From f6b18e6381860d453f6d3bff8de4f99eeb0a218b Mon Sep 17 00:00:00 2001 From: Chris Smowton Date: Thu, 22 Feb 2024 11:39:00 +0000 Subject: [PATCH 1/2] Update CHANGELOG.md for release 2.16.3 --- CHANGELOG.md | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7eac2fb..6042687 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,32 @@ you know what to do). --> +## Release 2.16.3 (2024-02-22) + +### Security patches + +- Fixes CVE-2024-25129, a limited data exfiltration vulnerability that + could be triggered by untrusted databases or QL packs. See the + [security advisory](https://github.com/github/codeql-cli-binaries/security/advisories/GHSA-gf8p-v3g3-3wph) + for more information. + +### New Features + +- A new extractor option has been added to the Python extractor. + Set the new extractor option `python_executable_name` or the environment variable + `CODEQL_EXTRACTOR_PYTHON_OPTION_PYTHON_EXECUTABLE_NAME` to one of `py`, `python` or `python3` + to override the default Python executable search and selection behavior of the Python extractor. + For example, on Windows machines, the Python extractor will expect to find `py.exe` on the + system `PATH` by default. Setting this extractor option or environment variable allows + overriding this behavior to look for a different name like `python` or `python3`. + More detail can be found in [the extractor option documentation](https://docs.github.com/en/code-security/codeql-cli/using-the-advanced-functionality-of-the-codeql-cli/extractor-options). + +### Bugs fixed + +- Fixed a bug where CodeQL may produce an invalid database when it exhausts + all available ID numbers. Now it detects the condition and reports an + error instead. + ## Release 2.16.2 (2024-02-12) - There are no user-facing changes in this release. @@ -99,7 +125,7 @@ - Fixed an issue where CodeQL would sometimes incorrectly report that no files were scanned when running on Windows. - This affected the human-readable summary produced by `codeql database analyze` + This affected the human-readable summary produced by `codeql database analyze` and `codeql database interpret-results`, but did not impact the file coverage information produced in the SARIF output and displayed on the tool status page. - When analyzing Swift codebases, CodeQL build tracing will now ignore the From d6584c92c977a8553f4368fb38479a69335159b3 Mon Sep 17 00:00:00 2001 From: Chris Smowton Date: Thu, 22 Feb 2024 11:43:27 +0000 Subject: [PATCH 2/2] Replace nbsp with regular space --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6042687..7e3c5f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -125,7 +125,7 @@ - Fixed an issue where CodeQL would sometimes incorrectly report that no files were scanned when running on Windows. - This affected the human-readable summary produced by `codeql database analyze` + This affected the human-readable summary produced by `codeql database analyze` and `codeql database interpret-results`, but did not impact the file coverage information produced in the SARIF output and displayed on the tool status page. - When analyzing Swift codebases, CodeQL build tracing will now ignore the