codeql/java/ql/lib/change-notes/released/0.8.6.md

0.8.6

Deprecated APIs

• Imports of the old dataflow libraries (e.g. semmle.code.java.dataflow.DataFlow2) have been deprecated in the libraries under the semmle.code.java.security namespace.

Minor Analysis Improvements

• Added the Map#replace and Map#replaceAll methods to the MapMutator class in semmle.code.java.Maps.

• Taint tracking now understands Kotlin's Array.get and Array.set methods.

• Added a sink model for the createRelative method of the org.springframework.core.io.Resource interface.

• Added source models for methods of the org.springframework.web.util.UrlPathHelper class and removed their taint flow models.

• Added models for the following packages:

  • com.google.common.io
  • hudson
  • hudson.console
  • java.lang
  • java.net
  • java.util.logging
  • javax.imageio.stream
  • org.apache.commons.io
  • org.apache.hadoop.hive.ql.exec
  • org.apache.hadoop.hive.ql.metadata
  • org.apache.tools.ant.taskdefs

• Added models for the following packages:

  • com.alibaba.druid.sql.repository
  • jakarta.persistence
  • jakarta.persistence.criteria
  • liquibase.database.jvm
  • liquibase.statement.core
  • org.apache.ibatis.mapping
  • org.keycloak.models.map.storage