Merge pull request #17903 from github/release-prep/2.19.3

Release preparation for version 2.19.3
github · Nov 4, 2024 · 39a67b6 · 39a67b6
2 parents 7418d8e + cc7b724
commit 39a67b6
Showing 150 changed files with 371 additions and 125 deletions.
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,16 @@
+## 2.1.0
+
+### New Features
+
+* Added a new predicate `DataFlow::getARuntimeTarget` for getting a function that may be invoked by a `Call` expression. Unlike `Call.getTarget` this new predicate may also resolve function pointers.
+* Added the predicate `mayBeFromImplicitlyDeclaredFunction()` to the `Call` class to represent calls that may be the return value of an implicitly declared C function.
+* Added the predicate `getAnExplicitDeclarationEntry()` to the `Function` class to get a `FunctionDeclarationEntry` that is not implicit.
+* Added classes `RequiresExpr`, `SimpleRequirementExpr`, `TypeRequirementExpr`, `CompoundRequirementExpr`, and `NestedRequirementExpr` to represent C++20 requires expressions and the simple, type, compound, and nested requirements that can occur in `requires` expressions.
+
+### Minor Analysis Improvements
+
+* The function call target resolution algorithm has been improved to resolve more calls through function pointers. As a result, dataflow queries may have more results.
+
 ## 2.0.2
 
 ### Minor Analysis Improvements

diff --git a/cpp/ql/lib/change-notes/2014-10-11-requires-expressions.md b/cpp/ql/lib/change-notes/2014-10-11-requires-expressions.md
diff --git a/cpp/ql/lib/change-notes/2014-10-16-implicitly-declared-fns.md b/cpp/ql/lib/change-notes/2014-10-16-implicitly-declared-fns.md
diff --git a/cpp/ql/lib/change-notes/2024-10-16-function-pointer-resolution.md b/cpp/ql/lib/change-notes/2024-10-16-function-pointer-resolution.md
diff --git a/cpp/ql/lib/change-notes/2024-10-16-new-api-for-call-target-resolution.md b/cpp/ql/lib/change-notes/2024-10-16-new-api-for-call-target-resolution.md
diff --git a/cpp/ql/lib/change-notes/released/2.1.0.md b/cpp/ql/lib/change-notes/released/2.1.0.md
@@ -0,0 +1,12 @@
+## 2.1.0
+
+### New Features
+
+* Added a new predicate `DataFlow::getARuntimeTarget` for getting a function that may be invoked by a `Call` expression. Unlike `Call.getTarget` this new predicate may also resolve function pointers.
+* Added the predicate `mayBeFromImplicitlyDeclaredFunction()` to the `Call` class to represent calls that may be the return value of an implicitly declared C function.
+* Added the predicate `getAnExplicitDeclarationEntry()` to the `Function` class to get a `FunctionDeclarationEntry` that is not implicit.
+* Added classes `RequiresExpr`, `SimpleRequirementExpr`, `TypeRequirementExpr`, `CompoundRequirementExpr`, and `NestedRequirementExpr` to represent C++20 requires expressions and the simple, type, compound, and nested requirements that can occur in `requires` expressions.
+
+### Minor Analysis Improvements
+
+* The function call target resolution algorithm has been improved to resolve more calls through function pointers. As a result, dataflow queries may have more results.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 2.0.2
+lastReleaseVersion: 2.1.0
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 2.0.3-dev
+version: 2.1.0
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.2.6
+
+### Minor Analysis Improvements
+
+* Remove results from the `cpp/wrong-type-format-argument` ("Wrong type of arguments to formatting function") query if the argument is the return value of an implicitly declared function.
+
 ## 1.2.5
 
 ### Minor Analysis Improvements

diff --git a/.../2024-10-15-wrong-type-format-argument.md → cpp/ql/src/change-notes/released/1.2.6.md b/.../2024-10-15-wrong-type-format-argument.md → cpp/ql/src/change-notes/released/1.2.6.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 1.2.6
+
+### Minor Analysis Improvements
+
 * Remove results from the `cpp/wrong-type-format-argument` ("Wrong type of arguments to formatting function") query if the argument is the return value of an implicitly declared function.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.2.5
+lastReleaseVersion: 1.2.6
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.2.6-dev
+version: 1.2.6
 groups:
   - cpp
   - queries

diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.28
+
+No user-facing changes.
+
 ## 1.7.27
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.28.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.28.md
@@ -0,0 +1,3 @@
+## 1.7.28
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.27
+lastReleaseVersion: 1.7.28
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.28-dev
+version: 1.7.28
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.28
+
+No user-facing changes.
+
 ## 1.7.27
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.28.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.28.md
@@ -0,0 +1,3 @@
+## 1.7.28
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.27
+lastReleaseVersion: 1.7.28
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.28-dev
+version: 1.7.28
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 3.1.0
+
+### Major Analysis Improvements
+
+* The generated .NET 8 runtime models have been updated.
+
 ## 3.0.1
 
 No user-facing changes.

diff --git a/csharp/ql/lib/change-notes/2024-10-07-netruntime-models.md b/csharp/ql/lib/change-notes/2024-10-07-netruntime-models.md
diff --git a/csharp/ql/lib/change-notes/released/3.1.0.md b/csharp/ql/lib/change-notes/released/3.1.0.md
@@ -0,0 +1,5 @@
+## 3.1.0
+
+### Major Analysis Improvements
+
+* The generated .NET 8 runtime models have been updated.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 3.0.1
+lastReleaseVersion: 3.1.0
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 3.0.2-dev
+version: 3.1.0
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.0.11
+
+### Minor Analysis Improvements
+
+* C#: The method `string.ReplaceLineEndings(string)` is now considered a sanitizer for the `cs/log-forging` query. 
+
 ## 1.0.10
 
 No user-facing changes.

diff --git a/csharp/ql/src/change-notes/2024-10-21-log-forging-replacelineendings.md b/csharp/ql/src/change-notes/2024-10-21-log-forging-replacelineendings.md
diff --git a/csharp/ql/src/change-notes/released/1.0.11.md b/csharp/ql/src/change-notes/released/1.0.11.md
@@ -0,0 +1,5 @@
+## 1.0.11
+
+### Minor Analysis Improvements
+
+* C#: The method `string.ReplaceLineEndings(string)` is now considered a sanitizer for the `cs/log-forging` query. 
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.10
+lastReleaseVersion: 1.0.11
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.0.11-dev
+version: 1.0.11
 groups:
   - csharp
   - queries

diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.11
+
+No user-facing changes.
+
 ## 1.0.10
 
 No user-facing changes.

diff --git a/go/ql/consistency-queries/change-notes/released/1.0.11.md b/go/ql/consistency-queries/change-notes/released/1.0.11.md
@@ -0,0 +1,3 @@
+## 1.0.11
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.10
+lastReleaseVersion: 1.0.11
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.11-dev
+version: 1.0.11
 groups:
   - go
   - queries

diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.1.2
+
+### Minor Analysis Improvements
+
+* The AST viewer now shows type parameter declarations in the correct place in the AST.
+
 ## 2.1.1
 
 ### Minor Analysis Improvements

diff --git a/.../2024-10-17-ast-viewer-type-param-decl.md → go/ql/lib/change-notes/released/2.1.2.md b/.../2024-10-17-ast-viewer-type-param-decl.md → go/ql/lib/change-notes/released/2.1.2.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 2.1.2
+
+### Minor Analysis Improvements
+
 * The AST viewer now shows type parameter declarations in the correct place in the AST.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 2.1.1
+lastReleaseVersion: 2.1.2
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 2.1.2-dev
+version: 2.1.2
 groups: go
 dbscheme: go.dbscheme
 extractor: go

diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.1.2
+
+No user-facing changes.
+
 ## 1.1.1
 
 No user-facing changes.

diff --git a/go/ql/src/change-notes/released/1.1.2.md b/go/ql/src/change-notes/released/1.1.2.md
@@ -0,0 +1,3 @@
+## 1.1.2
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.1.1
+lastReleaseVersion: 1.1.2
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.1.2-dev
+version: 1.1.2
 groups:
   - go
   - queries

diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.11
+
+No user-facing changes.
+
 ## 1.0.10
 
 No user-facing changes.

diff --git a/java/ql/automodel/src/change-notes/released/1.0.11.md b/java/ql/automodel/src/change-notes/released/1.0.11.md
@@ -0,0 +1,3 @@
+## 1.0.11
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.10
+lastReleaseVersion: 1.0.11
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-automodel-queries
-version: 1.0.11-dev
+version: 1.0.11
 groups:
     - java
     - automodel

diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 4.2.0
+
+### Major Analysis Improvements
+
+* Java: The generated JDK 17 models have been updated.
+
+### Minor Analysis Improvements
+
+* Java `build-mode=none` extraction now packages the Maven plugin used to examine project dependencies. This means that dependency identification is more likely to succeed, and therefore analysis quality may rise, in scenarios where Maven Central is not reachable.
+
 ## 4.1.1
 
 No user-facing changes.

diff --git a/java/ql/lib/change-notes/2024-10-04-jdk-models.md b/java/ql/lib/change-notes/2024-10-04-jdk-models.md
diff --git a/...-10-21-buildless-packages-maven-plugin.md → java/ql/lib/change-notes/released/4.2.0.md b/...-10-21-buildless-packages-maven-plugin.md → java/ql/lib/change-notes/released/4.2.0.md
@@ -1,4 +1,9 @@
----
-category: minorAnalysis
----
+## 4.2.0
+
+### Major Analysis Improvements
+
+* Java: The generated JDK 17 models have been updated.
+
+### Minor Analysis Improvements
+
 * Java `build-mode=none` extraction now packages the Maven plugin used to examine project dependencies. This means that dependency identification is more likely to succeed, and therefore analysis quality may rise, in scenarios where Maven Central is not reachable.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 4.1.1
+lastReleaseVersion: 4.2.0
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 4.1.2-dev
+version: 4.2.0
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.1.8
+
+No user-facing changes.
+
 ## 1.1.7
 
 No user-facing changes.

diff --git a/java/ql/src/change-notes/released/1.1.8.md b/java/ql/src/change-notes/released/1.1.8.md
@@ -0,0 +1,3 @@
+## 1.1.8
+
+No user-facing changes.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.1.7
+lastReleaseVersion: 1.1.8
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 1.1.8-dev
+version: 1.1.8
 groups:
   - java
   - queries

diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.1.0
+
+### New Features
+
+* Added support for custom threat-models, which can be used in most of our taint-tracking queries, see our [documentation](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models) for more details.
+
 ## 2.0.2
 
 No user-facing changes.

diff --git a/.../change-notes/2024-10-29-threat-models.md → ...ipt/ql/lib/change-notes/released/2.1.0.md b/.../change-notes/2024-10-29-threat-models.md → ...ipt/ql/lib/change-notes/released/2.1.0.md
@@ -1,4 +1,5 @@
----
-category: feature
----
+## 2.1.0
+
+### New Features
+
 * Added support for custom threat-models, which can be used in most of our taint-tracking queries, see our [documentation](https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models) for more details.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 2.0.2
+lastReleaseVersion: 2.1.0