diff --git a/CHANGELOG.md b/CHANGELOG.md index dad374a..0e93e38 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,57 @@ you know what to do). --> +## Release 2.25.2 (2026-04-15) + +### Miscellaneous + +- The build of Eclipse Temurin OpenJDK that is used to run the CodeQL + CLI has been updated to version 21.0.10. + +## Release 2.25.1 (2026-03-27) + +### Bug Fixes + +- Fixed a bug where extraction could fail on YAML files containing emoji. + +### Miscellaneous + +- Upgraded snakeyaml (which is a dependency of jackson-dataformat-yaml) from 2.3 to 2.6. + +## Release 2.25.0 (2026-03-19) + +### Breaking Changes + +- `codeql database interpret-results` and `codeql database analyze` no longer attempt to reconstruct file baseline information from databases created with CLI versions before 2.11.2. + +### Bug Fixes + +- Upgraded Jackson library from 2.16.1 to 2.18.6 to address a high-severity denial of service vulnerability (GHSA-72hv-8253-57qq) in jackson-core's async JSON parser. +- Upgraded snakeyaml (which is a dependency of jackson-dataformat-yaml) from 2.2 to 2.3. + +## Release 2.24.4 (2026-03-16) + +This release was skipped. + +## Release 2.24.3 (2026-03-05) + +### Bug Fixes + +- Fixed a race condition that could cause flaky failures in overlay CodeQL tests. Test extraction now skips `*.testproj` directories by name, preventing interference from concurrently cleaned-up test databases. +- Fixed spurious "OOPS" warnings that could appear in help output for commands using mutually exclusive option groups, such as `codeql query run`. + +## Release 2.24.2 (2026-02-20) + +### Bug Fixes + +- Fixed SARIF output to generate RFC 1738 compatible file URIs. File URIs now always use the `file:///` format instead of `file:/` for better interoperability with SARIF consumers. + +## Release 2.24.1 (2026-02-05) + +### Miscellaneous + +- The vulnerable xwork-core 2.3.37 test dependency (CVE-2025-68493) has been removed. The CodeQL Java library has been updated to support both legacy Struts 2.x-6.x package names and Struts 7.x package names for analyzing user code. + ## Release 2.24.0 (2026-01-26) ### Miscellaneous @@ -76,7 +127,7 @@ This release was skipped. } ``` - The `--permissive` option was removed, as under some circumstances it would break the extractor's ability to parse valid C++ code. When calling the extractor directly, + The `--permissive` option was removed, as under some circumstances it would break the extractor's ability to parse valid C++ code. When calling the extractor directly, `--permissive` should no longer be passed. The above code will fail to parse, and we recommend the code being made `const`-correct. @@ -225,7 +276,7 @@ This release was skipped. - On macOS the `CODEQL_TRACER_RELOCATION_EXCLUDE` environment variable can now be used to exclude certain paths from the tracer relocation and tracing process. This environment variable accepts newline-separated regex patterns of binaries - to be excluded. + to be excluded. ## Release 2.20.7 (2025-03-18) diff --git a/LICENSE.md b/LICENSE.md index 3ef032d..e872708 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -33,7 +33,7 @@ below: * Use the Software to demonstrate the Software. * Test CodeQL queries that are released under an OSI-approved - Licence to confirm that new versions of those queries continue to + License to confirm that new versions of those queries continue to find the right vulnerabilities. Here's what you may also do with the Software, but only with an Open @@ -169,7 +169,7 @@ provision of these Terms will not constitute a waiver of such right or provision. _Entire Agreement._ These Terms, together with any open source -software licenses referenced above, constitutes the entire agreement +software licenses referenced above, constitute the entire agreement between you and GitHub regarding your use of the Software, superseding any prior agreements between you and GitHub (including, but not limited to, any prior versions of these Terms) regarding such use.