codeql/javascript/ql/src/change-notes/released/2.3.0.md

2.3.0

Major Analysis Improvements

• JavaScript files with an average line length greater than 200 are now considered minified and will no longer be analyzed. For use-cases where minified files should be analyzed, the original behavior can be restored by setting the environment variable CODEQL_EXTRACTOR_JAVASCRIPT_ALLOW_MINIFIED_FILES=true.

Minor Analysis Improvements

• The model of vue-router now properly detects taint sources in cases where the props property is a callback.
• Fixed a bug in the Next.js model that would cause the analysis to miss server-side taint sources in files named route or page appearing outside api and pages folders.
• new Response(x) is no longer seen as a reflected XSS sink when no content-type header is set, since the content type defaults to text/plain.