionaryElementContent c, Node nodeT
 private predicate moreDictStoreSteps(CfgNode nodeFrom, DictionaryElementContent c, Node nodeTo) {
  // NOTE: It's important to add logic to the newtype definition of
  // DictionaryElementContent if you add new cases here.
-  exists(SubscriptNode subscript |
+  exists(Cfg::SubscriptNode subscript |
    nodeTo.(PostUpdateNode).getPreUpdateNode().asCfgNode() = subscript.getObject() and
-    nodeFrom.asCfgNode() = subscript.(DefinitionNode).getValue() and
+    nodeFrom.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
    c.getKey() = subscript.getIndex().getNode().(StringLiteral).getText()
  )
  or
@@ -944,8 +1000,8 @@ private predicate moreDictStoreSteps(CfgNode nodeFrom, DictionaryElementContent
 }

 predicate dictClearStep(Node node, DictionaryElementContent c) {
-  exists(SubscriptNode subscript |
-    subscript instanceof DefinitionNode and
+  exists(Cfg::SubscriptNode subscript |
+    subscript instanceof Cfg::DefinitionNode and
    node.asCfgNode() = subscript.getObject() and
    c.getKey() = subscript.getIndex().getNode().(StringLiteral).getText()
  )
@@ -1024,7 +1080,7 @@ predicate subscriptReadStep(CfgNode nodeFrom, Content c, CfgNode nodeTo) {
  //   nodeFrom is `l`, cfg node
  //   nodeTo is `l[3]`, cfg node
  //   c is compatible with 3
-  nodeFrom.getNode() = nodeTo.getNode().(SubscriptNode).getObject() and
+  nodeFrom.getNode() = nodeTo.getNode().(Cfg::SubscriptNode).getObject() and
  (
    c instanceof ListElementContent
    or
@@ -1033,10 +1089,10 @@ predicate subscriptReadStep(CfgNode nodeFrom, Content c, CfgNode nodeTo) {
    c instanceof DictionaryElementAnyContent
    or
    c.(TupleElementContent).getIndex() =
-      nodeTo.getNode().(SubscriptNode).getIndex().getNode().(IntegerLiteral).getValue()
+      nodeTo.getNode().(Cfg::SubscriptNode).getIndex().getNode().(IntegerLiteral).getValue()
    or
    c.(DictionaryElementContent).getKey() =
-      nodeTo.getNode().(SubscriptNode).getIndex().getNode().(StringLiteral).getS()
+      nodeTo.getNode().(Cfg::SubscriptNode).getIndex().getNode().(StringLiteral).getS()
  )
 }

@@ -1091,7 +1147,7 @@ module Conversions {

  predicate formatReadStep(Node nodeFrom, ContentSet c, Node nodeTo) {
    // % formatting
-    exists(BinaryExprNode fmt | fmt = nodeTo.asCfgNode() |
+    exists(Cfg::BinaryExprNode fmt | fmt = nodeTo.asCfgNode() |
      fmt.getOp() instanceof Mod and
      fmt.getRight() = nodeFrom.asCfgNode()
    ) and
--- a/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/DataFlowPublic.qll
@@ -5,11 +5,14 @@ overlay[local]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
+private import codeql.controlflow.SuccessorType
 private import DataFlowPrivate
 import semmle.python.dataflow.new.TypeTracking
 import Attributes
 import LocalSources
-private import semmle.python.essa.SsaCompute
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
 private import semmle.python.dataflow.new.internal.ImportStar
 private import semmle.python.frameworks.data.ModelsAsData
 private import FlowSummaryImpl as FlowSummaryImpl
@@ -27,16 +30,18 @@ private import semmle.python.frameworks.data.ModelsAsData
 overlay[local]
 newtype TNode =
  /** A node corresponding to a control flow node. */
-  TCfgNode(ControlFlowNode node) {
+  TCfgNode(Cfg::ControlFlowNode node) {
    isExpressionNode(node)
    or
-    node.getNode() instanceof Pattern
+    node.injects(_) and node.getNode() instanceof Pattern
  } or
  /**
   * A node corresponding to a scope entry definition. That is, the value of a variable
   * as it enters a scope.
   */
-  TScopeEntryDefinitionNode(ScopeEntryDefinition def) { not def.getScope() instanceof Module } or
+  TScopeEntryDefinitionNode(SsaImpl::ScopeEntryDefinition def) {
+    not def.getScope() instanceof Module
+  } or
  /**
   * A synthetic node representing the value of an object before a state change.
   *
@@ -47,13 +52,15 @@ newtype TNode =
  // NOTE: since we can't rely on the call graph, but we want to have synthetic
  // pre-update nodes for class calls, we end up getting synthetic pre-update nodes for
  // ALL calls :|
-  TSyntheticPreUpdateNode(CallNode call) or
+  TSyntheticPreUpdateNode(Cfg::CallNode call) { call.injects(_) } or
  /**
   * A synthetic node representing the value of an object after a state change.
   * See QLDoc for `PostUpdateNode`.
   */
-  TSyntheticPostUpdateNode(ControlFlowNode node) {
-    exists(CallNode call |
+  TSyntheticPostUpdateNode(Cfg::ControlFlowNode node) {
+    node.injects(_) and
+    (
+    exists(Cfg::CallNode call |
      node = call.getArg(_)
      or
      node = call.getArgByName(_)
@@ -62,12 +69,12 @@ newtype TNode =
      node = call.getFunction()
    )
    or
-    node = any(AttrNode a).getObject()
+    node = any(Cfg::AttrNode a).getObject()
    or
-    node = any(SubscriptNode s).getObject()
+    node = any(Cfg::SubscriptNode s).getObject()
    or
    // self parameter when used implicitly in `super()`
-    exists(Class cls, Function func, ParameterDefinition def |
+    exists(Class cls, Function func, SsaImpl::ParameterDefinition def |
      func = cls.getAMethod() and
      not isStaticmethod(func) and
      // this matches what we do in ExtractedParameterNode
@@ -77,6 +84,7 @@ newtype TNode =
    or
    // the iterable argument to the implicit comprehension function
    node.getNode() = any(Comp c).getIterable()
+    )
  } or
  /** A node representing a global (module-level) variable in a specific module. */
  TModuleVariableNode(Module m, GlobalVariable v) { v.getScope() = m } or
@@ -112,7 +120,9 @@ newtype TNode =
    exists(ParameterPosition ppos | ppos.isStarArgs(_) | exists(callable.getParameter(ppos)))
  } or
  /** A synthetic node to capture keyword arguments that are passed to a `**kwargs` parameter. */
-  TSynthDictSplatArgumentNode(CallNode call) { exists(call.getArgByName(_)) } or
+  TSynthDictSplatArgumentNode(Cfg::CallNode call) {
+    call.injects(_) and exists(call.getArgByName(_))
+  } or
  /** A synthetic node to allow flow to keyword parameters from a `**kwargs` argument. */
  TSynthDictSplatParameterNode(DataFlowCallable callable) {
    exists(ParameterPosition ppos | ppos.isKeyword(_) | exists(callable.getParameter(ppos)))
@@ -128,15 +138,15 @@ newtype TNode =
   * A synthetic node representing the values of the variables captured
   * by the callable being called.
   */
-  TSynthCapturedVariablesArgumentNode(ControlFlowNode callable) {
-    callable = any(CallNode c).getFunction()
+  TSynthCapturedVariablesArgumentNode(Cfg::ControlFlowNode callable) {
+    callable.injects(_) and callable = any(Cfg::CallNode c).getFunction()
  } or
  /**
   * A synthetic node representing the values of the variables captured
   * by the callable being called, after the output has been computed.
   */
-  TSynthCapturedVariablesArgumentPostUpdateNode(ControlFlowNode callable) {
-    callable = any(CallNode c).getFunction()
+  TSynthCapturedVariablesArgumentPostUpdateNode(Cfg::ControlFlowNode callable) {
+    callable.injects(_) and callable = any(Cfg::CallNode c).getFunction()
  } or
  /** A synthetic node representing the values of variables captured by a comprehension. */
  TSynthCompCapturedVariablesArgumentNode(Comp comp) {
@@ -194,7 +204,7 @@ class Node extends TNode {
  }

  /** Gets the control-flow node corresponding to this node, if any. */
-  ControlFlowNode asCfgNode() { none() }
+  Cfg::ControlFlowNode asCfgNode() { none() }

  /** Gets the expression corresponding to this node, if any. */
  Expr asExpr() { none() }
@@ -207,14 +217,14 @@ class Node extends TNode {

 /** A data-flow node corresponding to a control-flow node. */
 class CfgNode extends Node, TCfgNode {
-  ControlFlowNode node;
+  Cfg::ControlFlowNode node;

  CfgNode() { this = TCfgNode(node) }

-  /** Gets the `ControlFlowNode` represented by this data-flow node. */
-  ControlFlowNode getNode() { result = node }
+  /** Gets the `Cfg::ControlFlowNode` represented by this data-flow node. */
+  Cfg::ControlFlowNode getNode() { result = node }

-  override ControlFlowNode asCfgNode() { result = node }
+  override Cfg::ControlFlowNode asCfgNode() { result = node }

  /** Gets a textual representation of this element. */
  override string toString() { result = node.toString() }
@@ -224,9 +234,9 @@ class CfgNode extends Node, TCfgNode {
  override Location getLocation() { result = node.getLocation() }
 }

-/** A data-flow node corresponding to a `CallNode` in the control-flow graph. */
+/** A data-flow node corresponding to a `Cfg::CallNode` in the control-flow graph. */
 class CallCfgNode extends CfgNode, LocalSourceNode {
-  override CallNode node;
+  override Cfg::CallNode node;

  /**
   * Gets the data-flow node for the function component of the call corresponding to this data-flow
@@ -307,15 +317,15 @@ ExprNode exprNode(DataFlowExpr e) { result.getNode().getNode() = e }
 * as it enters a scope.
 */
 class ScopeEntryDefinitionNode extends Node, TScopeEntryDefinitionNode {
-  ScopeEntryDefinition def;
+  SsaImpl::ScopeEntryDefinition def;

  ScopeEntryDefinitionNode() { this = TScopeEntryDefinitionNode(def) }

-  /** Gets the `ScopeEntryDefinition` associated with this node. */
-  ScopeEntryDefinition getDefinition() { result = def }
+  /** Gets the `SsaImpl::ScopeEntryDefinition` associated with this node. */
+  SsaImpl::ScopeEntryDefinition getDefinition() { result = def }

  /** Gets the source variable represented by this node. */
-  SsaSourceVariable getVariable() { result = def.getSourceVariable() }
+  SsaImpl::SsaSourceVariable getVariable() { result = def.getSourceVariable() }

  override Location getLocation() { result = def.getLocation() }

@@ -337,7 +347,7 @@ class ParameterNode extends Node instanceof ParameterNodeImpl {
 /** A parameter node found in the source code (not in a summary). */
 class ExtractedParameterNode extends ParameterNodeImpl, CfgNode {
  //, LocalSourceNode {
-  ParameterDefinition def;
+  SsaImpl::ParameterDefinition def;

  ExtractedParameterNode() { node = def.getDefiningNode() }

@@ -368,10 +378,10 @@ Node getCallArgApproximation() {
  exists(Class c | result.asExpr() = c.getAMethod().getArg(0))
  or
  // the object part of an attribute expression (which might be a bound method)
-  result.asCfgNode() = any(AttrNode a).getObject()
+  result.asCfgNode() = any(Cfg::AttrNode a).getObject()
  or
  // the function part of any call
-  result.asCfgNode() = any(CallNode c).getFunction()
+  result.asCfgNode() = any(Cfg::CallNode c).getFunction()
 }

 /** Gets the extracted argument nodes that do not rely on `getCallArg`. */
@@ -380,7 +390,7 @@ private Node implicitArgumentNode() {
  normalCallArg(_, result, _)
  or
  // and self arguments
-  result.asCfgNode() = any(CallNode c).getFunction().(AttrNode).getObject()
+  result.asCfgNode() = any(Cfg::CallNode c).getFunction().(Cfg::AttrNode).getObject()
  or
  // for comprehensions, we allow the synthetic `iterable` argument
  result.asExpr() = any(Comp c).getIterable()
@@ -489,17 +499,20 @@ class ModuleVariableNode extends Node, TModuleVariableNode {
    not result.getScope() = mod
  }

-  /** Gets an `EssaNode` that corresponds to an assignment of this global variable. */
+  /** Gets a CFG node that corresponds to an assignment of this global variable. */
  Node getAWrite() {
-    any(EssaNodeDefinition def).definedBy(var, result.asCfgNode().(DefinitionNode))
+    exists(Cfg::NameNode n |
+      n.defines(var) and
+      result.asCfgNode() = n
+    )
  }

  /** Gets the possible values of the variable at the end of import time */
  CfgNode getADefiningWrite() {
-    exists(SsaVariable def |
-      def = any(SsaVariable ssa_var).getAnUltimateDefinition() and
-      def.getDefinition() = result.asCfgNode() and
-      def.getVariable() = var
+    exists(SsaImpl::EssaVariable def |
+      def = any(SsaImpl::EssaVariable ssa_var).getAnUltimateDefinition() and
+      def.getDefinition().(SsaImpl::EssaNodeDefinition).getDefiningNode() = result.asCfgNode() and
+      def.getSourceVariable().getVariable() = var
    )
  }

@@ -516,7 +529,7 @@ private ModuleVariableNode import_star_read(Node n) {
 overlay[global]
 pragma[nomagic]
 private predicate resolved_import_star_module(Module m, string name, Node n) {
-  exists(NameNode nn | nn = n.asCfgNode() |
+  exists(Cfg::NameNode nn | nn = n.asCfgNode() |
    ImportStar::importStarResolvesTo(pragma[only_bind_into](nn), m) and
    nn.getId() = name
  )
@@ -574,88 +587,88 @@ class StarPatternElementNode extends Node, TStarPatternElementNode {
 }

 /**
- * Gets a node that controls whether other nodes are evaluated.
+ * A node that participates in a conditional split: a CFG node whose
+ * evaluation outcome (true/false) is used to choose between two
+ * successor basic blocks. In the shared CFG, branching is detected
+ * via typed successor edges (boolean successor types) on the unique
+ * `injects` node for each AST expression.
 *
- * In the base case, this is the last node of `conditionBlock`, and `flipped` is `false`.
- * This definition accounts for (short circuting) `and`- and `or`-expressions, as the structure
- * of basic blocks will reflect their semantics.
- *
- * However, in the program
- * ```python
- * if not is_safe(path):
- *   return
- * ```
- * the last node in the `ConditionBlock` is `not is_safe(path)`.
- *
- * We would like to consider also `is_safe(path)` a guard node, albeit with `flipped` being `true`.
- * Thus we recurse through `not`-expressions.
+ * Users typically obtain a `GuardNode` by casting from a more specific
+ * Cfg type: `g.(Cfg::CallNode)` for a call-based check, etc.
 */
-ControlFlowNode guardNode(ConditionBlock conditionBlock, boolean flipped) {
-  // Base case: the last node truly does determine which successor is chosen
-  result = conditionBlock.getLastNode() and
-  flipped = false
-  or
-  // Recursive cases:
-  // if a guard node is a `not`-expression,
-  // the operand is also a guard node, but with inverted polarity.
-  exists(UnaryExprNode notNode |
-    result = notNode.getOperand() and
-    notNode.getNode().getOp() instanceof Not
-  |
-    notNode = guardNode(conditionBlock, flipped.booleanNot())
-  )
-  or
-  // if a guard node is compared to a boolean literal,
-  // the other operand is also a guard node,
-  // but with polarity depending on the literal (and on the comparison).
-  exists(CompareNode cmpNode, Cmpop op, ControlFlowNode b, boolean should_flip |
-    (
-      cmpNode.operands(result, op, b) or
-      cmpNode.operands(b, op, result)
-    ) and
-    not result.getNode() instanceof BooleanLiteral and
-    (
-      // comparing to the boolean
-      (op instanceof Eq or op instanceof Is) and
-      // we should flip if the value compared against, here the value of `b`, is false
-      should_flip = b.getNode().(BooleanLiteral).booleanValue().booleanNot()
-      or
-      // comparing to the negation of the boolean
-      (op instanceof NotEq or op instanceof IsNot) and
-      // again, we should flip if the value compared against, here the value of `not b`, is false.
-      // That is, if the value of `b` is true.
-      should_flip = b.getNode().(BooleanLiteral).booleanValue()
+class GuardNode extends Cfg::ControlFlowNode {
+  GuardNode() {
+    // This node has boolean successor edges (directly or via wrapping).
+    outcomeOfGuard(this, _, _)
+  }
+
+  /** Holds if this guard controls block `b` upon evaluating to `branch`. */
+  predicate controlsBlock(Cfg::BasicBlock b, boolean branch) {
+    exists(CfgImpl::BasicBlock outcomeBB |
+      outcomeOfGuard(this, outcomeBB, branch) and
+      outcomeBB.dominates(b)
    )
-  |
-    // we flip `flipped` according to `should_flip` via the formula `flipped xor should_flip`.
-    flipped in [true, false] and
-    cmpNode = guardNode(conditionBlock, flipped.booleanXor(should_flip))
-  )
+  }
 }

 /**
- * A node that controls whether other nodes are evaluated.
+ * Holds if `outcomeBB` is the basic block entered when `guard` evaluates
+ * to `branch`.
 *
- * The field `flipped` allows us to match `GuardNode`s underneath
- * `not`-expressions and still choose the appropriate branch.
+ * For a direct guard `if g:`, the outcome BB starts at the after-value
+ * node for the matching branch. For wrapped guards like `not g` or
+ * `g == True`, we follow those wrappers up the AST to find the
+ * outermost expression that actually branches, with an appropriate
+ * polarity transform.
 */
-class GuardNode extends ControlFlowNode {
-  ConditionBlock conditionBlock;
-  boolean flipped;
-
-  GuardNode() { this = guardNode(conditionBlock, flipped) }
-
-  /** Holds if this guard controls block `b` upon evaluating to `branch`. */
-  predicate controlsBlock(BasicBlock b, boolean branch) {
-    branch in [true, false] and
-    conditionBlock.controls(b, branch.booleanXor(flipped))
-  }
+private predicate outcomeOfGuard(
+  Cfg::ControlFlowNode guard, CfgImpl::BasicBlock outcomeBB, boolean branch
+) {
+  // Base case: the guard has boolean successor edges.
+  // Only the canonical representative (injects) can act as a guard base.
+  guard.injects(_) and
+  exists(BooleanSuccessor t |
+    t.getValue() = branch and
+    outcomeBB = guard.(CfgImpl::ControlFlowNode).getASuccessor(t).getBasicBlock()
+  )
+  or
+  // Recursive: `not guard` — same outcome split as `guard`, flipped.
+  exists(Cfg::UnaryExprNode notNode, boolean notBranch |
+    notNode.injects(_) and
+    notNode.getOperand().getNode() = guard.getNode() and
+    notNode.getNode().getOp() instanceof Not and
+    outcomeOfGuard(notNode, outcomeBB, notBranch) and
+    branch = notBranch.booleanNot()
+  )
+  or
+  // Recursive: comparisons against a boolean literal.
+  exists(
+    Cfg::CompareNode cmpNode, Cmpop op, Cfg::ControlFlowNode otherOperand,
+    Cfg::ControlFlowNode guardOperand, boolean polarity, boolean cmpBranch
+  |
+    cmpNode.injects(_) and
+    guardOperand.getNode() = guard.getNode() and
+    (
+      cmpNode.operands(guardOperand, op, otherOperand) or
+      cmpNode.operands(otherOperand, op, guardOperand)
+    ) and
+    not guard.getNode() instanceof BooleanLiteral and
+    (
+      (op instanceof Eq or op instanceof Is) and
+      polarity = otherOperand.getNode().(BooleanLiteral).booleanValue()
+      or
+      (op instanceof NotEq or op instanceof IsNot) and
+      polarity = otherOperand.getNode().(BooleanLiteral).booleanValue().booleanNot()
+    ) and
+    outcomeOfGuard(cmpNode, outcomeBB, cmpBranch) and
+    branch = cmpBranch.booleanXor(polarity.booleanNot())
+  )
 }

 /**
 * Holds if the guard `g` validates `node` upon evaluating to `branch`.
 */
-signature predicate guardChecksSig(GuardNode g, ControlFlowNode node, boolean branch);
+signature predicate guardChecksSig(GuardNode g, Cfg::ControlFlowNode node, boolean branch);

 /**
 * Provides a set of barrier nodes for a guard that validates a node.
@@ -670,7 +683,9 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
    result = ParameterizedBarrierGuard<Unit, extendedGuardChecks/4>::getABarrierNode(_)
  }

-  private predicate extendedGuardChecks(GuardNode g, ControlFlowNode node, boolean branch, Unit u) {
+  private predicate extendedGuardChecks(
+    GuardNode g, Cfg::ControlFlowNode node, boolean branch, Unit u
+  ) {
    guardChecks(g, node, branch) and
    u = u
  }
@@ -680,7 +695,7 @@ bindingset[this]
 private signature class ParamSig;

 private module WithParam<ParamSig P> {
-  signature predicate guardChecksSig(GuardNode g, ControlFlowNode node, boolean branch, P param);
+  signature predicate guardChecksSig(GuardNode g, Cfg::ControlFlowNode node, boolean branch, P param);
 }

 /**
@@ -693,10 +708,16 @@ module ParameterizedBarrierGuard<ParamSig P, WithParam<P>::guardChecksSig/4 guar
  /** Gets a node that is safely guarded by the given guard check with parameter `param`. */
  overlay[global]
  ExprNode getABarrierNode(P param) {
-    exists(GuardNode g, EssaDefinition def, ControlFlowNode node, boolean branch |
-      AdjacentUses::useOfDef(def, node) and
+    exists(GuardNode g, SsaImpl::EssaDefinition def, Cfg::ControlFlowNode node, boolean branch |
+      SsaImpl::AdjacentUses::useOfDef(def, node) and
      guardChecks(g, node, branch, param) and
-      AdjacentUses::useOfDef(def, result.asCfgNode()) and
+      SsaImpl::AdjacentUses::useOfDef(def, result.asCfgNode()) and
+      // The protected use must be a different SSA position than the test
+      // position itself: `controlsBlock` is reflexive on dominance, and
+      // the test expression is an SSA-use position on the def-use chain.
+      // Without this guard, the test position would be returned as a
+      // barrier and block flow before it can reach genuine branch uses.
+      node != result.asCfgNode() and
      g.controlsBlock(result.asCfgNode().getBasicBlock(), branch)
    )
  }
@@ -712,7 +733,7 @@ module ExternalBarrierGuard {
  private import semmle.python.ApiGraphs

  overlay[global]
-  private predicate guardCheck(GuardNode g, ControlFlowNode node, boolean branch, string kind) {
+  private predicate guardCheck(GuardNode g, Cfg::ControlFlowNode node, boolean branch, string kind) {
    exists(API::CallNode call, API::Node parameter |
      parameter = call.getAParameter() and
      parameter = ModelOutput::getABarrierGuardNode(kind, branch)
@@ -748,10 +769,10 @@ newtype TContent =
  TSetElementContent() or
  /** An element of a tuple at a specific index. */
  TTupleElementContent(int index) {
-    exists(any(TupleNode tn).getElement(index))
+    exists(any(Cfg::TupleNode tn).getElement(index))
    or
    // Arguments can overflow and end up in the starred parameter tuple.
-    exists(any(CallNode cn).getArg(index))
+    exists(any(Cfg::CallNode cn).getArg(index))
    or
    // since flow summaries might use tuples, we ensure that we at least have valid
    // TTupleElementContent for the 0..7 (7 was picked to match `small_tuple` in
@@ -768,10 +789,14 @@ newtype TContent =
    or
    // d["key"] = ...
    key =
-      any(SubscriptNode sub | sub.isStore() | sub.getIndex().getNode().(StringLiteral).getText())
+      any(Cfg::SubscriptNode sub |
+        sub.isStore()
+      |
+        sub.getIndex().getNode().(StringLiteral).getText()
+      )
    or
    // d.setdefault("key", ...)
-    exists(CallNode call | call.getFunction().(AttrNode).getName() = "setdefault" |
+    exists(Cfg::CallNode call | call.getFunction().(Cfg::AttrNode).getName() = "setdefault" |
      key = call.getArg(0).getNode().(StringLiteral).getText()
    )
  } or
--- a/python/ql/lib/semmle/python/dataflow/new/internal/ImportResolution.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/ImportResolution.qll
@@ -5,17 +5,18 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.ImportStar
 private import semmle.python.dataflow.new.TypeTracking
 private import semmle.python.dataflow.new.internal.DataFlowPrivate

 /**
- * Holds if `init` is a package's `__init__.py` and `var` is a global variable in
- * `init` whose name matches a submodule of the package.
- *
- * Inlined from `SsaSource::init_module_submodule_defn` to avoid pulling
- * `semmle.python.essa.SsaDefinitions` into the new dataflow stack.
+ * Holds if the name of `var` refers to a submodule of a package and `init` is
+ * the `__init__` module of that package. Locally inlined replacement for the
+ * legacy `SsaSource::init_module_submodule_defn` so that this module has no
+ * direct dependency on `semmle.python.essa.SsaDefinitions`.
 */
 private predicate initModuleSubmoduleDefn(GlobalVariable var, Module init) {
  init.isPackageInit() and
@@ -81,13 +82,19 @@ module ImportResolution {
   * Holds if there is an ESSA step from `defFrom` to `defTo`, which should be allowed
   * for import resolution.
   */
-  private predicate allowedEssaImportStep(EssaDefinition defFrom, EssaDefinition defTo) {
+  private predicate allowedEssaImportStep(
+    SsaImpl::EssaDefinition defFrom, SsaImpl::EssaDefinition defTo
+  ) {
    // to handle definitions guarded by if-then-else
-    defFrom = defTo.(PhiFunction).getAnInput()
+    defFrom = defTo.(SsaImpl::PhiFunction).getAnInput()
    or
-    // refined variable
-    // example: https://github.com/nvbn/thefuck/blob/ceeaeab94b5df5a4fe9d94d61e4f6b0bbea96378/thefuck/utils.py#L25-L45
-    defFrom = defTo.(EssaNodeRefinement).getInput().getDefinition()
+    // to handle uncertain writes such as `from X import *`, which create an
+    // uncertain SSA definition for every name in the importing scope. The
+    // immediately preceding definition is still potentially the value of the
+    // module export.
+    SsaImpl::Ssa::uncertainWriteDefinitionInput(defTo, defFrom)
+    // Note: legacy ESSA refinement-step (e.g. for `foo.bar = X`) is
+    // not modelled in the new SSA beyond the cases handled above.
  }

  /**
@@ -104,30 +111,32 @@ module ImportResolution {
    // Definitions made inside `m` itself
    //
    // for code such as `foo = ...; foo.bar = ...` there will be TWO
-    // EssaDefinition/EssaVariable. One for `foo = ...` (AssignmentDefinition) and one
+    // SsaImpl::EssaDefinition/SsaImpl::EssaVariable. One for `foo = ...` (SsaImpl::AssignmentDefinition) and one
    // for `foo.bar = ...`. The one for `foo.bar = ...` (EssaNodeRefinement). The
    // EssaNodeRefinement is the one that will reach the end of the module (normal
    // exit).
    //
    // However, we cannot just use the EssaNodeRefinement as the `val`, because the
    // normal data-flow depends on use-use flow, and use-use flow targets CFG nodes not
-    // EssaNodes. So we need to go back from the EssaDefinition/EssaVariable that
+    // EssaNodes. So we need to go back from the SsaImpl::EssaDefinition/SsaImpl::EssaVariable that
    // reaches the end of the module, to the first definition of the variable, and then
    // track forwards using use-use flow to find a suitable CFG node that has flow into
    // it from use-use flow.
-    exists(EssaVariable lastUseVar, EssaVariable firstDef |
+    exists(SsaImpl::EssaVariable lastUseVar, SsaImpl::EssaVariable firstDef |
      lastUseVar.getName() = name and
      // we ignore special variable $ introduced by our analysis (not used for anything)
      // we ignore special variable * introduced by `from <pkg> import *` -- TODO: understand why we even have this?
      not name in ["$", "*"] and
-      lastUseVar.getAUse() = m.getANormalExit() and
+      exists(Cfg::ControlFlowNode exit |
+        exit.isNormalExit() and exit.getScope() = m and lastUseVar.getAUse() = exit
+      ) and
      allowedEssaImportStep*(firstDef, lastUseVar) and
      not allowedEssaImportStep(_, firstDef)
    |
      not LocalFlow::defToFirstUse(firstDef, _) and
-      val.asCfgNode() = firstDef.getDefinition().(EssaNodeDefinition).getDefiningNode()
+      val.asCfgNode() = firstDef.getDefinition().(SsaImpl::EssaNodeDefinition).getDefiningNode()
      or
-      exists(ControlFlowNode mid, ControlFlowNode end |
+      exists(Cfg::ControlFlowNode mid, Cfg::ControlFlowNode end |
        LocalFlow::defToFirstUse(firstDef, mid) and
        LocalFlow::useToNextUse*(mid, end) and
        not LocalFlow::useToNextUse(end, _) and
@@ -155,9 +164,9 @@ module ImportResolution {
   * handles simple cases where we can statically tell that this is the case.
   */
  private predicate all_mentions_name(Module m, string name) {
-    exists(DefinitionNode def, SequenceNode n |
+    exists(Cfg::DefinitionNode def, Cfg::SequenceNode n |
      def.getValue() = n and
-      def.(NameNode).getId() = "__all__" and
+      def.(Cfg::NameNode).getId() = "__all__" and
      def.getScope() = m and
      any(StringLiteral s | s.getText() = name) = n.getAnElement().getNode()
    )
@@ -170,18 +179,20 @@ module ImportResolution {
   */
  private predicate no_or_complicated_all(Module m) {
    // No mention of `__all__` in the module
-    not exists(DefinitionNode def | def.getScope() = m and def.(NameNode).getId() = "__all__")
+    not exists(Cfg::DefinitionNode def |
+      def.getScope() = m and def.(Cfg::NameNode).getId() = "__all__"
+    )
    or
    // `__all__` is set to a non-sequence value
-    exists(DefinitionNode def |
-      def.(NameNode).getId() = "__all__" and
+    exists(Cfg::DefinitionNode def |
+      def.(Cfg::NameNode).getId() = "__all__" and
      def.getScope() = m and
-      not def.getValue() instanceof SequenceNode
+      not def.getValue() instanceof Cfg::SequenceNode
    )
    or
    // `__all__` is used in some way that doesn't involve storing a value in it. This usually means
    // it is being mutated through `append` or `extend`, which we don't handle.
-    exists(NameNode n | n.getId() = "__all__" and n.getScope() = m and n.isLoad())
+    exists(Cfg::NameNode n | n.getId() = "__all__" and n.getScope() = m and n.isLoad())
  }

  private predicate potential_module_export(Module m, string name) {
@@ -189,7 +200,7 @@ module ImportResolution {
    or
    no_or_complicated_all(m) and
    (
-      exists(NameNode n | n.getId() = name and n.getScope() = m and name.charAt(0) != "_")
+      exists(Cfg::NameNode n | n.getId() = name and n.getScope() = m and name.charAt(0) != "_")
      or
      exists(Alias a | a.getAsname().(Name).getId() = name and a.getValue().getScope() = m)
    )
@@ -219,12 +230,12 @@ module ImportResolution {

  /** Gets a module that may have been added to `sys.modules`. */
  private Module sys_modules_module_with_name(string name) {
-    exists(ControlFlowNode n, DataFlow::Node mod |
-      exists(SubscriptNode sub |
+    exists(Cfg::ControlFlowNode n, DataFlow::Node mod |
+      exists(Cfg::SubscriptNode sub |
        sub.getObject() = sys_modules_reference().asCfgNode() and
        sub.getIndex() = n and
        n.getNode().(StringLiteral).getText() = name and
-        sub.(DefinitionNode).getValue() = mod.asCfgNode() and
+        sub.(Cfg::DefinitionNode).getValue() = mod.asCfgNode() and
        mod = getModuleReference(result)
      )
    )
@@ -336,11 +347,11 @@ module ImportResolution {
    // name as a submodule, we always consider that this attribute _could_ be a
    // reference to the submodule, even if we don't know that the submodule has been
    // imported yet.
-    exists(string submodule, Module package, EssaVariable var |
+    exists(string submodule, Module package, SsaImpl::EssaVariable var |
      submodule = var.getName() and
-      initModuleSubmoduleDefn(var.getSourceVariable(), package) and
+      initModuleSubmoduleDefn(var.getSourceVariable().getVariable(), package) and
      m = getModuleFromName(package.getPackageName() + "." + submodule) and
-      result.asCfgNode() = var.getDefinition().(EssaNodeDefinition).getDefiningNode()
+      result.asCfgNode() = var.getDefinition().(SsaImpl::EssaNodeDefinition).getDefiningNode()
    )
  }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/ImportStar.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/ImportStar.qll
@@ -3,6 +3,7 @@ overlay[local]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.internal.Builtins
 private import semmle.python.dataflow.new.internal.ImportResolution
 private import semmle.python.dataflow.new.DataFlow
@@ -15,7 +16,7 @@ module ImportStar {
   */
  overlay[local]
  cached
-  predicate namePossiblyDefinedInImportStar(NameNode n, string name, Scope s) {
+  predicate namePossiblyDefinedInImportStar(Cfg::NameNode n, string name, Scope s) {
    n.isLoad() and
    name = n.getId() and
    s = n.getScope().getEnclosingScope*() and
@@ -52,7 +53,7 @@ module ImportStar {
  /** Holds if a global variable called `name` is assigned a value in the module `m`. */
  cached
  predicate globalNameDefinedInModule(string name, Module m) {
-    exists(NameNode n |
+    exists(Cfg::NameNode n |
      not exists(LocalVariable v | n.defines(v)) and
      n.isStore() and
      name = n.getId() and
@@ -66,7 +67,7 @@ module ImportStar {
   */
  overlay[global]
  cached
-  predicate importStarResolvesTo(NameNode n, Module m) {
+  predicate importStarResolvesTo(Cfg::NameNode n, Module m) {
    m = getStarImported+(n.getEnclosingModule()) and
    globalNameDefinedInModule(n.getId(), m) and
    not isDefinedLocally(n.getNode())
@@ -99,7 +100,7 @@ module ImportStar {
   */
  overlay[local]
  cached
-  ControlFlowNode potentialImportStarBase(Scope s) {
-    result = any(ImportStarNode n | n.getScope() = s).getModule()
+  Cfg::ControlFlowNode potentialImportStarBase(Scope s) {
+    result = any(Cfg::ImportStarNode n | n.getScope() = s).getModule()
  }
 }
--- a/python/ql/lib/semmle/python/dataflow/new/internal/IterableUnpacking.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/IterableUnpacking.qll
@@ -170,6 +170,8 @@ overlay[local]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
 private import DataFlowPublic

 /**
@@ -178,7 +180,7 @@ private import DataFlowPublic
 * This class abstracts away the differing representations of comprehensions and
 * for statements.
 */
-class ForTarget extends ControlFlowNode {
+class ForTarget extends Cfg::ControlFlowNode {
  Expr source;

  ForTarget() {
@@ -198,7 +200,7 @@ class ForTarget extends ControlFlowNode {
 }

 /** The LHS of an assignment, it also records the assigned value. */
-class AssignmentTarget extends ControlFlowNode {
+class AssignmentTarget extends Cfg::ControlFlowNode {
  Expr value;

  AssignmentTarget() {
@@ -209,7 +211,7 @@ class AssignmentTarget extends ControlFlowNode {
 }

 /** A direct (or top-level) target of an unpacking assignment. */
-class UnpackingAssignmentDirectTarget extends ControlFlowNode instanceof SequenceNode {
+class UnpackingAssignmentDirectTarget extends Cfg::ControlFlowNode instanceof Cfg::SequenceNode {
  Expr value;

  UnpackingAssignmentDirectTarget() {
@@ -222,7 +224,7 @@ class UnpackingAssignmentDirectTarget extends ControlFlowNode instanceof Sequenc
 }

 /** A (possibly recursive) target of an unpacking assignment. */
-class UnpackingAssignmentTarget extends ControlFlowNode {
+class UnpackingAssignmentTarget extends Cfg::ControlFlowNode {
  UnpackingAssignmentTarget() {
    this instanceof UnpackingAssignmentDirectTarget
    or
@@ -231,10 +233,11 @@ class UnpackingAssignmentTarget extends ControlFlowNode {
 }

 /** A (possibly recursive) target of an unpacking assignment which is also a sequence. */
-class UnpackingAssignmentSequenceTarget extends UnpackingAssignmentTarget instanceof SequenceNode {
-  ControlFlowNode getElement(int i) { result = super.getElement(i) }
+class UnpackingAssignmentSequenceTarget extends UnpackingAssignmentTarget instanceof Cfg::SequenceNode
+{
+  Cfg::ControlFlowNode getElement(int i) { result = super.getElement(i) }

-  ControlFlowNode getAnElement() { result = this.getElement(_) }
+  Cfg::ControlFlowNode getAnElement() { result = this.getElement(_) }
 }

 /**
@@ -255,7 +258,7 @@ predicate iterableUnpackingAssignmentFlowStep(Node nodeFrom, Node nodeTo) {
 predicate iterableUnpackingForReadStep(CfgNode nodeFrom, Content c, Node nodeTo) {
  exists(ForTarget target |
    nodeFrom.getNode().getNode() = target.getSource() and
-    target instanceof SequenceNode and
+    target instanceof Cfg::SequenceNode and
    nodeTo = TIterableSequenceNode(target)
  ) and
  (
@@ -323,11 +326,11 @@ predicate iterableUnpackingConvertingStoreStep(Node nodeFrom, Content c, Node no
 */
 predicate iterableUnpackingElementReadStep(Node nodeFrom, Content c, Node nodeTo) {
  exists(
-    UnpackingAssignmentSequenceTarget target, int index, ControlFlowNode element, int starIndex
+    UnpackingAssignmentSequenceTarget target, int index, Cfg::ControlFlowNode element, int starIndex
  |
-    target.getElement(starIndex) instanceof StarredNode
+    target.getElement(starIndex) instanceof Cfg::StarredNode
    or
-    not exists(target.getAnElement().(StarredNode)) and
+    not exists(target.getAnElement().(Cfg::StarredNode)) and
    starIndex = -1
  |
    nodeFrom.(CfgNode).getNode() = target and
@@ -342,18 +345,18 @@ predicate iterableUnpackingElementReadStep(Node nodeFrom, Content c, Node nodeTo
        else c.(TupleElementContent).getIndex() >= index - 1
    ) and
    (
-      if element instanceof SequenceNode
+      if element instanceof Cfg::SequenceNode
      then
        // Step 5b
        nodeTo = TIterableSequenceNode(element)
      else
-        if element instanceof StarredNode
+        if element instanceof Cfg::StarredNode
        then
          // Step 5c
          nodeTo = TIterableElementNode(element)
        else
          // Step 5a
-          exists(MultiAssignmentDefinition mad | element = mad.getDefiningNode() |
+          exists(SsaImpl::MultiAssignmentDefinition mad | element = mad.getDefiningNode() |
            nodeTo.(CfgNode).getNode() = element
          )
    )
@@ -366,7 +369,7 @@ predicate iterableUnpackingElementReadStep(Node nodeFrom, Content c, Node nodeTo
 * content type `ListElementContent`.
 */
 predicate iterableUnpackingStarredElementStoreStep(Node nodeFrom, Content c, Node nodeTo) {
-  exists(ControlFlowNode starred, MultiAssignmentDefinition mad |
+  exists(Cfg::ControlFlowNode starred, SsaImpl::MultiAssignmentDefinition mad |
    starred.getNode() instanceof Starred and
    starred = mad.getDefiningNode()
  |
--- a/python/ql/lib/semmle/python/dataflow/new/internal/LocalSources.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/LocalSources.qll
@@ -9,6 +9,7 @@ overlay[local]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import DataFlowPublic
 private import DataFlowPrivate
 private import semmle.python.internal.CachedStages
@@ -314,7 +315,7 @@ private module Cached {
   */
  cached
  predicate subscript(LocalSourceNode node, CfgNode subscript, CfgNode index) {
-    exists(CfgNode seq, SubscriptNode subscriptNode | subscriptNode = subscript.getNode() |
+    exists(CfgNode seq, Cfg::SubscriptNode subscriptNode | subscriptNode = subscript.getNode() |
      node.flowsTo(seq) and
      seq.getNode() = subscriptNode.getObject() and
      index.getNode() = subscriptNode.getIndex()
--- a/python/ql/lib/semmle/python/dataflow/new/internal/MatchUnpacking.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/MatchUnpacking.qll
@@ -91,9 +91,7 @@ predicate matchAsFlowStep(Node nodeFrom, Node nodeTo) {
    or
    // the interior pattern flows to the alias
    nodeFrom.(CfgNode).getNode().getNode() = subject.getPattern() and
-    exists(PatternAliasDefinition pad | pad.getDefiningNode().getNode() = alias |
-      nodeTo.(CfgNode).getNode() = pad.getDefiningNode()
-    )
+    nodeTo.(CfgNode).getNode().getNode() = alias
  )
 }

@@ -124,11 +122,9 @@ predicate matchLiteralFlowStep(Node nodeFrom, Node nodeTo) {
 * syntax (toplevel): `case var:`
 */
 predicate matchCaptureFlowStep(Node nodeFrom, Node nodeTo) {
-  exists(MatchCapturePattern capture, Name var | capture.getVariable() = var |
+  exists(MatchCapturePattern capture |
    nodeFrom.(CfgNode).getNode().getNode() = capture and
-    exists(PatternCaptureDefinition pcd | pcd.getDefiningNode().getNode() = var |
-      nodeTo.(CfgNode).getNode() = pcd.getDefiningNode()
-    )
+    nodeTo.(CfgNode).getNode().getNode() = capture.getVariable()
  )
 }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/SsaImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/SsaImpl.qll
@@ -0,0 +1,548 @@
+/**
+ * Provides the Python SSA implementation built on the new (shared) CFG.
+ *
+ * Mirrors the Java SSA adapter at
+ * `java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll`:
+ * an `InputSig` is defined in terms of positional `(BasicBlock, int)`
+ * variable references, and the shared
+ * `codeql.ssa.Ssa::Make<Location, Cfg, Input>` module is then
+ * instantiated.
+ *
+ * `SourceVariable` is the AST-level `Py::Variable`. Variable references
+ * are looked up via the CFG facade's `NameNode.defines`/`uses`/`deletes`
+ * predicates, which themselves are one-line bridges to AST-level
+ * `Name.defines`/`uses`/`deletes`.
+ *
+ * Implicit-entry definitions are inserted for:
+ *   - non-local / global / builtin variables that are read in the scope
+ *     but never assigned (no enclosing CFG node defines them),
+ *   - captured variables (variables defined in an enclosing scope that
+ *     are read inside the scope), and
+ *   - parameters, but only if the corresponding parameter name is *not*
+ *     itself a CFG node. With the C#-style parameter wiring already
+ *     installed in `AstNodeImpl.qll`, parameter names *are* CFG nodes,
+ *     so the regular `variableWrite` path handles them — no `i = -1`
+ *     entry is needed for ordinary parameters.
+ */
+overlay[local?]
+module;
+
+private import python as Py
+private import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import codeql.ssa.Ssa as SsaImplCommon
+private import codeql.controlflow.BasicBlock as BB
+
+/**
+ * Adapts the Python `Cfg` facade to the shared SSA library's `CfgSig`.
+ * All members are inherited from `Cfg::ControlFlowNode` and
+ * `Cfg::BasicBlock`.
+ */
+private module CfgForSsa implements BB::CfgSig<Py::Location> {
+  class ControlFlowNode = CfgImpl::ControlFlowNode;
+
+  class BasicBlock = CfgImpl::BasicBlock;
+
+  class EntryBasicBlock = CfgImpl::Cfg::EntryBasicBlock;
+
+  predicate dominatingEdge = CfgImpl::Cfg::dominatingEdge/2;
+}
+
+/**
+ * A source variable for SSA, wrapping a Python AST `Variable`.
+ *
+ * We only track variables that are read at least once in their scope —
+ * tracking write-only variables would be unnecessary work — *except*
+ * for module-scope globals, where the "read" can be external (e.g.
+ * `import mymodule; mymodule.x`). Such globals are tracked
+ * unconditionally so that import-resolution can find their defining
+ * write.
+ */
+private newtype TSsaSourceVariable =
+  TPyVar(Py::Variable v) {
+    // Has a use somewhere — read-relevant for SSA.
+    exists(Cfg::NameNode n | n.uses(v))
+    or
+    // Or has a deletion (treated as a write that destroys the value).
+    exists(Cfg::NameNode n | n.deletes(v))
+    or
+    // Or is a module-scope global written in this module — must be
+    // tracked even if never read locally, because importers may read
+    // it as an attribute on the module object.
+    v.getScope() instanceof Py::Module and
+    exists(Cfg::NameNode n | n.defines(v))
+    or
+    // Or is a parameter — parameters must always have a
+    // `ParameterDefinition` for dataflow argument-routing to work,
+    // even if the parameter is never read in its scope. Mirrors
+    // legacy ESSA's `ParameterDefinition` (which fired for every
+    // parameter binding regardless of liveness).
+    exists(Py::Parameter p | p.asName() = v.getAStore())
+  }
+
+/**
+ * A source variable for SSA, wrapping a Python AST `Variable`.
+ */
+class SsaSourceVariable extends TSsaSourceVariable {
+  /** Gets the underlying Python AST variable. */
+  Py::Variable getVariable() { this = TPyVar(result) }
+
+  /** Gets the (textual) name of this variable. */
+  string getName() { result = this.getVariable().getId() }
+
+  /** Gets a textual representation of this source variable. */
+  string toString() { result = this.getVariable().toString() }
+
+  /** Gets the location of this source variable. */
+  Py::Location getLocation() { result = this.getVariable().getScope().getLocation() }
+
+  /** Gets the scope in which this variable lives. */
+  Py::Scope getScope() { result = this.getVariable().getScope() }
+
+  /**
+   * Gets a use of this variable as it appears in the source — a `NameNode`
+   * that loads or deletes the variable. Mirrors legacy
+   * `SsaSourceVariable.getASourceUse()`.
+   */
+  Cfg::ControlFlowNode getASourceUse() {
+    exists(Cfg::NameNode n | result = n |
+      n.uses(this.getVariable()) or n.deletes(this.getVariable())
+    )
+  }
+
+  /**
+   * Gets an implicit use of this variable. The new SSA does not have
+   * implicit-use refinements, but we keep this for API parity — every
+   * normal-exit of the variable's scope counts as a sink, ensuring
+   * variables stay live to scope exit for taint-tracking.
+   */
+  Cfg::ControlFlowNode getAnImplicitUse() {
+    result.isNormalExit() and result.getScope() = this.getScope()
+  }
+
+  /**
+   * Gets a use of this variable — either an explicit source use or an
+   * implicit use at scope exit. Mirrors legacy `SsaSourceVariable.getAUse()`.
+   */
+  Cfg::ControlFlowNode getAUse() {
+    result = this.getASourceUse() or result = this.getAnImplicitUse()
+  }
+}
+
+/**
+ * Holds if `v` is a non-local read in scope `s`, in the sense that `s`
+ * uses `v` but does not write it within `s`. This includes globals,
+ * builtins, and variables captured from an enclosing function scope.
+ *
+ * The `Py::Variable` `v` lives in some defining scope (the module for
+ * globals, an outer function for closures, etc.); the reading scope
+ * `s` is the scope where the use of `v` occurs.
+ */
+private predicate nonLocalReadIn(Py::Variable v, Py::Scope s) {
+  exists(Cfg::NameNode n |
+    n.uses(v) and
+    n.getScope() = s and
+    not exists(Cfg::NameNode def | def.defines(v) and def.getScope() = s)
+  ) and
+  // Match legacy ESSA: only create entry defs for variables that have
+  // at least one defining store somewhere — otherwise the entry def
+  // represents "nothing reaches here", which is the default anyway and
+  // introduces no useful flow. (Legacy's `ModuleVariable` required a
+  // store; this is the closure-aware generalisation.)
+  exists(Cfg::NameNode store | store.defines(v))
+}
+
+/**
+ * Holds if `bb` is the entry basic block of a scope where `v` should
+ * have an implicit entry definition. This covers:
+ *   - non-local / global / builtin variables read in `s`, and
+ *   - captured variables (defined in an enclosing scope but read in `s`).
+ *
+ * Each reading scope gets its own entry def, so a closure variable can
+ * have multiple entry defs across all functions/methods that read it.
+ *
+ * Parameters are *not* included: their bound `Name` is itself a CFG
+ * node (per the C#-style parameter wiring), so `variableWrite` fires at
+ * the parameter's natural CFG index.
+ */
+private predicate hasEntryDefIn(SsaSourceVariable v, CfgImpl::BasicBlock bb) {
+  exists(Py::Scope s |
+    nonLocalReadIn(v.getVariable(), s) and
+    bb = entryBlock(s)
+  )
+}
+
+/**
+ * Gets the entry basic block of scope `s`, where implicit entry
+ * definitions are placed (at synthetic index `-1`).
+ */
+private CfgImpl::BasicBlock entryBlock(Py::Scope s) {
+  exists(CfgImpl::ControlFlowNode entry |
+    entry instanceof CfgImpl::ControlFlow::EntryNode and
+    entry.getEnclosingCallable().asScope() = s and
+    result = entry.getBasicBlock()
+  )
+}
+
+/**
+ * The SSA `InputSig` for Python. References are positional
+ * `(BasicBlock, int)` pairs into the new CFG.
+ */
+private module SsaImplInput implements SsaImplCommon::InputSig<Py::Location, CfgImpl::BasicBlock> {
+  class SourceVariable = SsaSourceVariable;
+
+  predicate variableWrite(CfgImpl::BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    // Explicit binding at a CFG node — includes assignments,
+    // parameter Names (wired in via the C# pattern), exception-handler
+    // `as`-bindings, import aliases, and match-pattern captures.
+    exists(Cfg::NameNode n |
+      bb.getNode(i) = n and
+      n.defines(v.getVariable()) and
+      certain = true
+    )
+    or
+    // `del x` — removes the binding. Modelled as a certain write that
+    // makes any subsequent read invalid.
+    exists(Cfg::NameNode n |
+      bb.getNode(i) = n and
+      n.deletes(v.getVariable()) and
+      certain = true
+    )
+    or
+    // Implicit entry definition for non-local / captured / global /
+    // builtin variables read in some scope. Each reading scope's entry
+    // block gets one such write, allowing closures: e.g. when `x` is a
+    // parameter of an outer function and read inside a nested
+    // function, both scopes get entry defs for `x`.
+    hasEntryDefIn(v, bb) and
+    i = -1 and
+    certain = true
+    or
+    // `from X import *` — possibly rebinds every name in the importing
+    // scope. Modelled as an uncertain write at the import-star's CFG
+    // position for every variable that lives in (or is referenced
+    // from) the same scope as the import-star. Mirrors legacy ESSA's
+    // `ImportStarRefinement` (see `essa/SsaDefinitions.qll`'s
+    // `import_star_refinement` predicate). The write is uncertain so
+    // that prior definitions of the variable remain available — the
+    // shared-SSA `SsaUncertainWrite` merges the new value with the
+    // immediately preceding definition.
+    exists(Cfg::ImportStarNode imp |
+      imp.injects(_) and
+      bb.getNode(i) = imp and
+      certain = false and
+      (
+        v.getVariable().getScope() = imp.getScope()
+        or
+        // Variable is defined in some other scope but referenced in
+        // the same scope as the import-star (matches legacy clause 2:
+        // `other.uses(v) and def.getScope() = other.getScope()`).
+        exists(Cfg::NameNode other |
+          other.uses(v.getVariable()) and
+          imp.getScope() = other.getScope()
+        )
+      )
+    )
+  }
+
+  predicate variableRead(CfgImpl::BasicBlock bb, int i, SourceVariable v, boolean certain) {
+    // Explicit source use — a `Name` load or a `del x` of the variable.
+    exists(Cfg::NameNode n |
+      bb.getNode(i) = n and
+      n.uses(v.getVariable()) and
+      certain = true
+    )
+    or
+    // Synthetic use at the normal exit of the variable's defining scope.
+    // This keeps every variable live to scope exit so that callers (e.g.
+    // `module_export` in ImportResolution.qll, or taint-tracking pass-through
+    // through unread locals) can ask "which definition reaches end of
+    // scope?". Mirrors legacy ESSA's `SsaSourceVariable.getAUse()` which
+    // included `getScope().getANormalExit()`.
+    exists(Cfg::ControlFlowNode exit |
+      exit.isNormalExit() and
+      exit.getScope() = v.getVariable().getScope() and
+      bb.getNode(i) = exit and
+      certain = true
+    )
+  }
+}
+
+/**
+ * The shared SSA instantiation for Python.
+ *
+ * Members:
+ *   - `Definition` — the union of explicit, uncertain, and phi definitions
+ *   - `WriteDefinition`, `UncertainWriteDefinition`, `PhiNode`
+ *   - the standard SSA predicates (`getAUse`, `getAnUltimateDefinition`, ...).
+ */
+module Ssa = SsaImplCommon::Make<Py::Location, CfgForSsa, SsaImplInput>;
+
+final class Definition = Ssa::Definition;
+
+final class WriteDefinition = Ssa::WriteDefinition;
+
+final class UncertainWriteDefinition = Ssa::UncertainWriteDefinition;
+
+final class PhiNode = Ssa::PhiNode;
+
+// ===========================================================================
+// ESSA-shaped adapter layer
+//
+// The dataflow library (`python/ql/lib/semmle/python/dataflow/new/`) and
+// related modules (`ApiGraphs.qll`, etc.) consume the legacy ESSA API
+// (`EssaVariable`, `EssaDefinition`, `AssignmentDefinition`,
+// `ScopeEntryDefinition`, `ParameterDefinition`, `WithDefinition`,
+// `PhiFunction`, plus the `AdjacentUses` module). To migrate them off
+// the legacy CFG, we expose the same API surface on top of the
+// shared SSA built above.
+//
+// This adapter is intentionally narrow: it covers only the predicates
+// that new dataflow consumes. The richer legacy ESSA — refinement
+// nodes, attribute refinements, edge refinements — stays available
+// via `semmle.python.essa.Essa` for points-to / legacy code.
+// ===========================================================================
+/**
+ * Gets the CFG node at which a write definition's binding takes place.
+ *
+ * For ordinary writes (assignment, deletion, parameter) this is the
+ * canonical CFG node of the bound Name. For implicit entry definitions
+ * (synthesised at position `-1` of a scope's entry BB) this is the
+ * scope's entry node.
+ */
+private Cfg::ControlFlowNode writeDefNode(Ssa::WriteDefinition def) {
+  exists(CfgImpl::BasicBlock bb, int i | def.definesAt(_, bb, i) |
+    i >= 0 and result = bb.getNode(i)
+    or
+    i = -1 and result = bb.getNode(0)
+  )
+}
+
+/**
+ * A write definition whose binding has a corresponding CFG node — i.e.
+ * everything that's not a phi node. Mirrors legacy ESSA's
+ * `EssaNodeDefinition`.
+ */
+class EssaNodeDefinition extends Ssa::WriteDefinition {
+  /** Gets the CFG node where this definition's binding takes place. */
+  Cfg::ControlFlowNode getDefiningNode() { result = writeDefNode(this) }
+
+  /** Gets the variable defined here (legacy name). */
+  SsaSourceVariable getVariable() { result = this.getSourceVariable() }
+
+  /** Gets the enclosing scope. */
+  Py::Scope getScope() {
+    exists(Cfg::ControlFlowNode n | n = this.getDefiningNode() | result = n.getScope())
+  }
+
+  /**
+   * Holds if this definition defines source variable `v` at CFG node
+   * `defNode`. Flatter form of `getSourceVariable()` +
+   * `getDefiningNode()`, matching legacy ESSA's `definedBy`.
+   */
+  predicate definedBy(SsaSourceVariable v, Cfg::ControlFlowNode defNode) {
+    v = this.getSourceVariable() and defNode = this.getDefiningNode()
+  }
+}
+
+/**
+ * An assignment definition: any binding where the value being assigned
+ * is statically known via `Cfg::DefinitionNode.getValue()`. Includes
+ * plain assignments, walrus, annotated assignments, augmented
+ * assignments, import aliases (`import x` / `from m import x [as y]`),
+ * `with ... as x`, and for-target bindings (where `getValue()` returns
+ * the iter expression's CFG node). Excludes parameter bindings —
+ * those are modelled by `ParameterDefinition`.
+ */
+class AssignmentDefinition extends EssaNodeDefinition {
+  AssignmentDefinition() {
+    exists(Cfg::NameNode n | n = this.getDefiningNode() |
+      exists(n.(Cfg::DefinitionNode).getValue()) and
+      not n.(Cfg::ControlFlowNode).isParameter()
+    )
+  }
+
+  /** Gets the CFG node for the value being assigned, if statically known. */
+  Cfg::ControlFlowNode getValue() {
+    result = this.getDefiningNode().(Cfg::DefinitionNode).getValue()
+  }
+}
+
+/**
+ * A parameter definition — the binding of a parameter name in a
+ * function's scope.
+ */
+class ParameterDefinition extends EssaNodeDefinition {
+  ParameterDefinition() { this.getDefiningNode().isParameter() }
+
+  /** Gets the AST `Parameter` (a `Py::Name` in param context). */
+  Py::Name getParameter() { result = this.getDefiningNode().getNode() }
+}
+
+/**
+ * A definition introduced by a `with ... as x:` clause.
+ */
+class WithDefinition extends EssaNodeDefinition {
+  WithDefinition() {
+    exists(Cfg::NameNode n, Py::With w |
+      n = this.getDefiningNode() and
+      w.getOptionalVars() = n.getNode()
+    )
+  }
+}
+
+/**
+ * An assignment where the LHS is a tuple/list and the RHS is unpacked:
+ * `a, b = (1, 2)` or `a, *rest = xs`. The SSA def lives at the inner
+ * `Name` CFG node, but for IterableUnpacking integration we expose
+ * the enclosing `StarredNode` as the `getDefiningNode()` for `*rest`
+ * patterns — mirroring legacy ESSA's `multi_assignment_definition`,
+ * which placed the def at the StarredNode CFG node.
+ */
+class MultiAssignmentDefinition extends EssaNodeDefinition {
+  MultiAssignmentDefinition() {
+    exists(Cfg::NameNode n | n = super.getDefiningNode() |
+      exists(Py::Assign a, Py::Expr lhs |
+        a.getATarget() = lhs and
+        (lhs instanceof Py::Tuple or lhs instanceof Py::List) and
+        lhs.getASubExpression+() = n.getNode()
+      )
+      or
+      // For-loop with tuple/list target: `for a, b in xs:` —
+      // tuple-unpacking semantics applies to the for-target.
+      exists(Py::For f, Py::Expr lhs |
+        f.getTarget() = lhs and
+        (lhs instanceof Py::Tuple or lhs instanceof Py::List) and
+        lhs.getASubExpression+() = n.getNode()
+      )
+    )
+  }
+
+  override Cfg::ControlFlowNode getDefiningNode() {
+    // Default: the underlying `Name` CFG node (where the SSA def lives).
+    not exists(Cfg::StarredNode s |
+      s.getNode().(Py::Starred).getValue() = super.getDefiningNode().getNode()
+    ) and
+    result = super.getDefiningNode()
+    or
+    // Exception: for `*rest`, expose the enclosing `Starred` CFG node
+    // so that `IterableUnpacking::iterableUnpackingStarredElementStoreStep`
+    // can attach the rest-list to it.
+    exists(Cfg::StarredNode s |
+      s.getNode().(Py::Starred).getValue() = super.getDefiningNode().getNode()
+    |
+      result = s
+    )
+  }
+}
+
+/**
+ * An implicit entry definition for a non-local / captured / global /
+ * builtin variable read in a scope but not defined there.
+ *
+ * Inherits from `EssaNodeDefinition` and exposes the scope's entry node
+ * as its defining node (matching legacy ESSA semantics).
+ */
+class ScopeEntryDefinition extends EssaNodeDefinition {
+  ScopeEntryDefinition() {
+    exists(CfgImpl::BasicBlock bb |
+      this.definesAt(_, bb, -1) and
+      bb instanceof CfgImpl::Cfg::EntryBasicBlock
+    )
+  }
+
+  /** Gets the enclosing scope (the scope whose entry block this def is in). */
+  override Py::Scope getScope() {
+    exists(CfgImpl::BasicBlock bb |
+      this.definesAt(_, bb, -1) and
+      result = bb.getNode(0).(Cfg::ControlFlowNode).getScope()
+    )
+  }
+}
+
+/** A phi node (alias matching legacy naming). */
+class PhiFunction extends PhiNode {
+  /**
+   * Gets an input to this phi function (a definition that flows into
+   * the phi from one of its predecessor blocks). Mirrors legacy
+   * ESSA's `PhiFunction.getAnInput()`.
+   */
+  Ssa::Definition getAnInput() { Ssa::phiHasInputFromBlock(this, result, _) }
+}
+
+/** Base class for all ESSA definitions (legacy-shaped). */
+class EssaDefinition = Ssa::Definition;
+
+/**
+ * An adapter representing a single SSA-defined "variable" — wrapping
+ * one `Ssa::Definition`. Mirrors legacy `EssaVariable` API.
+ */
+class EssaVariable extends Ssa::Definition {
+  /** Gets the underlying SSA definition (legacy name). */
+  Ssa::Definition getDefinition() { result = this }
+
+  /**
+   * Gets a CFG node where this definition is used. Includes regular
+   * `Name` reads as well as the synthetic scope-exit "use" registered
+   * via `SsaImplInput::variableRead` — mirrors legacy ESSA's
+   * `EssaVariable.getAUse()` which inherited the synthetic exit-use
+   * from `SsaSourceVariable`.
+   */
+  Cfg::ControlFlowNode getAUse() {
+    exists(CfgImpl::BasicBlock bb, int i |
+      Ssa::ssaDefReachesRead(this.getSourceVariable(), this, bb, i) and
+      bb.getNode(i) = result
+    )
+  }
+
+  /** Gets the (textual) name of the underlying variable. */
+  string getName() { result = this.getSourceVariable().getVariable().getId() }
+
+  /** Gets the scope in which this variable lives. */
+  Py::Scope getScope() { result = this.getSourceVariable().getVariable().getScope() }
+
+  /** Gets an ultimate non-phi ancestor of this definition. */
+  EssaVariable getAnUltimateDefinition() {
+    if this instanceof PhiNode
+    then
+      exists(Ssa::Definition input |
+        Ssa::phiHasInputFromBlock(this, input, _) and
+        result = input.(EssaVariable).getAnUltimateDefinition()
+      )
+    else result = this
+  }
+}
+
+/**
+ * Adjacent use-use and def-use relations exposed by the shared SSA
+ * library. Provides the same interface as legacy
+ * `semmle.python.essa.SsaCompute::AdjacentUses`.
+ */
+module AdjacentUses {
+  /** Holds if `nodeFrom` and `nodeTo` are adjacent uses of the same SSA variable. */
+  predicate adjacentUseUse(Cfg::NameNode nodeFrom, Cfg::NameNode nodeTo) {
+    exists(SsaSourceVariable v, CfgImpl::BasicBlock bb1, int i1, CfgImpl::BasicBlock bb2, int i2 |
+      Ssa::adjacentUseUse(bb1, i1, bb2, i2, v, _) and
+      nodeFrom = bb1.getNode(i1) and
+      nodeTo = bb2.getNode(i2)
+    )
+  }
+
+  /** Holds if `use` is a first use of definition `def`. */
+  predicate firstUse(Ssa::Definition def, Cfg::NameNode use) {
+    exists(CfgImpl::BasicBlock bb, int i |
+      Ssa::firstUse(def, bb, i, _) and
+      use = bb.getNode(i)
+    )
+  }
+
+  /**
+   * Holds if `use` is any reachable use of definition `def`. Combines
+   * `firstUse` with transitive use-use adjacency.
+   */
+  predicate useOfDef(Ssa::Definition def, Cfg::NameNode use) {
+    firstUse(def, use)
+    or
+    exists(Cfg::NameNode mid | useOfDef(def, mid) and adjacentUseUse(mid, use))
+  }
+}
--- a/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/TaintTrackingPrivate.qll
@@ -1,4 +1,6 @@
 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
 private import FlowSummaryImpl as FlowSummaryImpl
@@ -97,7 +99,7 @@ import Cached
 * and isn't a big problem in practice.
 */
 predicate concatStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
-  exists(BinaryExprNode add | add = nodeTo.getNode() |
+  exists(Cfg::BinaryExprNode add | add = nodeTo.getNode() |
    add.getOp() instanceof Add and add.getAnOperand() = nodeFrom.getNode()
  )
 }
@@ -106,7 +108,7 @@ predicate concatStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
 * Holds if taint can flow from `nodeFrom` to `nodeTo` with a step related to subscripting.
 */
 predicate subscriptStep(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeTo) {
-  nodeTo.getNode().(SubscriptNode).getObject() = nodeFrom.getNode()
+  nodeTo.getNode().(Cfg::SubscriptNode).getObject() = nodeFrom.getNode()
 }

 /**
@@ -122,15 +124,15 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
    (
      call = API::builtin(["str", "bytes", "unicode"]).getACall()
      or
-      call.getFunction().asCfgNode().(NameNode).getId() in ["str", "bytes", "unicode"]
+      call.getFunction().asCfgNode().(Cfg::NameNode).getId() in ["str", "bytes", "unicode"]
    ) and
    nodeFrom in [call.getArg(0), call.getArgByName("object")]
  )
  or
  // String methods. Note that this doesn't recognize `meth = "foo".upper; meth()`
-  exists(CallNode call, string method_name, ControlFlowNode object |
+  exists(Cfg::CallNode call, string method_name, Cfg::ControlFlowNode object |
    call = nodeTo.getNode() and
-    object = call.getFunction().(AttrNode).getObject(method_name)
+    object = call.getFunction().(Cfg::AttrNode).getObject(method_name)
  |
    nodeFrom.getNode() = object and
    method_name in [
@@ -156,7 +158,7 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
  )
  or
  // % formatting
-  exists(BinaryExprNode fmt | fmt = nodeTo.getNode() |
+  exists(Cfg::BinaryExprNode fmt | fmt = nodeTo.getNode() |
    fmt.getOp() instanceof Mod and
    (
      fmt.getLeft() = nodeFrom.getNode()
@@ -166,7 +168,7 @@ predicate stringManipulation(DataFlow::CfgNode nodeFrom, DataFlow::CfgNode nodeT
  )
  or
  // string multiplication -- `"foo" * 10`
-  exists(BinaryExprNode mult | mult = nodeTo.getNode() |
+  exists(Cfg::BinaryExprNode mult | mult = nodeTo.getNode() |
    mult.getOp() instanceof Mult and
    mult.getLeft() = nodeFrom.getNode()
  )
@@ -213,8 +215,8 @@ predicate awaitStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
 * the variable `f` is tainted if the result of `open("foo")` is tainted.
 */
 predicate asyncWithStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-  exists(With with, ControlFlowNode contextManager, ControlFlowNode var |
-    var = any(WithDefinition wd).getDefiningNode()
+  exists(With with, Cfg::ControlFlowNode contextManager, Cfg::ControlFlowNode var |
+    var = any(SsaImpl::WithDefinition wd).getDefiningNode()
  |
    nodeFrom.(DataFlow::CfgNode).getNode() = contextManager and
    nodeTo.(DataFlow::CfgNode).getNode() = var and
--- a/python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll
@@ -2,6 +2,8 @@ import codeql.util.Unit
 import codeql.typetracking.TypeTracking as Shared
 import codeql.typetracking.internal.TypeTrackingImpl as SharedImpl
 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
 private import semmle.python.internal.CachedStages
 private import semmle.python.dataflow.new.internal.DataFlowPublic as DataFlowPublic
 private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
@@ -162,7 +164,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
    // ignore the flow steps from the synthetic sequence node to the real sequence node,
    // since we only support one level of content in type-trackers, and the nested
    // structure requires two levels at least to be useful.
-    not exists(SequenceNode outer |
+    not exists(Cfg::SequenceNode outer |
      outer.getAnElement() = nodeTo.asCfgNode() and
      IterableUnpacking::iterableUnpackingTupleFlowStep(nodeFrom, nodeTo)
    )
@@ -267,7 +269,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
    // Since we only support one level of content in type-trackers we don't actually
    // support `(aa, ab), (ba, bb) = ...`. Therefore we exclude the read-step from `(aa,
    // ab)` to `aa` (since it is not needed).
-    not exists(SequenceNode outer |
+    not exists(Cfg::SequenceNode outer |
      outer.getAnElement() = nodeFrom.asCfgNode() and
      IterableUnpacking::iterableUnpackingTupleFlowStep(_, nodeFrom)
    ) and
@@ -277,7 +279,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
      IterableUnpacking::iterableUnpackingForReadStep(_, _, seq) and
      IterableUnpacking::iterableUnpackingConvertingReadStep(seq, _, elem) and
      IterableUnpacking::iterableUnpackingConvertingStoreStep(elem, _, nodeFrom) and
-      nodeFrom.asCfgNode() instanceof SequenceNode
+      nodeFrom.asCfgNode() instanceof Cfg::SequenceNode
    )
    or
    TypeTrackerSummaryFlow::basicLoadStep(nodeFrom, nodeTo, DataFlowPublic::singleton(content))
@@ -315,13 +317,15 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
    //
    // nodeFrom is `expr`
    // nodeTo is entry node for `f`
-    exists(ScopeEntryDefinition e, SsaSourceVariable var, DefinitionNode def |
+    exists(
+      SsaImpl::ScopeEntryDefinition e, SsaImpl::SsaSourceVariable var, Cfg::DefinitionNode def
+    |
      e.getSourceVariable() = var and
-      var.hasDefiningNode(def)
+      def.getNode() = var.getVariable().getAStore()
    |
      nodeTo.(DataFlowPublic::ScopeEntryDefinitionNode).getDefinition() = e and
      nodeFrom.asCfgNode() = def and
-      var.getScope().getScope*() = nodeFrom.getScope()
+      var.getVariable().getScope().getScope*() = nodeFrom.getScope()
    )
  }

--- a/python/ql/lib/semmle/python/dataflow/new/internal/VariableCapture.qll
+++ b/python/ql/lib/semmle/python/dataflow/new/internal/VariableCapture.qll
@@ -3,6 +3,9 @@ overlay[local]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.controlflow.internal.AstNodeImpl as CfgImpl
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
 private import DataFlowPublic
 private import semmle.python.dataflow.new.internal.DataFlowPrivate
 private import codeql.dataflow.VariableCapture as Shared
@@ -14,10 +17,10 @@ private import codeql.dataflow.VariableCapture as Shared
 // The first is the main implementation, the second is a performance motivated restriction.
 // The restriction is to clear any `CapturedVariableContent` before writing a new one
 // to avoid long access paths (see the link for a nice explanation).
-private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBlock> {
+private module CaptureInput implements Shared::InputSig<Location, CfgImpl::BasicBlock> {
  private import python as PY

-  additional class ExprCfgNode extends ControlFlowNode {
+  additional class ExprCfgNode extends Cfg::ControlFlowNode {
    ExprCfgNode() { isExpressionNode(this) }
  }

@@ -25,7 +28,9 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
    predicate isConstructor() { none() }
  }

-  Callable basicBlockGetEnclosingCallable(Cfg::BasicBlock bb) { result = bb.getScope() }
+  Callable basicBlockGetEnclosingCallable(CfgImpl::BasicBlock bb) {
+    result = bb.getEnclosingCallable().asScope()
+  }

  class CapturedVariable extends LocalVariable {
    Function f;
@@ -51,21 +56,23 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
  class CapturedParameter extends CapturedVariable {
    CapturedParameter() { this.isParameter() }

-    ControlFlowNode getCfgNode() { result.getNode().(Parameter) = this.getAnAccess() }
+    Cfg::ControlFlowNode getCfgNode() { result.getNode().(Parameter) = this.getAnAccess() }
  }

  class Expr extends ExprCfgNode {
-    predicate hasCfgNode(Cfg::BasicBlock bb, int i) { this = bb.getNode(i) }
+    predicate hasCfgNode(CfgImpl::BasicBlock bb, int i) { this = bb.getNode(i) }
  }

-  class VariableWrite extends ControlFlowNode {
+  class VariableWrite extends Cfg::ControlFlowNode {
    CapturedVariable v;

-    VariableWrite() { exists(DefinitionNode d | d.getNode() = v.getAStore() | this = d.getValue()) }
+    VariableWrite() {
+      exists(Cfg::DefinitionNode d | d.getNode() = v.getAStore() | this = d.getValue())
+    }

    CapturedVariable getVariable() { result = v }

-    predicate hasCfgNode(Cfg::BasicBlock bb, int i) { this = bb.getNode(i) }
+    predicate hasCfgNode(CfgImpl::BasicBlock bb, int i) { this = bb.getNode(i) }
  }

  class VariableRead extends Expr {
@@ -80,9 +87,14 @@ private module CaptureInput implements Shared::InputSig<Location, Cfg::BasicBloc
    // TODO: Other languages have an extra case here looking like
    //   simpleAstFlowStep(nodeFrom, nodeTo)
    // we should investigate the potential benefit of adding that.
-    exists(SsaVariable def |
+    exists(SsaImpl::EssaVariable def |
      def.getAUse() = nodeTo and
-      def.getAnUltimateDefinition().getDefinition().(DefinitionNode).getValue() = nodeFrom
+      def.getAnUltimateDefinition()
+          .getDefinition()
+          .(SsaImpl::EssaNodeDefinition)
+          .getDefiningNode()
+          .(Cfg::DefinitionNode)
+          .getValue() = nodeFrom
    )
  }

@@ -107,7 +119,7 @@ class CapturedVariable = CaptureInput::CapturedVariable;

 class ClosureExpr = CaptureInput::ClosureExpr;

-module Flow = Shared::Flow<Location, Cfg, CaptureInput>;
+module Flow = Shared::Flow<Location, Cfg::CfgSigImpl, CaptureInput>;

 private Flow::ClosureNode asClosureNode(Node n) {
  result = n.(SynthCaptureNode).getSynthesizedCaptureNode()
--- a/python/ql/lib/semmle/python/frameworks/Bottle.qll
+++ b/python/ql/lib/semmle/python/frameworks/Bottle.qll
@@ -4,6 +4,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
 private import semmle.python.dataflow.new.RemoteFlowSources
@@ -157,9 +158,9 @@ module Bottle {
        DataFlow::Node value;

        HeaderWriteSubscript() {
-          exists(SubscriptNode subscript |
+          exists(Cfg::SubscriptNode subscript |
            this.asCfgNode() = subscript and
-            value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+            value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
            name.asCfgNode() = subscript.getIndex() and
            subscript.getObject() = headers().asSource().asCfgNode()
          )
--- a/python/ql/lib/semmle/python/frameworks/Django.qll
+++ b/python/ql/lib/semmle/python/frameworks/Django.qll
@@ -4,6 +4,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
@@ -1305,7 +1306,7 @@ module PrivateDjango {
                  dict.(DataFlow::MethodCallNode).calls(files, "dict")
                )
              |
-                this.asCfgNode().(SubscriptNode).getObject() = dict.asCfgNode()
+                this.asCfgNode().(Cfg::SubscriptNode).getObject() = dict.asCfgNode()
                or
                this.(DataFlow::MethodCallNode).calls(dict, "get")
              )
@@ -1314,7 +1315,7 @@ module PrivateDjango {
              exists(DataFlow::AttrRead files, DataFlow::MethodCallNode getlistCall |
                files.accesses(instance(), "FILES") and
                getlistCall.calls(files, "getlist") and
-                this.asCfgNode().(SubscriptNode).getObject() = getlistCall.asCfgNode()
+                this.asCfgNode().(Cfg::SubscriptNode).getObject() = getlistCall.asCfgNode()
              )
            }
          }
@@ -2216,7 +2217,7 @@ module PrivateDjango {
          DataFlow::Node value;

          DjangoResponseCookieSubscriptWrite() {
-            exists(SubscriptNode subscript, DataFlow::AttrRead cookieLookup |
+            exists(Cfg::SubscriptNode subscript, DataFlow::AttrRead cookieLookup |
              // To give `this` a value, we need to choose between either LHS or RHS,
              // and just go with the LHS
              this.asCfgNode() = subscript
@@ -2228,7 +2229,7 @@ module PrivateDjango {
              |
                cookieLookup.flowsTo(subscriptObj)
              ) and
-              value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+              value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
              index.asCfgNode() = subscript.getIndex()
            )
          }
@@ -2249,7 +2250,7 @@ module PrivateDjango {
          DataFlow::Node value;

          DjangoResponseHeaderSubscriptWrite() {
-            exists(SubscriptNode subscript, DataFlow::AttrRead headerLookup |
+            exists(Cfg::SubscriptNode subscript, DataFlow::AttrRead headerLookup |
              // To give `this` a value, we need to choose between either LHS or RHS,
              // and just go with the LHS
              this.asCfgNode() = subscript
@@ -2261,7 +2262,7 @@ module PrivateDjango {
              |
                headerLookup.flowsTo(subscriptObj)
              ) and
-              value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+              value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
              index.asCfgNode() = subscript.getIndex()
            )
          }
@@ -2284,14 +2285,14 @@ module PrivateDjango {
          DataFlow::Node value;

          DjangoResponseSubscriptWrite() {
-            exists(SubscriptNode subscript |
+            exists(Cfg::SubscriptNode subscript |
              // To give `this` a value, we need to choose between either LHS or RHS,
              // and just go with the LHS
              this.asCfgNode() = subscript
            |
              subscript.getObject() =
                DjangoImpl::DjangoHttp::Response::HttpResponse::instance().asCfgNode() and
-              value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+              value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
              index.asCfgNode() = subscript.getIndex()
            )
          }
@@ -2426,7 +2427,7 @@ module PrivateDjango {
    /** Gets a reference to the result of calling the `as_view` classmethod of this class. */
    private DataFlow::TypeTrackingNode asViewResult(DataFlow::TypeTracker t) {
      t.start() and
-      result.asCfgNode().(CallNode).getFunction() = this.asViewRef().asCfgNode()
+      result.asCfgNode().(Cfg::CallNode).getFunction() = this.asViewRef().asCfgNode()
      or
      exists(DataFlow::TypeTracker t2 | result = this.asViewResult(t2).track(t2, t))
    }
--- a/python/ql/lib/semmle/python/frameworks/FastApi.qll
+++ b/python/ql/lib/semmle/python/frameworks/FastApi.qll
@@ -4,6 +4,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
@@ -441,7 +442,7 @@ module FastApi {
      DataFlow::Node value;

      HeaderSubscriptWrite() {
-        exists(SubscriptNode subscript, DataFlow::AttrRead headerLookup |
+        exists(Cfg::SubscriptNode subscript, DataFlow::AttrRead headerLookup |
          // To give `this` a value, we need to choose between either LHS or RHS,
          // and just go with the LHS
          this.asCfgNode() = subscript
@@ -450,7 +451,7 @@ module FastApi {
          exists(DataFlow::Node subscriptObj | subscriptObj.asCfgNode() = subscript.getObject() |
            headerLookup.flowsTo(subscriptObj)
          ) and
-          value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+          value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
          index.asCfgNode() = subscript.getIndex()
        )
      }
--- a/python/ql/lib/semmle/python/frameworks/Gradio.qll
+++ b/python/ql/lib/semmle/python/frameworks/Gradio.qll
@@ -4,6 +4,7 @@
 */

 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import semmle.python.dataflow.new.RemoteFlowSources
 import semmle.python.dataflow.new.TaintTracking
 import semmle.python.ApiGraphs
@@ -51,9 +52,9 @@ module Gradio {
        // limit only to lists of parameters given to `inputs`.
        (
          (
-            call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof ListNode
+            call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof Cfg::ListNode
            or
-            call.getParameter(1).asSink().asCfgNode() instanceof ListNode
+            call.getParameter(1).asSink().asCfgNode() instanceof Cfg::ListNode
          ) and
          (
            this = call.getKeywordParameter("inputs").getASubscript().getAValueReachingSink()
@@ -75,8 +76,8 @@ module Gradio {
      exists(GradioInput call |
        this = call.getParameter(0, "fn").getParameter(_).asSource() and
        // exclude lists of parameters given to `inputs`
-        not call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof ListNode and
-        not call.getParameter(1).asSink().asCfgNode() instanceof ListNode
+        not call.getKeywordParameter("inputs").asSink().asCfgNode() instanceof Cfg::ListNode and
+        not call.getParameter(1).asSink().asCfgNode() instanceof Cfg::ListNode
      )
    }

@@ -105,16 +106,16 @@ module Gradio {
        // handle cases where there are multiple arguments passed as a list to `inputs`
        (
          (
-            node.getKeywordParameter("inputs").asSink().asCfgNode() instanceof ListNode
+            node.getKeywordParameter("inputs").asSink().asCfgNode() instanceof Cfg::ListNode
            or
-            node.getParameter(1).asSink().asCfgNode() instanceof ListNode
+            node.getParameter(1).asSink().asCfgNode() instanceof Cfg::ListNode
          ) and
          exists(int i | nodeTo = node.getParameter(0, "fn").getParameter(i).asSource() |
            nodeFrom.asCfgNode() =
-              node.getKeywordParameter("inputs").asSink().asCfgNode().(ListNode).getElement(i)
+              node.getKeywordParameter("inputs").asSink().asCfgNode().(Cfg::ListNode).getElement(i)
            or
            nodeFrom.asCfgNode() =
-              node.getParameter(1).asSink().asCfgNode().(ListNode).getElement(i)
+              node.getParameter(1).asSink().asCfgNode().(Cfg::ListNode).getElement(i)
          )
        )
      )
--- a/python/ql/lib/semmle/python/frameworks/MarkupSafe.qll
+++ b/python/ql/lib/semmle/python/frameworks/MarkupSafe.qll
@@ -4,6 +4,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
@@ -46,7 +47,7 @@ module MarkupSafeModel {

    /** A direct instantiation of `markupsafe.Markup`. */
    private class ClassInstantiation extends InstanceSource, DataFlow::CallCfgNode {
-      override CallNode node;
+      override Cfg::CallNode node;

      ClassInstantiation() { this = classRef().getACall() }
    }
@@ -64,7 +65,7 @@ module MarkupSafeModel {

    /** A string concatenation with a `markupsafe.Markup` involved. */
    class StringConcat extends Markup::InstanceSource, DataFlow::CfgNode {
-      override BinaryExprNode node;
+      override Cfg::BinaryExprNode node;

      StringConcat() {
        node.getOp() instanceof Add and
@@ -79,7 +80,7 @@ module MarkupSafeModel {

    /** A %-style string format with `markupsafe.Markup` as the format string. */
    class PercentStringFormat extends Markup::InstanceSource, DataFlow::CfgNode {
-      override BinaryExprNode node;
+      override Cfg::BinaryExprNode node;

      PercentStringFormat() {
        node.getOp() instanceof Mod and
--- a/python/ql/lib/semmle/python/frameworks/Pycurl.qll
+++ b/python/ql/lib/semmle/python/frameworks/Pycurl.qll
@@ -7,6 +7,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
 private import semmle.python.frameworks.data.ModelsAsData
@@ -56,7 +57,7 @@ module Pycurl {
    {
      OutgoingRequestCall() {
        this = setopt().getACall() and
-        this.getArg(0).asCfgNode().(AttrNode).getName() = "URL"
+        this.getArg(0).asCfgNode().(Cfg::AttrNode).getName() = "URL"
      }

      override DataFlow::Node getAUrlPart() {
@@ -81,7 +82,7 @@ module Pycurl {
    private class CurlSslCall extends Http::Client::Request::Range instanceof DataFlow::CallCfgNode {
      CurlSslCall() {
        this = setopt().getACall() and
-        this.getArg(0).asCfgNode().(AttrNode).getName() = ["SSL_VERIFYPEER", "SSL_VERIFYHOST"]
+        this.getArg(0).asCfgNode().(Cfg::AttrNode).getName() = ["SSL_VERIFYPEER", "SSL_VERIFYHOST"]
      }

      override DataFlow::Node getAUrlPart() { none() }
--- a/python/ql/lib/semmle/python/frameworks/Pydantic.qll
+++ b/python/ql/lib/semmle/python/frameworks/Pydantic.qll
@@ -7,6 +7,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
@@ -93,7 +94,7 @@ module Pydantic {
      // be a Pydantic model. So `model[0]` will be an overapproximation, but should not
      // really cause problems (since we don't expect real code to contain such accesses)
      nodeFrom = instance() and
-      nodeTo.asCfgNode().(SubscriptNode).getObject() = nodeFrom.asCfgNode()
+      nodeTo.asCfgNode().(Cfg::SubscriptNode).getObject() = nodeFrom.asCfgNode()
    }

    /**
--- a/python/ql/lib/semmle/python/frameworks/Stdlib.qll
+++ b/python/ql/lib/semmle/python/frameworks/Stdlib.qll
@@ -6,6 +6,7 @@ overlay[local?]
 module;

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.dataflow.new.RemoteFlowSources
@@ -1246,7 +1247,7 @@ module StdlibPrivate {
  /** An additional taint step for calls to `os.path.join` */
  private class OsPathJoinCallAdditionalTaintStep extends TaintTracking::AdditionalTaintStep {
    override predicate step(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
-      exists(CallNode call |
+      exists(Cfg::CallNode call |
        nodeTo.asCfgNode() = call and
        call = OS::OsPath::join().getACall().asCfgNode() and
        call.getAnArg() = nodeFrom.asCfgNode()
@@ -1317,13 +1318,13 @@ module StdlibPrivate {
          // run, so if we're able to, we only mark the first element as the command
          // (and not the arguments to the command).
          //
-          result.asCfgNode() = arg_args.asCfgNode().(SequenceNode).getElement(0)
+          result.asCfgNode() = arg_args.asCfgNode().(Cfg::SequenceNode).getElement(0)
          or
          // Either the "args" argument is not a sequence (which is valid) or we where
          // just not able to figure it out. Simply mark the "args" argument as the
          // command.
          //
-          not arg_args.asCfgNode() instanceof SequenceNode and
+          not arg_args.asCfgNode() instanceof Cfg::SequenceNode and
          result = arg_args
        )
      )
@@ -1542,7 +1543,7 @@ module StdlibPrivate {
   * See https://docs.python.org/3/library/functions.html#eval
   */
  private class BuiltinsEvalCall extends CodeExecution::Range, DataFlow::CallCfgNode {
-    override CallNode node;
+    override Cfg::CallNode node;

    BuiltinsEvalCall() { this = API::builtin("eval").getACall() }

@@ -1923,7 +1924,7 @@ module StdlibPrivate {
          nodeFrom = instance().getAValueReachableFromSource() and
          nodeTo = [getvalueRef(), getfirstRef(), getlistRef()].getAValueReachableFromSource()
          or
-          nodeFrom.asCfgNode() = nodeTo.asCfgNode().(CallNode).getFunction() and
+          nodeFrom.asCfgNode() = nodeTo.asCfgNode().(Cfg::CallNode).getFunction() and
          (
            nodeFrom = getvalueRef().getAValueReachableFromSource() and
            nodeTo = getvalueResult().asSource()
@@ -1939,7 +1940,7 @@ module StdlibPrivate {
          nodeFrom in [
              instance().getAValueReachableFromSource(), fieldList().getAValueReachableFromSource()
            ] and
-          nodeTo.asCfgNode().(SubscriptNode).getObject() = nodeFrom.asCfgNode()
+          nodeTo.asCfgNode().(Cfg::SubscriptNode).getObject() = nodeFrom.asCfgNode()
          or
          // Attributes on Field
          nodeFrom = field().getAValueReachableFromSource() and
@@ -2254,8 +2255,8 @@ module StdlibPrivate {
      DataFlow::CfgNode
    {
      WsgirefSimpleServerApplicationReturn() {
-        exists(WsgirefSimpleServerApplication requestHandler, Return ret |
-          ret.getScope() = requestHandler and
+        exists(Return ret |
+          ret.getScope() = any(WsgirefSimpleServerApplication requestHandler) and
          node.getNode() = ret.getValue()
        )
      }
@@ -2338,9 +2339,9 @@ module StdlibPrivate {
        DataFlow::Node value;

        HeaderWriteSubscript() {
-          exists(SubscriptNode subscript |
+          exists(Cfg::SubscriptNode subscript |
            this.asCfgNode() = subscript and
-            value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+            value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
            name.asCfgNode() = subscript.getIndex() and
            subscript.getObject() = instance().asCfgNode()
          )
@@ -2682,7 +2683,7 @@ module StdlibPrivate {
    or
    // Data injection
    //   Special handling of the `/` operator
-    exists(BinaryExprNode slash, DataFlow::Node pathOperand, DataFlow::TypeTracker t2 |
+    exists(Cfg::BinaryExprNode slash, DataFlow::Node pathOperand, DataFlow::TypeTracker t2 |
      slash.getOp() instanceof Div and
      pathOperand.asCfgNode() = slash.getAnOperand() and
      pathlibPath(t2).flowsTo(pathOperand) and
@@ -2807,7 +2808,7 @@ module StdlibPrivate {
      pathlibPath().flowsTo(nodeTo) and
      (
        // Special handling of the `/` operator
-        exists(BinaryExprNode slash, DataFlow::Node pathOperand |
+        exists(Cfg::BinaryExprNode slash, DataFlow::Node pathOperand |
          slash.getOp() instanceof Div and
          pathOperand.asCfgNode() = slash.getAnOperand() and
          pathlibPath().flowsTo(pathOperand)
@@ -4605,9 +4606,9 @@ module StdlibPrivate {
    }

    override predicate propagatesFlow(string input, string output, boolean preservesValue) {
-      exists(CallNode c, string name, ControlFlowNode n, DataFlow::AttributeContent ac |
-        c.getFunction().(NameNode).getId() = "replace" or
-        c.getFunction().(AttrNode).getName() = "replace"
+      exists(Cfg::CallNode c, string name, Cfg::ControlFlowNode n, DataFlow::AttributeContent ac |
+        c.getFunction().(Cfg::NameNode).getId() = "replace" or
+        c.getFunction().(Cfg::AttrNode).getName() = "replace"
      |
        n = c.getArgByName(name) and
        ac.getAttribute() = name and
@@ -5171,10 +5172,10 @@ module StdlibPrivate {
 * See https://docs.python.org/3.9/library/stdtypes.html#str.startswith
 */
 private class StartswithCall extends Path::SafeAccessCheck::Range {
-  StartswithCall() { this.(CallNode).getFunction().(AttrNode).getName() = "startswith" }
+  StartswithCall() { this.(Cfg::CallNode).getFunction().(Cfg::AttrNode).getName() = "startswith" }

-  override predicate checks(ControlFlowNode node, boolean branch) {
-    node = this.(CallNode).getFunction().(AttrNode).getObject() and
+  override predicate checks(Cfg::ControlFlowNode node, boolean branch) {
+    node = this.(Cfg::CallNode).getFunction().(Cfg::AttrNode).getObject() and
    branch = true
  }
 }
--- a/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib.qll
+++ b/python/ql/lib/semmle/python/frameworks/Stdlib/Urllib.qll
@@ -8,6 +8,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
 private import semmle.python.security.dataflow.UrlRedirectCustomizations
@@ -91,7 +92,7 @@ private module Urllib {
     * A read of the `netloc` attribute of a parsed URL as returned by `urllib.parse.urlparse`,
     * which is being checked in a way that is relevant for URL redirection vulnerabilities.
     */
-    private predicate netlocCheck(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
+    private predicate netlocCheck(DataFlow::GuardNode g, Cfg::ControlFlowNode node, boolean branch) {
      exists(DataFlow::CallCfgNode urlParseCall, DataFlow::AttrRead netlocRead |
        urlParseCall = getUrlParseCall() and
        netlocRead = urlParseCall.getAnAttributeRead("netloc") and
--- a/python/ql/lib/semmle/python/frameworks/Tornado.qll
+++ b/python/ql/lib/semmle/python/frameworks/Tornado.qll
@@ -4,6 +4,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.TaintTracking
@@ -72,9 +73,9 @@ module Tornado {
      DataFlow::Node value;

      TornadoHeaderSubscriptWrite() {
-        exists(SubscriptNode subscript |
+        exists(Cfg::SubscriptNode subscript |
          subscript.getObject() = instance().asCfgNode() and
-          value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+          value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
          index.asCfgNode() = subscript.getIndex() and
          this.asCfgNode() = subscript
        )
@@ -422,7 +423,7 @@ module Tornado {
            // be able to do something more structured for providing modeling of the members
            // of a container-object.
            exists(DataFlow::AttrRead files | files.accesses(instance(), "cookies") |
-              this.asCfgNode().(SubscriptNode).getObject() = files.asCfgNode()
+              this.asCfgNode().(Cfg::SubscriptNode).getObject() = files.asCfgNode()
              or
              this.(DataFlow::MethodCallNode).calls(files, "get")
            )
@@ -479,20 +480,20 @@ module Tornado {
  // routing
  // ---------------------------------------------------------------------------
  /** Gets a sequence that defines a number of route rules */
-  SequenceNode routeSetupRuleList() {
-    exists(CallNode call |
+  Cfg::SequenceNode routeSetupRuleList() {
+    exists(Cfg::CallNode call |
      call = any(TornadoModule::Web::Application::ClassInstantiation c).asCfgNode()
    |
      result in [call.getArg(0), call.getArgByName("handlers")]
    )
    or
-    exists(CallNode call |
+    exists(Cfg::CallNode call |
      call.getFunction() = TornadoModule::Web::Application::add_handlers().asCfgNode()
    |
      result in [call.getArg(1), call.getArgByName("host_handlers")]
    )
    or
-    result = routeSetupRuleList().getElement(_).(TupleNode).getElement(1)
+    result = routeSetupRuleList().getElement(_).(Cfg::TupleNode).getElement(1)
  }

  /** A tornado route setup. */
@@ -515,12 +516,12 @@ module Tornado {

  /** A route setup using a tuple. */
  private class TornadoTupleRouteSetup extends TornadoRouteSetup, DataFlow::CfgNode {
-    override TupleNode node;
+    override Cfg::TupleNode node;

    TornadoTupleRouteSetup() {
      node = routeSetupRuleList().getElement(_) and
      count(node.getElement(_)) = 2 and
-      not node.getElement(1) instanceof SequenceNode
+      not node.getElement(1) instanceof Cfg::SequenceNode
    }

    override DataFlow::Node getUrlPatternArg() { result.asCfgNode() = node.getElement(0) }
--- a/python/ql/lib/semmle/python/frameworks/Werkzeug.qll
+++ b/python/ql/lib/semmle/python/frameworks/Werkzeug.qll
@@ -6,6 +6,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.ApiGraphs
@@ -221,9 +222,9 @@ module Werkzeug {
      DataFlow::Node value;

      HeaderWriteSubscript() {
-        exists(SubscriptNode subscript |
+        exists(Cfg::SubscriptNode subscript |
          this.asCfgNode() = subscript and
-          value.asCfgNode() = subscript.(DefinitionNode).getValue() and
+          value.asCfgNode() = subscript.(Cfg::DefinitionNode).getValue() and
          name.asCfgNode() = subscript.getIndex() and
          subscript.getObject() = instance().asCfgNode()
        )
--- a/python/ql/lib/semmle/python/frameworks/Yaml.qll
+++ b/python/ql/lib/semmle/python/frameworks/Yaml.qll
@@ -8,6 +8,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
@@ -28,7 +29,7 @@ private module Yaml {
   * See https://pyyaml.org/wiki/PyYAMLDocumentation (you will have to scroll down).
   */
  private class YamlLoadCall extends Decoding::Range, DataFlow::CallCfgNode {
-    override CallNode node;
+    override Cfg::CallNode node;
    string func_name;

    YamlLoadCall() {
--- a/python/ql/lib/semmle/python/frameworks/Yarl.qll
+++ b/python/ql/lib/semmle/python/frameworks/Yarl.qll
@@ -4,6 +4,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Concepts
@@ -111,7 +112,7 @@ module Yarl {
    }

    private predicate yarlUrlIsAbsoluteCall(
-      DataFlow::GuardNode g, ControlFlowNode node, boolean branch
+      DataFlow::GuardNode g, Cfg::ControlFlowNode node, boolean branch
    ) {
      exists(ClassInstantiation instance, DataFlow::MethodCallNode call |
        call.calls(instance, "is_absolute") and
--- a/python/ql/lib/semmle/python/frameworks/internal/SubclassFinder.qll
+++ b/python/ql/lib/semmle/python/frameworks/internal/SubclassFinder.qll
@@ -11,6 +11,7 @@ private import semmle.python.dataflow.new.internal.ImportResolution
 private import semmle.python.ApiGraphs
 private import semmle.python.filters.Tests
 private import semmle.python.Module
+private import semmle.python.controlflow.internal.Cfg as Cfg

 // very much inspired by the draft at https://github.com/github/codeql/pull/5632
 module NotExposed {
@@ -206,7 +207,7 @@ module NotExposed {
    string relevantName, Location loc
  ) {
    loc = mod.getLocation() and
-    exists(API::Node relevantClass, ControlFlowNode value |
+    exists(API::Node relevantClass, Cfg::ControlFlowNode value |
      relevantClass = newOrExistingModeling(spec).getASubclass*() and
      ImportResolution::module_export(mod, relevantName, def) and
      value = relevantClass.getAValueReachableFromSource().asCfgNode() and
--- a/python/ql/lib/semmle/python/regexp/internal/ParseRegExp.qll
+++ b/python/ql/lib/semmle/python/regexp/internal/ParseRegExp.qll
@@ -3,6 +3,7 @@
 */

 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts as Concepts
 private import semmle.python.regex
@@ -78,7 +79,7 @@ private module FindRegexMode {
    t.start() and
    exists(API::Node flag | flag_name = canonical_name(flag) and result = flag.asSource())
    or
-    exists(BinaryExprNode binop, DataFlow::Node operand |
+    exists(Cfg::BinaryExprNode binop, DataFlow::Node operand |
      operand.getALocalSource() = re_flag_tracker(flag_name, t.continue()) and
      operand.asCfgNode() = binop.getAnOperand() and
      (binop.getOp() instanceof BitOr or binop.getOp() instanceof Add) and
--- a/python/ql/lib/semmle/python/security/dataflow/ExceptionInfo.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/ExceptionInfo.qll
@@ -3,6 +3,7 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 private import semmle.python.ApiGraphs
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /**
 * INTERNAL: Do not use.
@@ -29,7 +30,7 @@ private class TracebackFunctionCall extends ExceptionInfo, DataFlow::CallCfgNode
 private class CaughtException extends ExceptionInfo {
  CaughtException() {
    this.asExpr() = any(ExceptStmt s).getName() and
-    this.asCfgNode() = any(EssaNodeDefinition def).getDefiningNode()
+    this.asCfgNode().(Cfg::NameNode).defines(_)
  }
 }

--- a/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/ServerSideRequestForgeryCustomizations.qll
@@ -11,6 +11,7 @@ private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.dataflow.new.BarrierGuards
 private import semmle.python.ApiGraphs
 private import semmle.python.frameworks.data.internal.ApiGraphModels
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /**
 * Provides default sources, sinks and sanitizers for detecting
@@ -95,7 +96,7 @@ module ServerSideRequestForgery {
  class StringConstructionAsFullUrlControlSanitizer extends FullUrlControlSanitizer {
    StringConstructionAsFullUrlControlSanitizer() {
      // string concat
-      exists(BinaryExprNode add |
+      exists(Cfg::BinaryExprNode add |
        add.getOp() instanceof Add and
        add.getRight() = this.asCfgNode() and
        not add.getLeft().getNode().(StringLiteral).getText().toLowerCase() in [
@@ -104,7 +105,7 @@ module ServerSideRequestForgery {
      )
      or
      // % formatting
-      exists(BinaryExprNode fmt |
+      exists(Cfg::BinaryExprNode fmt |
        fmt.getOp() instanceof Mod and
        fmt.getRight() = this.asCfgNode() and
        // detecting %-formatting is not super easy, so we simplify it to only handle
@@ -155,7 +156,9 @@ module ServerSideRequestForgery {
    }
  }

-  private predicate stringRestriction(DataFlow::GuardNode g, ControlFlowNode node, boolean branch) {
+  private predicate stringRestriction(
+    DataFlow::GuardNode g, Cfg::ControlFlowNode node, boolean branch
+  ) {
    exists(DataFlow::MethodCallNode call, DataFlow::Node strNode |
      call.asCfgNode() = g and strNode.asCfgNode() = node
    |
--- a/python/ql/lib/semmle/python/security/dataflow/TarSlipCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/TarSlipCustomizations.qll
@@ -9,6 +9,7 @@ private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
 private import semmle.python.dataflow.new.BarrierGuards
 private import semmle.python.ApiGraphs
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /**
 * Provides default sources, sinks and sanitizers for detecting
@@ -139,8 +140,8 @@ module TarSlip {
   * where `<check_path>` is any function matching `"%path"`.
   * `info` is assumed to be a `TarInfo` instance.
   */
-  predicate tarFileInfoSanitizer(DataFlow::GuardNode g, ControlFlowNode tarInfo, boolean branch) {
-    exists(CallNode call, AttrNode attr |
+  predicate tarFileInfoSanitizer(DataFlow::GuardNode g, Cfg::ControlFlowNode tarInfo, boolean branch) {
+    exists(Cfg::CallNode call, Cfg::AttrNode attr |
      g = call and
      // We must test the name of the tar info object.
      attr = call.getAnArg() and
@@ -148,9 +149,9 @@ module TarSlip {
      attr.getObject() = tarInfo
    |
      // The assumption that any test that matches %path is a sanitizer might be too broad.
-      call.getAChild*().(AttrNode).getName().matches("%path")
+      call.getAChild*().(Cfg::AttrNode).getName().matches("%path")
      or
-      call.getAChild*().(NameNode).getId().matches("%path")
+      call.getAChild*().(Cfg::NameNode).getId().matches("%path")
    ) and
    branch = false
  }
--- a/python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
+++ b/python/ql/lib/semmle/python/security/dataflow/UrlRedirectCustomizations.qll
@@ -5,6 +5,7 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.DataFlow
 private import semmle.python.Concepts
 private import semmle.python.ApiGraphs
@@ -111,7 +112,7 @@ module UrlRedirect {
      // Url redirection is a problem only if the user controls the prefix of the URL.
      // TODO: This is a copy of the taint-sanitizer from the old points-to query, which doesn't
      // cover formatting.
-      exists(BinaryExprNode string_concat | string_concat.getOp() instanceof Add |
+      exists(Cfg::BinaryExprNode string_concat | string_concat.getOp() instanceof Add |
        string_concat.getRight() = this.asCfgNode()
      )
    }
--- a/python/ql/lib/utils/test/dataflow/MaximalFlowTest.qll
+++ b/python/ql/lib/utils/test/dataflow/MaximalFlowTest.qll
@@ -1,4 +1,5 @@
 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import semmle.python.dataflow.new.DataFlow
 private import semmle.python.dataflow.new.internal.DataFlowPrivate
 import FlowTest
@@ -23,7 +24,7 @@ import MakeTest<MakeTestSig<MaximalFlowTest>>
 module MaximalFlowsConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node node) {
    exists(node.getLocation().getFile().getRelativePath()) and
-    not node.asCfgNode() instanceof CallNode and
+    not node.asCfgNode() instanceof Cfg::CallNode and
    not node.asCfgNode().getNode() instanceof Return and
    not node instanceof DataFlow::ParameterNode and
    not node instanceof DataFlow::PostUpdateNode and
@@ -34,9 +35,9 @@ module MaximalFlowsConfig implements DataFlow::ConfigSig {

  predicate isSink(DataFlow::Node node) {
    exists(node.getLocation().getFile().getRelativePath()) and
-    not any(CallNode c).getArg(_) = node.asCfgNode() and
+    not any(Cfg::CallNode c).getArg(_) = node.asCfgNode() and
    not isArgumentNode(node, _, _) and
-    not node.asCfgNode().(NameNode).getId().matches("SINK%") and
+    not node.asCfgNode().(Cfg::NameNode).getId().matches("SINK%") and
    not DataFlow::localFlowStep(node, _)
  }
 }
--- a/python/ql/lib/utils/test/dataflow/NormalDataflowTest.qll
+++ b/python/ql/lib/utils/test/dataflow/NormalDataflowTest.qll
@@ -1,4 +1,5 @@
 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import utils.test.dataflow.FlowTest
 import utils.test.dataflow.testConfig
 private import semmle.python.dataflow.new.internal.PrintNode
@@ -19,7 +20,7 @@ query predicate missingAnnotationOnSink(Location location, string error, string
    TestConfig::isSink(sink) and
    // note: we only care about `SINK` and not `SINK_F`, so we have to reconstruct manually.
    exists(DataFlow::CallCfgNode call |
-      call.getFunction().asCfgNode().(NameNode).getId() = "SINK" and
+      call.getFunction().asCfgNode().(Cfg::NameNode).getId() = "SINK" and
      (sink = call.getArg(_) or sink = call.getArgByName(_))
    ) and
    location = sink.getLocation() and
--- a/python/ql/lib/utils/test/dataflow/NormalTaintTrackingTest.qll
+++ b/python/ql/lib/utils/test/dataflow/NormalTaintTrackingTest.qll
@@ -1,4 +1,5 @@
 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import utils.test.dataflow.FlowTest
 import utils.test.dataflow.testTaintConfig
 private import semmle.python.dataflow.new.internal.PrintNode
@@ -18,7 +19,7 @@ query predicate missingAnnotationOnSink(Location location, string error, string
  exists(DataFlow::Node sink |
    exists(DataFlow::CallCfgNode call |
      // note: we only care about `SINK` and not `SINK_F`, so we have to reconstruct manually.
-      call.getFunction().asCfgNode().(NameNode).getId() = "SINK" and
+      call.getFunction().asCfgNode().(Cfg::NameNode).getId() = "SINK" and
      (sink = call.getArg(_) or sink = call.getArgByName(_))
    ) and
    location = sink.getLocation() and
--- a/python/ql/lib/utils/test/dataflow/RoutingTest.qll
+++ b/python/ql/lib/utils/test/dataflow/RoutingTest.qll
@@ -1,4 +1,5 @@
 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import semmle.python.dataflow.new.DataFlow
 import utils.test.InlineExpectationsTest
 private import semmle.python.dataflow.new.internal.PrintNode
@@ -49,7 +50,7 @@ private string fromValue(DataFlow::Node fromNode) {

 pragma[inline]
 private string fromFunc(DataFlow::ArgumentNode fromNode) {
-  result = fromNode.getCall().getNode().(CallNode).getFunction().getNode().(Name).getId()
+  result = fromNode.getCall().getNode().(Cfg::CallNode).getFunction().getNode().(Name).getId()
 }

 pragma[inline]
--- a/python/ql/lib/utils/test/dataflow/UnresolvedCalls.qll
+++ b/python/ql/lib/utils/test/dataflow/UnresolvedCalls.qll
@@ -1,15 +1,16 @@
 import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 private import semmle.python.dataflow.new.internal.PrintNode
 private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
 private import semmle.python.ApiGraphs
 import utils.test.InlineExpectationsTest

 signature module UnresolvedCallExpectationsSig {
-  predicate unresolvedCall(CallNode call);
+  predicate unresolvedCall(Cfg::CallNode call);
 }

 module DefaultUnresolvedCallExpectations implements UnresolvedCallExpectationsSig {
-  predicate unresolvedCall(CallNode call) {
+  predicate unresolvedCall(Cfg::CallNode call) {
    not exists(DataFlowPrivate::DataFlowCall dfc |
      exists(dfc.getCallable()) and dfc.getNode() = call
    ) and
@@ -24,7 +25,7 @@ module MakeUnresolvedCallExpectations<UnresolvedCallExpectationsSig Impl> {

    predicate hasActualResult(Location location, string element, string tag, string value) {
      exists(location.getFile().getRelativePath()) and
-      exists(CallNode call | Impl::unresolvedCall(call) |
+      exists(Cfg::CallNode call | Impl::unresolvedCall(call) and call.injects(_) |
        location = call.getLocation() and
        tag = "unresolved_call" and
        value = prettyExpr(call.getNode()) and
--- a/python/ql/lib/utils/test/dataflow/testConfig.qll
+++ b/python/ql/lib/utils/test/dataflow/testConfig.qll
@@ -21,11 +21,12 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import semmle.python.dataflow.new.DataFlow

 module TestConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node node) {
-    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "SOURCE"
+    node.(DataFlow::CfgNode).getNode().(Cfg::NameNode).getId() = "SOURCE"
    or
    node.(DataFlow::CfgNode).getNode().getNode().(StringLiteral).getS() = "source"
    or
@@ -37,7 +38,7 @@ module TestConfig implements DataFlow::ConfigSig {

  predicate isSink(DataFlow::Node node) {
    exists(DataFlow::CallCfgNode call |
-      call.getFunction().asCfgNode().(NameNode).getId() in ["SINK", "SINK_F"] and
+      call.getFunction().asCfgNode().(Cfg::NameNode).getId() in ["SINK", "SINK_F"] and
      (node = call.getArg(_) or node = call.getArgByName(_)) and
      not node = call.getArgByName("not_present_at_runtime")
    )
--- a/python/ql/lib/utils/test/dataflow/testTaintConfig.qll
+++ b/python/ql/lib/utils/test/dataflow/testTaintConfig.qll
@@ -21,12 +21,13 @@
 */

 private import python
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.TaintTracking

 module TestConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node node) {
-    node.(DataFlow::CfgNode).getNode().(NameNode).getId() = "SOURCE"
+    node.(DataFlow::CfgNode).getNode().(Cfg::NameNode).getId() = "SOURCE"
    or
    node.(DataFlow::CfgNode).getNode().getNode().(StringLiteral).getS() = "source"
    or
@@ -37,8 +38,8 @@ module TestConfig implements DataFlow::ConfigSig {
  }

  predicate isSink(DataFlow::Node node) {
-    exists(CallNode call |
-      call.getFunction().(NameNode).getId() in ["SINK", "SINK_F"] and
+    exists(Cfg::CallNode call |
+      call.getFunction().(Cfg::NameNode).getId() in ["SINK", "SINK_F"] and
      node.(DataFlow::CfgNode).getNode() = call.getAnArg()
    )
  }
--- a/python/ql/src/Exceptions/UnguardedNextInGenerator.ql
+++ b/python/ql/src/Exceptions/UnguardedNextInGenerator.ql
@@ -12,6 +12,8 @@

 import python
 private import semmle.python.ApiGraphs
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.Flow as Flow

 API::Node iter() { result = API::builtin("iter") }

@@ -19,17 +21,17 @@ API::Node next() { result = API::builtin("next") }

 API::Node stopIteration() { result = API::builtin("StopIteration") }

-predicate call_to_iter(CallNode call, EssaVariable sequence) {
-  call = iter().getACall().asCfgNode() and
+predicate call_to_iter(Flow::CallNode call, EssaVariable sequence) {
+  call.getNode() = iter().getACall().asCfgNode().(Cfg::CallNode).getNode() and
  call.getArg(0) = sequence.getAUse()
 }

-predicate call_to_next(CallNode call, ControlFlowNode iter) {
-  call = next().getACall().asCfgNode() and
+predicate call_to_next(Flow::CallNode call, Flow::ControlFlowNode iter) {
+  call.getNode() = next().getACall().asCfgNode().(Cfg::CallNode).getNode() and
  call.getArg(0) = iter
 }

-predicate call_to_next_has_default(CallNode call) {
+predicate call_to_next_has_default(Flow::CallNode call) {
  exists(call.getArg(1)) or exists(call.getArgByName("default"))
 }

@@ -49,14 +51,14 @@ predicate iter_not_exhausted(EssaVariable iterator) {
  )
 }

-predicate stop_iteration_handled(CallNode call) {
+predicate stop_iteration_handled(Flow::CallNode call) {
  exists(Try t |
    t.containsInScope(call.getNode()) and
    t.getAHandler().getType() = stopIteration().getAValueReachableFromSource().asExpr()
  )
 }

-from CallNode call
+from Flow::CallNode call
 where
  call_to_next(call, _) and
  not call_to_next_has_default(call) and
--- a/python/ql/src/Expressions/UseofApply.ql
+++ b/python/ql/src/Expressions/UseofApply.ql
@@ -11,8 +11,9 @@

 import python
 private import semmle.python.ApiGraphs
+private import semmle.python.controlflow.internal.Cfg as Cfg

-from CallNode call
+from Cfg::CallNode call
 where
  major_version() = 2 and
  call = API::builtin("apply").getACall().asCfgNode()
--- a/python/ql/src/Functions/SignatureOverriddenMethod.ql
+++ b/python/ql/src/Functions/SignatureOverriddenMethod.ql
@@ -15,6 +15,7 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.dataflow.new.internal.DataFlowDispatch
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import codeql.util.Option

 /** Holds if `base` is overridden by `sub` */
@@ -143,7 +144,7 @@ predicate ignore(Function f) {

 /** Gets a function that `call` may resolve to. */
 Function resolveCall(Call call) {
-  exists(DataFlowCall dfc | call = dfc.getNode().(CallNode).getNode() |
+  exists(DataFlowCall dfc | call = dfc.getNode().(Cfg::CallNode).getNode() |
    result = viableCallable(dfc).(DataFlowFunction).getScope()
  )
 }
--- a/python/ql/src/Resources/FileNotAlwaysClosedQuery.qll
+++ b/python/ql/src/Resources/FileNotAlwaysClosedQuery.qll
@@ -4,6 +4,7 @@ import python
 import semmle.python.dataflow.new.internal.DataFlowDispatch
 import semmle.python.ApiGraphs
 private import semmle.python.dataflow.new.internal.ReExposedInstance
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /** A CFG node where a file is opened. */
 abstract class FileOpenSource extends DataFlow::CfgNode { }
@@ -81,12 +82,14 @@ abstract class FileClose extends DataFlow::CfgNode {
  }
 }

-private predicate bbSuccessor(BasicBlock src, BasicBlock sink) { sink = src.getASuccessor() }
+private predicate bbSuccessor(Cfg::BasicBlock src, Cfg::BasicBlock sink) {
+  sink = src.getASuccessor()
+}

-private predicate bbReachableStrict(BasicBlock src, BasicBlock sink) =
+private predicate bbReachableStrict(Cfg::BasicBlock src, Cfg::BasicBlock sink) =
  fastTC(bbSuccessor/2)(src, sink)

-private predicate bbReachableRefl(BasicBlock src, BasicBlock sink) {
+private predicate bbReachableRefl(Cfg::BasicBlock src, Cfg::BasicBlock sink) {
  bbReachableStrict(src, sink) or src = sink
 }

--- a/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
+++ b/python/ql/src/Security/CWE-020-ExternalAPIs/ExternalAPIs.qll
@@ -10,6 +10,7 @@ private import semmle.python.dataflow.new.RemoteFlowSources
 private import semmle.python.ApiGraphs
 private import semmle.python.dataflow.new.internal.DataFlowPrivate as DataFlowPrivate
 private import semmle.python.dataflow.new.internal.TaintTrackingPrivate as TaintTrackingPrivate
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /**
 * An external API that is considered "safe" from a security perspective.
@@ -71,7 +72,7 @@ string apiNodeToStringRepr(API::Node node) {
  )
 }

-predicate resolvedCall(CallNode call) {
+predicate resolvedCall(Cfg::CallNode call) {
  DataFlowPrivate::resolveCall(call, _, _) or
  DataFlowPrivate::resolveClassCall(call, _)
 }
--- a/python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.ql
+++ b/python/ql/src/Security/CWE-079/Jinja2WithoutEscaping.ql
@@ -14,6 +14,7 @@
 import python
 import semmle.python.dataflow.new.DataFlow
 import semmle.python.ApiGraphs
+private import semmle.python.controlflow.internal.Cfg as Cfg

 /*
 * Jinja 2 Docs:
@@ -36,8 +37,8 @@ private API::Node jinja2EnvironmentOrTemplate() {
 from API::CallNode call
 where
  call = jinja2EnvironmentOrTemplate().getACall() and
-  not exists(call.asCfgNode().(CallNode).getNode().getStarargs()) and
-  not exists(call.asCfgNode().(CallNode).getNode().getKwargs()) and
+  not exists(call.asCfgNode().(Cfg::CallNode).getNode().getStarargs()) and
+  not exists(call.asCfgNode().(Cfg::CallNode).getNode().getKwargs()) and
  (
    not exists(call.getArgByName("autoescape"))
    or
--- a/python/ql/src/Security/CWE-327/PyOpenSSL.qll
+++ b/python/ql/src/Security/CWE-327/PyOpenSSL.qll
@@ -5,6 +5,7 @@

 private import python
 private import semmle.python.ApiGraphs
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import TlsLibraryModel

 class PyOpenSslContextCreation extends ContextCreation, DataFlow::CallCfgNode {
@@ -37,10 +38,10 @@ class ConnectionCall extends ConnectionCreation, DataFlow::CallCfgNode {
 // This cannot be used to unrestrict,
 // see https://www.pyopenssl.org/en/stable/api/ssl.html#OpenSSL.SSL.Context.set_options
 class SetOptionsCall extends ProtocolRestriction, DataFlow::CallCfgNode {
-  SetOptionsCall() { node.getFunction().(AttrNode).getName() = "set_options" }
+  SetOptionsCall() { node.getFunction().(Cfg::AttrNode).getName() = "set_options" }

  override DataFlow::CfgNode getContext() {
-    result.getNode() = node.getFunction().(AttrNode).getObject()
+    result.getNode() = node.getFunction().(Cfg::AttrNode).getObject()
  }

  override ProtocolVersion getRestriction() {
--- a/python/ql/src/Security/CWE-327/Ssl.qll
+++ b/python/ql/src/Security/CWE-327/Ssl.qll
@@ -5,6 +5,7 @@

 private import python
 private import semmle.python.ApiGraphs
+private import semmle.python.controlflow.internal.Cfg as Cfg
 import TlsLibraryModel

 class SslContextCreation extends ContextCreation, DataFlow::CallCfgNode {
@@ -53,7 +54,7 @@ class OptionsAugOr extends ProtocolRestriction, DataFlow::CfgNode {
  ProtocolVersion restriction;

  OptionsAugOr() {
-    exists(AugAssign aa, AttrNode attr, Expr flag |
+    exists(AugAssign aa, Cfg::AttrNode attr, Expr flag |
      aa.getOperation().getOp() instanceof BitOr and
      aa.getTarget() = attr.getNode() and
      attr.getName() = "options" and
@@ -80,7 +81,7 @@ class OptionsAugAndNot extends ProtocolUnrestriction, DataFlow::CfgNode {
  ProtocolVersion restriction;

  OptionsAugAndNot() {
-    exists(AugAssign aa, AttrNode attr, Expr flag, UnaryExpr notFlag |
+    exists(AugAssign aa, Cfg::AttrNode attr, Expr flag, UnaryExpr notFlag |
      aa.getOperation().getOp() instanceof BitAnd and
      aa.getTarget() = attr.getNode() and
      attr.getName() = "options" and
--- a/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
+++ b/python/ql/src/Security/CWE-798/HardcodedCredentials.ql
@@ -19,6 +19,7 @@ import semmle.python.filters.Tests
 private import semmle.python.dataflow.new.internal.DataFlowDispatch as DataFlowDispatch
 private import semmle.python.dataflow.new.internal.Builtins::Builtins as Builtins
 private import semmle.python.frameworks.data.ModelsAsData
+private import semmle.python.controlflow.internal.Cfg as Cfg

 bindingset[char, fraction]
 predicate fewer_characters_than(StringLiteral str, string char, float fraction) {
@@ -48,7 +49,7 @@ predicate capitalized_word(StringLiteral str) { str.getText().regexpMatch("[A-Z]

 predicate format_string(StringLiteral str) { str.getText().matches("%{%}%") }

-predicate maybeCredential(ControlFlowNode f) {
+predicate maybeCredential(Cfg::ControlFlowNode f) {
  /* A string that is not too short and unlikely to be text or an identifier. */
  exists(StringLiteral str | str = f.getNode() |
    /* At least 10 characters */
@@ -96,7 +97,7 @@ class CredentialSink extends DataFlow::Node {
      or
      exists(Keyword k | k.getArg() = name and this.asCfgNode().getNode() = k.getValue())
      or
-      exists(CompareNode cmp, NameNode n | n.getId() = name |
+      exists(Cfg::CompareNode cmp, Cfg::NameNode n | n.getId() = name |
        cmp.operands(this.asCfgNode(), any(Eq eq), n)
        or
        cmp.operands(n, any(Eq eq), this.asCfgNode())
--- a/python/ql/src/Statements/ModificationOfLocals.ql
+++ b/python/ql/src/Statements/ModificationOfLocals.ql
@@ -14,8 +14,9 @@
 import python
 private import semmle.python.ApiGraphs
 private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.controlflow.internal.Cfg as Cfg

-predicate originIsLocals(ControlFlowNode n) {
+predicate originIsLocals(Cfg::ControlFlowNode n) {
  // Only consider the `locals()` dictionary within the scope that called `locals()`.
  // Once the dictionary is passed to another scope (e.g. as an argument or via an
  // instance attribute) it is just an ordinary mapping, and modifying it is both
@@ -28,19 +29,19 @@ predicate originIsLocals(ControlFlowNode n) {
  )
 }

-predicate modification_of_locals(ControlFlowNode f) {
-  originIsLocals(f.(SubscriptNode).getObject()) and
+predicate modification_of_locals(Cfg::ControlFlowNode f) {
+  originIsLocals(f.(Cfg::SubscriptNode).getObject()) and
  (f.isStore() or f.isDelete())
  or
-  exists(string mname, AttrNode attr |
-    attr = f.(CallNode).getFunction() and
+  exists(string mname, Cfg::AttrNode attr |
+    attr = f.(Cfg::CallNode).getFunction() and
    originIsLocals(attr.getObject(mname))
  |
    mname in ["pop", "popitem", "update", "clear"]
  )
 }

-from AstNode a, ControlFlowNode f
+from AstNode a, Cfg::ControlFlowNode f
 where
  modification_of_locals(f) and
  a = f.getNode() and
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
yoff	893301098c	Python: visit function parameter and return annotations in new CFG The new (shared-CFG-based) Python control flow graph in `semmle.python.controlflow.internal.Cfg` previously did not emit CFG nodes for parameter type annotations (`def f(x: T): ...`) or for the return type annotation (`-> T`). The legacy CFG emitted both, and a small number of framework models rely on this: `LocalSources.qll`'s `annotatedInstance` walks the parameter annotation expression by way of its CFG node to track that a parameter receives an instance of the annotated class. After the dataflow flip to the new CFG/SSA this regression manifested as lost flows in any test exercising annotation-based parameter tracking: FastAPI `Depends()` receivers, Pydantic request bodies, Starlette `WebSocket`, the call-graph type-annotation test, and so on. Extend `FunctionDefExpr` to visit each annotation as a child of the function-def expression, in CPython evaluation order: positional parameter annotations, `args` annotation, keyword-only parameter annotations, `*kwargs` annotation, then the return annotation. (Lambda expressions have no annotations in Python syntax, so `LambdaExpr` is unchanged.) PEP 695 type parameters remain out of scope; they belong to the inner annotation scope, not the enclosing CFG. Restored test results across `framework/aiohttp`, `framework/fastapi`, `framework/lxml`, the `CallGraph-type-annotations` test, and `CWE-022-PathInjection`. Two FastAPI list-comprehension MISSING markers become positive (`taint_test.py:41,55`). CPython CFG consistency remains clean. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 13:47:04 +00:00
yoff	92e03318ea	Python: model exception edges for raise-prone expressions inside try/with The new CFG previously only emitted exception edges for explicit `raise` and `assert` statements. As a result, code that became reachable only via the exception path of an arbitrary expression (e.g., the body of an `except` handler following a try-body whose `call()` could raise) was classified as dead, breaking analyses like StackTraceExposure, FileNotAlwaysClosed, ExceptionInfo, UseOfExit, and CatchingBaseException. This commit adds a `mayThrow` predicate over expressions that are known sources of implicit exceptions in Python (calls, attribute access, subscripts, arithmetic/comparison operators, imports, await/yield/yield from) plus `from m import *` at the statement level, and routes them through the shared CFG's `beginAbruptCompletion(_, _, ExceptionSuccessor, always=false)` hook. The set of exception sources is restricted to nodes that are syntactically inside a `try`/`with` statement in the same scope. This mirrors Java's `ControlFlowGraph::mayThrow`, which only emits exception edges where local handling can observe them — outside such contexts, the edges add CFG complexity (weakening BarrierGuard precision and breaking SSA continuity around augmented assignments and subscript stores) without analysis benefit, since exceptions just propagate to the function exit anyway. Net effect on the test suite: ~100 alerts restored across the exception- related query tests (StackTraceExposure +29, ExceptionInfo +17, FileNotAlwaysClosed +52, UseOfExit +1, CatchingBaseException restored) with no precision regressions. Affected `.expected` files and the regression-guard `dead_under_no_raise.py` are updated accordingly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 13:46:51 +00:00
yoff	408ba6218f	Python: switch dataflow library to new (shared) CFG + SSA Flips the Python dataflow trunk from the legacy CFG (semmle/python/Flow.qll) and legacy ESSA SSA (semmle/python/essa/) to the new shared CFG facade (semmle.python.controlflow.internal.Cfg) and the new SSA adapter (semmle.python.dataflow.new.internal.SsaImpl), both introduced additively in the preceding PRs in this stack. This is the trunk-flip equivalent of the original draft PR #21894 (kept around as documentation), rebased on top of the four preparatory PRs: P1: Remove AstNode.getAFlowNode() and rewrite callers (#21919). P2: Qualify Flow.qll's AST references with Py:: prefix (#21920). P3: Add new shared-CFG-backed control flow graph (#21921). P4: Add new shared-SSA-backed SSA adapter (#21923). The Python dataflow library (semmle/python/dataflow/new/) now imports the new CFG facade and SSA adapter. All CFG-typed predicates (ControlFlowNode, CallNode, BasicBlock, NameNode, AttrNode, ...) are qualified with the Cfg:: prefix; SSA references switch from EssaVariable/EssaDefinition to SsaImpl::Definition/SourceVariable. GuardNode is redesigned to use the new CFG's outcome-node model (isAfterTrue / isAfterFalse) instead of the legacy ConditionBlock + flipped indirection. Only BarrierGuard<...> is preserved as public API. Framework files (Bottle, FastApi, Django, Tornado, Pyramid, Stdlib, ...) are updated to take CFG nodes from the new facade. A handful of dataflow consistency tweaks for the new CFG: - Augmented-assignment targets are treated as both load and store. - 'from X import ' produces uncertain SSA writes for unknown names. - CFG nodes are canonicalised so dataflow does not see equivalent pre/post-order pairs as distinct nodes. Two AST tweaks for the new CFG: - AstNodeImpl: omit PEP 695 type-parameter names from FunctionDefExpr / ClassDefExpr children. - ImportResolution: drop the legacy essa import. Test churn (~175 files): reblessed library- and query-test .expected files reflect slightly different CFG granularity, different toString output, and a handful of true alert deltas in security queries. Verification: all 367 lib + src + consistency-queries compile clean. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 13:46:43 +00:00
Copilot	b7f79f2d34	Python: add new shared-SSA-backed SSA adapter Preparatory refactor for the shared-CFG dataflow migration. Adds the new Python SSA adapter additively, without changing any production behaviour. Library additions: - semmle.python.dataflow.new.internal.SsaImpl — Python SSA implementation built on the new (shared) CFG. Mirrors the Java SSA adapter (java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll): an InputSig is defined in terms of positional (BasicBlock, int) variable references, and the shared codeql.ssa.Ssa::Make<Location, Cfg, Input> module is then instantiated. SourceVariable is the AST-level Py::Variable. Variable references are looked up via the new CFG facade's NameNode.defines/uses/deletes predicates (added in the preceding PR), which themselves are one-line bridges to AST-level Name.defines/uses/deletes. Implicit-entry definitions are inserted for non-local/global/builtin reads, captured variables, and (when needed) parameters. Test additions: - library-tests/dataflow-new-ssa/ — exercises the new SSA over a representative test corpus and checks expected def/use chains. - library-tests/dataflow-new-ssa-vs-legacy/ — runs both new SSA and legacy ESSA over the same corpus and diffs the results, so any semantic divergence shows up as a test failure. Production impact: None. The new SSA adapter has zero callers in lib/ and src/ — the legacy ESSA SSA (semmle/python/essa/*) remains the default. The dataflow library is not migrated yet; that lands in a follow-up PR. Verified by: - All 367 lib + src + consistency-queries compile clean. - All 641 ControlFlow + PointsTo + dataflow + essa + consistency library-tests pass. - Both new dataflow-new-ssa[/vs-legacy] test packs pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 13:38:40 +00:00
Copilot	9cdeb8e7ee	Python: add new shared-CFG-backed control flow graph Preparatory refactor for the shared-CFG dataflow migration. Adds the new Python CFG library additively, without changing any production behaviour. Library additions: - semmle.python.controlflow.internal.AstNodeImpl — mediates between the Python AST and the shared codeql.controlflow.ControlFlowGraph signature. Wraps Python's Stmt/Expr/Scope/Pattern and adds two synthetic kinds of node (BlockStmt for body slots, intermediate nodes for multi-operand boolean expressions). - semmle.python.controlflow.internal.Cfg — public facade re-exposing the same API surface as semmle/python/Flow.qll (ControlFlowNode, CallNode, BasicBlock, NameNode, DefinitionNode, CompareNode, ...), backed by the shared CFG. - lib/printCfgNew.ql — debug/visualisation query for the new CFG. - consistency-queries/CfgConsistency.ql — consistency query running the shared CFG's standard checks against Python. Shared library: - shared.controlflow.ControlFlowGraph — adds two defaulted getWhileElse / getForeachElse predicates to AstSig so Python can model while-else / for-else (no behavioural change for other languages). Test additions: - ControlFlow/bindings/* — annotation-driven SSA-binding tests for the new CFG (annassign, compound, comprehension, decorated, except_handler, imports, match_pattern, parameters, simple, type_params, walrus_starred, with_stmt, dead_under_no_raise). - ControlFlow/store-load/* — basic store/load coverage. - ControlFlow/evaluation-order/NewCfg*.ql — mirrors of the existing OldCfg evaluation-order self-validation suite, run against the new CFG via NewCfgImpl.qll. - Minor extensions to existing test_if.py / test_boolean.py + cosmetic .expected churn on a handful of OldCfg tests. No dataflow, SSA, or production query is migrated yet — that lands in follow-up PRs. The new CFG library has zero callers in lib/ and src/. Verified by: - All lib + src + consistency-queries compile clean (367 queries). - All 56 ControlFlow library-tests pass. - All 474 dataflow + PointsTo library-tests + consistency tests pass. - syntax_error/CONSISTENCY/CfgConsistency passes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 13:38:30 +00:00
yoff	ea0b2e9219	Shared CFG: add defaulted getWhileElse/getForeachElse/getCatchType to AstSig Adds three new defaulted signature predicates to the shared CFG library: - getWhileElse / getForeachElse: `else` block of a while/for loop, if any (used by Python's `while-else` / `for-else` constructs). - getCatchType: type expression of a catch clause, if any (used by Python's `except SomeExpr:` where the catch type is a runtime expression that needs CFG evaluation). Each predicate defaults to `none()`, so behaviour is unchanged for any language that doesn't override it (verified by re-running java/ql/test/library-tests/controlflow/). The Make0 succession rules are extended: - WhileStmt/ForeachStmt: route the loop-exit edge through the else block before reaching the after-position. - CatchClause: route the matching-evaluation through the type expression (if present) before reaching the after-value position. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 13:38:30 +00:00
yoff	9c41238eee	Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-22 13:37:46 +00:00
Copilot	d7c0ef7e4d	Python: qualify Flow.qll's AST references with Py:: prefix Preparatory refactor for the shared-CFG dataflow migration. Switches 'import python' to 'import python as Py' inside Flow.qll, and qualifies every AST-class reference (Expr, Bytes, Dict, AssignExpr, Compare, Module, Scope, Call, Attribute, SsaVariable, AugAssign, etc.) with the Py:: prefix. Flow.qll's own CFG types (ControlFlowNode, BasicBlock, CallNode, NameNode, DefinitionNode, CompareNode, ...) keep their unqualified names — they remain the public CFG API exported from this file. This is a semantic noop: the qualification was applied mechanically by script and no name resolution changes. Verified by: - All 361 lib/ + src/ queries compile clean. - All 186 ControlFlow + PointsTo + dataflow library-tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 13:37:45 +00:00