Release preparation for version 2.26.4

actions/ql/lib/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 0.6.0
+
+### Breaking Changes
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) were split out of `ActorIfCheck` into a new class `EventActorIfCheck`. The `ActorIfCheck` class now only covers `github.actor` and `github.triggering_actor`.
+
+### Minor Analysis Improvements
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an environment is no longer a sufficient sanitizer.
+
 ## 0.5.0
 
 ### Breaking Changes

actions/ql/lib/change-notes/released/0.6.0.md

@@ -0,0 +1,10 @@
+## 0.6.0
+
+### Breaking Changes
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) were split out of `ActorIfCheck` into a new class `EventActorIfCheck`. The `ActorIfCheck` class now only covers `github.actor` and `github.triggering_actor`.
+
+### Minor Analysis Improvements
+
+* Checks on actor fields read from the event payload (e.g. `github.event.pull_request.user.login`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.user.login != 'name'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+* Added an option to `EnvironmentCheck` to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to `actions/ql/lib/ext/config/deployment_environment.yml` the behavior of every query will be unchanged. When models are added queries using `ControlCheck` may find more results in cases where an environment is no longer a sufficient sanitizer.

actions/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.6.0

actions/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.5.1-dev
+version: 0.6.0
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/src/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.6.34
+
+### Minor Analysis Improvements
+
+* The `actions/unpinned-tag` query now detects mutable references to reusable workflows.
+
 ## 0.6.33
 
 ### Query Metadata Changes

actions/ql/src/change-notes/2026-08-05-unpinned-reusable-workflows.md → actions/ql/src/change-notes/released/0.6.34.md

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 0.6.34
+
+### Minor Analysis Improvements
+
 * The `actions/unpinned-tag` query now detects mutable references to reusable workflows.

actions/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.33
+lastReleaseVersion: 0.6.34

actions/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.34-dev
+version: 0.6.34
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

cpp/ql/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 12.0.3
+
+No user-facing changes.
+
 ## 12.0.2
 
 ### Minor Analysis Improvements

cpp/ql/lib/change-notes/released/12.0.3.md

@@ -0,0 +1,3 @@
+## 12.0.3
+
+No user-facing changes.

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 12.0.2
+lastReleaseVersion: 12.0.3

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 12.0.3-dev
+version: 12.0.3
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.8.2
+
+No user-facing changes.
+
 ## 1.8.1
 
 No user-facing changes.

cpp/ql/src/change-notes/released/1.8.2.md

@@ -0,0 +1,3 @@
+## 1.8.2
+
+No user-facing changes.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.8.1
+lastReleaseVersion: 1.8.2

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.8.2-dev
+version: 1.8.2
 groups:
   - cpp
   - queries

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.7.73
+
+No user-facing changes.
+
 ## 1.7.72
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.73.md

@@ -0,0 +1,3 @@
+## 1.7.73
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.72
+lastReleaseVersion: 1.7.73

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.73-dev
+version: 1.7.73
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.7.73
+
+No user-facing changes.
+
 ## 1.7.72
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.73.md

@@ -0,0 +1,3 @@
+## 1.7.73
+
+No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.72
+lastReleaseVersion: 1.7.73

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.73-dev
+version: 1.7.73
 groups:
   - csharp
   - solorigate

csharp/ql/lib/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 7.2.0
+
+### New Features
+
+* Added the `AdditionalTaintStep` extension point (`semmle.code.csharp.dataflow.FlowSteps`). Extend this class to add additional taint steps that apply to all taint-tracking configurations.
+
+### Major Analysis Improvements
+
+* Simplified and streamlined the use of NuGet sources when downloading dependencies. In fallback scenarios and specialized package downloads, NuGet sources are now passed directly to `dotnet restore` via the CLI. Furthermore, no `nuget.config` files are created for fallback scenarios, and private registries are used when attempting to download missing packages that were not restored as part of the normal `dotnet restore` process.
+
 ## 7.1.2
 
 No user-facing changes.

csharp/ql/lib/change-notes/2026-07-17-nuget-package-restore.md → csharp/ql/lib/change-notes/released/7.2.0.md

@@ -1,4 +1,9 @@
----
-category: majorAnalysis
----
+## 7.2.0
+
+### New Features
+
+* Added the `AdditionalTaintStep` extension point (`semmle.code.csharp.dataflow.FlowSteps`). Extend this class to add additional taint steps that apply to all taint-tracking configurations.
+
+### Major Analysis Improvements
+
 * Simplified and streamlined the use of NuGet sources when downloading dependencies. In fallback scenarios and specialized package downloads, NuGet sources are now passed directly to `dotnet restore` via the CLI. Furthermore, no `nuget.config` files are created for fallback scenarios, and private registries are used when attempting to download missing packages that were not restored as part of the normal `dotnet restore` process.

csharp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.1.2
+lastReleaseVersion: 7.2.0

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 7.1.3-dev
+version: 7.2.0
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/src/CHANGELOG.md

@@ -1,3 +1,16 @@
+## 1.9.2
+
+### Minor Analysis Improvements
+
+* The `cs/simplifiable-boolean-expression` query no longer suggests replacing a negated comparison when the replacement could recursively call an enclosing user-defined operator in `build-mode: none` databases.
+* The `cs/web/missing-token-validation` query now recognizes enabled ASP.NET Core `RequireAntiforgeryToken` attributes when antiforgery middleware is used.
+* The query `cs/virtual-call-in-constructor` has been improved. Uses of virtual members in `nameof` expressions are no longer reported, since they are not calls.
+* Static constructors are now used as the enclosing callable for static member initializer expressions. This improves the precision of a range of queries, including `cs/useless-assignment-to-local` and `cs/dereferenced-value-may-be-null`.
+
+### Bug Fixes
+
+* The query `cs/useless-cast-to-self` no longer reports casts when both the expression type and the cast target type are unknown, which can occur in `build-mode: none` databases.
+
 ## 1.9.1
 
 No user-facing changes.

csharp/ql/src/change-notes/released/1.9.2.md

@@ -0,0 +1,12 @@
+## 1.9.2
+
+### Minor Analysis Improvements
+
+* The `cs/simplifiable-boolean-expression` query no longer suggests replacing a negated comparison when the replacement could recursively call an enclosing user-defined operator in `build-mode: none` databases.
+* The `cs/web/missing-token-validation` query now recognizes enabled ASP.NET Core `RequireAntiforgeryToken` attributes when antiforgery middleware is used.
+* The query `cs/virtual-call-in-constructor` has been improved. Uses of virtual members in `nameof` expressions are no longer reported, since they are not calls.
+* Static constructors are now used as the enclosing callable for static member initializer expressions. This improves the precision of a range of queries, including `cs/useless-assignment-to-local` and `cs/dereferenced-value-may-be-null`.
+
+### Bug Fixes
+
+* The query `cs/useless-cast-to-self` no longer reports casts when both the expression type and the cast target type are unknown, which can occur in `build-mode: none` databases.

csharp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.9.1
+lastReleaseVersion: 1.9.2

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.9.2-dev
+version: 1.9.2
 groups:
   - csharp
   - queries

go/ql/consistency-queries/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.0.56
+
+No user-facing changes.
+
 ## 1.0.55
 
 No user-facing changes.

go/ql/consistency-queries/change-notes/released/1.0.56.md

@@ -0,0 +1,3 @@
+## 1.0.56
+
+No user-facing changes.

go/ql/consistency-queries/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.55
+lastReleaseVersion: 1.0.56

go/ql/consistency-queries/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.56-dev
+version: 1.0.56
 groups:
   - go
   - queries

go/ql/lib/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 7.3.0
+
+### Major Analysis Improvements
+
+* Go 1.27 is now supported.
+
 ## 7.2.3
 
 No user-facing changes.

go/ql/lib/change-notes/released/7.3.0.md

@@ -0,0 +1,5 @@
+## 7.3.0
+
+### Major Analysis Improvements
+
+* Go 1.27 is now supported.

go/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.2.3
+lastReleaseVersion: 7.3.0

go/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 7.2.4-dev
+version: 7.3.0
 groups: go
 dbscheme: go.dbscheme
 extractor: go

go/ql/src/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.6.9
+
+No user-facing changes.
+
 ## 1.6.8
 
 No user-facing changes.

go/ql/src/change-notes/released/1.6.9.md

@@ -0,0 +1,3 @@
+## 1.6.9
+
+No user-facing changes.

go/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.6.8
+lastReleaseVersion: 1.6.9

go/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.6.9-dev
+version: 1.6.9
 groups:
   - go
   - queries

java/ql/lib/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 9.2.4
+
+### Minor Analysis Improvements
+
+* Removed the summary model for `String.valueOf(CharSequence)`, which does not exist. Instead, taint is now propagated through calls to `String.valueOf(Object)` when the argument is a `CharSequence`, for example a `String` or a `StringBuilder`.
+* Added SQL injection sink models for Spring R2DBC `DatabaseClient` and the R2DBC SPI.
+
 ## 9.2.3
 
 No user-facing changes.

java/ql/lib/change-notes/2026-08-11-string-valueof-charsequence.md → java/ql/lib/change-notes/released/9.2.4.md

@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 9.2.4
+
+### Minor Analysis Improvements
+
 * Removed the summary model for `String.valueOf(CharSequence)`, which does not exist. Instead, taint is now propagated through calls to `String.valueOf(Object)` when the argument is a `CharSequence`, for example a `String` or a `StringBuilder`.
+* Added SQL injection sink models for Spring R2DBC `DatabaseClient` and the R2DBC SPI.

java/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 9.2.3
+lastReleaseVersion: 9.2.4

java/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 9.2.4-dev
+version: 9.2.4
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java