Skip to content

Commit 7a4b88f

Browse files
oscarsjoscarsj
authored
Merge pull request #21586 from github/oscarsj/hotfix-2.25.1-base
Release 2.25.1 preparations
2 parents 970b57c + fe565ba commit 7a4b88f

File tree

3 files changed

+254
-0
lines changed

3 files changed

+254
-0
lines changed

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.24.3.rst‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
.. _codeql-cli-2.24.3:
2+
3+
==========================
4+
CodeQL 2.24.3 (2026-03-05)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.24.3 runs a total of 491 security queries when configured with the Default suite (covering 166 CWE). The Extended suite enables an additional 135 queries (covering 35 more CWE).
18+
19+
CodeQL CLI
20+
----------
21+
22+
Bug Fixes
23+
~~~~~~~~~
24+
25+
* Fixed a race condition that could cause flaky failures in overlay CodeQL tests. Test extraction now skips :code:`*.testproj` directories by name, preventing interference from concurrently cleaned-up test databases.
26+
* Fixed spurious "OOPS" warnings that could appear in help output for commands using mutually exclusive option groups, such as :code:`codeql query run`.
27+
28+
Query Packs
29+
-----------
30+
31+
Minor Analysis Improvements
32+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
33+
34+
Java/Kotlin
35+
"""""""""""
36+
37+
* The Java extractor and QL libraries now support Java 26.
38+
* Java analysis now selects the Java version to use informed by Maven POM files across all project modules. It also tries to use Java 17 or higher for all Maven projects if possible, for improved build compatibility.
39+
40+
Rust
41+
""""
42+
43+
* The macro resolution metric has been removed from :code:`rust/diagnostic/database-quality`. This metric was found to be an unreliable indicator of database quality in many cases, leading to false alarms on the tool status page.
44+
45+
Language Libraries
46+
------------------
47+
48+
Bug Fixes
49+
~~~~~~~~~
50+
51+
C/C++
52+
"""""
53+
54+
* The :code:`allowInterproceduralFlow` predicate of must-flow data flow configurations now correctly handles direct recursion.
55+
56+
C#
57+
""
58+
59+
* Fixed an issue where the body of a partial member could be extracted twice. When both a *defining* and an *implementing* declaration exist, only the *implementing* declaration is now extracted.
60+
61+
Breaking Changes
62+
~~~~~~~~~~~~~~~~
63+
64+
C/C++
65+
"""""
66+
67+
* CodeQL version 2.24.2 accidentally introduced a syntactical breaking change to :code:`BarrierGuard<...>::getAnIndirectBarrierNode` and :code:`InstructionBarrierGuard<...>::getAnIndirectBarrierNode`. These breaking changes have now been reverted so that the original code compiles again.
68+
* :code:`MustFlow`, the inter-procedural must-flow data flow analysis library, has been re-worked to use parameterized modules. Like in the case of data flow and taint tracking, instead of extending the :code:`MustFlowConfiguration` class, the user should now implement a module with the :code:`MustFlow::ConfigSig` signature, and instantiate the :code:`MustFlow::Global` parameterized module with the implemented module.
69+
70+
Python
71+
""""""
72+
73+
* The :code:`Metrics` library no longer contains code that depends on the points-to analysis. The removed functionality has instead been moved to the :code:`LegacyPointsTo` module, to classes like :code:`ModuleMetricsWithPointsTo` etc. If you depend on any of these classes, you must now remember to import :code:`LegacyPointsTo`, and use the appropriate types in order to use the points-to-based functionality.
74+
75+
Major Analysis Improvements
76+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
77+
78+
Python
79+
""""""
80+
81+
* The CodeQL Python libraries have been updated to be compatible with overlay evaluation. This should result in a significant speedup on analyses for which a base database already exists. Note that it may be necessary to add :code:`overlay[local?] module;` to user-managed libraries that extend classes that are now marked as :code:`overlay[local]`.
82+
83+
Minor Analysis Improvements
84+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
85+
86+
C/C++
87+
"""""
88+
89+
* Refactored the "Year field changed using an arithmetic operation without checking for leap year" query (:code:`cpp/leap-year/unchecked-after-arithmetic-year-modification`) to address large numbers of false positive results.
90+
91+
C#
92+
""
93+
94+
* C# 14: Added support for partial events.
95+
* C# 14: Added support for the :code:`field` keyword in properties.
96+
97+
Java/Kotlin
98+
"""""""""""
99+
100+
* Some modelling which previously only worked for Java EE packages beginning with "javax" will now also work for Java EE packages beginning with "jakarta" as well. This may lead to some alert changes.
101+
102+
JavaScript/TypeScript
103+
"""""""""""""""""""""
104+
105+
* Added support for React components wrapped by :code:`observer` from :code:`mobx-react` and :code:`mobx-react-lite`.
106+
107+
Python
108+
""""""
109+
110+
* Added new full SSRF sanitization barrier from the new AntiSSRF library.
111+
* When a guard such as :code:`isSafe(x)` is defined, we now also automatically handle :code:`isSafe(x) == true` and :code:`isSafe(x) != false`.
112+
113+
Ruby
114+
""""
115+
116+
* We now track taint flow through :code:`Shellwords.escape` and :code:`Shellwords.shellescape` for all queries except command injection, for which they are sanitizers.
117+
118+
Rust
119+
""""
120+
121+
* Added support for neutral models (:code:`extensible: neutralModel`) to control where generated source, sink and flow summary models apply.

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.25.0.rst‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
.. _codeql-cli-2.25.0:
2+
3+
==========================
4+
CodeQL 2.25.0 (2026-03-19)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.25.0 runs a total of 491 security queries when configured with the Default suite (covering 166 CWE). The Extended suite enables an additional 135 queries (covering 35 more CWE).
18+
19+
CodeQL CLI
20+
----------
21+
22+
Breaking Changes
23+
~~~~~~~~~~~~~~~~
24+
25+
* :code:`codeql database interpret-results` and :code:`codeql database analyze` no longer attempt to reconstruct file baseline information from databases created with CLI versions before 2.11.2.
26+
27+
Bug Fixes
28+
~~~~~~~~~
29+
30+
* Upgraded Jackson library from 2.16.1 to 2.18.6 to address a high-severity denial of service vulnerability (GHSA-72hv-8253-57qq) in jackson-core's async JSON parser.
31+
* Upgraded snakeyaml (which is a dependency of jackson-dataformat-yaml) from 2.2 to 2.3.
32+
33+
Language Libraries
34+
------------------
35+
36+
Breaking Changes
37+
~~~~~~~~~~~~~~~~
38+
39+
Java/Kotlin
40+
"""""""""""
41+
42+
* The Java control flow graph (CFG) implementation has been completely rewritten. The CFG now includes additional nodes to more accurately represent certain constructs. This also means that any existing code that implicitly relies on very specific details about the CFG may need to be updated.
43+
The CFG now only includes the nodes that are reachable from the entry point.
44+
Additionally, the following breaking changes have been made:
45+
46+
* :code:`ControlFlowNode.asCall` has been removed - use :code:`Call.getControlFlowNode` instead.
47+
* :code:`ControlFlowNode.getEnclosingStmt` has been removed.
48+
* :code:`ControlFlow::ExprNode` has been removed.
49+
* :code:`ControlFlow::StmtNode` has been removed.
50+
* :code:`ControlFlow::Node` has been removed - this was merely an alias of
51+
:code:`ControlFlowNode`, which is still available.
52+
* Previously deprecated predicates on :code:`BasicBlock` have been removed.
53+
54+
Major Analysis Improvements
55+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
56+
57+
Swift
58+
"""""
59+
60+
* Upgraded to allow analysis of Swift 6.2.4.
61+
62+
Minor Analysis Improvements
63+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
64+
65+
C/C++
66+
"""""
67+
68+
* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
69+
70+
C#
71+
""
72+
73+
* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
74+
* Added :code:`System.Net.WebSockets::ReceiveAsync` as a remote flow source.
75+
* Added reverse taint flow from implicit conversion operator calls to their arguments.
76+
* Added post-update nodes for struct-type arguments, allowing data flow out of method calls via those arguments.
77+
* C# 14: Added support for partial constructors.
78+
79+
Golang
80+
""""""
81+
82+
* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
83+
84+
Java/Kotlin
85+
"""""""""""
86+
87+
* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
88+
* The class :code:`Assignment` now extends :code:`BinaryExpr`. Uses of :code:`BinaryExpr` may in some cases need slight adjustment.
89+
90+
JavaScript/TypeScript
91+
"""""""""""""""""""""
92+
93+
* Added support for browser-specific source kinds (:code:`browser`, :code:`browser-url-query`, :code:`browser-url-fragment`, :code:`browser-url-path`, :code:`browser-url`, :code:`browser-window-name`, :code:`browser-message-event`) that can be used in data extensions to model sources in browser environments.
94+
* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
95+
96+
Python
97+
""""""
98+
99+
* The call graph resolution no longer considers methods marked using |link-code-typing-overload-1|_ as valid targets. This ensures that only the method that contains the actual implementation gets resolved as a target.
100+
* Inline expectations test comments, which are of the form :code:`# $ tag` or :code:`# $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
101+
102+
Ruby
103+
""""
104+
105+
* Inline expectations test comments, which are of the form :code:`# $ tag` or :code:`# $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
106+
107+
Swift
108+
"""""
109+
110+
* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
111+
112+
Rust
113+
""""
114+
115+
* Inline expectations test comments, which are of the form :code:`// $ tag` or :code:`// $ tag=value`, are now parsed more strictly and will not be recognized if there isn't a space after the :code:`$` symbol.
116+
* Added neutral models to inhibit spurious generated sink models for :code:`map` and :code:`from`. This fixes some false positive query results.
117+
118+
Shared Libraries
119+
----------------
120+
121+
New Features
122+
~~~~~~~~~~~~
123+
124+
Dataflow Analysis
125+
"""""""""""""""""
126+
127+
* Two new flow features :code:`FeatureEscapesSourceCallContext` and :code:`FeatureEscapesSourceCallContextOrEqualSourceSinkCallContext` have been added. The former implies that the sink must be reached from the source by escaping the source call context, that is, flow must either return from the callable containing the source or use a jump-step before reaching the sink. The latter is the disjunction of the former and the existing :code:`FeatureEqualSourceSinkCallContext` flow feature.
128+
129+
.. |link-code-typing-overload-1| replace:: :code:`@typing.overload`\
130+
.. _link-code-typing-overload-1: https://typing.python.org/en/latest/spec/overload.html#overloads
131+

‎docs/codeql/codeql-overview/codeql-changelog/index.rst‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ A list of queries for each suite and language `is available here <https://docs.g
1111
.. toctree::
1212
:maxdepth: 1
1313

14+
codeql-cli-2.25.0
15+
codeql-cli-2.24.3
1416
codeql-cli-2.24.2
1517
codeql-cli-2.24.1
1618
codeql-cli-2.24.0

0 commit comments

Comments
 (0)