Skip to content

Commit 6265e55

Browse files
author
github-actions[bot]
committed
update codeql documentation
1 parent 1be292a commit 6265e55

2 files changed

Lines changed: 154 additions & 0 deletions

File tree

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.27.4.rst‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
.. _codeql-cli-2.27.4:
2+
3+
==========================
4+
CodeQL 2.27.4 (2026-11-02)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.27.4 runs a total of 498 security queries when configured with the Default suite (covering 169 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).
18+
19+
CodeQL CLI
20+
----------
21+
22+
Bug Fixes
23+
~~~~~~~~~
24+
25+
* The CodeQL CLI now writes messages from the Java virtual machine, such as warnings and initialization errors, to standard error instead of standard output. Previously, these messages could corrupt the output of commands that print JSON or other machine-readable output.
26+
27+
Security Updates
28+
~~~~~~~~~~~~~~~~
29+
30+
* :code:`codeql pack bundle` and :code:`codeql pack publish` now check that each file added to the pack archive is still inside the pack root after symbolic links are resolved. Files that resolve to a location outside the pack root are omitted from the archive with a warning.
31+
32+
Query Packs
33+
-----------
34+
35+
Minor Analysis Improvements
36+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
37+
38+
C/C++
39+
"""""
40+
41+
* The :code:`cpp/suspicious-pointer-scaling` query no longer reports false positives for intentional pointer arithmetic from :code:`std::byte*` buffers.
42+
* The :code:`cpp/unused-local-variable` and :code:`cpp/unused-static-variable` queries no longer report variables marked with the C++17 :code:`[[maybe_unused]]` attribute.
43+
44+
JavaScript/TypeScript
45+
"""""""""""""""""""""
46+
47+
* The :code:`js/invalid-prototype-value` query no longer reports computed :code:`__proto__` properties in object literals.
48+
49+
Query Metadata Changes
50+
~~~~~~~~~~~~~~~~~~~~~~
51+
52+
C/C++
53+
"""""
54+
55+
* Added a new :code:`cpp-code-quality` query suite containing queries that identify maintainability and reliability issues in C and C++ code.
56+
57+
C#
58+
""
59+
60+
* The :code:`external/cwe/cwe-730` tag has been removed from :code:`cs/redos` and :code:`cs/regex-injection`, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.
61+
62+
Java/Kotlin
63+
"""""""""""
64+
65+
* The :code:`external/cwe/cwe-730` tag has been removed from :code:`java/redos`, :code:`java/polynomial-redos` and :code:`java/regex-injection`, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.
66+
67+
JavaScript/TypeScript
68+
"""""""""""""""""""""
69+
70+
* The :code:`external/cwe/cwe-730` tag has been removed from :code:`js/redos`, :code:`js/polynomial-redos`, :code:`js/regex-injection`, :code:`js/regex-injection-more-sources`, :code:`js/server-crash` and :code:`js/loop-bound-injection`, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.
71+
72+
Python
73+
""""""
74+
75+
* The :code:`external/cwe/cwe-730` tag has been removed from :code:`py/redos`, :code:`py/polynomial-redos` and :code:`py/regex-injection`, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.
76+
77+
Ruby
78+
""""
79+
80+
* The :code:`external/cwe/cwe-730` tag has been removed from :code:`rb/redos`, :code:`rb/polynomial-redos` and :code:`rb/regexp-injection`, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.
81+
82+
Swift
83+
"""""
84+
85+
* The :code:`external/cwe/cwe-730` tag has been removed from :code:`swift/redos` and :code:`swift/regex-injection`, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.
86+
87+
Language Libraries
88+
------------------
89+
90+
Bug Fixes
91+
~~~~~~~~~
92+
93+
Golang
94+
""""""
95+
96+
* The Go extractor no longer modifies the global Git configuration when private :code:`git_source` registries are configured. The registry proxy certificate is now passed to Git through the :code:`GIT_SSL_CAINFO` environment variable instead, which only affects the Git processes spawned by :code:`go`.
97+
98+
Breaking Changes
99+
~~~~~~~~~~~~~~~~
100+
101+
JavaScript/TypeScript
102+
"""""""""""""""""""""
103+
104+
* The :code:`SEMMLE_TYPESCRIPT_HOME` environment variable is no longer supported. The JavaScript/TypeScript extractor now ignores the environment variable and always uses its bundled TypeScript compiler.
105+
106+
Minor Analysis Improvements
107+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
108+
109+
C#
110+
""
111+
112+
* Rolled back the change that set proxy and certificate environment variables for the subprocess that invokes the NuGet CLI because the environment variables were only partially respected by the target process in some cases.
113+
114+
Java/Kotlin
115+
"""""""""""
116+
117+
* The :code:`java/log-injection` query now recognizes additional sanitizers and sanitizer guards from the JDK, Apache Commons Lang and Text, Guava, OWASP Java Encoder, and Spring Framework.
118+
* Queries that use path-injection sanitizers now recognize additional substring guards and string replacement and removal operations from Apache Commons Lang and Guava.
119+
120+
JavaScript/TypeScript
121+
"""""""""""""""""""""
122+
123+
* Added taint steps for :code:`String.prototype.trimStart`, :code:`trimEnd`, and :code:`normalize`.
124+
* Fixed the flow summary for :code:`Array.prototype.flatMap`. The :code:`thisArg` argument now flows to the callback's :code:`this` instead of its index parameter.
125+
126+
Rust
127+
""""
128+
129+
* The early return taken by the :code:`?` operator no longer makes the unwrapped value of :code:`x?` flow out of the enclosing function. This fixes false positive results from queries such as :code:`rust/cleartext-logging`, where a sensitive value read with :code:`?` was reported as part of an unrelated return value.
130+
* Added neutral models to inhibit spurious generated sink models for :code:`actix_web::HttpRequest::connection_info` and the methods built on it, such as :code:`full_url` and :code:`url_for`. This fixes some false positive results from queries such as :code:`rust/uncontrolled-allocation-size` and :code:`rust/log-injection`.
131+
* Added neutral models to inhibit spurious generated sink models for :code:`Vec` and :code:`VecDeque` methods such as :code:`insert`, :code:`remove` and :code:`push_back`. This fixes some false positive results from queries such as :code:`rust/cleartext-logging`.
132+
133+
Deprecated APIs
134+
~~~~~~~~~~~~~~~
135+
136+
Golang
137+
""""""
138+
139+
* :code:`ControlFlow::ConditionGuardNode` is now deprecated. Use the API from :code:`semmle.go.controlflow.Guards` instead.
140+
141+
New Features
142+
~~~~~~~~~~~~
143+
144+
C/C++
145+
"""""
146+
147+
* Added support for the :code:`__builtin_lt_synthesizes_from_spaceship`, :code:`__builtin_gt_synthesizes_from_spaceship`, :code:`__builtin_le_synthesizes_from_spaceship`, :code:`__builtin_ge_synthesizes_from_spaceship`, :code:`__builtin_is_implicit_lifetime`, :code:`__builtin_is_structural`, and :code:`__builtin_is_virtual_base_of` builtin operations.
148+
* Added a new predicate :code:`getBitWidth` to the :code:`Type` class, which yields the bit-width of the type.
149+
150+
Golang
151+
""""""
152+
153+
* The Go language library now instantiates the shared library :code:`semmle.go.controlflow.Guards`, including the :code:`Guard` and :code:`GuardValue` classes and the :code:`guardEnsures`, :code:`guardEnsuresEq`, :code:`guardEnsuresNeq`, and :code:`guardEnsuresLeq` predicates.

‎docs/codeql/codeql-overview/codeql-changelog/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
1111
.. toctree::
1212
:maxdepth: 1
1313

14+
codeql-cli-2.27.4
1415
codeql-cli-2.27.3
1516
codeql-cli-2.27.2
1617
codeql-cli-2.27.1

0 commit comments

Comments
 (0)