github · aibaars · Apr 1, 2025 · Mar 31, 2025
@@ -1,3 +1,10 @@
+## 0.4.6
+
+### Bug Fixes
+
+* The query `actions/code-injection/medium` now produces alerts for injection
+  vulnerabilities on `pull_request` events.
+
 ## 0.4.5
 
 No user-facing changes.

@@ -1,5 +1,6 @@
----
-category: fix
----
+## 0.4.6
+
+### Bug Fixes
+
 * The query `actions/code-injection/medium` now produces alerts for injection
-  vulnerabilities on `pull_request` events.
+  vulnerabilities on `pull_request` events.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.5
+lastReleaseVersion: 0.4.6
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.6-dev
+version: 0.4.6
 library: true
 warnOnImplicitThis: true
 dependencies:

@@ -1,3 +1,11 @@
+## 0.5.3
+
+### Bug Fixes
+
+* Fixed typos in the query and alert titles for the queries
+  `actions/envpath-injection/critical`, `actions/envpath-injection/medium`,
+  `actions/envvar-injection/critical`, and `actions/envvar-injection/medium`.
+
 ## 0.5.2
 
 No user-facing changes.
@@ -7,9 +15,10 @@ No user-facing changes.
 ### Bug Fixes
 
 * The `actions/unversioned-immutable-action` query will no longer report any alerts, since the
-  Immutable Actions feature is not yet available for customer use. The query remains in the
-  default Code Scanning suites for use internal to GitHub. Once the Immutable Actions feature is
-  available, the query will be updated to report alerts again.
+  Immutable Actions feature is not yet available for customer use. The query has also been moved
+  to the experimental folder and will not be used in code scanning unless it is explicitly added
+  to a code scanning configuration. Once the Immutable Actions feature is available, the query will
+  be updated to report alerts again.
 
 ## 0.5.0
 

@@ -1,6 +1,7 @@
----
-category: fix
----
+## 0.5.3
+
+### Bug Fixes
+
 * Fixed typos in the query and alert titles for the queries
   `actions/envpath-injection/critical`, `actions/envpath-injection/medium`,
-  `actions/envvar-injection/critical`, and `actions/envvar-injection/medium`.
+  `actions/envvar-injection/critical`, and `actions/envvar-injection/medium`.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.2
+lastReleaseVersion: 0.5.3
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.5.3-dev
+version: 0.5.3
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

@@ -1,3 +1,9 @@
+## 4.1.0
+
+### New Features
+
+* Added `Node.asUncertainDefinition` and `Node.asCertainDefinition` to the `DataFlow::Node` class for querying whether a definition overwrites the entire destination buffer.
+
 ## 4.0.3
 
 No user-facing changes.

@@ -1,4 +1,5 @@
----
-category: feature
----
-* Added `Node.asUncertainDefinition` and `Node.asCertainDefinition` to the `DataFlow::Node` class for querying whether a definition overwrites the entire destination buffer.
+## 4.1.0
+
+### New Features
+
+* Added `Node.asUncertainDefinition` and `Node.asCertainDefinition` to the `DataFlow::Node` class for querying whether a definition overwrites the entire destination buffer.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 4.0.3
+lastReleaseVersion: 4.1.0
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 4.0.4-dev
+version: 4.1.0
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

@@ -1,3 +1,10 @@
+## 1.3.7
+
+### Minor Analysis Improvements
+
+* Fixed a bug in the models for Microsoft's Active Template Library (ATL).
+* The query "Use of basic integral type" (`cpp/jpl-c/basic-int-types`) no longer produces alerts for the standard fixed width integer types (`int8_t`, `uint8_t`, etc.), and the `_Bool` and `bool` types.
+
 ## 1.3.6
 
 No user-facing changes.

@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
-* The query "Use of basic integral type" (`cpp/jpl-c/basic-int-types`) no longer produces alerts for the standard fixed width integer types (`int8_t`, `uint8_t`, etc.), and the `_Bool` and `bool` types.
+## 1.3.7
+
+### Minor Analysis Improvements
+
+* Fixed a bug in the models for Microsoft's Active Template Library (ATL).
+* The query "Use of basic integral type" (`cpp/jpl-c/basic-int-types`) no longer produces alerts for the standard fixed width integer types (`int8_t`, `uint8_t`, etc.), and the `_Bool` and `bool` types.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.3.6
+lastReleaseVersion: 1.3.7
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.3.7-dev
+version: 1.3.7
 groups:
   - cpp
   - queries

@@ -1,3 +1,7 @@
+## 1.7.37
+
+No user-facing changes.
+
 ## 1.7.36
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.37
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.36
+lastReleaseVersion: 1.7.37
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.37-dev
+version: 1.7.37
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,7 @@
+## 1.7.37
+
+No user-facing changes.
+
 ## 1.7.36
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.37
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.36
+lastReleaseVersion: 1.7.37
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.37-dev
+version: 1.7.37
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,10 @@
+## 5.1.3
+
+### Minor Analysis Improvements
+
+* The models for `System.Uri` have been modified to better model the flow of tainted URIs.
+* Modeled parameter passing between Blazor parent and child components.
+
 ## 5.1.2
 
 No user-facing changes.

@@ -0,0 +1,6 @@
+## 5.1.3
+
+### Minor Analysis Improvements
+
+* The models for `System.Uri` have been modified to better model the flow of tainted URIs.
+* Modeled parameter passing between Blazor parent and child components.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 5.1.2
+lastReleaseVersion: 5.1.3
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 5.1.3-dev
+version: 5.1.3
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

@@ -1,3 +1,18 @@
+## 1.1.0
+
+### New Queries
+
+* Added a new query, `csharp/path-combine`, to recommend against the `Path.Combine` method due to it silently discarding its earlier parameters if later parameters are rooted.
+
+### Minor Analysis Improvements
+
+* Improved dependency resolution in `build-mode: none` extraction to handle failing `dotnet restore` processes that managed to download a subset of the dependencies before the failure.
+* Increase query precision for `cs/useless-gethashcode-call` by not flagging calls to `GetHashCode` on `uint`, `long` and `ulong`.
+* Increase query precision for `cs/constant-condition` and allow the use of discards in switch/case statements and also take the condition (if any) into account.
+* The `cs/local-not-disposed` query no longer flags un-disposed tasks as this is often not needed (explained [here](https://devblogs.microsoft.com/pfxteam/do-i-need-to-dispose-of-tasks/)).
+* Increase query precision for `cs/useless-assignment-to-local` and `cs/constant-condition` when *unknown* types are involved (mostly relevant for `build-mode: none` databases).
+* Don't consider an if-statement to be *useless* in `cs/useless-if-statement` if there is at least a comment.
+
 ## 1.0.19
 
 No user-facing changes.

@@ -0,0 +1,14 @@
+## 1.1.0
+
+### New Queries
+
+* Added a new query, `csharp/path-combine`, to recommend against the `Path.Combine` method due to it silently discarding its earlier parameters if later parameters are rooted.
+
+### Minor Analysis Improvements
+
+* Improved dependency resolution in `build-mode: none` extraction to handle failing `dotnet restore` processes that managed to download a subset of the dependencies before the failure.
+* Increase query precision for `cs/useless-gethashcode-call` by not flagging calls to `GetHashCode` on `uint`, `long` and `ulong`.
+* Increase query precision for `cs/constant-condition` and allow the use of discards in switch/case statements and also take the condition (if any) into account.
+* The `cs/local-not-disposed` query no longer flags un-disposed tasks as this is often not needed (explained [here](https://devblogs.microsoft.com/pfxteam/do-i-need-to-dispose-of-tasks/)).
+* Increase query precision for `cs/useless-assignment-to-local` and `cs/constant-condition` when *unknown* types are involved (mostly relevant for `build-mode: none` databases).
+* Don't consider an if-statement to be *useless* in `cs/useless-if-statement` if there is at least a comment.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.19
+lastReleaseVersion: 1.1.0
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.0.20-dev
+version: 1.1.0
 groups:
   - csharp
   - queries

@@ -1,3 +1,7 @@
+## 1.0.20
+
+No user-facing changes.
+
 ## 1.0.19
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.0.20
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.19
+lastReleaseVersion: 1.0.20
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.20-dev
+version: 1.0.20
 groups:
   - go
   - queries

@@ -1,3 +1,11 @@
+## 4.2.2
+
+### Minor Analysis Improvements
+
+* We no longer track taint into a `sync.Map` via the key of a key-value pair, since we do not model any way in which keys can be read from a `sync.Map`.
+* `database` source models have been added for v1 and v2 of the `github.com/couchbase/gocb` package.
+* Added `database` source models for the `github.com/Masterminds/squirrel` ORM package.
+
 ## 4.2.1
 
 No user-facing changes.

@@ -0,0 +1,7 @@
+## 4.2.2
+
+### Minor Analysis Improvements
+
+* We no longer track taint into a `sync.Map` via the key of a key-value pair, since we do not model any way in which keys can be read from a `sync.Map`.
+* `database` source models have been added for v1 and v2 of the `github.com/couchbase/gocb` package.
+* Added `database` source models for the `github.com/Masterminds/squirrel` ORM package.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 4.2.1
+lastReleaseVersion: 4.2.2
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 4.2.2-dev
+version: 4.2.2
 groups: go
 dbscheme: go.dbscheme
 extractor: go