Skip to content

Commit fce5b4d

Browse files
jonjanegojonjanego
committed
Changedocs for 2.21.3
1 parent 4bb829e commit fce5b4d

File tree

9 files changed

+186
-29
lines changed

9 files changed

+186
-29
lines changed

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.19.4.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,4 +79,4 @@ JavaScript/TypeScript
7979
* Added taint-steps for :code:`Array.prototype.toReversed`.
8080
* Added taint-steps for :code:`Array.prototype.toSorted`.
8181
* Added support for :code:`String.prototype.matchAll`.
82-
* Added taint-steps for :code:`Array.prototype.reverse`.
82+
* Added taint-steps for :code:`Array.prototype.reverse`\

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.4.rst

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,8 @@ Java/Kotlin
117117
* Deleted the deprecated :code:`isLValue` and :code:`isRValue` predicates from the :code:`VarAccess` class, use :code:`isVarWrite` and :code:`isVarRead` respectively instead.
118118
* Deleted the deprecated :code:`getRhs` predicate from the :code:`VarWrite` class, use :code:`getASource` instead.
119119
* Deleted the deprecated :code:`LValue` and :code:`RValue` classes, use :code:`VarWrite` and :code:`VarRead` respectively instead.
120-
* Deleted a lot of deprecated classes ending in ``*Access``, use the corresponding ``*Call`` classes instead.
121-
* Deleted a lot of deprecated predicates ending in ``*Access``, use the corresponding ``*Call`` predicates instead.
120+
* Deleted a lot of deprecated classes ending in "*Access", use the corresponding "*Call" classes instead.
121+
* Deleted a lot of deprecated predicates ending in "*Access", use the corresponding "*Call" predicates instead.
122122
* Deleted the deprecated :code:`EnvInput` and :code:`DatabaseInput` classes from :code:`FlowSources.qll`, use the threat models feature instead.
123123
* Deleted some deprecated API predicates from :code:`SensitiveApi.qll`, use the Sink classes from that file instead.
124124
@@ -144,7 +144,7 @@ Ruby
144144
* Deleted the deprecated :code:`ModelClass` and :code:`ModelInstance` classes from :code:`ActiveResource.qll`, use :code:`ModelClassNode` and :code:`ModelClassNode.getAnInstanceReference()` instead.
145145
* Deleted the deprecated :code:`Collection` class from :code:`ActiveResource.qll`, use :code:`CollectionSource` instead.
146146
* Deleted the deprecated :code:`ServiceInstantiation` and :code:`ClientInstantiation` classes from :code:`Twirp.qll`.
147-
* Deleted a lot of deprecated dataflow modules from ``*Query.qll`` files.
147+
* Deleted a lot of deprecated dataflow modules from "*Query.qll" files.
148148
* Deleted the old deprecated TypeTracking library.
149149
150150
Swift

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.5.rst

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -109,14 +109,6 @@ Python
109109
* Fixed a bug in the extractor where a comment inside a subscript could sometimes cause the AST to be missing nodes.
110110
* Using the :code:`break` and :code:`continue` keywords outside of a loop, which is a syntax error but is accepted by our parser, would cause the control-flow construction to fail. This is now no longer the case.
111111

112-
Major Analysis Improvements
113-
~~~~~~~~~~~~~~~~~~~~~~~~~~~
114-
115-
Golang
116-
""""""
117-
118-
* Go 1.24 is now supported. This includes the new language feature of generic type aliases.
119-
120112
Minor Analysis Improvements
121113
~~~~~~~~~~~~~~~~~~~~~~~~~~~
122114

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.20.6.rst

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Bug Fixes
3535
GitHub Actions
3636
""""""""""""""
3737

38-
* The :code:`actions/unversioned-immutable-action` query will no longer report any alerts, since the Immutable Actions feature is not yet available for customer use. The query remains in the default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is available, the query will be updated to report alerts again.
38+
* The :code:`actions/unversioned-immutable-action` query will no longer report any alerts, since the Immutable Actions feature is not yet available for customer use. The query has also been moved to the experimental folder and will not be used in code scanning unless it is explicitly added to a code scanning configuration. Once the Immutable Actions feature is available, the query will be updated to report alerts again.
3939

4040
Major Analysis Improvements
4141
~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -71,6 +71,11 @@ Language Libraries
7171
Major Analysis Improvements
7272
~~~~~~~~~~~~~~~~~~~~~~~~~~~
7373

74+
Golang
75+
""""""
76+
77+
* Go 1.24 is now supported. This includes the new language feature of generic type aliases.
78+
7479
JavaScript/TypeScript
7580
"""""""""""""""""""""
7681

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.0.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ Java/Kotlin
165165
"""""""""""
166166

167167
* Java extraction is now able to download Maven 3.9.x if a Maven Enforcer Plugin configuration indicates it is necessary. Maven 3.8.x is still preferred if the enforcer-plugin configuration (if any) permits it.
168-
* Added a path injection sanitizer for calls to :code:`java.lang.String.matches`, :code:`java.lang.String.replace`, and :code:`java.lang.String.replaceAll` that make sure :code:`/`, :code:`\\`, :code:`..` are not in the path.
168+
* Added a path injection sanitizer for calls to :code:`java.lang.String.matches`, :code:`java.lang.String.replace`, and :code:`java.lang.String.replaceAll` that make sure '/', '', '..' are not in the path.
169169

170170
JavaScript/TypeScript
171171
"""""""""""""""""""""
@@ -207,5 +207,5 @@ JavaScript/TypeScript
207207

208208
* Intersection :code:`&&`
209209
* Subtraction :code:`--`
210-
* :code:`\\q` quoted string
210+
* :code:`\q` quoted string
211211

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.1.rst

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -37,14 +37,6 @@ Bug Fixes
3737
Query Packs
3838
-----------
3939

40-
New Features
41-
~~~~~~~~~~~~
42-
43-
GitHub Actions
44-
""""""""""""""
45-
46-
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.
47-
4840
Bug Fixes
4941
~~~~~~~~~
5042

@@ -87,6 +79,14 @@ Python
8779

8880
* The :code:`py/mixed-tuple-returns` query no longer flags instances where the tuple is passed into the function as an argument, as this led to too many false positives.
8981

82+
New Features
83+
~~~~~~~~~~~~
84+
85+
GitHub Actions
86+
""""""""""""""
87+
88+
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.
89+
9090
Language Libraries
9191
------------------
9292

@@ -131,17 +131,17 @@ Ruby
131131
New Features
132132
~~~~~~~~~~~~
133133

134-
GitHub Actions
135-
""""""""""""""
136-
137-
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.
138-
139134
C/C++
140135
"""""
141136

142137
* Calling conventions explicitly specified on function declarations (:code:`__cdecl`, :code:`__stdcall`, :code:`__fastcall`, etc.) are now represented as specifiers of those declarations.
143138
* A new class :code:`CallingConventionSpecifier` extending the :code:`Specifier` class was introduced, which represents explicitly specified calling conventions.
144139

140+
GitHub Actions
141+
""""""""""""""
142+
143+
* CodeQL and Copilot Autofix support for GitHub Actions is now Generally Available.
144+
145145
Shared Libraries
146146
----------------
147147

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.2.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ Swift
108108
"""""
109109

110110
* Added AST nodes :code:`ActorIsolationErasureExpr`, :code:`CurrentContextIsolationExpr`,
111-
:code:`ExtractFunctionIsolationExpr` and :code:`UnreachableExpr` that correspond to new nodes added by Swift 6.0.
111+
:code:`ExtracFunctionIsolationExpr` and :code:`UnreachableExpr` that correspond to new nodes added by Swift 6.0.
112112

113113
New Features
114114
~~~~~~~~~~~~

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.21.3.rst

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
.. _codeql-cli-2.21.3:
2+
3+
==========================
4+
CodeQL 2.21.3 (2025-05-15)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.21.3 runs a total of 452 security queries when configured with the Default suite (covering 168 CWE). The Extended suite enables an additional 136 queries (covering 35 more CWE).
18+
19+
CodeQL CLI
20+
----------
21+
22+
Miscellaneous
23+
~~~~~~~~~~~~~
24+
25+
* Windows binaries for the CodeQL CLI are now built with :code:`/guard:cf`, enabling `Control Flow Guard <https://learn.microsoft.com/en-us/windows/win32/secbp/control-flow-guard>`__.
26+
27+
Query Packs
28+
-----------
29+
30+
Minor Analysis Improvements
31+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
32+
33+
C#
34+
""
35+
36+
* Changed the precision of the :code:`cs/equality-on-floats` query from medium to high.
37+
38+
JavaScript/TypeScript
39+
"""""""""""""""""""""
40+
41+
* Type information is now propagated more precisely through :code:`Promise.all()` calls,
42+
leading to more resolved calls and more sources and sinks being detected.
43+
44+
Query Metadata Changes
45+
~~~~~~~~~~~~~~~~~~~~~~
46+
47+
C/C++
48+
"""""
49+
50+
* The tag :code:`external/cwe/cwe-14` has been removed from :code:`cpp/memset-may-be-deleted` and the tag :code:`external/cwe/cwe-014` has been added.
51+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cpp/count-untrusted-data-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
52+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cpp/count-untrusted-data-external-api-ir` and the tag :code:`external/cwe/cwe-020` has been added.
53+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cpp/untrusted-data-to-external-api-ir` and the tag :code:`external/cwe/cwe-020` has been added.
54+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cpp/untrusted-data-to-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
55+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cpp/late-check-of-function-argument` and the tag :code:`external/cwe/cwe-020` has been added.
56+
57+
C#
58+
""
59+
60+
* The tag :code:`external/cwe/cwe-13` has been removed from :code:`cs/password-in-configuration` and the tag :code:`external/cwe/cwe-013` has been added.
61+
* The tag :code:`external/cwe/cwe-11` has been removed from :code:`cs/web/debug-binary` and the tag :code:`external/cwe/cwe-011` has been added.
62+
* The tag :code:`external/cwe/cwe-16` has been removed from :code:`cs/web/large-max-request-length` and the tag :code:`external/cwe/cwe-016` has been added.
63+
* The tag :code:`external/cwe/cwe-16` has been removed from :code:`cs/web/request-validation-disabled` and the tag :code:`external/cwe/cwe-016` has been added.
64+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cs/count-untrusted-data-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
65+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cs/serialization-check-bypass` and the tag :code:`external/cwe/cwe-020` has been added.
66+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`cs/untrusted-data-to-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
67+
* The tag :code:`external/cwe/cwe-12` has been removed from :code:`cs/web/missing-global-error-handler` and the tag :code:`external/cwe/cwe-012` has been added.
68+
69+
Golang
70+
""""""
71+
72+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`go/count-untrusted-data-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
73+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`go/incomplete-hostname-regexp` and the tag :code:`external/cwe/cwe-020` has been added.
74+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`go/regex/missing-regexp-anchor` and the tag :code:`external/cwe/cwe-020` has been added.
75+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`go/suspicious-character-in-regex` and the tag :code:`external/cwe/cwe-020` has been added.
76+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`go/untrusted-data-to-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
77+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`go/untrusted-data-to-unknown-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
78+
* The tag :code:`external/cwe/cwe-90` has been removed from :code:`go/ldap-injection` and the tag :code:`external/cwe/cwe-090` has been added.
79+
* The tag :code:`external/cwe/cwe-74` has been removed from :code:`go/dsn-injection` and the tag :code:`external/cwe/cwe-074` has been added.
80+
* The tag :code:`external/cwe/cwe-74` has been removed from :code:`go/dsn-injection-local` and the tag :code:`external/cwe/cwe-074` has been added.
81+
* The tag :code:`external/cwe/cwe-79` has been removed from :code:`go/html-template-escaping-passthrough` and the tag :code:`external/cwe/cwe-079` has been added.
82+
83+
Java/Kotlin
84+
"""""""""""
85+
86+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`java/count-untrusted-data-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
87+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`java/untrusted-data-to-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
88+
* The tag :code:`external/cwe/cwe-93` has been removed from :code:`java/netty-http-request-or-response-splitting` and the tag :code:`external/cwe/cwe-093` has been added.
89+
90+
JavaScript/TypeScript
91+
"""""""""""""""""""""
92+
93+
* The tag :code:`external/cwe/cwe-79` has been removed from :code:`js/disabling-electron-websecurity` and the tag :code:`external/cwe/cwe-079` has been added.
94+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`js/count-untrusted-data-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
95+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`js/untrusted-data-to-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
96+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`js/untrusted-data-to-external-api-more-sources` and the tag :code:`external/cwe/cwe-020` has been added.
97+
98+
Python
99+
""""""
100+
101+
* The tags :code:`security/cwe/cwe-94` and :code:`security/cwe/cwe-95` have been removed from :code:`py/use-of-input` and the tags :code:`external/cwe/cwe-094` and :code:`external/cwe/cwe-095` have been added.
102+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`py/count-untrusted-data-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
103+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`py/untrusted-data-to-external-api` and the tag :code:`external/cwe/cwe-020` has been added.
104+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`py/cookie-injection` and the tag :code:`external/cwe/cwe-020` has been added.
105+
* The tag :code:`external/cwe/cwe-20` has been removed from :code:`py/incomplete-url-substring-sanitization` and the tag :code:`external/cwe/cwe-020` has been added.
106+
* The tag :code:`external/cwe/cwe-94` has been removed from :code:`py/js2py-rce` and the tag :code:`external/cwe/cwe-094` has been added.
107+
108+
Ruby
109+
""""
110+
111+
* The precision of :code:`rb/useless-assignment-to-local` has been adjusted from :code:`medium` to :code:`high`.
112+
* The tag :code:`external/cwe/cwe-94` has been removed from :code:`rb/server-side-template-injection` and the tag :code:`external/cwe/cwe-094` has been added.
113+
114+
Language Libraries
115+
------------------
116+
117+
Bug Fixes
118+
~~~~~~~~~
119+
120+
C/C++
121+
"""""
122+
123+
* Fixed an infinite loop in :code:`semmle.code.cpp.rangeanalysis.new.RangeAnalysis` when computing ranges in very large and complex function bodies.
124+
125+
Minor Analysis Improvements
126+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
127+
128+
JavaScript/TypeScript
129+
"""""""""""""""""""""
130+
131+
* Enhanced modeling of the `fastify <https://www.npmjs.com/package/fastify>`__ framework to support the :code:`all` route handler method.
132+
* Improved modeling of the |link-code-shelljs-1|_ and |link-code-async-shelljs-2|_ libraries by adding support for the :code:`which`, :code:`cmd`, :code:`asyncExec` and :code:`env`.
133+
* Added support for the :code:`fastify` :code:`addHook` method.
134+
135+
Python
136+
""""""
137+
138+
* Added modeling for the :code:`hdbcli` PyPI package as a database library implementing PEP 249.
139+
* Added header write model for :code:`send_header` in :code:`http.server`.
140+
141+
New Features
142+
~~~~~~~~~~~~
143+
144+
Java/Kotlin
145+
"""""""""""
146+
147+
* Kotlin versions up to 2.2.0\ *x* are now supported. Support for the Kotlin 1.5.x series is dropped (so the minimum Kotlin version is now 1.6.0).
148+
149+
Swift
150+
"""""
151+
152+
* Added AST nodes :code:`UnsafeCastExpr`, :code:`TypeValueExpr`, :code:`IntegerType`, and :code:`BuiltinFixedArrayType` that correspond to new nodes added by Swift 6.1.
153+
154+
.. |link-code-shelljs-1| replace:: :code:`shelljs`\
155+
.. _link-code-shelljs-1: https://www.npmjs.com/package/shelljs
156+
157+
.. |link-code-async-shelljs-2| replace:: :code:`async-shelljs`\
158+
.. _link-code-async-shelljs-2: https://www.npmjs.com/package/async-shelljs
159+

‎docs/codeql/codeql-overview/codeql-changelog/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
1111
.. toctree::
1212
:maxdepth: 1
1313

14+
codeql-cli-2.21.3
1415
codeql-cli-2.21.2
1516
codeql-cli-2.21.1
1617
codeql-cli-2.21.0

0 commit comments

Comments
 (0)