Merge pull request #19110 from github/redsun82/rust-fix-rc.17

Rust: accept test changes for now
2026-05-24 08:07:07 +02:00 · 2025-03-25 17:54:47 +01:00 · 2025-03-25 12:44:22 +01:00 · 2025-03-17 15:32:23 +00:00 · 2025-03-17 13:00:41 +00:00 · 2025-03-17 12:21:27 +00:00
2310 changed files with 19821 additions and 37338 deletions
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@@ -8,8 +8,5 @@ paths-ignore:
  - '/java/'
  - '/python/'
  - '/javascript/ql/test'
-  - '/javascript/ql/integration-tests'
  - '/javascript/extractor/tests'
-  - '/javascript/extractor/parser-tests'
-  - '/javascript/ql/src/'
  - '/rust/ql'
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -18,10 +18,6 @@ on:

 jobs:
  CodeQL-Build:
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['actions', 'csharp']

    runs-on: ubuntu-latest

@@ -42,8 +38,9 @@ jobs:
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@main
+      # Override language selection by uncommenting this and choosing your languages
      with:
-        languages: ${{ matrix.language }}
+        languages: csharp
        config-file: ./.github/codeql/codeql-config.yml

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -50,11 +50,6 @@
                "${input:name}",
                "${input:categoryQuery}"
            ],
-            "options": {
-                "env": {
-                    "EDITOR": "code -r",
-                }
-            },
            "presentation": {
                "reveal": "never",
                "close": true
@@ -72,11 +67,6 @@
                "${input:name}",
                "${input:categoryLibrary}"
            ],
-            "options": {
-                "env": {
-                    "EDITOR": "code -r"
-                }
-            },
            "presentation": {
                "reveal": "never",
                "close": true
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -35,9 +35,9 @@ bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True

 # Keep edition and version approximately in sync with internal repo.
 # the versions there are canonical, the versions here are used for CI in github/codeql, as well as for the vendoring of dependencies.
-RUST_EDITION = "2024"
+RUST_EDITION = "2021"

-RUST_VERSION = "1.85.0"
+RUST_VERSION = "1.82.0"

 rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
 rust.toolchain(
@@ -71,59 +71,57 @@ use_repo(
 tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")
 use_repo(
    tree_sitter_extractors_deps,
-    "vendor_ts__anyhow-1.0.96",
-    "vendor_ts__argfile-0.2.1",
-    "vendor_ts__chalk-ir-0.99.0",
-    "vendor_ts__chrono-0.4.39",
-    "vendor_ts__clap-4.5.31",
-    "vendor_ts__dunce-1.0.5",
-    "vendor_ts__either-1.14.0",
-    "vendor_ts__encoding-0.2.33",
-    "vendor_ts__figment-0.10.19",
-    "vendor_ts__flate2-1.1.0",
-    "vendor_ts__glob-0.3.2",
-    "vendor_ts__globset-0.4.15",
-    "vendor_ts__itertools-0.14.0",
-    "vendor_ts__lazy_static-1.5.0",
-    "vendor_ts__mustache-0.9.0",
-    "vendor_ts__num-traits-0.2.19",
-    "vendor_ts__num_cpus-1.16.0",
-    "vendor_ts__proc-macro2-1.0.93",
-    "vendor_ts__quote-1.0.38",
-    "vendor_ts__ra_ap_base_db-0.0.266",
-    "vendor_ts__ra_ap_cfg-0.0.266",
-    "vendor_ts__ra_ap_hir-0.0.266",
-    "vendor_ts__ra_ap_hir_def-0.0.266",
-    "vendor_ts__ra_ap_hir_expand-0.0.266",
-    "vendor_ts__ra_ap_hir_ty-0.0.266",
-    "vendor_ts__ra_ap_ide_db-0.0.266",
-    "vendor_ts__ra_ap_intern-0.0.266",
-    "vendor_ts__ra_ap_load-cargo-0.0.266",
-    "vendor_ts__ra_ap_parser-0.0.266",
-    "vendor_ts__ra_ap_paths-0.0.266",
-    "vendor_ts__ra_ap_project_model-0.0.266",
-    "vendor_ts__ra_ap_span-0.0.266",
-    "vendor_ts__ra_ap_stdx-0.0.266",
-    "vendor_ts__ra_ap_syntax-0.0.266",
-    "vendor_ts__ra_ap_vfs-0.0.266",
-    "vendor_ts__rand-0.9.0",
-    "vendor_ts__rayon-1.10.0",
-    "vendor_ts__regex-1.11.1",
-    "vendor_ts__serde-1.0.218",
-    "vendor_ts__serde_json-1.0.139",
-    "vendor_ts__serde_with-3.12.0",
-    "vendor_ts__syn-2.0.98",
-    "vendor_ts__toml-0.8.20",
-    "vendor_ts__tracing-0.1.41",
-    "vendor_ts__tracing-flame-0.2.0",
-    "vendor_ts__tracing-subscriber-0.3.19",
-    "vendor_ts__tree-sitter-0.24.6",
-    "vendor_ts__tree-sitter-embedded-template-0.23.2",
-    "vendor_ts__tree-sitter-json-0.24.8",
-    "vendor_ts__tree-sitter-ql-0.23.1",
-    "vendor_ts__tree-sitter-ruby-0.23.1",
-    "vendor_ts__triomphe-0.1.14",
-    "vendor_ts__ungrammar-1.16.1",
+    "vendor__anyhow-1.0.95",
+    "vendor__argfile-0.2.1",
+    "vendor__chrono-0.4.39",
+    "vendor__clap-4.5.26",
+    "vendor__dunce-1.0.5",
+    "vendor__either-1.13.0",
+    "vendor__encoding-0.2.33",
+    "vendor__figment-0.10.19",
+    "vendor__flate2-1.0.35",
+    "vendor__glob-0.3.2",
+    "vendor__globset-0.4.15",
+    "vendor__itertools-0.14.0",
+    "vendor__lazy_static-1.5.0",
+    "vendor__mustache-0.9.0",
+    "vendor__num-traits-0.2.19",
+    "vendor__num_cpus-1.16.0",
+    "vendor__proc-macro2-1.0.93",
+    "vendor__quote-1.0.38",
+    "vendor__ra_ap_base_db-0.0.258",
+    "vendor__ra_ap_cfg-0.0.258",
+    "vendor__ra_ap_hir-0.0.258",
+    "vendor__ra_ap_hir_def-0.0.258",
+    "vendor__ra_ap_hir_expand-0.0.258",
+    "vendor__ra_ap_ide_db-0.0.258",
+    "vendor__ra_ap_intern-0.0.258",
+    "vendor__ra_ap_load-cargo-0.0.258",
+    "vendor__ra_ap_parser-0.0.258",
+    "vendor__ra_ap_paths-0.0.258",
+    "vendor__ra_ap_project_model-0.0.258",
+    "vendor__ra_ap_span-0.0.258",
+    "vendor__ra_ap_stdx-0.0.258",
+    "vendor__ra_ap_syntax-0.0.258",
+    "vendor__ra_ap_vfs-0.0.258",
+    "vendor__rand-0.8.5",
+    "vendor__rayon-1.10.0",
+    "vendor__regex-1.11.1",
+    "vendor__serde-1.0.217",
+    "vendor__serde_json-1.0.135",
+    "vendor__serde_with-3.12.0",
+    "vendor__syn-2.0.96",
+    "vendor__toml-0.8.19",
+    "vendor__tracing-0.1.41",
+    "vendor__tracing-flame-0.2.0",
+    "vendor__tracing-subscriber-0.3.19",
+    "vendor__tree-sitter-0.24.6",
+    "vendor__tree-sitter-embedded-template-0.23.2",
+    "vendor__tree-sitter-json-0.24.8",
+    "vendor__tree-sitter-ql-0.23.1",
+    "vendor__tree-sitter-ruby-0.23.1",
+    "vendor__triomphe-0.1.14",
+    "vendor__ungrammar-1.16.1",
 )

 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
--- a/actions/ql/lib/CHANGELOG.md
+++ b/actions/ql/lib/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 0.4.5
+
+No user-facing changes.
+
+## 0.4.4
+
+No user-facing changes.
+
 ## 0.4.3

 ### New Features
--- a/actions/ql/lib/change-notes/released/0.4.4.md
+++ b/actions/ql/lib/change-notes/released/0.4.4.md
@@ -0,0 +1,3 @@
+## 0.4.4
+
+No user-facing changes.
--- a/actions/ql/lib/change-notes/released/0.4.5.md
+++ b/actions/ql/lib/change-notes/released/0.4.5.md
@@ -0,0 +1,3 @@
+## 0.4.5
+
+No user-facing changes.
--- a/actions/ql/lib/codeql-pack.release.yml
+++ b/actions/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.3
+lastReleaseVersion: 0.4.5
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.4-dev
+version: 0.4.6-dev
 library: true
 warnOnImplicitThis: true
 dependencies:
--- a/actions/ql/src/CHANGELOG.md
+++ b/actions/ql/src/CHANGELOG.md
@@ -1,3 +1,16 @@
+## 0.5.2
+
+No user-facing changes.
+
+## 0.5.1
+
+### Bug Fixes
+
+* The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
+  Immutable Actions feature is not yet available for customer use. The query remains in the
+  default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is
+  available, the query will be updated to report alerts again.
+
 ## 0.5.0

 ### Breaking Changes
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.md
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.md
@@ -43,7 +43,7 @@ jobs:
 The following example, correctly creates a temporary directory and extracts the contents of the artifact there before calling `cmd.sh`.

 ```yaml
-name: Secure Workflow
+name: Insecure Workflow

 on:
  workflow_run:
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.md
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.md
@@ -43,7 +43,7 @@ jobs:
 The following example, correctly creates a temporary directory and extracts the contents of the artifact there before calling `cmd.sh`.

 ```yaml
-name: Secure Workflow
+name: Insecure Workflow

 on:
  workflow_run:
--- a/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.md
+++ b/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.md
--- a/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql
+++ b/actions/ql/src/experimental/Security/CWE-829/UnversionedImmutableAction.ql
@@ -8,7 +8,6 @@
 * @tags security
 *       actions
 *       internal
- *       experimental
 *       external/cwe/cwe-829
 */

--- a/actions/ql/src/change-notes/2025-02-27-immutable-actions-list.md
+++ b/actions/ql/src/change-notes/2025-02-27-immutable-actions-list.md
@@ -1,8 +0,0 @@
---
-category: fix
---
-* The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
-  Immutable Actions feature is not yet available for customer use. The query has also been moved
-  to the experimental folder and will not be used in code scanning unless it is explicitly added
-  to a code scanning configuration. Once the Immutable Actions feature is available, the query will
-  be updated to report alerts again.
--- a/actions/ql/src/change-notes/released/0.5.1.md
+++ b/actions/ql/src/change-notes/released/0.5.1.md
@@ -0,0 +1,8 @@
+## 0.5.1
+
+### Bug Fixes
+
+* The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
+  Immutable Actions feature is not yet available for customer use. The query remains in the
+  default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is
+  available, the query will be updated to report alerts again.
--- a/actions/ql/src/change-notes/released/0.5.2.md
+++ b/actions/ql/src/change-notes/released/0.5.2.md
@@ -0,0 +1,3 @@
+## 0.5.2
+
+No user-facing changes.
--- a/actions/ql/src/codeql-pack.release.yml
+++ b/actions/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.5.2
--- a/actions/ql/src/codeql-suites/actions-security-and-quality.qls
+++ b/actions/ql/src/codeql-suites/actions-security-and-quality.qls
@@ -1,4 +1,2 @@
 - description: Security-and-quality queries for GitHub Actions
- queries: .
- apply: security-and-quality-selectors.yml
-  from: codeql/suite-helpers
+- import: codeql-suites/actions-security-extended.qls
--- a/actions/ql/src/codeql-suites/actions-security-experimental.qls
+++ b/actions/ql/src/codeql-suites/actions-security-experimental.qls
@@ -1,4 +1,2 @@
 - description: Extended and experimental security queries for GitHub Actions
- queries: .
- apply: security-experimental-selectors.yml
-  from: codeql/suite-helpers
+- import: codeql-suites/actions-code-scanning.qls
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.5.1-dev
+version: 0.5.3-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]
@@ -8,4 +8,3 @@ extractor: actions
 defaultSuiteFile: codeql-suites/actions-code-scanning.qls
 dependencies:
  codeql/actions-all: ${workspace}
-  codeql/suite-helpers: ${workspace}
--- a/actions/ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.qlref
+++ b/actions/ql/test/query-tests/Security/CWE-829/UnversionedImmutableAction.qlref
@@ -1 +1 @@
-experimental/Security/CWE-829/UnversionedImmutableAction.ql
+Security/CWE-829/UnversionedImmutableAction.ql
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 4.0.3
+
+No user-facing changes.
+
+## 4.0.2
+
+### Minor Analysis Improvements
+
+* Modified the `getBufferSize` predicate in `commons/Buffer.qll` to be more tolerant in some cases involving member variables in a larger struct or class.
+* Fixed an issue where the `getBufferSize` predicate in `commons/Buffer.qll` was returning results for references inside `offsetof` expressions, which are not accesses to a buffer.
+
 ## 4.0.1

 No user-facing changes.
--- a/cpp/ql/lib/change-notes/2025-02-20-getbuffersize.md
+++ b/cpp/ql/lib/change-notes/2025-02-20-getbuffersize.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* Fixed an issue where the `getBufferSize` predicate in `commons/Buffer.qll` was returning results for references inside `offsetof` expressions, which are not accesses to a buffer.
--- a/cpp/ql/lib/change-notes/2025-02-25-getbuffersize.md
+++ b/cpp/ql/lib/change-notes/2025-02-25-getbuffersize.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* Modified the `getBufferSize` predicate in `commons/Buffer.qll` to be more tolerant in some cases involving member variables in a larger struct or class.
--- a/cpp/ql/lib/change-notes/2025-03-13-ascertaindef.md
+++ b/cpp/ql/lib/change-notes/2025-03-13-ascertaindef.md
@@ -1,4 +0,0 @@
---
-category: feature
---
-* Added `Node.asUncertainDefinition` and `Node.asCertainDefinition` to the `DataFlow::Node` class for querying whether a definition overwrites the entire destination buffer.
--- a/cpp/ql/lib/change-notes/released/4.0.2.md
+++ b/cpp/ql/lib/change-notes/released/4.0.2.md
@@ -0,0 +1,6 @@
+## 4.0.2
+
+### Minor Analysis Improvements
+
+* Modified the `getBufferSize` predicate in `commons/Buffer.qll` to be more tolerant in some cases involving member variables in a larger struct or class.
+* Fixed an issue where the `getBufferSize` predicate in `commons/Buffer.qll` was returning results for references inside `offsetof` expressions, which are not accesses to a buffer.
--- a/cpp/ql/lib/change-notes/released/4.0.3.md
+++ b/cpp/ql/lib/change-notes/released/4.0.3.md
@@ -0,0 +1,3 @@
+## 4.0.3
+
+No user-facing changes.
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 4.0.1
+lastReleaseVersion: 4.0.3
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 4.0.2-dev
+version: 4.0.4-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -1318,7 +1318,7 @@ predicate nodeIsHidden(Node n) {
  or
  n instanceof InitialGlobalValue
  or
-  n instanceof SsaSynthNode
+  n instanceof SsaPhiInputNode
 }

 predicate neverSkipInPathGraph(Node n) {
@@ -1520,17 +1520,16 @@ private EdgeKind caseOrDefaultEdge() {
 private int countNumberOfBranchesUsingParameter(SwitchInstruction switch, ParameterNode p) {
  exists(Ssa::SourceVariable sv |
    parameterNodeHasSourceVariable(p, sv) and
-    // Count the number of cases that use the parameter.
+    // Count the number of cases that use the parameter. We do this by finding the phi node
+    // that merges the uses/defs of the parameter. There might be multiple such phi nodes, so
+    // we pick the one with the highest edge count.
    result =
-      strictcount(IRBlock caseblock |
-        exists(IRBlock useblock |
-          switch.getSuccessor(caseOrDefaultEdge()).getBlock() = caseblock and
-          caseblock.dominates(useblock)
-        |
-          exists(Ssa::UseImpl use | use.hasIndexInBlock(useblock, _, sv))
-          or
-          exists(Ssa::DefImpl def | def.hasIndexInBlock(useblock, _, sv))
-        )
+      max(SsaPhiNode phi |
+        switch.getSuccessor(caseOrDefaultEdge()).getBlock().dominanceFrontier() =
+          phi.getBasicBlock() and
+        phi.getSourceVariable() = sv
+      |
+        strictcount(phi.getAnInput())
      )
  )
 }
@@ -1632,7 +1631,9 @@ private Instruction getAnInstruction(Node n) {
  not n instanceof InstructionNode and
  result = n.asOperand().getUse()
  or
-  result = n.(SsaSynthNode).getBasicBlock().getFirstInstruction()
+  result = n.(SsaPhiNode).getPhiNode().getBasicBlock().getFirstInstruction()
+  or
+  result = n.(SsaPhiInputNode).getBasicBlock().getFirstInstruction()
  or
  n.(IndirectInstruction).hasInstructionAndIndirectionIndex(result, _)
  or
@@ -1764,14 +1765,14 @@ module IteratorFlow {
     * Note: Unlike `def.getAnUltimateDefinition()` this predicate also
     * traverses back through iterator increment and decrement operations.
     */
-    private Ssa::Definition getAnUltimateDefinition(Ssa::Definition def) {
+    private Ssa::DefinitionExt getAnUltimateDefinition(Ssa::DefinitionExt def) {
      result = def.getAnUltimateDefinition()
      or
      exists(IRBlock bb, int i, IteratorCrementCall crementCall, Ssa::SourceVariable sv |
        crementCall = def.getValue().asInstruction().(StoreInstruction).getSourceValue() and
        sv = def.getSourceVariable() and
        bb.getInstruction(i) = crementCall and
-        Ssa::ssaDefReachesRead(sv, result, bb, i)
+        Ssa::ssaDefReachesReadExt(sv, result, bb, i)
      )
    }

@@ -1799,13 +1800,13 @@ module IteratorFlow {
      GetsIteratorCall beginCall, Instruction writeToDeref
    ) {
      exists(
-        StoreInstruction beginStore, IRBlock bbStar, int iStar, Ssa::Definition def,
-        IteratorPointerDereferenceCall starCall, Ssa::Definition ultimate, Operand address
+        StoreInstruction beginStore, IRBlock bbStar, int iStar, Ssa::DefinitionExt def,
+        IteratorPointerDereferenceCall starCall, Ssa::DefinitionExt ultimate, Operand address
      |
        isIteratorWrite(writeToDeref, address) and
        operandForFullyConvertedCall(address, starCall) and
        bbStar.getInstruction(iStar) = starCall and
-        Ssa::ssaDefReachesRead(_, def, bbStar, iStar) and
+        Ssa::ssaDefReachesReadExt(_, def, bbStar, iStar) and
        ultimate = getAnUltimateDefinition*(def) and
        beginStore = ultimate.getValue().asInstruction() and
        operandForFullyConvertedCall(beginStore.getSourceValueOperand(), beginCall)
@@ -1834,15 +1835,45 @@ module IteratorFlow {

  private module IteratorSsa = SsaImpl::Make<Location, SsaInput>;

-  private class Def extends IteratorSsa::DefinitionExt {
+  cached
+  private newtype TSsaDef =
+    TDef(IteratorSsa::DefinitionExt def) or
+    TPhi(PhiNode phi)
+
+  abstract private class SsaDef extends TSsaDef {
+    /** Gets a textual representation of this element. */
+    string toString() { none() }
+
+    /** Gets the underlying non-phi definition or use. */
+    IteratorSsa::DefinitionExt asDef() { none() }
+
+    /** Gets the underlying phi node. */
+    PhiNode asPhi() { none() }
+
+    /** Gets the location of this element. */
+    abstract Location getLocation();
+  }
+
+  private class Def extends TDef, SsaDef {
+    IteratorSsa::DefinitionExt def;
+
+    Def() { this = TDef(def) }
+
+    final override IteratorSsa::DefinitionExt asDef() { result = def }
+
    final override Location getLocation() { result = this.getImpl().getLocation() }

+    /** Gets the variable written to by this definition. */
+    final SourceVariable getSourceVariable() { result = def.getSourceVariable() }
+
+    override string toString() { result = def.toString() }
+
    /**
     * Holds if this definition (or use) has index `index` in block `block`,
     * and is a definition (or use) of the variable `sv`.
     */
    predicate hasIndexInBlock(IRBlock block, int index, SourceVariable sv) {
-      super.definesAt(sv, block, index, _)
+      def.definesAt(sv, block, index, _)
    }

    private Ssa::DefImpl getImpl() {
@@ -1859,6 +1890,20 @@ module IteratorFlow {
    int getIndirectionIndex() { result = this.getImpl().getIndirectionIndex() }
  }

+  private class Phi extends TPhi, SsaDef {
+    PhiNode phi;
+
+    Phi() { this = TPhi(phi) }
+
+    final override PhiNode asPhi() { result = phi }
+
+    final override Location getLocation() { result = phi.getBasicBlock().getLocation() }
+
+    override string toString() { result = phi.toString() }
+
+    SsaIteratorNode getNode() { result.getIteratorFlowNode() = phi }
+  }
+
  private class PhiNode extends IteratorSsa::DefinitionExt {
    PhiNode() {
      this instanceof IteratorSsa::PhiNode or
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -27,7 +27,7 @@ import ExprNodes
 * - `VariableNode`, which is used to model flow through global variables.
 * - `PostUpdateNodeImpl`, which is used to model the state of an object after
 *    an update after a number of loads.
- * - `SsaSynthNode`, which represents synthesized nodes as computed by the shared SSA
+ * - `SsaPhiNode`, which represents phi nodes as computed by the shared SSA
 *    library.
 * - `RawIndirectOperand`, which represents the value of `operand` after
 *    loading the address a number of times.
@@ -47,7 +47,8 @@ private newtype TIRDataFlowNode =
    or
    Ssa::isModifiableByCall(operand, indirectionIndex)
  } or
-  TSsaSynthNode(Ssa::SynthNode n) or
+  TSsaPhiInputNode(Ssa::PhiNode phi, IRBlock input) { phi.hasInputFromBlock(_, _, _, _, input) } or
+  TSsaPhiNode(Ssa::PhiNode phi) or
  TSsaIteratorNode(IteratorFlow::IteratorFlowNode n) or
  TRawIndirectOperand0(Node0Impl node, int indirectionIndex) {
    Ssa::hasRawIndirectOperand(node.asOperand(), indirectionIndex)
@@ -183,11 +184,10 @@ class Node extends TIRDataFlowNode {
    or
    this.asOperand().getUse() = block.getInstruction(i)
    or
-    exists(Ssa::SynthNode ssaNode |
-      this.(SsaSynthNode).getSynthNode() = ssaNode and
-      ssaNode.getBasicBlock() = block and
-      ssaNode.getIndex() = i
-    )
+    this.(SsaPhiNode).getPhiNode().getBasicBlock() = block and i = -1
+    or
+    this.(SsaPhiInputNode).getBlock() = block and
+    i = block.getInstructionCount()
    or
    this.(RawIndirectOperand).getOperand().getUse() = block.getInstruction(i)
    or
@@ -313,79 +313,13 @@ class Node extends TIRDataFlowNode {
   * `n.asExpr() instanceof IncrementOperation` since the result of evaluating
   * the expression `x++` is passed to `sink`.
   */
-  Expr asDefinition() { result = this.asDefinition(_) }
-
-  /**
-   * Gets the definition associated with this node, if any.
-   *
-   * For example, consider the following example
-   * ```cpp
-   * int x = 42;     // 1
-   * x = 34;         // 2
-   * ++x;            // 3
-   * x++;            // 4
-   * x += 1;         // 5
-   * int y = x += 2; // 6
-   * ```
-   * - For (1) the result is `42`.
-   * - For (2) the result is `x = 34`.
-   * - For (3) the result is `++x`.
-   * - For (4) the result is `x++`.
-   * - For (5) the result is `x += 1`.
-   * - For (6) there are two results:
-   *   - For the definition generated by `x += 2` the result is `x += 2`
-   *   - For the definition generated by `int y = ...` the result is
-   *     also `x += 2`.
-   *
-   * For assignments, `node.asDefinition(_)` and `node.asExpr()` will both exist
-   * for the same dataflow node. However, for expression such as `x++` that
-   * both write to `x` and read the current value of `x`, `node.asDefinition(_)`
-   * will give the node corresponding to the value after the increment, and
-   * `node.asExpr()` will give the node corresponding to the value before the
-   * increment. For an example of this, consider the following:
-   *
-   * ```cpp
-   * sink(x++);
-   * ```
-   * in the above program, there will not be flow from a node `n` such that
-   * `n.asDefinition(_) instanceof IncrementOperation` to the argument of `sink`
-   * since the value passed to `sink` is the value before to the increment.
-   * However, there will be dataflow from a node `n` such that
-   * `n.asExpr() instanceof IncrementOperation` since the result of evaluating
-   * the expression `x++` is passed to `sink`.
-   *
-   * If `uncertain = false` then the definition is guaranteed to overwrite
-   * the entire buffer pointed to by the destination address of the definition.
-   * Otherwise, `uncertain = true`.
-   *
-   * For example, the write `int x; x = 42;` is guaranteed to overwrite all the
-   * bytes allocated to `x`, while the assignment `int p[10]; p[3] = 42;` has
-   * `uncertain = true` since the write will not overwrite the entire buffer
-   * pointed to by `p`.
-   */
-  Expr asDefinition(boolean uncertain) {
-    exists(StoreInstruction store, Ssa::Definition def |
+  Expr asDefinition() {
+    exists(StoreInstruction store |
      store = this.asInstruction() and
-      result = asDefinitionImpl(store) and
-      Ssa::defToNode(this, def, _) and
-      if def.isCertain() then uncertain = false else uncertain = true
+      result = asDefinitionImpl(store)
    )
  }

-  /**
-   * Gets the definition associated with this node, if this node is a certain definition.
-   *
-   * See `Node.asDefinition/1` for a description of certain and uncertain definitions.
-   */
-  Expr asCertainDefinition() { result = this.asDefinition(false) }
-
-  /**
-   * Gets the definition associated with this node, if this node is an uncertain definition.
-   *
-   * See `Node.asDefinition/1` for a description of certain and uncertain definitions.
-   */
-  Expr asUncertainDefinition() { result = this.asDefinition(true) }
-
  /**
   * Gets the indirect definition at a given indirection corresponding to this
   * node, if any.
@@ -686,30 +620,117 @@ class PostFieldUpdateNode extends PostUpdateNodeImpl {
 /**
 * INTERNAL: do not use.
 *
- * A synthesized SSA node produced by the shared SSA library, viewed as a node
- * in a data flow graph.
+ * A phi node produced by the shared SSA library, viewed as a node in a data flow graph.
 */
-class SsaSynthNode extends Node, TSsaSynthNode {
-  Ssa::SynthNode node;
+class SsaPhiNode extends Node, TSsaPhiNode {
+  Ssa::PhiNode phi;

-  SsaSynthNode() { this = TSsaSynthNode(node) }
+  SsaPhiNode() { this = TSsaPhiNode(phi) }

-  /** Gets the synthesized SSA node associated with this node. */
-  Ssa::SynthNode getSynthNode() { result = node }
+  /** Gets the phi node associated with this node. */
+  Ssa::PhiNode getPhiNode() { result = phi }

  override DataFlowCallable getEnclosingCallable() {
    result.asSourceCallable() = this.getFunction()
  }

-  override Declaration getFunction() { result = node.getBasicBlock().getEnclosingFunction() }
+  override Declaration getFunction() { result = phi.getBasicBlock().getEnclosingFunction() }

-  override DataFlowType getType() { result = node.getSourceVariable().getType() }
+  override DataFlowType getType() {
+    exists(Ssa::SourceVariable sv |
+      this.getPhiNode().definesAt(sv, _, _, _) and
+      result = sv.getType()
+    )
+  }

-  override predicate isGLValue() { node.getSourceVariable().isGLValue() }
+  override predicate isGLValue() { phi.getSourceVariable().isGLValue() }

-  final override Location getLocationImpl() { result = node.getLocation() }
+  final override Location getLocationImpl() { result = phi.getBasicBlock().getLocation() }

-  override string toStringImpl() { result = node.toString() }
+  override string toStringImpl() { result = phi.toString() }
+
+  /**
+   * Gets a node that is used as input to this phi node.
+   * `fromBackEdge` is true if data flows along a back-edge,
+   * and `false` otherwise.
+   */
+  cached
+  final Node getAnInput(boolean fromBackEdge) {
+    result.(SsaPhiInputNode).getPhiNode() = phi and
+    exists(IRBlock bPhi, IRBlock bResult |
+      bPhi = phi.getBasicBlock() and bResult = result.getBasicBlock()
+    |
+      if bPhi.dominates(bResult) then fromBackEdge = true else fromBackEdge = false
+    )
+  }
+
+  /** Gets a node that is used as input to this phi node. */
+  final Node getAnInput() { result = this.getAnInput(_) }
+
+  /** Gets the source variable underlying this phi node. */
+  Ssa::SourceVariable getSourceVariable() { result = phi.getSourceVariable() }
+
+  /**
+   * Holds if this phi node is a phi-read node.
+   *
+   * Phi-read nodes are like normal phi nodes, but they are inserted based
+   * on reads instead of writes.
+   */
+  predicate isPhiRead() { phi.isPhiRead() }
+}
+
+/**
+ * INTERNAL: Do not use.
+ *
+ * A node that is used as an input to a phi node.
+ *
+ * This class exists to allow more powerful barrier guards. Consider this
+ * example:
+ *
+ * ```cpp
+ * int x = source();
+ * if(!safe(x)) {
+ *   x = clear();
+ * }
+ * // phi node for x here
+ * sink(x);
+ * ```
+ *
+ * At the phi node for `x` it is neither the case that `x` is dominated by
+ * `safe(x)`, or is the case that the phi is dominated by a clearing of `x`.
+ *
+ * By inserting a "phi input" node as the last entry in the basic block that
+ * defines the inputs to the phi we can conclude that each of those inputs are
+ * safe to pass to `sink`.
+ */
+class SsaPhiInputNode extends Node, TSsaPhiInputNode {
+  Ssa::PhiNode phi;
+  IRBlock block;
+
+  SsaPhiInputNode() { this = TSsaPhiInputNode(phi, block) }
+
+  /** Gets the phi node associated with this node. */
+  Ssa::PhiNode getPhiNode() { result = phi }
+
+  /** Gets the basic block in which this input originates. */
+  IRBlock getBlock() { result = block }
+
+  override DataFlowCallable getEnclosingCallable() {
+    result.asSourceCallable() = this.getFunction()
+  }
+
+  override Declaration getFunction() { result = phi.getBasicBlock().getEnclosingFunction() }
+
+  override DataFlowType getType() { result = this.getSourceVariable().getType() }
+
+  override predicate isGLValue() { phi.getSourceVariable().isGLValue() }
+
+  final override Location getLocationImpl() { result = block.getLastInstruction().getLocation() }
+
+  override string toStringImpl() { result = "Phi input" }
+
+  /** Gets the source variable underlying this phi node. */
+  Ssa::SourceVariable getSourceVariable() { result = phi.getSourceVariable() }
 }

 /**
@@ -1284,10 +1305,10 @@ class UninitializedNode extends Node {
  LocalVariable v;

  UninitializedNode() {
-    exists(Ssa::Definition def, Ssa::SourceVariable sv |
+    exists(Ssa::DefinitionExt def, Ssa::SourceVariable sv |
      def.getIndirectionIndex() = 0 and
      def.getValue().asInstruction() instanceof UninitializedInstruction and
-      Ssa::defToNode(this, def, sv) and
+      Ssa::defToNode(this, def, sv, _, _, _) and
      v = sv.getBaseVariable().(Ssa::BaseIRVariable).getIRVariable().getAst()
    )
  }
@@ -1712,21 +1733,6 @@ predicate hasInstructionAndIndex(

 cached
 private module Cached {
-  /**
-   * Holds if `n` has a local flow step that goes through a back-edge.
-   */
-  cached
-  predicate flowsToBackEdge(Node n) {
-    exists(Node succ, IRBlock bb1, IRBlock bb2 |
-      Ssa::ssaFlow(n, succ) and
-      bb1 = n.getBasicBlock() and
-      bb2 = succ.getBasicBlock() and
-      bb1 != bb2 and
-      bb2.dominates(bb1) and
-      bb1.getASuccessor+() = bb2
-    )
-  }
-
  /**
   * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
   * (intra-procedural) step. This relation is only used for local dataflow
@@ -1815,9 +1821,15 @@ private module Cached {
  cached
  predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
    (
+      // Post update node -> Node flow
+      Ssa::postUpdateFlow(nodeFrom, nodeTo)
+      or
      // Def-use/Use-use flow
      Ssa::ssaFlow(nodeFrom, nodeTo)
      or
+      // Phi input -> Phi
+      nodeFrom.(SsaPhiInputNode).getPhiNode() = nodeTo.(SsaPhiNode).getPhiNode()
+      or
      IteratorFlow::localFlowStep(nodeFrom, nodeTo)
      or
      // Operand -> Instruction flow
@@ -1832,6 +1844,9 @@ private module Cached {
        not iFrom = Ssa::getIRRepresentationOfOperand(opTo)
      )
      or
+      // Phi node -> Node flow
+      Ssa::fromPhiNode(nodeFrom, nodeTo)
+      or
      // Indirect operand -> (indirect) instruction flow
      indirectionOperandFlow(nodeFrom, nodeTo)
      or
@@ -2275,6 +2290,22 @@ class ContentSet instanceof Content {
  }
 }

+pragma[nomagic]
+private predicate guardControlsPhiInput(
+  IRGuardCondition g, boolean branch, Ssa::DefinitionExt def, IRBlock input, Ssa::PhiNode phi
+) {
+  phi.hasInputFromBlock(def, _, _, _, input) and
+  (
+    g.controls(input, branch)
+    or
+    exists(EdgeKind kind |
+      g.getBlock() = input and
+      kind = getConditionalEdge(branch) and
+      input.getSuccessor(kind) = phi.getBasicBlock()
+    )
+  )
+}
+
 /**
 * Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
 *
@@ -2306,10 +2337,6 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
    )
  }

-  private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch) {
-    guardChecks(g, n.asOperand().getDef().getConvertedResultExpression(), branch)
-  }
-
  /**
   * Gets an expression node that is safely guarded by the given guard check.
   *
@@ -2350,7 +2377,14 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
      controls(g, result, edge)
    )
    or
-    result = Ssa::BarrierGuard<guardChecksNode/3>::getABarrierNode()
+    exists(
+      IRGuardCondition g, boolean branch, Ssa::DefinitionExt def, IRBlock input, Ssa::PhiNode phi
+    |
+      guardChecks(g, def.getARead().asOperand().getDef().getConvertedResultExpression(), branch) and
+      guardControlsPhiInput(g, branch, def, pragma[only_bind_into](input),
+        pragma[only_bind_into](phi)) and
+      result = TSsaPhiInputNode(phi, input)
+    )
  }

  /**
@@ -2399,13 +2433,6 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
    )
  }

-  private predicate guardChecksIndirectNode(
-    IRGuardCondition g, Node n, boolean branch, int indirectionIndex
-  ) {
-    guardChecks(g, n.asIndirectOperand(indirectionIndex).getDef().getConvertedResultExpression(),
-      branch)
-  }
-
  /**
   * Gets an indirect expression node with indirection index `indirectionIndex` that is
   * safely guarded by the given guard check.
@@ -2448,8 +2475,16 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
      controls(g, result, edge)
    )
    or
-    result =
-      Ssa::BarrierGuardWithIntParam<guardChecksIndirectNode/4>::getABarrierNode(indirectionIndex)
+    exists(
+      IRGuardCondition g, boolean branch, Ssa::DefinitionExt def, IRBlock input, Ssa::PhiNode phi
+    |
+      guardChecks(g,
+        def.getARead().asIndirectOperand(indirectionIndex).getDef().getConvertedResultExpression(),
+        branch) and
+      guardControlsPhiInput(g, branch, def, pragma[only_bind_into](input),
+        pragma[only_bind_into](phi)) and
+      result = TSsaPhiInputNode(phi, input)
+    )
  }
 }

@@ -2458,6 +2493,14 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
 */
 signature predicate instructionGuardChecksSig(IRGuardCondition g, Instruction instr, boolean branch);

+private EdgeKind getConditionalEdge(boolean branch) {
+  branch = true and
+  result instanceof TrueEdge
+  or
+  branch = false and
+  result instanceof FalseEdge
+}
+
 /**
 * Provides a set of barrier nodes for a guard that validates an instruction.
 *
@@ -2474,10 +2517,6 @@ module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardCheck
    )
  }

-  private predicate guardChecksNode(IRGuardCondition g, Node n, boolean branch) {
-    instructionGuardChecks(g, n.asOperand().getDef(), branch)
-  }
-
  /** Gets a node that is safely guarded by the given guard check. */
  Node getABarrierNode() {
    exists(IRGuardCondition g, ValueNumber value, boolean edge |
@@ -2486,7 +2525,14 @@ module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardCheck
      controls(g, result, edge)
    )
    or
-    result = Ssa::BarrierGuard<guardChecksNode/3>::getABarrierNode()
+    exists(
+      IRGuardCondition g, boolean branch, Ssa::DefinitionExt def, IRBlock input, Ssa::PhiNode phi
+    |
+      instructionGuardChecks(g, def.getARead().asOperand().getDef(), branch) and
+      guardControlsPhiInput(g, branch, def, pragma[only_bind_into](input),
+        pragma[only_bind_into](phi)) and
+      result = TSsaPhiInputNode(phi, input)
+    )
  }

  bindingset[value, n]
@@ -2498,12 +2544,6 @@ module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardCheck
    )
  }

-  private predicate guardChecksIndirectNode(
-    IRGuardCondition g, Node n, boolean branch, int indirectionIndex
-  ) {
-    instructionGuardChecks(g, n.asIndirectOperand(indirectionIndex).getDef(), branch)
-  }
-
  /**
   * Gets an indirect node with indirection index `indirectionIndex` that is
   * safely guarded by the given guard check.
@@ -2515,8 +2555,14 @@ module InstructionBarrierGuard<instructionGuardChecksSig/3 instructionGuardCheck
      controls(g, result, edge)
    )
    or
-    result =
-      Ssa::BarrierGuardWithIntParam<guardChecksIndirectNode/4>::getABarrierNode(indirectionIndex)
+    exists(
+      IRGuardCondition g, boolean branch, Ssa::DefinitionExt def, IRBlock input, Ssa::PhiNode phi
+    |
+      instructionGuardChecks(g, def.getARead().asIndirectOperand(indirectionIndex).getDef(), branch) and
+      guardControlsPhiInput(g, branch, def, pragma[only_bind_into](input),
+        pragma[only_bind_into](phi)) and
+      result = TSsaPhiInputNode(phi, input)
+    )
  }
 }

--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
@@ -2,7 +2,6 @@ private import codeql.ssa.Ssa as SsaImplCommon
 private import semmle.code.cpp.ir.IR
 private import DataFlowUtil
 private import DataFlowImplCommon as DataFlowImplCommon
-private import semmle.code.cpp.controlflow.IRGuards as IRGuards
 private import semmle.code.cpp.models.interfaces.Allocation as Alloc
 private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
 private import semmle.code.cpp.models.interfaces.Taint as Taint
@@ -465,17 +464,6 @@ private predicate finalParameterNodeHasParameterAndIndex(
  n.getIndirectionIndex() = indirectionIndex
 }

-pragma[nomagic]
-private predicate hasReturnPosition(IRFunction f, IRBlock block, int index) {
-  exists(Instruction return |
-    return instanceof ReturnInstruction or
-    return instanceof UnreachedInstruction
-  |
-    block.getInstruction(index) = return and
-    return.getEnclosingIRFunction() = f
-  )
-}
-
 class FinalParameterUse extends UseImpl, TFinalParameterUse {
  Parameter p;

@@ -504,9 +492,12 @@ class FinalParameterUse extends UseImpl, TFinalParameterUse {
    // `UnreachedInstruction`. If that's the case this predicate will
    // return multiple results. I don't think this is detrimental to
    // performance, however.
-    exists(IRFunction f |
-      hasReturnPosition(f, block, index) and
-      f.getFunction() = p.getFunction()
+    exists(Instruction return |
+      return instanceof ReturnInstruction or
+      return instanceof UnreachedInstruction
+    |
+      block.getInstruction(index) = return and
+      return.getEnclosingFunction() = p.getFunction()
    )
  }

@@ -596,7 +587,13 @@ class GlobalUse extends UseImpl, TGlobalUse {
    // globals at any exit so that we can flow out of non-returning functions.
    // Obviously this isn't correct as we can't actually flow but the global flow
    // requires this if we want to flow into children.
-    hasReturnPosition(f, block, index)
+    exists(Instruction return |
+      return instanceof ReturnInstruction or
+      return instanceof UnreachedInstruction
+    |
+      block.getInstruction(index) = return and
+      return.getEnclosingIRFunction() = f
+    )
  }

  override BaseSourceVariable getBaseSourceVariable() {
@@ -672,6 +669,21 @@ class GlobalDefImpl extends DefImpl, TGlobalDefImpl {
  override Location getLocation() { result = f.getLocation() }
 }

+/**
+ * Holds if there is a definition or access at index `i1` in basic block `bb1`
+ * and the next subsequent read is at index `i2` in basic block `bb2`.
+ */
+predicate adjacentDefRead(IRBlock bb1, int i1, SourceVariable sv, IRBlock bb2, int i2) {
+  adjacentDefReadExt(_, sv, bb1, i1, bb2, i2)
+}
+
+predicate useToNode(IRBlock bb, int i, SourceVariable sv, Node nodeTo) {
+  exists(UseImpl use |
+    use.hasIndexInBlock(bb, i, sv) and
+    nodeTo = use.getNode()
+  )
+}
+
 pragma[noinline]
 predicate outNodeHasAddressAndIndex(
  IndirectArgumentOutNode out, Operand address, int indirectionIndex
@@ -685,17 +697,34 @@ predicate outNodeHasAddressAndIndex(
 *
 * Holds if `node` is the node that corresponds to the definition of `def`.
 */
-predicate defToNode(Node node, Definition def, SourceVariable sv) {
-  def.getSourceVariable() = sv and
-  defToNode(node, def)
+predicate defToNode(
+  Node node, DefinitionExt def, SourceVariable sv, IRBlock bb, int i, boolean uncertain
+) {
+  def.definesAt(sv, bb, i, _) and
+  (
+    nodeHasOperand(node, def.getValue().asOperand(), def.getIndirectionIndex())
+    or
+    nodeHasInstruction(node, def.getValue().asInstruction(), def.getIndirectionIndex())
+    or
+    node.(InitialGlobalValue).getGlobalDef() = def
+  ) and
+  if def.isCertain() then uncertain = false else uncertain = true
 }

-private predicate defToNode(Node node, Definition def) {
-  nodeHasOperand(node, def.getValue().asOperand(), def.getIndirectionIndex())
+/**
+ * INTERNAL: Do not use.
+ *
+ * Holds if `node` is the node that corresponds to the definition or use at
+ * index `i` in block `bb` of `sv`.
+ *
+ * `uncertain` is `true` if this is an uncertain definition.
+ */
+predicate nodeToDefOrUse(Node node, SourceVariable sv, IRBlock bb, int i, boolean uncertain) {
+  defToNode(node, _, sv, bb, i, uncertain)
  or
-  nodeHasInstruction(node, def.getValue().asInstruction(), def.getIndirectionIndex())
-  or
-  node.(InitialGlobalValue).getGlobalDef() = def
+  // Node -> Use
+  useToNode(bb, i, sv, node) and
+  uncertain = false
 }

 /**
@@ -703,7 +732,10 @@ private predicate defToNode(Node node, Definition def) {
 * only holds when there is no use-use relation out of `nTo`.
 */
 private predicate indirectConversionFlowStep(Node nFrom, Node nTo) {
-  not ssaFlowImpl(nTo, _) and
+  not exists(SourceVariable sv, IRBlock bb2, int i2 |
+    useToNode(bb2, i2, sv, nTo) and
+    adjacentDefRead(bb2, i2, sv, _, _)
+  ) and
  exists(Operand op1, Operand op2, int indirectionIndex, Instruction instr |
    hasOperandAndIndex(nFrom, op1, pragma[only_bind_into](indirectionIndex)) and
    hasOperandAndIndex(nTo, op2, pragma[only_bind_into](indirectionIndex)) and
@@ -712,6 +744,50 @@ private predicate indirectConversionFlowStep(Node nFrom, Node nTo) {
  )
 }

+/**
+ * Holds if `node` is a phi input node that should receive flow from the
+ * definition to (or use of) `sv` at `(bb1, i1)`.
+ */
+private predicate phiToNode(SsaPhiInputNode node, SourceVariable sv, IRBlock bb1, int i1) {
+  exists(PhiNode phi, IRBlock input |
+    phi.hasInputFromBlock(_, sv, bb1, i1, input) and
+    node.getPhiNode() = phi and
+    node.getBlock() = input
+  )
+}
+
+/**
+ * Holds if there should be flow from `nodeFrom` to `nodeTo` because
+ * `nodeFrom` is a definition or use of `sv` at index `i1` at basic
+ * block `bb1`.
+ *
+ * `uncertain` is `true` if `(bb1, i1)` is a definition, and that definition
+ * is _not_ guaranteed to overwrite the entire allocation.
+ */
+private predicate ssaFlowImpl(
+  IRBlock bb1, int i1, SourceVariable sv, Node nodeFrom, Node nodeTo, boolean uncertain
+) {
+  nodeToDefOrUse(nodeFrom, sv, bb1, i1, uncertain) and
+  (
+    exists(IRBlock bb2, int i2 |
+      adjacentDefRead(bb1, i1, sv, bb2, i2) and
+      useToNode(bb2, i2, sv, nodeTo)
+    )
+    or
+    phiToNode(nodeTo, sv, bb1, i1)
+  ) and
+  nodeFrom != nodeTo
+}
+
+/** Gets a node that represents the prior definition of `node`. */
+private Node getAPriorDefinition(DefinitionExt next) {
+  exists(IRBlock bb, int i, SourceVariable sv |
+    lastRefRedefExt(_, pragma[only_bind_into](sv), pragma[only_bind_into](bb),
+      pragma[only_bind_into](i), _, next) and
+    nodeToDefOrUse(result, sv, bb, i, _)
+  )
+}
+
 private predicate inOut(FIO::FunctionInput input, FIO::FunctionOutput output) {
  exists(int indirectionIndex |
    input.isQualifierObject(indirectionIndex) and
@@ -758,6 +834,21 @@ private predicate modeledFlowBarrier(Node n) {
  )
 }

+/** Holds if there is def-use or use-use flow from `nodeFrom` to `nodeTo`. */
+predicate ssaFlow(Node nodeFrom, Node nodeTo) {
+  exists(Node nFrom, boolean uncertain, IRBlock bb, int i, SourceVariable sv |
+    ssaFlowImpl(bb, i, sv, nFrom, nodeTo, uncertain) and
+    not modeledFlowBarrier(nFrom) and
+    nodeFrom != nodeTo
+  |
+    if uncertain = true
+    then
+      nodeFrom =
+        [nFrom, getAPriorDefinition(any(DefinitionExt next | next.definesAt(sv, bb, i, _)))]
+    else nodeFrom = nFrom
+  )
+}
+
 private predicate isArgumentOfCallableInstruction(DataFlowCall call, Instruction instr) {
  isArgumentOfCallableOperand(call, unique( | | getAUse(instr)))
 }
@@ -814,15 +905,22 @@ private predicate postUpdateNodeToFirstUse(PostUpdateNode pun, Node n) {
  // So this predicate recurses back along conversions and `PointerArithmetic`
  // instructions to find the first use that has provides use-use flow, and
  // uses that target as the target of the `nodeFrom`.
-  exists(Node adjusted |
+  exists(Node adjusted, IRBlock bb1, int i1, SourceVariable sv |
    indirectConversionFlowStep*(adjusted, pun.getPreUpdateNode()) and
-    ssaFlowImpl(adjusted, n)
+    useToNode(bb1, i1, sv, adjusted)
+  |
+    exists(IRBlock bb2, int i2 |
+      adjacentDefRead(bb1, i1, sv, bb2, i2) and
+      useToNode(bb2, i2, sv, n)
+    )
+    or
+    phiToNode(n, sv, bb1, i1)
  )
 }

 private predicate stepUntilNotInCall(DataFlowCall call, Node n1, Node n2) {
  isArgumentOfCallable(call, n1) and
-  exists(Node mid | ssaFlowImpl(n1, mid) |
+  exists(Node mid | ssaFlowImpl(_, _, _, n1, mid, _) |
    isArgumentOfCallable(call, mid) and
    stepUntilNotInCall(call, mid, n2)
    or
@@ -854,7 +952,7 @@ private predicate isArgumentOfSameCall(DataFlowCall call, Node n1, Node n2) {
 * similarly we want flow from the second argument of `write_first_argument` to `x`
 * on the next line.
 */
-private predicate postUpdateFlow(PostUpdateNode pun, Node nodeTo) {
+predicate postUpdateFlow(PostUpdateNode pun, Node nodeTo) {
  exists(Node preUpdate, Node mid |
    preUpdate = pun.getPreUpdateNode() and
    postUpdateNodeToFirstUse(pun, mid)
@@ -869,6 +967,21 @@ private predicate postUpdateFlow(PostUpdateNode pun, Node nodeTo) {
  )
 }

+/** Holds if `nodeTo` receives flow from the phi node `nodeFrom`. */
+predicate fromPhiNode(SsaPhiNode nodeFrom, Node nodeTo) {
+  exists(PhiNode phi, SourceVariable sv, IRBlock bb1, int i1 |
+    phi = nodeFrom.getPhiNode() and
+    phi.definesAt(sv, bb1, i1, _)
+  |
+    exists(IRBlock bb2, int i2 |
+      adjacentDefRead(bb1, i1, sv, bb2, i2) and
+      useToNode(bb2, i2, sv, nodeTo)
+    )
+    or
+    phiToNode(nodeTo, sv, bb1, i1)
+  )
+}
+
 private predicate baseSourceVariableIsGlobal(
  BaseIRVariable base, GlobalLikeVariable global, IRFunction func
 ) {
@@ -910,6 +1023,11 @@ private module SsaInput implements SsaImplCommon::InputSig<Location> {
    exists(UseImpl use | use.hasIndexInBlock(bb, i, v) |
      if use.isCertain() then certain = true else certain = false
    )
+    or
+    exists(GlobalUse global |
+      global.hasIndexInBlock(bb, i, v) and
+      certain = true
+    )
  }
 }

@@ -918,14 +1036,42 @@ private module SsaInput implements SsaImplCommon::InputSig<Location> {
 */
 cached
 module SsaCached {
+  /**
+   * Holds if `def` is accessed at index `i1` in basic block `bb1` (either a read
+   * or a write), `def` is read at index `i2` in basic block `bb2`, and there is a
+   * path between them without any read of `def`.
+   */
  cached
-  predicate ssaDefReachesRead(SourceVariable v, Definition def, IRBlock bb, int i) {
-    SsaImpl::ssaDefReachesRead(v, def, bb, i)
+  predicate adjacentDefReadExt(
+    DefinitionExt def, SourceVariable sv, IRBlock bb1, int i1, IRBlock bb2, int i2
+  ) {
+    SsaImpl::adjacentDefReadExt(def, sv, bb1, i1, bb2, i2)
+  }
+
+  /**
+   * Holds if the node at index `i` in `bb` is a last reference to SSA definition
+   * `def`. The reference is last because it can reach another write `next`,
+   * without passing through another read or write.
+   *
+   * The path from node `i` in `bb` to `next` goes via basic block `input`,
+   * which is either a predecessor of the basic block of `next`, or `input` =
+   * `bb` in case `next` occurs in basic block `bb`.
+   */
+  cached
+  predicate lastRefRedefExt(
+    DefinitionExt def, SourceVariable sv, IRBlock bb, int i, IRBlock input, DefinitionExt next
+  ) {
+    SsaImpl::lastRefRedefExt(def, sv, bb, i, input, next)
  }

  cached
-  predicate phiHasInputFromBlock(PhiNode phi, Definition inp, IRBlock bb) {
-    SsaImpl::phiHasInputFromBlock(phi, inp, bb)
+  DefinitionExt phiHasInputFromBlockExt(PhiNode phi, IRBlock bb) {
+    SsaImpl::phiHasInputFromBlockExt(phi, result, bb)
+  }
+
+  cached
+  predicate ssaDefReachesReadExt(SourceVariable v, DefinitionExt def, IRBlock bb, int i) {
+    SsaImpl::ssaDefReachesReadExt(v, def, bb, i)
  }

  predicate variableRead = SsaInput::variableRead/4;
@@ -934,14 +1080,14 @@ module SsaCached {
 }

 /** Gets the `DefImpl` corresponding to `def`. */
-private DefImpl getDefImpl(SsaImpl::Definition def) {
+private DefImpl getDefImpl(SsaImpl::DefinitionExt def) {
  exists(SourceVariable sv, IRBlock bb, int i |
-    def.definesAt(sv, bb, i) and
+    def.definesAt(sv, bb, i, _) and
    result.hasIndexInBlock(bb, i, sv)
  )
 }

-class GlobalDef extends Definition {
+class GlobalDef extends DefinitionExt {
  GlobalDefImpl impl;

  GlobalDef() { impl = getDefImpl(this) }
@@ -955,173 +1101,51 @@ class GlobalDef extends Definition {

 private module SsaImpl = SsaImplCommon::Make<Location, SsaInput>;

-private module DataFlowIntegrationInput implements SsaImpl::DataFlowIntegrationInputSig {
-  private import codeql.util.Void
-
-  class Expr extends Instruction {
-    Expr() {
-      exists(IRBlock bb, int i |
-        variableRead(bb, i, _, true) and
-        this = bb.getInstruction(i)
-      )
-    }
-
-    predicate hasCfgNode(SsaInput::BasicBlock bb, int i) { bb.getInstruction(i) = this }
-  }
-
-  Expr getARead(SsaImpl::Definition def) {
-    exists(SourceVariable v, IRBlock bb, int i |
-      ssaDefReachesRead(v, def, bb, i) and
-      variableRead(bb, i, v, true) and
-      result.hasCfgNode(bb, i)
-    )
-  }
-
-  predicate ssaDefAssigns(SsaImpl::WriteDefinition def, Expr value) { none() }
-
-  class Parameter extends Void {
-    Location getLocation() { none() }
-  }
-
-  predicate ssaDefInitializesParam(SsaImpl::WriteDefinition def, Parameter p) { none() }
-
-  predicate allowFlowIntoUncertainDef(SsaImpl::UncertainWriteDefinition def) { any() }
-
-  private EdgeKind getConditionalEdge(boolean branch) {
-    branch = true and
-    result instanceof TrueEdge
-    or
-    branch = false and
-    result instanceof FalseEdge
-  }
-
-  class Guard instanceof IRGuards::IRGuardCondition {
-    string toString() { result = super.toString() }
-
-    predicate controlsBranchEdge(SsaInput::BasicBlock bb1, SsaInput::BasicBlock bb2, boolean branch) {
-      exists(EdgeKind kind |
-        super.getBlock() = bb1 and
-        kind = getConditionalEdge(branch) and
-        bb1.getSuccessor(kind) = bb2
-      )
-    }
-  }
-
-  predicate guardControlsBlock(Guard guard, SsaInput::BasicBlock bb, boolean branch) {
-    guard.(IRGuards::IRGuardCondition).controls(bb, branch)
-  }
-}
-
-private module DataFlowIntegrationImpl = SsaImpl::DataFlowIntegration<DataFlowIntegrationInput>;
-
-class SynthNode extends DataFlowIntegrationImpl::SsaNode {
-  SynthNode() { not this.asDefinition() instanceof SsaImpl::WriteDefinition }
-}
-
-signature predicate guardChecksNodeSig(IRGuards::IRGuardCondition g, Node e, boolean branch);
-
-signature predicate guardChecksNodeSig(
-  IRGuards::IRGuardCondition g, Node e, boolean branch, int indirectionIndex
-);
-
-module BarrierGuardWithIntParam<guardChecksNodeSig/4 guardChecksNode> {
-  private predicate ssaDefReachesCertainUse(Definition def, UseImpl use) {
-    exists(SourceVariable v, IRBlock bb, int i |
-      use.hasIndexInBlock(bb, i, v) and
-      variableRead(bb, i, v, true) and
-      ssaDefReachesRead(v, def, bb, i)
-    )
-  }
-
-  private predicate guardChecks(
-    DataFlowIntegrationInput::Guard g, SsaImpl::Definition def, boolean branch, int indirectionIndex
-  ) {
-    exists(UseImpl use |
-      guardChecksNode(g, use.getNode(), branch, indirectionIndex) and
-      ssaDefReachesCertainUse(def, use)
-    )
-  }
-
-  Node getABarrierNode(int indirectionIndex) {
-    // Only get the SynthNodes from the shared implementation, as the ExprNodes cannot
-    // be matched on SourceVariable.
-    result.(SsaSynthNode).getSynthNode() =
-      DataFlowIntegrationImpl::BarrierGuardDefWithState<int, guardChecks/4>::getABarrierNode(indirectionIndex)
-    or
-    // Calculate the guarded UseImpls corresponding to ExprNodes directly.
-    exists(DataFlowIntegrationInput::Guard g, boolean branch, Definition def, IRBlock bb |
-      guardChecks(g, def, branch, indirectionIndex) and
-      exists(UseImpl use |
-        ssaDefReachesCertainUse(def, use) and
-        use.getBlock() = bb and
-        DataFlowIntegrationInput::guardControlsBlock(g, bb, branch) and
-        result = use.getNode()
-      )
-    )
-  }
-}
-
-module BarrierGuard<guardChecksNodeSig/3 guardChecksNode> {
-  private predicate guardChecksNode(
-    IRGuards::IRGuardCondition g, Node e, boolean branch, int indirectionIndex
-  ) {
-    guardChecksNode(g, e, branch) and indirectionIndex = 0
-  }
-
-  Node getABarrierNode() {
-    result = BarrierGuardWithIntParam<guardChecksNode/4>::getABarrierNode(0)
-  }
-}
-
-bindingset[result, v]
-pragma[inline_late]
-DataFlowIntegrationImpl::Node fromDfNode(Node n, SourceVariable v) {
-  result = n.(SsaSynthNode).getSynthNode()
-  or
-  exists(UseImpl use, IRBlock bb, int i |
-    result.(DataFlowIntegrationImpl::ExprNode).getExpr().hasCfgNode(bb, i) and
-    use.hasIndexInBlock(bb, i, v) and
-    use.isCertain() and
-    use.getNode() = n
-  )
-  or
-  defToNode(n, result.(DataFlowIntegrationImpl::SsaDefinitionNode).getDefinition())
-}
-
-private predicate ssaFlowImpl(Node nodeFrom, Node nodeTo) {
-  exists(SourceVariable v |
-    nodeFrom != nodeTo and
-    DataFlowIntegrationImpl::localFlowStep(v, fromDfNode(nodeFrom, v), fromDfNode(nodeTo, v), _)
-  )
-}
-
-/** Holds if there is def-use or use-use flow from `nodeFrom` to `nodeTo`. */
-predicate ssaFlow(Node nodeFrom, Node nodeTo) {
-  postUpdateFlow(nodeFrom, nodeTo)
-  or
-  ssaFlowImpl(nodeFrom, nodeTo) and
-  not modeledFlowBarrier(nodeFrom)
-}
-
 /**
 * An static single assignment (SSA) phi node.
+ *
+ * This is either a normal phi node or a phi-read node.
 */
-class PhiNode extends Definition instanceof SsaImpl::PhiNode {
+class PhiNode extends SsaImpl::DefinitionExt {
+  PhiNode() {
+    this instanceof SsaImpl::PhiNode or
+    this instanceof SsaImpl::PhiReadNode
+  }
+
+  /**
+   * Holds if this phi node is a phi-read node.
+   *
+   * Phi-read nodes are like normal phi nodes, but they are inserted based
+   * on reads instead of writes.
+   */
+  predicate isPhiRead() { this instanceof SsaImpl::PhiReadNode }
+
+  /**
+   * Holds if the node at index `i` in `bb` is a last reference to SSA
+   * definition `def` of `sv`. The reference is last because it can reach
+   * this phi node, without passing through another read or write.
+   *
+   * The path from node `i` in `bb` to this phi node goes via basic block
+   * `input`, which is either a predecessor of the basic block of this phi
+   * node, or `input` = `bb` in case this phi node occurs in basic block `bb`.
+   */
+  predicate hasInputFromBlock(DefinitionExt def, SourceVariable sv, IRBlock bb, int i, IRBlock input) {
+    SsaCached::lastRefRedefExt(def, sv, bb, i, input, this)
+  }
+
  /** Gets a definition that is an input to this phi node. */
-  final Definition getAnInput() { phiHasInputFromBlock(this, result, _) }
+  final DefinitionExt getAnInput() { this.hasInputFromBlock(result, _, _, _, _) }
 }

 /** An static single assignment (SSA) definition. */
-class Definition extends SsaImpl::Definition {
-  // TODO: Include prior definitions of uncertain writes or rename predicate
-  // i.e. the disjunct `SsaImpl::uncertainWriteDefinitionInput(this, result)`
-  private Definition getAPhiInputOrPriorDefinition() { result = this.(PhiNode).getAnInput() }
+class DefinitionExt extends SsaImpl::DefinitionExt {
+  private DefinitionExt getAPhiInputOrPriorDefinition() { result = this.(PhiNode).getAnInput() }

  /**
   * Gets a definition that ultimately defines this SSA definition and is
   * not itself a phi node.
   */
-  final Definition getAnUltimateDefinition() {
+  final DefinitionExt getAnUltimateDefinition() {
    result = this.getAPhiInputOrPriorDefinition*() and
    not result instanceof PhiNode
  }
@@ -1156,6 +1180,16 @@ class Definition extends SsaImpl::Definition {

  /** Gets the unspecified type of the variable being defined by this definition. */
  Type getUnspecifiedType() { result = this.getUnderlyingType().getUnspecifiedType() }
+
+  /** Gets a node that represents a read of this SSA definition. */
+  pragma[nomagic]
+  Node getARead() {
+    exists(SourceVariable sv, IRBlock bb, int i | SsaCached::ssaDefReachesReadExt(sv, this, bb, i) |
+      useToNode(bb, i, sv, result)
+      or
+      phiToNode(result, sv, bb, i)
+    )
+  }
 }

 import SsaCached
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
@@ -630,18 +630,10 @@ private module Cached {
    Operand operand, int indirectionIndex, Operand operandRepr, int indirectionIndexRepr
  ) {
    indirectionIndex = [1 .. countIndirectionsForCppType(getLanguageType(operand))] and
-    (
-      exists(Instruction load |
-        isDereference(load, operand, false) and
-        operandRepr = unique( | | getAUse(load)) and
-        indirectionIndexRepr = indirectionIndex - 1
-      )
-      or
-      exists(CopyValueInstruction copy |
-        copy.getSourceValueOperand() = operand and
-        operandRepr = unique( | | getAUse(copy)) and
-        indirectionIndexRepr = indirectionIndex
-      )
+    exists(Instruction load |
+      isDereference(load, operand, false) and
+      operandRepr = unique( | | getAUse(load)) and
+      indirectionIndexRepr = indirectionIndex - 1
    )
  }

@@ -657,19 +649,11 @@ private module Cached {
    Instruction instr, int indirectionIndex, Instruction instrRepr, int indirectionIndexRepr
  ) {
    indirectionIndex = [1 .. countIndirectionsForCppType(getResultLanguageType(instr))] and
-    (
-      exists(Instruction load, Operand address |
-        address = unique( | | getAUse(instr)) and
-        isDereference(load, address, false) and
-        instrRepr = load and
-        indirectionIndexRepr = indirectionIndex - 1
-      )
-      or
-      exists(CopyValueInstruction copy |
-        copy.getSourceValueOperand() = unique( | | getAUse(instr)) and
-        instrRepr = copy and
-        indirectionIndexRepr = indirectionIndex
-      )
+    exists(Instruction load, Operand address |
+      address = unique( | | getAUse(instr)) and
+      isDereference(load, address, false) and
+      instrRepr = load and
+      indirectionIndexRepr = indirectionIndex - 1
    )
  }

--- a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll
+++ b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll
@@ -327,7 +327,9 @@ private module Config implements ProductFlow::StateConfigSig {

  predicate isBarrierIn1(DataFlow::Node node) { isSourcePair(node, _, _, _) }

-  predicate isBarrierOut2(DataFlow::Node node) { DataFlow::flowsToBackEdge(node) }
+  predicate isBarrierOut2(DataFlow::Node node) {
+    node = any(DataFlow::SsaPhiNode phi).getAnInput(true)
+  }
 }

 private module AllocToInvalidPointerFlow = ProductFlow::GlobalWithState<Config>;
--- a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
+++ b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
@@ -203,7 +203,9 @@ private module InvalidPointerToDerefConfig implements DataFlow::StateConfigSig {

  predicate isSink(DataFlow::Node sink, FlowState pai) { none() }

-  predicate isBarrier(DataFlow::Node node) { DataFlow::flowsToBackEdge(node) }
+  predicate isBarrier(DataFlow::Node node) {
+    node = any(DataFlow::SsaPhiNode phi | not phi.isPhiRead()).getAnInput(true)
+  }

  predicate isBarrier(DataFlow::Node node, FlowState pai) {
    // `node = getABarrierNode(pai)` ensures that node < pai, so this node is safe to dereference.
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 1.3.6
+
+No user-facing changes.
+
+## 1.3.5
+
+### Minor Analysis Improvements
+
+* Due to changes in libraries the query "Static array access may cause overflow" (`cpp/static-buffer-overflow`) will no longer report cases where multiple fields of a struct or class are written with a single `memset` or similar operation.
+* The query "Call to memory access function may overflow buffer" (`cpp/overflow-buffer`) has been added to the security-extended query suite. The query detects a range of buffer overflow and underflow issues.
+
 ## 1.3.4

 No user-facing changes.
--- a/cpp/ql/src/JPL_C/LOC-3/Rule
+++ b/cpp/ql/src/JPL_C/LOC-3/Rule
@@ -12,11 +12,7 @@
 import cpp

 predicate allowedTypedefs(TypedefType t) {
-  t.getName() =
-    [
-      "I64", "U64", "I32", "U32", "I16", "U16", "I8", "U8", "F64", "F32", "int64_t", "uint64_t",
-      "int32_t", "uint32_t", "int16_t", "uint16_t", "int8_t", "uint8_t"
-    ]
+  t.getName() = ["I64", "U64", "I32", "U32", "I16", "U16", "I8", "U8", "F64", "F32"]
 }

 /**
@@ -50,8 +46,6 @@ from Declaration d, Type usedType
 where
  usedType = getAUsedType*(getAnImmediateUsedType(d)) and
  problematic(usedType) and
-  // Allow uses of boolean types where defined by the language.
-  not usedType instanceof BoolType and
  // Ignore violations for which we do not have a valid location.
  not d.getLocation() instanceof UnknownLocation
 select d,
--- a/Management/AllocaInLoop.ql
+++ b/Management/AllocaInLoop.ql
@@ -208,7 +208,8 @@ class LoopWithAlloca extends Stmt {
      this.conditionRequiresInequality(va, _, _) and
      DataFlow::localFlow(result, DataFlow::exprNode(va)) and
      // Phi nodes will be preceded by nodes that represent actual definitions
-      not result instanceof DataFlow::SsaSynthNode and
+      not result instanceof DataFlow::SsaPhiNode and
+      not result instanceof DataFlow::SsaPhiInputNode and
      // A source is outside the loop if it's not inside the loop
      not exists(Expr e | e = getExpr(result) | this = getAnEnclosingLoopOfExpr(e))
    )
--- a/cpp/ql/src/Metrics/Internal/IncludeResolutionStatus.ql
+++ b/cpp/ql/src/Metrics/Internal/IncludeResolutionStatus.ql
@@ -1,20 +0,0 @@
-/**
- * @name Include file resolution status
- * @description Counts unresolved and resolved #includes.
- *              This query is for internal use only and may change without notice.
- * @kind table
- * @id cpp/include-resolution-status
- */
-
-import cpp
-
-/**
- * A cannot open file error.
- *
- * Typically this is due to a missing include.
- */
-class CannotOpenFileError extends CompilerError {
-  CannotOpenFileError() { this.hasTag(["cannot_open_file", "cannot_open_file_reason"]) }
-}
-
-select count(CannotOpenFileError e) as failed_includes, count(Include i) as successful_includes
--- a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
+++ b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
@@ -37,7 +37,7 @@ module Config implements DataFlow::ConfigSig {
  predicate isBarrier(DataFlow::Node node) {
    isSink(node) and node.asExpr().getUnspecifiedType() instanceof ArithmeticType
    or
-    node.asCertainDefinition().getUnspecifiedType() instanceof ArithmeticType
+    node.asInstruction().(StoreInstruction).getResultType() instanceof ArithmeticType
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
+++ b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
@@ -37,7 +37,7 @@ module Config implements DataFlow::ConfigSig {
  predicate isBarrier(DataFlow::Node node) {
    isSink(node) and node.asExpr().getUnspecifiedType() instanceof ArithmeticType
    or
-    node.asCertainDefinition().getUnspecifiedType() instanceof ArithmeticType
+    node.asInstruction().(StoreInstruction).getResultType() instanceof ArithmeticType
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql
+++ b/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql
@@ -212,7 +212,9 @@ module StringSizeConfig implements ProductFlow::StateConfigSig {
    )
  }

-  predicate isBarrierOut2(DataFlow::Node node) { DataFlow::flowsToBackEdge(node) }
+  predicate isBarrierOut2(DataFlow::Node node) {
+    node = any(DataFlow::SsaPhiNode phi).getAnInput(true)
+  }

  predicate isAdditionalFlowStep2(
    DataFlow::Node node1, FlowState2 state1, DataFlow::Node node2, FlowState2 state2
--- a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
@@ -42,7 +42,7 @@ module Config implements DataFlow::ConfigSig {
  predicate isBarrier(DataFlow::Node node) {
    isSink(node) and isArithmeticNonCharType(node.asExpr().getUnspecifiedType())
    or
-    isArithmeticNonCharType(node.asCertainDefinition().getUnspecifiedType())
+    isArithmeticNonCharType(node.asInstruction().(StoreInstruction).getResultType())
  }
 }

--- a/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.ql
@@ -37,7 +37,7 @@ private module Config implements DataFlow::ConfigSig {
  predicate isBarrier(DataFlow::Node node) {
    isSink(node) and node.asExpr().getUnspecifiedType() instanceof ArithmeticType
    or
-    node.asCertainDefinition().getUnspecifiedType() instanceof ArithmeticType
+    node.asInstruction().(StoreInstruction).getResultType() instanceof ArithmeticType
    or
    mayAddNullTerminator(_, node.asIndirectExpr())
  }
--- a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
@@ -75,11 +75,9 @@ module Config implements DataFlow::ConfigSig {
  predicate isSink(DataFlow::Node sink) { isSink(sink, _, _) }

  predicate isBarrier(DataFlow::Node node) {
-    exists(StoreInstruction store, Expr e |
-      store = node.asInstruction() and e = node.asCertainDefinition()
-    |
+    exists(StoreInstruction store | store = node.asInstruction() |
      // Block flow to "likely small expressions"
-      bounded(e)
+      bounded(store.getSourceValue().getUnconvertedResultExpression())
      or
      // Block flow to "small types"
      store.getResultType().getUnspecifiedType().(IntegralType).getSize() <= 1
--- a/cpp/ql/src/change-notes/2025-02-20-overflow-buffer.md
+++ b/cpp/ql/src/change-notes/2025-02-20-overflow-buffer.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* The query "Call to memory access function may overflow buffer" (`cpp/overflow-buffer`) has been added to the security-extended query suite. The query detects a range of buffer overflow and underflow issues.
--- a/cpp/ql/src/change-notes/2025-02-27-static-buffer-overflow.md
+++ b/cpp/ql/src/change-notes/2025-02-27-static-buffer-overflow.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* Due to changes in libraries the query "Static array access may cause overflow" (`cpp/static-buffer-overflow`) will no longer report cases where multiple fields of a struct or class are written with a single `memset` or similar operation.
--- a/cpp/ql/src/change-notes/2025-03-11-basic-int-types.md
+++ b/cpp/ql/src/change-notes/2025-03-11-basic-int-types.md
@@ -1,4 +0,0 @@
---
-category: minorAnalysis
---
-* The query "Use of basic integral type" (`cpp/jpl-c/basic-int-types`) no longer produces alerts for the standard fixed width integer types (`int8_t`, `uint8_t`, etc.), and the `_Bool` and `bool` types.
--- a/cpp/ql/src/change-notes/released/1.3.5.md
+++ b/cpp/ql/src/change-notes/released/1.3.5.md
@@ -0,0 +1,6 @@
+## 1.3.5
+
+### Minor Analysis Improvements
+
+* Due to changes in libraries the query "Static array access may cause overflow" (`cpp/static-buffer-overflow`) will no longer report cases where multiple fields of a struct or class are written with a single `memset` or similar operation.
+* The query "Call to memory access function may overflow buffer" (`cpp/overflow-buffer`) has been added to the security-extended query suite. The query detects a range of buffer overflow and underflow issues.
--- a/cpp/ql/src/change-notes/released/1.3.6.md
+++ b/cpp/ql/src/change-notes/released/1.3.6.md
@@ -0,0 +1,3 @@
+## 1.3.6
+
+No user-facing changes.
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.3.4
+lastReleaseVersion: 1.3.6
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.3.5-dev
+version: 1.3.7-dev
 groups:
  - cpp
  - queries
--- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected
+++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected
@@ -44,7 +44,6 @@ edges
 | test.cpp:143:18:143:21 | asdf | test.cpp:134:25:134:27 | arr | provenance |  |
 | test.cpp:143:18:143:21 | asdf | test.cpp:143:18:143:21 | asdf | provenance |  |
 | test.cpp:146:26:146:26 | *p | test.cpp:147:4:147:9 | -- ... | provenance |  |
-| test.cpp:146:26:146:26 | *p | test.cpp:147:4:147:9 | -- ... | provenance |  |
 | test.cpp:154:7:154:9 | definition of buf | test.cpp:156:12:156:18 | ... + ... | provenance | Config |
 | test.cpp:156:12:156:14 | buf | test.cpp:156:12:156:18 | ... + ... | provenance | Config |
 | test.cpp:156:12:156:18 | ... + ... | test.cpp:156:12:156:18 | ... + ... | provenance |  |
@@ -155,7 +154,6 @@ nodes
 | test.cpp:143:18:143:21 | asdf | semmle.label | asdf |
 | test.cpp:146:26:146:26 | *p | semmle.label | *p |
 | test.cpp:147:4:147:9 | -- ... | semmle.label | -- ... |
-| test.cpp:147:4:147:9 | -- ... | semmle.label | -- ... |
 | test.cpp:154:7:154:9 | definition of buf | semmle.label | definition of buf |
 | test.cpp:156:12:156:14 | buf | semmle.label | buf |
 | test.cpp:156:12:156:18 | ... + ... | semmle.label | ... + ... |
@@ -226,8 +224,6 @@ subpaths
 | test.cpp:136:9:136:16 | PointerAdd: ... += ... | test.cpp:142:10:142:13 | definition of asdf | test.cpp:138:13:138:15 | arr | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:142:10:142:13 | asdf | asdf | test.cpp:138:12:138:15 | Load: * ... | read |
 | test.cpp:136:9:136:16 | PointerAdd: ... += ... | test.cpp:143:18:143:21 | asdf | test.cpp:138:13:138:15 | arr | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:142:10:142:13 | asdf | asdf | test.cpp:138:12:138:15 | Load: * ... | read |
 | test.cpp:156:12:156:18 | PointerAdd: ... + ... | test.cpp:154:7:154:9 | definition of buf | test.cpp:147:4:147:9 | -- ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:154:7:154:9 | buf | buf | test.cpp:147:3:147:13 | Store: ... = ... | write |
-| test.cpp:156:12:156:18 | PointerAdd: ... + ... | test.cpp:154:7:154:9 | definition of buf | test.cpp:147:4:147:9 | -- ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:154:7:154:9 | buf | buf | test.cpp:147:3:147:13 | Store: ... = ... | write |
-| test.cpp:156:12:156:18 | PointerAdd: ... + ... | test.cpp:156:12:156:14 | buf | test.cpp:147:4:147:9 | -- ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:154:7:154:9 | buf | buf | test.cpp:147:3:147:13 | Store: ... = ... | write |
 | test.cpp:156:12:156:18 | PointerAdd: ... + ... | test.cpp:156:12:156:14 | buf | test.cpp:147:4:147:9 | -- ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:154:7:154:9 | buf | buf | test.cpp:147:3:147:13 | Store: ... = ... | write |
 | test.cpp:221:5:221:11 | PointerAdd: access to array | test.cpp:217:19:217:24 | definition of buffer | test.cpp:221:5:221:11 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:217:19:217:24 | buffer | buffer | test.cpp:221:5:221:15 | Store: ... = ... | write |
 | test.cpp:221:5:221:11 | PointerAdd: access to array | test.cpp:218:23:218:28 | buffer | test.cpp:221:5:221:11 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:217:19:217:24 | buffer | buffer | test.cpp:221:5:221:15 | Store: ... = ... | write |
--- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
+++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected
@@ -31,6 +31,8 @@
 | example.c:17:21:17:21 | 0 | example.c:17:21:17:21 | 0 |
 | example.c:19:6:19:6 | *b | example.c:15:37:15:37 | *b |
 | example.c:19:6:19:6 | *b [post update] | example.c:15:37:15:37 | *b |
+| example.c:19:6:19:6 | *b [post update] | example.c:19:6:19:6 | *b |
+| example.c:19:6:19:6 | b [post update] | example.c:19:6:19:6 | b |
 | example.c:24:2:24:7 | *coords | example.c:26:18:26:24 | *& ... |
 | example.c:24:2:24:7 | *coords [post update] | example.c:26:18:26:24 | *& ... |
 | example.c:24:2:24:7 | coords | example.c:26:18:26:24 | & ... |
@@ -51,9 +53,11 @@
 | example.c:26:18:26:24 | *& ... | example.c:26:2:26:7 | *coords |
 | example.c:26:18:26:24 | getX output argument | example.c:26:2:26:7 | *coords |
 | example.c:26:18:26:24 | pointer to getX output argument | example.c:26:2:26:7 | coords |
+| example.c:26:19:26:24 | *coords | example.c:26:18:26:24 | *& ... |
 | example.c:26:19:26:24 | coords | example.c:26:18:26:24 | & ... |
 | example.c:28:22:28:25 | & ... | example.c:28:14:28:25 | & ... |
 | example.c:28:22:28:25 | *& ... | example.c:28:14:28:25 | *& ... |
+| example.c:28:23:28:25 | *pos | example.c:28:22:28:25 | *& ... |
 | example.c:28:23:28:25 | pos | example.c:28:22:28:25 | & ... |
 | test.cpp:6:12:6:17 | call to source | test.cpp:6:12:6:17 | call to source |
 | test.cpp:6:12:6:17 | call to source | test.cpp:7:8:7:9 | t1 |
@@ -65,34 +69,34 @@
 | test.cpp:8:8:8:9 | t1 | test.cpp:9:8:9:9 | t1 |
 | test.cpp:9:8:9:9 | t1 | test.cpp:11:7:11:8 | t1 |
 | test.cpp:9:8:9:9 | t1 | test.cpp:11:7:11:8 | t1 |
-| test.cpp:10:8:10:9 | t2 | test.cpp:11:7:11:8 | [input] SSA phi read(t2) |
-| test.cpp:10:8:10:9 | t2 | test.cpp:11:7:11:8 | [input] SSA phi(*t2) |
+| test.cpp:10:8:10:9 | t2 | test.cpp:11:7:11:8 | Phi input |
+| test.cpp:10:8:10:9 | t2 | test.cpp:11:7:11:8 | Phi input |
 | test.cpp:10:8:10:9 | t2 | test.cpp:13:10:13:11 | t2 |
-| test.cpp:11:7:11:8 | [input] SSA phi read(t2) | test.cpp:15:3:15:6 | SSA phi read(t2) |
-| test.cpp:11:7:11:8 | [input] SSA phi(*t2) | test.cpp:15:3:15:6 | SSA phi(*t2) |
+| test.cpp:11:7:11:8 | Phi input | test.cpp:15:3:15:6 | SSA phi read(t2) |
+| test.cpp:11:7:11:8 | Phi input | test.cpp:15:3:15:6 | SSA phi(*t2) |
 | test.cpp:11:7:11:8 | t1 | test.cpp:21:8:21:9 | t1 |
 | test.cpp:12:5:12:10 | ... = ... | test.cpp:13:10:13:11 | t2 |
 | test.cpp:12:10:12:10 | 0 | test.cpp:12:5:12:10 | ... = ... |
-| test.cpp:13:5:13:8 | [input] SSA phi read(t2) | test.cpp:15:3:15:6 | SSA phi read(t2) |
-| test.cpp:13:5:13:8 | [input] SSA phi(*t2) | test.cpp:15:3:15:6 | SSA phi(*t2) |
-| test.cpp:13:10:13:11 | t2 | test.cpp:13:5:13:8 | [input] SSA phi read(t2) |
-| test.cpp:13:10:13:11 | t2 | test.cpp:13:5:13:8 | [input] SSA phi(*t2) |
+| test.cpp:13:5:13:8 | Phi input | test.cpp:15:3:15:6 | SSA phi read(t2) |
+| test.cpp:13:5:13:8 | Phi input | test.cpp:15:3:15:6 | SSA phi(*t2) |
+| test.cpp:13:10:13:11 | t2 | test.cpp:13:5:13:8 | Phi input |
+| test.cpp:13:10:13:11 | t2 | test.cpp:13:5:13:8 | Phi input |
 | test.cpp:15:3:15:6 | SSA phi read(t2) | test.cpp:15:8:15:9 | t2 |
 | test.cpp:15:3:15:6 | SSA phi(*t2) | test.cpp:15:8:15:9 | t2 |
-| test.cpp:15:8:15:9 | t2 | test.cpp:23:15:23:16 | [input] SSA phi read(*t2) |
-| test.cpp:15:8:15:9 | t2 | test.cpp:23:15:23:16 | [input] SSA phi read(t2) |
+| test.cpp:15:8:15:9 | t2 | test.cpp:23:15:23:16 | Phi input |
+| test.cpp:15:8:15:9 | t2 | test.cpp:23:15:23:16 | Phi input |
 | test.cpp:17:3:17:8 | ... = ... | test.cpp:21:8:21:9 | t1 |
 | test.cpp:17:8:17:8 | 0 | test.cpp:17:3:17:8 | ... = ... |
-| test.cpp:21:8:21:9 | t1 | test.cpp:23:15:23:16 | [input] SSA phi read(t1) |
-| test.cpp:21:8:21:9 | t1 | test.cpp:23:15:23:16 | [input] SSA phi(*t1) |
+| test.cpp:21:8:21:9 | t1 | test.cpp:23:15:23:16 | Phi input |
+| test.cpp:21:8:21:9 | t1 | test.cpp:23:15:23:16 | Phi input |
 | test.cpp:23:15:23:16 | 0 | test.cpp:23:15:23:16 | 0 |
-| test.cpp:23:15:23:16 | 0 | test.cpp:23:15:23:16 | [input] SSA phi(*i) |
-| test.cpp:23:15:23:16 | [input] SSA phi read(*t2) | test.cpp:23:19:23:19 | SSA phi read(*t2) |
-| test.cpp:23:15:23:16 | [input] SSA phi read(i) | test.cpp:23:19:23:19 | SSA phi read(i) |
-| test.cpp:23:15:23:16 | [input] SSA phi read(t1) | test.cpp:23:19:23:19 | SSA phi read(t1) |
-| test.cpp:23:15:23:16 | [input] SSA phi read(t2) | test.cpp:23:19:23:19 | SSA phi read(t2) |
-| test.cpp:23:15:23:16 | [input] SSA phi(*i) | test.cpp:23:19:23:19 | SSA phi(*i) |
-| test.cpp:23:15:23:16 | [input] SSA phi(*t1) | test.cpp:23:19:23:19 | SSA phi(*t1) |
+| test.cpp:23:15:23:16 | 0 | test.cpp:23:15:23:16 | Phi input |
+| test.cpp:23:15:23:16 | Phi input | test.cpp:23:19:23:19 | SSA phi read(*t2) |
+| test.cpp:23:15:23:16 | Phi input | test.cpp:23:19:23:19 | SSA phi read(i) |
+| test.cpp:23:15:23:16 | Phi input | test.cpp:23:19:23:19 | SSA phi read(t1) |
+| test.cpp:23:15:23:16 | Phi input | test.cpp:23:19:23:19 | SSA phi read(t2) |
+| test.cpp:23:15:23:16 | Phi input | test.cpp:23:19:23:19 | SSA phi(*i) |
+| test.cpp:23:15:23:16 | Phi input | test.cpp:23:19:23:19 | SSA phi(*t1) |
 | test.cpp:23:19:23:19 | SSA phi read(*t2) | test.cpp:24:10:24:11 | t2 |
 | test.cpp:23:19:23:19 | SSA phi read(i) | test.cpp:23:19:23:19 | i |
 | test.cpp:23:19:23:19 | SSA phi read(t1) | test.cpp:23:23:23:24 | t1 |
@@ -101,25 +105,25 @@
 | test.cpp:23:19:23:19 | SSA phi(*t1) | test.cpp:23:23:23:24 | t1 |
 | test.cpp:23:19:23:19 | i | test.cpp:23:27:23:27 | i |
 | test.cpp:23:19:23:19 | i | test.cpp:23:27:23:27 | i |
-| test.cpp:23:23:23:24 | t1 | test.cpp:23:27:23:29 | [input] SSA phi read(t1) |
+| test.cpp:23:23:23:24 | t1 | test.cpp:23:27:23:29 | Phi input |
 | test.cpp:23:23:23:24 | t1 | test.cpp:26:8:26:9 | t1 |
 | test.cpp:23:23:23:24 | t1 | test.cpp:26:8:26:9 | t1 |
 | test.cpp:23:27:23:27 | *i | test.cpp:23:27:23:27 | *i |
 | test.cpp:23:27:23:27 | *i | test.cpp:23:27:23:27 | i |
 | test.cpp:23:27:23:27 | i | test.cpp:23:27:23:27 | i |
 | test.cpp:23:27:23:27 | i | test.cpp:23:27:23:27 | i |
-| test.cpp:23:27:23:27 | i | test.cpp:23:27:23:29 | [input] SSA phi read(i) |
+| test.cpp:23:27:23:27 | i | test.cpp:23:27:23:29 | Phi input |
 | test.cpp:23:27:23:29 | ... ++ | test.cpp:23:27:23:29 | ... ++ |
-| test.cpp:23:27:23:29 | ... ++ | test.cpp:23:27:23:29 | [input] SSA phi(*i) |
-| test.cpp:23:27:23:29 | [input] SSA phi read(*t2) | test.cpp:23:19:23:19 | SSA phi read(*t2) |
-| test.cpp:23:27:23:29 | [input] SSA phi read(i) | test.cpp:23:19:23:19 | SSA phi read(i) |
-| test.cpp:23:27:23:29 | [input] SSA phi read(t1) | test.cpp:23:19:23:19 | SSA phi read(t1) |
-| test.cpp:23:27:23:29 | [input] SSA phi read(t2) | test.cpp:23:19:23:19 | SSA phi read(t2) |
-| test.cpp:23:27:23:29 | [input] SSA phi(*i) | test.cpp:23:19:23:19 | SSA phi(*i) |
-| test.cpp:23:27:23:29 | [input] SSA phi(*t1) | test.cpp:23:19:23:19 | SSA phi(*t1) |
-| test.cpp:24:5:24:11 | ... = ... | test.cpp:23:27:23:29 | [input] SSA phi(*t1) |
-| test.cpp:24:10:24:11 | t2 | test.cpp:23:27:23:29 | [input] SSA phi read(*t2) |
-| test.cpp:24:10:24:11 | t2 | test.cpp:23:27:23:29 | [input] SSA phi read(t2) |
+| test.cpp:23:27:23:29 | ... ++ | test.cpp:23:27:23:29 | Phi input |
+| test.cpp:23:27:23:29 | Phi input | test.cpp:23:19:23:19 | SSA phi read(*t2) |
+| test.cpp:23:27:23:29 | Phi input | test.cpp:23:19:23:19 | SSA phi read(i) |
+| test.cpp:23:27:23:29 | Phi input | test.cpp:23:19:23:19 | SSA phi read(t1) |
+| test.cpp:23:27:23:29 | Phi input | test.cpp:23:19:23:19 | SSA phi read(t2) |
+| test.cpp:23:27:23:29 | Phi input | test.cpp:23:19:23:19 | SSA phi(*i) |
+| test.cpp:23:27:23:29 | Phi input | test.cpp:23:19:23:19 | SSA phi(*t1) |
+| test.cpp:24:5:24:11 | ... = ... | test.cpp:23:27:23:29 | Phi input |
+| test.cpp:24:10:24:11 | t2 | test.cpp:23:27:23:29 | Phi input |
+| test.cpp:24:10:24:11 | t2 | test.cpp:23:27:23:29 | Phi input |
 | test.cpp:24:10:24:11 | t2 | test.cpp:24:5:24:11 | ... = ... |
 | test.cpp:382:48:382:54 | source1 | test.cpp:384:16:384:23 | *& ... |
 | test.cpp:383:12:383:13 | 0 | test.cpp:383:12:383:13 | 0 |
@@ -130,6 +134,7 @@
 | test.cpp:384:10:384:13 | *& ... | test.cpp:384:10:384:13 | *& ... |
 | test.cpp:384:10:384:13 | memcpy output argument | test.cpp:385:8:385:10 | tmp |
 | test.cpp:384:10:384:13 | pointer to memcpy output argument | test.cpp:385:8:385:10 | tmp |
+| test.cpp:384:11:384:13 | *tmp | test.cpp:384:10:384:13 | *& ... |
 | test.cpp:384:11:384:13 | tmp | test.cpp:384:10:384:13 | & ... |
 | test.cpp:384:16:384:23 | & ... | test.cpp:384:16:384:23 | & ... |
 | test.cpp:384:16:384:23 | *& ... | test.cpp:384:3:384:8 | **call to memcpy |
@@ -138,6 +143,7 @@
 | test.cpp:384:16:384:23 | *& ... | test.cpp:384:16:384:23 | *& ... |
 | test.cpp:384:16:384:23 | **& ... | test.cpp:384:3:384:8 | **call to memcpy |
 | test.cpp:384:16:384:23 | **& ... | test.cpp:384:10:384:13 | memcpy output argument |
+| test.cpp:384:17:384:23 | *source1 | test.cpp:384:16:384:23 | *& ... |
 | test.cpp:384:17:384:23 | source1 | test.cpp:384:16:384:23 | & ... |
 | test.cpp:388:53:388:59 | source1 | test.cpp:391:16:391:23 | *& ... |
 | test.cpp:388:66:388:66 | b | test.cpp:393:7:393:7 | b |
@@ -147,6 +153,7 @@
 | test.cpp:390:18:390:21 | & ... | test.cpp:391:10:391:13 | & ... |
 | test.cpp:390:18:390:21 | *& ... | test.cpp:390:18:390:21 | *& ... |
 | test.cpp:390:18:390:21 | *& ... | test.cpp:391:10:391:13 | *& ... |
+| test.cpp:390:19:390:21 | *tmp | test.cpp:390:18:390:21 | *& ... |
 | test.cpp:390:19:390:21 | tmp | test.cpp:390:18:390:21 | & ... |
 | test.cpp:391:10:391:13 | & ... | test.cpp:391:3:391:8 | call to memcpy |
 | test.cpp:391:10:391:13 | & ... | test.cpp:391:10:391:13 | & ... |
@@ -154,6 +161,7 @@
 | test.cpp:391:10:391:13 | *& ... | test.cpp:391:10:391:13 | *& ... |
 | test.cpp:391:10:391:13 | memcpy output argument | test.cpp:392:8:392:10 | tmp |
 | test.cpp:391:10:391:13 | pointer to memcpy output argument | test.cpp:392:8:392:10 | tmp |
+| test.cpp:391:11:391:13 | *tmp | test.cpp:391:10:391:13 | *& ... |
 | test.cpp:391:11:391:13 | tmp | test.cpp:391:10:391:13 | & ... |
 | test.cpp:391:16:391:23 | & ... | test.cpp:391:16:391:23 | & ... |
 | test.cpp:391:16:391:23 | *& ... | test.cpp:391:3:391:8 | **call to memcpy |
@@ -162,6 +170,7 @@
 | test.cpp:391:16:391:23 | *& ... | test.cpp:391:16:391:23 | *& ... |
 | test.cpp:391:16:391:23 | **& ... | test.cpp:391:3:391:8 | **call to memcpy |
 | test.cpp:391:16:391:23 | **& ... | test.cpp:391:10:391:13 | memcpy output argument |
+| test.cpp:391:17:391:23 | *source1 | test.cpp:391:16:391:23 | *& ... |
 | test.cpp:391:17:391:23 | source1 | test.cpp:391:16:391:23 | & ... |
 | test.cpp:392:8:392:10 | tmp | test.cpp:394:10:394:12 | tmp |
 | test.cpp:392:8:392:10 | tmp | test.cpp:394:10:394:12 | tmp |
@@ -187,6 +196,8 @@
 | test.cpp:488:24:488:30 | content | test.cpp:488:21:488:30 | content |
 | test.cpp:489:20:489:20 | *s | test.cpp:487:67:487:67 | *s |
 | test.cpp:489:20:489:20 | *s [post update] | test.cpp:487:67:487:67 | *s |
+| test.cpp:489:20:489:20 | *s [post update] | test.cpp:489:20:489:20 | *s |
+| test.cpp:489:20:489:20 | s [post update] | test.cpp:489:20:489:20 | s |
 | test.cpp:489:23:489:29 | *content | test.cpp:489:23:489:29 | *content |
 | test.cpp:489:23:489:29 | *content | test.cpp:490:8:490:17 | * ... |
 | test.cpp:489:23:489:29 | content | test.cpp:489:23:489:29 | content |
@@ -198,4 +209,5 @@
 | test.cpp:1087:3:1087:3 | a [post update] | test.cpp:1088:8:1088:9 | & ... |
 | test.cpp:1087:15:1087:21 | 0 | test.cpp:1087:3:1087:21 | ... = ... |
 | test.cpp:1087:15:1087:21 | *0 | test.cpp:1087:3:1087:21 | *... = ... |
+| test.cpp:1088:9:1088:9 | *a | test.cpp:1088:8:1088:9 | *& ... |
 | test.cpp:1088:9:1088:9 | a | test.cpp:1088:8:1088:9 | & ... |
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected
@@ -1,13 +1,13 @@
-| test.cpp:3:8:3:8 | C<1> | 0 | int | test.cpp:5:25:5:25 | 1 | 1 |
-| test.cpp:3:8:3:8 | C<2> | 0 | int | file://:0:0:0:0 | 2 | 2 |
-| test.cpp:3:8:3:8 | C<x> | 0 | int | file://:0:0:0:0 | x | x |
-| test.cpp:10:8:10:8 | D<T, X> | 0 | <none> | test.cpp:9:19:9:19 | T | <none> |
-| test.cpp:10:8:10:8 | D<T, X> | 1 | T | file://:0:0:0:0 | X | X |
-| test.cpp:10:8:10:8 | D<int, 2> | 0 | <none> | file://:0:0:0:0 | int | <none> |
-| test.cpp:10:8:10:8 | D<int, 2> | 1 | int | test.cpp:12:8:12:8 | 2 | 2 |
-| test.cpp:10:8:10:8 | D<long, 2L> | 0 | <none> | file://:0:0:0:0 | long | <none> |
-| test.cpp:10:8:10:8 | D<long, 2L> | 1 | long | file://:0:0:0:0 | 2 | 2 |
-| test.cpp:16:8:16:8 | E<T, X> | 0 | <none> | test.cpp:15:19:15:19 | T | <none> |
-| test.cpp:16:8:16:8 | E<T, X> | 1 | T * | file://:0:0:0:0 | X | X |
-| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 0 | <none> | file://:0:0:0:0 | int | <none> |
-| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 1 | int * | file://:0:0:0:0 | 0 | 0 |
+| test.cpp:3:8:3:8 | C<1> | 0 | int | test.cpp:5:25:5:25 | 1 |
+| test.cpp:3:8:3:8 | C<2> | 0 | int | file://:0:0:0:0 | 2 |
+| test.cpp:3:8:3:8 | C<x> | 0 | int | file://:0:0:0:0 | x |
+| test.cpp:10:8:10:8 | D<T, X> | 0 | <none> | test.cpp:9:19:9:19 | T |
+| test.cpp:10:8:10:8 | D<T, X> | 1 | T | file://:0:0:0:0 | X |
+| test.cpp:10:8:10:8 | D<int, 2> | 0 | <none> | file://:0:0:0:0 | int |
+| test.cpp:10:8:10:8 | D<int, 2> | 1 | int | test.cpp:12:8:12:8 | 2 |
+| test.cpp:10:8:10:8 | D<long, 2L> | 0 | <none> | file://:0:0:0:0 | long |
+| test.cpp:10:8:10:8 | D<long, 2L> | 1 | long | file://:0:0:0:0 | 2 |
+| test.cpp:16:8:16:8 | E<T, X> | 0 | <none> | test.cpp:15:19:15:19 | T |
+| test.cpp:16:8:16:8 | E<T, X> | 1 | T * | file://:0:0:0:0 | X |
+| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 0 | <none> | file://:0:0:0:0 | int |
+| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 1 | int * | file://:0:0:0:0 | 0 |
--- a/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql
+++ b/cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql
@@ -9,16 +9,6 @@ string maybeGetTemplateArgumentKind(Declaration d, int i) {
  i = [0 .. d.getNumberOfTemplateArguments()]
 }

-string maybeGetTemplateArgumentValue(Declaration d, int i) {
-  (
-    if exists(d.getTemplateArgument(i).(Expr).getValue())
-    then result = d.getTemplateArgument(i).(Expr).getValue()
-    else result = "<none>"
-  ) and
-  i = [0 .. d.getNumberOfTemplateArguments()]
-}
-
 from Declaration d, int i
 where i >= 0 and i < d.getNumberOfTemplateArguments()
-select d, i, maybeGetTemplateArgumentKind(d, i), d.getTemplateArgument(i),
-  maybeGetTemplateArgumentValue(d, i)
+select d, i, maybeGetTemplateArgumentKind(d, i), d.getTemplateArgument(i)
--- a/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule
+++ b/cpp/ql/test/query-tests/JPL_C/LOC-3/Rule
@@ -1 +1,3 @@
 | test.c:6:26:6:26 | x | x uses the basic integral type unsigned char rather than a typedef with size and signedness. |
+| test.c:7:20:7:20 | x | x uses the basic integral type unsigned char rather than a typedef with size and signedness. |
+| test.c:10:16:10:20 | test7 | test7 uses the basic integral type unsigned char rather than a typedef with size and signedness. |
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/TaintedPath.expected
@@ -1,13 +1,7 @@
 edges
-| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:62:25:62:46 | ... = ... | provenance |  |
-| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:69:21:69:40 | ... = ... | provenance |  |
 | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | *data | provenance |  |
-| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:62:25:62:46 | ... = ... | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | *data | provenance |  |
-| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:69:21:69:40 | ... = ... | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | *data | provenance |  |
 nodes
 | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:55:27:55:38 | fgets output argument | semmle.label | fgets output argument |
-| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:62:25:62:46 | ... = ... | semmle.label | ... = ... |
-| CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:69:21:69:40 | ... = ... | semmle.label | ... = ... |
 | CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp:77:23:77:26 | *data | semmle.label | *data |
 subpaths
 #select
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/UncontrolledFormatString.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/SAMATE/UncontrolledFormatString.expected
@@ -1,21 +1,12 @@
 edges
-| char_connect_socket_w32_vsnprintf_01_bad.c:94:46:94:69 | recv output argument | char_connect_socket_w32_vsnprintf_01_bad.c:100:13:100:60 | ... = ... | provenance |  |
 | char_connect_socket_w32_vsnprintf_01_bad.c:94:46:94:69 | recv output argument | char_connect_socket_w32_vsnprintf_01_bad.c:125:15:125:18 | *data | provenance |  |
-| char_connect_socket_w32_vsnprintf_01_bad.c:100:13:100:60 | ... = ... | char_connect_socket_w32_vsnprintf_01_bad.c:125:15:125:18 | *data | provenance |  |
-| char_console_fprintf_01_bad.c:30:23:30:35 | fgets output argument | char_console_fprintf_01_bad.c:37:21:37:43 | ... = ... | provenance |  |
-| char_console_fprintf_01_bad.c:30:23:30:35 | fgets output argument | char_console_fprintf_01_bad.c:44:17:44:37 | ... = ... | provenance |  |
 | char_console_fprintf_01_bad.c:30:23:30:35 | fgets output argument | char_console_fprintf_01_bad.c:49:21:49:24 | *data | provenance |  |
-| char_console_fprintf_01_bad.c:37:21:37:43 | ... = ... | char_console_fprintf_01_bad.c:49:21:49:24 | *data | provenance |  |
-| char_console_fprintf_01_bad.c:44:17:44:37 | ... = ... | char_console_fprintf_01_bad.c:49:21:49:24 | *data | provenance |  |
 | char_environment_fprintf_01_bad.c:27:30:27:35 | *call to getenv | char_environment_fprintf_01_bad.c:27:30:27:35 | *call to getenv | provenance |  |
 | char_environment_fprintf_01_bad.c:27:30:27:35 | *call to getenv | char_environment_fprintf_01_bad.c:36:21:36:24 | *data | provenance | TaintFunction |
 nodes
 | char_connect_socket_w32_vsnprintf_01_bad.c:94:46:94:69 | recv output argument | semmle.label | recv output argument |
-| char_connect_socket_w32_vsnprintf_01_bad.c:100:13:100:60 | ... = ... | semmle.label | ... = ... |
 | char_connect_socket_w32_vsnprintf_01_bad.c:125:15:125:18 | *data | semmle.label | *data |
 | char_console_fprintf_01_bad.c:30:23:30:35 | fgets output argument | semmle.label | fgets output argument |
-| char_console_fprintf_01_bad.c:37:21:37:43 | ... = ... | semmle.label | ... = ... |
-| char_console_fprintf_01_bad.c:44:17:44:37 | ... = ... | semmle.label | ... = ... |
 | char_console_fprintf_01_bad.c:49:21:49:24 | *data | semmle.label | *data |
 | char_environment_fprintf_01_bad.c:27:30:27:35 | *call to getenv | semmle.label | *call to getenv |
 | char_environment_fprintf_01_bad.c:27:30:27:35 | *call to getenv | semmle.label | *call to getenv |
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/consts/NonConstantFormat.expected
@@ -1,9 +1,6 @@
 edges
-| consts.cpp:24:7:24:9 | **gv1 | consts.cpp:25:2:25:4 | *a | provenance |  |
+| consts.cpp:24:7:24:9 | **gv1 | consts.cpp:24:7:24:9 | **gv1 | provenance |  |
 | consts.cpp:24:7:24:9 | **gv1 | consts.cpp:30:9:30:14 | *access to array | provenance |  |
-| consts.cpp:24:7:24:9 | **gv1 | consts.cpp:123:2:123:12 | *... = ... | provenance |  |
-| consts.cpp:25:2:25:4 | *a | consts.cpp:26:2:26:4 | *b | provenance |  |
-| consts.cpp:26:2:26:4 | *b | consts.cpp:24:7:24:9 | **gv1 | provenance |  |
 | consts.cpp:29:7:29:25 | **nonConstFuncToArray | consts.cpp:126:9:126:30 | *call to nonConstFuncToArray | provenance |  |
 | consts.cpp:30:9:30:14 | *access to array | consts.cpp:29:7:29:25 | **nonConstFuncToArray | provenance |  |
 | consts.cpp:85:7:85:8 | gets output argument | consts.cpp:86:9:86:10 | *v1 | provenance |  |
@@ -28,7 +25,8 @@ edges
 | consts.cpp:106:13:106:19 | *call to varFunc | consts.cpp:107:9:107:10 | *v5 | provenance |  |
 | consts.cpp:111:2:111:15 | *... = ... | consts.cpp:112:9:112:10 | *v6 | provenance |  |
 | consts.cpp:111:7:111:13 | *call to varFunc | consts.cpp:111:2:111:15 | *... = ... | provenance |  |
-| consts.cpp:115:17:115:18 | *v1 | consts.cpp:115:21:115:22 | *v2 | provenance |  |
+| consts.cpp:115:17:115:18 | *v1 | consts.cpp:116:9:116:13 | *access to array | provenance |  |
+| consts.cpp:115:17:115:18 | *v1 | consts.cpp:120:2:120:11 | *... = ... | provenance |  |
 | consts.cpp:115:21:115:22 | *v2 | consts.cpp:116:9:116:13 | *access to array | provenance |  |
 | consts.cpp:115:21:115:22 | *v2 | consts.cpp:120:2:120:11 | *... = ... | provenance |  |
 | consts.cpp:120:2:120:11 | *... = ... | consts.cpp:121:9:121:10 | *v8 | provenance |  |
@@ -38,8 +36,6 @@ edges
 | consts.cpp:144:16:144:18 | readStringRef output argument | consts.cpp:145:9:145:11 | *v12 | provenance |  |
 nodes
 | consts.cpp:24:7:24:9 | **gv1 | semmle.label | **gv1 |
-| consts.cpp:25:2:25:4 | *a | semmle.label | *a |
-| consts.cpp:26:2:26:4 | *b | semmle.label | *b |
 | consts.cpp:29:7:29:25 | **nonConstFuncToArray | semmle.label | **nonConstFuncToArray |
 | consts.cpp:30:9:30:14 | *access to array | semmle.label | *access to array |
 | consts.cpp:85:7:85:8 | gets output argument | semmle.label | gets output argument |
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected
@@ -27,10 +27,6 @@ edges
 | test.cpp:53:5:53:23 | ... = ... | test.cpp:51:33:51:35 | *end | provenance |  |
 | test.cpp:53:12:53:23 | ... + ... | test.cpp:53:5:53:23 | ... = ... | provenance |  |
 | test.cpp:60:34:60:37 | mk_array output argument | test.cpp:67:9:67:14 | ... = ... | provenance | Config |
-| test.cpp:60:34:60:37 | mk_array output argument | test.cpp:67:9:67:14 | ... = ... | provenance | Config |
-| test.cpp:66:37:66:39 | *++ ... | test.cpp:67:9:67:14 | ... = ... | provenance |  |
-| test.cpp:66:37:66:39 | *++ ... | test.cpp:67:9:67:14 | ... = ... | provenance |  |
-| test.cpp:67:9:67:14 | ... = ... | test.cpp:66:37:66:39 | *++ ... | provenance |  |
 | test.cpp:205:15:205:33 | call to malloc | test.cpp:205:15:205:33 | call to malloc | provenance |  |
 | test.cpp:205:15:205:33 | call to malloc | test.cpp:206:17:206:23 | ... + ... | provenance | Config |
 | test.cpp:206:17:206:23 | ... + ... | test.cpp:206:17:206:23 | ... + ... | provenance |  |
@@ -51,11 +47,6 @@ edges
 | test.cpp:271:14:271:21 | ... + ... | test.cpp:271:14:271:21 | ... + ... | provenance |  |
 | test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | ... = ... | provenance | Config |
 | test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | ... = ... | provenance | Config |
-| test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | ... = ... | provenance | Config |
-| test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | ... = ... | provenance | Config |
-| test.cpp:272:31:272:33 | *... ++ | test.cpp:274:5:274:10 | ... = ... | provenance |  |
-| test.cpp:272:31:272:33 | *... ++ | test.cpp:274:5:274:10 | ... = ... | provenance |  |
-| test.cpp:274:5:274:10 | ... = ... | test.cpp:272:31:272:33 | *... ++ | provenance |  |
 | test.cpp:355:14:355:27 | new[] | test.cpp:355:14:355:27 | new[] | provenance |  |
 | test.cpp:355:14:355:27 | new[] | test.cpp:356:15:356:23 | ... + ... | provenance | Config |
 | test.cpp:356:15:356:23 | ... + ... | test.cpp:356:15:356:23 | ... + ... | provenance |  |
@@ -123,18 +114,9 @@ edges
 | test.cpp:794:5:794:24 | ... = ... | test.cpp:792:60:792:62 | *end | provenance |  |
 | test.cpp:794:12:794:24 | ... + ... | test.cpp:794:5:794:24 | ... = ... | provenance |  |
 | test.cpp:800:40:800:43 | mk_array_no_field_flow output argument | test.cpp:807:7:807:12 | ... = ... | provenance | Config |
-| test.cpp:800:40:800:43 | mk_array_no_field_flow output argument | test.cpp:807:7:807:12 | ... = ... | provenance | Config |
-| test.cpp:806:35:806:37 | *++ ... | test.cpp:807:7:807:12 | ... = ... | provenance |  |
-| test.cpp:806:35:806:37 | *++ ... | test.cpp:807:7:807:12 | ... = ... | provenance |  |
-| test.cpp:807:7:807:12 | ... = ... | test.cpp:806:35:806:37 | *++ ... | provenance |  |
 | test.cpp:815:52:815:54 | end | test.cpp:815:52:815:54 | end | provenance |  |
 | test.cpp:815:52:815:54 | end | test.cpp:821:7:821:12 | ... = ... | provenance | Config |
 | test.cpp:815:52:815:54 | end | test.cpp:821:7:821:12 | ... = ... | provenance | Config |
-| test.cpp:815:52:815:54 | end | test.cpp:821:7:821:12 | ... = ... | provenance | Config |
-| test.cpp:815:52:815:54 | end | test.cpp:821:7:821:12 | ... = ... | provenance | Config |
-| test.cpp:820:35:820:37 | *++ ... | test.cpp:821:7:821:12 | ... = ... | provenance |  |
-| test.cpp:820:35:820:37 | *++ ... | test.cpp:821:7:821:12 | ... = ... | provenance |  |
-| test.cpp:821:7:821:12 | ... = ... | test.cpp:820:35:820:37 | *++ ... | provenance |  |
 | test.cpp:832:40:832:43 | mk_array_no_field_flow output argument | test.cpp:833:37:833:39 | end | provenance |  |
 | test.cpp:833:37:833:39 | end | test.cpp:815:52:815:54 | end | provenance |  |
 | test.cpp:841:18:841:35 | call to malloc | test.cpp:841:18:841:35 | call to malloc | provenance |  |
@@ -175,8 +157,6 @@ nodes
 | test.cpp:53:5:53:23 | ... = ... | semmle.label | ... = ... |
 | test.cpp:53:12:53:23 | ... + ... | semmle.label | ... + ... |
 | test.cpp:60:34:60:37 | mk_array output argument | semmle.label | mk_array output argument |
-| test.cpp:66:37:66:39 | *++ ... | semmle.label | *++ ... |
-| test.cpp:67:9:67:14 | ... = ... | semmle.label | ... = ... |
 | test.cpp:67:9:67:14 | ... = ... | semmle.label | ... = ... |
 | test.cpp:205:15:205:33 | call to malloc | semmle.label | call to malloc |
 | test.cpp:205:15:205:33 | call to malloc | semmle.label | call to malloc |
@@ -194,8 +174,6 @@ nodes
 | test.cpp:270:13:270:24 | new[] | semmle.label | new[] |
 | test.cpp:271:14:271:21 | ... + ... | semmle.label | ... + ... |
 | test.cpp:271:14:271:21 | ... + ... | semmle.label | ... + ... |
-| test.cpp:272:31:272:33 | *... ++ | semmle.label | *... ++ |
-| test.cpp:274:5:274:10 | ... = ... | semmle.label | ... = ... |
 | test.cpp:274:5:274:10 | ... = ... | semmle.label | ... = ... |
 | test.cpp:355:14:355:27 | new[] | semmle.label | new[] |
 | test.cpp:355:14:355:27 | new[] | semmle.label | new[] |
@@ -262,13 +240,9 @@ nodes
 | test.cpp:794:5:794:24 | ... = ... | semmle.label | ... = ... |
 | test.cpp:794:12:794:24 | ... + ... | semmle.label | ... + ... |
 | test.cpp:800:40:800:43 | mk_array_no_field_flow output argument | semmle.label | mk_array_no_field_flow output argument |
-| test.cpp:806:35:806:37 | *++ ... | semmle.label | *++ ... |
-| test.cpp:807:7:807:12 | ... = ... | semmle.label | ... = ... |
 | test.cpp:807:7:807:12 | ... = ... | semmle.label | ... = ... |
 | test.cpp:815:52:815:54 | end | semmle.label | end |
 | test.cpp:815:52:815:54 | end | semmle.label | end |
-| test.cpp:820:35:820:37 | *++ ... | semmle.label | *++ ... |
-| test.cpp:821:7:821:12 | ... = ... | semmle.label | ... = ... |
 | test.cpp:821:7:821:12 | ... = ... | semmle.label | ... = ... |
 | test.cpp:832:40:832:43 | mk_array_no_field_flow output argument | semmle.label | mk_array_no_field_flow output argument |
 | test.cpp:833:37:833:39 | end | semmle.label | end |
--- a/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected
+++ b/cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/CleartextTransmission.expected
@@ -16,8 +16,7 @@ edges
 | test3.cpp:138:24:138:32 | password1 | test3.cpp:138:21:138:22 | call to id | provenance |  |
 | test3.cpp:144:16:144:29 | call to get_global_str | test3.cpp:144:16:144:29 | call to get_global_str | provenance |  |
 | test3.cpp:144:16:144:29 | call to get_global_str | test3.cpp:146:15:146:18 | data | provenance |  |
-| test3.cpp:157:19:157:26 | password | test3.cpp:158:3:158:16 | ... = ... | provenance | TaintFunction |
-| test3.cpp:158:3:158:16 | ... = ... | test3.cpp:159:15:159:20 | *buffer | provenance |  |
+| test3.cpp:157:19:157:26 | password | test3.cpp:159:15:159:20 | *buffer | provenance | TaintFunction |
 | test3.cpp:270:16:270:23 | password | test3.cpp:272:15:272:18 | *data | provenance | DataFlowFunction |
 | test3.cpp:278:20:278:23 | data | test3.cpp:280:14:280:17 | data | provenance |  |
 | test3.cpp:283:20:283:23 | data | test3.cpp:285:14:285:17 | data | provenance |  |
@@ -71,7 +70,6 @@ nodes
 | test3.cpp:144:16:144:29 | call to get_global_str | semmle.label | call to get_global_str |
 | test3.cpp:146:15:146:18 | data | semmle.label | data |
 | test3.cpp:157:19:157:26 | password | semmle.label | password |
-| test3.cpp:158:3:158:16 | ... = ... | semmle.label | ... = ... |
 | test3.cpp:159:15:159:20 | *buffer | semmle.label | *buffer |
 | test3.cpp:173:15:173:22 | password | semmle.label | password |
 | test3.cpp:181:15:181:22 | password | semmle.label | password |
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependabotProxy.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependabotProxy.cs
@@ -1,30 +1,14 @@
 using System;
-using System.Collections.Generic;
+using System.Diagnostics;
 using System.IO;
 using System.Security.Cryptography.X509Certificates;
 using Semmle.Util;
 using Semmle.Util.Logging;
-using Newtonsoft.Json;

 namespace Semmle.Extraction.CSharp.DependencyFetching
 {
    public class DependabotProxy : IDisposable
    {
-        /// <summary>
-        /// Represents configurations for package registries.
-        /// </summary>
-        public struct RegistryConfig
-        {
-            /// <summary>
-            /// The type of package registry.
-            /// </summary>
-            public string Type { get; set; }
-            /// <summary>
-            /// The URL of the package registry.
-            /// </summary>
-            public string URL { get; set; }
-        }
-
        private readonly string host;
        private readonly string port;

@@ -33,10 +17,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        /// </summary>
        internal string Address { get; }
        /// <summary>
-        /// The URLs of package registries that are configured for the proxy.
-        /// </summary>
-        internal HashSet<string> RegistryURLs { get; }
-        /// <summary>
        /// The path to the temporary file where the certificate is stored.
        /// </summary>
        internal string? CertificatePath { get; private set; }
@@ -87,39 +67,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                result.Certificate = X509Certificate2.CreateFromPem(cert);
            }

-            // Try to obtain the list of private registry URLs.
-            var registryURLs = Environment.GetEnvironmentVariable(EnvironmentVariableNames.ProxyURLs);
-
-            if (!string.IsNullOrWhiteSpace(registryURLs))
-            {
-                try
-                {
-                    // The value of the environment variable should be a JSON array of objects, such as:
-                    // [ { "type": "nuget_feed", "url": "https://nuget.pkg.github.com/org/index.json" } ]
-                    var array = JsonConvert.DeserializeObject<List<RegistryConfig>>(registryURLs);
-                    if (array != null)
-                    {
-                        foreach (RegistryConfig config in array)
-                        {
-                            // The array contains all configured private registries, not just ones for C#.
-                            // We ignore the non-C# ones here.
-                            if (!config.Type.Equals("nuget_feed"))
-                            {
-                                logger.LogDebug($"Ignoring registry at '{config.URL}' since it is not of type 'nuget_feed'.");
-                                continue;
-                            }
-
-                            logger.LogInfo($"Found private registry at '{config.URL}'");
-                            result.RegistryURLs.Add(config.URL);
-                        }
-                    }
-                }
-                catch (JsonException ex)
-                {
-                    logger.LogError($"Unable to parse '{EnvironmentVariableNames.ProxyURLs}': {ex.Message}");
-                }
-            }
-
            return result;
        }

@@ -128,7 +75,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
            this.host = host;
            this.port = port;
            this.Address = $"http://{this.host}:{this.port}";
-            this.RegistryURLs = new HashSet<string>();
        }

        public void Dispose()
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs
@@ -2,7 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
-using System.Text;
+
 using Newtonsoft.Json.Linq;

 using Semmle.Util;
@@ -67,19 +67,6 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                args += $" --configfile \"{restoreSettings.PathToNugetConfig}\"";
            }

-            // Add package sources. If any are present, they override all sources specified in
-            // the configuration file(s).
-            if (restoreSettings.Sources != null)
-            {
-                var feedArgs = new StringBuilder();
-                foreach (string source in restoreSettings.Sources)
-                {
-                    feedArgs.Append($" -s {source}");
-                }
-
-                args += feedArgs.ToString();
-            }
-
            if (restoreSettings.ForceReevaluation)
            {
                args += " --force";
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/EnvironmentVariableNames.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/EnvironmentVariableNames.cs
@@ -89,10 +89,5 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        /// Contains the certificate used by the Dependabot proxy.
        /// </summary>
        public const string ProxyCertificate = "CODEQL_PROXY_CA_CERTIFICATE";
-
-        /// <summary>
-        /// Contains the URLs of private nuget registries as a JSON array.
-        /// </summary>
-        public const string ProxyURLs = "CODEQL_PROXY_URLS";
    }
 }
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/IDotNet.cs
@@ -17,7 +17,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        IList<string> GetNugetFeedsFromFolder(string folderPath);
    }

-    public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, IList<string>? Sources = null, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);
+    public record class RestoreSettings(string File, string PackageDirectory, bool ForceDotnetRefAssemblyFetching, string? PathToNugetConfig = null, bool ForceReevaluation = false, bool TargetWindows = false);

    public partial record class RestoreResult(bool Success, IList<string> Output)
    {
--- a/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
@@ -109,7 +109,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                if (checkNugetFeedResponsiveness && !CheckFeeds(out explicitFeeds))
                {
                    // todo: we could also check the reachability of the inherited nuget feeds, but to use those in the fallback we would need to handle authentication too.
-                    var unresponsiveMissingPackageLocation = DownloadMissingPackagesFromSpecificFeeds([], explicitFeeds);
+                    var unresponsiveMissingPackageLocation = DownloadMissingPackagesFromSpecificFeeds(explicitFeeds);
                    return unresponsiveMissingPackageLocation is null
                        ? []
                        : [unresponsiveMissingPackageLocation];
@@ -156,7 +156,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching

            var restoredProjects = RestoreSolutions(out var container);
            var projects = fileProvider.Projects.Except(restoredProjects);
-            RestoreProjects(projects, explicitFeeds, out var containers);
+            RestoreProjects(projects, out var containers);

            var dependencies = containers.Flatten(container);

@@ -166,11 +166,11 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                .ToList();
            assemblyLookupLocations.UnionWith(paths.Select(p => new AssemblyLookupLocation(p)));

-            var usedPackageNames = GetAllUsedPackageDirNames(dependencies);
+            LogAllUnusedPackages(dependencies);

            var missingPackageLocation = checkNugetFeedResponsiveness
-                ? DownloadMissingPackagesFromSpecificFeeds(usedPackageNames, explicitFeeds)
-                : DownloadMissingPackages(usedPackageNames);
+                ? DownloadMissingPackagesFromSpecificFeeds(explicitFeeds)
+                : DownloadMissingPackages();

            if (missingPackageLocation is not null)
            {
@@ -260,24 +260,8 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
        /// Populates dependencies with the relative paths to the assets files generated by the restore.
        /// </summary>
        /// <param name="projects">A list of paths to project files.</param>
-        private void RestoreProjects(IEnumerable<string> projects, HashSet<string>? configuredSources, out ConcurrentBag<DependencyContainer> dependencies)
+        private void RestoreProjects(IEnumerable<string> projects, out ConcurrentBag<DependencyContainer> dependencies)
        {
-            // Conservatively, we only set this to a non-null value if a Dependabot proxy is enabled.
-            // This ensures that we continue to get the old behaviour where feeds are taken from
-            // `nuget.config` files instead of the command-line arguments.
-            HashSet<string>? sources = null;
-
-            if (this.dependabotProxy != null)
-            {
-                // If the Dependabot proxy is configured, then our main goal is to make `dotnet` aware
-                // of the private registry feeds. However, since providing them as command-line arguments
-                // to `dotnet` ignores other feeds that may be configured, we also need to add the feeds
-                // we have discovered from analysing `nuget.config` files.
-                sources = configuredSources ?? new();
-                sources.Add(PublicNugetOrgFeed);
-                this.dependabotProxy?.RegistryURLs.ForEach(url => sources.Add(url));
-            }
-
            var successCount = 0;
            var nugetSourceFailures = 0;
            ConcurrentBag<DependencyContainer> collectedDependencies = [];
@@ -292,7 +276,7 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
                foreach (var project in projectGroup)
                {
                    logger.LogInfo($"Restoring project {project}...");
-                    var res = dotnet.Restore(new(project, PackageDirectory.DirInfo.FullName, ForceDotnetRefAssemblyFetching: true, sources?.ToList(), TargetWindows: isWindows));
+                    var res = dotnet.Restore(new(project, PackageDirectory.DirInfo.FullName, ForceDotnetRefAssemblyFetching: true, TargetWindows: isWindows));
                    assets.AddDependenciesRange(res.AssetsFilePaths);
                    lock (sync)
                    {
@@ -313,21 +297,21 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
            compilationInfoContainer.CompilationInfos.Add(("Failed project restore with package source error", nugetSourceFailures.ToString()));
        }

-        private AssemblyLookupLocation? DownloadMissingPackagesFromSpecificFeeds(IEnumerable<string> usedPackageNames, HashSet<string>? feedsFromNugetConfigs)
+        private AssemblyLookupLocation? DownloadMissingPackagesFromSpecificFeeds(HashSet<string>? feedsFromNugetConfigs)
        {
            var reachableFallbackFeeds = GetReachableFallbackNugetFeeds(feedsFromNugetConfigs);
            if (reachableFallbackFeeds.Count > 0)
            {
-                return DownloadMissingPackages(usedPackageNames, fallbackNugetFeeds: reachableFallbackFeeds);
+                return DownloadMissingPackages(fallbackNugetFeeds: reachableFallbackFeeds);
            }

            logger.LogWarning("Skipping download of missing packages from specific feeds as no fallback Nuget feeds are reachable.");
            return null;
        }

-        private AssemblyLookupLocation? DownloadMissingPackages(IEnumerable<string> usedPackageNames, IEnumerable<string>? fallbackNugetFeeds = null)
+        private AssemblyLookupLocation? DownloadMissingPackages(IEnumerable<string>? fallbackNugetFeeds = null)
        {
-            var alreadyDownloadedPackages = usedPackageNames.Select(p => p.ToLowerInvariant());
+            var alreadyDownloadedPackages = GetRestoredPackageDirectoryNames(PackageDirectory.DirInfo);
            var alreadyDownloadedLegacyPackages = GetRestoredLegacyPackageNames();

            var notYetDownloadedPackages = new HashSet<PackageReference>(fileContent.AllPackages);
@@ -434,23 +418,17 @@ namespace Semmle.Extraction.CSharp.DependencyFetching
            return nugetConfig;
        }

-        private IEnumerable<string> GetAllUsedPackageDirNames(DependencyContainer dependencies)
+        private void LogAllUnusedPackages(DependencyContainer dependencies)
        {
            var allPackageDirectories = GetAllPackageDirectories();

            logger.LogInfo($"Restored {allPackageDirectories.Count} packages");
            logger.LogInfo($"Found {dependencies.Packages.Count} packages in project.assets.json files");

-            var usage = allPackageDirectories.Select(package => (package, isUsed: dependencies.Packages.Contains(package)));
-
-            usage
-                .Where(package => !package.isUsed)
+            allPackageDirectories
+                .Where(package => !dependencies.Packages.Contains(package))
                .Order()
-                .ForEach(package => logger.LogDebug($"Unused package: {package.package}"));
-
-            return usage
-                .Where(package => package.isUsed)
-                .Select(package => package.package);
+                .ForEach(package => logger.LogDebug($"Unused package: {package}"));
        }

        private ICollection<string> GetAllPackageDirectories()
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Assembly.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Assembly.cs
@@ -31,7 +31,7 @@ namespace Semmle.Extraction.CSharp.Entities
        {
            if (assemblyPath is not null)
            {
-                var isBuildlessOutputAssembly = isOutputAssembly && Context.ExtractionContext.IsStandalone;
+                var isBuildlessOutputAssembly = isOutputAssembly && Context.ExtractionContext.Mode.HasFlag(ExtractorMode.Standalone);
                var identifier = isBuildlessOutputAssembly
                    ? ""
                    : assembly.ToString() ?? "";
@@ -72,7 +72,7 @@ namespace Semmle.Extraction.CSharp.Entities

        public override void WriteId(EscapingTextWriter trapFile)
        {
-            if (isOutputAssembly && Context.ExtractionContext.IsStandalone)
+            if (isOutputAssembly && Context.ExtractionContext.Mode.HasFlag(ExtractorMode.Standalone))
            {
                trapFile.Write("buildlessOutputAssembly");
            }
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Expressions/Invocation.cs
@@ -133,7 +133,7 @@ namespace Semmle.Extraction.CSharp.Entities.Expressions
                        .Where(method => method.Parameters.Length >= Syntax.ArgumentList.Arguments.Count)
                        .Where(method => method.Parameters.Count(p => !p.HasExplicitDefaultValue) <= Syntax.ArgumentList.Arguments.Count);

-                    return Context.ExtractionContext.IsStandalone ?
+                    return Context.ExtractionContext.Mode.HasFlag(ExtractorMode.Standalone) ?
                        candidates.FirstOrDefault() :
                        candidates.SingleOrDefault();
                }
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/NamedType.cs
@@ -166,9 +166,7 @@ namespace Semmle.Extraction.CSharp.Entities
        // Create typerefs for constructed error types in case they are fully defined elsewhere.
        // We cannot use `!this.NeedsPopulation` because this would not be stable as it would depend on
        // the assembly that was being extracted at the time.
-        private bool UsesTypeRef =>
-            Symbol.TypeKind == TypeKind.Error ||
-            SymbolEqualityComparer.Default.Equals(Symbol.OriginalDefinition, Symbol);
+        private bool UsesTypeRef => Symbol.TypeKind == TypeKind.Error || SymbolEqualityComparer.Default.Equals(Symbol.OriginalDefinition, Symbol);

        public override Type TypeRef => UsesTypeRef ? (Type)NamedTypeRef.Create(Context, Symbol) : this;
    }
--- a/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Entities/Types/Type.cs
@@ -25,40 +25,6 @@ namespace Semmle.Extraction.CSharp.Entities
                symbol.ContainingType is not null && ConstructedOrParentIsConstructed(symbol.ContainingType);
        }

-
-        /// <summary>
-        /// A hashset containing the C# contextual keywords that could be confused with types (and typing).
-        ///
-        /// For the list of all contextual keywords, see
-        /// https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/#contextual-keywords
-        /// </summary>
-        private readonly HashSet<string> ContextualKeywordTypes = [
-            "dynamic",
-            "nint",
-            "nuint",
-            "var"
-            ];
-
-        /// <summary>
-        /// Returns true in case we suspect this is a broken type.
-        /// </summary>
-        /// <param name="symbol">Type symbol</param>
-        private bool IsBrokenType(ITypeSymbol symbol)
-        {
-            if (!Context.ExtractionContext.IsStandalone ||
-                !symbol.FromSource() ||
-                symbol.IsAnonymousType)
-            {
-                return false;
-            }
-
-            // (1) public class { ... } is a broken type as it doesn't have a name.
-            // (2) public class var { ... } is an allowed type, but it overrides the `var` keyword for all uses.
-            //     The same goes for other contextual keywords that could be used as type names.
-            //     It is probably a better heuristic to treat these as broken types.
-            return string.IsNullOrEmpty(symbol.Name) || ContextualKeywordTypes.Contains(symbol.Name);
-        }
-
        public Kinds.TypeKind GetTypeKind(Context cx, bool constructUnderlyingTupleType)
        {
            switch (Symbol.SpecialType)
@@ -82,9 +48,6 @@ namespace Semmle.Extraction.CSharp.Entities
                    if (Symbol.IsBoundNullable())
                        return Kinds.TypeKind.NULLABLE;

-                    if (IsBrokenType(Symbol))
-                        return Kinds.TypeKind.UNKNOWN;
-
                    switch (Symbol.TypeKind)
                    {
                        case TypeKind.Class: return Kinds.TypeKind.CLASS;
--- a/csharp/extractor/Semmle.Extraction.CSharp/Extractor/BinaryLogExtractionContext.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Extractor/BinaryLogExtractionContext.cs
@@ -47,7 +47,7 @@ namespace Semmle.Extraction.CSharp

        public static string? GetAdjustedPath(ExtractionContext extractionContext, string sourcePath)
        {
-            if (extractionContext.IsBinaryLog
+            if (extractionContext.Mode.HasFlag(ExtractorMode.BinaryLog)
                && extractionContext is BinaryLogExtractionContext binaryLogExtractionContext
                && binaryLogExtractionContext.GetAdjustedPath(sourcePath) is string adjustedPath)
            {
--- a/csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Extractor/Context.cs
@@ -267,7 +267,7 @@ namespace Semmle.Extraction.CSharp

            bool duplicationGuard, deferred;

-            if (ExtractionContext.IsStandalone)
+            if (ExtractionContext.Mode is ExtractorMode.Standalone)
            {
                duplicationGuard = false;
                deferred = false;
@@ -376,7 +376,7 @@ namespace Semmle.Extraction.CSharp

        private void ReportError(InternalError error)
        {
-            if (!ExtractionContext.IsStandalone)
+            if (!ExtractionContext.Mode.HasFlag(ExtractorMode.Standalone))
                throw error;

            ExtractionError(error);
--- a/csharp/extractor/Semmle.Extraction.CSharp/Extractor/ExtractionContext.cs
+++ b/csharp/extractor/Semmle.Extraction.CSharp/Extractor/ExtractionContext.cs
@@ -15,8 +15,6 @@ namespace Semmle.Extraction.CSharp
        public ExtractorMode Mode { get; }
        public string OutputPath { get; }
        public IEnumerable<CompilationInfo> CompilationInfos { get; }
-        public bool IsStandalone => Mode.HasFlag(ExtractorMode.Standalone);
-        public bool IsBinaryLog => Mode.HasFlag(ExtractorMode.BinaryLog);

        /// <summary>
        /// Creates a new extractor instance for one compilation unit.
--- a/csharp/extractor/Semmle.Extraction.Tests/DotNet.cs
+++ b/csharp/extractor/Semmle.Extraction.Tests/DotNet.cs
@@ -123,7 +123,7 @@ namespace Semmle.Extraction.Tests
            var dotnet = MakeDotnet(dotnetCliInvoker);

            // Execute
-            var res = dotnet.Restore(new("myproject.csproj", "mypackages", false, null, "myconfig.config"));
+            var res = dotnet.Restore(new("myproject.csproj", "mypackages", false, "myconfig.config"));

            // Verify
            var lastArgs = dotnetCliInvoker.GetLastArgs();
@@ -141,7 +141,7 @@ namespace Semmle.Extraction.Tests
            var dotnet = MakeDotnet(dotnetCliInvoker);

            // Execute
-            var res = dotnet.Restore(new("myproject.csproj", "mypackages", false, null, "myconfig.config", true));
+            var res = dotnet.Restore(new("myproject.csproj", "mypackages", false, "myconfig.config", true));

            // Verify
            var lastArgs = dotnetCliInvoker.GetLastArgs();
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 1.7.36
+
+No user-facing changes.
+
+## 1.7.35
+
+No user-facing changes.
+
 ## 1.7.34

 No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.35.md
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.35.md
@@ -0,0 +1,3 @@
+## 1.7.35
+
+No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.36.md
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.36.md
@@ -0,0 +1,3 @@
+## 1.7.36
+
+No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.34
+lastReleaseVersion: 1.7.36
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.35-dev
+version: 1.7.37-dev
 groups:
  - csharp
  - solorigate
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 1.7.36
+
+No user-facing changes.
+
+## 1.7.35
+
+No user-facing changes.
+
 ## 1.7.34

 No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.35.md
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.35.md
@@ -0,0 +1,3 @@
+## 1.7.35
+
+No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.36.md
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.36.md
@@ -0,0 +1,3 @@
+## 1.7.36
+
+No user-facing changes.
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.34
+lastReleaseVersion: 1.7.36
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.35-dev
+version: 1.7.37-dev
 groups:
  - csharp
  - solorigate
--- a/csharp/ql/consistency-queries/SsaConsistency.ql
+++ b/csharp/ql/consistency-queries/SsaConsistency.ql
@@ -3,6 +3,22 @@ import semmle.code.csharp.dataflow.internal.SsaImpl as Impl
 import Impl::Consistency
 import Ssa

+class MyRelevantDefinition extends RelevantDefinition, Ssa::Definition {
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
+class MyRelevantDefinitionExt extends RelevantDefinitionExt, Impl::DefinitionExt {
+  override predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  ) {
+    this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+  }
+}
+
 query predicate localDeclWithSsaDef(LocalVariableDeclExpr d) {
  // Local variables in C# must be initialized before every use, so uninitialized
  // local variables should not have an SSA definition, as that would imply that
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 5.1.2
+
+No user-facing changes.
+
+## 5.1.1
+
+No user-facing changes.
+
 ## 5.1.0

 ### Deprecated APIs
--- a/csharp/ql/lib/change-notes/released/5.1.1.md
+++ b/csharp/ql/lib/change-notes/released/5.1.1.md
@@ -0,0 +1,3 @@
+## 5.1.1
+
+No user-facing changes.
--- a/csharp/ql/lib/change-notes/released/5.1.2.md
+++ b/csharp/ql/lib/change-notes/released/5.1.2.md
@@ -0,0 +1,3 @@
+## 5.1.2
+
+No user-facing changes.
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 5.1.0
+lastReleaseVersion: 5.1.2
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 5.1.1-dev
+version: 5.1.3-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp
--- a/csharp/ql/lib/semmle/code/csharp/Type.qll
+++ b/csharp/ql/lib/semmle/code/csharp/Type.qll
@@ -1214,8 +1214,6 @@ class ArglistType extends Type, @arglist_type {
 class UnknownType extends Type, @unknown_type {
  /** Holds if this is the canonical unknown type, and not a type that failed to extract properly. */
  predicate isCanonical() { types(this, _, "<unknown type>") }
-
-  override string getAPrimaryQlClass() { result = "UnknownType" }
 }

 /**
--- a/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Completion.qll
+++ b/csharp/ql/lib/semmle/code/csharp/controlflow/internal/Completion.qll
@@ -293,8 +293,6 @@ private predicate isMatchingConstant(PatternExpr pe, boolean value) {
  value = true
  or
  exists(Type t, Type strippedType |
-    not t instanceof UnknownType and
-    not strippedType instanceof UnknownType and
    typePatternMustHaveMatchingCompletion(pe, t, strippedType) and
    not typePatternCommonSubType(t, strippedType) and
    value = false
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -456,9 +456,9 @@ module VariableCapture {
    Flow::clearsContent(asClosureNode(node), getCapturedVariableContent(c))
  }

-  class CapturedSsaSourceVariable extends Ssa::SourceVariable {
-    CapturedSsaSourceVariable() {
-      this.getAssignable() = any(CapturedVariable v).asLocalScopeVariable()
+  class CapturedSsaDefinitionExt extends SsaImpl::DefinitionExt {
+    CapturedSsaDefinitionExt() {
+      this.getSourceVariable().getAssignable() = any(CapturedVariable v).asLocalScopeVariable()
    }
  }

@@ -509,12 +509,12 @@ module SsaFlow {
    result.(Impl::ParameterNode).getParameter() = n.(ExplicitParameterNode).getSsaDefinition()
  }

-  predicate localFlowStep(Ssa::SourceVariable v, Node nodeFrom, Node nodeTo, boolean isUseStep) {
-    Impl::localFlowStep(v, asNode(nodeFrom), asNode(nodeTo), isUseStep)
+  predicate localFlowStep(SsaImpl::DefinitionExt def, Node nodeFrom, Node nodeTo, boolean isUseStep) {
+    Impl::localFlowStep(def, asNode(nodeFrom), asNode(nodeTo), isUseStep)
  }

-  predicate localMustFlowStep(Ssa::SourceVariable v, Node nodeFrom, Node nodeTo) {
-    Impl::localMustFlowStep(v, asNode(nodeFrom), asNode(nodeTo))
+  predicate localMustFlowStep(SsaImpl::DefinitionExt def, Node nodeFrom, Node nodeTo) {
+    Impl::localMustFlowStep(def, asNode(nodeFrom), asNode(nodeTo))
  }
 }

@@ -644,10 +644,12 @@ module LocalFlow {
  }

  /**
-   * Holds if the source variable `v` is an instance field.
+   * Holds if the source variable of SSA definition `def` is an instance field.
   */
-  predicate isInstanceField(Ssa::SourceVariables::FieldOrPropSourceVariable v) {
-    not v.getAssignable().(Modifiable).isStatic()
+  predicate usesInstanceField(SsaImpl::DefinitionExt def) {
+    exists(Ssa::SourceVariables::FieldOrPropSourceVariable fp | fp = def.getSourceVariable() |
+      not fp.getAssignable().(Modifiable).isStatic()
+    )
  }

  predicate localFlowStepCommon(Node nodeFrom, Node nodeTo) {
@@ -747,10 +749,10 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo, string model) {
  (
    LocalFlow::localFlowStepCommon(nodeFrom, nodeTo)
    or
-    exists(Ssa::SourceVariable v, boolean isUseStep |
-      SsaFlow::localFlowStep(v, nodeFrom, nodeTo, isUseStep) and
-      not LocalFlow::isInstanceField(v) and
-      not v instanceof VariableCapture::CapturedSsaSourceVariable
+    exists(SsaImpl::DefinitionExt def, boolean isUseStep |
+      SsaFlow::localFlowStep(def, nodeFrom, nodeTo, isUseStep) and
+      not LocalFlow::usesInstanceField(def) and
+      not def instanceof VariableCapture::CapturedSsaDefinitionExt
    |
      isUseStep = false
      or
@@ -3005,13 +3007,13 @@ private predicate delegateCreationStep(Node nodeFrom, Node nodeTo) {

 /** Extra data-flow steps needed for lambda flow analysis. */
 predicate additionalLambdaFlowStep(Node nodeFrom, Node nodeTo, boolean preservesValue) {
-  exists(Ssa::SourceVariable v |
-    SsaFlow::localFlowStep(v, nodeFrom, nodeTo, _) and
+  exists(SsaImpl::DefinitionExt def |
+    SsaFlow::localFlowStep(def, nodeFrom, nodeTo, _) and
    preservesValue = true
  |
-    LocalFlow::isInstanceField(v)
+    LocalFlow::usesInstanceField(def)
    or
-    v instanceof VariableCapture::CapturedSsaSourceVariable
+    def instanceof VariableCapture::CapturedSsaDefinitionExt
  )
  or
  delegateCreationStep(nodeFrom, nodeTo) and
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/SsaImpl.qll
@@ -60,6 +60,12 @@ class PhiNode = Impl::PhiNode;

 module Consistency = Impl::Consistency;

+module ExposedForTestingOnly {
+  predicate ssaDefReachesReadExt = Impl::ssaDefReachesReadExt/4;
+
+  predicate phiHasInputFromBlockExt = Impl::phiHasInputFromBlockExt/3;
+}
+
 /**
 * Holds if the `i`th node of basic block `bb` reads source variable `v`.
 */
@@ -961,13 +967,13 @@ private module Cached {
    import DataFlowIntegrationImpl

    cached
-    predicate localFlowStep(Ssa::SourceVariable v, Node nodeFrom, Node nodeTo, boolean isUseStep) {
-      DataFlowIntegrationImpl::localFlowStep(v, nodeFrom, nodeTo, isUseStep)
+    predicate localFlowStep(DefinitionExt def, Node nodeFrom, Node nodeTo, boolean isUseStep) {
+      DataFlowIntegrationImpl::localFlowStep(def, nodeFrom, nodeTo, isUseStep)
    }

    cached
-    predicate localMustFlowStep(Ssa::SourceVariable v, Node nodeFrom, Node nodeTo) {
-      DataFlowIntegrationImpl::localMustFlowStep(v, nodeFrom, nodeTo)
+    predicate localMustFlowStep(DefinitionExt def, Node nodeFrom, Node nodeTo) {
+      DataFlowIntegrationImpl::localMustFlowStep(def, nodeFrom, nodeTo)
    }

    signature predicate guardChecksSig(Guards::Guard g, Expr e, Guards::AbstractValue v);
@@ -994,9 +1000,9 @@ private module Cached {

 import Cached

-private string getSplitString(Definition def) {
+private string getSplitString(DefinitionExt def) {
  exists(ControlFlow::BasicBlock bb, int i, ControlFlow::Node cfn |
-    def.definesAt(_, bb, i) and
+    def.definesAt(_, bb, i, _) and
    result = cfn.(ControlFlow::Nodes::ElementNode).getSplitsString()
  |
    cfn = bb.getNode(i)
@@ -1006,13 +1012,48 @@ private string getSplitString(Definition def) {
  )
 }

-string getToStringPrefix(Definition def) {
+string getToStringPrefix(DefinitionExt def) {
  result = "[" + getSplitString(def) + "] "
  or
  not exists(getSplitString(def)) and
  result = ""
 }

+/**
+ * An extended static single assignment (SSA) definition.
+ *
+ * This is either a normal SSA definition (`Definition`) or a
+ * phi-read node (`PhiReadNode`).
+ *
+ * Only intended for internal use.
+ */
+class DefinitionExt extends Impl::DefinitionExt {
+  override string toString() { result = this.(Ssa::Definition).toString() }
+
+  /** Gets the location of this definition. */
+  override Location getLocation() { result = this.(Ssa::Definition).getLocation() }
+
+  /** Gets the enclosing callable of this definition. */
+  Callable getEnclosingCallable() { result = this.(Ssa::Definition).getEnclosingCallable() }
+}
+
+/**
+ * A phi-read node.
+ *
+ * Only intended for internal use.
+ */
+class PhiReadNode extends DefinitionExt, Impl::PhiReadNode {
+  override string toString() {
+    result = getToStringPrefix(this) + "SSA phi read(" + this.getSourceVariable() + ")"
+  }
+
+  override Location getLocation() { result = this.getBasicBlock().getLocation() }
+
+  override Callable getEnclosingCallable() {
+    result = this.getSourceVariable().getEnclosingCallable()
+  }
+}
+
 private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInputSig {
  private import csharp as Cs
  private import semmle.code.csharp.controlflow.BasicBlocks
@@ -1047,17 +1088,8 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
  }

  class Guard extends Guards::Guard {
-    /**
-     * Holds if the control flow branching from `bb1` is dependent on this guard,
-     * and that the edge from `bb1` to `bb2` corresponds to the evaluation of this
-     * guard to `branch`.
-     */
-    predicate controlsBranchEdge(BasicBlock bb1, BasicBlock bb2, boolean branch) {
-      exists(ControlFlow::SuccessorTypes::ConditionalSuccessor s |
-        this.getAControlFlowNode() = bb1.getLastNode() and
-        bb2 = bb1.getASuccessorByType(s) and
-        s.getValue() = branch
-      )
+    predicate hasCfgNode(ControlFlow::BasicBlock bb, int i) {
+      this.getAControlFlowNode() = bb.getNode(i)
    }
  }

@@ -1069,6 +1101,16 @@ private module DataFlowIntegrationInput implements Impl::DataFlowIntegrationInpu
      conditionBlock.edgeDominates(bb, s)
    )
  }
+
+  /** Gets an immediate conditional successor of basic block `bb`, if any. */
+  ControlFlow::BasicBlock getAConditionalBasicBlockSuccessor(
+    ControlFlow::BasicBlock bb, boolean branch
+  ) {
+    exists(ControlFlow::SuccessorTypes::ConditionalSuccessor s |
+      result = bb.getASuccessorByType(s) and
+      s.getValue() = branch
+    )
+  }
 }

 private module DataFlowIntegrationImpl = Impl::DataFlowIntegration<DataFlowIntegrationInput>;
--- a/Abuse/NoDisposeCallOnLocalIDisposable.ql
+++ b/Abuse/NoDisposeCallOnLocalIDisposable.ql
@@ -16,7 +16,6 @@
 import csharp
 import Dispose
 import semmle.code.csharp.frameworks.System
-import semmle.code.csharp.frameworks.system.threading.Tasks
 import semmle.code.csharp.commons.Disposal

 private class ReturnNode extends DataFlow::ExprNode {
@@ -25,27 +24,15 @@ private class ReturnNode extends DataFlow::ExprNode {
  }
 }

-private class Task extends Type {
-  Task() {
-    this instanceof SystemThreadingTasksTaskClass or
-    this instanceof SystemThreadingTasksTaskTClass
-  }
-}
-
 module DisposeCallOnLocalIDisposableConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node node) {
-    exists(LocalScopeDisposableCreation disposable, Type t |
-      node.asExpr() = disposable and
-      t = disposable.getType()
-    |
-      // Only care about library types - user types often have spurious IDisposable declarations
-      t.fromLibrary() and
-      // WebControls are usually disposed automatically
-      not t instanceof WebControl and
-      // It is typically not nessesary to dispose tasks
-      // https://devblogs.microsoft.com/pfxteam/do-i-need-to-dispose-of-tasks/
-      not t instanceof Task
-    )
+    node.asExpr() =
+      any(LocalScopeDisposableCreation disposable |
+        // Only care about library types - user types often have spurious IDisposable declarations
+        disposable.getType().fromLibrary() and
+        // WebControls are usually disposed automatically
+        not disposable.getType() instanceof WebControl
+      )
  }

  predicate isSink(DataFlow::Node node) {
--- a/Practices/Control-Flow/ConstantCondition.ql
+++ b/Practices/Control-Flow/ConstantCondition.ql
@@ -119,14 +119,9 @@ class ConstantMatchingCondition extends ConstantCondition {
  }

  override predicate isWhiteListed() {
-    exists(Switch se, Case c, int i |
-      c = se.getCase(i) and
-      c.getPattern() = this.(DiscardExpr)
-    |
+    exists(SwitchExpr se, int i |
+      se.getCase(i).getPattern() = this.(DiscardExpr) and
      i > 0
-      or
-      i = 0 and
-      exists(Expr cond | c.getCondition() = cond and not isConstantCondition(cond, true))
    )
    or
    this = any(PositionalPatternExpr ppe).getPattern(_)
--- a/Practices/PathCombine.qhelp
+++ b/Practices/PathCombine.qhelp
@@ -1,18 +0,0 @@
-<!DOCTYPE qhelp PUBLIC
-  "-//Semmle//qhelp//EN"
-  "qhelp.dtd">
-<qhelp>
-<overview>
-<p><code>Path.Combine</code> may silently drop its earlier arguments if its later arguments are absolute paths. E.g. <code>Path.Combine("C:\\Users\\Me\\Documents", "C:\\Program Files\\") == "C:\\Program Files"</code>.</p>
-
-</overview>
-<recommendation>
-<p>Use <code>Path.Join</code> instead.</p>
-</recommendation>
-<references>
-
-  <li>Microsoft Learn, .NET API browser, <a href="https://learn.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-9.0">Path.Combine</a>.</li>
-  <li>Microsoft Learn, .NET API browser, <a href="https://learn.microsoft.com/en-us/dotnet/api/system.io.path.join?view=net-9.0">Path.Join</a>.</li>
-
-</references>
-</qhelp>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Paolo Tranquilli	9dc9f79172	Merge pull request #19110 from github/redsun82/rust-fix-rc.17 Rust: accept test changes for now	2025-03-25 17:54:47 +01:00
Paolo Tranquilli	3d405f6d61	Rust: accept test changes for now	2025-03-25 12:44:22 +01:00
Chris Smowton	36869efeb5	Merge pull request #19043 from github/post-release-prep/codeql-cli-2.20.7 Post-release preparation for codeql-cli-2.20.7	2025-03-17 15:32:23 +00:00
github-actions[bot]	51cdeefafb	Post-release preparation for codeql-cli-2.20.7	2025-03-17 13:00:41 +00:00
Chris Smowton	0ac0dad49d	Merge pull request #19042 from github/release-prep/2.20.7 Release preparation for version 2.20.7	2025-03-17 12:21:27 +00:00
github-actions[bot]	2d64a618e6	Release preparation for version 2.20.7	2025-03-17 12:15:54 +00:00
Aditya Sharad	52dac47d68	Merge pull request #18953 from github/jonjanego-patch-1-more-escaping Update codeql-cli-2.20.4.rst	2025-03-07 23:01:18 +05:30
Jon Janego	b9ec58ba73	Update codeql-cli-2.20.4.rst	2025-03-07 09:27:47 -06:00
Florin Coada	c93f671f7b	Merge pull request #18951 from github/coadaflorin-patch-for-escaping Update codeql-cli-2.20.4.rst	2025-03-07 15:24:02 +00:00
Florin Coada	7564255542	Update codeql-cli-2.20.4.rst	2025-03-07 15:16:52 +00:00
Jon Janego	468c12e656	Merge pull request #18944 from github/changedocs-2.20.6 Changedocs for 2.20.6	2025-03-06 17:31:59 -06:00
Jon Janego	b742ed21db	Merge branch 'rc/3.17' into changedocs-2.20.6	2025-03-06 16:51:25 -06:00
Jon Janego	65d5e527c0	Apply suggestions from code review Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>	2025-03-06 16:46:57 -06:00
Jon Janego	da7b9b7c20	rearranging golang 1.24 support	2025-03-06 15:32:48 -06:00
Jon Janego	3652a45a97	Update codeql-cli-2.20.4.rst	2025-03-06 15:10:42 -06:00
Jon Janego	1385de223f	Update codeql-cli-2.20.4.rst	2025-03-06 15:10:11 -06:00
Jon Janego	2b818e3a4f	Update codeql-cli-2.19.4.rst	2025-03-06 15:04:55 -06:00
Jon Janego	fc6794f6df	adding 2.20.6 sitedocs	2025-03-06 14:12:54 -06:00
Michael B. Gale	16e84d0ad0	Merge pull request #18929 from github/mbg/go/filter-more-vendor-dirs Go: Support more dependency managers in `IsGolangVendorDirectory`	2025-03-06 16:10:18 +00:00
Michael B. Gale	b872c60e1c	Go: Support more dependency managers in `IsGolangVendorDirectory`	2025-03-06 15:40:44 +00:00
Chuan-kai Lin	c7dc8a364c	Merge pull request #18925 from github/mergeback-2.20.6 Mergeback codeql-cli-2.20.6 to rc/3.17	2025-03-04 08:36:09 -08:00
Chuan-kai Lin	dbffe91a20	Merge pull request #18917 from github/smowton/admin/jdk-24-2.20.6 Update supported Java version	2025-03-04 07:10:10 -08:00
Chris Smowton	fba47877c7	Update supported Java version	2025-03-04 10:06:20 +00:00
Chuan-kai Lin	df42ff6253	Merge pull request #18912 from github/post-release-prep/codeql-cli-2.20.6 Post-release preparation for codeql-cli-2.20.6	2025-03-03 12:45:35 -08:00
github-actions[bot]	58f355ae5a	Post-release preparation for codeql-cli-2.20.6	2025-03-03 18:18:15 +00:00
Chuan-kai Lin	c1dca1038a	Merge pull request #18911 from github/release-prep/2.20.6 Release preparation for version 2.20.6	2025-03-03 09:22:19 -08:00
Chuan-kai Lin	17acb31f65	JS: Fix changelog formatting	2025-03-03 09:19:01 -08:00
github-actions[bot]	fa850cccb1	Release preparation for version 2.20.6	2025-03-03 17:13:19 +00:00