Merge main into rust/remove-argfile

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 68782cf6-b72d-4197-95b1-5c6003baf543

# Conflicts:
#	rust/extractor/src/main.rs

Author: paldepind

.bazelversion

@@ -1 +1 @@
-9.0.0
+9.3.1

MODULE.bazel

@@ -14,28 +14,28 @@ local_path_override(
 
 # see https://registry.bazel.build/ for a list of available packages
 
-bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "rules_cc", version = "0.2.20")
-bazel_dep(name = "rules_go", version = "0.60.0")
+bazel_dep(name = "platforms", version = "1.1.0")
+bazel_dep(name = "rules_cc", version = "0.2.27")
+bazel_dep(name = "rules_go", version = "0.65.0")
 bazel_dep(name = "rules_java", version = "9.6.1")
 bazel_dep(name = "rules_pkg", version = "1.2.0")
-bazel_dep(name = "rules_nodejs", version = "6.7.5")
-bazel_dep(name = "rules_python", version = "1.9.0")
-bazel_dep(name = "rules_shell", version = "0.7.1")
+bazel_dep(name = "rules_nodejs", version = "6.7.7")
+bazel_dep(name = "rules_python", version = "2.4.5")
+bazel_dep(name = "rules_shell", version = "0.8.0")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "abseil-cpp", version = "20260107.1", repo_name = "absl")
-bazel_dep(name = "nlohmann_json", version = "3.12.0.bcr.1", repo_name = "json")
+bazel_dep(name = "nlohmann_json", version = "3.12.0.bcr.2", repo_name = "json")
 bazel_dep(name = "fmt", version = "12.1.0-codeql.1")
 bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")
-bazel_dep(name = "gazelle", version = "0.50.0")
+bazel_dep(name = "gazelle", version = "0.54.0")
 bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")
-bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
+bazel_dep(name = "googletest", version = "1.18.0.bcr.1")
 bazel_dep(name = "rules_rust", version = "0.74.0")
-bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.2")
+bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.3")
 bazel_dep(name = "swift-syntax", version = "603.0.2")
 bazel_dep(name = "zstd", version = "1.5.7.bcr.1")
 
-bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
+bazel_dep(name = "buildifier_prebuilt", version = "10.1.0", dev_dependency = True)
 
 # Keep edition and version approximately in sync with internal repo.
 # the versions there are canonical, the versions here are used for CI in github/codeql, as well as for the vendoring of dependencies.

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll

@@ -217,6 +217,16 @@ private module IteratorIndirections {
       )
     }
 
+    // A by-value crement result loads the iterator, rather than aliasing its address.
+    override predicate isAdditionalDereference(Instruction deref, Operand address) {
+      exists(CallInstruction call |
+        deref = call and
+        call.getStaticCallTarget() instanceof Iterator::IteratorCrementMemberOperator and
+        not call.getResultType() instanceof Cpp::ReferenceType and
+        address = call.getThisArgumentOperand()
+      )
+    }
+
     override predicate isAdditionalConversionFlow(Operand opFrom, Instruction instrTo) {
       // This is a bit annoying: Consider the following snippet:
       // ```
@@ -255,11 +265,11 @@ private module IteratorIndirections {
         store.getDestinationAddress() = var
       )
       or
-      // A call to `operator++` or `operator--` is the iterator equivalent version of a
-      // pointer arithmetic instruction.
+      // A reference-returning `operator++` or `operator--` preserves the iterator's address.
       exists(CallInstruction call |
         instrTo = call and
         call.getStaticCallTarget() instanceof Iterator::IteratorCrementMemberOperator and
+        call.getResultType() instanceof Cpp::ReferenceType and
         opFrom = call.getThisArgumentOperand()
       )
     }

cpp/ql/src/Best Practices/Unused Entities/UnusedLocals.ql

@@ -57,5 +57,6 @@ where
   not declarationHasSideEffects(v) and
   not exists(AsmStmt s | f = s.getEnclosingFunction()) and
   not v.getAnAttribute().getName() = "unused" and
+  not v.getAnAttribute().getName() = "maybe_unused" and
   not f.hasErrors() // Unextracted expressions may use `v`
 select v, "Variable " + v.getName() + " is not used."

cpp/ql/src/Best Practices/Unused Entities/UnusedStaticVariables.ql

@@ -26,5 +26,6 @@ where
   not v instanceof MemberVariable and
   not declarationHasSideEffects(v) and
   not v.getAnAttribute().hasName("used") and
-  not v.getAnAttribute().hasName("unused")
+  not v.getAnAttribute().hasName("unused") and
+  not v.getAnAttribute().hasName("maybe_unused")
 select v, "Static variable " + v.getName() + " is never read."

cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.ql

@@ -22,11 +22,12 @@ where
   destBase = baseType(destType) and
   destBase.getSize() != sourceBase.getSize() and
   not dest.isInMacroExpansion() and
-  // If the source type is a `char*` or `void*` then don't
+  // If the source type is a `char*`, `void*` or `std::byte*` then don't
   // produce a result, because it is likely to be a false
   // positive.
   not sourceBase instanceof CharType and
   not sourceBase instanceof VoidType and
+  not sourceBase.(Enum).hasQualifiedName("std", "byte") and
   // Low-level pointer tricks often involve casting a struct pointer to a
   // char pointer, then accessing it at byte offsets. For example, this can
   // be necessary in order to resume an interrupted `write(2)`.

cpp/ql/src/change-notes/2026-10-29-suspicious-pointer-scaling-byte.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `cpp/suspicious-pointer-scaling` query no longer reports false positives for intentional pointer arithmetic from `std::byte*` buffers.

cpp/ql/src/change-notes/2026-10-29-unused-maybe-unused.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+The `cpp/unused-local-variable` and `cpp/unused-static-variable` queries no longer report variables marked with the C++17 `[[maybe_unused]]` attribute.

cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedLocals/code2.cpp

@@ -176,3 +176,8 @@ void test_switch_initializer()
 		// ...
 	}
 }
+
+void test_maybe_unused()
+{
+	[[maybe_unused]] int unused; // GOOD: explicitly marked as maybe_unused
+}

cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticVariables/test.cpp

@@ -1,4 +1,4 @@
-
+// semmle-extractor-options: -std=c++17
 int globalVar; // GOOD (not static)
 static int staticVar1; // GOOD (used)
 static int staticVar2; // GOOD (used)
@@ -10,6 +10,7 @@ static __attribute__((__unused__)) int staticVar7; // GOOD (unused but this is e
 const int constVar8 = 8; // $ Alert // BAD (const defaults to static)
 extern const int constVar9 = 9; // GOOD
 static int staticVar10 = 10; // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE] (referenced in a never instantiated template)
+[[maybe_unused]] static int staticVar11; // GOOD (explicitly marked as maybe_unused)
 
 void f()
 {