Updated versions & `CHANGELOG.md` for `v2.25.1-next.1` release by data-douser · Pull Request #197 · advanced-security/codeql-development-mcp-server

data-douser · 2026-03-30T20:33:10Z

Release notes to use for the planned v2.25.1-next.1 release:

## [v2.25.1-next.1] — 2026-03-30

### Highlights

- **Rust language support** — Added first-class Rust support with all standard tool queries (PrintAST, PrintCFG, CallGraphFrom, CallGraphTo, CallGraphFromTo) plus a new `rust_ast.md` language resource, bringing the total supported languages to 10. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>)
- **SqliteStore backend + 14 new opt-in tools** — Replaced `lowdb` with `sql.js` (SQLite compiled to asm.js) as the unified storage backend. Introduced annotation (6 tools), audit (4 tools), and query result cache (4 tools) suites, gated by `ENABLE_ANNOTATION_TOOLS`. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>)
- **VS Code workspace folder change fix** — The ql-mcp server now correctly restarts with a fresh environment when workspace folders are added or removed, fixing a bug where the server was left in a broken state. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/196">#196</a>)

### Added

#### MCP Server Tools

| Tool | Description |
| ---- | ----------- |
| `annotation_create` | Create general-purpose notes and bookmarks on any entity. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `annotation_get` | Retrieve a specific annotation by ID. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `annotation_list` | List all annotations, optionally filtered. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `annotation_update` | Update an existing annotation. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `annotation_delete` | Delete an annotation by ID. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `annotation_search` | Full-text search across annotations. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `audit_store_findings` | Store repo-keyed findings for MRVA triage workflows. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `audit_list_findings` | List audit findings for a repository. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `audit_add_notes` | Add notes to audit findings. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `audit_clear_repo` | Clear all findings for a repository. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `query_results_cache_lookup` | Look up cached query results with subset retrieval. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `query_results_cache_retrieve` | Retrieve cached query results with line range, grep, and SARIF filters. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `query_results_cache_clear` | Clear the query result cache. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `query_results_cache_compare` | Compare query results across databases. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |

#### CodeQL Query Packs

| Pack | Description |
| ---- | ----------- |
| Rust tool queries | `PrintAST`, `PrintCFG`, `CallGraphFrom`, `CallGraphTo`, `CallGraphFromTo` for Rust, using entity-based function resolution via `getResolvedTarget()`. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>) |

#### MCP Server Resources

| URI | Description |
| --- | ----------- |
| `codeql://languages/rust/ast` | Comprehensive Rust AST class reference for CodeQL query development, with verified accessor predicates. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>) |

#### Infrastructure &amp; CI/CD

- Added Rust to all CI/CD workflows: `query-unit-tests.yml`, `release.yml`, `release-codeql.yml`. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>)
- Added client integration tests for Rust PrintAST and CallGraphFrom. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>)
- Added client integration tests for all 14 new annotation/audit/cache tools and an MRVA triage workflow end-to-end test. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>)
- Added `.prettierignore` entries for `*.ql`, `*.qll`, and query documentation `.md` files to prevent prettier from overriding CodeQL formatting. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>)

### Changed

#### MCP Server Tools

| Tool | Change |
| ---- | ------ |
| `codeql_query_run` | Results are now auto-cached in the SqliteStore after SARIF interpretation. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `extractQueryMetadata` | LRU in-memory cache with mtime-based invalidation for improved performance. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |
| `resolveDatabasePath` | Module-level Map cache to avoid redundant filesystem scans. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>) |

#### VS Code Extension

- `McpProvider.requestRestart()` now atomically invalidates the environment cache and bumps a `+rN` revision suffix, ensuring VS Code reliably detects version changes and restarts the server. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/196">#196</a>)
- Extension version is cached once at construction time instead of reading `package.json` synchronously on every definition query. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/196">#196</a>)

#### Infrastructure &amp; CI/CD

- Extracted `database-resolver.ts`, `query-resolver.ts`, `result-processor.ts`, and `codeql-version.ts` from monolithic files, reducing `cli-tool-registry.ts` by ~375 lines. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>)
- CodeQL CLI actual-vs-target version mismatch detection at startup with logged warnings. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>)

### Fixed

- **VS Code workspace folder changes left server in broken state** — `fireDidChange()` was called with an identical version string after folder add/remove, causing VS Code to stop but not restart the server. `requestRestart()` now invalidates the environment cache and uses a monotonically increasing `+rN` revision suffix. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/196">#196</a>)
- **`requestRestart()` did not invalidate environment cache** — Callers had to manually invalidate the env cache before calling `requestRestart()`, which was undocumented. Now handled internally. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/196">#196</a>)

### Dependencies

- Replaced `lowdb` with `sql.js` (asm.js build, zero native dependencies). (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/169">#169</a>)
- Added `codeql/rust-all: 0.2.10` as a CodeQL pack dependency for Rust tool queries. (<a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>)

### New Contributors

- <a href="https://github.com/apps/copilot-swe-agent">@Copilot</a> made their first contribution in <a href="https://github.com/advanced-security/codeql-development-mcp-server/pull/195">#195</a>

**Full Changelog**: <a href="https://github.com/advanced-security/codeql-development-mcp-server/compare/v2.25.1...v2.25.1-next.1">`v2.25.1...v2.25.1-next.1`</a>

github-actions · 2026-03-30T20:33:26Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 3 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 700a39c.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

package-lock.json

Package	Version	License	Issue Type
client	2.25.1-next.1	Null	Unknown License
extensions/vscode	2.25.1-next.1	Null	Unknown License
server	2.25.1-next.1	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/client	2.25.1-next.1	Unknown	Unknown
npm/extensions/vscode	2.25.1-next.1	Unknown	Unknown
npm/server	2.25.1-next.1	Unknown	Unknown

Scanned Files

package-lock.json

Copilot

Pull request overview

Prepares the repository for the 2.25.1-next.1 pre-release by updating version strings across the monorepo packages and CodeQL tool packs, and by drafting corresponding notes under [Unreleased] in CHANGELOG.md.

Changes:

Bump package and extension versions to 2.25.1-next.1 (root, server, client, VS Code extension, lockfile).
Bump all language tool-pack versions (server/ql/**/tools/{src,test}/codeql-pack.yml) to 2.25.1-next.1.
Add [Unreleased] changelog entries summarizing recent features/fixes intended for the upcoming pre-release.

Reviewed changes

Copilot reviewed 26 out of 29 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`server/src/codeql-development-mcp-server.ts`	Bumps the server’s runtime `VERSION` constant to `2.25.1-next.1`.
`server/ql/swift/tools/test/codeql-pack.yml`	Bumps Swift tool-pack test pack version to `2.25.1-next.1`.
`server/ql/swift/tools/src/codeql-pack.yml`	Bumps Swift tool-pack source pack version to `2.25.1-next.1`.
`server/ql/rust/tools/test/codeql-pack.yml`	Bumps Rust tool-pack test pack version to `2.25.1-next.1`.
`server/ql/rust/tools/src/codeql-pack.yml`	Bumps Rust tool-pack source pack version to `2.25.1-next.1`.
`server/ql/ruby/tools/test/codeql-pack.yml`	Bumps Ruby tool-pack test pack version to `2.25.1-next.1`.
`server/ql/ruby/tools/src/codeql-pack.yml`	Bumps Ruby tool-pack source pack version to `2.25.1-next.1`.
`server/ql/python/tools/test/codeql-pack.yml`	Bumps Python tool-pack test pack version to `2.25.1-next.1`.
`server/ql/python/tools/src/codeql-pack.yml`	Bumps Python tool-pack source pack version to `2.25.1-next.1`.
`server/ql/javascript/tools/test/codeql-pack.yml`	Bumps JavaScript tool-pack test pack version to `2.25.1-next.1`.
`server/ql/javascript/tools/src/codeql-pack.yml`	Bumps JavaScript tool-pack source pack version to `2.25.1-next.1`.
`server/ql/java/tools/test/codeql-pack.yml`	Bumps Java tool-pack test pack version to `2.25.1-next.1`.
`server/ql/java/tools/src/codeql-pack.yml`	Bumps Java tool-pack source pack version to `2.25.1-next.1`.
`server/ql/go/tools/test/codeql-pack.yml`	Bumps Go tool-pack test pack version to `2.25.1-next.1`.
`server/ql/go/tools/src/codeql-pack.yml`	Bumps Go tool-pack source pack version to `2.25.1-next.1`.
`server/ql/csharp/tools/test/codeql-pack.yml`	Bumps C# tool-pack test pack version to `2.25.1-next.1`.
`server/ql/csharp/tools/src/codeql-pack.yml`	Bumps C# tool-pack source pack version to `2.25.1-next.1`.
`server/ql/cpp/tools/test/codeql-pack.yml`	Bumps C/C++ tool-pack test pack version to `2.25.1-next.1`.
`server/ql/cpp/tools/src/codeql-pack.yml`	Bumps C/C++ tool-pack source pack version to `2.25.1-next.1`.
`server/ql/actions/tools/test/codeql-pack.yml`	Bumps Actions tool-pack test pack version to `2.25.1-next.1`.
`server/ql/actions/tools/src/codeql-pack.yml`	Bumps Actions tool-pack source pack version to `2.25.1-next.1`.
`server/package.json`	Bumps server workspace package version to `2.25.1-next.1`.
`server/dist/codeql-development-mcp-server.js`	Updates the bundled/dist server version constant to `2.25.1-next.1`.
`package.json`	Bumps root workspace version to `2.25.1-next.1`.
`package-lock.json`	Updates lockfile workspace versions to `2.25.1-next.1`.
`extensions/vscode/package.json`	Bumps VS Code extension version to `2.25.1-next.1`.
`client/package.json`	Bumps client workspace version to `2.25.1-next.1`.
`CHANGELOG.md`	Adds `[Unreleased]` notes describing the set of changes expected for the upcoming pre-release.

Comments suppressed due to low confidence (2)

CHANGELOG.md:39

The Unreleased “MCP Server Resources” table uses | Name | Description |, but elsewhere in the changelog resources are consistently listed as | URI | Description | (e.g., CHANGELOG.md:191-199). Since the entry value is a URI (codeql://languages/rust/ast), renaming the header to URI would better match established convention.

| Name                          | Description                                                                                                                                                                       |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `codeql://languages/rust/ast` | Rust AST reference resource with verified accessor predicates for CodeQL query development. ([#195](https://github.com/advanced-security/codeql-development-mcp-server/pull/195)) |

CHANGELOG.md:45

The Unreleased “CodeQL Query Packs” table uses | Name | Description |, but other pack tables in this changelog use Pack as the first column header (e.g., CHANGELOG.md:139-141). Consider changing the header from Name to Pack for consistency.

| Name            | Description                                                                                                                                                                                 |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Rust tools pack | Added `PrintAST`, `PrintCFG`, `CallGraphFrom`, `CallGraphTo`, and `CallGraphFromTo` support for Rust. ([#195](https://github.com/advanced-security/codeql-development-mcp-server/pull/195)) |

Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/7111cd8d-f783-4b5a-a656-2e04dda2e1f9 Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

Updated versions & CHANGELOG for v2.25.1-next.1 release

030403e

data-douser self-assigned this Mar 30, 2026

data-douser requested review from a team and enyil as code owners March 30, 2026 20:33

data-douser added the documentation Improvements or additions to documentation label Mar 30, 2026

Copilot AI review requested due to automatic review settings March 30, 2026 20:33

data-douser added the enhancement New feature or request label Mar 30, 2026

github-license-compliance bot found potential problems Mar 30, 2026

View reviewed changes

Comment thread package-lock.json Fixed

Copilot started reviewing on behalf of data-douser March 30, 2026 20:33 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

Comment thread CHANGELOG.md Outdated

Copilot started work on behalf of data-douser March 30, 2026 21:05 View session

fix: use consistent column headers in CHANGELOG.md Unreleased tables

700a39c

Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/7111cd8d-f783-4b5a-a656-2e04dda2e1f9 Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>

Copilot finished work on behalf of data-douser March 30, 2026 21:12

data-douser merged commit 86fe331 into main Mar 30, 2026
29 checks passed

data-douser deleted the dd/changelog/v2.25.1-next.1 branch March 30, 2026 22:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updated versions & `CHANGELOG.md` for `v2.25.1-next.1` release#197

Updated versions & `CHANGELOG.md` for `v2.25.1-next.1` release#197
data-douser merged 2 commits intomainfrom
dd/changelog/v2.25.1-next.1

data-douser commented Mar 30, 2026 •

edited by Copilot AI

Loading

Uh oh!

Uh oh!

github-actions bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

data-douser commented Mar 30, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Snapshot Warnings

License Issues

package-lock.json

OpenSSF Scorecard

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

data-douser commented Mar 30, 2026 •

edited by Copilot AI

Loading

github-actions bot commented Mar 30, 2026 •

edited

Loading