Add change note for instance-attribute type-tracking performance fix

This reverts commit f251a572e1.

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.39-dev
+version: 0.4.38
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.31-dev
+version: 0.6.30
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 11.0.1-dev
+version: 11.0.0
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.6.6-dev
+version: 1.6.5
 groups:
   - cpp
   - queries

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.70-dev
+version: 1.7.69
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.70-dev
+version: 1.7.69
 groups:
   - csharp
   - solorigate

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 7.0.1-dev
+version: 7.0.0
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.7.6-dev
+version: 1.7.5
 groups:
   - csharp
   - queries

go/extractor/go.mod

@@ -10,7 +10,7 @@ toolchain go1.26.4
 //    bazel mod tidy
 require (
 	golang.org/x/mod v0.37.0
-	golang.org/x/tools v0.47.0
+	golang.org/x/tools v0.46.0
 )
 
 require github.com/stretchr/testify v1.11.1

go/extractor/go.sum

@@ -10,8 +10,8 @@ golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
 golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

go/ql/consistency-queries/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.53-dev
+version: 1.0.52
 groups:
   - go
   - queries

go/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 7.2.1-dev
+version: 7.2.0
 groups: go
 dbscheme: go.dbscheme
 extractor: go

go/ql/lib/semmle/go/security/StoredXssCustomizations.qll

@@ -33,11 +33,9 @@ module StoredXss {
         walkFn.getACall().getArgument(1) = f.getASuccessor*()
       )
       or
-      // The return value of a call to `os.DirEntry.Name`, `os.FileInfo.Name`
+      // A call to os.FileInfo.Name
-      // or `os.File.ReadDirNames`.
+      exists(Method m | m.implements("io/fs", "FileInfo", "Name") |
-      exists(DataFlow::CallNode cn, Method m | m = cn.getTarget() and this = cn.getResult(0) |
+        m = this.(DataFlow::CallNode).getTarget()
-        m.implements("io/fs", ["DirEntry", "FileInfo"], "Name") or
-        m.hasQualifiedName("os", "File", "ReadDirNames")
       )
     }
   }

go/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.6.6-dev
+version: 1.6.5
 groups:
   - go
   - queries

go/ql/test/query-tests/Security/CWE-079/ReflectedXss.expected

@@ -156,3 +156,12 @@ nodes
 | websocketXss.go:54:3:54:38 | ... := ...[1] | semmle.label | ... := ...[1] |
 | websocketXss.go:55:24:55:31 | gorilla3 | semmle.label | gorilla3 |
 subpaths
+testFailures
+| websocketXss.go:30:32:30:60 | comment | Missing result: Source[go/reflected-xss] |
+| websocketXss.go:31:11:31:14 | xnet [postupdate] | Unexpected result: Source |
+| websocketXss.go:34:30:34:58 | comment | Missing result: Source[go/reflected-xss] |
+| websocketXss.go:35:21:35:25 | xnet2 [postupdate] | Unexpected result: Source |
+| websocketXss.go:46:38:46:66 | comment | Missing result: Source[go/reflected-xss] |
+| websocketXss.go:47:26:47:35 | gorillaMsg [postupdate] | Unexpected result: Source |
+| websocketXss.go:50:33:50:61 | comment | Missing result: Source[go/reflected-xss] |
+| websocketXss.go:51:17:51:24 | gorilla2 [postupdate] | Unexpected result: Source |

go/ql/test/query-tests/Security/CWE-079/StoredXss.expected

@@ -1,9 +1,7 @@
 #select
-| StoredXss.go:13:21:13:36 | ...+... | StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | Stored cross-site scripting vulnerability due to $@. | StoredXss.go:13:21:13:31 | call to Name | stored value |
 | stored.go:30:22:30:25 | name | stored.go:18:3:18:28 | ... := ...[0] | stored.go:30:22:30:25 | name | Stored cross-site scripting vulnerability due to $@. | stored.go:18:3:18:28 | ... := ...[0] | stored value |
 | stored.go:61:22:61:25 | path | stored.go:59:30:59:33 | SSA def(path) | stored.go:61:22:61:25 | path | Stored cross-site scripting vulnerability due to $@. | stored.go:59:30:59:33 | SSA def(path) | stored value |
 edges
-| StoredXss.go:13:21:13:31 | call to Name | StoredXss.go:13:21:13:36 | ...+... | provenance |  |
 | stored.go:18:3:18:28 | ... := ...[0] | stored.go:25:14:25:17 | rows | provenance | Src:MaD:1  |
 | stored.go:25:14:25:17 | rows | stored.go:25:29:25:33 | &... [postupdate] | provenance | FunctionModel |
 | stored.go:25:29:25:33 | &... [postupdate] | stored.go:30:22:30:25 | name | provenance |  |
@@ -11,8 +9,6 @@ edges
 models
 | 1 | Source: database/sql; DB; true; Query; ; ; ReturnValue[0]; database; manual |
 nodes
-| StoredXss.go:13:21:13:31 | call to Name | semmle.label | call to Name |
-| StoredXss.go:13:21:13:36 | ...+... | semmle.label | ...+... |
 | stored.go:18:3:18:28 | ... := ...[0] | semmle.label | ... := ...[0] |
 | stored.go:25:14:25:17 | rows | semmle.label | rows |
 | stored.go:25:29:25:33 | &... [postupdate] | semmle.label | &... [postupdate] |
@@ -20,3 +16,5 @@ nodes
 | stored.go:59:30:59:33 | SSA def(path) | semmle.label | SSA def(path) |
 | stored.go:61:22:61:25 | path | semmle.label | path |
 subpaths
+testFailures
+| StoredXss.go:13:39:13:63 | comment | Missing result: Alert[go/stored-xss] |

go/ql/test/query-tests/Security/CWE-079/websocketXss.go

@@ -27,12 +27,12 @@ func xss(w http.ResponseWriter, r *http.Request) {
 	origin := "test"
 	{
 		ws, _ := websocket.Dial(uri, "", origin)
-		var xnet = make([]byte, 512)
+		var xnet = make([]byte, 512) // $ Source[go/reflected-xss]
-		ws.Read(xnet)              // $ Source[go/reflected-xss]
+		ws.Read(xnet)
 		fmt.Fprintf(w, "%v", xnet) // $ Alert[go/reflected-xss]
 		codec := &websocket.Codec{Marshal: marshal, Unmarshal: unmarshal}
-		xnet2 := make([]byte, 512)
+		xnet2 := make([]byte, 512) // $ Source[go/reflected-xss]
-		codec.Receive(ws, xnet2)    // $ Source[go/reflected-xss]
+		codec.Receive(ws, xnet2)
 		fmt.Fprintf(w, "%v", xnet2) // $ Alert[go/reflected-xss]
 	}
 	{
@@ -43,12 +43,12 @@ func xss(w http.ResponseWriter, r *http.Request) {
 	{
 		dialer := gorilla.Dialer{}
 		conn, _, _ := dialer.Dial(uri, nil)
-		var gorillaMsg = make([]byte, 512)
+		var gorillaMsg = make([]byte, 512) // $ Source[go/reflected-xss]
-		gorilla.ReadJSON(conn, gorillaMsg) // $ Source[go/reflected-xss]
+		gorilla.ReadJSON(conn, gorillaMsg)
 		fmt.Fprintf(w, "%v", gorillaMsg) // $ Alert[go/reflected-xss]
 
-		gorilla2 := make([]byte, 512)
+		gorilla2 := make([]byte, 512) // $ Source[go/reflected-xss]
-		conn.ReadJSON(gorilla2)        // $ Source[go/reflected-xss]
+		conn.ReadJSON(gorilla2)
 		fmt.Fprintf(w, "%v", gorilla2) // $ Alert[go/reflected-xss]
 
 		_, gorilla3, _ := conn.ReadMessage() // $ Source[go/reflected-xss]

java/ql/integration-tests/java/android-8-sample/settings.gradle

@@ -14,9 +14,7 @@ pluginManagement {
     repositories {
         gradlePluginPortal()
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 dependencyResolutionManagement {
@@ -35,9 +33,7 @@ dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 rootProject.name = "Android Sample"

java/ql/integration-tests/java/android-sample-kotlin-build-script-no-wrapper/settings.gradle.kts

@@ -14,9 +14,7 @@ pluginManagement {
     repositories {
         gradlePluginPortal()
         google()
-        maven {
+        mavenCentral()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 }
 dependencyResolutionManagement {
@@ -35,9 +33,7 @@ dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
         google()
-        maven {
+        mavenCentral()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 }
 rootProject.name = "Android Sample"

java/ql/integration-tests/java/android-sample-kotlin-build-script/settings.gradle.kts

@@ -14,9 +14,7 @@ pluginManagement {
     repositories {
         gradlePluginPortal()
         google()
-        maven {
+        mavenCentral()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 }
 dependencyResolutionManagement {
@@ -35,9 +33,7 @@ dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
         google()
-        maven {
+        mavenCentral()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 }
 rootProject.name = "Android Sample"

java/ql/integration-tests/java/android-sample-no-wrapper/settings.gradle

@@ -14,9 +14,7 @@ pluginManagement {
     repositories {
         gradlePluginPortal()
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 dependencyResolutionManagement {
@@ -35,9 +33,7 @@ dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 rootProject.name = "Android Sample"

java/ql/integration-tests/java/android-sample-old-style-kotlin-build-script-no-wrapper/build.gradle.kts

@@ -13,9 +13,7 @@ buildscript {
 
     repositories {
         google()
-        maven {
+        jcenter()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 
     /**
@@ -41,8 +39,6 @@ buildscript {
 allprojects {
     repositories {
         google()
-        maven {
+        jcenter()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 }

java/ql/integration-tests/java/android-sample-old-style-kotlin-build-script/build.gradle.kts

@@ -13,9 +13,7 @@ buildscript {
 
     repositories {
         google()
-        maven {
+        jcenter()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 
     /**
@@ -41,8 +39,6 @@ buildscript {
 allprojects {
     repositories {
         google()
-        maven {
+        jcenter()
-            url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
-        }
     }
 }

java/ql/integration-tests/java/android-sample-old-style-no-wrapper/build.gradle

@@ -13,9 +13,7 @@ buildscript {
 
     repositories {
         google()
-        maven {
+        jcenter()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 
     /**
@@ -41,8 +39,6 @@ buildscript {
 allprojects {
     repositories {
         google()
-        maven {
+        jcenter()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }

java/ql/integration-tests/java/android-sample-old-style/build.gradle

@@ -13,9 +13,7 @@ buildscript {
 
     repositories {
         google()
-        maven {
+        jcenter()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 
     /**
@@ -34,15 +32,13 @@ buildscript {
  * dependencies used by all modules in your project, such as third-party plugins
  * or libraries. However, you should configure module-specific dependencies in
  * each module-level build.gradle file. For new projects, Android Studio
- * includes Maven Central and Google's Maven repository by default, but it does not
+ * includes JCenter and Google's Maven repository by default, but it does not
  * configure any dependencies (unless you select a template that requires some).
  */
 
 allprojects {
     repositories {
         google()
-        maven {
+        jcenter()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }

java/ql/integration-tests/java/android-sample/settings.gradle

@@ -14,9 +14,7 @@ pluginManagement {
     repositories {
         gradlePluginPortal()
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 dependencyResolutionManagement {
@@ -35,9 +33,7 @@ dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 rootProject.name = "Android Sample"

java/ql/integration-tests/java/buildless-gradle-boms/build.gradle

@@ -8,9 +8,7 @@
 apply plugin: 'java-library'
 
 repositories {
-  maven {
+  mavenCentral()
-    url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-  }
 }
 
 dependencies {

java/ql/integration-tests/java/buildless-gradle-boms/buildless-fetches.expected

@@ -1,5 +1,5 @@
-https://maven-central.storage-download.googleapis.com/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar
+https://repo.maven.apache.org/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/apiguardian/apiguardian-api/1.1.2/apiguardian-api-1.1.2.jar
+https://repo.maven.apache.org/maven2/org/apiguardian/apiguardian-api/1.1.2/apiguardian-api-1.1.2.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/junit/jupiter/junit-jupiter-api/5.12.1/junit-jupiter-api-5.12.1.jar
+https://repo.maven.apache.org/maven2/org/junit/jupiter/junit-jupiter-api/5.12.1/junit-jupiter-api-5.12.1.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/junit/platform/junit-platform-commons/1.12.1/junit-platform-commons-1.12.1.jar
+https://repo.maven.apache.org/maven2/org/junit/platform/junit-platform-commons/1.12.1/junit-platform-commons-1.12.1.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/opentest4j/opentest4j/1.3.0/opentest4j-1.3.0.jar
+https://repo.maven.apache.org/maven2/org/opentest4j/opentest4j/1.3.0/opentest4j-1.3.0.jar

java/ql/integration-tests/java/buildless-gradle-classifiers/build.gradle

@@ -8,9 +8,7 @@
 apply plugin: 'java-library'
 
 repositories {
-  maven {
+  mavenCentral()
-    url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-  }
 }
 
 dependencies {

java/ql/integration-tests/java/buildless-gradle-classifiers/buildless-fetches.expected

@@ -1,2 +1,2 @@
-https://maven-central.storage-download.googleapis.com/maven2/joda-time/joda-time/2.12.7/joda-time-2.12.7-no-tzdb.jar
+https://repo.maven.apache.org/maven2/joda-time/joda-time/2.12.7/joda-time-2.12.7-no-tzdb.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar
+https://repo.maven.apache.org/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar

java/ql/integration-tests/java/buildless-gradle-timeout/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/buildless-gradle/build.gradle

@@ -8,9 +8,7 @@
 apply plugin: 'java-library'
 
 repositories {
-  maven {
+  mavenCentral()
-    url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-  }
 }
 
 dependencies {

java/ql/integration-tests/java/buildless-gradle/buildless-fetches.expected

@@ -1 +1 @@
-https://maven-central.storage-download.googleapis.com/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar
+https://repo.maven.apache.org/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar

java/ql/integration-tests/java/buildless-proxy-gradle/build.gradle

@@ -8,9 +8,7 @@
 apply plugin: 'java-library'
 
 repositories {
-  maven {
+  mavenCentral()
-    url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-  }
 }
 
 dependencies {

java/ql/integration-tests/java/buildless-proxy-gradle/buildless-fetches.expected

@@ -1 +1 @@
-https://maven-central.storage-download.googleapis.com/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar
+https://repo.maven.apache.org/maven2/org/apache/commons/commons-math3/3.6.1/commons-math3-3.6.1.jar

java/ql/integration-tests/java/buildless-sibling-projects/buildless-fetches.expected

@@ -1,7 +1,6 @@
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.11/junit-4.11.jar
+https://jcenter.bintray.com/junit/junit/4.12/junit-4.12.jar
-https://maven-central.storage-download.googleapis.com/maven2/junit/junit/4.12/junit-4.12.jar
+https://jcenter.bintray.com/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar
+https://jcenter.bintray.com/org/slf4j/slf4j-api/1.7.21/slf4j-api-1.7.21.jar
-https://maven-central.storage-download.googleapis.com/maven2/org/slf4j/slf4j-api/1.7.21/slf4j-api-1.7.21.jar
 https://repo.maven.apache.org/maven2/com/feiniaojin/naaf/naaf-graceful-response-example/1.0/naaf-graceful-response-example-1.0.jar
 https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/avro-registry-in-source-tests/1.8/avro-registry-in-source-tests-1.8.jar
 https://repo.maven.apache.org/maven2/com/github/MoebiusSolutions/avro-registry-in-source/example-project/1.5/example-project-1.5.jar
@@ -13,6 +12,7 @@ https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-example_2.11/0.1.2/r
 https://repo.maven.apache.org/maven2/de/knutwalker/rx-redis-java-example_2.11/0.1.2/rx-redis-java-example_2.11-0.1.2.jar
 https://repo.maven.apache.org/maven2/io/github/scrollsyou/example-spring-boot-starter/1.0.0/example-spring-boot-starter-1.0.0.jar
 https://repo.maven.apache.org/maven2/io/streamnative/com/example/maven-central-template/server/3.0.0/server-3.0.0.jar
+https://repo.maven.apache.org/maven2/junit/junit/4.11/junit-4.11.jar
 https://repo.maven.apache.org/maven2/no/nav/security/token-validation-ktor-demo/3.1.0/token-validation-ktor-demo-3.1.0.jar
 https://repo.maven.apache.org/maven2/org/minijax/minijax-example-fileupload/0.5.10/minijax-example-fileupload-0.5.10.jar
 https://repo.maven.apache.org/maven2/org/minijax/minijax-example-inject/0.5.10/minijax-example-inject-0.5.10.jar

java/ql/integration-tests/java/buildless-sibling-projects/gradle-sample/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/buildless-sibling-projects/gradle-sample2/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/buildless-sibling-projects/settings.xml

@@ -1,10 +0,0 @@
-<settings>
-  <mirrors>
-    <mirror>
-      <id>google-maven-central</id>
-      <name>GCS Maven Central mirror</name>
-      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
-      <mirrorOf>central</mirrorOf>
-    </mirror>
-  </mirrors>
-</settings>

java/ql/integration-tests/java/buildless-sibling-projects/source_archive.expected

@@ -26,5 +26,4 @@ maven-project-2/src/main/resources/my-app.properties
 maven-project-2/src/main/resources/page.xml
 maven-project-2/src/main/resources/struts.xml
 maven-project-2/src/test/java/com/example/AppTest4.java
-settings.xml
 test-db/working/settings.xml

java/ql/integration-tests/java/buildless-sibling-projects/test.py

@@ -1,5 +1,3 @@
-import os
-
 def test(codeql, use_java_11, java, actions_toolchains_file, check_diagnostics_java):
     # The version of gradle used doesn't work on java 17
     codeql.database.create(
@@ -7,6 +5,5 @@ def test(codeql, use_java_11, java, actions_toolchains_file, check_diagnostics_j
             "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS": "true",
             "CODEQL_EXTRACTOR_JAVA_OPTION_BUILDLESS_CLASSPATH_FROM_BUILD_FILES": "true",
             "LGTM_INDEX_MAVEN_TOOLCHAINS_FILE": str(actions_toolchains_file),
-            "LGTM_INDEX_MAVEN_SETTINGS_FILE": os.path.join(os.path.dirname(os.path.realpath(__file__)), "settings.xml"),
         }
     )

java/ql/integration-tests/java/diagnostics/android-gradle-incompatibility/settings.gradle

@@ -14,9 +14,7 @@ pluginManagement {
     repositories {
         gradlePluginPortal()
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 dependencyResolutionManagement {
@@ -35,9 +33,7 @@ dependencyResolutionManagement {
     repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
     repositories {
         google()
-        maven {
+        mavenCentral()
-            url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-        }
     }
 }
 rootProject.name = "Android Sample"

java/ql/integration-tests/java/diagnostics/java-version-too-old/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/diagnostics/no-gradle-wrapper/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/gradle-sample-kotlin-script/app/build.gradle.kts

@@ -12,9 +12,8 @@ plugins {
 }
 
 repositories {
-    maven {
+    // Use Maven Central for resolving dependencies.
-        url = uri("https://maven-central.storage-download.googleapis.com/maven2/")
+    mavenCentral()
-    }
 }
 
 dependencies {

java/ql/integration-tests/java/gradle-sample-without-wrapper-or-gradle-buildless/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/gradle-sample/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/partial-gradle-sample-without-gradle/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/partial-gradle-sample/build.gradle

@@ -12,9 +12,9 @@ apply plugin: 'java'
 
 // In this section you declare where to find the dependencies of your project
 repositories {
-    maven {
+    // Use 'jcenter' for resolving your dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    // You can declare any Maven/Ivy/file repository here.
-    }
+    jcenter()
 }
 
 // In this section you declare the dependencies for your production and test code

java/ql/integration-tests/java/spring-boot-sample/build.gradle

@@ -11,9 +11,7 @@ version = '0.0.1-SNAPSHOT'
 // but I omit it to test we recognise the Spring Boot plugin version.
 
 repositories {
-	maven {
+	mavenCentral()
-		url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-	}
 }
 
 dependencies {

java/ql/integration-tests/kotlin/all-platforms/compiler_arguments/app/build.gradle

@@ -15,9 +15,8 @@ plugins {
 }
 
 repositories {
-    maven {
+    // Use Maven Central for resolving dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    mavenCentral()
-    }
 }
 
 application {

java/ql/integration-tests/kotlin/all-platforms/gradle_groovy_app/app/build.gradle

@@ -15,9 +15,8 @@ plugins {
 }
 
 repositories {
-    maven {
+    // Use Maven Central for resolving dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    mavenCentral()
-    }
 }
 
 application {

java/ql/integration-tests/kotlin/all-platforms/gradle_kotlinx_serialization/app/build.gradle

@@ -4,9 +4,7 @@ plugins {
 }
 
 repositories {
-    maven {
+    mavenCentral()
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
-    }
 }
 
 dependencies {

java/ql/integration-tests/kotlin/all-platforms/kotlin_kfunction/app/build.gradle

@@ -15,9 +15,8 @@ plugins {
 }
 
 repositories {
-    maven {
+    // Use Maven Central for resolving dependencies.
-        url = 'https://maven-central.storage-download.googleapis.com/maven2/'
+    mavenCentral()
-    }
 }
 
 application {

java/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 9.2.1-dev
+version: 9.2.0
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

java/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 1.11.6-dev
+version: 1.11.5
 groups:
   - java
   - queries

javascript/ql/lib/change-notes/2026-06-22-angular-hostlistener-postmessage.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added support for Angular's `@HostListener('window:message', ...)` and `@HostListener('document:message', ...)` decorators as `postMessage` event handlers. The decorated method's event parameter is now recognized as a client-side remote flow source, and is considered by the `js/missing-origin-check` query.

javascript/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-all
-version: 2.8.1-dev
+version: 2.8.0
 groups: javascript
 dbscheme: semmlecode.javascript.dbscheme
 extractor: javascript

javascript/ql/lib/semmle/javascript/security/dataflow/DOM.qll

@@ -195,18 +195,6 @@ class PostMessageEventHandler extends Function {
       rhs = DataFlow::globalObjectRef().getAPropertyWrite("onmessage").getRhs() and
       rhs.getABoundFunctionValue(paramIndex).getFunction() = this
     )
-    or
-    // Angular's `@HostListener('window:message', ['$event'])` decorator registers
-    // a method as a `message` event handler on the global `window` or `document`
-    // target.  The decorated method receives the `MessageEvent` as its first
-    // parameter, so it is equivalent to `window.addEventListener('message', ...)`.
-    exists(MethodDefinition method, DataFlow::CallNode decorator |
-      decorator = DataFlow::moduleMember("@angular/core", "HostListener").getACall() and
-      decorator = method.getADecorator().getExpression().flow() and
-      decorator.getArgument(0).mayHaveStringValue(["window:message", "document:message"]) and
-      method.getBody() = this and
-      paramIndex = 0
-    )
   }
 
   /**

javascript/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/javascript-queries
-version: 2.4.1-dev
+version: 2.4.0
 groups:
   - javascript
   - queries

javascript/ql/test/query-tests/Security/CWE-020/MissingOriginCheck/Angular.ts

@@ -1,29 +0,0 @@
-import { Component, HostListener } from '@angular/core';
-
-@Component({ selector: 'app-root' })
-class AngularComponent {
-  // Angular registers this as a `window` message handler via the decorator,
-  // equivalent to `window.addEventListener('message', ...)`.
-  @HostListener('window:message', ['$event'])
-  onWindowMessage(event: MessageEvent): void { // $ Alert - no origin check
-    eval(event.data);
-  }
-
-  @HostListener('document:message', ['$event'])
-  onDocumentMessage(event: MessageEvent): void { // $ Alert - no origin check
-    eval(event.data);
-  }
-
-  @HostListener('window:message', ['$event'])
-  onCheckedMessage(event: MessageEvent): void { // OK - has an origin check
-    if (event.origin === 'https://www.example.com') {
-      eval(event.data);
-    }
-  }
-
-  // Not a message event, so it is not a postMessage handler.
-  @HostListener('window:resize', ['$event'])
-  onResize(event: MessageEvent): void { // OK - not a message handler
-    eval(event.data);
-  }
-}

javascript/ql/test/query-tests/Security/CWE-020/MissingOriginCheck/MissingOriginCheck.expected

@@ -1,5 +1,3 @@
-| Angular.ts:8:19:8:23 | event | Postmessage handler has no origin check. |
-| Angular.ts:13:21:13:25 | event | Postmessage handler has no origin check. |
 | tst.js:11:20:11:24 | event | Postmessage handler has no origin check. |
 | tst.js:24:27:24:27 | e | Postmessage handler has no origin check. |
 | tst.js:40:27:40:27 | e | Postmessage handler has no origin check. |

misc/suite-helpers/qlpack.yml

@@ -1,4 +1,4 @@
 name: codeql/suite-helpers
-version: 1.0.53-dev
+version: 1.0.52
 groups: shared
 warnOnImplicitThis: true

python/ql/lib/change-notes/2026-05-19-flask-subclasses.md

@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* `Flask::FlaskApp::instance()` will now also return instances of subclasses defined in the source tree. Previously, these were filtered out. `Flask::FlaskApp::classRef()` has been deprecated in favor of `Flask::FlaskApp::subclassRef()` since it already returned some subclasses.

python/ql/lib/change-notes/2026-06-30-disable-instance-field-step-hotfix.md

@@ -1,5 +0,0 @@
----
-category: minorAnalysis
----
-
-- Temporarily disabled the `instanceFieldStep` disjunct of the internal `TypeTrackingInput::levelStepCall` predicate, which was introduced in 7.2.0 and caused catastrophic query slowdowns on some OOP-heavy Python codebases (e.g. `mypy` and `dask`).

python/ql/lib/change-notes/2026-06-30-instance-attribute-typetracking-performance.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Type tracking of values stored in instance attributes and read from outside the class (for example `instance.attr` where the value was assigned to `self.attr` in a method) no longer relies on a dedicated instance type-tracker. This avoids a structural mutual recursion that could cause catastrophic query slowdowns on some OOP-heavy code bases. Such reads are now resolved using local flow from the constructor call, which is slightly less precise for instances that flow across a call or return before being read.

python/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/python-all
-version: 7.2.1-dev
+version: 7.2.0
 groups: python
 dbscheme: semmlecode.python.dbscheme
 extractor: python

python/ql/lib/semmle/python/dataflow/new/internal/TypeTrackingImpl.qll

@@ -170,13 +170,7 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
 
   /** Holds if there is a level step from `nodeFrom` to `nodeTo`, which may depend on the call graph. */
   predicate levelStepCall(Node nodeFrom, LocalSourceNode nodeTo) {
-    // HOTFIX: `instanceFieldStep` is temporarily disabled (via `and none()`).
+    instanceFieldStep(nodeFrom, nodeTo)
-    // It uses `classInstanceTracker(cls)` -- itself a type-tracker run --
-    // from inside `levelStepCall`, creating a structural mutual recursion
-    // that causes catastrophic query slowdowns on some OOP-heavy Python
-    // codebases (e.g. mypy and dask). The `and none()` should be removed
-    // once that recursion is redesigned.
-    instanceFieldStep(nodeFrom, nodeTo) and none()
     or
     inheritedFieldStep(nodeFrom, nodeTo)
   }
@@ -355,11 +349,23 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
    * `instance.attr`, where `instance` is a reference to an instance of `cls`).
    *
    * This complements `selfAttrRef`, which only handles `self.attr` accesses inside the
-   * methods of `cls`. Unlike `selfAttrRef`, this depends on the call graph (via
+   * methods of `cls`. The instance is identified using *local* flow from a constructor
-   * `classInstanceTracker`), so steps using it must be reported as `levelStepCall`.
+   * call `cls(...)` (resolved via the call graph by `resolveClassCall`), rather than a
+   * dedicated instance type-tracker (`classInstanceTracker`).
+   *
+   * Using `classInstanceTracker` here would make `levelStepCall` mutually recursive with
+   * `classInstanceTracker` -- itself a full type-tracker run -- which caused catastrophic
+   * query slowdowns on some OOP-heavy Python code bases (e.g. `mypy` and `dask`). Relying
+   * on local flow from a resolved constructor call instead depends only on `classTracker`
+   * (the same call-graph machinery already used by `inheritedFieldStep`), avoiding that
+   * blow-up. The trade-off is reduced precision: instances that flow across a call or
+   * return before being read are no longer covered by this step.
    */
   private predicate instanceAttrRead(Class cls, string attr, DataFlowPublic::AttrRead read) {
-    read.getObject() = DataFlowDispatch::classInstanceTracker(cls) and
+    exists(DataFlowPublic::CallCfgNode construction |
+      DataFlowDispatch::resolveClassCall(construction.asCfgNode(), cls) and
+      read.getObject().getALocalSource() = construction
+    ) and
     read.mayHaveAttributeName(attr)
   }
 
@@ -438,9 +444,9 @@ module TypeTrackingInput implements Shared::TypeTrackingInput<Location> {
    * This is the cross-instance counterpart of `localFieldStep`: it relates a write of
    * `self.attr` inside a class to a read of `attr` on a reference to an instance of that
    * class or one of its subclasses. Identifying instances relies on the call graph (via
-   * `classInstanceTracker`), so this step is reported as `levelStepCall` rather than
+   * `resolveClassCall`, see `instanceAttrRead`), so this step is reported as
-   * `levelStepNoCall`. The write may occur in the instance's own class or in any of its
+   * `levelStepCall` rather than `levelStepNoCall`. The write may occur in the instance's
-   * superclasses, since those methods are inherited.
+   * own class or in any of its superclasses, since those methods are inherited.
    *
    * Like `localFieldStep`, this is an over-approximation: it is both instance-insensitive
    * and order-insensitive.

python/ql/lib/semmle/python/frameworks/Flask.qll

@@ -71,21 +71,14 @@ module Flask {
    * See https://flask.palletsprojects.com/en/1.1.x/api/#flask.Flask.
    */
   module FlaskApp {
-    /**
+    /** Gets a reference to the `flask.Flask` class. */
-     * Gets a reference to the `flask.Flask` class or any subclass.
+    API::Node classRef() {
-     *
+      result = API::moduleImport("flask").getMember("Flask") or
-     * Deprecated: Use `subclassRef()` instead, this predicate always returned some subclasses.
-     */
-    deprecated API::Node classRef() { result = subclassRef() }
-
-    /** Gets a reference to the `flask.Flask` class or any subclass. */
-    API::Node subclassRef() {
-      result = API::moduleImport("flask").getMember("Flask").getASubclass*() or
       result = ModelOutput::getATypeNode("flask.Flask~Subclass").getASubclass*()
     }
 
     /** Gets a reference to an instance of `flask.Flask` (a flask application). */
-    API::Node instance() { result = subclassRef().getReturn() }
+    API::Node instance() { result = classRef().getReturn() }
   }
 
   /**
@@ -139,7 +132,7 @@ module Flask {
     API::Node classRef() {
       result = API::moduleImport("flask").getMember("Response")
       or
-      result = [FlaskApp::subclassRef(), FlaskApp::instance()].getMember("response_class")
+      result = [FlaskApp::classRef(), FlaskApp::instance()].getMember("response_class")
       or
       result = ModelOutput::getATypeNode("flask.Response~Subclass").getASubclass*()
     }

python/ql/src/meta/ClassHierarchy/Find.ql

@@ -351,7 +351,7 @@ class DjangoHttpRequest extends FindSubclassesSpec {
 class FlaskClass extends FindSubclassesSpec {
   FlaskClass() { this = "flask.Flask~Subclass" }
 
-  override API::Node getAlreadyModeledClass() { result = Flask::FlaskApp::subclassRef() }
+  override API::Node getAlreadyModeledClass() { result = Flask::FlaskApp::classRef() }
 }
 
 class FlaskBlueprint extends FindSubclassesSpec {

python/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/python-queries
-version: 1.8.6-dev
+version: 1.8.5
 groups:
   - python
   - queries

python/ql/test/experimental/meta/InlineInstanceTest.qll

@@ -1,29 +0,0 @@
-/**
- * Defines an InlineExpectationsTest for class instances, that is,
- * for any API::Node that is an instance of a class (e.g. `Flask`).
- */
-
-import python
-import semmle.python.ApiGraphs
-import utils.test.InlineExpectationsTest
-private import semmle.python.dataflow.new.internal.PrintNode
-
-signature API::Node getInstanceSig();
-
-module MakeInlineInstanceTest<getInstanceSig/0 getInstance> {
-  private module InlineInstanceTest implements TestSig {
-    string getARelevantTag() { result = "instance" }
-
-    predicate hasActualResult(Location location, string element, string tag, string value) {
-      exists(location.getFile().getRelativePath()) and
-      exists(API::Node instance | instance = getInstance() |
-        location = instance.getLocation() and
-        element = prettyNode(instance.asSource()) and
-        value = "" and
-        tag = "instance"
-      )
-    }
-  }
-
-  import MakeTest<InlineInstanceTest>
-}

python/ql/test/library-tests/dataflow/typetracking/attribute_tests.py

@@ -157,10 +157,22 @@ class MyClass2(object):
         print(self.foo) # $ tracked MISSING: tracked=foo
 
 instance = MyClass2()
-print(instance.foo) # $ MISSING: tracked=foo tracked
+print(instance.foo) # $ tracked MISSING: tracked=foo
 instance.print_foo() # $ MISSING: tracked=foo
 
 
+# attribute set in method, but the instance flows across a call/return before the read.
+# `instanceFieldStep` identifies the instance using only local flow from the constructor
+# call, so a value stored on `self.foo` is not seen once the instance has crossed a
+# function boundary.
+
+def make_my_class2():
+    return MyClass2()
+
+returned_instance = make_my_class2()
+print(returned_instance.foo) # $ MISSING: tracked
+
+
 # attribute set from outside of class
 
 class MyClass3(object):
@@ -195,7 +207,7 @@ class Sub1(Base1):
 
 sub1 = Sub1()
 sub1.read_foo()
-print(sub1.foo) # $ MISSING: tracked=foo tracked
+print(sub1.foo) # $ tracked MISSING: tracked=foo
 
 
 # attribute written in a subclass method, read in an inherited base class method
@@ -210,7 +222,7 @@ class Sub2(Base2):
 
 sub2 = Sub2()
 sub2.read_bar()
-print(sub2.bar) # $ MISSING: tracked=bar tracked
+print(sub2.bar) # $ tracked MISSING: tracked=bar
 
 
 # attribute written in a base class method, read on an instance of the subclass
@@ -223,4 +235,4 @@ class Sub3(Base3):
     pass
 
 sub3 = Sub3()
-print(sub3.baz) # $ MISSING: tracked=baz tracked
+print(sub3.baz) # $ tracked MISSING: tracked=baz

python/ql/test/library-tests/frameworks/flask/InlineInstanceTest.ql

@@ -1,8 +0,0 @@
-import python
-import semmle.python.frameworks.Flask
-import semmle.python.ApiGraphs
-import experimental.meta.InlineInstanceTest
-
-API::Node getInstance() { result = Flask::FlaskApp::instance() }
-
-import MakeInlineInstanceTest<getInstance/0>

python/ql/test/library-tests/frameworks/flask/flask_subclass.py

@@ -1,14 +0,0 @@
-from flask import Flask
-
-
-class Sub(Flask):
-    def __init__(self, *args, **kwargs):
-        Flask.__init__(self, *args, **kwargs)
-
-
-app = Sub(__name__) # $ instance
-
-
-@app.route("/") # $ routeSetup="/"
-def hello(): # $ requestHandler
-    return "world" # $ HttpResponse

python/ql/test/library-tests/frameworks/flask/old_test.py

@@ -1,7 +1,7 @@
 import flask
 
 from flask import Flask, request, make_response
-app = Flask(__name__) # $ instance
+app = Flask(__name__)
 
 @app.route("/")  # $ routeSetup="/"
 def hello_world():  # $ requestHandler

python/ql/test/library-tests/frameworks/flask/response_test.py

@@ -3,7 +3,7 @@ import json
 from flask import Flask, make_response, jsonify, Response, request, redirect
 from werkzeug.datastructures import Headers
 
-app = Flask(__name__) # $ instance
+app = Flask(__name__)
 
 
 @app.route("/html1")  # $ routeSetup="/html1"

python/ql/test/library-tests/frameworks/flask/routing_test.py

@@ -1,7 +1,7 @@
 import flask
 
 from flask import Flask, make_response
-app = Flask(__name__) # $ instance
+app = Flask(__name__)
 
 
 SOME_ROUTE = "/some/route"

python/ql/test/library-tests/frameworks/flask/save_uploaded_file.py

@@ -1,5 +1,5 @@
 from flask import Flask, request
-app = Flask(__name__) # $ instance
+app = Flask(__name__)
 
 @app.route("/save-uploaded-file")  # $ routeSetup="/save-uploaded-file"
 def test_taint():  # $ requestHandler

python/ql/test/library-tests/frameworks/flask/taint_test.py

@@ -1,5 +1,5 @@
 from flask import Flask, request, render_template_string, stream_template_string
-app = Flask(__name__) # $ instance
+app = Flask(__name__)
 
 @app.route("/test_taint/<name>/<int:number>")  # $ routeSetup="/test_taint/<name>/<int:number>"
 def test_taint(name = "World!", number="0", foo="foo"):  # $ requestHandler routedParameter=name routedParameter=number

python/ql/test/library-tests/frameworks/flask/template_test.py

@@ -1,5 +1,5 @@
 from flask import Flask, Response, stream_with_context, render_template_string, stream_template_string
-app = Flask(__name__) # $ instance
+app = Flask(__name__)
 
 @app.route("/a")  # $ routeSetup="/a"
 def a():  # $ requestHandler

python/ql/test/query-tests/Security/CWE-089-SqlInjection/SqlInjection.expected

@@ -1,6 +1,7 @@
 #select
 | app.py:23:20:23:24 | ControlFlowNode for query | app.py:20:18:20:21 | ControlFlowNode for name | app.py:23:20:23:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:20:18:20:21 | ControlFlowNode for name | user-provided value |
 | app.py:30:20:30:24 | ControlFlowNode for query | app.py:27:19:27:22 | ControlFlowNode for name | app.py:30:20:30:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:27:19:27:22 | ControlFlowNode for name | user-provided value |
+| app.py:37:20:37:24 | ControlFlowNode for query | app.py:34:19:34:22 | ControlFlowNode for name | app.py:37:20:37:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:34:19:34:22 | ControlFlowNode for name | user-provided value |
 | app.py:44:20:44:24 | ControlFlowNode for query | app.py:41:19:41:22 | ControlFlowNode for name | app.py:44:20:44:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:41:19:41:22 | ControlFlowNode for name | user-provided value |
 | app.py:51:20:51:24 | ControlFlowNode for query | app.py:48:19:48:22 | ControlFlowNode for name | app.py:51:20:51:24 | ControlFlowNode for query | This SQL query depends on a $@. | app.py:48:19:48:22 | ControlFlowNode for name | user-provided value |
 | sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | sql_injection.py:14:15:14:22 | ControlFlowNode for username | sql_injection.py:21:24:21:77 | ControlFlowNode for BinaryExpr | This SQL query depends on a $@. | sql_injection.py:14:15:14:22 | ControlFlowNode for username | user-provided value |
@@ -24,6 +25,8 @@ edges
 | app.py:21:5:21:9 | ControlFlowNode for query | app.py:23:20:23:24 | ControlFlowNode for query | provenance |  |
 | app.py:27:19:27:22 | ControlFlowNode for name | app.py:28:5:28:9 | ControlFlowNode for query | provenance |  |
 | app.py:28:5:28:9 | ControlFlowNode for query | app.py:30:20:30:24 | ControlFlowNode for query | provenance |  |
+| app.py:34:19:34:22 | ControlFlowNode for name | app.py:35:5:35:9 | ControlFlowNode for query | provenance |  |
+| app.py:35:5:35:9 | ControlFlowNode for query | app.py:37:20:37:24 | ControlFlowNode for query | provenance |  |
 | app.py:41:19:41:22 | ControlFlowNode for name | app.py:42:5:42:9 | ControlFlowNode for query | provenance |  |
 | app.py:42:5:42:9 | ControlFlowNode for query | app.py:44:20:44:24 | ControlFlowNode for query | provenance |  |
 | app.py:48:19:48:22 | ControlFlowNode for name | app.py:49:5:49:9 | ControlFlowNode for query | provenance |  |
@@ -51,6 +54,9 @@ nodes
 | app.py:27:19:27:22 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
 | app.py:28:5:28:9 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
 | app.py:30:20:30:24 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
+| app.py:34:19:34:22 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
+| app.py:35:5:35:9 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
+| app.py:37:20:37:24 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
 | app.py:41:19:41:22 | ControlFlowNode for name | semmle.label | ControlFlowNode for name |
 | app.py:42:5:42:9 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |
 | app.py:44:20:44:24 | ControlFlowNode for query | semmle.label | ControlFlowNode for query |

python/ql/test/query-tests/Security/CWE-089-SqlInjection/app.py

@@ -31,10 +31,10 @@ async def unsafe2(name: str): # $ Source
     cursor.close()
 
 @app.get("/unsafe3/")
-async def unsafe3(name: str): # $ MISSING: Source
+async def unsafe3(name: str): # $ Source
     query = "select * from users where name=" + name
     cursor = hdb_con3.cursor()
-    cursor.execute(query) # $ MISSING: Alert
+    cursor.execute(query) # $ Alert
     cursor.close()
 
 @app.get("/unsafe4/")

ql/ql/src/codeql_ql/ast/internal/TreeSitter.qll

@@ -1312,244 +1312,6 @@ module QL {
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() { ql_variable_def(this, result) }
   }
-
-  /** Provides predicates for mapping AST nodes to their named children. */
-  module PrintAst {
-    /** Gets a child of `node` returned by the member predicate with the given `name`. If the predicate takes an index argument, `i` is bound to that index, otherwise `i` is `-1` (which is never a valid index). */
-    AstNode getChild(AstNode node, string name, int i) {
-      result = node.(AddExpr).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(AddExpr).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(AddExpr).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Aggregate).getChild(i) and name = "getChild"
-      or
-      result = node.(AnnotArg).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Annotation).getArgs(i) and name = "getArgs"
-      or
-      result = node.(Annotation).getName() and i = -1 and name = "getName"
-      or
-      result = node.(AritylessPredicateExpr).getName() and i = -1 and name = "getName"
-      or
-      result = node.(AritylessPredicateExpr).getQualifier() and i = -1 and name = "getQualifier"
-      or
-      result = node.(AsExpr).getChild(i) and name = "getChild"
-      or
-      result = node.(AsExprs).getChild(i) and name = "getChild"
-      or
-      result = node.(Body).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Bool).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(CallBody).getChild(i) and name = "getChild"
-      or
-      result = node.(CallOrUnqualAggExpr).getChild(i) and name = "getChild"
-      or
-      result = node.(Charpred).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Charpred).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(ClassMember).getChild(i) and name = "getChild"
-      or
-      result = node.(ClasslessPredicate).getName() and i = -1 and name = "getName"
-      or
-      result = node.(ClasslessPredicate).getReturnType() and i = -1 and name = "getReturnType"
-      or
-      result = node.(ClasslessPredicate).getChild(i) and name = "getChild"
-      or
-      result = node.(CompTerm).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(CompTerm).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(CompTerm).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Conjunction).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(Conjunction).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(Dataclass).getExtends(i) and name = "getExtends"
-      or
-      result = node.(Dataclass).getInstanceof(i) and name = "getInstanceof"
-      or
-      result = node.(Dataclass).getName() and i = -1 and name = "getName"
-      or
-      result = node.(Dataclass).getChild(i) and name = "getChild"
-      or
-      result = node.(Datatype).getName() and i = -1 and name = "getName"
-      or
-      result = node.(Datatype).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(DatatypeBranch).getName() and i = -1 and name = "getName"
-      or
-      result = node.(DatatypeBranch).getChild(i) and name = "getChild"
-      or
-      result = node.(DatatypeBranches).getChild(i) and name = "getChild"
-      or
-      result = node.(Disjunction).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(Disjunction).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(ExprAggregateBody).getAsExprs() and i = -1 and name = "getAsExprs"
-      or
-      result = node.(ExprAggregateBody).getOrderBys() and i = -1 and name = "getOrderBys"
-      or
-      result = node.(ExprAnnotation).getAnnotArg() and i = -1 and name = "getAnnotArg"
-      or
-      result = node.(ExprAnnotation).getName() and i = -1 and name = "getName"
-      or
-      result = node.(ExprAnnotation).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Field).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(FullAggregateBody).getAsExprs() and i = -1 and name = "getAsExprs"
-      or
-      result = node.(FullAggregateBody).getGuard() and i = -1 and name = "getGuard"
-      or
-      result = node.(FullAggregateBody).getOrderBys() and i = -1 and name = "getOrderBys"
-      or
-      result = node.(FullAggregateBody).getChild(i) and name = "getChild"
-      or
-      result = node.(HigherOrderTerm).getName() and i = -1 and name = "getName"
-      or
-      result = node.(HigherOrderTerm).getChild(i) and name = "getChild"
-      or
-      result = node.(IfTerm).getCond() and i = -1 and name = "getCond"
-      or
-      result = node.(IfTerm).getFirst() and i = -1 and name = "getFirst"
-      or
-      result = node.(IfTerm).getSecond() and i = -1 and name = "getSecond"
-      or
-      result = node.(Implication).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(Implication).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(ImportDirective).getChild(i) and name = "getChild"
-      or
-      result = node.(ImportModuleExpr).getQualName(i) and name = "getQualName"
-      or
-      result = node.(ImportModuleExpr).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(InExpr).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(InExpr).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(InstanceOf).getChild(i) and name = "getChild"
-      or
-      result = node.(Literal).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(MemberPredicate).getName() and i = -1 and name = "getName"
-      or
-      result = node.(MemberPredicate).getReturnType() and i = -1 and name = "getReturnType"
-      or
-      result = node.(MemberPredicate).getChild(i) and name = "getChild"
-      or
-      result = node.(Module).getImplements(i) and name = "getImplements"
-      or
-      result = node.(Module).getName() and i = -1 and name = "getName"
-      or
-      result = node.(Module).getParameter(i) and name = "getParameter"
-      or
-      result = node.(Module).getChild(i) and name = "getChild"
-      or
-      result = node.(ModuleAliasBody).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(ModuleExpr).getName() and i = -1 and name = "getName"
-      or
-      result = node.(ModuleExpr).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(ModuleInstantiation).getName() and i = -1 and name = "getName"
-      or
-      result = node.(ModuleInstantiation).getChild(i) and name = "getChild"
-      or
-      result = node.(ModuleMember).getChild(i) and name = "getChild"
-      or
-      result = node.(ModuleName).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(ModuleParam).getParameter() and i = -1 and name = "getParameter"
-      or
-      result = node.(ModuleParam).getSignature() and i = -1 and name = "getSignature"
-      or
-      result = node.(MulExpr).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(MulExpr).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(MulExpr).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Negation).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(OrderBy).getChild(i) and name = "getChild"
-      or
-      result = node.(OrderBys).getChild(i) and name = "getChild"
-      or
-      result = node.(ParExpr).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(PredicateAliasBody).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(PredicateExpr).getChild(i) and name = "getChild"
-      or
-      result = node.(PrefixCast).getChild(i) and name = "getChild"
-      or
-      result = node.(Ql).getChild(i) and name = "getChild"
-      or
-      result = node.(QualifiedRhs).getName() and i = -1 and name = "getName"
-      or
-      result = node.(QualifiedRhs).getChild(i) and name = "getChild"
-      or
-      result = node.(QualifiedExpr).getChild(i) and name = "getChild"
-      or
-      result = node.(Quantified).getExpr() and i = -1 and name = "getExpr"
-      or
-      result = node.(Quantified).getFormula() and i = -1 and name = "getFormula"
-      or
-      result = node.(Quantified).getRange() and i = -1 and name = "getRange"
-      or
-      result = node.(Quantified).getChild(i) and name = "getChild"
-      or
-      result = node.(Range).getLower() and i = -1 and name = "getLower"
-      or
-      result = node.(Range).getUpper() and i = -1 and name = "getUpper"
-      or
-      result = node.(Select).getChild(i) and name = "getChild"
-      or
-      result = node.(SetLiteral).getChild(i) and name = "getChild"
-      or
-      result = node.(SignatureExpr).getModExpr() and i = -1 and name = "getModExpr"
-      or
-      result = node.(SignatureExpr).getPredicate() and i = -1 and name = "getPredicate"
-      or
-      result = node.(SignatureExpr).getTypeExpr() and i = -1 and name = "getTypeExpr"
-      or
-      result = node.(SpecialCall).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(SuperRef).getChild(i) and name = "getChild"
-      or
-      result = node.(TypeAliasBody).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(TypeExpr).getName() and i = -1 and name = "getName"
-      or
-      result = node.(TypeExpr).getQualifier() and i = -1 and name = "getQualifier"
-      or
-      result = node.(TypeExpr).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(TypeUnionBody).getChild(i) and name = "getChild"
-      or
-      result = node.(UnaryExpr).getChild(i) and name = "getChild"
-      or
-      result = node.(UnqualAggBody).getAsExprs(i) and name = "getAsExprs"
-      or
-      result = node.(UnqualAggBody).getGuard() and i = -1 and name = "getGuard"
-      or
-      result = node.(UnqualAggBody).getChild(i) and name = "getChild"
-      or
-      result = node.(VarDecl).getChild(i) and name = "getChild"
-      or
-      result = node.(VarName).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Variable).getChild() and i = -1 and name = "getChild"
-    }
-  }
 }
 
 overlay[local]
@@ -1907,60 +1669,6 @@ module Dbscheme {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "Varchar" }
   }
-
-  /** Provides predicates for mapping AST nodes to their named children. */
-  module PrintAst {
-    /** Gets a child of `node` returned by the member predicate with the given `name`. If the predicate takes an index argument, `i` is bound to that index, otherwise `i` is `-1` (which is never a valid index). */
-    AstNode getChild(AstNode node, string name, int i) {
-      result = node.(Annotation).getArgsAnnotation() and i = -1 and name = "getArgsAnnotation"
-      or
-      result = node.(Annotation).getSimpleAnnotation() and i = -1 and name = "getSimpleAnnotation"
-      or
-      result = node.(ArgsAnnotation).getName() and i = -1 and name = "getName"
-      or
-      result = node.(ArgsAnnotation).getChild(i) and name = "getChild"
-      or
-      result = node.(Branch).getQldoc() and i = -1 and name = "getQldoc"
-      or
-      result = node.(Branch).getChild(i) and name = "getChild"
-      or
-      result = node.(CaseDecl).getBase() and i = -1 and name = "getBase"
-      or
-      result = node.(CaseDecl).getDiscriminator() and i = -1 and name = "getDiscriminator"
-      or
-      result = node.(CaseDecl).getChild(i) and name = "getChild"
-      or
-      result = node.(ColType).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Column).getColName() and i = -1 and name = "getColName"
-      or
-      result = node.(Column).getColType() and i = -1 and name = "getColType"
-      or
-      result = node.(Column).getIsRef() and i = -1 and name = "getIsRef"
-      or
-      result = node.(Column).getIsUnique() and i = -1 and name = "getIsUnique"
-      or
-      result = node.(Column).getQldoc() and i = -1 and name = "getQldoc"
-      or
-      result = node.(Column).getReprType() and i = -1 and name = "getReprType"
-      or
-      result = node.(Dbscheme).getChild(i) and name = "getChild"
-      or
-      result = node.(Entry).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(ReprType).getChild(i) and name = "getChild"
-      or
-      result = node.(Table).getTableName() and i = -1 and name = "getTableName"
-      or
-      result = node.(Table).getChild(i) and name = "getChild"
-      or
-      result = node.(TableName).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(UnionDecl).getBase() and i = -1 and name = "getBase"
-      or
-      result = node.(UnionDecl).getChild(i) and name = "getChild"
-    }
-  }
 }
 
 overlay[local]
@@ -2095,24 +1803,6 @@ module Blame {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "Number" }
   }
-
-  /** Provides predicates for mapping AST nodes to their named children. */
-  module PrintAst {
-    /** Gets a child of `node` returned by the member predicate with the given `name`. If the predicate takes an index argument, `i` is bound to that index, otherwise `i` is `-1` (which is never a valid index). */
-    AstNode getChild(AstNode node, string name, int i) {
-      result = node.(BlameEntry).getDate() and i = -1 and name = "getDate"
-      or
-      result = node.(BlameEntry).getLine(i) and name = "getLine"
-      or
-      result = node.(BlameInfo).getFileEntry(i) and name = "getFileEntry"
-      or
-      result = node.(BlameInfo).getToday() and i = -1 and name = "getToday"
-      or
-      result = node.(FileEntry).getBlameEntry(i) and name = "getBlameEntry"
-      or
-      result = node.(FileEntry).getFileName() and i = -1 and name = "getFileName"
-    }
-  }
 }
 
 overlay[local]
@@ -2287,22 +1977,4 @@ module JSON {
     /** Gets the name of the primary QL class for this element. */
     final override string getAPrimaryQlClass() { result = "True" }
   }
-
-  /** Provides predicates for mapping AST nodes to their named children. */
-  module PrintAst {
-    /** Gets a child of `node` returned by the member predicate with the given `name`. If the predicate takes an index argument, `i` is bound to that index, otherwise `i` is `-1` (which is never a valid index). */
-    AstNode getChild(AstNode node, string name, int i) {
-      result = node.(Array).getChild(i) and name = "getChild"
-      or
-      result = node.(Document).getChild(i) and name = "getChild"
-      or
-      result = node.(Object).getChild(i) and name = "getChild"
-      or
-      result = node.(Pair).getKey() and i = -1 and name = "getKey"
-      or
-      result = node.(Pair).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(String).getChild(i) and name = "getChild"
-    }
-  }
 }

ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll

@@ -1964,340 +1964,6 @@ module Ruby {
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() { ruby_yield_child(this, result) }
   }
-
-  /** Provides predicates for mapping AST nodes to their named children. */
-  module PrintAst {
-    /** Gets a child of `node` returned by the member predicate with the given `name`. If the predicate takes an index argument, `i` is bound to that index, otherwise `i` is `-1` (which is never a valid index). */
-    AstNode getChild(AstNode node, string name, int i) {
-      result = node.(Alias).getAlias() and i = -1 and name = "getAlias"
-      or
-      result = node.(Alias).getName() and i = -1 and name = "getName"
-      or
-      result = node.(AlternativePattern).getAlternatives(i) and name = "getAlternatives"
-      or
-      result = node.(ArgumentList).getChild(i) and name = "getChild"
-      or
-      result = node.(Array).getChild(i) and name = "getChild"
-      or
-      result = node.(ArrayPattern).getClass() and i = -1 and name = "getClass"
-      or
-      result = node.(ArrayPattern).getChild(i) and name = "getChild"
-      or
-      result = node.(AsPattern).getName() and i = -1 and name = "getName"
-      or
-      result = node.(AsPattern).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(Assignment).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(Assignment).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(BareString).getChild(i) and name = "getChild"
-      or
-      result = node.(BareSymbol).getChild(i) and name = "getChild"
-      or
-      result = node.(Begin).getChild(i) and name = "getChild"
-      or
-      result = node.(BeginBlock).getChild(i) and name = "getChild"
-      or
-      result = node.(Binary).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(Binary).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(Block).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Block).getParameters() and i = -1 and name = "getParameters"
-      or
-      result = node.(BlockArgument).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(BlockBody).getChild(i) and name = "getChild"
-      or
-      result = node.(BlockParameter).getName() and i = -1 and name = "getName"
-      or
-      result = node.(BlockParameters).getLocals(i) and name = "getLocals"
-      or
-      result = node.(BlockParameters).getChild(i) and name = "getChild"
-      or
-      result = node.(BodyStatement).getChild(i) and name = "getChild"
-      or
-      result = node.(Break).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Call).getArguments() and i = -1 and name = "getArguments"
-      or
-      result = node.(Call).getBlock() and i = -1 and name = "getBlock"
-      or
-      result = node.(Call).getMethod() and i = -1 and name = "getMethod"
-      or
-      result = node.(Call).getOperator() and i = -1 and name = "getOperator"
-      or
-      result = node.(Call).getReceiver() and i = -1 and name = "getReceiver"
-      or
-      result = node.(Case).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(Case).getChild(i) and name = "getChild"
-      or
-      result = node.(CaseMatch).getClauses(i) and name = "getClauses"
-      or
-      result = node.(CaseMatch).getElse() and i = -1 and name = "getElse"
-      or
-      result = node.(CaseMatch).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(ChainedString).getChild(i) and name = "getChild"
-      or
-      result = node.(Class).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Class).getName() and i = -1 and name = "getName"
-      or
-      result = node.(Class).getSuperclass() and i = -1 and name = "getSuperclass"
-      or
-      result = node.(Complex).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Conditional).getAlternative() and i = -1 and name = "getAlternative"
-      or
-      result = node.(Conditional).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(Conditional).getConsequence() and i = -1 and name = "getConsequence"
-      or
-      result = node.(DelimitedSymbol).getChild(i) and name = "getChild"
-      or
-      result = node.(DestructuredLeftAssignment).getChild(i) and name = "getChild"
-      or
-      result = node.(DestructuredParameter).getChild(i) and name = "getChild"
-      or
-      result = node.(Do).getChild(i) and name = "getChild"
-      or
-      result = node.(DoBlock).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(DoBlock).getParameters() and i = -1 and name = "getParameters"
-      or
-      result = node.(ElementReference).getBlock() and i = -1 and name = "getBlock"
-      or
-      result = node.(ElementReference).getObject() and i = -1 and name = "getObject"
-      or
-      result = node.(ElementReference).getChild(i) and name = "getChild"
-      or
-      result = node.(Else).getChild(i) and name = "getChild"
-      or
-      result = node.(Elsif).getAlternative() and i = -1 and name = "getAlternative"
-      or
-      result = node.(Elsif).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(Elsif).getConsequence() and i = -1 and name = "getConsequence"
-      or
-      result = node.(EndBlock).getChild(i) and name = "getChild"
-      or
-      result = node.(Ensure).getChild(i) and name = "getChild"
-      or
-      result = node.(ExceptionVariable).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Exceptions).getChild(i) and name = "getChild"
-      or
-      result = node.(ExpressionReferencePattern).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(FindPattern).getClass() and i = -1 and name = "getClass"
-      or
-      result = node.(FindPattern).getChild(i) and name = "getChild"
-      or
-      result = node.(For).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(For).getPattern() and i = -1 and name = "getPattern"
-      or
-      result = node.(For).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(Hash).getChild(i) and name = "getChild"
-      or
-      result = node.(HashPattern).getClass() and i = -1 and name = "getClass"
-      or
-      result = node.(HashPattern).getChild(i) and name = "getChild"
-      or
-      result = node.(HashSplatArgument).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(HashSplatParameter).getName() and i = -1 and name = "getName"
-      or
-      result = node.(HeredocBody).getChild(i) and name = "getChild"
-      or
-      result = node.(If).getAlternative() and i = -1 and name = "getAlternative"
-      or
-      result = node.(If).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(If).getConsequence() and i = -1 and name = "getConsequence"
-      or
-      result = node.(IfGuard).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(IfModifier).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(IfModifier).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(In).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(InClause).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(InClause).getGuard() and i = -1 and name = "getGuard"
-      or
-      result = node.(InClause).getPattern() and i = -1 and name = "getPattern"
-      or
-      result = node.(Interpolation).getChild(i) and name = "getChild"
-      or
-      result = node.(KeywordParameter).getName() and i = -1 and name = "getName"
-      or
-      result = node.(KeywordParameter).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(KeywordPattern).getKey() and i = -1 and name = "getKey"
-      or
-      result = node.(KeywordPattern).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(Lambda).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Lambda).getParameters() and i = -1 and name = "getParameters"
-      or
-      result = node.(LambdaParameters).getChild(i) and name = "getChild"
-      or
-      result = node.(LeftAssignmentList).getChild(i) and name = "getChild"
-      or
-      result = node.(MatchPattern).getPattern() and i = -1 and name = "getPattern"
-      or
-      result = node.(MatchPattern).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(Method).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Method).getName() and i = -1 and name = "getName"
-      or
-      result = node.(Method).getParameters() and i = -1 and name = "getParameters"
-      or
-      result = node.(MethodParameters).getChild(i) and name = "getChild"
-      or
-      result = node.(Module).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Module).getName() and i = -1 and name = "getName"
-      or
-      result = node.(Next).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(OperatorAssignment).getLeft() and i = -1 and name = "getLeft"
-      or
-      result = node.(OperatorAssignment).getRight() and i = -1 and name = "getRight"
-      or
-      result = node.(OptionalParameter).getName() and i = -1 and name = "getName"
-      or
-      result = node.(OptionalParameter).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(Pair).getKey() and i = -1 and name = "getKey"
-      or
-      result = node.(Pair).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(ParenthesizedPattern).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(ParenthesizedStatements).getChild(i) and name = "getChild"
-      or
-      result = node.(Pattern).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Program).getChild(i) and name = "getChild"
-      or
-      result = node.(Range).getBegin() and i = -1 and name = "getBegin"
-      or
-      result = node.(Range).getEnd() and i = -1 and name = "getEnd"
-      or
-      result = node.(Rational).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Redo).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Regex).getChild(i) and name = "getChild"
-      or
-      result = node.(Rescue).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Rescue).getExceptions() and i = -1 and name = "getExceptions"
-      or
-      result = node.(Rescue).getVariable() and i = -1 and name = "getVariable"
-      or
-      result = node.(RescueModifier).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(RescueModifier).getHandler() and i = -1 and name = "getHandler"
-      or
-      result = node.(RestAssignment).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Retry).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Return).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(RightAssignmentList).getChild(i) and name = "getChild"
-      or
-      result = node.(ScopeResolution).getName() and i = -1 and name = "getName"
-      or
-      result = node.(ScopeResolution).getScope() and i = -1 and name = "getScope"
-      or
-      result = node.(Setter).getName() and i = -1 and name = "getName"
-      or
-      result = node.(SingletonClass).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(SingletonClass).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(SingletonMethod).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(SingletonMethod).getName() and i = -1 and name = "getName"
-      or
-      result = node.(SingletonMethod).getObject() and i = -1 and name = "getObject"
-      or
-      result = node.(SingletonMethod).getParameters() and i = -1 and name = "getParameters"
-      or
-      result = node.(SplatArgument).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(SplatParameter).getName() and i = -1 and name = "getName"
-      or
-      result = node.(String).getChild(i) and name = "getChild"
-      or
-      result = node.(StringArray).getChild(i) and name = "getChild"
-      or
-      result = node.(Subshell).getChild(i) and name = "getChild"
-      or
-      result = node.(Superclass).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(SymbolArray).getChild(i) and name = "getChild"
-      or
-      result = node.(TestPattern).getPattern() and i = -1 and name = "getPattern"
-      or
-      result = node.(TestPattern).getValue() and i = -1 and name = "getValue"
-      or
-      result = node.(Then).getChild(i) and name = "getChild"
-      or
-      result = node.(Unary).getOperand() and i = -1 and name = "getOperand"
-      or
-      result = node.(Undef).getChild(i) and name = "getChild"
-      or
-      result = node.(Unless).getAlternative() and i = -1 and name = "getAlternative"
-      or
-      result = node.(Unless).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(Unless).getConsequence() and i = -1 and name = "getConsequence"
-      or
-      result = node.(UnlessGuard).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(UnlessModifier).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(UnlessModifier).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(Until).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(Until).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(UntilModifier).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(UntilModifier).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(VariableReferencePattern).getName() and i = -1 and name = "getName"
-      or
-      result = node.(When).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(When).getPattern(i) and name = "getPattern"
-      or
-      result = node.(While).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(While).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(WhileModifier).getBody() and i = -1 and name = "getBody"
-      or
-      result = node.(WhileModifier).getCondition() and i = -1 and name = "getCondition"
-      or
-      result = node.(Yield).getChild() and i = -1 and name = "getChild"
-    }
-  }
 }
 
 overlay[local]
@@ -2441,20 +2107,4 @@ module Erb {
     /** Gets a field or child node of this node. */
     final override AstNode getAFieldOrChild() { erb_template_child(this, _, result) }
   }
-
-  /** Provides predicates for mapping AST nodes to their named children. */
-  module PrintAst {
-    /** Gets a child of `node` returned by the member predicate with the given `name`. If the predicate takes an index argument, `i` is bound to that index, otherwise `i` is `-1` (which is never a valid index). */
-    AstNode getChild(AstNode node, string name, int i) {
-      result = node.(CommentDirective).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Directive).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(GraphqlDirective).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(OutputDirective).getChild() and i = -1 and name = "getChild"
-      or
-      result = node.(Template).getChild(i) and name = "getChild"
-    }
-  }
 }

ruby/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ruby-all
-version: 6.0.1-dev
+version: 6.0.0
 groups: ruby
 extractor: ruby
 dbscheme: ruby.dbscheme

ruby/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ruby-queries
-version: 1.6.6-dev
+version: 1.6.5
 groups:
   - ruby
   - queries

rust/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/rust-all
-version: 0.2.17-dev
+version: 0.2.16
 groups: rust
 extractor: rust
 dbscheme: rust.dbscheme

rust/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/rust-queries
-version: 0.1.38-dev
+version: 0.1.37
 groups:
   - rust
   - queries

shared/concepts/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/concepts
-version: 0.0.27-dev
+version: 0.0.26
 groups: shared
 library: true
 dependencies:

shared/controlflow/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/controlflow
-version: 2.0.37-dev
+version: 2.0.36
 groups: shared
 library: true
 dependencies:

shared/dataflow/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/dataflow
-version: 2.1.9-dev
+version: 2.1.8
 groups: shared
 library: true
 dependencies:

shared/mad/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/mad
-version: 1.0.53-dev
+version: 1.0.52
 groups: shared
 library: true
 dependencies:

shared/namebinding/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/namebinding
-version: 0.0.2-dev
+version: 0.0.1
 groups: shared
 library: true
 dependencies:

shared/quantum/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/quantum
-version: 0.0.31-dev
+version: 0.0.30
 groups: shared
 library: true
 dependencies:

shared/rangeanalysis/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/rangeanalysis
-version: 1.0.53-dev
+version: 1.0.52
 groups: shared
 library: true
 dependencies:

shared/regex/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/regex
-version: 1.0.53-dev
+version: 1.0.52
 groups: shared
 library: true
 dependencies:

shared/ssa/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/ssa
-version: 2.0.29-dev
+version: 2.0.28
 groups: shared
 library: true
 dependencies:

shared/threat-models/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/threat-models
-version: 1.0.53-dev
+version: 1.0.52
 library: true
 groups: shared
 dataExtensions: