From 5a77128a8bcf9b090d76b6dc09cf53f0ecd20815 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 23 Mar 2026 11:27:05 +0000
Subject: [PATCH 001/146] C++: Disable cpp/implicit-function-declaration on BMN
databases.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 6a55557cf70b..007ef71a1630 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -17,6 +17,11 @@ import TooFewArguments
import TooManyArguments
import semmle.code.cpp.commons.Exclusions
+/*
+ * This query is not compatible with build mode: none databases, and has
+ * no results on those databases.
+ */
+
predicate locInfo(Locatable e, File file, int line, int col) {
e.getFile() = file and
e.getLocation().getStartLine() = line and
@@ -39,6 +44,7 @@ predicate isCompiledAsC(File f) {
from FunctionDeclarationEntry fdeIm, FunctionCall fc
where
isCompiledAsC(fdeIm.getFile()) and
+ not any(Compilation c).buildModeNone() and
not isFromMacroDefinition(fc) and
fdeIm.isImplicit() and
sameLocation(fdeIm, fc) and
From 39056e44771373f23bcd8a561bbf60a6c0122e60 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Mon, 23 Mar 2026 12:28:12 +0000
Subject: [PATCH 002/146] C++: Change note.
---
.../change-notes/2026-03-23-implicit-function-declaration.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
diff --git a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
new file mode 100644
index 000000000000..8c2c431ec24c
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.
From 55d16e8781602f1e6542e3b4bd6d38c7d2250975 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Wed, 25 Mar 2026 10:58:16 +0100
Subject: [PATCH 003/146] Remove false-positive `command-injection` sink model
for `step-security/harden-runner`
The `allowed-endpoints` input only flows to `execFileSync("echo", [content])`
(no shell) and `fs.writeFileSync` (JSON config), neither of which is a
command injection vector.
Fixes https://github.com/github/codeql/issues/21568
---
.../ql/lib/ext/manual/step-security_harden-runner.model.yml | 6 ------
1 file changed, 6 deletions(-)
delete mode 100644 actions/ql/lib/ext/manual/step-security_harden-runner.model.yml
diff --git a/actions/ql/lib/ext/manual/step-security_harden-runner.model.yml b/actions/ql/lib/ext/manual/step-security_harden-runner.model.yml
deleted file mode 100644
index 129c8beb0202..000000000000
--- a/actions/ql/lib/ext/manual/step-security_harden-runner.model.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-extensions:
- - addsTo:
- pack: codeql/actions-all
- extensible: actionsSinkModel
- data:
- - ["step-security/harden-runner", "*", "input.allowed-endpoints", "command-injection", "manual"]
From e8075455913cfcfc05dfb02d882396c08ed24c8d Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 26 Mar 2026 09:08:34 +0100
Subject: [PATCH 004/146] Remove false positive `docker/build-push-action`
`context` sink model
The `context` input is passed as a single array element through
`docker/actions-toolkit` and `@actions/exec` all the way to
`child_process.spawn()`, which does not perform shell splitting.
No code injection is possible.
Fixes https://github.com/github/codeql/issues/21428
---
.../ql/lib/ext/manual/docker_build-push-action.model.yml | 6 ------
1 file changed, 6 deletions(-)
delete mode 100644 actions/ql/lib/ext/manual/docker_build-push-action.model.yml
diff --git a/actions/ql/lib/ext/manual/docker_build-push-action.model.yml b/actions/ql/lib/ext/manual/docker_build-push-action.model.yml
deleted file mode 100644
index 116c231c30a4..000000000000
--- a/actions/ql/lib/ext/manual/docker_build-push-action.model.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-extensions:
- - addsTo:
- pack: codeql/actions-all
- extensible: actionsSinkModel
- data:
- - ["docker/build-push-action", "*", "input.context", "code-injection", "manual"]
\ No newline at end of file
From e0bc18c22866b5808817754bd820d1da53478214 Mon Sep 17 00:00:00 2001
From: Paolo Tranquilli
Date: Thu, 26 Mar 2026 09:11:25 +0100
Subject: [PATCH 005/146] Add changenote for false positive sink model removals
---
.../change-notes/2026-03-26-remove-false-positive-sinks.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md
diff --git a/actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md b/actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md
new file mode 100644
index 000000000000..20ccc6d6c024
--- /dev/null
+++ b/actions/ql/lib/change-notes/2026-03-26-remove-false-positive-sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Removed false positive injection sink models for the `context` input of `docker/build-push-action` and the `allowed-endpoints` input of `step-security/harden-runner`.
From 824d004a2700080b8fb4bb3d2e3a02f85fd8e30a Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 14:40:54 +0000
Subject: [PATCH 006/146] Python: Convert BindToAllInterfaces test to inline
expectations
---
.../Security/CVE-2018-1281/BindToAllInterfaces.qlref | 3 ++-
.../Security/CVE-2018-1281/BindToAllInterfaces_test.py | 10 +++++-----
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref
index f06cc3d869dc..6396fd918634 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.qlref
@@ -1 +1,2 @@
-Security/CVE-2018-1281/BindToAllInterfaces.ql
\ No newline at end of file
+query: Security/CVE-2018-1281/BindToAllInterfaces.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
\ No newline at end of file
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index bbab44d81033..93ed0364a295 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -2,11 +2,11 @@
# binds to all interfaces, insecure
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-s.bind(('0.0.0.0', 31137))
+s.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds to all interfaces, insecure
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-s.bind(('', 4040))
+s.bind(('', 4040)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds only to a dedicated interface, secure
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
@@ -14,13 +14,13 @@
# binds to all interfaces, insecure
ALL_LOCALS = "0.0.0.0"
-s.bind((ALL_LOCALS, 9090))
+s.bind((ALL_LOCALS, 9090)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds to all interfaces, insecure
tup = (ALL_LOCALS, 8080)
-s.bind(tup)
+s.bind(tup) # $ Alert[py/bind-socket-all-network-interfaces]
# IPv6
s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
-s.bind(("::", 8080)) # NOT OK
+s.bind(("::", 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
From 1ecd9e83b8566c9028cec3d33097f157a2b3bde1 Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 14:51:59 +0000
Subject: [PATCH 007/146] Python: Add test cases for BindToAllInterfaces FNs
Adds test cases from github/codeql#21582 demonstrating false negatives:
- Address stored in class attribute (`self.bind_addr`)
- `os.environ.get` with insecure default value
- `gevent.socket` (alternative socket module)
---
.../CVE-2018-1281/BindToAllInterfaces_test.py | 32 +++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index 93ed0364a295..5a13aa9c4e3a 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -24,3 +24,35 @@
# IPv6
s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
s.bind(("::", 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
+
+
+# FN cases from https://github.com/github/codeql/issues/21582
+
+# Address stored in a class attribute
+class Server:
+ def __init__(self):
+ self.bind_addr = '0.0.0.0'
+ self.port = 31137
+
+ def start(self):
+ s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ s.bind((self.bind_addr, self.port)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+
+server = Server()
+server.start()
+
+# os.environ.get with insecure default
+import os
+host = os.environ.get('APP_HOST', '0.0.0.0')
+s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+s.bind((host, 8080)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+
+# gevent.socket (alternative socket module)
+from gevent import socket as gsocket
+gs = gsocket.socket(gsocket.AF_INET, gsocket.SOCK_STREAM)
+gs.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+
+# eventlet.green.socket (another alternative socket module)
+from eventlet.green import socket as esocket
+es = esocket.socket(esocket.AF_INET, esocket.SOCK_STREAM)
+es.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
From c439fc5d4519e8688115bc297a818f3420279e3e Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 14:53:18 +0000
Subject: [PATCH 008/146] Python: Replace type tracking with global data-flow
This takes care of most of the false negatives from the preceding
commit.
Additionally, we add models for some known wrappers of `socket.socket`
from the `gevent` and `eventlet` packages.
---
.../python/frameworks/Eventlet.model.yml | 9 ++++
.../semmle/python/frameworks/Gevent.model.yml | 7 +++
.../semmle/python/frameworks/Stdlib.model.yml | 4 ++
.../CVE-2018-1281/BindToAllInterfaces.ql | 51 +++++--------------
.../BindToAllInterfaces.expected | 4 ++
.../CVE-2018-1281/BindToAllInterfaces_test.py | 8 +--
shared/mad/codeql/mad/ModelValidation.qll | 2 +-
7 files changed, 43 insertions(+), 42 deletions(-)
create mode 100644 python/ql/lib/semmle/python/frameworks/Eventlet.model.yml
create mode 100644 python/ql/lib/semmle/python/frameworks/Gevent.model.yml
diff --git a/python/ql/lib/semmle/python/frameworks/Eventlet.model.yml b/python/ql/lib/semmle/python/frameworks/Eventlet.model.yml
new file mode 100644
index 000000000000..f60b9218819d
--- /dev/null
+++ b/python/ql/lib/semmle/python/frameworks/Eventlet.model.yml
@@ -0,0 +1,9 @@
+extensions:
+ - addsTo:
+ pack: codeql/python-all
+ extensible: typeModel
+ data:
+ # See https://eventlet.readthedocs.io/en/latest/patching.html
+ - ['socket.socket', 'eventlet', 'Member[green].Member[socket].Member[socket].ReturnValue']
+ # eventlet also re-exports as eventlet.socket for convenience
+ - ['socket.socket', 'eventlet', 'Member[socket].Member[socket].ReturnValue']
diff --git a/python/ql/lib/semmle/python/frameworks/Gevent.model.yml b/python/ql/lib/semmle/python/frameworks/Gevent.model.yml
new file mode 100644
index 000000000000..974ecedd0730
--- /dev/null
+++ b/python/ql/lib/semmle/python/frameworks/Gevent.model.yml
@@ -0,0 +1,7 @@
+extensions:
+ - addsTo:
+ pack: codeql/python-all
+ extensible: typeModel
+ data:
+ # See https://www.gevent.org/api/gevent.socket.html
+ - ['socket.socket', 'gevent', 'Member[socket].Member[socket].ReturnValue']
diff --git a/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml b/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
index a01bf1b40ba6..5b50dff313e7 100644
--- a/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
+++ b/python/ql/lib/semmle/python/frameworks/Stdlib.model.yml
@@ -27,6 +27,8 @@ extensions:
extensible: sinkModel
data:
- ["zipfile.ZipFile","Member[extractall].Argument[0,path:]", "path-injection"]
+ # See https://docs.python.org/3/library/socket.html#socket.socket.bind
+ - ["socket.socket", "Member[bind].Argument[0,address:]", "bind-socket-all-interfaces"]
- addsTo:
pack: codeql/python-all
@@ -184,6 +186,8 @@ extensions:
pack: codeql/python-all
extensible: typeModel
data:
+ # See https://docs.python.org/3/library/socket.html#socket.socket
+ - ['socket.socket', 'socket', 'Member[socket].ReturnValue']
# See https://docs.python.org/3/library/urllib.parse.html#urllib.parse.urlparse
- ["urllib.parse.ParseResult~Subclass", 'urllib', 'Member[parse].Member[urlparse]']
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 5e2e27b3bf40..39d0c6b6237d 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -14,7 +14,8 @@
import python
import semmle.python.dataflow.new.DataFlow
-import semmle.python.ApiGraphs
+import semmle.python.dataflow.new.TaintTracking
+private import semmle.python.frameworks.data.ModelsAsData
/** Gets a hostname that can be used to bind to all interfaces. */
private string vulnerableHostname() {
@@ -26,45 +27,21 @@ private string vulnerableHostname() {
]
}
-/** Gets a reference to a hostname that can be used to bind to all interfaces. */
-private DataFlow::TypeTrackingNode vulnerableHostnameRef(DataFlow::TypeTracker t, string hostname) {
- t.start() and
- exists(StringLiteral allInterfacesStringLiteral | hostname = vulnerableHostname() |
- allInterfacesStringLiteral.getText() = hostname and
- result.asExpr() = allInterfacesStringLiteral
- )
- or
- exists(DataFlow::TypeTracker t2 | result = vulnerableHostnameRef(t2, hostname).track(t2, t))
-}
-
-/** Gets a reference to a hostname that can be used to bind to all interfaces. */
-DataFlow::Node vulnerableHostnameRef(string hostname) {
- vulnerableHostnameRef(DataFlow::TypeTracker::end(), hostname).flowsTo(result)
-}
+private module BindToAllInterfacesConfig implements DataFlow::ConfigSig {
+ predicate isSource(DataFlow::Node source) {
+ source.asExpr().(StringLiteral).getText() = vulnerableHostname()
+ }
-/** Gets a reference to a tuple for which the first element is a hostname that can be used to bind to all interfaces. */
-private DataFlow::TypeTrackingNode vulnerableAddressTuple(DataFlow::TypeTracker t, string hostname) {
- t.start() and
- result.asExpr() = any(Tuple tup | tup.getElt(0) = vulnerableHostnameRef(hostname).asExpr())
- or
- exists(DataFlow::TypeTracker t2 | result = vulnerableAddressTuple(t2, hostname).track(t2, t))
+ predicate isSink(DataFlow::Node sink) {
+ ModelOutput::sinkNode(sink, "bind-socket-all-interfaces")
+ }
}
-/** Gets a reference to a tuple for which the first element is a hostname that can be used to bind to all interfaces. */
-DataFlow::Node vulnerableAddressTuple(string hostname) {
- vulnerableAddressTuple(DataFlow::TypeTracker::end(), hostname).flowsTo(result)
-}
-
-/**
- * Gets an instance of `socket.socket` using _some_ address family.
- *
- * See https://docs.python.org/3/library/socket.html
- */
-API::Node socketInstance() { result = API::moduleImport("socket").getMember("socket").getReturn() }
+private module BindToAllInterfacesFlow = TaintTracking::Global;
-from DataFlow::CallCfgNode bindCall, DataFlow::Node addressArg, string hostname
+from DataFlow::Node source, DataFlow::Node sink, DataFlow::CallCfgNode bindCall, string hostname
where
- bindCall = socketInstance().getMember("bind").getACall() and
- addressArg = bindCall.getArg(0) and
- addressArg = vulnerableAddressTuple(hostname)
+ BindToAllInterfacesFlow::flow(source, sink) and
+ bindCall.getArg(0) = sink and
+ hostname = source.asExpr().(StringLiteral).getText()
select bindCall.asExpr(), "'" + hostname + "' binds a socket to all interfaces."
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
index 86c67af4eaef..d657c2f14db4 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
@@ -3,3 +3,7 @@
| BindToAllInterfaces_test.py:17:1:17:26 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
| BindToAllInterfaces_test.py:21:1:21:11 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
| BindToAllInterfaces_test.py:26:1:26:20 | Attribute() | '::' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:39:9:39:43 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:48:1:48:20 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:53:1:53:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+| BindToAllInterfaces_test.py:58:1:58:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index 5a13aa9c4e3a..8d5d7998101d 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -36,7 +36,7 @@ def __init__(self):
def start(self):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
- s.bind((self.bind_addr, self.port)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+ s.bind((self.bind_addr, self.port)) # $ Alert[py/bind-socket-all-network-interfaces]
server = Server()
server.start()
@@ -45,14 +45,14 @@ def start(self):
import os
host = os.environ.get('APP_HOST', '0.0.0.0')
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-s.bind((host, 8080)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+s.bind((host, 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
# gevent.socket (alternative socket module)
from gevent import socket as gsocket
gs = gsocket.socket(gsocket.AF_INET, gsocket.SOCK_STREAM)
-gs.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+gs.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
# eventlet.green.socket (another alternative socket module)
from eventlet.green import socket as esocket
es = esocket.socket(esocket.AF_INET, esocket.SOCK_STREAM)
-es.bind(('0.0.0.0', 31137)) # $ MISSING: Alert[py/bind-socket-all-network-interfaces]
+es.bind(('0.0.0.0', 31137)) # $ Alert[py/bind-socket-all-network-interfaces]
diff --git a/shared/mad/codeql/mad/ModelValidation.qll b/shared/mad/codeql/mad/ModelValidation.qll
index 042fb4200dd1..5eaa78626ab3 100644
--- a/shared/mad/codeql/mad/ModelValidation.qll
+++ b/shared/mad/codeql/mad/ModelValidation.qll
@@ -48,7 +48,7 @@ module KindValidation {
// CPP-only currently
"remote-sink",
// Python-only currently, but may be shared in the future
- "prompt-injection"
+ "bind-socket-all-interfaces", "prompt-injection"
]
or
this.matches([
From c0ce6699a535488181d122316c04609e8afd9735 Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 15:10:59 +0000
Subject: [PATCH 009/146] Python: Add change note
---
.../2026-03-26-improve-bind-all-interfaces-query.md | 5 +++++
1 file changed, 5 insertions(+)
create mode 100644 python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
diff --git a/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
new file mode 100644
index 000000000000..b4b5464b5037
--- /dev/null
+++ b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+
+- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognised as socket binding operations.
From c9832c330af360b4204971cb1c250b7633da0c1d Mon Sep 17 00:00:00 2001
From: Taus
Date: Thu, 26 Mar 2026 20:13:55 +0000
Subject: [PATCH 010/146] Python: Convert BindToAllInterfaces to path-problem
Now that we're using global data-flow, we might as well make use of the
fact that we know where the source is.
---
.../CVE-2018-1281/BindToAllInterfaces.ql | 16 +++--
.../BindToAllInterfaces.expected | 72 ++++++++++++++++---
.../CVE-2018-1281/BindToAllInterfaces_test.py | 6 +-
3 files changed, 75 insertions(+), 19 deletions(-)
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 39d0c6b6237d..2b62b184fd4e 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -2,7 +2,7 @@
* @name Binding a socket to all network interfaces
* @description Binding a socket to all interfaces opens it up to traffic from any IPv4 address
* and is therefore associated with security risks.
- * @kind problem
+ * @kind path-problem
* @tags security
* external/cwe/cwe-200
* @problem.severity error
@@ -16,6 +16,7 @@ import python
import semmle.python.dataflow.new.DataFlow
import semmle.python.dataflow.new.TaintTracking
private import semmle.python.frameworks.data.ModelsAsData
+import BindToAllInterfacesFlow::PathGraph
/** Gets a hostname that can be used to bind to all interfaces. */
private string vulnerableHostname() {
@@ -39,9 +40,10 @@ private module BindToAllInterfacesConfig implements DataFlow::ConfigSig {
private module BindToAllInterfacesFlow = TaintTracking::Global;
-from DataFlow::Node source, DataFlow::Node sink, DataFlow::CallCfgNode bindCall, string hostname
-where
- BindToAllInterfacesFlow::flow(source, sink) and
- bindCall.getArg(0) = sink and
- hostname = source.asExpr().(StringLiteral).getText()
-select bindCall.asExpr(), "'" + hostname + "' binds a socket to all interfaces."
+private import BindToAllInterfacesFlow
+
+from PathNode source, PathNode sink
+where flowPath(source, sink)
+select sink.getNode(), source, sink,
+ "Binding a socket to all interfaces (using $@) is a security risk.", source.getNode(),
+ "'" + source.getNode().asExpr().(StringLiteral).getText() + "'"
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
index d657c2f14db4..0b96b2df6508 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces.expected
@@ -1,9 +1,63 @@
-| BindToAllInterfaces_test.py:5:1:5:26 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:9:1:9:18 | Attribute() | '' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:17:1:17:26 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:21:1:21:11 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:26:1:26:20 | Attribute() | '::' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:39:9:39:43 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:48:1:48:20 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:53:1:53:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
-| BindToAllInterfaces_test.py:58:1:58:27 | Attribute() | '0.0.0.0' binds a socket to all interfaces. |
+#select
+| BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | '' |
+| BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | '::' |
+| BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+| BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | Binding a socket to all interfaces (using $@) is a security risk. | BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | '0.0.0.0' |
+edges
+| BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | provenance | |
+| BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | provenance | |
+| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:34:9:34:12 | [post] ControlFlowNode for self [Attribute bind_addr] | BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:34:9:34:12 | [post] ControlFlowNode for self [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:37:15:37:18 | ControlFlowNode for self [Attribute bind_addr] | BindToAllInterfaces_test.py:39:17:39:20 | ControlFlowNode for self [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:39:17:39:20 | ControlFlowNode for self [Attribute bind_addr] | BindToAllInterfaces_test.py:39:17:39:30 | ControlFlowNode for Attribute | provenance | |
+| BindToAllInterfaces_test.py:39:17:39:30 | ControlFlowNode for Attribute | BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | BindToAllInterfaces_test.py:37:15:37:18 | ControlFlowNode for self [Attribute bind_addr] | provenance | |
+| BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | provenance | |
+| BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | provenance | dict.get |
+| BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+| BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | provenance | Sink:MaD:63 |
+nodes
+| BindToAllInterfaces_test.py:5:9:5:17 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:5:9:5:24 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:9:9:9:10 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:9:9:9:16 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:16:1:16:10 | ControlFlowNode for ALL_LOCALS | semmle.label | ControlFlowNode for ALL_LOCALS |
+| BindToAllInterfaces_test.py:16:14:16:22 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:17:9:17:24 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:20:1:20:3 | ControlFlowNode for tup | semmle.label | ControlFlowNode for tup |
+| BindToAllInterfaces_test.py:21:8:21:10 | ControlFlowNode for tup | semmle.label | ControlFlowNode for tup |
+| BindToAllInterfaces_test.py:26:9:26:12 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:26:9:26:18 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:33:18:33:21 | ControlFlowNode for self [Return] [Attribute bind_addr] | semmle.label | ControlFlowNode for self [Return] [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:34:9:34:12 | [post] ControlFlowNode for self [Attribute bind_addr] | semmle.label | [post] ControlFlowNode for self [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:34:26:34:34 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:37:15:37:18 | ControlFlowNode for self [Attribute bind_addr] | semmle.label | ControlFlowNode for self [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:39:17:39:20 | ControlFlowNode for self [Attribute bind_addr] | semmle.label | ControlFlowNode for self [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:39:17:39:30 | ControlFlowNode for Attribute | semmle.label | ControlFlowNode for Attribute |
+| BindToAllInterfaces_test.py:39:17:39:41 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:41:1:41:6 | ControlFlowNode for server [Attribute bind_addr] | semmle.label | ControlFlowNode for server [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:41:10:41:17 | ControlFlowNode for Server() [Attribute bind_addr] | semmle.label | ControlFlowNode for Server() [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:42:1:42:6 | ControlFlowNode for server [Attribute bind_addr] | semmle.label | ControlFlowNode for server [Attribute bind_addr] |
+| BindToAllInterfaces_test.py:46:1:46:4 | ControlFlowNode for host | semmle.label | ControlFlowNode for host |
+| BindToAllInterfaces_test.py:46:8:46:44 | ControlFlowNode for Attribute() | semmle.label | ControlFlowNode for Attribute() |
+| BindToAllInterfaces_test.py:46:35:46:43 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:48:9:48:18 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:53:10:53:18 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:53:10:53:25 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+| BindToAllInterfaces_test.py:58:10:58:18 | ControlFlowNode for StringLiteral | semmle.label | ControlFlowNode for StringLiteral |
+| BindToAllInterfaces_test.py:58:10:58:25 | ControlFlowNode for Tuple | semmle.label | ControlFlowNode for Tuple |
+subpaths
diff --git a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
index 8d5d7998101d..3c267ff2f296 100644
--- a/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
+++ b/python/ql/test/query-tests/Security/CVE-2018-1281/BindToAllInterfaces_test.py
@@ -13,7 +13,7 @@
s.bind(('84.68.10.12', 8080))
# binds to all interfaces, insecure
-ALL_LOCALS = "0.0.0.0"
+ALL_LOCALS = "0.0.0.0" # $ Source
s.bind((ALL_LOCALS, 9090)) # $ Alert[py/bind-socket-all-network-interfaces]
# binds to all interfaces, insecure
@@ -31,7 +31,7 @@
# Address stored in a class attribute
class Server:
def __init__(self):
- self.bind_addr = '0.0.0.0'
+ self.bind_addr = '0.0.0.0' # $ Source
self.port = 31137
def start(self):
@@ -43,7 +43,7 @@ def start(self):
# os.environ.get with insecure default
import os
-host = os.environ.get('APP_HOST', '0.0.0.0')
+host = os.environ.get('APP_HOST', '0.0.0.0') # $ Source
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((host, 8080)) # $ Alert[py/bind-socket-all-network-interfaces]
From 10fddc7b960879d188e58cdf02a9a532cd844cea Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:40:11 +0000
Subject: [PATCH 011/146] Add barriers and barrier guards to MaD format
explanations
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 10 +++++++++-
.../code/csharp/dataflow/internal/ExternalFlow.qll | 11 +++++++++--
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 10 +++++++++-
.../ql/lib/semmle/code/java/dataflow/ExternalFlow.qll | 11 +++++++++--
.../frameworks/data/internal/ApiGraphModels.qll | 7 ++++++-
.../frameworks/data/internal/ApiGraphModels.qll | 7 ++++++-
.../ruby/frameworks/data/internal/ApiGraphModels.qll | 7 ++++++-
.../codeql/rust/dataflow/internal/ModelsAsData.qll | 11 +++++++++--
8 files changed, 63 insertions(+), 11 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index 7cf3b937ac51..1ec501a85dd6 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -10,6 +10,10 @@
* `namespace; type; subtypes; name; signature; ext; input; kind`
* - Summaries:
* `namespace; type; subtypes; name; signature; ext; input; output; kind`
+ * - Barriers:
+ * `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
@@ -86,7 +90,11 @@
* value, and
* - flow from the _second_ indirection of the 0th argument to the first
* indirection of the return value, etc.
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
+ * supported.
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 024e9cf119d5..2b4264fc4329 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -11,6 +11,10 @@
* `namespace; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
* `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
+ * - Barriers:
+ * `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
* - Neutrals:
* `namespace; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -69,14 +73,17 @@
* - "Field[f]": Selects the contents of field `f`.
* - "Property[p]": Selects the contents of property `p`.
*
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false", "no-exception", "not-zero", "null", "not-null".
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step. For neutrals the kind can be `summary`,
* `source` or `sink` to indicate that the neutral is neutral with respect to
* flow (no summary), source (is not a source) or sink (is not a sink).
- * 9. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
* The format is {origin}-{verification} or just "manual" where the origin describes
* the origin of the model and verification describes how the model has been verified.
* Some examples are:
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index e1170aeda244..3812b3df449f 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -11,6 +11,10 @@
* `package; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
* `package; type; subtypes; name; signature; ext; input; output; kind; provenance`
+ * - Barriers:
+ * `package; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -78,7 +82,11 @@
* - "MapValue": Selects a value in a map.
* - "Dereference": Selects the value referenced by a pointer.
*
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
+ * supported.
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 1536c81aa083..45db15897f7c 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -11,6 +11,10 @@
* `package; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
* `package; type; subtypes; name; signature; ext; input; output; kind; provenance`
+ * - Barriers:
+ * `package; type; subtypes; name; signature; ext; output; kind; provenance`
+ * - BarrierGuards:
+ * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -69,14 +73,17 @@
* in the given range. The range is inclusive at both ends.
* - "ReturnValue": Selects the return value of a call to the selected element.
* - "Element": Selects the collection elements of the selected element.
- * 8. The `kind` column is a tag that can be referenced from QL to determine to
+ * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * under which the guard accepts or blocks flow. It can be one of "true" or
+ * "false", "no-exception", "not-zero", "null", "not-null".
+ * 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step. For neutrals the kind can be `summary`,
* `source` or `sink` to indicate that the neutral is neutral with respect to
* flow (no summary), source (is not a source) or sink (is not a sink).
- * 9. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
* The format is {origin}-{verification} or just "manual" where the origin describes
* the origin of the model and verification describes how the model has been verified.
* Some examples are:
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
index 60fe40e716d0..34bf32675221 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
@@ -10,6 +10,10 @@
* `type, path, kind`
* - Summaries:
* `type, path, input, output, kind`
+ * - Barriers:
+ * `type, path, kind`
+ * - BarrierGuards:
+ * `type, path, branch, kind`
* - Types:
* `type1, type2, path`
*
@@ -42,7 +46,8 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `kind` column is a tag that can be referenced from QL to determine to
+ * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
index 60fe40e716d0..34bf32675221 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
@@ -10,6 +10,10 @@
* `type, path, kind`
* - Summaries:
* `type, path, input, output, kind`
+ * - Barriers:
+ * `type, path, kind`
+ * - BarrierGuards:
+ * `type, path, branch, kind`
* - Types:
* `type1, type2, path`
*
@@ -42,7 +46,8 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `kind` column is a tag that can be referenced from QL to determine to
+ * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
index 60fe40e716d0..34bf32675221 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
@@ -10,6 +10,10 @@
* `type, path, kind`
* - Summaries:
* `type, path, input, output, kind`
+ * - Barriers:
+ * `type, path, kind`
+ * - BarrierGuards:
+ * `type, path, branch, kind`
* - Types:
* `type1, type2, path`
*
@@ -42,7 +46,8 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `kind` column is a tag that can be referenced from QL to determine to
+ * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index 4d28dd8de812..a21d50ed8ad0 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -9,6 +9,10 @@
* `path; input; kind; provenance`
* - Summaries:
* `path; input; output; kind; provenance`
+ * - Barriers:
+ * `path; output; kind; provenance`
+ * - BarrierGuards:
+ * `path; input; branch; kind; provenance`
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
@@ -34,12 +38,15 @@
* - `Field[i]`: the `i`th element of a tuple.
* - `Reference`: the referenced value.
* - `Future`: the value being computed asynchronously.
- * 3. The `kind` column is a tag that can be referenced from QL to determine to
+ * 3. The `branch` column of barrier guard models specifies which branch of the
+ * guard is blocking flow. It can be "true" or "false". In the future
+ * "no-exception", "not-zero", "null", "not-null" may be supported.
+ * 4. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
* `"taint"` indicates a default additional taint step and `"value"` indicates a
* globally applicable value-preserving step.
- * 4. The `provenance` column is mainly used internally, and should be set to `"manual"` for
+ * 5. The `provenance` column is mainly used internally, and should be set to `"manual"` for
* all custom models.
*/
From 61b13d570272fe63c193a1b6b2158cf20a959883 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:40:42 +0000
Subject: [PATCH 012/146] C++: Add provenance to MaD format explanation
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index 1ec501a85dd6..b36c37d81141 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -99,6 +99,15 @@
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * The format is {origin}-{verification} or just "manual" where the origin describes
+ * the origin of the model and verification describes how the model has been verified.
+ * Some examples are:
+ * - "df-generated": The model has been generated by the model generator tool.
+ * - "df-manual": The model has been generated by the model generator and verified by a human.
+ * - "manual": The model has been written by hand.
+ * This information is used in a heuristic for dataflow analysis to determine, if a
+ * model or source code should be used for determining flow.
*/
import cpp
From 805d2ec46cbe4c5aae54c817f59811f1595b250b Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:41:59 +0000
Subject: [PATCH 013/146] Go: Add provenance to MaD format explanation
---
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 3812b3df449f..23e08ce5cbf5 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -91,6 +91,15 @@
* sources "remote" indicates a default remote flow source, and for summaries
* "taint" indicates a default additional taint step and "value" indicates a
* globally applicable value-preserving step.
+ * 10. The `provenance` column is a tag to indicate the origin and verification of a model.
+ * The format is {origin}-{verification} or just "manual" where the origin describes
+ * the origin of the model and verification describes how the model has been verified.
+ * Some examples are:
+ * - "df-generated": The model has been generated by the model generator tool.
+ * - "df-manual": The model has been generated by the model generator and verified by a human.
+ * - "manual": The model has been written by hand.
+ * This information is used in a heuristic for dataflow analysis to determine, if a
+ * model or source code should be used for determining flow.
*/
overlay[local?]
module;
From df842665b7156aa20de94972d39698a74326462b Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 11:42:13 +0000
Subject: [PATCH 014/146] Rust: Add neutrals to MaD format explanation
---
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll | 3 +++
1 file changed, 3 insertions(+)
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index a21d50ed8ad0..a43495ac7840 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -13,6 +13,9 @@
* `path; output; kind; provenance`
* - BarrierGuards:
* `path; input; branch; kind; provenance`
+ * - Neutrals:
+ * `package; type; name; signature; kind; provenance`
+ * A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
From e680d49c93334f38134c1e7da000e0e18db42fc3 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 12:08:54 +0000
Subject: [PATCH 015/146] Shared: document extensible relations rather than CSV
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 2 +-
.../lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll | 2 +-
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 2 +-
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index b36c37d81141..df1765ec07ca 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -3,7 +3,7 @@
*
* Provides classes and predicates for dealing with flow models specified in CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `namespace; type; subtypes; name; signature; ext; output; kind`
* - Sinks:
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 2b4264fc4329..95b9578e4f3b 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -4,7 +4,7 @@
* Provides classes and predicates for dealing with MaD flow models specified
* in data extensions and CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 23e08ce5cbf5..05379c620fbb 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -4,7 +4,7 @@
* Provides classes and predicates for dealing with flow models specified
* in data extensions and CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 45db15897f7c..8f6d1a7855a3 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -4,7 +4,7 @@
* Provides classes and predicates for dealing with flow models specified
* in data extensions and CSV format.
*
- * The CSV specification has the following columns:
+ * The extensible relations have the following columns:
* - Sources:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
From 886a16bfad664c67da64f4136a3079009a38bd11 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Thu, 26 Mar 2026 12:09:11 +0000
Subject: [PATCH 016/146] C++: Add provenance column
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index df1765ec07ca..ed40d3919173 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -5,11 +5,11 @@
*
* The extensible relations have the following columns:
* - Sources:
- * `namespace; type; subtypes; name; signature; ext; output; kind`
+ * `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - Sinks:
- * `namespace; type; subtypes; name; signature; ext; input; kind`
+ * `namespace; type; subtypes; name; signature; ext; input; kind; provenance`
* - Summaries:
- * `namespace; type; subtypes; name; signature; ext; input; output; kind`
+ * `namespace; type; subtypes; name; signature; ext; input; output; kind; provenance`
* - Barriers:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
From 5451424e751d102f492d4f7298518afd20cdf6e6 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 09:46:20 +0000
Subject: [PATCH 017/146] Rust: Fix columns for neutrals
---
rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index a43495ac7840..cc7dd9963ea0 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -14,7 +14,7 @@
* - BarrierGuards:
* `path; input; branch; kind; provenance`
* - Neutrals:
- * `package; type; name; signature; kind; provenance`
+ * `path; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
*
* The interpretation of a row is similar to API-graphs with a left-to-right
From b3285c6ae2274aaa456a2fe152945f38bd16f8af Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 11:35:22 +0000
Subject: [PATCH 018/146] Make description of `acceptingvalue` column clearer
---
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll | 5 ++---
.../semmle/code/csharp/dataflow/internal/ExternalFlow.qll | 4 ++--
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 5 ++---
java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll | 4 ++--
4 files changed, 8 insertions(+), 10 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index ed40d3919173..3fe9f6aaedfc 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -91,9 +91,8 @@
* - flow from the _second_ indirection of the 0th argument to the first
* indirection of the return value, etc.
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
- * supported.
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 95b9578e4f3b..17cdcc1bf0b9 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -74,8 +74,8 @@
* - "Property[p]": Selects the contents of property `p`.
*
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false", "no-exception", "not-zero", "null", "not-null".
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 05379c620fbb..0ad28bac5332 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -83,9 +83,8 @@
* - "Dereference": Selects the value referenced by a pointer.
*
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false". In the future "no-exception", "not-zero", "null", "not-null" may be
- * supported.
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 8f6d1a7855a3..6ad4a5938a3b 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -74,8 +74,8 @@
* - "ReturnValue": Selects the return value of a call to the selected element.
* - "Element": Selects the collection elements of the selected element.
* 8. The `acceptingvalue` column of barrier guard models specifies the condition
- * under which the guard accepts or blocks flow. It can be one of "true" or
- * "false", "no-exception", "not-zero", "null", "not-null".
+ * under which the guard blocks flow. It can be one of "true" or "false". In
+ * the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
From 60f9ce4ce7485269027caefacd2fa5ee73099d90 Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Mar 2026 13:55:58 +0000
Subject: [PATCH 019/146] Python: Port UnreachableCode.ql
---
python/ql/src/Statements/UnreachableCode.ql | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/python/ql/src/Statements/UnreachableCode.ql b/python/ql/src/Statements/UnreachableCode.ql
index 55582ed2f061..200e073cff6b 100644
--- a/python/ql/src/Statements/UnreachableCode.ql
+++ b/python/ql/src/Statements/UnreachableCode.ql
@@ -13,7 +13,7 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.ApiGraphs
predicate typing_import(ImportingStmt is) {
exists(Module m |
@@ -34,11 +34,7 @@ predicate unique_yield(Stmt s) {
/** Holds if `contextlib.suppress` may be used in the same scope as `s` */
predicate suppression_in_scope(Stmt s) {
exists(With w |
- w.getContextExpr()
- .(Call)
- .getFunc()
- .(ExprWithPointsTo)
- .pointsTo(Value::named("contextlib.suppress")) and
+ w.getContextExpr() = API::moduleImport("contextlib").getMember("suppress").getACall().asExpr() and
w.getScope() = s.getScope()
)
}
From 0ea80ac184013820dbd2da2e5b4ba24c8ea92f3d Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Feb 2026 15:03:15 +0000
Subject: [PATCH 020/146] Python: Port UnusedExceptionObject.ql
Depending on whether other queries depend on this, we may end up moving
the exception utility functions to a more central location.
---
.../src/Statements/UnusedExceptionObject.ql | 46 +++++++++++++++++--
1 file changed, 42 insertions(+), 4 deletions(-)
diff --git a/python/ql/src/Statements/UnusedExceptionObject.ql b/python/ql/src/Statements/UnusedExceptionObject.ql
index 9a6a3650b7e6..890cdc963aca 100644
--- a/python/ql/src/Statements/UnusedExceptionObject.ql
+++ b/python/ql/src/Statements/UnusedExceptionObject.ql
@@ -12,11 +12,49 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.dataflow.new.internal.DataFlowDispatch
+private import semmle.python.dataflow.new.internal.Builtins
+private import semmle.python.ApiGraphs
-from Call call, ClassValue ex
+/**
+ * Holds if `cls` is a user-defined exception class, i.e. it transitively
+ * extends one of the builtin exception base classes.
+ */
+predicate isUserDefinedExceptionClass(Class cls) {
+ cls.getABase() =
+ API::builtin(["BaseException", "Exception"]).getAValueReachableFromSource().asExpr()
+ or
+ isUserDefinedExceptionClass(getADirectSuperclass(cls))
+}
+
+/**
+ * Gets the name of a builtin exception class.
+ */
+string getBuiltinExceptionName() {
+ result = Builtins::getBuiltinName() and
+ (
+ result.matches("%Error") or
+ result.matches("%Exception") or
+ result.matches("%Warning") or
+ result =
+ ["GeneratorExit", "KeyboardInterrupt", "StopIteration", "StopAsyncIteration", "SystemExit"]
+ )
+}
+
+/**
+ * Holds if `call` is an instantiation of an exception class.
+ */
+predicate isExceptionInstantiation(Call call) {
+ exists(Class cls |
+ classTracker(cls).asExpr() = call.getFunc() and
+ isUserDefinedExceptionClass(cls)
+ )
+ or
+ call.getFunc() = API::builtin(getBuiltinExceptionName()).getAValueReachableFromSource().asExpr()
+}
+
+from Call call
where
- call.getFunc().(ExprWithPointsTo).pointsTo(ex) and
- ex.getASuperType() = ClassValue::exception() and
+ isExceptionInstantiation(call) and
exists(ExprStmt s | s.getValue() = call)
select call, "Instantiating an exception, but not raising it, has no effect."
From bb9873dc8fff136f5e119400ca9cc67f08d0cdb2 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:40:45 +0000
Subject: [PATCH 021/146] C++: Increase the query precision to high.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 007ef71a1630..0cf6c8b3714e 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
- * @precision medium
+ * @precision high
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
From 50681a3c42fb901cd231e0988c1f3047acbff075 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:47:31 +0000
Subject: [PATCH 022/146] C++: Add note to the .qhelp.
---
.../ImplicitFunctionDeclaration.qhelp | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
index 6ff60d383419..d9b5a0220773 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
@@ -14,6 +14,9 @@ function may behave unpredictably.
This may indicate a misspelled function name, or that the required header containing
the function declaration has not been included.
+Note: This query is not compatible with build mode: none databases, and produces
+no results on those databases.
+
Provide an explicit declaration of the function before invoking it.
@@ -26,4 +29,4 @@ the function declaration has not been included.
SEI CERT C Coding Standard: DCL31-C. Declare identifiers before using them
-
\ No newline at end of file
+
From 4f74d421b9095e06a8642a5615c48f0a0094d7aa Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 27 Mar 2026 14:11:14 +0000
Subject: [PATCH 023/146] Python: Exclude `AF_UNIX` sockets from
BindToAllInterfaces
Looking at the results of the the previous DCA run, there was a bunch of
false positives where `bind` was being used with a `AF_UNIX` socket (a
filesystem path encoded as a string), not a `(host, port)` tuple. These
results should be excluded from the query, as they are not vulnerable.
Ideally, we would just add `.TupleElement[0]` to the MaD sink, except we
don't actually support this in Python MaD...
So, instead I opted for a more low-tech solution: check that the
argument in question flows from a tuple in the local scope.
This eliminates a bunch of false positives on `python/cpython` leaving
behind four true positive results.
---
.../Security/CVE-2018-1281/BindToAllInterfaces.ql | 14 +++++++++++++-
.../CVE-2018-1281/BindToAllInterfaces.expected | 1 +
.../CVE-2018-1281/BindToAllInterfaces_test.py | 4 ++++
3 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 2b62b184fd4e..75c145ec0ace 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -42,8 +42,20 @@ private module BindToAllInterfacesFlow = TaintTracking::Global
Date: Fri, 27 Mar 2026 17:04:05 +0000
Subject: [PATCH 024/146] C++: Update change note.
---
.../src/change-notes/2026-03-23-implicit-function-declaration.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
index 8c2c431ec24c..4fc4808f40c2 100644
--- a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
+++ b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
@@ -1,4 +1,5 @@
---
category: minorAnalysis
---
+* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been promoted to `@precision high`.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.
From a9cce1c0fa75b167c549b46ab350d7970929750a Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Fri, 27 Mar 2026 17:32:03 +0000
Subject: [PATCH 025/146] C++: Undo increasing query precision.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
.../change-notes/2026-03-23-implicit-function-declaration.md | 1 -
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 0cf6c8b3714e..007ef71a1630 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
- * @precision high
+ * @precision medium
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
diff --git a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
index 4fc4808f40c2..8c2c431ec24c 100644
--- a/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
+++ b/cpp/ql/src/change-notes/2026-03-23-implicit-function-declaration.md
@@ -1,5 +1,4 @@
---
category: minorAnalysis
---
-* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been promoted to `@precision high`.
* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query no longer produces results on `build mode: none` databases. These results were found to be very noisy and fundamentally imprecise in this mode.
From a7fdc4b5435e38cffb68fa425cbdec62939091bb Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 22:15:45 +0000
Subject: [PATCH 026/146] Replace `acceptingvalue` with `acceptingValue`
---
.../semmle/code/cpp/dataflow/ExternalFlow.qll | 16 +++++++--------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../cpp/dataflow/internal/FlowSummaryImpl.qll | 4 ++--
.../csharp/dataflow/internal/ExternalFlow.qll | 18 ++++++++---------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../dataflow/internal/FlowSummaryImpl.qll | 4 ++--
go/ql/lib/semmle/go/dataflow/ExternalFlow.qll | 18 ++++++++---------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../go/dataflow/internal/FlowSummaryImpl.qll | 4 ++--
.../code/java/dataflow/ExternalFlow.qll | 18 ++++++++---------
.../internal/ExternalFlowExtensions.qll | 2 +-
.../dataflow/internal/FlowSummaryImpl.qll | 4 ++--
.../rust/dataflow/internal/DataFlowImpl.qll | 6 +++---
.../dataflow/internal/FlowSummaryImpl.qll | 20 +++++++++----------
shared/mad/codeql/mad/static/ModelsAsData.qll | 12 +++++------
.../dataflow/internal/FlowSummaryImpl.qll | 2 +-
16 files changed, 67 insertions(+), 67 deletions(-)
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
index 3fe9f6aaedfc..e97b6d044d72 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
*
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
@@ -90,7 +90,7 @@
* value, and
* - flow from the _second_ indirection of the 0th argument to the first
* indirection of the return value, etc.
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -1089,13 +1089,13 @@ private module Cached {
private predicate barrierGuardChecks(IRGuardCondition g, Expr e, boolean gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingvalue,
+ SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingValue,
string kind, string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
+ gv = convertAcceptingValue(acceptingValue).asBooleanValue() and
n.asNode().(Private::ArgumentNode).getCall().asCallInstruction() = g
)
}
@@ -1112,14 +1112,14 @@ private module Cached {
) {
exists(
SourceSinkInterpretationInput::InterpretNode interpretNode,
- Public::AcceptingValue acceptingvalue, string kind, string model, int indirectionIndex,
+ Public::AcceptingValue acceptingValue, string kind, string model, int indirectionIndex,
Private::ArgumentNode arg
|
- isBarrierGuardNode(interpretNode, acceptingvalue, kind, model) and
+ isBarrierGuardNode(interpretNode, acceptingValue, kind, model) and
arg = interpretNode.asNode() and
arg.asIndirectExpr(indirectionIndex) = e and
kmp = MkKindModelPairIntPair(TMkPair(kind, model), indirectionIndex) and
- gv = convertAcceptingValue(acceptingvalue).asBooleanValue() and
+ gv = convertAcceptingValue(acceptingValue).asBooleanValue() and
arg.getCall().asCallInstruction() = g
)
}
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll
index 1a572c221d9f..22c74c2aa714 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll
@@ -33,7 +33,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
index cce1b80e7fcb..d91dc41febeb 100644
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
@@ -162,13 +162,13 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
string package, string type, boolean subtypes, string name, string signature, string ext
|
- barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingvalue, kind,
+ barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingValue, kind,
provenance, model) and
e = interpretElement(package, type, subtypes, name, signature, ext)
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
index 17cdcc1bf0b9..f8cec8c4d9f6 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlow.qll
@@ -14,7 +14,7 @@
* - Barriers:
* `namespace; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `namespace; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `namespace; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
* - Neutrals:
* `namespace; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -73,7 +73,7 @@
* - "Field[f]": Selects the contents of field `f`.
* - "Property[p]": Selects the contents of property `p`.
*
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -237,11 +237,11 @@ module ModelValidation {
result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
)
or
- exists(string acceptingvalue |
- barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
- invalidAcceptingValue(acceptingvalue) and
+ exists(string acceptingValue |
+ barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and
+ invalidAcceptingValue(acceptingValue) and
result =
- "Unrecognized accepting value description \"" + acceptingvalue +
+ "Unrecognized accepting value description \"" + acceptingValue +
"\" in barrier guard model."
)
}
@@ -489,13 +489,13 @@ private module Cached {
private predicate barrierGuardChecks(Guard g, Expr e, GuardValue gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingvalue, string kind,
+ SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingValue, string kind,
string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue)
+ gv = convertAcceptingValue(acceptingValue)
|
g.(Call).getAnArgument() = e or g.(QualifiableExpr).getQualifier() = e
)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
index 3461f0a51863..cd438ece284d 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/ExternalFlowExtensions.qll
@@ -33,7 +33,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
index 6f9b621ff404..4b79ed5feca6 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll
@@ -253,13 +253,13 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext
|
- barrierGuardModel(namespace, type, subtypes, name, signature, ext, input, acceptingvalue,
+ barrierGuardModel(namespace, type, subtypes, name, signature, ext, input, acceptingValue,
kind, provenance, model) and
e = interpretElement(namespace, type, subtypes, name, signature, ext, _)
)
diff --git a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
index 0ad28bac5332..f0dc0cf0ca2b 100644
--- a/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
+++ b/go/ql/lib/semmle/go/dataflow/ExternalFlow.qll
@@ -14,7 +14,7 @@
* - Barriers:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `package; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -82,7 +82,7 @@
* - "MapValue": Selects a value in a map.
* - "Dereference": Selects the value referenced by a pointer.
*
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -266,11 +266,11 @@ module ModelValidation {
result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
)
or
- exists(string acceptingvalue |
- barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
- invalidAcceptingValue(acceptingvalue) and
+ exists(string acceptingValue |
+ barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and
+ invalidAcceptingValue(acceptingValue) and
result =
- "Unrecognized accepting value description \"" + acceptingvalue +
+ "Unrecognized accepting value description \"" + acceptingValue +
"\" in barrier guard model."
)
}
@@ -478,13 +478,13 @@ private module Cached {
private predicate barrierGuardChecks(DataFlow::Node g, Expr e, boolean gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingvalue,
+ SourceSinkInterpretationInput::InterpretNode n, Public::AcceptingValue acceptingValue,
string kind, string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue)
+ gv = convertAcceptingValue(acceptingValue)
|
g.asExpr().(CallExpr).getAnArgument() = e // TODO: qualifier?
)
diff --git a/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll b/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll
index 5d43cf674c1c..ab2a241e14a6 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/ExternalFlowExtensions.qll
@@ -35,7 +35,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string package, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll b/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
index 240665bd492d..ff727286c3b4 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll
@@ -174,13 +174,13 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
string package, string type, boolean subtypes, string name, string signature, string ext
|
- barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingvalue, kind,
+ barrierGuardModel(package, type, subtypes, name, signature, ext, input, acceptingValue, kind,
provenance, model) and
e = interpretElement(package, type, subtypes, name, signature, ext)
)
diff --git a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
index 6ad4a5938a3b..a6a9347ca03a 100644
--- a/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll
@@ -14,7 +14,7 @@
* - Barriers:
* `package; type; subtypes; name; signature; ext; output; kind; provenance`
* - BarrierGuards:
- * `package; type; subtypes; name; signature; ext; input; acceptingvalue; kind; provenance`
+ * `package; type; subtypes; name; signature; ext; input; acceptingValue; kind; provenance`
* - Neutrals:
* `package; type; name; signature; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -73,7 +73,7 @@
* in the given range. The range is inclusive at both ends.
* - "ReturnValue": Selects the return value of a call to the selected element.
* - "Element": Selects the collection elements of the selected element.
- * 8. The `acceptingvalue` column of barrier guard models specifies the condition
+ * 8. The `acceptingValue` column of barrier guard models specifies the condition
* under which the guard blocks flow. It can be one of "true" or "false". In
* the future "no-exception", "not-zero", "null", "not-null" may be supported.
* 9. The `kind` column is a tag that can be referenced from QL to determine to
@@ -365,11 +365,11 @@ module ModelValidation {
result = "Unrecognized provenance description \"" + provenance + "\" in " + pred + " model."
)
or
- exists(string acceptingvalue |
- barrierGuardModel(_, _, _, _, _, _, _, acceptingvalue, _, _, _) and
- invalidAcceptingValue(acceptingvalue) and
+ exists(string acceptingValue |
+ barrierGuardModel(_, _, _, _, _, _, _, acceptingValue, _, _, _) and
+ invalidAcceptingValue(acceptingValue) and
result =
- "Unrecognized accepting value description \"" + acceptingvalue +
+ "Unrecognized accepting value description \"" + acceptingValue +
"\" in barrier guard model."
)
}
@@ -590,13 +590,13 @@ private module Cached {
private predicate barrierGuardChecks(Guard g, Expr e, GuardValue gv, TKindModelPair kmp) {
exists(
- SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingvalue, string kind,
+ SourceSinkInterpretationInput::InterpretNode n, AcceptingValue acceptingValue, string kind,
string model
|
- isBarrierGuardNode(n, acceptingvalue, kind, model) and
+ isBarrierGuardNode(n, acceptingValue, kind, model) and
n.asNode().asExpr() = e and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue)
+ gv = convertAcceptingValue(acceptingValue)
|
g.(Call).getAnArgument() = e or g.(MethodCall).getQualifier() = e
)
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll b/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll
index be474ad45352..3c6b003876de 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/ExternalFlowExtensions.qll
@@ -35,7 +35,7 @@ extensible predicate barrierModel(
*/
extensible predicate barrierGuardModel(
string package, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, QlBuiltins::ExtensionId madId
+ string input, string acceptingValue, string kind, string provenance, QlBuiltins::ExtensionId madId
);
/**
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
index 64fa30c7d914..453b7ccae11c 100644
--- a/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
+++ b/java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll
@@ -282,7 +282,7 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element e, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element e, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
exists(
@@ -290,7 +290,7 @@ module SourceSinkInterpretationInput implements
SourceOrSinkElement baseBarrier, string originalInput
|
barrierGuardModel(namespace, type, subtypes, name, signature, ext, originalInput,
- acceptingvalue, kind, provenance, model) and
+ acceptingValue, kind, provenance, model) and
baseBarrier = interpretElement(namespace, type, subtypes, name, signature, ext, _) and
(
e = baseBarrier and input = originalInput
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll
index 27773758fc46..7c1fdd8cf781 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll
@@ -1183,12 +1183,12 @@ private module Cached {
exists(
FlowSummaryImpl::Public::BarrierGuardElement b,
FlowSummaryImpl::Private::SummaryComponentStack stack,
- FlowSummaryImpl::Public::AcceptingValue acceptingvalue, string kind, string model
+ FlowSummaryImpl::Public::AcceptingValue acceptingValue, string kind, string model
|
- FlowSummaryImpl::Private::barrierGuardSpec(b, stack, acceptingvalue, kind, model) and
+ FlowSummaryImpl::Private::barrierGuardSpec(b, stack, acceptingValue, kind, model) and
e = FlowSummaryImpl::StepsInput::getSinkNode(b, stack.headOfSingleton()).asExpr() and
kmp = TMkPair(kind, model) and
- gv = convertAcceptingValue(acceptingvalue) and
+ gv = convertAcceptingValue(acceptingValue) and
g = b.getCall()
)
}
diff --git a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
index 8b25c54bfa09..0c6e42d9066a 100644
--- a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
@@ -2189,10 +2189,10 @@ module Make<
not exists(interpretComponent(c))
}
- /** Holds if `acceptingvalue` is not a valid barrier guard accepting-value. */
- bindingset[acceptingvalue]
- predicate invalidAcceptingValue(string acceptingvalue) {
- not acceptingvalue instanceof AcceptingValue
+ /** Holds if `acceptingValue` is not a valid barrier guard accepting-value. */
+ bindingset[acceptingValue]
+ predicate invalidAcceptingValue(string acceptingValue) {
+ not acceptingValue instanceof AcceptingValue
}
/** Holds if `provenance` is not a valid provenance value. */
@@ -2242,10 +2242,10 @@ module Make<
/**
* Holds if an external barrier guard specification exists for `n` with input
- * specification `input`, accepting value `acceptingvalue`, and kind `kind`.
+ * specification `input`, accepting value `acceptingValue`, and kind `kind`.
*/
predicate barrierGuardElement(
- Element n, string input, AcceptingValue acceptingvalue, string kind,
+ Element n, string input, AcceptingValue acceptingValue, string kind,
Provenance provenance, string model
);
@@ -2371,11 +2371,11 @@ module Make<
}
private predicate barrierGuardElementRef(
- InterpretNode ref, SourceSinkAccessPath input, AcceptingValue acceptingvalue, string kind,
+ InterpretNode ref, SourceSinkAccessPath input, AcceptingValue acceptingValue, string kind,
string model
) {
exists(SourceOrSinkElement e |
- barrierGuardElement(e, input, acceptingvalue, kind, _, model) and
+ barrierGuardElement(e, input, acceptingValue, kind, _, model) and
if inputNeedsReferenceExt(input.getToken(0))
then e = ref.getCallTarget()
else e = ref.asElement()
@@ -2518,10 +2518,10 @@ module Make<
* given kind in a MaD flow model.
*/
predicate isBarrierGuardNode(
- InterpretNode node, AcceptingValue acceptingvalue, string kind, string model
+ InterpretNode node, AcceptingValue acceptingValue, string kind, string model
) {
exists(InterpretNode ref, SourceSinkAccessPath input |
- barrierGuardElementRef(ref, input, acceptingvalue, kind, model) and
+ barrierGuardElementRef(ref, input, acceptingValue, kind, model) and
interpretInput(input, input.getNumToken(), ref, node)
)
}
diff --git a/shared/mad/codeql/mad/static/ModelsAsData.qll b/shared/mad/codeql/mad/static/ModelsAsData.qll
index 84daaa9b6c86..4b58a23186ac 100644
--- a/shared/mad/codeql/mad/static/ModelsAsData.qll
+++ b/shared/mad/codeql/mad/static/ModelsAsData.qll
@@ -31,7 +31,7 @@ signature module ExtensionsSig {
*/
predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance,
+ string input, string acceptingValue, string kind, string provenance,
QlBuiltins::ExtensionId madId
);
@@ -142,14 +142,14 @@ module ModelsAsData {
or
exists(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance
+ string input, string acceptingValue, string kind, string provenance
|
Extensions::barrierGuardModel(namespace, type, subtypes, name, signature, ext, input,
- acceptingvalue, kind, provenance, madId)
+ acceptingValue, kind, provenance, madId)
|
model =
"Barrier Guard: " + namespace + "; " + type + "; " + subtypes + "; " + name + "; " +
- signature + "; " + ext + "; " + input + "; " + acceptingvalue + "; " + kind + "; " +
+ signature + "; " + ext + "; " + input + "; " + acceptingValue + "; " + kind + "; " +
provenance
)
or
@@ -241,12 +241,12 @@ module ModelsAsData {
/** Holds if a barrier guard model exists for the given parameters. */
predicate barrierGuardModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
- string input, string acceptingvalue, string kind, string provenance, string model
+ string input, string acceptingValue, string kind, string provenance, string model
) {
exists(string namespaceOrGroup, QlBuiltins::ExtensionId madId |
namespace = getNamespace(namespaceOrGroup) and
Extensions::barrierGuardModel(namespaceOrGroup, type, subtypes, name, signature, ext, input,
- acceptingvalue, kind, provenance, madId) and
+ acceptingValue, kind, provenance, madId) and
model = "MaD:" + madId.toString()
)
}
diff --git a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
index c1ddb7f781f5..3a096fe3d576 100644
--- a/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
+++ b/swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll
@@ -168,7 +168,7 @@ module SourceSinkInterpretationInput implements
}
predicate barrierGuardElement(
- Element n, string input, Public::AcceptingValue acceptingvalue, string kind,
+ Element n, string input, Public::AcceptingValue acceptingValue, string kind,
Public::Provenance provenance, string model
) {
none()
From c5ef1f6342bbc04bf34f95abc397df1089617d2c Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Mar 2026 13:56:07 +0000
Subject: [PATCH 027/146] Python: Port UseOfExit.ql
---
python/ql/src/Statements/UseOfExit.ql | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/python/ql/src/Statements/UseOfExit.ql b/python/ql/src/Statements/UseOfExit.ql
index 437ff93b5371..2310a839f67b 100644
--- a/python/ql/src/Statements/UseOfExit.ql
+++ b/python/ql/src/Statements/UseOfExit.ql
@@ -12,10 +12,12 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.ApiGraphs
from CallNode call, string name
-where call.getFunction().(ControlFlowNodeWithPointsTo).pointsTo(Value::siteQuitter(name))
+where
+ name = ["exit", "quit"] and
+ call = API::builtin(name).getACall().asCfgNode()
select call,
"The '" + name +
"' site.Quitter object may not exist if the 'site' module is not loaded or is modified."
From 37aac059640e804b4b7550279d5f2bfa1812c211 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Date: Fri, 27 Mar 2026 22:39:10 +0000
Subject: [PATCH 028/146] Replace `branch` with `acceptingValue`
---
.../data/internal/ApiGraphModels.qll | 26 +++++++++----------
.../internal/ApiGraphModelsExtensions.qll | 6 ++---
.../data/internal/ApiGraphModels.qll | 26 +++++++++----------
.../internal/ApiGraphModelsExtensions.qll | 6 ++---
.../data/internal/ApiGraphModels.qll | 26 +++++++++----------
.../internal/ApiGraphModelsExtensions.qll | 6 ++---
.../rust/dataflow/internal/ModelsAsData.qll | 21 ++++++++-------
.../dataflow/internal/FlowSummaryImpl.qll | 16 ++++++------
8 files changed, 67 insertions(+), 66 deletions(-)
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
index 34bf32675221..155fb4b7c786 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `type, path, kind`
* - BarrierGuards:
- * `type, path, branch, kind`
+ * `type, path, acceptingValue, kind`
* - Types:
* `type1, type2, path`
*
@@ -46,7 +46,7 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 4. The `acceptingValue` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
* 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
@@ -360,11 +360,11 @@ private predicate barrierModel(string type, string path, string kind, string mod
/** Holds if a barrier guard model exists for the given parameters. */
private predicate barrierGuardModel(
- string type, string path, string branch, string kind, string model
+ string type, string path, string acceptingValue, string kind, string model
) {
// No deprecation adapter for barrier models, they were not around back then.
exists(QlBuiltins::ExtensionId madId |
- Extensions::barrierGuardModel(type, path, branch, kind, madId) and
+ Extensions::barrierGuardModel(type, path, acceptingValue, kind, madId) and
model = "MaD:" + madId.toString()
)
}
@@ -788,16 +788,16 @@ module ModelOutput {
}
/**
- * Holds if a barrier model contributed `barrier` with the given `kind` for the given `branch`.
+ * Holds if a barrier model contributed `barrier` with the given `kind` for the given `acceptingValue`.
*/
cached
- API::Node getABarrierGuardNode(string kind, boolean branch, string model) {
- exists(string type, string path, string branch_str |
- branch = true and branch_str = "true"
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue, string model) {
+ exists(string type, string path, string acceptingValue_str |
+ acceptingValue = true and acceptingValue_str = "true"
or
- branch = false and branch_str = "false"
+ acceptingValue = false and acceptingValue_str = "false"
|
- barrierGuardModel(type, path, branch_str, kind, model) and
+ barrierGuardModel(type, path, acceptingValue_str, kind, model) and
result = getNodeFromPath(type, path)
)
}
@@ -861,12 +861,12 @@ module ModelOutput {
API::Node getABarrierNode(string kind) { result = getABarrierNode(kind, _) }
/**
- * Holds if an external model contributed `barrier-guard` with the given `kind` and `branch`.
+ * Holds if an external model contributed `barrier-guard` with the given `kind` and `acceptingValue`.
*
* INTERNAL: Do not use.
*/
- API::Node getABarrierGuardNode(string kind, boolean branch) {
- result = getABarrierGuardNode(kind, branch, _)
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue) {
+ result = getABarrierGuardNode(kind, acceptingValue, _)
}
/**
diff --git a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll
index 2a644aabb95d..8d8a4f5fd880 100644
--- a/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll
+++ b/javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsExtensions.qll
@@ -33,11 +33,11 @@ extensible predicate barrierModel(
* of the given `kind` and `madId` is the data extension row number.
* `path` is assumed to lead to a parameter of a call (possibly `self`), and
* the call is guarding the parameter.
- * `branch` is either `true` or `false`, indicating which branch of the guard
- * is protecting the parameter.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string type, string path, string branch, string kind, QlBuiltins::ExtensionId madId
+ string type, string path, string acceptingValue, string kind, QlBuiltins::ExtensionId madId
);
/**
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
index 34bf32675221..155fb4b7c786 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `type, path, kind`
* - BarrierGuards:
- * `type, path, branch, kind`
+ * `type, path, acceptingValue, kind`
* - Types:
* `type1, type2, path`
*
@@ -46,7 +46,7 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 4. The `acceptingValue` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
* 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
@@ -360,11 +360,11 @@ private predicate barrierModel(string type, string path, string kind, string mod
/** Holds if a barrier guard model exists for the given parameters. */
private predicate barrierGuardModel(
- string type, string path, string branch, string kind, string model
+ string type, string path, string acceptingValue, string kind, string model
) {
// No deprecation adapter for barrier models, they were not around back then.
exists(QlBuiltins::ExtensionId madId |
- Extensions::barrierGuardModel(type, path, branch, kind, madId) and
+ Extensions::barrierGuardModel(type, path, acceptingValue, kind, madId) and
model = "MaD:" + madId.toString()
)
}
@@ -788,16 +788,16 @@ module ModelOutput {
}
/**
- * Holds if a barrier model contributed `barrier` with the given `kind` for the given `branch`.
+ * Holds if a barrier model contributed `barrier` with the given `kind` for the given `acceptingValue`.
*/
cached
- API::Node getABarrierGuardNode(string kind, boolean branch, string model) {
- exists(string type, string path, string branch_str |
- branch = true and branch_str = "true"
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue, string model) {
+ exists(string type, string path, string acceptingValue_str |
+ acceptingValue = true and acceptingValue_str = "true"
or
- branch = false and branch_str = "false"
+ acceptingValue = false and acceptingValue_str = "false"
|
- barrierGuardModel(type, path, branch_str, kind, model) and
+ barrierGuardModel(type, path, acceptingValue_str, kind, model) and
result = getNodeFromPath(type, path)
)
}
@@ -861,12 +861,12 @@ module ModelOutput {
API::Node getABarrierNode(string kind) { result = getABarrierNode(kind, _) }
/**
- * Holds if an external model contributed `barrier-guard` with the given `kind` and `branch`.
+ * Holds if an external model contributed `barrier-guard` with the given `kind` and `acceptingValue`.
*
* INTERNAL: Do not use.
*/
- API::Node getABarrierGuardNode(string kind, boolean branch) {
- result = getABarrierGuardNode(kind, branch, _)
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue) {
+ result = getABarrierGuardNode(kind, acceptingValue, _)
}
/**
diff --git a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll
index 2a644aabb95d..8d8a4f5fd880 100644
--- a/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll
+++ b/python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModelsExtensions.qll
@@ -33,11 +33,11 @@ extensible predicate barrierModel(
* of the given `kind` and `madId` is the data extension row number.
* `path` is assumed to lead to a parameter of a call (possibly `self`), and
* the call is guarding the parameter.
- * `branch` is either `true` or `false`, indicating which branch of the guard
- * is protecting the parameter.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string type, string path, string branch, string kind, QlBuiltins::ExtensionId madId
+ string type, string path, string acceptingValue, string kind, QlBuiltins::ExtensionId madId
);
/**
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
index 34bf32675221..155fb4b7c786 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
@@ -13,7 +13,7 @@
* - Barriers:
* `type, path, kind`
* - BarrierGuards:
- * `type, path, branch, kind`
+ * `type, path, acceptingValue, kind`
* - Types:
* `type1, type2, path`
*
@@ -46,7 +46,7 @@
* 3. The `input` and `output` columns specify how data enters and leaves the element selected by the
* first `(type, path)` tuple. Both strings are `.`-separated access paths
* of the same syntax as the `path` column.
- * 4. The `branch` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
+ * 4. The `acceptingValue` column of barrier guard models specifies which branch of the guard is blocking flow. It can be "true" or "false".
* 5. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources `"remote"` indicates a default remote flow source, and for summaries
@@ -360,11 +360,11 @@ private predicate barrierModel(string type, string path, string kind, string mod
/** Holds if a barrier guard model exists for the given parameters. */
private predicate barrierGuardModel(
- string type, string path, string branch, string kind, string model
+ string type, string path, string acceptingValue, string kind, string model
) {
// No deprecation adapter for barrier models, they were not around back then.
exists(QlBuiltins::ExtensionId madId |
- Extensions::barrierGuardModel(type, path, branch, kind, madId) and
+ Extensions::barrierGuardModel(type, path, acceptingValue, kind, madId) and
model = "MaD:" + madId.toString()
)
}
@@ -788,16 +788,16 @@ module ModelOutput {
}
/**
- * Holds if a barrier model contributed `barrier` with the given `kind` for the given `branch`.
+ * Holds if a barrier model contributed `barrier` with the given `kind` for the given `acceptingValue`.
*/
cached
- API::Node getABarrierGuardNode(string kind, boolean branch, string model) {
- exists(string type, string path, string branch_str |
- branch = true and branch_str = "true"
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue, string model) {
+ exists(string type, string path, string acceptingValue_str |
+ acceptingValue = true and acceptingValue_str = "true"
or
- branch = false and branch_str = "false"
+ acceptingValue = false and acceptingValue_str = "false"
|
- barrierGuardModel(type, path, branch_str, kind, model) and
+ barrierGuardModel(type, path, acceptingValue_str, kind, model) and
result = getNodeFromPath(type, path)
)
}
@@ -861,12 +861,12 @@ module ModelOutput {
API::Node getABarrierNode(string kind) { result = getABarrierNode(kind, _) }
/**
- * Holds if an external model contributed `barrier-guard` with the given `kind` and `branch`.
+ * Holds if an external model contributed `barrier-guard` with the given `kind` and `acceptingValue`.
*
* INTERNAL: Do not use.
*/
- API::Node getABarrierGuardNode(string kind, boolean branch) {
- result = getABarrierGuardNode(kind, branch, _)
+ API::Node getABarrierGuardNode(string kind, boolean acceptingValue) {
+ result = getABarrierGuardNode(kind, acceptingValue, _)
}
/**
diff --git a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll
index 2a644aabb95d..8d8a4f5fd880 100644
--- a/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll
+++ b/ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModelsExtensions.qll
@@ -33,11 +33,11 @@ extensible predicate barrierModel(
* of the given `kind` and `madId` is the data extension row number.
* `path` is assumed to lead to a parameter of a call (possibly `self`), and
* the call is guarding the parameter.
- * `branch` is either `true` or `false`, indicating which branch of the guard
- * is protecting the parameter.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string type, string path, string branch, string kind, QlBuiltins::ExtensionId madId
+ string type, string path, string acceptingValue, string kind, QlBuiltins::ExtensionId madId
);
/**
diff --git a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
index cc7dd9963ea0..2b3ecf51fe40 100644
--- a/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
+++ b/rust/ql/lib/codeql/rust/dataflow/internal/ModelsAsData.qll
@@ -12,7 +12,7 @@
* - Barriers:
* `path; output; kind; provenance`
* - BarrierGuards:
- * `path; input; branch; kind; provenance`
+ * `path; input; acceptingValue; kind; provenance`
* - Neutrals:
* `path; kind; provenance`
* A neutral is used to indicate that a callable is neutral with respect to flow (no summary), source (is not a source) or sink (is not a sink).
@@ -41,7 +41,7 @@
* - `Field[i]`: the `i`th element of a tuple.
* - `Reference`: the referenced value.
* - `Future`: the value being computed asynchronously.
- * 3. The `branch` column of barrier guard models specifies which branch of the
+ * 3. The `acceptingValue` column of barrier guard models specifies which branch of the
* guard is blocking flow. It can be "true" or "false". In the future
* "no-exception", "not-zero", "null", "not-null" may be supported.
* 4. The `kind` column is a tag that can be referenced from QL to determine to
@@ -124,11 +124,12 @@ extensible predicate barrierModel(
* extension row number.
*
* The value referred to by `input` is assumed to lead to an argument of a call
- * (possibly `self`), and the call is guarding the argument. `branch` is either `true`
- * or `false`, indicating which branch of the guard is protecting the argument.
+ * (possibly `self`), and the call is guarding the argument.
+ * `acceptingValue` is either `true` or `false`, indicating which branch of
+ * the guard is protecting the parameter.
*/
extensible predicate barrierGuardModel(
- string path, string input, string branch, string kind, string provenance,
+ string path, string input, string acceptingValue, string kind, string provenance,
QlBuiltins::ExtensionId madId
);
@@ -163,9 +164,9 @@ predicate interpretModelForTest(QlBuiltins::ExtensionId madId, string model) {
model = "Barrier: " + path + "; " + output + "; " + kind
)
or
- exists(string path, string input, string branch, string kind |
- barrierGuardModel(path, input, branch, kind, _, madId) and
- model = "Barrier guard: " + path + "; " + input + "; " + branch + "; " + kind
+ exists(string path, string input, string acceptingValue, string kind |
+ barrierGuardModel(path, input, acceptingValue, kind, _, madId) and
+ model = "Barrier guard: " + path + "; " + input + "; " + acceptingValue + "; " + kind
)
}
@@ -275,10 +276,10 @@ private class FlowBarrierGuardFromModel extends FlowBarrierGuard::Range {
}
override predicate isBarrierGuard(
- string input, string branch, string kind, Provenance provenance, string model
+ string input, string acceptingValue, string kind, Provenance provenance, string model
) {
exists(QlBuiltins::ExtensionId madId |
- barrierGuardModel(path, input, branch, kind, provenance, madId) and
+ barrierGuardModel(path, input, acceptingValue, kind, provenance, madId) and
model = "MaD:" + madId.toString()
)
}
diff --git a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
index 0c6e42d9066a..ce980724778b 100644
--- a/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
@@ -388,11 +388,11 @@ module Make<
/**
* Holds if this element is a flow barrier guard of kind `kind`, for data
- * flowing in as described by `input`, when `this` evaluates to `branch`.
+ * flowing in as described by `input`, when `this` evaluates to `acceptingValue`.
*/
pragma[nomagic]
abstract predicate isBarrierGuard(
- string input, string branch, string kind, Provenance provenance, string model
+ string input, string acceptingValue, string kind, Provenance provenance, string model
);
}
@@ -764,10 +764,10 @@ module Make<
}
private predicate isRelevantBarrierGuard(
- BarrierGuardElement e, string input, string branch, string kind, Provenance provenance,
- string model
+ BarrierGuardElement e, string input, string acceptingValue, string kind,
+ Provenance provenance, string model
) {
- e.isBarrierGuard(input, branch, kind, provenance, model) and
+ e.isBarrierGuard(input, acceptingValue, kind, provenance, model) and
(
provenance.isManual()
or
@@ -1588,11 +1588,11 @@ module Make<
* Holds if `barrierGuard` is a relevant barrier guard element with input specification `inSpec`.
*/
predicate barrierGuardSpec(
- BarrierGuardElement barrierGuard, SummaryComponentStack inSpec, string branch, string kind,
- string model
+ BarrierGuardElement barrierGuard, SummaryComponentStack inSpec, string acceptingValue,
+ string kind, string model
) {
exists(string input |
- isRelevantBarrierGuard(barrierGuard, input, branch, kind, _, model) and
+ isRelevantBarrierGuard(barrierGuard, input, acceptingValue, kind, _, model) and
External::interpretSpec(input, inSpec)
)
}
From 187f7c7bcf95097648230c34a7cf7d857dc0aeea Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 27 Mar 2026 22:44:39 +0000
Subject: [PATCH 029/146] Python: Move isNetworkBind check into isSink
---
.../CVE-2018-1281/BindToAllInterfaces.ql | 20 ++++++-------------
.../BindToAllInterfaces.expected | 1 -
2 files changed, 6 insertions(+), 15 deletions(-)
diff --git a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
index 75c145ec0ace..14c17edc3591 100644
--- a/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
+++ b/python/ql/src/Security/CVE-2018-1281/BindToAllInterfaces.ql
@@ -34,7 +34,11 @@ private module BindToAllInterfacesConfig implements DataFlow::ConfigSig {
}
predicate isSink(DataFlow::Node sink) {
- ModelOutput::sinkNode(sink, "bind-socket-all-interfaces")
+ ModelOutput::sinkNode(sink, "bind-socket-all-interfaces") and
+ // Network socket addresses are tuples like (host, port), so we require
+ // the bind() argument to originate from a tuple expression. This excludes
+ // AF_UNIX sockets, which pass a plain string path to bind().
+ any(DataFlow::LocalSourceNode n | n.asExpr() instanceof Tuple).flowsTo(sink)
}
}
@@ -42,20 +46,8 @@ private module BindToAllInterfacesFlow = TaintTracking::Global
Date: Fri, 27 Mar 2026 23:46:50 +0100
Subject: [PATCH 030/146] Python: Update change note
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
.../2026-03-26-improve-bind-all-interfaces-query.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
index b4b5464b5037..bc78b2b6f776 100644
--- a/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
+++ b/python/ql/src/change-notes/2026-03-26-improve-bind-all-interfaces-query.md
@@ -2,4 +2,4 @@
category: minorAnalysis
---
-- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognised as socket binding operations.
+- The `py/bind-socket-all-network-interfaces` query now uses the global data-flow library, leading to better precision and more results. Also, wrappers of `socket.socket` in the `eventlet` and `gevent` libraries are now also recognized as socket binding operations.
From 84c01bc255b549f9b34fece46a588c3e1205f6d6 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:26:39 +0100
Subject: [PATCH 031/146] C++: Upgrade query precision.
---
cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
index 7f0a4833cb59..5842b9474f74 100644
--- a/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
+++ b/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity error
* @security-severity 7.5
- * @precision medium
+ * @precision high
* @id cpp/wrong-type-format-argument
* @tags reliability
* correctness
From fca567f6ea98abe390b446701fa82ff5c386b7d9 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:26:21 +0100
Subject: [PATCH 032/146] C++: Change note.
---
.../src/change-notes/2026-04-02-wrong-type-format-argument.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md b/cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md
new file mode 100644
index 000000000000..f8b9085dacc6
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-wrong-type-format-argument.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From b41a4ff5e4c06ac0e2308786bf82490e00b232a3 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:28:19 +0100
Subject: [PATCH 033/146] C++: Upgrade query precision.
---
cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql b/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
index 6747d177c80e..b05bd637dc2d 100644
--- a/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
+++ b/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
@@ -5,7 +5,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.1
- * @precision medium
+ * @precision high
* @id cpp/integer-multiplication-cast-to-long
* @tags reliability
* security
From 909b55a40a2e4a85ce4ea04ff8d6a179c0b6399e Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:28:34 +0100
Subject: [PATCH 034/146] C++: Change note.
---
.../2026-04-02-integer-multiplication-cast-to-long.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md b/cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md
new file mode 100644
index 000000000000..cd6796b408f0
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-integer-multiplication-cast-to-long.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From 520e95d92c255dc4e54ccaadc8c31121f0651ded Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:30:34 +0100
Subject: [PATCH 035/146] C++: Upgrade query precision.
---
cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
index 3f330807304f..7d9ef88adea1 100644
--- a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 7.8
- * @precision medium
+ * @precision high
* @tags reliability
* security
* external/cwe/cwe-190
From 9dbbdef4cbab1c6bb4f63825112f329b3f5f5fad Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:30:52 +0100
Subject: [PATCH 036/146] C++: Change note.
---
.../src/change-notes/2026-04-02-comparison-with-wider-type.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md b/cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md
new file mode 100644
index 000000000000..c84e1dba404c
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-comparison-with-wider-type.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Comparison of narrow type with wide type in loop condition" (`cpp/comparison-with-wider-type`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From 2d02056e5c2434b85a853b8d414a5bffa327ed1c Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:34:54 +0100
Subject: [PATCH 037/146] C++: Second change note.
---
.../change-notes/2026-04-02-implicit-function-declaration.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md b/cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md
new file mode 100644
index 000000000000..dd0dbd4bc7d9
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-implicit-function-declaration.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Implicit function declaration" (`cpp/implicit-function-declaration`) query has been upgraded to `high` precision.
From e83658ed06c43ea71f6d35adf1285592ae15148d Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:38:09 +0100
Subject: [PATCH 038/146] C++: Upgrade query precision.
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 007ef71a1630..0cf6c8b3714e 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -5,7 +5,7 @@
* may lead to unpredictable behavior.
* @kind problem
* @problem.severity warning
- * @precision medium
+ * @precision high
* @id cpp/implicit-function-declaration
* @tags correctness
* maintainability
From 9eabfc5fdc5d3b809641e4f8b81c1188b6d9a743 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:39:45 +0100
Subject: [PATCH 039/146] Update cpp/ql/src/Likely Bugs/Underspecified
Functions/ImplicitFunctionDeclaration.ql
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
---
.../Underspecified Functions/ImplicitFunctionDeclaration.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
index 0cf6c8b3714e..00b29efbd0f2 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.ql
@@ -18,7 +18,7 @@ import TooManyArguments
import semmle.code.cpp.commons.Exclusions
/*
- * This query is not compatible with build mode: none databases, and has
+ * This query is not compatible with build mode: none databases, and produces
* no results on those databases.
*/
From 56af9a84ab4f6232bf03c10bc08def2a4611cb83 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:40:51 +0100
Subject: [PATCH 040/146] Update cpp/ql/src/Likely Bugs/Underspecified
Functions/ImplicitFunctionDeclaration.qhelp
---
.../Underspecified Functions/ImplicitFunctionDeclaration.qhelp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
index d9b5a0220773..90a98e1bf573 100644
--- a/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
+++ b/cpp/ql/src/Likely Bugs/Underspecified Functions/ImplicitFunctionDeclaration.qhelp
@@ -14,7 +14,7 @@ function may behave unpredictably.
This may indicate a misspelled function name, or that the required header containing
the function declaration has not been included.
-Note: This query is not compatible with build mode: none databases, and produces
+
Note: This query is not compatible with build mode: none databases, and produces
no results on those databases.
From 70b72f70e14f51930f3c9c4de67174ca0636214e Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:32:53 +0100
Subject: [PATCH 041/146] C++: Upgrade query precision.
---
cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
index 343e96a00d39..d5a5cd8f6655 100644
--- a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
+++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
@@ -6,7 +6,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 8.8
- * @precision medium
+ * @precision high
* @id cpp/suspicious-add-sizeof
* @tags security
* external/cwe/cwe-468
From cc89b6ea919eb619ee932c2008fca5bbdeb4da08 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Thu, 2 Apr 2026 11:33:06 +0100
Subject: [PATCH 042/146] C++: Change note.
---
cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md
diff --git a/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md
new file mode 100644
index 000000000000..040e89c13475
--- /dev/null
+++ b/cpp/ql/src/change-notes/2026-04-02-suspicious-add-sizeof.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query has been upgraded to `high` precision. This query will now run in the default code scanning suite.
From 5866bcc8816a23b612043ba4dbb847eb4f36a019 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:41:41 +0200
Subject: [PATCH 043/146] Actions: Add FP test for
`actions/missing-workflow-permissions`
---
.../Security/CWE-275/.github/workflows/perms11.yml | 9 +++++++++
.../Security/CWE-275/.github/workflows/perms12.yml | 11 +++++++++++
.../CWE-275/MissingActionsPermissions.expected | 1 +
3 files changed, 21 insertions(+)
create mode 100644 actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml
create mode 100644 actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml
new file mode 100644
index 000000000000..717cdabc3025
--- /dev/null
+++ b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms11.yml
@@ -0,0 +1,9 @@
+on:
+ workflow_call:
+
+jobs:
+ build:
+ name: Build and test
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/deploy-pages
diff --git a/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml
new file mode 100644
index 000000000000..25ac1f532481
--- /dev/null
+++ b/actions/ql/test/query-tests/Security/CWE-275/.github/workflows/perms12.yml
@@ -0,0 +1,11 @@
+on:
+ workflow_dispatch:
+
+permissions:
+ contents: read
+ id-token: write
+ pages: write
+
+jobs:
+ call-workflow:
+ uses: ./.github/workflows/perms11.yml
diff --git a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
index 52a045e0de21..74edf8a7d389 100644
--- a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
+++ b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
@@ -6,3 +6,4 @@
| .github/workflows/perms8.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
| .github/workflows/perms9.yml:7:5:10:44 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {packages: write} |
| .github/workflows/perms10.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, models: read} |
+| .github/workflows/perms11.yml:6:5:9:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
From 74e6d3474d4a0f03a870a0ab5f23cb66f325ad3d Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:42:45 +0200
Subject: [PATCH 044/146] Actions: Correctly check permissions in
`actions/missing-workflow-permissions`
---
.../CWE-275/MissingActionsPermissions.ql | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql b/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
index a8bd8a5f93dc..00f601fd5daf 100644
--- a/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
+++ b/actions/ql/src/Security/CWE-275/MissingActionsPermissions.ql
@@ -26,10 +26,23 @@ string permissionsForJob(Job job) {
"{" + concat(string permission | permission = jobNeedsPermission(job) | permission, ", ") + "}"
}
+predicate jobHasPermissions(Job job) {
+ exists(job.getPermissions())
+ or
+ exists(job.getEnclosingWorkflow().getPermissions())
+ or
+ // The workflow is reusable and cannot be triggered in any other way; check callers
+ exists(ReusableWorkflow r | r = job.getEnclosingWorkflow() |
+ not exists(Event e | e = r.getOn().getAnEvent() | e.getName() != "workflow_call") and
+ forall(Job caller | caller = job.getEnclosingWorkflow().(ReusableWorkflow).getACaller() |
+ jobHasPermissions(caller)
+ )
+ )
+}
+
from Job job, string permissions
where
- not exists(job.getPermissions()) and
- not exists(job.getEnclosingWorkflow().getPermissions()) and
+ not jobHasPermissions(job) and
// exists a trigger event that is not a workflow_call
exists(Event e |
e = job.getATriggerEvent() and
From 47409d1c599c2367c67e649bf89a4817cee9e1b2 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:43:49 +0200
Subject: [PATCH 045/146] Actions: Update expected test results
---
.../Security/CWE-275/MissingActionsPermissions.expected | 1 -
1 file changed, 1 deletion(-)
diff --git a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
index 74edf8a7d389..52a045e0de21 100644
--- a/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
+++ b/actions/ql/test/query-tests/Security/CWE-275/MissingActionsPermissions.expected
@@ -6,4 +6,3 @@
| .github/workflows/perms8.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
| .github/workflows/perms9.yml:7:5:10:44 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {packages: write} |
| .github/workflows/perms10.yml:7:5:10:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read, models: read} |
-| .github/workflows/perms11.yml:6:5:9:33 | Job: build | Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {id-token: write, pages: write} |
From 87f9b9581ec3bb327ea78fbc82a6b3f3c4c2c355 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Thu, 2 Apr 2026 15:48:45 +0200
Subject: [PATCH 046/146] Actions: Add change note
---
actions/ql/src/change-notes/2026-04-02-permissions.md | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 actions/ql/src/change-notes/2026-04-02-permissions.md
diff --git a/actions/ql/src/change-notes/2026-04-02-permissions.md b/actions/ql/src/change-notes/2026-04-02-permissions.md
new file mode 100644
index 000000000000..2672a30ef870
--- /dev/null
+++ b/actions/ql/src/change-notes/2026-04-02-permissions.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The query `actions/missing-workflow-permissions` no longer produces false positive results on reusable workflows where all callers set permissions.
\ No newline at end of file
From e69e30aa84b9240369b7b32e83a0e84a11e402d6 Mon Sep 17 00:00:00 2001
From: Kristen Newbury
Date: Thu, 2 Apr 2026 11:32:37 -0400
Subject: [PATCH 047/146] Adjust alert messages
CWE-829/ArtifactPoisoning[Critical|Medium]
---
actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql | 4 ++--
actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql | 3 +--
actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md | 4 ++++
3 files changed, 7 insertions(+), 4 deletions(-)
create mode 100644 actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
index 24ecb4b03397..fc65f93f5c09 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
@@ -21,5 +21,5 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
event = getRelevantEventInPrivilegedContext(sink.getNode())
select sink.getNode(), source, sink,
- "Potential artifact poisoning in $@, which may be controlled by an external user ($@).", sink,
- sink.getNode().toString(), event, event.getName()
+ "Potential artifact poisoning, which may be controlled by an external user ($@).", event,
+ event.getName()
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
index d2aff7da95ff..6caba3571146 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
@@ -21,5 +21,4 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
inNonPrivilegedContext(sink.getNode().asExpr())
select sink.getNode(), source, sink,
- "Potential artifact poisoning in $@, which may be controlled by an external user.", sink,
- sink.getNode().toString()
+ "Potential artifact poisoning, which may be controlled by an external user."
diff --git a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
new file mode 100644
index 000000000000..5b016941566e
--- /dev/null
+++ b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand.
\ No newline at end of file
From 41714656ec52f1dd92b1e47ddb47a4438be05676 Mon Sep 17 00:00:00 2001
From: Kristen Newbury
Date: Thu, 2 Apr 2026 11:58:58 -0400
Subject: [PATCH 048/146] Adjust alert messages actions CWE-829
---
.../CWE-829/ArtifactPoisoningCritical.ql | 4 +--
.../CWE-829/ArtifactPoisoningMedium.ql | 2 +-
.../2026-04-02-alert-msg-poisoning.md | 2 +-
.../ArtifactPoisoningCritical.expected | 36 +++++++++----------
4 files changed, 22 insertions(+), 22 deletions(-)
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
index fc65f93f5c09..44b69cd46b2e 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
@@ -21,5 +21,5 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
event = getRelevantEventInPrivilegedContext(sink.getNode())
select sink.getNode(), source, sink,
- "Potential artifact poisoning, which may be controlled by an external user ($@).", event,
- event.getName()
+ "Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@).",
+ event, event.getName()
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
index 6caba3571146..cc5532172e82 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
@@ -21,4 +21,4 @@ where
ArtifactPoisoningFlow::flowPath(source, sink) and
inNonPrivilegedContext(sink.getNode().asExpr())
select sink.getNode(), source, sink,
- "Potential artifact poisoning, which may be controlled by an external user."
+ "Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user."
diff --git a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
index 5b016941566e..30936d8b5c54 100644
--- a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
+++ b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
@@ -1,4 +1,4 @@
---
category: majorAnalysis
---
-* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand.
\ No newline at end of file
+* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also clarify the wording to make it clear that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed.
\ No newline at end of file
diff --git a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
index 2d29cd9b79b4..75f08e0357e0 100644
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
@@ -55,21 +55,21 @@ nodes
| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | semmle.label | ./gradlew buildScanPublishPrevious\n |
subpaths
#select
-| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | .github/workflows/artifactpoisoning12.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | python foo/x.py | .github/workflows/artifactpoisoning12.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | sh foo/cmd\n | .github/workflows/artifactpoisoning21.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | .github/workflows/artifactpoisoning22.yml:13:9:17:6 | Uses Step | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | sh cmd | .github/workflows/artifactpoisoning22.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | .github/workflows/artifactpoisoning31.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | ./foo/cmd | .github/workflows/artifactpoisoning31.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning32.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | ./bar/cmd\n | .github/workflows/artifactpoisoning32.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning33.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | ./bar/cmd\n | .github/workflows/artifactpoisoning33.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | .github/workflows/artifactpoisoning34.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | npm install\nnpm run lint\n | .github/workflows/artifactpoisoning34.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | .github/workflows/artifactpoisoning41.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | ./foo/cmd | .github/workflows/artifactpoisoning41.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | .github/workflows/artifactpoisoning42.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | ./cmd | .github/workflows/artifactpoisoning42.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | sed -f config foo.md > bar.md\n | .github/workflows/artifactpoisoning71.yml:4:5:4:16 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | python test.py | .github/workflows/artifactpoisoning81.yml:3:5:3:23 | pull_request_target | pull_request_target |
-| .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Uses Step | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | make snapshot | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | .github/workflows/artifactpoisoning96.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | npm install | .github/workflows/artifactpoisoning96.yml:2:3:2:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:4:3:4:21 | pull_request_target | pull_request_target |
-| .github/workflows/test18.yml:36:15:40:58 | Uses Step | .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Uses Step | .github/workflows/test18.yml:3:5:3:16 | workflow_run | workflow_run |
-| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | Potential artifact poisoning in $@, which may be controlled by an external user ($@). | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:2:3:2:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning11.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | .github/workflows/artifactpoisoning12.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning12.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning21.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | .github/workflows/artifactpoisoning22.yml:13:9:17:6 | Uses Step | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning22.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | .github/workflows/artifactpoisoning31.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning31.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning32.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning32.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning33.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning33.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | .github/workflows/artifactpoisoning34.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning34.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | .github/workflows/artifactpoisoning41.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning41.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | .github/workflows/artifactpoisoning42.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning42.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning71.yml:4:5:4:16 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning81.yml:3:5:3:23 | pull_request_target | pull_request_target |
+| .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | .github/workflows/artifactpoisoning96.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning96.yml:2:3:2:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning101.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/test18.yml:36:15:40:58 | Uses Step | .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test18.yml:3:5:3:16 | workflow_run | workflow_run |
+| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test25.yml:2:3:2:14 | workflow_run | workflow_run |
From 4fe2f6d2b44e0ea850d8cfffaee5b107aac24791 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 6 Apr 2026 10:30:38 +0000
Subject: [PATCH 049/146] Release preparation for version 2.25.2
---
actions/ql/lib/CHANGELOG.md | 4 ++++
.../ql/lib/change-notes/released/0.4.33.md | 3 +++
actions/ql/lib/codeql-pack.release.yml | 2 +-
actions/ql/lib/qlpack.yml | 2 +-
actions/ql/src/CHANGELOG.md | 4 ++++
.../ql/src/change-notes/released/0.6.25.md | 3 +++
actions/ql/src/codeql-pack.release.yml | 2 +-
actions/ql/src/qlpack.yml | 2 +-
cpp/ql/lib/CHANGELOG.md | 20 +++++++++++++++++++
...6-03-20-add-indirect-uninitialized-node.md | 4 ----
...rameter-nodes-and-indirect-instructions.md | 5 -----
.../lib/change-notes/2026-03-24-field-init.md | 5 -----
.../2026-03-26-convert-csv-models-to-yml.md | 4 ----
.../change-notes/2026-03-30-nsdmi-dataflow.md | 4 ----
.../2026-03-31-http-flow-sources.md | 4 ----
cpp/ql/lib/change-notes/2026-03-31-meson.md | 4 ----
cpp/ql/lib/change-notes/released/9.0.0.md | 19 ++++++++++++++++++
cpp/ql/lib/codeql-pack.release.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/CHANGELOG.md | 14 +++++++++++++
...-11-integer-multiplication-cast-to-long.md | 4 ----
...3-adjust-xss-and-log-injection-severity.md | 4 ----
.../2026-03-16-wrong-type-format-argument.md | 4 ----
.../2026-03-19-suspicious-add-sizeof.md | 4 ----
.../2026-03-19-tainted-format-string.md | 4 ----
.../2026-03-30-warning-diagnostics.md | 4 ----
cpp/ql/src/change-notes/released/1.6.0.md | 13 ++++++++++++
cpp/ql/src/codeql-pack.release.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
.../ql/campaigns/Solorigate/lib/CHANGELOG.md | 4 ++++
.../lib/change-notes/released/1.7.64.md | 3 +++
.../Solorigate/lib/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
.../ql/campaigns/Solorigate/src/CHANGELOG.md | 4 ++++
.../src/change-notes/released/1.7.64.md | 3 +++
.../Solorigate/src/codeql-pack.release.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/CHANGELOG.md | 10 ++++++++++
.../2026-03-26-expanded-assignments.md | 4 ----
.../5.4.12.md} | 8 +++++---
csharp/ql/lib/codeql-pack.release.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/CHANGELOG.md | 11 ++++++++++
...3-adjust-xss-and-log-injection-severity.md | 5 -----
.../1.7.0.md} | 12 ++++++++---
csharp/ql/src/codeql-pack.release.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
.../codeql-pack.release.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/CHANGELOG.md | 4 ++++
go/ql/lib/change-notes/released/7.0.5.md | 3 +++
go/ql/lib/codeql-pack.release.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/CHANGELOG.md | 7 +++++++
.../1.6.0.md} | 7 ++++---
go/ql/src/codeql-pack.release.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/lib/CHANGELOG.md | 9 +++++++++
.../change-notes/2026-03-26-kotlin-2.3.20.md | 4 ----
...6-03-28-tainted-arithmetic-bounds-check.md | 4 ----
.../9.0.3.md} | 9 ++++++---
java/ql/lib/codeql-pack.release.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/CHANGELOG.md | 7 +++++++
.../1.11.0.md} | 7 ++++---
java/ql/src/codeql-pack.release.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/CHANGELOG.md | 4 ++++
.../ql/lib/change-notes/released/2.6.27.md | 3 +++
javascript/ql/lib/codeql-pack.release.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/CHANGELOG.md | 4 ++++
.../ql/src/change-notes/released/2.3.7.md | 3 +++
javascript/ql/src/codeql-pack.release.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
misc/suite-helpers/codeql-pack.release.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/CHANGELOG.md | 6 ++++++
.../7.0.4.md} | 6 +++---
python/ql/lib/codeql-pack.release.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/CHANGELOG.md | 11 ++++++++++
...026-03-13-port-simple-points-to-queries.md | 5 -----
.../1.8.0.md} | 11 +++++++---
python/ql/src/codeql-pack.release.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/CHANGELOG.md | 4 ++++
ruby/ql/lib/change-notes/released/5.1.15.md | 3 +++
ruby/ql/lib/codeql-pack.release.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/CHANGELOG.md | 7 +++++++
.../1.6.0.md} | 7 ++++---
ruby/ql/src/codeql-pack.release.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
rust/ql/lib/CHANGELOG.md | 4 ++++
rust/ql/lib/change-notes/released/0.2.11.md | 3 +++
rust/ql/lib/codeql-pack.release.yml | 2 +-
rust/ql/lib/qlpack.yml | 2 +-
rust/ql/src/CHANGELOG.md | 7 +++++++
.../0.1.32.md} | 7 ++++---
rust/ql/src/codeql-pack.release.yml | 2 +-
rust/ql/src/qlpack.yml | 2 +-
shared/concepts/CHANGELOG.md | 4 ++++
.../concepts/change-notes/released/0.0.21.md | 3 +++
shared/concepts/codeql-pack.release.yml | 2 +-
shared/concepts/qlpack.yml | 2 +-
shared/controlflow/CHANGELOG.md | 4 ++++
.../change-notes/released/2.0.31.md | 3 +++
shared/controlflow/codeql-pack.release.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/CHANGELOG.md | 4 ++++
.../dataflow/change-notes/released/2.1.3.md | 3 +++
shared/dataflow/codeql-pack.release.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/CHANGELOG.md | 4 ++++
shared/mad/change-notes/released/1.0.47.md | 3 +++
shared/mad/codeql-pack.release.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/quantum/CHANGELOG.md | 4 ++++
.../quantum/change-notes/released/0.0.25.md | 3 +++
shared/quantum/codeql-pack.release.yml | 2 +-
shared/quantum/qlpack.yml | 2 +-
shared/rangeanalysis/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
shared/rangeanalysis/codeql-pack.release.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/CHANGELOG.md | 4 ++++
shared/regex/change-notes/released/1.0.47.md | 3 +++
shared/regex/codeql-pack.release.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/CHANGELOG.md | 4 ++++
shared/ssa/change-notes/released/2.0.23.md | 3 +++
shared/ssa/codeql-pack.release.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/CHANGELOG.md | 4 ++++
.../change-notes/released/1.0.47.md | 3 +++
shared/threat-models/codeql-pack.release.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/CHANGELOG.md | 4 ++++
.../tutorial/change-notes/released/1.0.47.md | 3 +++
shared/tutorial/codeql-pack.release.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typeflow/CHANGELOG.md | 4 ++++
.../typeflow/change-notes/released/1.0.47.md | 3 +++
shared/typeflow/codeql-pack.release.yml | 2 +-
shared/typeflow/qlpack.yml | 2 +-
shared/typeinference/CHANGELOG.md | 4 ++++
.../change-notes/released/0.0.28.md | 3 +++
shared/typeinference/codeql-pack.release.yml | 2 +-
shared/typeinference/qlpack.yml | 2 +-
shared/typetracking/CHANGELOG.md | 4 ++++
.../change-notes/released/2.0.31.md | 3 +++
shared/typetracking/codeql-pack.release.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/CHANGELOG.md | 4 ++++
shared/typos/change-notes/released/1.0.47.md | 3 +++
shared/typos/codeql-pack.release.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/CHANGELOG.md | 4 ++++
shared/util/change-notes/released/2.0.34.md | 3 +++
shared/util/codeql-pack.release.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/xml/CHANGELOG.md | 4 ++++
shared/xml/change-notes/released/1.0.47.md | 3 +++
shared/xml/codeql-pack.release.yml | 2 +-
shared/xml/qlpack.yml | 2 +-
shared/yaml/CHANGELOG.md | 4 ++++
shared/yaml/change-notes/released/1.0.47.md | 3 +++
shared/yaml/codeql-pack.release.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/CHANGELOG.md | 4 ++++
swift/ql/lib/change-notes/released/6.3.3.md | 3 +++
swift/ql/lib/codeql-pack.release.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/CHANGELOG.md | 6 ++++++
.../1.3.0.md} | 7 ++++---
swift/ql/src/codeql-pack.release.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
182 files changed, 483 insertions(+), 188 deletions(-)
create mode 100644 actions/ql/lib/change-notes/released/0.4.33.md
create mode 100644 actions/ql/src/change-notes/released/0.6.25.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-24-field-init.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md
delete mode 100644 cpp/ql/lib/change-notes/2026-03-31-meson.md
create mode 100644 cpp/ql/lib/change-notes/released/9.0.0.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
delete mode 100644 cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md
create mode 100644 cpp/ql/src/change-notes/released/1.6.0.md
create mode 100644 csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md
create mode 100644 csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md
delete mode 100644 csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md
rename csharp/ql/lib/change-notes/{2026-03-19-fix-log-forging-extension-methods.md => released/5.4.12.md} (52%)
delete mode 100644 csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename csharp/ql/src/change-notes/{2026-03-31-constantcondition-simplify.md => released/1.7.0.md} (58%)
create mode 100644 go/ql/consistency-queries/change-notes/released/1.0.47.md
create mode 100644 go/ql/lib/change-notes/released/7.0.5.md
rename go/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.6.0.md} (87%)
delete mode 100644 java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md
delete mode 100644 java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md
rename java/ql/lib/change-notes/{2026-03-27-add-ec-to-secure-algorithms.md => released/9.0.3.md} (63%)
rename java/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.11.0.md} (88%)
create mode 100644 javascript/ql/lib/change-notes/released/2.6.27.md
create mode 100644 javascript/ql/src/change-notes/released/2.3.7.md
create mode 100644 misc/suite-helpers/change-notes/released/1.0.47.md
rename python/ql/lib/change-notes/{2026-03-11-fix-unresolved-relative-imports.md => released/7.0.4.md} (89%)
delete mode 100644 python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md
rename python/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.8.0.md} (56%)
create mode 100644 ruby/ql/lib/change-notes/released/5.1.15.md
rename ruby/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.6.0.md} (87%)
create mode 100644 rust/ql/lib/change-notes/released/0.2.11.md
rename rust/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/0.1.32.md} (84%)
create mode 100644 shared/concepts/change-notes/released/0.0.21.md
create mode 100644 shared/controlflow/change-notes/released/2.0.31.md
create mode 100644 shared/dataflow/change-notes/released/2.1.3.md
create mode 100644 shared/mad/change-notes/released/1.0.47.md
create mode 100644 shared/quantum/change-notes/released/0.0.25.md
create mode 100644 shared/rangeanalysis/change-notes/released/1.0.47.md
create mode 100644 shared/regex/change-notes/released/1.0.47.md
create mode 100644 shared/ssa/change-notes/released/2.0.23.md
create mode 100644 shared/threat-models/change-notes/released/1.0.47.md
create mode 100644 shared/tutorial/change-notes/released/1.0.47.md
create mode 100644 shared/typeflow/change-notes/released/1.0.47.md
create mode 100644 shared/typeinference/change-notes/released/0.0.28.md
create mode 100644 shared/typetracking/change-notes/released/2.0.31.md
create mode 100644 shared/typos/change-notes/released/1.0.47.md
create mode 100644 shared/util/change-notes/released/2.0.34.md
create mode 100644 shared/xml/change-notes/released/1.0.47.md
create mode 100644 shared/yaml/change-notes/released/1.0.47.md
create mode 100644 swift/ql/lib/change-notes/released/6.3.3.md
rename swift/ql/src/change-notes/{2026-03-13-adjust-xss-and-log-injection-severity.md => released/1.3.0.md} (75%)
diff --git a/actions/ql/lib/CHANGELOG.md b/actions/ql/lib/CHANGELOG.md
index 03201c9603af..d625bc6f619e 100644
--- a/actions/ql/lib/CHANGELOG.md
+++ b/actions/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.4.33
+
+No user-facing changes.
+
## 0.4.32
No user-facing changes.
diff --git a/actions/ql/lib/change-notes/released/0.4.33.md b/actions/ql/lib/change-notes/released/0.4.33.md
new file mode 100644
index 000000000000..99c04e352dff
--- /dev/null
+++ b/actions/ql/lib/change-notes/released/0.4.33.md
@@ -0,0 +1,3 @@
+## 0.4.33
+
+No user-facing changes.
diff --git a/actions/ql/lib/codeql-pack.release.yml b/actions/ql/lib/codeql-pack.release.yml
index 3201cd9b0637..7581fef2abf7 100644
--- a/actions/ql/lib/codeql-pack.release.yml
+++ b/actions/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.4.32
+lastReleaseVersion: 0.4.33
diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml
index bc4a8ba134ba..131f29b87aaa 100644
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-all
-version: 0.4.33-dev
+version: 0.4.33
library: true
warnOnImplicitThis: true
dependencies:
diff --git a/actions/ql/src/CHANGELOG.md b/actions/ql/src/CHANGELOG.md
index e42a19a8168f..d991237aca97 100644
--- a/actions/ql/src/CHANGELOG.md
+++ b/actions/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.25
+
+No user-facing changes.
+
## 0.6.24
No user-facing changes.
diff --git a/actions/ql/src/change-notes/released/0.6.25.md b/actions/ql/src/change-notes/released/0.6.25.md
new file mode 100644
index 000000000000..b9d9e69c728d
--- /dev/null
+++ b/actions/ql/src/change-notes/released/0.6.25.md
@@ -0,0 +1,3 @@
+## 0.6.25
+
+No user-facing changes.
diff --git a/actions/ql/src/codeql-pack.release.yml b/actions/ql/src/codeql-pack.release.yml
index f4aa7271ace7..b8288b392226 100644
--- a/actions/ql/src/codeql-pack.release.yml
+++ b/actions/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.6.24
+lastReleaseVersion: 0.6.25
diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml
index 3f76a5273f15..024862b808a6 100644
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-queries
-version: 0.6.25-dev
+version: 0.6.25
library: false
warnOnImplicitThis: true
groups: [actions, queries]
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
index 686195e9211e..5b5bc748c5dd 100644
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,23 @@
+## 9.0.0
+
+### Breaking Changes
+
+* The `SourceModelCsv`, `SinkModelCsv`, and `SummaryModelCsv` classes and the associated CSV parsing infrastructure have been removed from `ExternalFlow.qll`. New models should be added as `.model.yml` files in the `ext/` directory.
+
+### New Features
+
+* Added a subclass `MesonPrivateTestFile` of `ConfigurationTestFile` that represents files created by Meson to test the build configuration.
+* Added a class `ConstructorDirectFieldInit` to represent field initializations that occur in member initializer lists.
+* Added a class `ConstructorDefaultFieldInit` to represent default field initializations.
+* Added a class `DataFlow::IndirectParameterNode` to represent the indirection of a parameter as a dataflow node.
+* Added a predicate `Node::asIndirectInstruction` which returns the `Instruction` that defines the indirect dataflow node, if any.
+* Added a class `IndirectUninitializedNode` to represent the indirection of an uninitialized local variable as a dataflow node.
+
+### Minor Analysis Improvements
+
+* Added `HttpReceiveHttpRequest`, `HttpReceiveRequestEntityBody`, and `HttpReceiveClientCertificate` from Win32's `http.h` as remote flow sources.
+* Added dataflow through members initialized via non-static data member initialization (NSDMI).
+
## 8.0.3
No user-facing changes.
diff --git a/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md b/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md
deleted file mode 100644
index 07235e047d43..000000000000
--- a/cpp/ql/lib/change-notes/2026-03-20-add-indirect-uninitialized-node.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added a class `IndirectUninitializedNode` to represent the indirection of an uninitialized local variable as a dataflow node.
diff --git a/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md b/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md
deleted file mode 100644
index c3bd4028ee97..000000000000
--- a/cpp/ql/lib/change-notes/2026-03-23-indirect-parameter-nodes-and-indirect-instructions.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: feature
----
-* Added a class `DataFlow::IndirectParameterNode` to represent the indirection of a parameter as a dataflow node.
-* Added a predicate `Node::asIndirectInstruction` which returns the `Instruction` that defines the indirect dataflow node, if any.
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2026-03-24-field-init.md b/cpp/ql/lib/change-notes/2026-03-24-field-init.md
deleted file mode 100644
index c11329a3d9f0..000000000000
--- a/cpp/ql/lib/change-notes/2026-03-24-field-init.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: feature
----
-* Added a class `ConstructorDirectFieldInit` to represent field initializations that occur in member initializer lists.
-* Added a class `ConstructorDefaultFieldInit` to represent default field initializations.
diff --git a/cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md b/cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md
deleted file mode 100644
index 41d77b518f14..000000000000
--- a/cpp/ql/lib/change-notes/2026-03-26-convert-csv-models-to-yml.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: breaking
----
-* The `SourceModelCsv`, `SinkModelCsv`, and `SummaryModelCsv` classes and the associated CSV parsing infrastructure have been removed from `ExternalFlow.qll`. New models should be added as `.model.yml` files in the `ext/` directory.
diff --git a/cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md b/cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md
deleted file mode 100644
index 8bf879003304..000000000000
--- a/cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added dataflow through members initialized via non-static data member initialization (NSDMI).
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md b/cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md
deleted file mode 100644
index 54a0ad81036d..000000000000
--- a/cpp/ql/lib/change-notes/2026-03-31-http-flow-sources.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Added `HttpReceiveHttpRequest`, `HttpReceiveRequestEntityBody`, and `HttpReceiveClientCertificate` from Win32's `http.h` as remote flow sources.
\ No newline at end of file
diff --git a/cpp/ql/lib/change-notes/2026-03-31-meson.md b/cpp/ql/lib/change-notes/2026-03-31-meson.md
deleted file mode 100644
index c18de40b85db..000000000000
--- a/cpp/ql/lib/change-notes/2026-03-31-meson.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: feature
----
-* Added a subclass `MesonPrivateTestFile` of `ConfigurationTestFile` that represents files created by Meson to test the build configuration.
diff --git a/cpp/ql/lib/change-notes/released/9.0.0.md b/cpp/ql/lib/change-notes/released/9.0.0.md
new file mode 100644
index 000000000000..2f97209a02d2
--- /dev/null
+++ b/cpp/ql/lib/change-notes/released/9.0.0.md
@@ -0,0 +1,19 @@
+## 9.0.0
+
+### Breaking Changes
+
+* The `SourceModelCsv`, `SinkModelCsv`, and `SummaryModelCsv` classes and the associated CSV parsing infrastructure have been removed from `ExternalFlow.qll`. New models should be added as `.model.yml` files in the `ext/` directory.
+
+### New Features
+
+* Added a subclass `MesonPrivateTestFile` of `ConfigurationTestFile` that represents files created by Meson to test the build configuration.
+* Added a class `ConstructorDirectFieldInit` to represent field initializations that occur in member initializer lists.
+* Added a class `ConstructorDefaultFieldInit` to represent default field initializations.
+* Added a class `DataFlow::IndirectParameterNode` to represent the indirection of a parameter as a dataflow node.
+* Added a predicate `Node::asIndirectInstruction` which returns the `Instruction` that defines the indirect dataflow node, if any.
+* Added a class `IndirectUninitializedNode` to represent the indirection of an uninitialized local variable as a dataflow node.
+
+### Minor Analysis Improvements
+
+* Added `HttpReceiveHttpRequest`, `HttpReceiveRequestEntityBody`, and `HttpReceiveClientCertificate` from Win32's `http.h` as remote flow sources.
+* Added dataflow through members initialized via non-static data member initialization (NSDMI).
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
index 1be4ac8d0d39..fd5f4a48b3c1 100644
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 8.0.3
+lastReleaseVersion: 9.0.0
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index 802f3c3e4de8..e4e7a96ef681 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 8.0.4-dev
+version: 9.0.0
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
index 126b1d9efa34..a3f9d1836ade 100644
--- a/cpp/ql/src/CHANGELOG.md
+++ b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,17 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cpp/cgi-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Minor Analysis Improvements
+
+* The "Extraction warnings" (`cpp/diagnostics/extraction-warnings`) diagnostics query no longer yields `ExtractionRecoverableWarning`s for `build-mode: none` databases. The results were found to significantly increase the sizes of the produced SARIF files, making them unprocessable in some cases.
+* Fixed an issue with the "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Uncontrolled format string" (`cpp/tainted-format-string`) query involving certain kinds of formatting function implementations.
+* Fixed an issue with the "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query causing false positive results in `build-mode: none` databases.
+
## 1.5.15
No user-facing changes.
diff --git a/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md b/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
deleted file mode 100644
index 4d4a66c0a226..000000000000
--- a/cpp/ql/src/change-notes/2026-03-11-integer-multiplication-cast-to-long.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
deleted file mode 100644
index 0810e9c49bac..000000000000
--- a/cpp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: queryMetadata
----
-* The `@security-severity` metadata of `cpp/cgi-xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md b/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
deleted file mode 100644
index 84aef7791fcf..000000000000
--- a/cpp/ql/src/change-notes/2026-03-16-wrong-type-format-argument.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md b/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
deleted file mode 100644
index 387e2d44b469..000000000000
--- a/cpp/ql/src/change-notes/2026-03-19-suspicious-add-sizeof.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md b/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
deleted file mode 100644
index 6a1133917bf7..000000000000
--- a/cpp/ql/src/change-notes/2026-03-19-tainted-format-string.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Fixed an issue with the "Uncontrolled format string" (`cpp/tainted-format-string`) query involving certain kinds of formatting function implementations.
diff --git a/cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md b/cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md
deleted file mode 100644
index 0db0d7c718da..000000000000
--- a/cpp/ql/src/change-notes/2026-03-30-warning-diagnostics.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The "Extraction warnings" (`cpp/diagnostics/extraction-warnings`) diagnostics query no longer yields `ExtractionRecoverableWarning`s for `build-mode: none` databases. The results were found to significantly increase the sizes of the produced SARIF files, making them unprocessable in some cases.
diff --git a/cpp/ql/src/change-notes/released/1.6.0.md b/cpp/ql/src/change-notes/released/1.6.0.md
new file mode 100644
index 000000000000..3bbb94806609
--- /dev/null
+++ b/cpp/ql/src/change-notes/released/1.6.0.md
@@ -0,0 +1,13 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cpp/cgi-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Minor Analysis Improvements
+
+* The "Extraction warnings" (`cpp/diagnostics/extraction-warnings`) diagnostics query no longer yields `ExtractionRecoverableWarning`s for `build-mode: none` databases. The results were found to significantly increase the sizes of the produced SARIF files, making them unprocessable in some cases.
+* Fixed an issue with the "Suspicious add with sizeof" (`cpp/suspicious-add-sizeof`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Uncontrolled format string" (`cpp/tainted-format-string`) query involving certain kinds of formatting function implementations.
+* Fixed an issue with the "Wrong type of arguments to formatting function" (`cpp/wrong-type-format-argument`) query causing false positive results in `build-mode: none` databases.
+* Fixed an issue with the "Multiplication result converted to larger type" (`cpp/integer-multiplication-cast-to-long`) query causing false positive results in `build-mode: none` databases.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
index b41e6e78a66a..c4f0b07d5336 100644
--- a/cpp/ql/src/codeql-pack.release.yml
+++ b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.5.15
+lastReleaseVersion: 1.6.0
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index 3160da2efb68..fa0391ae9c15 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 1.5.16-dev
+version: 1.6.0
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
index dfbc0f9f376d..f7107d18c014 100644
--- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.64
+
+No user-facing changes.
+
## 1.7.63
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md
new file mode 100644
index 000000000000..47290bbbeb30
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.64.md
@@ -0,0 +1,3 @@
+## 1.7.64
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
index 3d19252da0b4..f41e954c9ae2 100644
--- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.63
+lastReleaseVersion: 1.7.64
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 972746e92550..9c094c18dc6d 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.64-dev
+version: 1.7.64
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
index dfbc0f9f376d..f7107d18c014 100644
--- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
+++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.64
+
+No user-facing changes.
+
## 1.7.63
No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md
new file mode 100644
index 000000000000..47290bbbeb30
--- /dev/null
+++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.64.md
@@ -0,0 +1,3 @@
+## 1.7.64
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
index 3d19252da0b4..f41e954c9ae2 100644
--- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
+++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.63
+lastReleaseVersion: 1.7.64
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 7a4e4fff627d..666c44a2805e 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.64-dev
+version: 1.7.64
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
index 7261891eed7d..57d99a41480b 100644
--- a/csharp/ql/lib/CHANGELOG.md
+++ b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 5.4.12
+
+### Minor Analysis Improvements
+
+* The extractor no longer synthesizes expanded forms of compound assignments. This may have a small impact on the results of queries that explicitly or implicitly rely on the expanded form of compound assignments.
+* The `cs/log-forging` query no longer treats arguments to extension methods with
+ source code on `ILogger` types as sinks. Instead, taint is tracked interprocedurally
+ through extension method bodies, reducing false positives when extension methods
+ sanitize input internally.
+
## 5.4.11
No user-facing changes.
diff --git a/csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md b/csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md
deleted file mode 100644
index 159ab1ee3c64..000000000000
--- a/csharp/ql/lib/change-notes/2026-03-26-expanded-assignments.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The extractor no longer synthesizes expanded forms of compound assignments. This may have a small impact on the results of queries that explicitly or implicitly rely on the expanded form of compound assignments.
diff --git a/csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md b/csharp/ql/lib/change-notes/released/5.4.12.md
similarity index 52%
rename from csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md
rename to csharp/ql/lib/change-notes/released/5.4.12.md
index 65ce217b1058..506fae5a15e1 100644
--- a/csharp/ql/lib/change-notes/2026-03-19-fix-log-forging-extension-methods.md
+++ b/csharp/ql/lib/change-notes/released/5.4.12.md
@@ -1,6 +1,8 @@
----
-category: minorAnalysis
----
+## 5.4.12
+
+### Minor Analysis Improvements
+
+* The extractor no longer synthesizes expanded forms of compound assignments. This may have a small impact on the results of queries that explicitly or implicitly rely on the expanded form of compound assignments.
* The `cs/log-forging` query no longer treats arguments to extension methods with
source code on `ILogger` types as sinks. Instead, taint is tracked interprocedurally
through extension method bodies, reducing false positives when extension methods
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
index f742ee59b537..43db6e52c988 100644
--- a/csharp/ql/lib/codeql-pack.release.yml
+++ b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 5.4.11
+lastReleaseVersion: 5.4.12
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index b45bd57ad56e..d5088885cdb0 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 5.4.12-dev
+version: 5.4.12
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
index 39bfe944d5d6..fc0f8c58d794 100644
--- a/csharp/ql/src/CHANGELOG.md
+++ b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 1.7.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cs/log-forging` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `cs/web/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
+* The `cs/constant-condition` query has been simplified. The query no longer reports trivially constant conditions as they were found to generally be intentional. As a result, it should now produce fewer false positives. Additionally, the simplification means that it now reports all the results that `cs/constant-comparison` used to report, and as consequence, that query has been deleted.
+
## 1.6.6
No user-facing changes.
diff --git a/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
deleted file mode 100644
index c317194bc259..000000000000
--- a/csharp/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: queryMetadata
----
-* The `@security-severity` metadata of `cs/log-forging` has been reduced from 7.8 (high) to 6.1 (medium).
-* The `@security-severity` metadata of `cs/web/xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/csharp/ql/src/change-notes/2026-03-31-constantcondition-simplify.md b/csharp/ql/src/change-notes/released/1.7.0.md
similarity index 58%
rename from csharp/ql/src/change-notes/2026-03-31-constantcondition-simplify.md
rename to csharp/ql/src/change-notes/released/1.7.0.md
index a1051d4c00f4..906a13d68d0a 100644
--- a/csharp/ql/src/change-notes/2026-03-31-constantcondition-simplify.md
+++ b/csharp/ql/src/change-notes/released/1.7.0.md
@@ -1,4 +1,10 @@
----
-category: majorAnalysis
----
+## 1.7.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `cs/log-forging` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `cs/web/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
* The `cs/constant-condition` query has been simplified. The query no longer reports trivially constant conditions as they were found to generally be intentional. As a result, it should now produce fewer false positives. Additionally, the simplification means that it now reports all the results that `cs/constant-comparison` used to report, and as consequence, that query has been deleted.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
index f8e54f30a672..d1184cc67507 100644
--- a/csharp/ql/src/codeql-pack.release.yml
+++ b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.6.6
+lastReleaseVersion: 1.7.0
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 728074e959dc..64d02609317a 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 1.6.7-dev
+version: 1.7.0
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
index 065f61912fa9..34ae2fd22778 100644
--- a/go/ql/consistency-queries/CHANGELOG.md
+++ b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/go/ql/consistency-queries/change-notes/released/1.0.47.md b/go/ql/consistency-queries/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/go/ql/consistency-queries/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/go/ql/consistency-queries/codeql-pack.release.yml
+++ b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index ba15945e1a24..53b3d29e717b 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 1.0.47-dev
+version: 1.0.47
groups:
- go
- queries
diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
index 09f0c8843205..441d15a0d0e8 100644
--- a/go/ql/lib/CHANGELOG.md
+++ b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 7.0.5
+
+No user-facing changes.
+
## 7.0.4
No user-facing changes.
diff --git a/go/ql/lib/change-notes/released/7.0.5.md b/go/ql/lib/change-notes/released/7.0.5.md
new file mode 100644
index 000000000000..adee6ebe3a75
--- /dev/null
+++ b/go/ql/lib/change-notes/released/7.0.5.md
@@ -0,0 +1,3 @@
+## 7.0.5
+
+No user-facing changes.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
index 6630ee1984ad..2cff21d59fec 100644
--- a/go/ql/lib/codeql-pack.release.yml
+++ b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 7.0.4
+lastReleaseVersion: 7.0.5
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index f3e9e50bf7bc..5c371bb7ae48 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 7.0.5-dev
+version: 7.0.5
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
index f6fcaa51ab3f..2bc95cc19222 100644
--- a/go/ql/src/CHANGELOG.md
+++ b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `go/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `go/html-template-escaping-bypass-xss`, `go/reflected-xss` and `go/stored-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.5.10
No user-facing changes.
diff --git a/go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/go/ql/src/change-notes/released/1.6.0.md
similarity index 87%
rename from go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to go/ql/src/change-notes/released/1.6.0.md
index 45320bcd719c..1e508254885a 100644
--- a/go/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/go/ql/src/change-notes/released/1.6.0.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 1.6.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `go/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `go/html-template-escaping-bypass-xss`, `go/reflected-xss` and `go/stored-xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
index fda54b31bffb..c4f0b07d5336 100644
--- a/go/ql/src/codeql-pack.release.yml
+++ b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.5.10
+lastReleaseVersion: 1.6.0
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index fd374637a9b7..1ec2c5b9430e 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 1.5.11-dev
+version: 1.6.0
groups:
- go
- queries
diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
index ecbffa5461c8..caa1eaecb948 100644
--- a/java/ql/lib/CHANGELOG.md
+++ b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 9.0.3
+
+### Minor Analysis Improvements
+
+* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in `if`-condition bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives.
+* The `java/potentially-weak-cryptographic-algorithm` query no longer flags Elliptic Curve algorithms (`EC`, `ECDSA`, `ECDH`, `EdDSA`, `Ed25519`, `Ed448`, `XDH`, `X25519`, `X448`), HMAC-based algorithms (`HMACSHA1`, `HMACSHA256`, `HMACSHA384`, `HMACSHA512`), or PBKDF2 key derivation as potentially insecure. These are modern, secure algorithms recommended by NIST and other standards bodies. This will reduce the number of false positives for this query.
+* The first argument of the method `getInstance` of `java.security.Signature` is now modeled as a sink for `java/potentially-weak-cryptographic-algorithm`, `java/weak-cryptographic-algorithm` and `java/rsa-without-oaep`. This will increase the number of alerts for these queries.
+* Kotlin versions up to 2.3.20 are now supported.
+
## 9.0.2
No user-facing changes.
diff --git a/java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md b/java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md
deleted file mode 100644
index b18cff457049..000000000000
--- a/java/ql/lib/change-notes/2026-03-26-kotlin-2.3.20.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* Kotlin versions up to 2.3.20 are now supported.
diff --git a/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md b/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md
deleted file mode 100644
index 0688815c822f..000000000000
--- a/java/ql/lib/change-notes/2026-03-28-tainted-arithmetic-bounds-check.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
-category: minorAnalysis
----
-* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in `if`-condition bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives.
diff --git a/java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md b/java/ql/lib/change-notes/released/9.0.3.md
similarity index 63%
rename from java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md
rename to java/ql/lib/change-notes/released/9.0.3.md
index ee53bedd4176..828b5867f8b2 100644
--- a/java/ql/lib/change-notes/2026-03-27-add-ec-to-secure-algorithms.md
+++ b/java/ql/lib/change-notes/released/9.0.3.md
@@ -1,5 +1,8 @@
----
-category: minorAnalysis
----
+## 9.0.3
+
+### Minor Analysis Improvements
+
+* The `java/tainted-arithmetic` query no longer flags arithmetic expressions that are used directly as an operand of a comparison in `if`-condition bounds-checking patterns. For example, `if (off + len > array.length)` is now recognized as a bounds check rather than a potentially vulnerable computation, reducing false positives.
* The `java/potentially-weak-cryptographic-algorithm` query no longer flags Elliptic Curve algorithms (`EC`, `ECDSA`, `ECDH`, `EdDSA`, `Ed25519`, `Ed448`, `XDH`, `X25519`, `X448`), HMAC-based algorithms (`HMACSHA1`, `HMACSHA256`, `HMACSHA384`, `HMACSHA512`), or PBKDF2 key derivation as potentially insecure. These are modern, secure algorithms recommended by NIST and other standards bodies. This will reduce the number of false positives for this query.
* The first argument of the method `getInstance` of `java.security.Signature` is now modeled as a sink for `java/potentially-weak-cryptographic-algorithm`, `java/weak-cryptographic-algorithm` and `java/rsa-without-oaep`. This will increase the number of alerts for these queries.
+* Kotlin versions up to 2.3.20 are now supported.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
index 533351acdc92..175658aaf53d 100644
--- a/java/ql/lib/codeql-pack.release.yml
+++ b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 9.0.2
+lastReleaseVersion: 9.0.3
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index fc1d2c13281a..d840954d6236 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 9.0.3-dev
+version: 9.0.3
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
index 8d9ce4a75b4e..2a2f8052092f 100644
--- a/java/ql/src/CHANGELOG.md
+++ b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.11.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `java/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `java/android/webview-addjavascriptinterface`, `java/android/websettings-javascript-enabled` and `java/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.10.11
No user-facing changes.
diff --git a/java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/java/ql/src/change-notes/released/1.11.0.md
similarity index 88%
rename from java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to java/ql/src/change-notes/released/1.11.0.md
index fa1288af16eb..0be4b0481d60 100644
--- a/java/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/java/ql/src/change-notes/released/1.11.0.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 1.11.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `java/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `java/android/webview-addjavascriptinterface`, `java/android/websettings-javascript-enabled` and `java/xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
index d267e07fb669..276088d81dc8 100644
--- a/java/ql/src/codeql-pack.release.yml
+++ b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.10.11
+lastReleaseVersion: 1.11.0
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 78372a6ec85b..2c4f95fb25bb 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 1.10.12-dev
+version: 1.11.0
groups:
- java
- queries
diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
index 52d003921a0d..fedb0b9b587f 100644
--- a/javascript/ql/lib/CHANGELOG.md
+++ b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.6.27
+
+No user-facing changes.
+
## 2.6.26
No user-facing changes.
diff --git a/javascript/ql/lib/change-notes/released/2.6.27.md b/javascript/ql/lib/change-notes/released/2.6.27.md
new file mode 100644
index 000000000000..94482b5ebe68
--- /dev/null
+++ b/javascript/ql/lib/change-notes/released/2.6.27.md
@@ -0,0 +1,3 @@
+## 2.6.27
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
index 679fedfb2ca3..2ce86b10a85d 100644
--- a/javascript/ql/lib/codeql-pack.release.yml
+++ b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.6.26
+lastReleaseVersion: 2.6.27
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index 06ba4c2b8c6c..df3fa463f358 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 2.6.27-dev
+version: 2.6.27
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
index 272799b3da36..29e6c8e8da32 100644
--- a/javascript/ql/src/CHANGELOG.md
+++ b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.3.7
+
+No user-facing changes.
+
## 2.3.6
No user-facing changes.
diff --git a/javascript/ql/src/change-notes/released/2.3.7.md b/javascript/ql/src/change-notes/released/2.3.7.md
new file mode 100644
index 000000000000..5be2835f3988
--- /dev/null
+++ b/javascript/ql/src/change-notes/released/2.3.7.md
@@ -0,0 +1,3 @@
+## 2.3.7
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
index 2c82422104bf..914cded08b38 100644
--- a/javascript/ql/src/codeql-pack.release.yml
+++ b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.3.6
+lastReleaseVersion: 2.3.7
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index c01152a2480c..7bd7a08f955f 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 2.3.7-dev
+version: 2.3.7
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md
index 1b5fe4c06dab..4b73639b1f75 100644
--- a/misc/suite-helpers/CHANGELOG.md
+++ b/misc/suite-helpers/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/misc/suite-helpers/change-notes/released/1.0.47.md b/misc/suite-helpers/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/misc/suite-helpers/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/misc/suite-helpers/codeql-pack.release.yml
+++ b/misc/suite-helpers/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 3107188efcfc..9ee0e7338b2d 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md
index ec5ff5ffe4f0..a6833ea8db3d 100644
--- a/python/ql/lib/CHANGELOG.md
+++ b/python/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 7.0.4
+
+### Bug Fixes
+
+- Fixed the resolution of relative imports such as `from . import helper` inside namespace packages (directories without an `__init__.py` file), which previously did not work correctly, leading to missing flow.
+
## 7.0.3
No user-facing changes.
diff --git a/python/ql/lib/change-notes/2026-03-11-fix-unresolved-relative-imports.md b/python/ql/lib/change-notes/released/7.0.4.md
similarity index 89%
rename from python/ql/lib/change-notes/2026-03-11-fix-unresolved-relative-imports.md
rename to python/ql/lib/change-notes/released/7.0.4.md
index 15290fb3d669..91464598a0e5 100644
--- a/python/ql/lib/change-notes/2026-03-11-fix-unresolved-relative-imports.md
+++ b/python/ql/lib/change-notes/released/7.0.4.md
@@ -1,5 +1,5 @@
----
-category: fix
----
+## 7.0.4
+
+### Bug Fixes
- Fixed the resolution of relative imports such as `from . import helper` inside namespace packages (directories without an `__init__.py` file), which previously did not work correctly, leading to missing flow.
diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml
index cf80607304e3..6630ee1984ad 100644
--- a/python/ql/lib/codeql-pack.release.yml
+++ b/python/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 7.0.3
+lastReleaseVersion: 7.0.4
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index bdf4cd0d8046..11bd07835834 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 7.0.4-dev
+version: 7.0.4
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md
index 4b109dca5698..d5f5269c61d9 100644
--- a/python/ql/src/CHANGELOG.md
+++ b/python/ql/src/CHANGELOG.md
@@ -1,3 +1,14 @@
+## 1.8.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `py/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `py/jinja2/autoescape-false` and `py/reflective-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
+- Several quality queries have been ported away from using the legacy points-to library. This may lead to changes in alerts.
+
## 1.7.11
No user-facing changes.
diff --git a/python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md b/python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md
deleted file mode 100644
index 3673b6de83a1..000000000000
--- a/python/ql/src/change-notes/2026-03-13-port-simple-points-to-queries.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-category: majorAnalysis
----
-
-- Several quality queries have been ported away from using the legacy points-to library. This may lead to changes in alerts.
diff --git a/python/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/python/ql/src/change-notes/released/1.8.0.md
similarity index 56%
rename from python/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to python/ql/src/change-notes/released/1.8.0.md
index 4278d0171e34..123b4604da31 100644
--- a/python/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/python/ql/src/change-notes/released/1.8.0.md
@@ -1,5 +1,10 @@
----
-category: queryMetadata
----
+## 1.8.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `py/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `py/jinja2/autoescape-false` and `py/reflective-xss` has been increased from 6.1 (medium) to 7.8 (high).
+
+### Major Analysis Improvements
+
+- Several quality queries have been ported away from using the legacy points-to library. This may lead to changes in alerts.
diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml
index 6e5b0b6e2f2b..dc8a37cc443d 100644
--- a/python/ql/src/codeql-pack.release.yml
+++ b/python/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.7.11
+lastReleaseVersion: 1.8.0
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index 32f1015130b1..d3c52c315e85 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 1.7.12-dev
+version: 1.8.0
groups:
- python
- queries
diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md
index ce1187d64420..40cb88d396f4 100644
--- a/ruby/ql/lib/CHANGELOG.md
+++ b/ruby/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 5.1.15
+
+No user-facing changes.
+
## 5.1.14
No user-facing changes.
diff --git a/ruby/ql/lib/change-notes/released/5.1.15.md b/ruby/ql/lib/change-notes/released/5.1.15.md
new file mode 100644
index 000000000000..c3ff6293f36f
--- /dev/null
+++ b/ruby/ql/lib/change-notes/released/5.1.15.md
@@ -0,0 +1,3 @@
+## 5.1.15
+
+No user-facing changes.
diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml
index bf92d1c672e0..840348ed924e 100644
--- a/ruby/ql/lib/codeql-pack.release.yml
+++ b/ruby/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 5.1.14
+lastReleaseVersion: 5.1.15
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 56537ce0a173..687618237bb6 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 5.1.15-dev
+version: 5.1.15
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md
index 884e126d9a16..cb4c0ae7874a 100644
--- a/ruby/ql/src/CHANGELOG.md
+++ b/ruby/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.6.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `rb/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
+* The `@security-severity` metadata of `rb/reflected-xss`, `rb/stored-xss` and `rb/html-constructed-from-input` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.5.11
No user-facing changes.
diff --git a/ruby/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/ruby/ql/src/change-notes/released/1.6.0.md
similarity index 87%
rename from ruby/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to ruby/ql/src/change-notes/released/1.6.0.md
index 459c2ce7f916..0398dab7aaf4 100644
--- a/ruby/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/ruby/ql/src/change-notes/released/1.6.0.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 1.6.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `rb/log-injection` has been reduced from 7.8 (high) to 6.1 (medium).
* The `@security-severity` metadata of `rb/reflected-xss`, `rb/stored-xss` and `rb/html-constructed-from-input` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml
index 7e8e8103d99a..c4f0b07d5336 100644
--- a/ruby/ql/src/codeql-pack.release.yml
+++ b/ruby/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.5.11
+lastReleaseVersion: 1.6.0
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index 20487d171b1c..a0473f5f849b 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 1.5.12-dev
+version: 1.6.0
groups:
- ruby
- queries
diff --git a/rust/ql/lib/CHANGELOG.md b/rust/ql/lib/CHANGELOG.md
index 2672c08645b4..eea5bd6e89d8 100644
--- a/rust/ql/lib/CHANGELOG.md
+++ b/rust/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.2.11
+
+No user-facing changes.
+
## 0.2.10
No user-facing changes.
diff --git a/rust/ql/lib/change-notes/released/0.2.11.md b/rust/ql/lib/change-notes/released/0.2.11.md
new file mode 100644
index 000000000000..1037f9194f83
--- /dev/null
+++ b/rust/ql/lib/change-notes/released/0.2.11.md
@@ -0,0 +1,3 @@
+## 0.2.11
+
+No user-facing changes.
diff --git a/rust/ql/lib/codeql-pack.release.yml b/rust/ql/lib/codeql-pack.release.yml
index a71167814cb7..2ee635b99371 100644
--- a/rust/ql/lib/codeql-pack.release.yml
+++ b/rust/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.2.10
+lastReleaseVersion: 0.2.11
diff --git a/rust/ql/lib/qlpack.yml b/rust/ql/lib/qlpack.yml
index 502f10265fae..cef8c27d1cb4 100644
--- a/rust/ql/lib/qlpack.yml
+++ b/rust/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-all
-version: 0.2.11-dev
+version: 0.2.11
groups: rust
extractor: rust
dbscheme: rust.dbscheme
diff --git a/rust/ql/src/CHANGELOG.md b/rust/ql/src/CHANGELOG.md
index 35445b7d626f..eab921bcbd6b 100644
--- a/rust/ql/src/CHANGELOG.md
+++ b/rust/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 0.1.32
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `rust/log-injection` has been increased from 2.6 (low) to 6.1 (medium).
+* The `@security-severity` metadata of `rust/xss` has been increased from 6.1 (medium) to 7.8 (high).
+
## 0.1.31
No user-facing changes.
diff --git a/rust/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/rust/ql/src/change-notes/released/0.1.32.md
similarity index 84%
rename from rust/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to rust/ql/src/change-notes/released/0.1.32.md
index 8bfc5be15517..d18f3ccd08df 100644
--- a/rust/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/rust/ql/src/change-notes/released/0.1.32.md
@@ -1,5 +1,6 @@
----
-category: queryMetadata
----
+## 0.1.32
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `rust/log-injection` has been increased from 2.6 (low) to 6.1 (medium).
* The `@security-severity` metadata of `rust/xss` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/rust/ql/src/codeql-pack.release.yml b/rust/ql/src/codeql-pack.release.yml
index 8f9b017abfeb..21bbd752f27a 100644
--- a/rust/ql/src/codeql-pack.release.yml
+++ b/rust/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.1.31
+lastReleaseVersion: 0.1.32
diff --git a/rust/ql/src/qlpack.yml b/rust/ql/src/qlpack.yml
index 48abcc305eec..41f566526eb9 100644
--- a/rust/ql/src/qlpack.yml
+++ b/rust/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-queries
-version: 0.1.32-dev
+version: 0.1.32
groups:
- rust
- queries
diff --git a/shared/concepts/CHANGELOG.md b/shared/concepts/CHANGELOG.md
index fc5bdcd8e23e..704ea3e8e019 100644
--- a/shared/concepts/CHANGELOG.md
+++ b/shared/concepts/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.21
+
+No user-facing changes.
+
## 0.0.20
No user-facing changes.
diff --git a/shared/concepts/change-notes/released/0.0.21.md b/shared/concepts/change-notes/released/0.0.21.md
new file mode 100644
index 000000000000..d32472e976d2
--- /dev/null
+++ b/shared/concepts/change-notes/released/0.0.21.md
@@ -0,0 +1,3 @@
+## 0.0.21
+
+No user-facing changes.
diff --git a/shared/concepts/codeql-pack.release.yml b/shared/concepts/codeql-pack.release.yml
index d2e86745bcaa..0c15c351db40 100644
--- a/shared/concepts/codeql-pack.release.yml
+++ b/shared/concepts/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.20
+lastReleaseVersion: 0.0.21
diff --git a/shared/concepts/qlpack.yml b/shared/concepts/qlpack.yml
index 04966d3a5b1f..c2cc618dd2d9 100644
--- a/shared/concepts/qlpack.yml
+++ b/shared/concepts/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/concepts
-version: 0.0.21-dev
+version: 0.0.21
groups: shared
library: true
dependencies:
diff --git a/shared/controlflow/CHANGELOG.md b/shared/controlflow/CHANGELOG.md
index 8725b6df20a6..baca729ddda8 100644
--- a/shared/controlflow/CHANGELOG.md
+++ b/shared/controlflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.31
+
+No user-facing changes.
+
## 2.0.30
No user-facing changes.
diff --git a/shared/controlflow/change-notes/released/2.0.31.md b/shared/controlflow/change-notes/released/2.0.31.md
new file mode 100644
index 000000000000..b3cd05e3de4d
--- /dev/null
+++ b/shared/controlflow/change-notes/released/2.0.31.md
@@ -0,0 +1,3 @@
+## 2.0.31
+
+No user-facing changes.
diff --git a/shared/controlflow/codeql-pack.release.yml b/shared/controlflow/codeql-pack.release.yml
index 19c804295854..783d47207cda 100644
--- a/shared/controlflow/codeql-pack.release.yml
+++ b/shared/controlflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.30
+lastReleaseVersion: 2.0.31
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index 2bb2efdb8c00..c5c64a8bcb68 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 2.0.31-dev
+version: 2.0.31
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/CHANGELOG.md b/shared/dataflow/CHANGELOG.md
index b2836038ddfa..52c893f78e27 100644
--- a/shared/dataflow/CHANGELOG.md
+++ b/shared/dataflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.1.3
+
+No user-facing changes.
+
## 2.1.2
No user-facing changes.
diff --git a/shared/dataflow/change-notes/released/2.1.3.md b/shared/dataflow/change-notes/released/2.1.3.md
new file mode 100644
index 000000000000..a1338012fcdd
--- /dev/null
+++ b/shared/dataflow/change-notes/released/2.1.3.md
@@ -0,0 +1,3 @@
+## 2.1.3
+
+No user-facing changes.
diff --git a/shared/dataflow/codeql-pack.release.yml b/shared/dataflow/codeql-pack.release.yml
index 1a4e53e87724..345fb0c73a44 100644
--- a/shared/dataflow/codeql-pack.release.yml
+++ b/shared/dataflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.1.2
+lastReleaseVersion: 2.1.3
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index da82b4bcd403..3009091cfdb3 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 2.1.3-dev
+version: 2.1.3
groups: shared
library: true
dependencies:
diff --git a/shared/mad/CHANGELOG.md b/shared/mad/CHANGELOG.md
index f08f6492daf1..1bffb976cf8c 100644
--- a/shared/mad/CHANGELOG.md
+++ b/shared/mad/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/mad/change-notes/released/1.0.47.md b/shared/mad/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/mad/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/mad/codeql-pack.release.yml b/shared/mad/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/mad/codeql-pack.release.yml
+++ b/shared/mad/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 00243bdecc08..678be4858dc4 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/quantum/CHANGELOG.md b/shared/quantum/CHANGELOG.md
index 20ebb6b42c02..8d524a11a093 100644
--- a/shared/quantum/CHANGELOG.md
+++ b/shared/quantum/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.25
+
+No user-facing changes.
+
## 0.0.24
No user-facing changes.
diff --git a/shared/quantum/change-notes/released/0.0.25.md b/shared/quantum/change-notes/released/0.0.25.md
new file mode 100644
index 000000000000..e41a9acfa062
--- /dev/null
+++ b/shared/quantum/change-notes/released/0.0.25.md
@@ -0,0 +1,3 @@
+## 0.0.25
+
+No user-facing changes.
diff --git a/shared/quantum/codeql-pack.release.yml b/shared/quantum/codeql-pack.release.yml
index b956773a07f5..6d0e80a50c3f 100644
--- a/shared/quantum/codeql-pack.release.yml
+++ b/shared/quantum/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.24
+lastReleaseVersion: 0.0.25
diff --git a/shared/quantum/qlpack.yml b/shared/quantum/qlpack.yml
index 4a33f9168a25..38fca7fc6dc4 100644
--- a/shared/quantum/qlpack.yml
+++ b/shared/quantum/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/quantum
-version: 0.0.25-dev
+version: 0.0.25
groups: shared
library: true
dependencies:
diff --git a/shared/rangeanalysis/CHANGELOG.md b/shared/rangeanalysis/CHANGELOG.md
index 0014924513d3..0ab7487192cb 100644
--- a/shared/rangeanalysis/CHANGELOG.md
+++ b/shared/rangeanalysis/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/rangeanalysis/change-notes/released/1.0.47.md b/shared/rangeanalysis/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/rangeanalysis/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/rangeanalysis/codeql-pack.release.yml b/shared/rangeanalysis/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/rangeanalysis/codeql-pack.release.yml
+++ b/shared/rangeanalysis/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index fe558ac3f189..2cf45348dc0e 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md
index 0b6da82a669a..dd6f0c4cad6b 100644
--- a/shared/regex/CHANGELOG.md
+++ b/shared/regex/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/regex/change-notes/released/1.0.47.md b/shared/regex/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/regex/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/regex/codeql-pack.release.yml
+++ b/shared/regex/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index 58fc5cc3e106..b2070c25fb15 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md
index 9b5af9899648..3573140fc410 100644
--- a/shared/ssa/CHANGELOG.md
+++ b/shared/ssa/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.23
+
+No user-facing changes.
+
## 2.0.22
No user-facing changes.
diff --git a/shared/ssa/change-notes/released/2.0.23.md b/shared/ssa/change-notes/released/2.0.23.md
new file mode 100644
index 000000000000..ab6f6f171ed6
--- /dev/null
+++ b/shared/ssa/change-notes/released/2.0.23.md
@@ -0,0 +1,3 @@
+## 2.0.23
+
+No user-facing changes.
diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml
index 980bdfe195ba..1bd7e296a34f 100644
--- a/shared/ssa/codeql-pack.release.yml
+++ b/shared/ssa/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.22
+lastReleaseVersion: 2.0.23
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index 3cf46284247c..ab991edccccf 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 2.0.23-dev
+version: 2.0.23
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/CHANGELOG.md b/shared/threat-models/CHANGELOG.md
index 065f61912fa9..34ae2fd22778 100644
--- a/shared/threat-models/CHANGELOG.md
+++ b/shared/threat-models/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/threat-models/change-notes/released/1.0.47.md b/shared/threat-models/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/threat-models/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/threat-models/codeql-pack.release.yml b/shared/threat-models/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/threat-models/codeql-pack.release.yml
+++ b/shared/threat-models/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index c3589be5880d..37f9b1ba7448 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 1.0.47-dev
+version: 1.0.47
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md
index 297d40b694f4..cf8f60d1d46a 100644
--- a/shared/tutorial/CHANGELOG.md
+++ b/shared/tutorial/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/tutorial/change-notes/released/1.0.47.md b/shared/tutorial/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/tutorial/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/tutorial/codeql-pack.release.yml
+++ b/shared/tutorial/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index 53716b9b5cad..d2ab12f93454 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typeflow/CHANGELOG.md b/shared/typeflow/CHANGELOG.md
index 039a7ef99a3d..8c5ee5e94864 100644
--- a/shared/typeflow/CHANGELOG.md
+++ b/shared/typeflow/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/typeflow/change-notes/released/1.0.47.md b/shared/typeflow/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/typeflow/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/typeflow/codeql-pack.release.yml b/shared/typeflow/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/typeflow/codeql-pack.release.yml
+++ b/shared/typeflow/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/typeflow/qlpack.yml b/shared/typeflow/qlpack.yml
index ea0f559611c9..c8d7a74c2978 100644
--- a/shared/typeflow/qlpack.yml
+++ b/shared/typeflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeflow
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/typeinference/CHANGELOG.md b/shared/typeinference/CHANGELOG.md
index be06e2108a8a..7153b9314b18 100644
--- a/shared/typeinference/CHANGELOG.md
+++ b/shared/typeinference/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.0.28
+
+No user-facing changes.
+
## 0.0.27
No user-facing changes.
diff --git a/shared/typeinference/change-notes/released/0.0.28.md b/shared/typeinference/change-notes/released/0.0.28.md
new file mode 100644
index 000000000000..1b4fdd478196
--- /dev/null
+++ b/shared/typeinference/change-notes/released/0.0.28.md
@@ -0,0 +1,3 @@
+## 0.0.28
+
+No user-facing changes.
diff --git a/shared/typeinference/codeql-pack.release.yml b/shared/typeinference/codeql-pack.release.yml
index dbab90d69898..3462db7d348f 100644
--- a/shared/typeinference/codeql-pack.release.yml
+++ b/shared/typeinference/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 0.0.27
+lastReleaseVersion: 0.0.28
diff --git a/shared/typeinference/qlpack.yml b/shared/typeinference/qlpack.yml
index 75aedbf6423b..d459c36ce72c 100644
--- a/shared/typeinference/qlpack.yml
+++ b/shared/typeinference/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeinference
-version: 0.0.28-dev
+version: 0.0.28
groups: shared
library: true
dependencies:
diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md
index 4132c8bcd999..f779002267aa 100644
--- a/shared/typetracking/CHANGELOG.md
+++ b/shared/typetracking/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.31
+
+No user-facing changes.
+
## 2.0.30
No user-facing changes.
diff --git a/shared/typetracking/change-notes/released/2.0.31.md b/shared/typetracking/change-notes/released/2.0.31.md
new file mode 100644
index 000000000000..b3cd05e3de4d
--- /dev/null
+++ b/shared/typetracking/change-notes/released/2.0.31.md
@@ -0,0 +1,3 @@
+## 2.0.31
+
+No user-facing changes.
diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml
index 19c804295854..783d47207cda 100644
--- a/shared/typetracking/codeql-pack.release.yml
+++ b/shared/typetracking/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.30
+lastReleaseVersion: 2.0.31
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index b9998e1240a1..d2d55be5b550 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 2.0.31-dev
+version: 2.0.31
groups: shared
library: true
dependencies:
diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md
index 6f0db2fa4b3a..b49f756fef03 100644
--- a/shared/typos/CHANGELOG.md
+++ b/shared/typos/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/typos/change-notes/released/1.0.47.md b/shared/typos/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/typos/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/typos/codeql-pack.release.yml
+++ b/shared/typos/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index dc62caedd6b0..b9b579b51763 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md
index 56a45488e079..cb3ac7bbe797 100644
--- a/shared/util/CHANGELOG.md
+++ b/shared/util/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.0.34
+
+No user-facing changes.
+
## 2.0.33
No user-facing changes.
diff --git a/shared/util/change-notes/released/2.0.34.md b/shared/util/change-notes/released/2.0.34.md
new file mode 100644
index 000000000000..fd170d38ce6d
--- /dev/null
+++ b/shared/util/change-notes/released/2.0.34.md
@@ -0,0 +1,3 @@
+## 2.0.34
+
+No user-facing changes.
diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml
index 92e23200b4d6..339a3ce7c57a 100644
--- a/shared/util/codeql-pack.release.yml
+++ b/shared/util/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 2.0.33
+lastReleaseVersion: 2.0.34
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index d27b3d6c59c1..4f7bb193afbb 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 2.0.34-dev
+version: 2.0.34
groups: shared
library: true
dependencies: null
diff --git a/shared/xml/CHANGELOG.md b/shared/xml/CHANGELOG.md
index dc06867e32db..98702251320c 100644
--- a/shared/xml/CHANGELOG.md
+++ b/shared/xml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/xml/change-notes/released/1.0.47.md b/shared/xml/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/xml/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/xml/codeql-pack.release.yml b/shared/xml/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/xml/codeql-pack.release.yml
+++ b/shared/xml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/xml/qlpack.yml b/shared/xml/qlpack.yml
index 5195fcbbe18c..fe6e59d133ed 100644
--- a/shared/xml/qlpack.yml
+++ b/shared/xml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/xml
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
dependencies:
diff --git a/shared/yaml/CHANGELOG.md b/shared/yaml/CHANGELOG.md
index 557db2b44052..4a41f8ee9dfe 100644
--- a/shared/yaml/CHANGELOG.md
+++ b/shared/yaml/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.47
+
+No user-facing changes.
+
## 1.0.46
No user-facing changes.
diff --git a/shared/yaml/change-notes/released/1.0.47.md b/shared/yaml/change-notes/released/1.0.47.md
new file mode 100644
index 000000000000..0c12039c1809
--- /dev/null
+++ b/shared/yaml/change-notes/released/1.0.47.md
@@ -0,0 +1,3 @@
+## 1.0.47
+
+No user-facing changes.
diff --git a/shared/yaml/codeql-pack.release.yml b/shared/yaml/codeql-pack.release.yml
index 05205e6a59e2..dcec0f6405ab 100644
--- a/shared/yaml/codeql-pack.release.yml
+++ b/shared/yaml/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.0.46
+lastReleaseVersion: 1.0.47
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index b6f74301d3af..f8e5976f8fa7 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 1.0.47-dev
+version: 1.0.47
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/CHANGELOG.md b/swift/ql/lib/CHANGELOG.md
index fda32d265b0c..3967689b9331 100644
--- a/swift/ql/lib/CHANGELOG.md
+++ b/swift/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 6.3.3
+
+No user-facing changes.
+
## 6.3.2
No user-facing changes.
diff --git a/swift/ql/lib/change-notes/released/6.3.3.md b/swift/ql/lib/change-notes/released/6.3.3.md
new file mode 100644
index 000000000000..86c54aaebb24
--- /dev/null
+++ b/swift/ql/lib/change-notes/released/6.3.3.md
@@ -0,0 +1,3 @@
+## 6.3.3
+
+No user-facing changes.
diff --git a/swift/ql/lib/codeql-pack.release.yml b/swift/ql/lib/codeql-pack.release.yml
index bf4d875e15a0..83b98dcdbc38 100644
--- a/swift/ql/lib/codeql-pack.release.yml
+++ b/swift/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 6.3.2
+lastReleaseVersion: 6.3.3
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index d403d14d991b..ebe1f051136b 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 6.3.3-dev
+version: 6.3.3
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/CHANGELOG.md b/swift/ql/src/CHANGELOG.md
index 1d4d9877b604..f880dc3366f8 100644
--- a/swift/ql/src/CHANGELOG.md
+++ b/swift/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.3.0
+
+### Query Metadata Changes
+
+* The `@security-severity` metadata of `swift/unsafe-webview-fetch` has been increased from 6.1 (medium) to 7.8 (high).
+
## 1.2.20
No user-facing changes.
diff --git a/swift/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md b/swift/ql/src/change-notes/released/1.3.0.md
similarity index 75%
rename from swift/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
rename to swift/ql/src/change-notes/released/1.3.0.md
index a46302ed1462..5a85d7239d7b 100644
--- a/swift/ql/src/change-notes/2026-03-13-adjust-xss-and-log-injection-severity.md
+++ b/swift/ql/src/change-notes/released/1.3.0.md
@@ -1,4 +1,5 @@
----
-category: queryMetadata
----
+## 1.3.0
+
+### Query Metadata Changes
+
* The `@security-severity` metadata of `swift/unsafe-webview-fetch` has been increased from 6.1 (medium) to 7.8 (high).
diff --git a/swift/ql/src/codeql-pack.release.yml b/swift/ql/src/codeql-pack.release.yml
index 8e035aaa1f41..ec16350ed6fd 100644
--- a/swift/ql/src/codeql-pack.release.yml
+++ b/swift/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
---
-lastReleaseVersion: 1.2.20
+lastReleaseVersion: 1.3.0
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index 64c712af472d..84b3e1d0b5d5 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 1.2.21-dev
+version: 1.3.0
groups:
- swift
- queries
From 242090e0acdb7d1af75b4f3e4c556629e24f95ff Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
Date: Mon, 6 Apr 2026 13:49:20 +0000
Subject: [PATCH 050/146] Post-release preparation for codeql-cli-2.25.2
---
actions/ql/lib/qlpack.yml | 2 +-
actions/ql/src/qlpack.yml | 2 +-
cpp/ql/lib/qlpack.yml | 2 +-
cpp/ql/src/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/lib/qlpack.yml | 2 +-
csharp/ql/campaigns/Solorigate/src/qlpack.yml | 2 +-
csharp/ql/lib/qlpack.yml | 2 +-
csharp/ql/src/qlpack.yml | 2 +-
go/ql/consistency-queries/qlpack.yml | 2 +-
go/ql/lib/qlpack.yml | 2 +-
go/ql/src/qlpack.yml | 2 +-
java/ql/lib/qlpack.yml | 2 +-
java/ql/src/qlpack.yml | 2 +-
javascript/ql/lib/qlpack.yml | 2 +-
javascript/ql/src/qlpack.yml | 2 +-
misc/suite-helpers/qlpack.yml | 2 +-
python/ql/lib/qlpack.yml | 2 +-
python/ql/src/qlpack.yml | 2 +-
ruby/ql/lib/qlpack.yml | 2 +-
ruby/ql/src/qlpack.yml | 2 +-
rust/ql/lib/qlpack.yml | 2 +-
rust/ql/src/qlpack.yml | 2 +-
shared/concepts/qlpack.yml | 2 +-
shared/controlflow/qlpack.yml | 2 +-
shared/dataflow/qlpack.yml | 2 +-
shared/mad/qlpack.yml | 2 +-
shared/quantum/qlpack.yml | 2 +-
shared/rangeanalysis/qlpack.yml | 2 +-
shared/regex/qlpack.yml | 2 +-
shared/ssa/qlpack.yml | 2 +-
shared/threat-models/qlpack.yml | 2 +-
shared/tutorial/qlpack.yml | 2 +-
shared/typeflow/qlpack.yml | 2 +-
shared/typeinference/qlpack.yml | 2 +-
shared/typetracking/qlpack.yml | 2 +-
shared/typos/qlpack.yml | 2 +-
shared/util/qlpack.yml | 2 +-
shared/xml/qlpack.yml | 2 +-
shared/yaml/qlpack.yml | 2 +-
swift/ql/lib/qlpack.yml | 2 +-
swift/ql/src/qlpack.yml | 2 +-
41 files changed, 41 insertions(+), 41 deletions(-)
diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml
index 131f29b87aaa..fec274158000 100644
--- a/actions/ql/lib/qlpack.yml
+++ b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-all
-version: 0.4.33
+version: 0.4.34-dev
library: true
warnOnImplicitThis: true
dependencies:
diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml
index 024862b808a6..3216a36f3d08 100644
--- a/actions/ql/src/qlpack.yml
+++ b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/actions-queries
-version: 0.6.25
+version: 0.6.26-dev
library: false
warnOnImplicitThis: true
groups: [actions, queries]
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
index e4e7a96ef681..dbf57d2b8699 100644
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-all
-version: 9.0.0
+version: 9.0.1-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
index fa0391ae9c15..4648951796cc 100644
--- a/cpp/ql/src/qlpack.yml
+++ b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/cpp-queries
-version: 1.6.0
+version: 1.6.1-dev
groups:
- cpp
- queries
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
index 9c094c18dc6d..006ef851567f 100644
--- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-all
-version: 1.7.64
+version: 1.7.65-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
index 666c44a2805e..af5fd98f58af 100644
--- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml
+++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-solorigate-queries
-version: 1.7.64
+version: 1.7.65-dev
groups:
- csharp
- solorigate
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
index d5088885cdb0..02c1ccd0d33c 100644
--- a/csharp/ql/lib/qlpack.yml
+++ b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-all
-version: 5.4.12
+version: 5.4.13-dev
groups: csharp
dbscheme: semmlecode.csharp.dbscheme
extractor: csharp
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
index 64d02609317a..9ea341d1b38d 100644
--- a/csharp/ql/src/qlpack.yml
+++ b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/csharp-queries
-version: 1.7.0
+version: 1.7.1-dev
groups:
- csharp
- queries
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
index 53b3d29e717b..c9dda4765dd0 100644
--- a/go/ql/consistency-queries/qlpack.yml
+++ b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql-go-consistency-queries
-version: 1.0.47
+version: 1.0.48-dev
groups:
- go
- queries
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
index 5c371bb7ae48..2d7338a020dc 100644
--- a/go/ql/lib/qlpack.yml
+++ b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-all
-version: 7.0.5
+version: 7.0.6-dev
groups: go
dbscheme: go.dbscheme
extractor: go
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
index 1ec2c5b9430e..de4e5e06d381 100644
--- a/go/ql/src/qlpack.yml
+++ b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/go-queries
-version: 1.6.0
+version: 1.6.1-dev
groups:
- go
- queries
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
index d840954d6236..7f058cfb8d60 100644
--- a/java/ql/lib/qlpack.yml
+++ b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-all
-version: 9.0.3
+version: 9.0.4-dev
groups: java
dbscheme: config/semmlecode.dbscheme
extractor: java
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
index 2c4f95fb25bb..72b4a5f94e6c 100644
--- a/java/ql/src/qlpack.yml
+++ b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/java-queries
-version: 1.11.0
+version: 1.11.1-dev
groups:
- java
- queries
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
index df3fa463f358..e0834c056d11 100644
--- a/javascript/ql/lib/qlpack.yml
+++ b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-all
-version: 2.6.27
+version: 2.6.28-dev
groups: javascript
dbscheme: semmlecode.javascript.dbscheme
extractor: javascript
diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml
index 7bd7a08f955f..117fae183e99 100644
--- a/javascript/ql/src/qlpack.yml
+++ b/javascript/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/javascript-queries
-version: 2.3.7
+version: 2.3.8-dev
groups:
- javascript
- queries
diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml
index 9ee0e7338b2d..1d8538023420 100644
--- a/misc/suite-helpers/qlpack.yml
+++ b/misc/suite-helpers/qlpack.yml
@@ -1,4 +1,4 @@
name: codeql/suite-helpers
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
warnOnImplicitThis: true
diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml
index 11bd07835834..fe87c5761cfd 100644
--- a/python/ql/lib/qlpack.yml
+++ b/python/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-all
-version: 7.0.4
+version: 7.0.5-dev
groups: python
dbscheme: semmlecode.python.dbscheme
extractor: python
diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml
index d3c52c315e85..aa2a2364854f 100644
--- a/python/ql/src/qlpack.yml
+++ b/python/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/python-queries
-version: 1.8.0
+version: 1.8.1-dev
groups:
- python
- queries
diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml
index 687618237bb6..bbf4de409093 100644
--- a/ruby/ql/lib/qlpack.yml
+++ b/ruby/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-all
-version: 5.1.15
+version: 5.1.16-dev
groups: ruby
extractor: ruby
dbscheme: ruby.dbscheme
diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml
index a0473f5f849b..191689565de4 100644
--- a/ruby/ql/src/qlpack.yml
+++ b/ruby/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ruby-queries
-version: 1.6.0
+version: 1.6.1-dev
groups:
- ruby
- queries
diff --git a/rust/ql/lib/qlpack.yml b/rust/ql/lib/qlpack.yml
index cef8c27d1cb4..f50310200378 100644
--- a/rust/ql/lib/qlpack.yml
+++ b/rust/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-all
-version: 0.2.11
+version: 0.2.12-dev
groups: rust
extractor: rust
dbscheme: rust.dbscheme
diff --git a/rust/ql/src/qlpack.yml b/rust/ql/src/qlpack.yml
index 41f566526eb9..f78504db76eb 100644
--- a/rust/ql/src/qlpack.yml
+++ b/rust/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rust-queries
-version: 0.1.32
+version: 0.1.33-dev
groups:
- rust
- queries
diff --git a/shared/concepts/qlpack.yml b/shared/concepts/qlpack.yml
index c2cc618dd2d9..bf6e8b6018c0 100644
--- a/shared/concepts/qlpack.yml
+++ b/shared/concepts/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/concepts
-version: 0.0.21
+version: 0.0.22-dev
groups: shared
library: true
dependencies:
diff --git a/shared/controlflow/qlpack.yml b/shared/controlflow/qlpack.yml
index c5c64a8bcb68..5573548794d0 100644
--- a/shared/controlflow/qlpack.yml
+++ b/shared/controlflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/controlflow
-version: 2.0.31
+version: 2.0.32-dev
groups: shared
library: true
dependencies:
diff --git a/shared/dataflow/qlpack.yml b/shared/dataflow/qlpack.yml
index 3009091cfdb3..3b917def33db 100644
--- a/shared/dataflow/qlpack.yml
+++ b/shared/dataflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/dataflow
-version: 2.1.3
+version: 2.1.4-dev
groups: shared
library: true
dependencies:
diff --git a/shared/mad/qlpack.yml b/shared/mad/qlpack.yml
index 678be4858dc4..b5583f8c55a2 100644
--- a/shared/mad/qlpack.yml
+++ b/shared/mad/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/mad
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/quantum/qlpack.yml b/shared/quantum/qlpack.yml
index 38fca7fc6dc4..a19e99ef7eaa 100644
--- a/shared/quantum/qlpack.yml
+++ b/shared/quantum/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/quantum
-version: 0.0.25
+version: 0.0.26-dev
groups: shared
library: true
dependencies:
diff --git a/shared/rangeanalysis/qlpack.yml b/shared/rangeanalysis/qlpack.yml
index 2cf45348dc0e..d493350749ee 100644
--- a/shared/rangeanalysis/qlpack.yml
+++ b/shared/rangeanalysis/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/rangeanalysis
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml
index b2070c25fb15..7b953dcff1cf 100644
--- a/shared/regex/qlpack.yml
+++ b/shared/regex/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/regex
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml
index ab991edccccf..a8fa9a114243 100644
--- a/shared/ssa/qlpack.yml
+++ b/shared/ssa/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/ssa
-version: 2.0.23
+version: 2.0.24-dev
groups: shared
library: true
dependencies:
diff --git a/shared/threat-models/qlpack.yml b/shared/threat-models/qlpack.yml
index 37f9b1ba7448..a4a367a990b3 100644
--- a/shared/threat-models/qlpack.yml
+++ b/shared/threat-models/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/threat-models
-version: 1.0.47
+version: 1.0.48-dev
library: true
groups: shared
dataExtensions:
diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml
index d2ab12f93454..f961ccdc0eb2 100644
--- a/shared/tutorial/qlpack.yml
+++ b/shared/tutorial/qlpack.yml
@@ -1,7 +1,7 @@
name: codeql/tutorial
description: Library for the CodeQL detective tutorials, helping new users learn to
write CodeQL queries.
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/typeflow/qlpack.yml b/shared/typeflow/qlpack.yml
index c8d7a74c2978..f7e111d28fde 100644
--- a/shared/typeflow/qlpack.yml
+++ b/shared/typeflow/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeflow
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typeinference/qlpack.yml b/shared/typeinference/qlpack.yml
index d459c36ce72c..97c8df368959 100644
--- a/shared/typeinference/qlpack.yml
+++ b/shared/typeinference/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typeinference
-version: 0.0.28
+version: 0.0.29-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml
index d2d55be5b550..aa0296875312 100644
--- a/shared/typetracking/qlpack.yml
+++ b/shared/typetracking/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typetracking
-version: 2.0.31
+version: 2.0.32-dev
groups: shared
library: true
dependencies:
diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml
index b9b579b51763..37fc79bb1dfd 100644
--- a/shared/typos/qlpack.yml
+++ b/shared/typos/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/typos
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml
index 4f7bb193afbb..02e6241dccbf 100644
--- a/shared/util/qlpack.yml
+++ b/shared/util/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/util
-version: 2.0.34
+version: 2.0.35-dev
groups: shared
library: true
dependencies: null
diff --git a/shared/xml/qlpack.yml b/shared/xml/qlpack.yml
index fe6e59d133ed..0d75859bdb9d 100644
--- a/shared/xml/qlpack.yml
+++ b/shared/xml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/xml
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
dependencies:
diff --git a/shared/yaml/qlpack.yml b/shared/yaml/qlpack.yml
index f8e5976f8fa7..cfea54e0b5b5 100644
--- a/shared/yaml/qlpack.yml
+++ b/shared/yaml/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/yaml
-version: 1.0.47
+version: 1.0.48-dev
groups: shared
library: true
warnOnImplicitThis: true
diff --git a/swift/ql/lib/qlpack.yml b/swift/ql/lib/qlpack.yml
index ebe1f051136b..32c6458ddeae 100644
--- a/swift/ql/lib/qlpack.yml
+++ b/swift/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-all
-version: 6.3.3
+version: 6.3.4-dev
groups: swift
extractor: swift
dbscheme: swift.dbscheme
diff --git a/swift/ql/src/qlpack.yml b/swift/ql/src/qlpack.yml
index 84b3e1d0b5d5..5b6c7a6977a8 100644
--- a/swift/ql/src/qlpack.yml
+++ b/swift/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
name: codeql/swift-queries
-version: 1.3.0
+version: 1.3.1-dev
groups:
- swift
- queries
From eb64fcd208039d92c1ffc3de463a7faa940534bc Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Fri, 20 Mar 2026 11:16:43 +0100
Subject: [PATCH 051/146] C#: Add test that shows unintended flow summary
generation
---
.../dataflow/CaptureContentSummaryModels.expected | 1 +
csharp/ql/test/utils/modelgenerator/dataflow/Summaries.cs | 6 ++++++
2 files changed, 7 insertions(+)
diff --git a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected
index cb6fc390349c..47769d299c35 100644
--- a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected
@@ -1,2 +1,3 @@
unexpectedModel
+| Unexpected contentbased-summary found: Models;HigherOrderParameters;false;Apply;(System.Func,System.Object);;Argument[1];ReturnValue;value;dfc-generated |
expectedModel
diff --git a/csharp/ql/test/utils/modelgenerator/dataflow/Summaries.cs b/csharp/ql/test/utils/modelgenerator/dataflow/Summaries.cs
index b59513504d9d..4c85b397ac1f 100644
--- a/csharp/ql/test/utils/modelgenerator/dataflow/Summaries.cs
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/Summaries.cs
@@ -536,6 +536,12 @@ public void Apply(Action a, object o)
{
a(o);
}
+
+ private void CallApply()
+ {
+ // Test that this call to `Apply` does not interfere with the flow summaries generated for `Apply`
+ Apply(x => x, null);
+ }
}
public static class HigherOrderExtensionMethods
From 1e1a8732a38535cdaf337c97c856ab846d945bcf Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Wed, 25 Mar 2026 11:39:40 +0100
Subject: [PATCH 052/146] Data flow: Add hook for preventing lambda dispatch in
source call contexts
---
.../internal/DataFlowImplSpecific.qll | 2 ++
.../dataflow/internal/DataFlowPrivate.qll | 17 ++++++++++-
.../CaptureContentSummaryModels.expected | 1 -
shared/dataflow/codeql/dataflow/DataFlow.qll | 29 +++++++++++++++++++
.../codeql/dataflow/internal/DataFlowImpl.qll | 12 ++++++++
.../dataflow/internal/DataFlowImplCommon.qll | 15 +++++++++-
6 files changed, 73 insertions(+), 3 deletions(-)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
index af104d777b87..d548c0ef2767 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
@@ -29,4 +29,6 @@ module CsharpDataFlow implements InputSig {
predicate neverSkipInPathGraph(Node n) {
exists(n.(AssignableDefinitionNode).getDefinition().getTargetAccess())
}
+
+ DataFlowType getSourceContextParameterNodeType() { result.isSourceContextParameterType() }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 109c27de67be..64a869e346ec 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -1179,7 +1179,8 @@ private module Cached {
cached
newtype TDataFlowType =
TGvnDataFlowType(Gvn::GvnType t) or
- TDelegateDataFlowType(Callable lambda) { lambdaCreationExpr(_, lambda) }
+ TDelegateDataFlowType(Callable lambda) { lambdaCreationExpr(_, lambda) } or
+ TSourceContextParameterType()
}
import Cached
@@ -2394,6 +2395,8 @@ class DataFlowType extends TDataFlowType {
Callable asDelegate() { this = TDelegateDataFlowType(result) }
+ predicate isSourceContextParameterType() { this = TSourceContextParameterType() }
+
/**
* Gets an expression that creates a delegate of this type.
*
@@ -2412,6 +2415,9 @@ class DataFlowType extends TDataFlowType {
result = this.asGvnType().toString()
or
result = this.asDelegate().toString()
+ or
+ this.isSourceContextParameterType() and
+ result = ""
}
}
@@ -2469,6 +2475,11 @@ private predicate compatibleTypesDelegateLeft(DataFlowType dt1, DataFlowType dt2
)
}
+pragma[nomagic]
+private predicate compatibleTypesSourceContextParameterTypeLeft(DataFlowType dt1, DataFlowType dt2) {
+ dt1.isSourceContextParameterType() and not exists(dt2.asDelegate())
+}
+
/**
* Holds if `t1` and `t2` are compatible, that is, whether data can flow from
* a node of type `t1` to a node of type `t2`.
@@ -2499,6 +2510,10 @@ predicate compatibleTypes(DataFlowType dt1, DataFlowType dt2) {
compatibleTypesDelegateLeft(dt2, dt1)
or
dt1.asDelegate() = dt2.asDelegate()
+ or
+ compatibleTypesSourceContextParameterTypeLeft(dt1, dt2)
+ or
+ compatibleTypesSourceContextParameterTypeLeft(dt2, dt1)
}
pragma[nomagic]
diff --git a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected
index 47769d299c35..cb6fc390349c 100644
--- a/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected
+++ b/csharp/ql/test/utils/modelgenerator/dataflow/CaptureContentSummaryModels.expected
@@ -1,3 +1,2 @@
unexpectedModel
-| Unexpected contentbased-summary found: Models;HigherOrderParameters;false;Apply;(System.Func,System.Object);;Argument[1];ReturnValue;value;dfc-generated |
expectedModel
diff --git a/shared/dataflow/codeql/dataflow/DataFlow.qll b/shared/dataflow/codeql/dataflow/DataFlow.qll
index 7f9c0194374b..bc9fc26adb12 100644
--- a/shared/dataflow/codeql/dataflow/DataFlow.qll
+++ b/shared/dataflow/codeql/dataflow/DataFlow.qll
@@ -63,6 +63,35 @@ signature module InputSig {
DataFlowType getNodeType(Node node);
+ /**
+ * Gets a special type to use for parameter nodes belonging to callables with a
+ * source node where a source call context `FlowFeature` is used, if any.
+ *
+ * This can be used to prevent lambdas from being resolved, when a concrete call
+ * context is needed. Example:
+ *
+ * ```csharp
+ * void Foo(Action a)
+ * {
+ * var x = Source();
+ * a(x); // (1)
+ * a = s => Sink(s); // (2)
+ * a(x); // (3)
+ * }
+ *
+ * void Bar()
+ * {
+ * Foo(s => Sink(s)); // (4)
+ * }
+ * ```
+ *
+ * If a source call context flow feature is used, `a` can be assigned a special
+ * type that is incompatible with the type of _any_ lambda expression, which will
+ * prevent the call edge from (1) to (4). Note that the call edge from (3) to (2)
+ * will still be valid.
+ */
+ default DataFlowType getSourceContextParameterNodeType() { none() }
+
predicate nodeIsHidden(Node node);
class DataFlowExpr;
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
index 506774857d8e..ed0412d1cd4d 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImpl.qll
@@ -1103,6 +1103,16 @@ module MakeImpl Lang> {
private module FwdTypeFlowInput implements TypeFlowInput {
predicate enableTypeFlow = Param::enableTypeFlow/0;
+ pragma[nomagic]
+ predicate isParameterNodeInSourceCallContext(ParamNode p) {
+ hasSourceCallCtx() and
+ exists(Node source, DataFlowCallable c |
+ Config::isSource(pragma[only_bind_into](source), _) and
+ nodeEnclosingCallable(source, c) and
+ nodeEnclosingCallable(p, c)
+ )
+ }
+
predicate relevantCallEdgeIn = PrevStage::relevantCallEdgeIn/2;
predicate relevantCallEdgeOut = PrevStage::relevantCallEdgeOut/2;
@@ -1410,6 +1420,8 @@ module MakeImpl Lang> {
private module RevTypeFlowInput implements TypeFlowInput {
predicate enableTypeFlow = Param::enableTypeFlow/0;
+ predicate isParameterNodeInSourceCallContext(ParamNode p) { none() }
+
predicate relevantCallEdgeIn(Call call, Callable c) {
flowOutOfCallAp(call, c, _, _, _, _, _)
}
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
index 51ebb3f8a730..3a414b8a0009 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
@@ -1893,6 +1893,9 @@ module MakeImplCommon Lang> {
signature module TypeFlowInput {
predicate enableTypeFlow();
+ /** Holds if `p` is a parameter of a callable with a source node that has a call context. */
+ predicate isParameterNodeInSourceCallContext(ParamNode p);
+
/** Holds if the edge is possibly needed in the direction `call` to `c`. */
predicate relevantCallEdgeIn(Call call, Callable c);
@@ -1953,6 +1956,9 @@ module MakeImplCommon Lang> {
/**
* Holds if a sequence of calls may propagate the value of `arg` to some
* argument-to-parameter call edge that strengthens the static type.
+ *
+ * This predicate is a reverse flow computation, starting at calls that
+ * strengthen the type and then following relevant call edges backwards.
*/
pragma[nomagic]
private predicate trackedArgTypeCand(ArgNode arg) {
@@ -1987,6 +1993,9 @@ module MakeImplCommon Lang> {
* Holds if `p` is part of a value-propagating call path where the
* end-points have stronger types than the intermediate parameter and
* argument nodes.
+ *
+ * This predicate is a forward flow computation, intersecting with the
+ * reverse flow computation done in `trackedArgTypeCand`.
*/
private predicate trackedParamType(ParamNode p) {
exists(Call call1, Callable c1, ArgNode argOut, Call call2, Callable c2, ArgNode argIn |
@@ -2013,6 +2022,8 @@ module MakeImplCommon Lang> {
typeStrongerThanFilter(at, pt)
)
or
+ Input::isParameterNodeInSourceCallContext(p)
+ or
exists(ArgNode arg |
trackedArgType(arg) and
relevantCallEdge(_, _, arg, p) and
@@ -2106,7 +2117,9 @@ module MakeImplCommon Lang> {
private predicate typeFlowParamType(ParamNode p, Type t, boolean cc) {
exists(Callable c |
Input::dataFlowNonCallEntry(c, cc) and
- trackedParamWithType(p, t, c)
+ if cc = true and exists(getSourceContextParameterNodeType())
+ then t = getSourceContextParameterNodeType()
+ else trackedParamWithType(p, t, c)
)
or
exists(Type t1, Type t2 |
From 0d4524f8f3256ef28e52af97bb70b69b82fbd8fd Mon Sep 17 00:00:00 2001
From: Tom Hvitved
Date: Tue, 7 Apr 2026 11:38:48 +0200
Subject: [PATCH 053/146] Address review comments
---
.../code/csharp/dataflow/internal/DataFlowImplSpecific.qll | 4 +++-
.../semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll | 2 ++
shared/dataflow/codeql/dataflow/DataFlow.qll | 4 ++--
.../dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll | 4 ++--
4 files changed, 9 insertions(+), 5 deletions(-)
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
index d548c0ef2767..ab1e75b3d0fc 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplSpecific.qll
@@ -30,5 +30,7 @@ module CsharpDataFlow implements InputSig {
exists(n.(AssignableDefinitionNode).getDefinition().getTargetAccess())
}
- DataFlowType getSourceContextParameterNodeType() { result.isSourceContextParameterType() }
+ DataFlowType getSourceContextParameterNodeType(Node p) {
+ exists(p) and result.isSourceContextParameterType()
+ }
}
diff --git a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
index 64a869e346ec..9a550a30b737 100644
--- a/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
+++ b/csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
@@ -2526,6 +2526,8 @@ predicate typeStrongerThan(DataFlowType t1, DataFlowType t2) {
uselessTypebound(t2)
or
compatibleTypesDelegateLeft(t1, t2)
+ or
+ compatibleTypesSourceContextParameterTypeLeft(t1, t2)
}
/**
diff --git a/shared/dataflow/codeql/dataflow/DataFlow.qll b/shared/dataflow/codeql/dataflow/DataFlow.qll
index bc9fc26adb12..cacd52cf8396 100644
--- a/shared/dataflow/codeql/dataflow/DataFlow.qll
+++ b/shared/dataflow/codeql/dataflow/DataFlow.qll
@@ -64,7 +64,7 @@ signature module InputSig {
DataFlowType getNodeType(Node node);
/**
- * Gets a special type to use for parameter nodes belonging to callables with a
+ * Gets a special type to use for parameter node `p` belonging to callables with a
* source node where a source call context `FlowFeature` is used, if any.
*
* This can be used to prevent lambdas from being resolved, when a concrete call
@@ -90,7 +90,7 @@ signature module InputSig {
* prevent the call edge from (1) to (4). Note that the call edge from (3) to (2)
* will still be valid.
*/
- default DataFlowType getSourceContextParameterNodeType() { none() }
+ default DataFlowType getSourceContextParameterNodeType(Node p) { none() }
predicate nodeIsHidden(Node node);
diff --git a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
index 3a414b8a0009..b2d4d13b07d4 100644
--- a/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
+++ b/shared/dataflow/codeql/dataflow/internal/DataFlowImplCommon.qll
@@ -2117,8 +2117,8 @@ module MakeImplCommon Lang> {
private predicate typeFlowParamType(ParamNode p, Type t, boolean cc) {
exists(Callable c |
Input::dataFlowNonCallEntry(c, cc) and
- if cc = true and exists(getSourceContextParameterNodeType())
- then t = getSourceContextParameterNodeType()
+ if cc = true and exists(getSourceContextParameterNodeType(p))
+ then t = getSourceContextParameterNodeType(p)
else trackedParamWithType(p, t, c)
)
or
From 3769a8a48287688b1c7469233d32d46dcd636660 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 7 Apr 2026 12:51:56 +0100
Subject: [PATCH 054/146] C++: Update code scanning suite .expected.
---
.../integration-tests/query-suite/cpp-code-scanning.qls.expected | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
index 57d240fd7958..6875fbf43def 100644
--- a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
+++ b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
@@ -11,6 +11,7 @@ ql/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
ql/cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql
ql/cpp/ql/src/Likely Bugs/Format/SnprintfOverflow.ql
ql/cpp/ql/src/Likely Bugs/Format/WrongNumberOfFormatArguments.ql
+ql/cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
ql/cpp/ql/src/Likely Bugs/Memory Management/AllocaInLoop.ql
ql/cpp/ql/src/Likely Bugs/Memory Management/PointerOverflow.ql
ql/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql
From f2292643a35362236f1e729bf7833839fb36bb56 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 7 Apr 2026 12:53:53 +0100
Subject: [PATCH 055/146] C++: Update code scanning suite .expected.
---
.../integration-tests/query-suite/cpp-code-scanning.qls.expected | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
index 57d240fd7958..6cc662aee3b2 100644
--- a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
+++ b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
@@ -7,6 +7,7 @@ ql/cpp/ql/src/Diagnostics/ExtractedFiles.ql
ql/cpp/ql/src/Diagnostics/ExtractionWarnings.ql
ql/cpp/ql/src/Diagnostics/FailedExtractorInvocations.ql
ql/cpp/ql/src/Likely Bugs/Arithmetic/BadAdditionOverflowCheck.ql
+ql/cpp/ql/src/Likely Bugs/Arithmetic/IntMultToLong.ql
ql/cpp/ql/src/Likely Bugs/Arithmetic/SignedOverflowCheck.ql
ql/cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql
ql/cpp/ql/src/Likely Bugs/Format/SnprintfOverflow.ql
From 201af3fffcb9a79fbc49bc37ef05275abd0ce7f5 Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 7 Apr 2026 12:59:31 +0100
Subject: [PATCH 056/146] C++: Update code scanning suite .expected.
---
.../integration-tests/query-suite/cpp-code-scanning.qls.expected | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
index 57d240fd7958..926efb34d85c 100644
--- a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
+++ b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
@@ -28,6 +28,7 @@ ql/cpp/ql/src/Security/CWE/CWE-120/VeryLikelyOverrunWrite.ql
ql/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql
ql/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
ql/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
+ql/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
ql/cpp/ql/src/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.ql
ql/cpp/ql/src/Security/CWE/CWE-253/HResultBooleanConversion.ql
ql/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
From b21dba6131e8550f7ea940c3341ccfbfbbd3dc6d Mon Sep 17 00:00:00 2001
From: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
Date: Tue, 7 Apr 2026 13:06:34 +0100
Subject: [PATCH 057/146] C++: Update code scanning suite .expected.
---
.../integration-tests/query-suite/cpp-code-scanning.qls.expected | 1 +
1 file changed, 1 insertion(+)
diff --git a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
index 57d240fd7958..4e86c27d53fd 100644
--- a/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
+++ b/cpp/ql/integration-tests/query-suite/cpp-code-scanning.qls.expected
@@ -40,6 +40,7 @@ ql/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql
ql/cpp/ql/src/Security/CWE/CWE-416/IteratorToExpiredContainer.ql
ql/cpp/ql/src/Security/CWE/CWE-416/UseOfStringAfterLifetimeEnds.ql
ql/cpp/ql/src/Security/CWE/CWE-416/UseOfUniquePointerAfterLifetimeEnds.ql
+ql/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
ql/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql
ql/cpp/ql/src/Security/CWE/CWE-611/XXE.ql
ql/cpp/ql/src/Security/CWE/CWE-676/DangerousFunctionOverflow.ql
From 8d79248ea767a3e931d0e1695d48c8b4d0b719ae Mon Sep 17 00:00:00 2001
From: Taus
Date: Fri, 20 Mar 2026 13:55:49 +0000
Subject: [PATCH 058/146] Python: Port ModificationOfLocals.ql
---
python/ql/src/Statements/ModificationOfLocals.ql | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/python/ql/src/Statements/ModificationOfLocals.ql b/python/ql/src/Statements/ModificationOfLocals.ql
index e4791a410f7a..82529cbd6d0b 100644
--- a/python/ql/src/Statements/ModificationOfLocals.ql
+++ b/python/ql/src/Statements/ModificationOfLocals.ql
@@ -12,10 +12,10 @@
*/
import python
-private import LegacyPointsTo
+private import semmle.python.ApiGraphs
-predicate originIsLocals(ControlFlowNodeWithPointsTo n) {
- n.pointsTo(_, _, Value::named("locals").getACall())
+predicate originIsLocals(ControlFlowNode n) {
+ API::builtin("locals").getReturn().getAValueReachableFromSource().asCfgNode() = n
}
predicate modification_of_locals(ControlFlowNode f) {
@@ -37,5 +37,5 @@ where
// in module level scope `locals() == globals()`
// see https://docs.python.org/3/library/functions.html#locals
// FP report in https://github.com/github/codeql/issues/6674
- not a.getScope() instanceof ModuleScope
+ not a.getScope() instanceof Module
select a, "Modification of the locals() dictionary will have no effect on the local variables."
From e3688444d74582c29c0356f96ac80c19201f3166 Mon Sep 17 00:00:00 2001
From: Taus
Date: Tue, 7 Apr 2026 21:39:30 +0000
Subject: [PATCH 059/146] Python: Also exclude class scope
Changing the `locals()` dictionary actually _does_ change the attributes
of the class being defined, so we shouldn't alert in this case.
---
python/ql/src/Statements/ModificationOfLocals.ql | 5 ++++-
python/ql/test/query-tests/Statements/general/test.py | 6 ++++++
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/python/ql/src/Statements/ModificationOfLocals.ql b/python/ql/src/Statements/ModificationOfLocals.ql
index 82529cbd6d0b..f32ddcf78849 100644
--- a/python/ql/src/Statements/ModificationOfLocals.ql
+++ b/python/ql/src/Statements/ModificationOfLocals.ql
@@ -37,5 +37,8 @@ where
// in module level scope `locals() == globals()`
// see https://docs.python.org/3/library/functions.html#locals
// FP report in https://github.com/github/codeql/issues/6674
- not a.getScope() instanceof Module
+ not a.getScope() instanceof Module and
+ // in class level scope `locals()` reflects the class namespace,
+ // so modifications do take effect.
+ not a.getScope() instanceof Class
select a, "Modification of the locals() dictionary will have no effect on the local variables."
diff --git a/python/ql/test/query-tests/Statements/general/test.py b/python/ql/test/query-tests/Statements/general/test.py
index eee63fa89e88..a5848f7c718d 100644
--- a/python/ql/test/query-tests/Statements/general/test.py
+++ b/python/ql/test/query-tests/Statements/general/test.py
@@ -174,3 +174,9 @@ def assert_ok(seq):
# False positive. ODASA-8042. Fixed in PR #2401.
class false_positive:
e = (x for x in [])
+
+# In class-level scope `locals()` reflects the class namespace,
+# so modifications do take effect.
+class MyClass:
+ locals()['x'] = 43 # OK
+ y = x
From 2fbfcb970e87aaad8c9501e6ecc071227b6c11a0 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Wed, 8 Apr 2026 13:19:00 +0200
Subject: [PATCH 060/146] Swift: Use Swift 6.3 artifacts
---
swift/third_party/load.bzl | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/swift/third_party/load.bzl b/swift/third_party/load.bzl
index 676c5f0ce847..156a2201cdac 100644
--- a/swift/third_party/load.bzl
+++ b/swift/third_party/load.bzl
@@ -6,6 +6,10 @@ load("//misc/bazel:lfs.bzl", "lfs_archive", "lfs_files")
_override = {
# these are used to test new artifacts. Must be empty before merging to main
+ "swift-prebuilt-macOS-swift-6.3-RELEASE-161.tar.zst": "eab65167bfb20e07803b9be61b22b109a0308056c58b572ea9a275b920a3ea0a",
+ "swift-prebuilt-Linux-swift-6.3-RELEASE-161.tar.zst": "cfc111c983a00acfdb01090ba1f568fa257d2f8fc3050a2f7c37e160fe9f1003",
+ "resource-dir-macOS-swift-6.3-RELEASE-151.zip": "991e63a2559a762058d66df08275aea55217ff96bd482c5ad7d536181afa573a",
+ "resource-dir-Linux-swift-6.3-RELEASE-151.zip": "9078cfd1ec62f30cd25c0ea4e43fc3d99449f802e6c165f59a7f789a70eb5284",
}
_staging_url = "https://github.com/dsp-testing/codeql-swift-artifacts/releases/download/staging-{}/{}"
From fd83515843776744084570828a1a25360a8a3383 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Wed, 8 Apr 2026 13:19:40 +0200
Subject: [PATCH 061/146] Swift: Make extractor compile
---
swift/extractor/infra/SwiftTagTraits.h | 7 +++----
swift/extractor/translators/StmtTranslator.cpp | 2 +-
swift/extractor/translators/TypeTranslator.cpp | 12 ++++++++----
swift/extractor/translators/TypeTranslator.h | 3 ++-
4 files changed, 14 insertions(+), 10 deletions(-)
diff --git a/swift/extractor/infra/SwiftTagTraits.h b/swift/extractor/infra/SwiftTagTraits.h
index f7825043edda..7ea1d58a5763 100644
--- a/swift/extractor/infra/SwiftTagTraits.h
+++ b/swift/extractor/infra/SwiftTagTraits.h
@@ -146,7 +146,6 @@ MAP(swift::Expr, ExprTag)
MAP(swift::ImplicitConversionExpr, ImplicitConversionExprTag)
MAP(swift::LoadExpr, LoadExprTag)
MAP(swift::DestructureTupleExpr, DestructureTupleExprTag)
- MAP(swift::UnresolvedTypeConversionExpr, UnresolvedTypeConversionExprTag)
MAP(swift::FunctionConversionExpr, FunctionConversionExprTag)
MAP(swift::CovariantFunctionConversionExpr, CovariantFunctionConversionExprTag)
MAP(swift::CovariantReturnConversionExpr, CovariantReturnConversionExprTag)
@@ -267,8 +266,7 @@ MAP(swift::TypeRepr, TypeReprTag)
MAP(swift::Type, TypeTag)
MAP(swift::TypeBase, TypeTag)
MAP(swift::ErrorType, ErrorTypeTag)
- MAP(swift::UnresolvedType, UnresolvedTypeTag)
- MAP(swift::PlaceholderType, void) // appears in ambiguous types but are then transformed to UnresolvedType
+ MAP(swift::PlaceholderType, void) // appears in ambiguous types but are then transformed to ErrorType
MAP(swift::BuiltinType, BuiltinTypeTag)
MAP(swift::AnyBuiltinIntegerType, AnyBuiltinIntegerTypeTag)
MAP(swift::BuiltinIntegerType, BuiltinIntegerTypeTag)
@@ -285,7 +283,8 @@ MAP(swift::TypeBase, TypeTag)
MAP(swift::BuiltinVectorType, BuiltinVectorTypeTag)
MAP(swift::BuiltinPackIndexType, void) // SIL type, cannot really appear in the frontend run
MAP(swift::BuiltinNonDefaultDistributedActorStorageType, void) // Does not appear in AST/SIL, only used during IRGen
- MAP(swift::BuiltinFixedArrayType, BuiltinFixedArrayTypeTag)
+ MAP(swift::BuiltinGenericType, BuiltinGenericTypeTag)
+ MAP(swift::BuiltinFixedArrayType, BuiltinFixedArrayTypeTag)
MAP(swift::BuiltinUnboundGenericType, void) // Only used during type resolution
MAP(swift::BuiltinImplicitActorType, void) // SIL type
MAP(swift::TupleType, TupleTypeTag)
diff --git a/swift/extractor/translators/StmtTranslator.cpp b/swift/extractor/translators/StmtTranslator.cpp
index 1562c28f19c7..2b059682b331 100644
--- a/swift/extractor/translators/StmtTranslator.cpp
+++ b/swift/extractor/translators/StmtTranslator.cpp
@@ -137,7 +137,7 @@ codeql::CaseStmt StmtTranslator::translateCaseStmt(const swift::CaseStmt& stmt)
auto entry = dispatcher.createEntry(stmt);
entry.body = dispatcher.fetchLabel(stmt.getBody());
entry.labels = dispatcher.fetchRepeatedLabels(stmt.getCaseLabelItems());
- entry.variables = dispatcher.fetchRepeatedLabels(stmt.getCaseBodyVariablesOrEmptyArray());
+ entry.variables = dispatcher.fetchRepeatedLabels(stmt.getCaseBodyVariables());
return entry;
}
diff --git a/swift/extractor/translators/TypeTranslator.cpp b/swift/extractor/translators/TypeTranslator.cpp
index 52d17c7a3577..5d2d1e39667e 100644
--- a/swift/extractor/translators/TypeTranslator.cpp
+++ b/swift/extractor/translators/TypeTranslator.cpp
@@ -233,6 +233,14 @@ codeql::BuiltinIntegerType TypeTranslator::translateBuiltinIntegerType(
return entry;
}
+codeql::BuiltinFixedArrayType TypeTranslator::translateBuiltinFixedArrayType(
+ const swift::BuiltinFixedArrayType& type) {
+ // currently the translate dispatching mechanism does not go up more than one step in the
+ // hierarchy so we need to put this explicitly here, as BuiltinFixedArrayType derives from
+ // BuiltinGenericType which then derives from BuiltinType
+ return translateBuiltinType(type);
+}
+
codeql::ExistentialArchetypeType TypeTranslator::translateExistentialArchetypeType(
const swift::ExistentialArchetypeType& type) {
auto entry = createTypeEntry(type);
@@ -258,10 +266,6 @@ codeql::ErrorType TypeTranslator::translateErrorType(const swift::ErrorType& typ
return createTypeEntry(type);
}
-codeql::UnresolvedType TypeTranslator::translateUnresolvedType(const swift::UnresolvedType& type) {
- return createTypeEntry(type);
-}
-
codeql::ParameterizedProtocolType TypeTranslator::translateParameterizedProtocolType(
const swift::ParameterizedProtocolType& type) {
auto entry = createTypeEntry(type);
diff --git a/swift/extractor/translators/TypeTranslator.h b/swift/extractor/translators/TypeTranslator.h
index c65c0e757dec..fd211ec39e09 100644
--- a/swift/extractor/translators/TypeTranslator.h
+++ b/swift/extractor/translators/TypeTranslator.h
@@ -69,13 +69,14 @@ class TypeTranslator : public TypeTranslatorBase {
codeql::BuiltinIntegerLiteralType translateBuiltinIntegerLiteralType(
const swift::BuiltinIntegerLiteralType& type);
codeql::BuiltinIntegerType translateBuiltinIntegerType(const swift::BuiltinIntegerType& type);
+ codeql::BuiltinFixedArrayType translateBuiltinFixedArrayType(
+ const swift::BuiltinFixedArrayType& type);
codeql::ExistentialArchetypeType translateExistentialArchetypeType(
const swift::ExistentialArchetypeType& type);
codeql::ModuleType translateModuleType(const swift::ModuleType& type);
codeql::OpaqueTypeArchetypeType translateOpaqueTypeArchetypeType(
const swift::OpaqueTypeArchetypeType& type);
codeql::ErrorType translateErrorType(const swift::ErrorType& type);
- codeql::UnresolvedType translateUnresolvedType(const swift::UnresolvedType& type);
codeql::ParameterizedProtocolType translateParameterizedProtocolType(
const swift::ParameterizedProtocolType& type);
codeql::PackArchetypeType translatePackArchetypeType(const swift::PackArchetypeType& type);
From d473c7143d3b83351ee5027320fb831daeceb021 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Wed, 8 Apr 2026 13:20:06 +0200
Subject: [PATCH 062/146] Swift: Update schema
---
swift/schema.py | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/swift/schema.py b/swift/schema.py
index e7b45fb81a57..9302cb14b579 100644
--- a/swift/schema.py
+++ b/swift/schema.py
@@ -1480,7 +1480,14 @@ class TypeValueExpr(Expr):
class IntegerType(Type):
value: string
-class BuiltinFixedArrayType(BuiltinType):
+class BuiltinGenericType(BuiltinType):
+ """
+ A builtin generic type.
+ """
+ pass
+
+
+class BuiltinFixedArrayType(BuiltinGenericType):
"""
A builtin type representing N values stored contiguously.
"""
From 6b2494c3e5c22cb552696dd7d1b91c5e1e6cc211 Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Wed, 8 Apr 2026 13:21:03 +0200
Subject: [PATCH 063/146] Swift: Update generated files
---
swift/ql/.generated.list | 15 +++++----
swift/ql/.gitattributes | 3 ++
swift/ql/lib/codeql/swift/elements.qll | 1 +
.../elements/type/BuiltinFixedArrayType.qll | 2 +-
.../elements/type/BuiltinGenericType.qll | 12 +++++++
.../type/internal/BuiltinGenericTypeImpl.qll | 19 +++++++++++
.../codeql/swift/generated/ParentChild.qll | 16 +++++-----
swift/ql/lib/codeql/swift/generated/Raw.qll | 32 +++++++++++--------
swift/ql/lib/codeql/swift/generated/Synth.qll | 31 +++++++++++++++---
.../generated/type/BuiltinFixedArrayType.qll | 6 ++--
.../generated/type/BuiltinGenericType.qll | 22 +++++++++++++
swift/ql/lib/swift.dbscheme | 14 +++++---
12 files changed, 133 insertions(+), 40 deletions(-)
create mode 100644 swift/ql/lib/codeql/swift/elements/type/BuiltinGenericType.qll
create mode 100644 swift/ql/lib/codeql/swift/elements/type/internal/BuiltinGenericTypeImpl.qll
create mode 100644 swift/ql/lib/codeql/swift/generated/type/BuiltinGenericType.qll
diff --git a/swift/ql/.generated.list b/swift/ql/.generated.list
index 8d2fb9a2ebca..a666c64948d4 100644
--- a/swift/ql/.generated.list
+++ b/swift/ql/.generated.list
@@ -539,8 +539,9 @@ lib/codeql/swift/elements/type/BoundGenericType.qll 089e5e8d09c62a23d575dcab68cd
lib/codeql/swift/elements/type/BuiltinBridgeObjectType.qll b0064e09b53efe801b0bf950ff00698a84e2f714e853e4859ed5f3246025a1bd aa14b6ae2ec510c4ddd2cc073bf971809536ab8fd8763fd05bd171b0bbe83860
lib/codeql/swift/elements/type/BuiltinDefaultActorStorageType.qll e867a9d0b2c61b7eb61f5143c78e31f8d98d3245d79e0e3281d4c172175f496b 265e87f2e37ca968af572cc619294d1ee91dd66ebb0d1bb1ba9ab7159de52f0b
lib/codeql/swift/elements/type/BuiltinExecutorType.qll 2b141553bbc02a00d97579ba9d0e38fa0978d40ce954b0caf64826aa259dbc08 a81465fd0e87ad5b8e418d8f21c337b3e96388a3b92b3332f0d6b0ff7663e5c7
-lib/codeql/swift/elements/type/BuiltinFixedArrayType.qll 24a57f15a53070e6308841cd5dac4d55059e84d9fb18a77eec1130647dcdc97c 9f4167ef5190cbeee71abd068bdb0a280b690a16349cd408244d4cf9edfb357a
+lib/codeql/swift/elements/type/BuiltinFixedArrayType.qll 9d32f49cd7169d12c00cde31433897e8f8ada62132430020dc2525a97673cf57 0236f494f6ce77b04a80e405d11f5b39b1e45ea9c50a6ee42dd96407516b448f
lib/codeql/swift/elements/type/BuiltinFloatType.qll 81f49325077b75cea682904ddab24d1b2fdc5c93b0b28830c08e866d5c9307a7 e26a348d66e3824ccd92729624ce2b2ebc82a844aa47035e0a963a62b08b772d
+lib/codeql/swift/elements/type/BuiltinGenericType.qll 108682444f5f28b64b7caa16254fd4d7418813bc9e7f6a17477b13fe37293d40 de3fa330516684f0cfd848101b3a93f83b2d8a9f00b35dae70d2b56cb5414923
lib/codeql/swift/elements/type/BuiltinIntegerLiteralType.qll 34ee35733cf26f90d799a79f8a2362b199ea2ecb6ba83eb5678dda9eb3ed255f e33fdb27d3c22d441277b66ba74136cb88e1da25a2146391b258c68f7fbf5dd3
lib/codeql/swift/elements/type/BuiltinIntegerType.qll b931e79a40fb379a8de377ae4ea1c85befb7b07dbfe913f0ea7f5adf5514b217 5d7e6f21284b8c5ff70773bb64f896a40541c9064bfdd336798ccfda4cb4fb9e
lib/codeql/swift/elements/type/BuiltinJobType.qll 4b4cab766d8476efd7482ab47f6fdd63fd90a322e1e791949351092f126f5b46 779ceee86a778b59a3feb5247603fe07e4a73068a7990e25c31dd93ba0dd718d
@@ -623,6 +624,7 @@ lib/codeql/swift/elements/type/internal/BuiltinFixedArrayTypeConstructor.qll 0d5
lib/codeql/swift/elements/type/internal/BuiltinFixedArrayTypeImpl.qll 6b69ba8b271646bcd699e338f41c186f3e4e7d401830918407e392312b2f0ad1 ecaca3d762264423094f7c2cb63e33b5d72d970946766eec33d984fa977950b4
lib/codeql/swift/elements/type/internal/BuiltinFloatTypeConstructor.qll f1dab7b9d36213e57083a6effec1b2d859553831394c0e746c592c96a20db6de cceeaa864cfc84511b3cdad6a88d44fc14ea1c8e38db72b0854c3f217a3f9c44
lib/codeql/swift/elements/type/internal/BuiltinFloatTypeImpl.qll 1dc7f7817c4a238751875b0cee98d060a1ea975a22fd90ceef0f9874b85824d6 d98f743c28174fb3294f0ff60232600a4fc80aeefe72e5cc15bb56e09880ec1e
+lib/codeql/swift/elements/type/internal/BuiltinGenericTypeImpl.qll 2735ef1521c399540ef43fc75aa62b4bbb1871446d87304c9e3a991ad16a96f4 263e41354843afc5d1f57bd2f50610992d05d77ceb1c2079587ddd3a1eceffc5
lib/codeql/swift/elements/type/internal/BuiltinIntegerLiteralTypeConstructor.qll 3885775f78e18286aa8dc99ab5b6f386a278b34b47f93da28d67faac918e6087 93be2ad0b7235bab613b74582bc1de0ca8b2a4da7a387d09a9b8ef9b38095534
lib/codeql/swift/elements/type/internal/BuiltinIntegerLiteralTypeImpl.qll 7f078bd837acddd0e835f78b0ae6e0381c9c587e82edc61cf78986ce0081e314 f141415be39f8a5f09d4a90cc5d841f90385c3be8781c0bafbad0871681ec8a3
lib/codeql/swift/elements/type/internal/BuiltinIntegerTypeConstructor.qll 2c5a7884c5c8c852d81b6ce03f9c6cc036944428731e3a73208c0d2047b72611 abd29915698109395a4751999aa334ba3c020f20372a5dff213acdd672d024a9
@@ -721,7 +723,7 @@ lib/codeql/swift/elements/type/internal/UnresolvedTypeImpl.qll ee1499dd568753898
lib/codeql/swift/elements/type/internal/VariadicSequenceTypeConstructor.qll fc74a5a2a2effa28ef24509b20ee4373d97cf6e8c71840121bb031c6adedf584 c9b2effc1d01c13c5e6a74a111122fa79a2f6554dda3cb016d68ba397e566ec4
lib/codeql/swift/elements/type/internal/WeakStorageTypeConstructor.qll 5fdce3716aba6318522174a2c455a63480970222ae81c732fb19c6dd3ae2d271 60ea79d6943e129deba0deccb566cf9d73f78398b0f7f0212674d91287d6b2ae
lib/codeql/swift/elements/type/internal/WeakStorageTypeImpl.qll 74f79b458f3204ec2519bd654de21bc4fb6b76816bd8ca01990fe897563a1383 34e1810f74cecda5b580ed050438ae1d914b97a36b8f4e2de1c25254c0cac633
-lib/codeql/swift/elements.qll ec0104a658330f595eac7dd8578d996905a6c2cf78765744c3967a8f3d1c3273 ec0104a658330f595eac7dd8578d996905a6c2cf78765744c3967a8f3d1c3273
+lib/codeql/swift/elements.qll 70e20ccd31c9247904fb5ef00ccbda5a6d29c680e88b0ed238f4b4546abf5f33 70e20ccd31c9247904fb5ef00ccbda5a6d29c680e88b0ed238f4b4546abf5f33
lib/codeql/swift/generated/AstNode.qll 6fb80e9b230a1e3ae8193af40744f253d5cc81dc4239156924e5ab606c491efc e5c28418e9a38bde08f323a3986a199620189fc4a8a4dc8f670610a5d3d65b99
lib/codeql/swift/generated/AvailabilityInfo.qll e3a5274c43e72ff124b6988fd8be0c83a41b89337e11104150dd0ca7f51d8a11 889563791ca8d9758dbbccf64a0731c4bdbf721cad32bc6cd723f1072b6aa1de
lib/codeql/swift/generated/AvailabilitySpec.qll 1bd2a0ee085f802c99090e681ab3339fc5013024d79deef39f376de12ab76d37 658f2eb51860726cfa6808b3e3501d624e0734750d1420f7a25c89782f1f6c7e
@@ -737,10 +739,10 @@ lib/codeql/swift/generated/KeyPathComponent.qll e11dcf952045b5e6062e24c23515cff9
lib/codeql/swift/generated/Locatable.qll 1d37fa20de71c0b9986bfd7a7c0cb82ab7bf3fda2d2008700f955ad82ce109a7 e97d4d4fb8a4800e0008cc00f60c8ed9b1ebd5f1140fd85e68b034616178d721
lib/codeql/swift/generated/Location.qll 5e20316c3e480ddfe632b7e88e016c19f10a67df1f6ae9c8f128755a6907d6f5 5a0af2d070bcb2ed53d6d0282bf9c60dc64c2dce89c21fdd485e9c7893c1c8fa
lib/codeql/swift/generated/MacroRole.qll facf907e75490d69cd401c491215e4719324d751f40ea46c86ccf24cf3663c1f 969d8d4b44e3f1a9c193a152a4d83a303e56d2dbb871fc920c47a33f699cf018
-lib/codeql/swift/generated/ParentChild.qll 7fdc133bdec6cc223d5ee85e757b02c5d2e1ab121bcf269bb48c8a12a31a61e9 d8dd6e21d290a293db4db510b1523a9ea428b12f48b7574f03acf00b9ca065ef
+lib/codeql/swift/generated/ParentChild.qll 669d39245f2cb735cfd4bcebdb551ef8f334fef5297c5834a8b09ebfa655856e 59b283c8a30b6b364c853302ab919ea713e0289e7b793b08b46fc87178d14a6a
lib/codeql/swift/generated/PureSynthConstructors.qll bc31a6c4d142fa3fbdcae69d5ba6f1cec00eb9ad92b46c8d7b91ebfa7ef6c1f4 bc31a6c4d142fa3fbdcae69d5ba6f1cec00eb9ad92b46c8d7b91ebfa7ef6c1f4
-lib/codeql/swift/generated/Raw.qll 6adc2ec210e91051b6d3d6c84117b827f10dbea682a18b69348d1c6cdc53629c 9ff02fcca7a7b83c85303ffc6daa00ea392da6ce1f9cb389b5053b34d4a45e4c
-lib/codeql/swift/generated/Synth.qll b0084d1f573ba1b10ec8a8fab169b15f15866ecb9a6aeeeac81553a442be28e3 09efe455f3fd6b8b983b30efbd797f09af46e6f5a1a1075801650528999ed938
+lib/codeql/swift/generated/Raw.qll c209a47a66f24f54bdfb5adf591dd171b2dbe9e30936a2355160526b9f756399 378e7492ca885f46092628ca26afa76c909deb88f092fe56404fea8f94d133b0
+lib/codeql/swift/generated/Synth.qll e30b50d2645d9c36719d81f1be70712c7c6e89a3f5b4a5ae894411e045d05bff 9bd0c9c90532db97cde9553dde4089b7cf12c462c690d853fa40cb36ea112c21
lib/codeql/swift/generated/SynthConstructors.qll c40f01e1331bdbe238620a41d17409cefe34a6b23066708ef5d74f8631b54f48 c40f01e1331bdbe238620a41d17409cefe34a6b23066708ef5d74f8631b54f48
lib/codeql/swift/generated/UnknownFile.qll 247ddf2ebb49ce5ed4bf7bf91a969ddff37de6c78d43d8affccaf7eb586e06f2 452b29f0465ef45e978ef8b647b75e5a2a1e53f2a568fc003bc8f52f73b3fa4d
lib/codeql/swift/generated/UnknownLocation.qll d871000b4f53ffca4f67ea23ca5626e5dcce125d62a4d4b9969e08cc974af6fc b05971d7774e60790362fb810fb7086314f40a2de747b8cb1bc823ec6494a4dd
@@ -978,8 +980,9 @@ lib/codeql/swift/generated/type/BoundGenericType.qll 5e7a2210b766437ca301f9675f7
lib/codeql/swift/generated/type/BuiltinBridgeObjectType.qll 97f30768a8788ec4547ce8a8f06fdd165286177e3819bf2e6590b9479f5bada4 ea3161c34d1d18783b38deac43c73048e4510015307d93f77cd95c149e988846
lib/codeql/swift/generated/type/BuiltinDefaultActorStorageType.qll 10e49de9a8bc3e67285c111f7869c8baceb70e478661d5557ebc8c86f41b4aec 1a0ce85eb325f666fbc2ac49c6f994efd552de6f2105e0a7ba9a10e39f3d1591
lib/codeql/swift/generated/type/BuiltinExecutorType.qll 8f58d4d413910aded894bfa9b54748adfc2b78f4ee271ac6db5f5b0214f36a66 69da70d76146155529b7b2426b3a459abe318f887240aac1aed5719fda5f386a
-lib/codeql/swift/generated/type/BuiltinFixedArrayType.qll 9bd26596da9137b07324222c9ed39ec0781e44673314fba96a0c7cf16f65cc7d cc2d40961b070a89f3350ab95b92ae33372277e499d7b2a9ea34721cc1fe1923
+lib/codeql/swift/generated/type/BuiltinFixedArrayType.qll 2ae9d1ef215c725bc27f69d25247d360ee8aa0aa5a757df6b8e9734821084435 2f1caacf0f95c8f863296f0cc0a56abac4bf58ddc68e9ed63b5d8672fd21172d
lib/codeql/swift/generated/type/BuiltinFloatType.qll 6306a806107bba052fe0b1335c8c4d4391cdb6aa5f42f14c70743113928c4c36 3265d571630c0437e5d81ba20a0b6112b7e88ee3ffca737557186001cf8aa04a
+lib/codeql/swift/generated/type/BuiltinGenericType.qll 6cd1b5da102e221f25a301c284ccc9cbd64d595596787df1a4fd3f2a92ded077 3ae4c8676a868205c5334646e395b8fc4e561ee2f4c115003ae2f4ed83197b76
lib/codeql/swift/generated/type/BuiltinIntegerLiteralType.qll 3f49aac9b81c440b902a658294cf95aff5cb79b0d6cee8b1abd8a08ad45c7966 6c184dcf5d9376f193f07fe4722ea7cab51f1dfdef4d72c3042842d73cca31fe
lib/codeql/swift/generated/type/BuiltinIntegerType.qll 3cfcbc4ebea6051d1f6dedcf098888c72c02bf697cebb52a0060c1885bea61f0 1c78df7a184e3615024d6e361b88dd619828a0aa7d342564610a95b02cc67d1e
lib/codeql/swift/generated/type/BuiltinJobType.qll dc0e1932e972936001b1d688d6e70d7395184eef3c4242cebf3a2608d6607785 e5573304f6043f79cfc28e35744fd390eaebcb86a6f2758cc96aba588c1b8cb9
diff --git a/swift/ql/.gitattributes b/swift/ql/.gitattributes
index 37f29b6947ed..212221509d0b 100644
--- a/swift/ql/.gitattributes
+++ b/swift/ql/.gitattributes
@@ -543,6 +543,7 @@
/lib/codeql/swift/elements/type/BuiltinExecutorType.qll linguist-generated
/lib/codeql/swift/elements/type/BuiltinFixedArrayType.qll linguist-generated
/lib/codeql/swift/elements/type/BuiltinFloatType.qll linguist-generated
+/lib/codeql/swift/elements/type/BuiltinGenericType.qll linguist-generated
/lib/codeql/swift/elements/type/BuiltinIntegerLiteralType.qll linguist-generated
/lib/codeql/swift/elements/type/BuiltinIntegerType.qll linguist-generated
/lib/codeql/swift/elements/type/BuiltinJobType.qll linguist-generated
@@ -625,6 +626,7 @@
/lib/codeql/swift/elements/type/internal/BuiltinFixedArrayTypeImpl.qll linguist-generated
/lib/codeql/swift/elements/type/internal/BuiltinFloatTypeConstructor.qll linguist-generated
/lib/codeql/swift/elements/type/internal/BuiltinFloatTypeImpl.qll linguist-generated
+/lib/codeql/swift/elements/type/internal/BuiltinGenericTypeImpl.qll linguist-generated
/lib/codeql/swift/elements/type/internal/BuiltinIntegerLiteralTypeConstructor.qll linguist-generated
/lib/codeql/swift/elements/type/internal/BuiltinIntegerLiteralTypeImpl.qll linguist-generated
/lib/codeql/swift/elements/type/internal/BuiltinIntegerTypeConstructor.qll linguist-generated
@@ -982,6 +984,7 @@
/lib/codeql/swift/generated/type/BuiltinExecutorType.qll linguist-generated
/lib/codeql/swift/generated/type/BuiltinFixedArrayType.qll linguist-generated
/lib/codeql/swift/generated/type/BuiltinFloatType.qll linguist-generated
+/lib/codeql/swift/generated/type/BuiltinGenericType.qll linguist-generated
/lib/codeql/swift/generated/type/BuiltinIntegerLiteralType.qll linguist-generated
/lib/codeql/swift/generated/type/BuiltinIntegerType.qll linguist-generated
/lib/codeql/swift/generated/type/BuiltinJobType.qll linguist-generated
diff --git a/swift/ql/lib/codeql/swift/elements.qll b/swift/ql/lib/codeql/swift/elements.qll
index bdffeba5261f..6a39c4657785 100644
--- a/swift/ql/lib/codeql/swift/elements.qll
+++ b/swift/ql/lib/codeql/swift/elements.qll
@@ -252,6 +252,7 @@ import codeql.swift.elements.type.BuiltinDefaultActorStorageType
import codeql.swift.elements.type.BuiltinExecutorType
import codeql.swift.elements.type.BuiltinFixedArrayType
import codeql.swift.elements.type.BuiltinFloatType
+import codeql.swift.elements.type.BuiltinGenericType
import codeql.swift.elements.type.BuiltinIntegerLiteralType
import codeql.swift.elements.type.BuiltinIntegerType
import codeql.swift.elements.type.BuiltinJobType
diff --git a/swift/ql/lib/codeql/swift/elements/type/BuiltinFixedArrayType.qll b/swift/ql/lib/codeql/swift/elements/type/BuiltinFixedArrayType.qll
index bf523a0a7852..996c38d127bf 100644
--- a/swift/ql/lib/codeql/swift/elements/type/BuiltinFixedArrayType.qll
+++ b/swift/ql/lib/codeql/swift/elements/type/BuiltinFixedArrayType.qll
@@ -4,7 +4,7 @@
*/
private import internal.BuiltinFixedArrayTypeImpl
-import codeql.swift.elements.type.BuiltinType
+import codeql.swift.elements.type.BuiltinGenericType
/**
* A builtin type representing N values stored contiguously.
diff --git a/swift/ql/lib/codeql/swift/elements/type/BuiltinGenericType.qll b/swift/ql/lib/codeql/swift/elements/type/BuiltinGenericType.qll
new file mode 100644
index 000000000000..4513423fd608
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/elements/type/BuiltinGenericType.qll
@@ -0,0 +1,12 @@
+// generated by codegen/codegen.py, do not edit
+/**
+ * This module provides the public class `BuiltinGenericType`.
+ */
+
+private import internal.BuiltinGenericTypeImpl
+import codeql.swift.elements.type.BuiltinType
+
+/**
+ * A builtin generic type.
+ */
+final class BuiltinGenericType = Impl::BuiltinGenericType;
diff --git a/swift/ql/lib/codeql/swift/elements/type/internal/BuiltinGenericTypeImpl.qll b/swift/ql/lib/codeql/swift/elements/type/internal/BuiltinGenericTypeImpl.qll
new file mode 100644
index 000000000000..0e475d64f010
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/elements/type/internal/BuiltinGenericTypeImpl.qll
@@ -0,0 +1,19 @@
+// generated by codegen/codegen.py, remove this comment if you wish to edit this file
+/**
+ * This module provides a hand-modifiable wrapper around the generated class `BuiltinGenericType`.
+ *
+ * INTERNAL: Do not use.
+ */
+
+private import codeql.swift.generated.type.BuiltinGenericType
+
+/**
+ * INTERNAL: This module contains the customizable definition of `BuiltinGenericType` and should not
+ * be referenced directly.
+ */
+module Impl {
+ /**
+ * A builtin generic type.
+ */
+ class BuiltinGenericType extends Generated::BuiltinGenericType { }
+}
diff --git a/swift/ql/lib/codeql/swift/generated/ParentChild.qll b/swift/ql/lib/codeql/swift/generated/ParentChild.qll
index efed12bb5fe0..424fd7af75e9 100644
--- a/swift/ql/lib/codeql/swift/generated/ParentChild.qll
+++ b/swift/ql/lib/codeql/swift/generated/ParentChild.qll
@@ -2972,12 +2972,6 @@ private module Impl {
none()
}
- private Element getImmediateChildOfBuiltinFixedArrayType(
- BuiltinFixedArrayType e, int index, string partialPredicateCall
- ) {
- none()
- }
-
private Element getImmediateChildOfBuiltinFloatType(
BuiltinFloatType e, int index, string partialPredicateCall
) {
@@ -3084,6 +3078,12 @@ private module Impl {
none()
}
+ private Element getImmediateChildOfBuiltinFixedArrayType(
+ BuiltinFixedArrayType e, int index, string partialPredicateCall
+ ) {
+ none()
+ }
+
private Element getImmediateChildOfBuiltinIntegerLiteralType(
BuiltinIntegerLiteralType e, int index, string partialPredicateCall
) {
@@ -3636,8 +3636,6 @@ private module Impl {
or
result = getImmediateChildOfBuiltinExecutorType(e, index, partialAccessor)
or
- result = getImmediateChildOfBuiltinFixedArrayType(e, index, partialAccessor)
- or
result = getImmediateChildOfBuiltinFloatType(e, index, partialAccessor)
or
result = getImmediateChildOfBuiltinJobType(e, index, partialAccessor)
@@ -3674,6 +3672,8 @@ private module Impl {
or
result = getImmediateChildOfWeakStorageType(e, index, partialAccessor)
or
+ result = getImmediateChildOfBuiltinFixedArrayType(e, index, partialAccessor)
+ or
result = getImmediateChildOfBuiltinIntegerLiteralType(e, index, partialAccessor)
or
result = getImmediateChildOfBuiltinIntegerType(e, index, partialAccessor)
diff --git a/swift/ql/lib/codeql/swift/generated/Raw.qll b/swift/ql/lib/codeql/swift/generated/Raw.qll
index 714579218bcb..c2c65234cd4b 100644
--- a/swift/ql/lib/codeql/swift/generated/Raw.qll
+++ b/swift/ql/lib/codeql/swift/generated/Raw.qll
@@ -6293,24 +6293,18 @@ module Raw {
/**
* INTERNAL: Do not use.
- * A builtin type representing N values stored contiguously.
*/
- class BuiltinFixedArrayType extends @builtin_fixed_array_type, BuiltinType {
- override string toString() { result = "BuiltinFixedArrayType" }
+ class BuiltinFloatType extends @builtin_float_type, BuiltinType {
+ override string toString() { result = "BuiltinFloatType" }
}
- private Element getImmediateChildOfBuiltinFixedArrayType(BuiltinFixedArrayType e, int index) {
- none()
- }
+ private Element getImmediateChildOfBuiltinFloatType(BuiltinFloatType e, int index) { none() }
/**
* INTERNAL: Do not use.
+ * A builtin generic type.
*/
- class BuiltinFloatType extends @builtin_float_type, BuiltinType {
- override string toString() { result = "BuiltinFloatType" }
- }
-
- private Element getImmediateChildOfBuiltinFloatType(BuiltinFloatType e, int index) { none() }
+ class BuiltinGenericType extends @builtin_generic_type, BuiltinType { }
/**
* INTERNAL: Do not use.
@@ -6537,6 +6531,18 @@ module Raw {
int getNumberOfArgTypes() { result = count(int i | bound_generic_type_arg_types(this, i, _)) }
}
+ /**
+ * INTERNAL: Do not use.
+ * A builtin type representing N values stored contiguously.
+ */
+ class BuiltinFixedArrayType extends @builtin_fixed_array_type, BuiltinGenericType {
+ override string toString() { result = "BuiltinFixedArrayType" }
+ }
+
+ private Element getImmediateChildOfBuiltinFixedArrayType(BuiltinFixedArrayType e, int index) {
+ none()
+ }
+
/**
* INTERNAL: Do not use.
*/
@@ -7224,8 +7230,6 @@ module Raw {
or
result = getImmediateChildOfBuiltinExecutorType(e, index)
or
- result = getImmediateChildOfBuiltinFixedArrayType(e, index)
- or
result = getImmediateChildOfBuiltinFloatType(e, index)
or
result = getImmediateChildOfBuiltinJobType(e, index)
@@ -7262,6 +7266,8 @@ module Raw {
or
result = getImmediateChildOfWeakStorageType(e, index)
or
+ result = getImmediateChildOfBuiltinFixedArrayType(e, index)
+ or
result = getImmediateChildOfBuiltinIntegerLiteralType(e, index)
or
result = getImmediateChildOfBuiltinIntegerType(e, index)
diff --git a/swift/ql/lib/codeql/swift/generated/Synth.qll b/swift/ql/lib/codeql/swift/generated/Synth.qll
index 27508df94e97..cd847f3e6afd 100644
--- a/swift/ql/lib/codeql/swift/generated/Synth.qll
+++ b/swift/ql/lib/codeql/swift/generated/Synth.qll
@@ -1392,12 +1392,17 @@ module Synth {
class TBoundGenericType =
TBoundGenericClassType or TBoundGenericEnumType or TBoundGenericStructType;
+ /**
+ * INTERNAL: Do not use.
+ */
+ class TBuiltinGenericType = TBuiltinFixedArrayType;
+
/**
* INTERNAL: Do not use.
*/
class TBuiltinType =
TAnyBuiltinIntegerType or TBuiltinBridgeObjectType or TBuiltinDefaultActorStorageType or
- TBuiltinExecutorType or TBuiltinFixedArrayType or TBuiltinFloatType or TBuiltinJobType or
+ TBuiltinExecutorType or TBuiltinFloatType or TBuiltinGenericType or TBuiltinJobType or
TBuiltinNativeObjectType or TBuiltinRawPointerType or TBuiltinRawUnsafeContinuationType or
TBuiltinUnsafeValueBufferType or TBuiltinVectorType;
@@ -4291,6 +4296,14 @@ module Synth {
result = convertBoundGenericStructTypeFromRaw(e)
}
+ /**
+ * INTERNAL: Do not use.
+ * Converts a raw DB element to a synthesized `TBuiltinGenericType`, if possible.
+ */
+ TBuiltinGenericType convertBuiltinGenericTypeFromRaw(Raw::Element e) {
+ result = convertBuiltinFixedArrayTypeFromRaw(e)
+ }
+
/**
* INTERNAL: Do not use.
* Converts a raw DB element to a synthesized `TBuiltinType`, if possible.
@@ -4304,10 +4317,10 @@ module Synth {
or
result = convertBuiltinExecutorTypeFromRaw(e)
or
- result = convertBuiltinFixedArrayTypeFromRaw(e)
- or
result = convertBuiltinFloatTypeFromRaw(e)
or
+ result = convertBuiltinGenericTypeFromRaw(e)
+ or
result = convertBuiltinJobTypeFromRaw(e)
or
result = convertBuiltinNativeObjectTypeFromRaw(e)
@@ -7037,6 +7050,14 @@ module Synth {
result = convertBoundGenericStructTypeToRaw(e)
}
+ /**
+ * INTERNAL: Do not use.
+ * Converts a synthesized `TBuiltinGenericType` to a raw DB element, if possible.
+ */
+ Raw::Element convertBuiltinGenericTypeToRaw(TBuiltinGenericType e) {
+ result = convertBuiltinFixedArrayTypeToRaw(e)
+ }
+
/**
* INTERNAL: Do not use.
* Converts a synthesized `TBuiltinType` to a raw DB element, if possible.
@@ -7050,10 +7071,10 @@ module Synth {
or
result = convertBuiltinExecutorTypeToRaw(e)
or
- result = convertBuiltinFixedArrayTypeToRaw(e)
- or
result = convertBuiltinFloatTypeToRaw(e)
or
+ result = convertBuiltinGenericTypeToRaw(e)
+ or
result = convertBuiltinJobTypeToRaw(e)
or
result = convertBuiltinNativeObjectTypeToRaw(e)
diff --git a/swift/ql/lib/codeql/swift/generated/type/BuiltinFixedArrayType.qll b/swift/ql/lib/codeql/swift/generated/type/BuiltinFixedArrayType.qll
index b61533168b77..5ed9491607af 100644
--- a/swift/ql/lib/codeql/swift/generated/type/BuiltinFixedArrayType.qll
+++ b/swift/ql/lib/codeql/swift/generated/type/BuiltinFixedArrayType.qll
@@ -6,7 +6,7 @@
private import codeql.swift.generated.Synth
private import codeql.swift.generated.Raw
-import codeql.swift.elements.type.internal.BuiltinTypeImpl::Impl as BuiltinTypeImpl
+import codeql.swift.elements.type.internal.BuiltinGenericTypeImpl::Impl as BuiltinGenericTypeImpl
/**
* INTERNAL: This module contains the fully generated definition of `BuiltinFixedArrayType` and should not
@@ -18,7 +18,9 @@ module Generated {
* INTERNAL: Do not reference the `Generated::BuiltinFixedArrayType` class directly.
* Use the subclass `BuiltinFixedArrayType`, where the following predicates are available.
*/
- class BuiltinFixedArrayType extends Synth::TBuiltinFixedArrayType, BuiltinTypeImpl::BuiltinType {
+ class BuiltinFixedArrayType extends Synth::TBuiltinFixedArrayType,
+ BuiltinGenericTypeImpl::BuiltinGenericType
+ {
override string getAPrimaryQlClass() { result = "BuiltinFixedArrayType" }
}
}
diff --git a/swift/ql/lib/codeql/swift/generated/type/BuiltinGenericType.qll b/swift/ql/lib/codeql/swift/generated/type/BuiltinGenericType.qll
new file mode 100644
index 000000000000..cfed16ac2832
--- /dev/null
+++ b/swift/ql/lib/codeql/swift/generated/type/BuiltinGenericType.qll
@@ -0,0 +1,22 @@
+// generated by codegen/codegen.py, do not edit
+/**
+ * This module provides the generated definition of `BuiltinGenericType`.
+ * INTERNAL: Do not import directly.
+ */
+
+private import codeql.swift.generated.Synth
+private import codeql.swift.generated.Raw
+import codeql.swift.elements.type.internal.BuiltinTypeImpl::Impl as BuiltinTypeImpl
+
+/**
+ * INTERNAL: This module contains the fully generated definition of `BuiltinGenericType` and should not
+ * be referenced directly.
+ */
+module Generated {
+ /**
+ * A builtin generic type.
+ * INTERNAL: Do not reference the `Generated::BuiltinGenericType` class directly.
+ * Use the subclass `BuiltinGenericType`, where the following predicates are available.
+ */
+ class BuiltinGenericType extends Synth::TBuiltinGenericType, BuiltinTypeImpl::BuiltinType { }
+}
diff --git a/swift/ql/lib/swift.dbscheme b/swift/ql/lib/swift.dbscheme
index 33e5e5e03bd3..ee3053b673c9 100644
--- a/swift/ql/lib/swift.dbscheme
+++ b/swift/ql/lib/swift.dbscheme
@@ -2266,8 +2266,8 @@ any_generic_type_parents( //dir=type
| @builtin_bridge_object_type
| @builtin_default_actor_storage_type
| @builtin_executor_type
-| @builtin_fixed_array_type
| @builtin_float_type
+| @builtin_generic_type
| @builtin_job_type
| @builtin_native_object_type
| @builtin_raw_pointer_type
@@ -2449,14 +2449,14 @@ builtin_executor_types( //dir=type
unique int id: @builtin_executor_type
);
-builtin_fixed_array_types( //dir=type
- unique int id: @builtin_fixed_array_type
-);
-
builtin_float_types( //dir=type
unique int id: @builtin_float_type
);
+@builtin_generic_type =
+ @builtin_fixed_array_type
+;
+
builtin_job_types( //dir=type
unique int id: @builtin_job_type
);
@@ -2558,6 +2558,10 @@ bound_generic_type_arg_types( //dir=type
int arg_type: @type_or_none ref
);
+builtin_fixed_array_types( //dir=type
+ unique int id: @builtin_fixed_array_type
+);
+
builtin_integer_literal_types( //dir=type
unique int id: @builtin_integer_literal_type
);
From 5eb8db0d4892df079fe3b09c841161d5a3b5b1ec Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Wed, 8 Apr 2026 13:21:33 +0200
Subject: [PATCH 064/146] Swift: Update expected QL test results after 6.3
update
---
.../extractor-tests/declarations/all.expected | 1 +
.../extractor-tests/errors/Errors.expected | 6 +-
.../decl/CapturedDecl/PrintAst.expected | 4 +-
.../ConcreteVarDecl/ConcreteVarDecl.expected | 14 ++---
.../decl/MacroDecl/MacroRole.expected | 2 +
.../decl/ParamDecl/ParamDecl.expected | 4 +-
.../ObjectLiteralExpr.expected | 6 +-
.../stmt/ForEachStmt/ForEachStmt.expected | 4 +-
.../type/BuiltinType/BuiltinType.expected | 61 +++++++++++++++++++
.../type/IntegerType/IntegerType.expected | 6 ++
.../test/library-tests/ast/PrintAst.expected | 12 ++--
.../controlflow/graph/Cfg.expected | 12 ++--
12 files changed, 101 insertions(+), 31 deletions(-)
diff --git a/swift/ql/test/extractor-tests/declarations/all.expected b/swift/ql/test/extractor-tests/declarations/all.expected
index 98b948953451..109e80ee4f60 100644
--- a/swift/ql/test/extractor-tests/declarations/all.expected
+++ b/swift/ql/test/extractor-tests/declarations/all.expected
@@ -116,6 +116,7 @@
| declarations.swift:77:16:77:23 | var ... = ... | |
| declarations.swift:77:20:77:20 | _x | |
| declarations.swift:77:20:77:20 | get | |
+| declarations.swift:77:20:77:20 | var ... = ... | |
| declarations.swift:77:20:77:20 | x | |
| declarations.swift:81:1:136:1 | HasPropertyAndObserver | |
| declarations.swift:81:8:81:8 | HasPropertyAndObserver.init(normalField:hasWillSet1:hasWillSet2:hasDidSet1:hasDidSet2:hasBoth:) | |
diff --git a/swift/ql/test/extractor-tests/errors/Errors.expected b/swift/ql/test/extractor-tests/errors/Errors.expected
index 50ab8ec658be..51900bf11d01 100644
--- a/swift/ql/test/extractor-tests/errors/Errors.expected
+++ b/swift/ql/test/extractor-tests/errors/Errors.expected
@@ -1,6 +1,6 @@
-| file://:0:0:0:0 | <> | ErrorType |
-| file://:0:0:0:0 | <> | ErrorType |
-| file://:0:0:0:0 | <> | ErrorType |
+| file://:0:0:0:0 | _ | ErrorType |
+| file://:0:0:0:0 | _ | ErrorType |
+| file://:0:0:0:0 | _ | ErrorType |
| overloaded.swift:6:5:6:5 | OverloadedDeclRefExpr | OverloadedDeclRefExpr |
| unresolved.swift:5:1:5:14 | UnresolvedSpecializeExpr | UnresolvedSpecializeExpr |
| unspecified.swift:3:1:3:23 | missing extended_type_decl from ExtensionDecl | UnspecifiedElement |
diff --git a/swift/ql/test/extractor-tests/generated/decl/CapturedDecl/PrintAst.expected b/swift/ql/test/extractor-tests/generated/decl/CapturedDecl/PrintAst.expected
index ac61ba1dfc60..689d93cab9b0 100644
--- a/swift/ql/test/extractor-tests/generated/decl/CapturedDecl/PrintAst.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/CapturedDecl/PrintAst.expected
@@ -164,8 +164,8 @@ closures.swift:
# 31| getArgument(0): [Argument] : ... .!=(_:_:) ...
# 31| getExpr(): [BinaryExpr] ... .!=(_:_:) ...
# 31| getFunction(): [MethodLookupExpr] .!=(_:_:)
-# 31| getBase(): [TypeExpr] Optional.Type
-# 31| getTypeRepr(): [TypeRepr] Optional
+# 31| getBase(): [TypeExpr] Int?.Type
+# 31| getTypeRepr(): [TypeRepr] Int?
# 31| getMethodRef(): [DeclRefExpr] !=(_:_:)
# 31| getArgument(0): [Argument] : x
# 31| getExpr(): [DeclRefExpr] x
diff --git a/swift/ql/test/extractor-tests/generated/decl/ConcreteVarDecl/ConcreteVarDecl.expected b/swift/ql/test/extractor-tests/generated/decl/ConcreteVarDecl/ConcreteVarDecl.expected
index 09751f3c41d4..03460f83620a 100644
--- a/swift/ql/test/extractor-tests/generated/decl/ConcreteVarDecl/ConcreteVarDecl.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/ConcreteVarDecl/ConcreteVarDecl.expected
@@ -118,11 +118,11 @@ getParentInitializer
| var_decls.swift:57:36:57:36 | _w4 | var_decls.swift:57:4:57:41 | call to WrapperWithProjectedAndInit.init(wrappedValue:) |
| var_decls.swift:57:36:57:36 | w4 | var_decls.swift:57:4:57:41 | call to WrapperWithProjectedAndInit.init(wrappedValue:) |
getPropertyWrapperBackingVarBinding
-| var_decls.swift:24:15:24:15 | wrapped | file://:0:0:0:0 | var ... = ... |
-| var_decls.swift:54:10:54:10 | w1 | file://:0:0:0:0 | var ... = ... |
-| var_decls.swift:55:24:55:24 | w2 | file://:0:0:0:0 | var ... = ... |
-| var_decls.swift:56:29:56:29 | w3 | file://:0:0:0:0 | var ... = ... |
-| var_decls.swift:57:36:57:36 | w4 | file://:0:0:0:0 | var ... = ... |
+| var_decls.swift:24:15:24:15 | wrapped | var_decls.swift:24:15:24:15 | var ... = ... |
+| var_decls.swift:54:10:54:10 | w1 | var_decls.swift:54:10:54:10 | var ... = ... |
+| var_decls.swift:55:24:55:24 | w2 | var_decls.swift:55:24:55:24 | var ... = ... |
+| var_decls.swift:56:29:56:29 | w3 | var_decls.swift:56:29:56:29 | var ... = ... |
+| var_decls.swift:57:36:57:36 | w4 | var_decls.swift:57:36:57:36 | var ... = ... |
getPropertyWrapperBackingVar
| var_decls.swift:24:15:24:15 | wrapped | var_decls.swift:24:15:24:15 | _wrapped |
| var_decls.swift:54:10:54:10 | w1 | var_decls.swift:54:10:54:10 | _w1 |
@@ -130,8 +130,8 @@ getPropertyWrapperBackingVar
| var_decls.swift:56:29:56:29 | w3 | var_decls.swift:56:29:56:29 | _w3 |
| var_decls.swift:57:36:57:36 | w4 | var_decls.swift:57:36:57:36 | _w4 |
getPropertyWrapperProjectionVarBinding
-| var_decls.swift:56:29:56:29 | w3 | file://:0:0:0:0 | var ... = ... |
-| var_decls.swift:57:36:57:36 | w4 | file://:0:0:0:0 | var ... = ... |
+| var_decls.swift:56:29:56:29 | w3 | var_decls.swift:56:29:56:29 | var ... = ... |
+| var_decls.swift:57:36:57:36 | w4 | var_decls.swift:57:36:57:36 | var ... = ... |
getPropertyWrapperProjectionVar
| var_decls.swift:56:29:56:29 | w3 | var_decls.swift:56:29:56:29 | $w3 |
| var_decls.swift:57:36:57:36 | w4 | var_decls.swift:57:36:57:36 | $w4 |
diff --git a/swift/ql/test/extractor-tests/generated/decl/MacroDecl/MacroRole.expected b/swift/ql/test/extractor-tests/generated/decl/MacroDecl/MacroRole.expected
index 05232a3cd041..52e80f2a2c69 100644
--- a/swift/ql/test/extractor-tests/generated/decl/MacroDecl/MacroRole.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/MacroDecl/MacroRole.expected
@@ -11,6 +11,7 @@ instances
| file://:0:0:0:0 | #freestanding(expression) | getKind: | 1 | getMacroSyntax: | 0 |
| file://:0:0:0:0 | #freestanding(expression) | getKind: | 1 | getMacroSyntax: | 0 |
| file://:0:0:0:0 | @attached(accessor) | getKind: | 4 | getMacroSyntax: | 1 |
+| file://:0:0:0:0 | @attached(extension) | getKind: | 256 | getMacroSyntax: | 1 |
| file://:0:0:0:0 | @attached(member) | getKind: | 16 | getMacroSyntax: | 1 |
| file://:0:0:0:0 | @attached(memberAttribute) | getKind: | 8 | getMacroSyntax: | 1 |
| file://:0:0:0:0 | @attached(peer) | getKind: | 32 | getMacroSyntax: | 1 |
@@ -22,6 +23,7 @@ instances
| test.swift:6:2:6:20 | @attached(extension) | getKind: | 256 | getMacroSyntax: | 1 |
getConformance
getName
+| file://:0:0:0:0 | @attached(extension) | 0 | _() |
| file://:0:0:0:0 | @attached(peer) | 0 | $() |
| file://:0:0:0:0 | @attached(peer) | 0 | _() |
| file://:0:0:0:0 | @attached(peer) | 0 | _lldb_summary() |
diff --git a/swift/ql/test/extractor-tests/generated/decl/ParamDecl/ParamDecl.expected b/swift/ql/test/extractor-tests/generated/decl/ParamDecl/ParamDecl.expected
index f67d25dc31b0..65191e3d55f1 100644
--- a/swift/ql/test/extractor-tests/generated/decl/ParamDecl/ParamDecl.expected
+++ b/swift/ql/test/extractor-tests/generated/decl/ParamDecl/ParamDecl.expected
@@ -66,8 +66,8 @@ getAttachedPropertyWrapperType
getParentPattern
getParentInitializer
getPropertyWrapperBackingVarBinding
-| param_decls.swift:48:18:48:22 | p1 | file://:0:0:0:0 | var ... = ... |
-| param_decls.swift:49:26:49:30 | p2 | file://:0:0:0:0 | var ... = ... |
+| param_decls.swift:48:18:48:22 | p1 | param_decls.swift:48:18:48:18 | var ... = ... |
+| param_decls.swift:49:26:49:30 | p2 | param_decls.swift:49:26:49:26 | var ... = ... |
getPropertyWrapperBackingVar
| param_decls.swift:48:18:48:22 | p1 | param_decls.swift:48:18:48:18 | _p1 |
| param_decls.swift:49:26:49:30 | p2 | param_decls.swift:49:26:49:26 | _p2 |
diff --git a/swift/ql/test/extractor-tests/generated/expr/ObjectLiteralExpr/ObjectLiteralExpr.expected b/swift/ql/test/extractor-tests/generated/expr/ObjectLiteralExpr/ObjectLiteralExpr.expected
index abf317e5a3b9..9f454d9cd696 100644
--- a/swift/ql/test/extractor-tests/generated/expr/ObjectLiteralExpr/ObjectLiteralExpr.expected
+++ b/swift/ql/test/extractor-tests/generated/expr/ObjectLiteralExpr/ObjectLiteralExpr.expected
@@ -3,9 +3,9 @@ instances
| object_literals.swift:6:5:6:61 | #colorLiteral(...) | getKind: | 2 |
| object_literals.swift:7:5:7:44 | #imageLiteral(...) | getKind: | 1 |
getType
-| object_literals.swift:5:5:5:42 | #fileLiteral(...) | <> |
-| object_literals.swift:6:5:6:61 | #colorLiteral(...) | <> |
-| object_literals.swift:7:5:7:44 | #imageLiteral(...) | <> |
+| object_literals.swift:5:5:5:42 | #fileLiteral(...) | _ |
+| object_literals.swift:6:5:6:61 | #colorLiteral(...) | _ |
+| object_literals.swift:7:5:7:44 | #imageLiteral(...) | _ |
getArgument
| object_literals.swift:5:5:5:42 | #fileLiteral(...) | 0 | object_literals.swift:5:18:5:32 | resourceName: file.txt |
| object_literals.swift:6:5:6:61 | #colorLiteral(...) | 0 | object_literals.swift:6:19:6:24 | red: 255 |
diff --git a/swift/ql/test/extractor-tests/generated/stmt/ForEachStmt/ForEachStmt.expected b/swift/ql/test/extractor-tests/generated/stmt/ForEachStmt/ForEachStmt.expected
index 55fc86a8fdbd..ff575435d015 100644
--- a/swift/ql/test/extractor-tests/generated/stmt/ForEachStmt/ForEachStmt.expected
+++ b/swift/ql/test/extractor-tests/generated/stmt/ForEachStmt/ForEachStmt.expected
@@ -12,8 +12,8 @@ getVariable
getWhere
| for.swift:4:5:6:5 | for ... in ... where ... { ... } | for.swift:4:25:4:30 | ... .!=(_:_:) ... |
getIteratorVar
-| for.swift:4:5:6:5 | for ... in ... where ... { ... } | file://:0:0:0:0 | var ... = ... |
-| for.swift:7:5:9:5 | for ... in ... { ... } | file://:0:0:0:0 | var ... = ... |
+| for.swift:4:5:6:5 | for ... in ... where ... { ... } | for.swift:4:14:4:14 | var ... = ... |
+| for.swift:7:5:9:5 | for ... in ... { ... } | for.swift:7:14:7:14 | var ... = ... |
getNextCall
| for.swift:4:5:6:5 | for ... in ... where ... { ... } | for.swift:4:5:4:5 | call to next() |
| for.swift:7:5:9:5 | for ... in ... { ... } | for.swift:7:5:7:5 | call to next() |
diff --git a/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected b/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
index 1b64e9f4a224..fe0d3372c495 100644
--- a/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
+++ b/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
@@ -3,8 +3,69 @@
| Builtin.FPIEEE32 | BuiltinFloatType | getName: | FPIEEE32 | getCanonicalType: | Builtin.FPIEEE32 |
| Builtin.FPIEEE64 | BuiltinFloatType | getName: | FPIEEE64 | getCanonicalType: | Builtin.FPIEEE64 |
| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
+| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
| Builtin.IntLiteral | BuiltinIntegerLiteralType | getName: | IntLiteral | getCanonicalType: | Builtin.IntLiteral |
| Builtin.Job | BuiltinJobType | getName: | Job | getCanonicalType: | Builtin.Job |
| Builtin.NativeObject | BuiltinNativeObjectType | getName: | NativeObject | getCanonicalType: | Builtin.NativeObject |
diff --git a/swift/ql/test/extractor-tests/generated/type/IntegerType/IntegerType.expected b/swift/ql/test/extractor-tests/generated/type/IntegerType/IntegerType.expected
index 7fba23db8bdc..7b2c1bada262 100644
--- a/swift/ql/test/extractor-tests/generated/type/IntegerType/IntegerType.expected
+++ b/swift/ql/test/extractor-tests/generated/type/IntegerType/IntegerType.expected
@@ -1,2 +1,8 @@
+| 16 | getName: | 16 | getCanonicalType: | 16 | getValue: | 16 |
+| 40 | getName: | 40 | getCanonicalType: | 40 | getValue: | 40 |
+| 58 | getName: | 58 | getCanonicalType: | 58 | getValue: | 58 |
+| 100 | getName: | 100 | getCanonicalType: | 100 | getValue: | 100 |
+| 112 | getName: | 112 | getCanonicalType: | 112 | getValue: | 112 |
| 128 | getName: | 128 | getCanonicalType: | 128 | getValue: | 128 |
| 256 | getName: | 256 | getCanonicalType: | 256 | getValue: | 256 |
+| 716 | getName: | 716 | getCanonicalType: | 716 | getValue: | 716 |
diff --git a/swift/ql/test/library-tests/ast/PrintAst.expected b/swift/ql/test/library-tests/ast/PrintAst.expected
index 8cd6a4a5aff7..9e47767c2376 100644
--- a/swift/ql/test/library-tests/ast/PrintAst.expected
+++ b/swift/ql/test/library-tests/ast/PrintAst.expected
@@ -705,7 +705,7 @@ cfg.swift:
# 138| getVariable(0): [ConcreteVarDecl] $generator
# 138| Type = IndexingIterator>
# 138| getPattern(): [AnyPattern] _
-#-----| getIteratorVar(): [PatternBindingDecl] var ... = ...
+# 138| getIteratorVar(): [PatternBindingDecl] var ... = ...
# 138| getInit(0): [CallExpr] call to makeIterator()
# 138| getFunction(): [MethodLookupExpr] .makeIterator()
# 138| getBase(): [BinaryExpr] ... ....(_:_:) ...
@@ -3263,7 +3263,7 @@ cfg.swift:
# 526| getVariable(1): [ConcreteVarDecl] $i$generator
# 526| Type = IndexingIterator>
# 526| getPattern(): [NamedPattern] i
-#-----| getIteratorVar(): [PatternBindingDecl] var ... = ...
+# 526| getIteratorVar(): [PatternBindingDecl] var ... = ...
# 526| getInit(0): [CallExpr] call to makeIterator()
# 526| getFunction(): [MethodLookupExpr] .makeIterator()
# 526| getBase(): [BinaryExpr] ... ....(_:_:) ...
@@ -3302,7 +3302,7 @@ cfg.swift:
# 533| getVariable(1): [ConcreteVarDecl] $i$generator
# 533| Type = AsyncStream.Iterator
# 533| getPattern(): [NamedPattern] i
-#-----| getIteratorVar(): [PatternBindingDecl] var ... = ...
+# 533| getIteratorVar(): [PatternBindingDecl] var ... = ...
# 533| getInit(0): [CallExpr] call to makeAsyncIterator()
# 533| getFunction(): [MethodLookupExpr] .makeAsyncIterator()
# 533| getBase(): [DeclRefExpr] stream
@@ -4141,7 +4141,7 @@ declarations.swift:
#-----| getResult(): [MemberRefExpr] .wrappedValue
#-----| getBase(): [DeclRefExpr] _x
#-----| getCapture(0): [CapturedDecl] _x
-#-----| getPropertyWrapperBackingVarBinding(): [PatternBindingDecl] var ... = ...
+# 77| getPropertyWrapperBackingVarBinding(): [PatternBindingDecl] var ... = ...
# 77| getInit(0): [CallExpr] call to ZeroWrapper.init()
# 77| getFunction(): [MethodLookupExpr] ZeroWrapper.init()
# 77| getBase(): [TypeExpr] ZeroWrapper.Type
@@ -7018,7 +7018,7 @@ statements.swift:
# 2| getVariable(1): [ConcreteVarDecl] $i$generator
# 2| Type = IndexingIterator>
# 2| getPattern(): [NamedPattern] i
-#-----| getIteratorVar(): [PatternBindingDecl] var ... = ...
+# 2| getIteratorVar(): [PatternBindingDecl] var ... = ...
# 2| getInit(0): [CallExpr] call to makeIterator()
# 2| getFunction(): [MethodLookupExpr] .makeIterator()
# 2| getBase(): [BinaryExpr] ... ....(_:_:) ...
@@ -7470,7 +7470,7 @@ statements.swift:
# 71| getExpr(): [IntegerLiteralExpr] 2
# 71| getArgument(1): [Argument] : 0
# 71| getExpr(): [IntegerLiteralExpr] 0
-#-----| getIteratorVar(): [PatternBindingDecl] var ... = ...
+# 71| getIteratorVar(): [PatternBindingDecl] var ... = ...
# 71| getInit(0): [CallExpr] call to makeIterator()
# 71| getFunction(): [MethodLookupExpr] .makeIterator()
# 71| getBase(): [DeclRefExpr] numbers
diff --git a/swift/ql/test/library-tests/controlflow/graph/Cfg.expected b/swift/ql/test/library-tests/controlflow/graph/Cfg.expected
index 8fc8c7808b1b..f128a0994b53 100644
--- a/swift/ql/test/library-tests/controlflow/graph/Cfg.expected
+++ b/swift/ql/test/library-tests/controlflow/graph/Cfg.expected
@@ -474,7 +474,8 @@
| cfg.swift:138:12:138:12 | 0 | cfg.swift:138:16:138:16 | 10 | |
| cfg.swift:138:12:138:12 | $generator | cfg.swift:138:12:138:12 | .makeIterator() | match |
| cfg.swift:138:12:138:12 | .makeIterator() | cfg.swift:138:13:138:13 | ....(_:_:) | |
-| cfg.swift:138:12:138:12 | call to makeIterator() | file://:0:0:0:0 | var ... = ... | |
+| cfg.swift:138:12:138:12 | call to makeIterator() | cfg.swift:138:12:138:12 | var ... = ... | |
+| cfg.swift:138:12:138:12 | var ... = ... | cfg.swift:138:3:138:3 | .next() | |
| cfg.swift:138:12:138:16 | ... ....(_:_:) ... | cfg.swift:138:12:138:12 | call to makeIterator() | |
| cfg.swift:138:13:138:13 | ....(_:_:) | cfg.swift:138:13:138:13 | Int.Type | |
| cfg.swift:138:13:138:13 | Int.Type | cfg.swift:138:12:138:12 | 0 | |
@@ -2023,7 +2024,8 @@
| cfg.swift:526:26:526:26 | 1 | cfg.swift:526:30:526:30 | 100 | |
| cfg.swift:526:26:526:26 | $i$generator | cfg.swift:526:26:526:26 | .makeIterator() | match |
| cfg.swift:526:26:526:26 | .makeIterator() | cfg.swift:526:27:526:27 | ....(_:_:) | |
-| cfg.swift:526:26:526:26 | call to makeIterator() | file://:0:0:0:0 | var ... = ... | |
+| cfg.swift:526:26:526:26 | call to makeIterator() | cfg.swift:526:26:526:26 | var ... = ... | |
+| cfg.swift:526:26:526:26 | var ... = ... | cfg.swift:526:17:526:17 | .next() | |
| cfg.swift:526:26:526:30 | ... ....(_:_:) ... | cfg.swift:526:26:526:26 | call to makeIterator() | |
| cfg.swift:526:27:526:27 | ....(_:_:) | cfg.swift:526:27:526:27 | Int.Type | |
| cfg.swift:526:27:526:27 | Int.Type | cfg.swift:526:26:526:26 | 1 | |
@@ -2048,8 +2050,9 @@
| cfg.swift:533:24:533:24 | $i$generator | cfg.swift:533:24:533:24 | .makeAsyncIterator() | match |
| cfg.swift:533:24:533:24 | (AsyncStream) ... | cfg.swift:533:24:533:24 | call to makeAsyncIterator() | |
| cfg.swift:533:24:533:24 | .makeAsyncIterator() | cfg.swift:533:24:533:24 | stream | |
-| cfg.swift:533:24:533:24 | call to makeAsyncIterator() | file://:0:0:0:0 | var ... = ... | |
+| cfg.swift:533:24:533:24 | call to makeAsyncIterator() | cfg.swift:533:24:533:24 | var ... = ... | |
| cfg.swift:533:24:533:24 | stream | cfg.swift:533:24:533:24 | (AsyncStream) ... | |
+| cfg.swift:533:24:533:24 | var ... = ... | cfg.swift:533:5:533:5 | .next(isolation:) | |
| cfg.swift:534:9:534:9 | print(_:separator:terminator:) | cfg.swift:534:15:534:15 | i | |
| cfg.swift:534:9:534:16 | call to print(_:separator:terminator:) | cfg.swift:533:5:533:5 | .next(isolation:) | |
| cfg.swift:534:14:534:14 | default separator | cfg.swift:534:14:534:14 | default terminator | |
@@ -2350,6 +2353,3 @@
| file://:0:0:0:0 | value | file://:0:0:0:0 | ... = ... | |
| file://:0:0:0:0 | value | file://:0:0:0:0 | ... = ... | |
| file://:0:0:0:0 | value | file://:0:0:0:0 | ... = ... | |
-| file://:0:0:0:0 | var ... = ... | cfg.swift:138:3:138:3 | .next() | |
-| file://:0:0:0:0 | var ... = ... | cfg.swift:526:17:526:17 | .next() | |
-| file://:0:0:0:0 | var ... = ... | cfg.swift:533:5:533:5 | .next(isolation:) | |
From 7b7411f7dfeea0db4bea9e1fa71c3a1fe5ab227f Mon Sep 17 00:00:00 2001
From: Kristen Newbury
Date: Wed, 8 Apr 2026 08:57:45 -0400
Subject: [PATCH 065/146] Change alert location CWE-829/ArtifactPoisoning
queries
---
.../CWE-829/ArtifactPoisoningCritical.ql | 2 +-
.../CWE-829/ArtifactPoisoningMedium.ql | 2 +-
.../2026-04-02-alert-msg-poisoning.md | 2 +-
.../ArtifactPoisoningCritical.expected | 36 +++++++++----------
4 files changed, 21 insertions(+), 21 deletions(-)
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
index 44b69cd46b2e..be49de830c33 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql
@@ -20,6 +20,6 @@ from ArtifactPoisoningFlow::PathNode source, ArtifactPoisoningFlow::PathNode sin
where
ArtifactPoisoningFlow::flowPath(source, sink) and
event = getRelevantEventInPrivilegedContext(sink.getNode())
-select sink.getNode(), source, sink,
+select source.getNode(), source, sink,
"Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@).",
event, event.getName()
diff --git a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
index cc5532172e82..49dc856e5665 100644
--- a/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
+++ b/actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
@@ -20,5 +20,5 @@ from ArtifactPoisoningFlow::PathNode source, ArtifactPoisoningFlow::PathNode sin
where
ArtifactPoisoningFlow::flowPath(source, sink) and
inNonPrivilegedContext(sink.getNode().asExpr())
-select sink.getNode(), source, sink,
+select source.getNode(), source, sink,
"Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user."
diff --git a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
index 30936d8b5c54..e2340f446a71 100644
--- a/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
+++ b/actions/ql/src/change-notes/2026-04-02-alert-msg-poisoning.md
@@ -1,4 +1,4 @@
---
category: majorAnalysis
---
-* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also clarify the wording to make it clear that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed.
\ No newline at end of file
+* Fixed alert messages in `actions/artifact-poisoning/critical` and `actions/artifact-poisoning/medium` as they previously included a redundant placeholder in the alert message that would on occasion contain a long block of yml that makes the alert difficult to understand. Also clarify the wording to make it clear that it is not the artifact that is being poisoned, but instead a potentially untrusted artifact that is consumed. Also change the alert location to be the source, to align more with other queries reporting an artifact (e.g. zipslip) which is more useful.
\ No newline at end of file
diff --git a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
index 75f08e0357e0..3c5f6bf93e98 100644
--- a/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
+++ b/actions/ql/test/query-tests/Security/CWE-829/ArtifactPoisoningCritical.expected
@@ -55,21 +55,21 @@ nodes
| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | semmle.label | ./gradlew buildScanPublishPrevious\n |
subpaths
#select
-| .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning11.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | .github/workflows/artifactpoisoning12.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning12.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning21.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | .github/workflows/artifactpoisoning22.yml:13:9:17:6 | Uses Step | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning22.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | .github/workflows/artifactpoisoning31.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning31.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning32.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning32.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | .github/workflows/artifactpoisoning33.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning33.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | .github/workflows/artifactpoisoning34.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning34.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | .github/workflows/artifactpoisoning41.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning41.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | .github/workflows/artifactpoisoning42.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning42.yml:4:3:4:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning71.yml:4:5:4:16 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning81.yml:3:5:3:23 | pull_request_target | pull_request_target |
-| .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | .github/workflows/artifactpoisoning96.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning96.yml:2:3:2:14 | workflow_run | workflow_run |
-| .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning101.yml:4:3:4:21 | pull_request_target | pull_request_target |
-| .github/workflows/test18.yml:36:15:40:58 | Uses Step | .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test18.yml:3:5:3:16 | workflow_run | workflow_run |
-| .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test25.yml:2:3:2:14 | workflow_run | workflow_run |
+| .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:28:9:29:6 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
+| .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/actions/download-artifact-2/action.yaml:6:7:25:4 | Uses Step | .github/workflows/artifactpoisoning92.yml:29:14:29:26 | make snapshot | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning92.yml:3:3:3:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning11.yml:38:11:38:77 | ./sonarcloud-data/x.py build -j$(nproc) --compiler gcc --skip-build | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning11.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning12.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning12.yml:13:9:32:6 | Uses Step | .github/workflows/artifactpoisoning12.yml:38:11:38:25 | python foo/x.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning12.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning21.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning21.yml:19:14:20:21 | sh foo/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning21.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning22.yml:13:9:17:6 | Uses Step | .github/workflows/artifactpoisoning22.yml:13:9:17:6 | Uses Step | .github/workflows/artifactpoisoning22.yml:18:14:18:19 | sh cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning22.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning31.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning31.yml:13:9:15:6 | Run Step | .github/workflows/artifactpoisoning31.yml:19:14:19:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning31.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning32.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning32.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning32.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning32.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning33.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning33.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning33.yml:17:14:18:20 | ./bar/cmd\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning33.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning34.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning34.yml:13:9:16:6 | Run Step | .github/workflows/artifactpoisoning34.yml:20:14:22:23 | npm install\nnpm run lint\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning34.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning41.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning41.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning41.yml:22:14:22:22 | ./foo/cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning41.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning42.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning42.yml:13:9:21:6 | Run Step | .github/workflows/artifactpoisoning42.yml:22:14:22:18 | ./cmd | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning42.yml:4:3:4:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:9:9:16:6 | Uses Step | .github/workflows/artifactpoisoning71.yml:17:14:18:40 | sed -f config foo.md > bar.md\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning71.yml:4:5:4:16 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:28:9:31:6 | Uses Step | .github/workflows/artifactpoisoning81.yml:31:14:31:27 | python test.py | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning81.yml:3:5:3:23 | pull_request_target | pull_request_target |
+| .github/workflows/artifactpoisoning96.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning96.yml:13:9:18:6 | Uses Step | .github/workflows/artifactpoisoning96.yml:18:14:18:24 | npm install | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning96.yml:2:3:2:14 | workflow_run | workflow_run |
+| .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:10:9:16:6 | Uses Step | .github/workflows/artifactpoisoning101.yml:17:14:19:59 | PR_NUMBER=$(./get_pull_request_number.sh pr_number.txt)\necho "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT \n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/artifactpoisoning101.yml:4:3:4:21 | pull_request_target | pull_request_target |
+| .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:12:15:33:12 | Uses Step | .github/workflows/test18.yml:36:15:40:58 | Uses Step | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test18.yml:3:5:3:16 | workflow_run | workflow_run |
+| .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:22:9:32:6 | Uses Step: downloadBuildScan | .github/workflows/test25.yml:39:14:40:45 | ./gradlew buildScanPublishPrevious\n | Potential artifact poisoning; the artifact being consumed has contents that may be controlled by an external user ($@). | .github/workflows/test25.yml:2:3:2:14 | workflow_run | workflow_run |
From f7de0abe602d2c4695b11604201e97637bf4673c Mon Sep 17 00:00:00 2001
From: Jeroen Ketema
Date: Wed, 8 Apr 2026 15:32:43 +0200
Subject: [PATCH 066/146] Swift: Fix `BuiltinFixedArrayType` mangling
---
swift/extractor/mangler/SwiftMangler.cpp | 11 +++-
swift/extractor/mangler/SwiftMangler.h | 1 +
.../type/BuiltinType/BuiltinType.expected | 61 -------------------
3 files changed, 9 insertions(+), 64 deletions(-)
diff --git a/swift/extractor/mangler/SwiftMangler.cpp b/swift/extractor/mangler/SwiftMangler.cpp
index 8d7d2a8a0658..76735bdc09f4 100644
--- a/swift/extractor/mangler/SwiftMangler.cpp
+++ b/swift/extractor/mangler/SwiftMangler.cpp
@@ -202,6 +202,14 @@ SwiftMangledName SwiftMangler::visitBuiltinType(const swift::BuiltinType* type)
return initMangled(type) << type->getTypeName(buffer, /* prependBuiltinNamespace= */ false);
}
+SwiftMangledName SwiftMangler::visitBuiltinFixedArrayType(
+ const swift::BuiltinFixedArrayType* type) {
+ auto ret = visitBuiltinType(type);
+ ret << fetch(type->getSize());
+ ret << fetch(type->getElementType());
+ return ret;
+}
+
SwiftMangledName SwiftMangler::visitAnyGenericType(const swift::AnyGenericType* type) {
auto ret = initMangled(type);
auto decl = type->getDecl();
@@ -240,9 +248,6 @@ SwiftMangledName SwiftMangler::visitAnyFunctionType(const swift::AnyFunctionType
if (flags.isNonEphemeral()) {
ret << "_nonephermeral";
}
- if (flags.isIsolated()) {
- ret << "_isolated";
- }
if (flags.isSending()) {
ret << "_sending";
}
diff --git a/swift/extractor/mangler/SwiftMangler.h b/swift/extractor/mangler/SwiftMangler.h
index caf70718633e..bb3691013886 100644
--- a/swift/extractor/mangler/SwiftMangler.h
+++ b/swift/extractor/mangler/SwiftMangler.h
@@ -71,6 +71,7 @@ class SwiftMangler : private swift::TypeVisitor,
SwiftMangledName visitModuleType(const swift::ModuleType* type);
SwiftMangledName visitTupleType(const swift::TupleType* type);
SwiftMangledName visitBuiltinType(const swift::BuiltinType* type);
+ SwiftMangledName visitBuiltinFixedArrayType(const swift::BuiltinFixedArrayType* type);
SwiftMangledName visitAnyGenericType(const swift::AnyGenericType* type);
// shouldn't be required, but they forgot to link `NominalType` to its direct superclass
diff --git a/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected b/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
index fe0d3372c495..1b64e9f4a224 100644
--- a/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
+++ b/swift/ql/test/extractor-tests/generated/type/BuiltinType/BuiltinType.expected
@@ -3,69 +3,8 @@
| Builtin.FPIEEE32 | BuiltinFloatType | getName: | FPIEEE32 | getCanonicalType: | Builtin.FPIEEE32 |
| Builtin.FPIEEE64 | BuiltinFloatType | getName: | FPIEEE64 | getCanonicalType: | Builtin.FPIEEE64 |
| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<4, Int> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<4, Int> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray<\u03c4_0_0, \u03c4_0_1> | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<4, Int> |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray |
-| Builtin.FixedArray | BuiltinFixedArrayType | getName: | FixedArray | getCanonicalType: | Builtin.FixedArray<\u03c4_0_0, \u03c4_0_1> |
-| Builtin.FixedArray