39 Pull requests merged by 20 people

• C++: Add summary models for openssl and sqlite

  #19492 merged May 16, 2025

• Quantum: Expand OpenSSL cipher modeling and fix JCA false reporting of intermediate calls

  #19509 merged May 16, 2025

• C++: Minor cleanup of qltest options

  #19508 merged May 16, 2025

• C++: Make node.asExpr() instanceof ClassAggregateLiteral satisfiable

  #19501 merged May 16, 2025

• Python: Extract files in hidden dirs by default

  #19424 merged May 16, 2025

• C++: Update static call target resolution semantics in dataflow

  #19500 merged May 16, 2025

• C++: Exclude tests in model generation

  #19498 merged May 16, 2025

• C#: Improve the query cs/gethashcode-is-not-defined.

  #19497 merged May 16, 2025

• JS: Merge ES6Class to FunctionStyleClass

  #19356 merged May 16, 2025

• Rust: Fix semantic merge conflict

  #19503 merged May 16, 2025

• Ruby printAst: fix order for synth children of real parents

  #19448 merged May 15, 2025

• Adding comprehensive docs for customizing actions/unpinned-tag query

  #19427 merged May 15, 2025

• Rust: Type inference and path resolution for builtins

  #19474 merged May 15, 2025

• C++: Fix IR edge case where there are no function calls taking an argument

  #19493 merged May 15, 2025

• Rust: expand attribute macros

  #19334 merged May 14, 2025

• Go: Remove redundant code in IR::ExtractTupleElementInstruction.getResultType() and expand tests

  #19484 merged May 14, 2025

• Swift: add new TypeValueExpr to CFG

  #19490 merged May 14, 2025

• C#: Add cs/call-to-gc to the code quality suite.

  #19482 merged May 14, 2025

• Ruby: More captured exit read nodes

  #19483 merged May 14, 2025

• C#: Improve precision of cs/uncontrolled-format-string.

  #19271 merged May 14, 2025

• Shared: Generate more value-preserving flow summaries

  #19433 merged May 14, 2025

• Shared: Generate more value-preserving flow summaries

  #19443 merged May 14, 2025

• Post-release preparation for codeql-cli-2.21.3

  #19489 merged May 13, 2025

• Release preparation for version 2.21.3

  #19488 merged May 13, 2025

• Add support for Kotlin 2.2.0; drop Kotlin 1.5.x

  #19402 merged May 13, 2025

• C++: Fix infinite range analysis loop on invalid SSA

  #19477 merged May 13, 2025

• Update changelogs for CodeQL CLI 2.21.2

  #19462 merged May 13, 2025

• Rust: Add LiteralExpr sub classes

  #19475 merged May 13, 2025

• JS: Overhaul import resolution

  #19391 merged May 13, 2025

• JS: Generate flow summaries from summaryModels; only generate steps as a fallback

  #19445 merged May 13, 2025

• Rust: Add Operation class

  #19454 merged May 13, 2025

• ruby: adjust precision of rb/useless-assignment-to-local

  #19476 merged May 13, 2025

• Shared: Remove the language-specific model generator scripts

  #19452 merged May 13, 2025

• Rust: Add tests for web frameworks as taint sources

  #19466 merged May 13, 2025

• Add new stubs definitions to System.Web

  #19456 merged May 13, 2025

• Add CodeQL Quantum models and queries (Java, C++) to experimental

  #19469 merged May 12, 2025

• Rust: Update query severities

  #19449 merged May 12, 2025

• Rust: Use the new 'quality' tag.

  #19455 merged May 12, 2025

• Rust: Update generated models for core and std

  #19440 merged May 12, 2025

13 Pull requests opened by 12 people

• C#: Re-generate .NET 9 Runtime models.

  #19480 opened May 13, 2025

• Fix typo from `occured` to `occurred`

  #19485 opened May 13, 2025

• Go: Check more things while running tests

  #19491 opened May 14, 2025

• actions: add some missing permissions

  #19494 opened May 14, 2025

• Kotlin: clean up alternate-version code now that v1.5.x support is dropped

  #19496 opened May 15, 2025

• Rust: Bulk model generator

  #19499 opened May 15, 2025

• Rust: Make current MaD predicates deprecated

  #19502 opened May 15, 2025

• All: delete outdated deprecations

  #19504 opened May 16, 2025

• Java: Use the shared BasicBlocks library.

  #19505 opened May 16, 2025

• Rust: extract source files of depdendencies

  #19506 opened May 16, 2025

• Exclude some queries from query suites by lowering their precision.

  #19507 opened May 16, 2025

• C/CPP: Update FlowSources to add wmain

  #19510 opened May 16, 2025

• C++: Make `node.asExpr() instanceof ArrayAggregateLiteral` satisfiable

  #19511 opened May 16, 2025

4 Issues closed by 4 people

• Support Kotlin 2.2.0-Beta

  #19349 closed May 16, 2025

• v2.21.2rule error

  #19495 closed May 15, 2025

• Error downloading packages etc

  #19465 closed May 14, 2025

• C++: Data flow and member templates

  #19236 closed May 12, 2025

2 Issues opened by 2 people

• The strings were concatenated, making it impossible to match the path.

  #19479 opened May 13, 2025

• How to speed up the execution

  #19471 opened May 11, 2025

19 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Rust: Support non-universal `impl` blocks

  #19372 commented on May 16, 2025 • 43 new comments

• Rust: Recognize more sensitive data sources

  #19470 commented on May 13, 2025 • 2 new comments

• Add Actix framework modeling and import to Frameworks.qll

  #19461 commented on May 13, 2025 • 0 new comments

• Add Microsoft to trusted actions owner

  #19450 commented on May 16, 2025 • 0 new comments

• Go: promote `html-template-escaping-bypass-xss`

  #19386 commented on May 13, 2025 • 0 new comments

• Rust: upgrade `rust-analyzer` to 0.0.274

  #19314 commented on May 16, 2025 • 0 new comments

• [DO NOT MERGE] Prior: Test PR

  #19285 commented on May 15, 2025 • 0 new comments

• Rust: Make `SummarizedCallable` extend `Function` instead of `string`

  #19268 commented on May 13, 2025 • 0 new comments

• JS: QL-side type/name resolution for TypeScript and JSDoc

  #19078 commented on May 13, 2025 • 0 new comments

• C++: Update expected test results and compiler version documentation after frontend update

  #18931 commented on May 13, 2025 • 0 new comments

• [JAVA] [GRADLE] OOM Issue with GitHub Autobuilder for Kotlin

  #19374 commented on May 16, 2025 • 0 new comments

• Swift: Xcode 16.2 - could not build module

  #19284 commented on May 16, 2025 • 0 new comments

• [Java] Issue resolving dependences

  #19458 commented on May 15, 2025 • 0 new comments

• `js/weak-cryptographic-algorithm`/`BrokenCryptoAlgorithm` got 25-30x slower

  #18604 commented on May 14, 2025 • 0 new comments

• False positive in C/C++ dead code detection

  #19399 commented on May 14, 2025 • 0 new comments

• CodeQL for php

  #14000 commented on May 13, 2025 • 0 new comments

• C++: Multi-Level Member Function Calls Not Modeled as DataFlow::Node

  #19457 commented on May 13, 2025 • 0 new comments

• CodeQL DB missing half the source C files, getting compiled with no errors.

  #19066 commented on May 12, 2025 • 0 new comments

• RegExpInjection takes 6 hours to scan the TypeScript repo after 2.20.2

  #18584 commented on May 12, 2025 • 0 new comments