29 Pull requests merged by 12 people

• C++: Turn header variant tests that use PCH files into integration tests

  #19410 merged Apr 30, 2025

• Rust: Add type inference debug predicates

  #19425 merged Apr 30, 2025

• Ruby: disable diff-informed mode on regex queries

  #19416 merged Apr 30, 2025

• Rust: Crate graph extraction workarounds

  #19362 merged Apr 30, 2025

• JS: Better type-tracking through Promise.all()

  #19412 merged Apr 30, 2025

• C++: Do not limit second level scopes to the top-level

  #19269 merged Apr 30, 2025

• Codegen: make missing codeql error clearer

  #19418 merged Apr 30, 2025

• Python: Improve performance of FileNotClosed query by using an explicit fastTC

  #19411 merged Apr 30, 2025

• Revert "Bazel: update rules_kotlin to 2.1.3"

  #19414 merged Apr 29, 2025

• Rust: Extract SelfParams from crate graph

  #19369 merged Apr 29, 2025

• JS: Added support for fastify.addHook

  #19300 merged Apr 29, 2025

• Bazel: update rules_kotlin to 2.1.3

  #19385 merged Apr 29, 2025

• C#/Java/Rust: Change the tag for the model generator debugging queries.

  #19408 merged Apr 29, 2025

• Python: Tweak LoopVariableCapture for performance

  #19325 merged Apr 29, 2025

• C#: Add cs/equality-on-floats to the Code Quality suite.

  #19396 merged Apr 29, 2025

• Shared: Use isSink/1 in PropagateFlowConfig

  #19404 merged Apr 29, 2025

• Fix spelling/wording in qhelp for rb/uninitialized-local-variable

  #19400 merged Apr 29, 2025

• Add query suite inclusion tests for cpp, python

  #19390 merged Apr 29, 2025

• JS: Tolerate trailing commas in JSON objects

  #19393 merged Apr 29, 2025

• C++: Add use-after-free FP tests

  #19397 merged Apr 29, 2025

• Post-release preparation for codeql-cli-2.21.2

  #19401 merged Apr 28, 2025

• Java: Remove erroneously-committed query

  #19398 merged Apr 28, 2025

• JS: Improved modeling of aws-sdk

  #19364 merged Apr 28, 2025

• Release preparation for version 2.21.2

  #19395 merged Apr 28, 2025

• C++: Fix missing summaries in MaD generation

  #19383 merged Apr 28, 2025

• Follow-up fixes to #19376

  #19394 merged Apr 28, 2025

• Shared: Model generator cleanup.

  #19311 merged Apr 28, 2025

• Swift: Clarify how the LFS artifacts should be updated

  #19381 merged Apr 28, 2025

• C#: Fix CFG for fall-through switch statements

  #19380 merged Apr 28, 2025

23 Pull requests opened by 18 people

• JS: Overhaul import resolution

  #19391 opened Apr 28, 2025

• Add support for Kotlin 2.2.0; drop Kotlin 1.5.x

  #19402 opened Apr 28, 2025

• .qll Contribution for Sink Detection

  #19403 opened Apr 28, 2025

• python: make content sets an IPA type

  #19407 opened Apr 29, 2025

• Shared: Generate more value-preserving summaries

  #19409 opened Apr 29, 2025

• Add code quality suite selector and use that in the code quality suites

  #19413 opened Apr 29, 2025

• Bump chrono from 0.4.40 to 0.4.41 in /ql

  #19415 opened Apr 30, 2025

• Rust: Use type inference to insert implicit borrows and derefs

  #19419 opened Apr 30, 2025

• Swift: Support new Swift 6.1 AST elements

  #19420 opened Apr 30, 2025

• Rust: extract declarations of builtin types

  #19421 opened Apr 30, 2025

• JS: Modeling of `ShellJS` functions

  #19422 opened Apr 30, 2025

• Rust: Rework visibility logic in path resolution and also apply to method call resolution

  #19423 opened Apr 30, 2025

• Python: Extract hidden files/dirs by default

  #19424 opened Apr 30, 2025

• Update .gitattributes

  #19426 opened Apr 30, 2025

• Adding comprehensive docs for customizing `actions/unpinned-tag` query

  #19427 opened Apr 30, 2025

• QL tests: run with --check-diff-informed

  #19428 opened Apr 30, 2025

• Fix cwe tags to include leading zero

  #19429 opened Apr 30, 2025

• Rust: Remove visibility check in path resolution

  #19431 opened Apr 30, 2025

• python: model `send_header` from `http.server`

  #19432 opened Apr 30, 2025

• Shared: Generate more value-preserving flow summaries

  #19433 opened Apr 30, 2025

• C++: Limit flow through sinks and sources in `cpp/upcast-array-pointer-arithmetic`

  #19434 opened Apr 30, 2025

• Actions: Retroactively add GA changenote

  #19436 opened Apr 30, 2025

• Docs: Fix escaping in 2.21.0 changelog

  #19437 opened Apr 30, 2025

1 Issue closed by 1 person

• Missing C/C++ DataFlow/TaintTracking edges for fields accessed through pointers

  #19405 closed Apr 29, 2025

3 Issues opened by 3 people

• Windows: AccessDeniedException during `codeql database create` TRAP finalization (`pools/0` move fails)

  #19438 opened May 1, 2025

• False positive - 'Vulnerable package' is not the package version resolved

  #19435 opened Apr 30, 2025

• False positive in C/C++ dead code detection

  #19399 opened Apr 28, 2025

16 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Rust: expand attribute macros

  #19334 commented on Apr 30, 2025 • 15 new comments

• Rust: Make `SummarizedCallable` extend `Function` instead of `string`

  #19268 commented on Apr 30, 2025 • 7 new comments

• Rust: Support non-universal `impl` blocks

  #19372 commented on Apr 29, 2025 • 6 new comments

• C#: Improve precision of `cs/uncontrolled-format-string`.

  #19271 commented on Apr 30, 2025 • 4 new comments

• [JAVA] [GRADLE] OOM Issue with GitHub Autobuilder for Kotlin

  #19374 commented on Apr 28, 2025 • 0 new comments

• How to write a cross-function isAdditionalFlowStep while preserving context sensitive dataflow.

  #19308 commented on Apr 28, 2025 • 0 new comments

• Java: Detecting flow through throw - catch statements

  #19336 commented on Apr 28, 2025 • 0 new comments

• False positives in cpp/user-after-free

  #19387 commented on Apr 28, 2025 • 0 new comments

• Swift: Xcode 16.2 - could not build module

  #19284 commented on Apr 29, 2025 • 0 new comments

• Ruby: Avoid a forced CP.

  #18927 commented on Apr 29, 2025 • 0 new comments

• C++: Update expected test results and compiler version documentation after frontend update

  #18931 commented on Apr 30, 2025 • 0 new comments

• JS: Add class harness to recover localFieldStep edges

  #19287 commented on Apr 28, 2025 • 0 new comments

• JS: Merge `ES6Class` to `FunctionStyleClass`

  #19356 commented on Apr 30, 2025 • 0 new comments

• actions: Add some missing permissions

  #19357 commented on Apr 29, 2025 • 0 new comments

• Rust: Type inference for `?` expressions

  #19367 commented on Apr 30, 2025 • 0 new comments

• Shared: Re-factor summary, source and sink model generators into separate modules.

  #19382 commented on Apr 30, 2025 • 0 new comments