diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md index 42a379734a17..cc4e0d9c1e2f 100644 --- a/cpp/ql/lib/CHANGELOG.md +++ b/cpp/ql/lib/CHANGELOG.md @@ -1,3 +1,46 @@ +## 0.6.0 + +### Breaking Changes + +* The `semmle.code.cpp.commons.Buffer` and `semmle.code.cpp.commons.NullTermination` libraries no longer expose `semmle.code.cpp.dataflow.DataFlow`. Please import `semmle.code.cpp.dataflow.DataFlow` directly. + +### Deprecated APIs + +* The `WriteConfig` taint tracking configuration has been deprecated. Please use `WriteFlow`. + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* A new C/C++ dataflow library (`semmle.code.cpp.dataflow.new.DataFlow`) has been added. + The new library behaves much more like the dataflow library of other CodeQL supported + languages by following use-use dataflow paths instead of def-use dataflow paths. + The new library also better supports dataflow through indirections, and new predicates + such as `Node::asIndirectExpr` have been added to facilitate working with indirections. + + The `semmle.code.cpp.ir.dataflow.DataFlow` library is now identical to the new + `semmle.code.cpp.dataflow.new.DataFlow` library. +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `hasGeneratedCopyConstructor` and `hasGeneratedCopyAssignmentOperator` predicates from the `Folder` class. +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. +* Deleted the deprecated `getMustlockFunction`, `getTrylockFunction`, `getLockFunction`, and `getUnlockFunction` predicates from the `MutexType` class. +* Deleted the deprecated `getPosInBasicBlock` predicate from the `SubBasicBlock` class. +* Deleted the deprecated `getExpr` predicate from the `PointerDereferenceExpr` class. +* Deleted the deprecated `getUseInstruction` and `getDefinitionInstruction` predicates from the `Operand` class. +* Deleted the deprecated `isInParameter`, `isInParameterPointer`, and `isInQualifier` predicates from the `FunctionInput` class. +* Deleted the deprecated `isOutParameterPointer`, `isOutQualifier`, `isOutReturnValue`, and `isOutReturnPointer` predicate from the `FunctionOutput` class. +* Deleted the deprecated 3-argument `isGuardPhi` predicate from the `RangeSsaDefinition` class. + ## 0.5.4 No user-facing changes. diff --git a/cpp/ql/lib/change-notes/2023-02-10-buffer-and-nill-termination-dataflow.md b/cpp/ql/lib/change-notes/2023-02-10-buffer-and-nill-termination-dataflow.md deleted file mode 100644 index adc00f952f95..000000000000 --- a/cpp/ql/lib/change-notes/2023-02-10-buffer-and-nill-termination-dataflow.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: breaking ---- -* The `semmle.code.cpp.commons.Buffer` and `semmle.code.cpp.commons.NullTermination` libraries no longer expose `semmle.code.cpp.dataflow.DataFlow`. Please import `semmle.code.cpp.dataflow.DataFlow` directly. diff --git a/cpp/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md b/cpp/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md deleted file mode 100644 index 89190af399f7..000000000000 --- a/cpp/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -category: majorAnalysis ---- -* The main data flow and taint tracking APIs have been changed. The old APIs - remain in place for now and translate to the new through a - backwards-compatible wrapper. If multiple configurations are in scope - simultaneously, then this may affect results slightly. The new API is quite - similar to the old, but makes use of a configuration module instead of a - configuration class. diff --git a/cpp/ql/lib/change-notes/2023-03-03-delete-deps.md b/cpp/ql/lib/change-notes/2023-03-03-delete-deps.md deleted file mode 100644 index 03efda079267..000000000000 --- a/cpp/ql/lib/change-notes/2023-03-03-delete-deps.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -category: minorAnalysis ---- -* Deleted the deprecated `hasGeneratedCopyConstructor` and `hasGeneratedCopyAssignmentOperator` predicates from the `Folder` class. -* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. -* Deleted the deprecated `getMustlockFunction`, `getTrylockFunction`, `getLockFunction`, and `getUnlockFunction` predicates from the `MutexType` class. -* Deleted the deprecated `getPosInBasicBlock` predicate from the `SubBasicBlock` class. -* Deleted the deprecated `getExpr` predicate from the `PointerDereferenceExpr` class. -* Deleted the deprecated `getUseInstruction` and `getDefinitionInstruction` predicates from the `Operand` class. -* Deleted the deprecated `isInParameter`, `isInParameterPointer`, and `isInQualifier` predicates from the `FunctionInput` class. -* Deleted the deprecated `isOutParameterPointer`, `isOutQualifier`, `isOutReturnValue`, and `isOutReturnPointer` predicate from the `FunctionOutput` class. -* Deleted the deprecated 3-argument `isGuardPhi` predicate from the `RangeSsaDefinition` class. diff --git a/cpp/ql/lib/change-notes/2023-03-08-deprecated-dataflow-configurations.md b/cpp/ql/lib/change-notes/2023-03-08-deprecated-dataflow-configurations.md deleted file mode 100644 index 124dc73213aa..000000000000 --- a/cpp/ql/lib/change-notes/2023-03-08-deprecated-dataflow-configurations.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: deprecated ---- -* The `WriteConfig` taint tracking configuration has been deprecated. Please use `WriteFlow`. diff --git a/cpp/ql/lib/change-notes/2023-03-13-mergepathgraph.md b/cpp/ql/lib/change-notes/2023-03-13-mergepathgraph.md deleted file mode 100644 index 63bfade2f10a..000000000000 --- a/cpp/ql/lib/change-notes/2023-03-13-mergepathgraph.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: feature ---- -* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. diff --git a/cpp/ql/lib/change-notes/2023-03-16-use-use-flow.md b/cpp/ql/lib/change-notes/2023-03-16-use-use-flow.md deleted file mode 100644 index a643fd50b7d1..000000000000 --- a/cpp/ql/lib/change-notes/2023-03-16-use-use-flow.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -category: majorAnalysis ---- -* A new C/C++ dataflow library (`semmle.code.cpp.dataflow.new.DataFlow`) has been added. - The new library behaves much more like the dataflow library of other CodeQL supported - languages by following use-use dataflow paths instead of def-use dataflow paths. - The new library also better supports dataflow through indirections, and new predicates - such as `Node::asIndirectExpr` have been added to facilitate working with indirections. - - The `semmle.code.cpp.ir.dataflow.DataFlow` library is now identical to the new - `semmle.code.cpp.dataflow.new.DataFlow` library. diff --git a/cpp/ql/lib/change-notes/released/0.6.0.md b/cpp/ql/lib/change-notes/released/0.6.0.md new file mode 100644 index 000000000000..2ae831d8f9a9 --- /dev/null +++ b/cpp/ql/lib/change-notes/released/0.6.0.md @@ -0,0 +1,42 @@ +## 0.6.0 + +### Breaking Changes + +* The `semmle.code.cpp.commons.Buffer` and `semmle.code.cpp.commons.NullTermination` libraries no longer expose `semmle.code.cpp.dataflow.DataFlow`. Please import `semmle.code.cpp.dataflow.DataFlow` directly. + +### Deprecated APIs + +* The `WriteConfig` taint tracking configuration has been deprecated. Please use `WriteFlow`. + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* A new C/C++ dataflow library (`semmle.code.cpp.dataflow.new.DataFlow`) has been added. + The new library behaves much more like the dataflow library of other CodeQL supported + languages by following use-use dataflow paths instead of def-use dataflow paths. + The new library also better supports dataflow through indirections, and new predicates + such as `Node::asIndirectExpr` have been added to facilitate working with indirections. + + The `semmle.code.cpp.ir.dataflow.DataFlow` library is now identical to the new + `semmle.code.cpp.dataflow.new.DataFlow` library. +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `hasGeneratedCopyConstructor` and `hasGeneratedCopyAssignmentOperator` predicates from the `Folder` class. +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. +* Deleted the deprecated `getMustlockFunction`, `getTrylockFunction`, `getLockFunction`, and `getUnlockFunction` predicates from the `MutexType` class. +* Deleted the deprecated `getPosInBasicBlock` predicate from the `SubBasicBlock` class. +* Deleted the deprecated `getExpr` predicate from the `PointerDereferenceExpr` class. +* Deleted the deprecated `getUseInstruction` and `getDefinitionInstruction` predicates from the `Operand` class. +* Deleted the deprecated `isInParameter`, `isInParameterPointer`, and `isInQualifier` predicates from the `FunctionInput` class. +* Deleted the deprecated `isOutParameterPointer`, `isOutQualifier`, `isOutReturnValue`, and `isOutReturnPointer` predicate from the `FunctionOutput` class. +* Deleted the deprecated 3-argument `isGuardPhi` predicate from the `RangeSsaDefinition` class. diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml index cd3f72e25138..a3f820f884d3 100644 --- a/cpp/ql/lib/codeql-pack.release.yml +++ b/cpp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.6.0 diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml index 8e6602b66341..5a75c36d89d1 100644 --- a/cpp/ql/lib/qlpack.yml +++ b/cpp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-all -version: 0.5.5-dev +version: 0.6.0 groups: cpp dbscheme: semmlecode.cpp.dbscheme extractor: cpp diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md index 2024538e99cd..510cd92b2756 100644 --- a/cpp/ql/src/CHANGELOG.md +++ b/cpp/ql/src/CHANGELOG.md @@ -1,3 +1,10 @@ +## 0.5.5 + +### Deprecated Queries + +* The `NetworkToBufferSizeConfiguration` and `UntrustedDataToExternalApiConfig` dataflow configurations have been deprecated. Please use `NetworkToBufferSizeFlow` and `UntrustedDataToExternalApiFlow`. +* The `LeapYearCheckConfiguration`, `FiletimeYearArithmeticOperationCheckConfiguration`, and `PossibleYearArithmeticOperationCheckConfiguration` dataflow configurations have been deprecated. Please use `LeapYearCheckFlow`, `FiletimeYearArithmeticOperationCheckFlow` and `PossibleYearArithmeticOperationCheckFlow`. + ## 0.5.4 No user-facing changes. diff --git a/cpp/ql/src/change-notes/2023-03-08-deprecated-dataflow-configurations.md b/cpp/ql/src/change-notes/2023-03-08-deprecated-dataflow-configurations.md deleted file mode 100644 index 46952f5b1a32..000000000000 --- a/cpp/ql/src/change-notes/2023-03-08-deprecated-dataflow-configurations.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: deprecated ---- -* The `NetworkToBufferSizeConfiguration` and `UntrustedDataToExternalApiConfig` dataflow configurations have been deprecated. Please use `NetworkToBufferSizeFlow` and `UntrustedDataToExternalApiFlow`. diff --git a/cpp/ql/src/change-notes/2023-03-08-deprecated-leap-year-dataflow-configurations.md b/cpp/ql/src/change-notes/released/0.5.5.md similarity index 57% rename from cpp/ql/src/change-notes/2023-03-08-deprecated-leap-year-dataflow-configurations.md rename to cpp/ql/src/change-notes/released/0.5.5.md index 1ea59f77680e..d8b6132e12b3 100644 --- a/cpp/ql/src/change-notes/2023-03-08-deprecated-leap-year-dataflow-configurations.md +++ b/cpp/ql/src/change-notes/released/0.5.5.md @@ -1,4 +1,6 @@ ---- -category: deprecated ---- +## 0.5.5 + +### Deprecated Queries + +* The `NetworkToBufferSizeConfiguration` and `UntrustedDataToExternalApiConfig` dataflow configurations have been deprecated. Please use `NetworkToBufferSizeFlow` and `UntrustedDataToExternalApiFlow`. * The `LeapYearCheckConfiguration`, `FiletimeYearArithmeticOperationCheckConfiguration`, and `PossibleYearArithmeticOperationCheckConfiguration` dataflow configurations have been deprecated. Please use `LeapYearCheckFlow`, `FiletimeYearArithmeticOperationCheckFlow` and `PossibleYearArithmeticOperationCheckFlow`. diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/cpp/ql/src/codeql-pack.release.yml +++ b/cpp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml index 9c312b5a5686..88e2c2a19217 100644 --- a/cpp/ql/src/qlpack.yml +++ b/cpp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-queries -version: 0.5.5-dev +version: 0.5.5 groups: - cpp - queries diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md index 1f2dc408daf6..892c022355af 100644 --- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.4.5 + +No user-facing changes. + ## 1.4.4 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.4.5.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.4.5.md new file mode 100644 index 000000000000..930163bb5ae1 --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.4.5.md @@ -0,0 +1,3 @@ +## 1.4.5 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml index 1dfca6daa3b1..a74b6b08d860 100644 --- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.4.4 +lastReleaseVersion: 1.4.5 diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml index 14647a2593bf..cbc4e04bfe61 100644 --- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-all -version: 1.4.5-dev +version: 1.4.5 groups: - csharp - solorigate diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md index 1f2dc408daf6..892c022355af 100644 --- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.4.5 + +No user-facing changes. + ## 1.4.4 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.4.5.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.4.5.md new file mode 100644 index 000000000000..930163bb5ae1 --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.4.5.md @@ -0,0 +1,3 @@ +## 1.4.5 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml index 1dfca6daa3b1..a74b6b08d860 100644 --- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.4.4 +lastReleaseVersion: 1.4.5 diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml index 48bb9aecd885..e7f9d67aa662 100644 --- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-queries -version: 1.4.5-dev +version: 1.4.5 groups: - csharp - solorigate diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md index 42eaea79fd6a..bf400a543786 100644 --- a/csharp/ql/lib/CHANGELOG.md +++ b/csharp/ql/lib/CHANGELOG.md @@ -1,3 +1,25 @@ +## 0.5.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. +* Deleted the deprecated `getAssertionIndex`, and `getAssertedParameter` predicates from the `AssertMethod` class. +* Deleted the deprecated `OverridableMethod` and `OverridableAccessor` classes. +* The `unsafe` predicate for `Modifiable` has been extended to cover delegate return types and identify pointer-like types at any nest level. This is relevant for `unsafe` declarations extracted from assemblies. + ## 0.5.4 ### Minor Analysis Improvements diff --git a/csharp/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md b/csharp/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md deleted file mode 100644 index 89190af399f7..000000000000 --- a/csharp/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -category: majorAnalysis ---- -* The main data flow and taint tracking APIs have been changed. The old APIs - remain in place for now and translate to the new through a - backwards-compatible wrapper. If multiple configurations are in scope - simultaneously, then this may affect results slightly. The new API is quite - similar to the old, but makes use of a configuration module instead of a - configuration class. diff --git a/csharp/ql/lib/change-notes/2023-03-02-unsafemembers.md b/csharp/ql/lib/change-notes/2023-03-02-unsafemembers.md deleted file mode 100644 index 7ff64ca13016..000000000000 --- a/csharp/ql/lib/change-notes/2023-03-02-unsafemembers.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: minorAnalysis ---- -* The `unsafe` predicate for `Modifiable` has been extended to cover delegate return types and identify pointer like types at any nest level. This is relevant for `unsafe` declarations extracted from assemblies. \ No newline at end of file diff --git a/csharp/ql/lib/change-notes/2023-03-03-delete-deps.md b/csharp/ql/lib/change-notes/2023-03-03-delete-deps.md deleted file mode 100644 index f5557fc5b77a..000000000000 --- a/csharp/ql/lib/change-notes/2023-03-03-delete-deps.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -category: minorAnalysis ---- -* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. -* Deleted the deprecated `getAssertionIndex`, and `getAssertedParameter` predicates from the `AssertMethod` class. -* Deleted the deprecated `OverridableMethod` and `OverridableAccessor` classes. diff --git a/csharp/ql/lib/change-notes/2023-03-13-mergepathgraph.md b/csharp/ql/lib/change-notes/2023-03-13-mergepathgraph.md deleted file mode 100644 index 63bfade2f10a..000000000000 --- a/csharp/ql/lib/change-notes/2023-03-13-mergepathgraph.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: feature ---- -* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. diff --git a/csharp/ql/lib/change-notes/released/0.5.5.md b/csharp/ql/lib/change-notes/released/0.5.5.md new file mode 100644 index 000000000000..873ac6839e37 --- /dev/null +++ b/csharp/ql/lib/change-notes/released/0.5.5.md @@ -0,0 +1,21 @@ +## 0.5.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. +* Deleted the deprecated `getAssertionIndex`, and `getAssertedParameter` predicates from the `AssertMethod` class. +* Deleted the deprecated `OverridableMethod` and `OverridableAccessor` classes. +* The `unsafe` predicate for `Modifiable` has been extended to cover delegate return types and identify pointer-like types at any nest level. This is relevant for `unsafe` declarations extracted from assemblies. diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/csharp/ql/lib/codeql-pack.release.yml +++ b/csharp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml index 34880f509e8e..434c2e324b9d 100644 --- a/csharp/ql/lib/qlpack.yml +++ b/csharp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-all -version: 0.5.5-dev +version: 0.5.5 groups: csharp dbscheme: semmlecode.csharp.dbscheme extractor: csharp diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md index b75d77162f4c..0abf2626a75f 100644 --- a/csharp/ql/src/CHANGELOG.md +++ b/csharp/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.5.5 + +No user-facing changes. + ## 0.5.4 No user-facing changes. diff --git a/csharp/ql/src/change-notes/released/0.5.5.md b/csharp/ql/src/change-notes/released/0.5.5.md new file mode 100644 index 000000000000..5f5ae32c0595 --- /dev/null +++ b/csharp/ql/src/change-notes/released/0.5.5.md @@ -0,0 +1,3 @@ +## 0.5.5 + +No user-facing changes. diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/csharp/ql/src/codeql-pack.release.yml +++ b/csharp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml index 3ed4e37fefcf..a2eae93dec88 100644 --- a/csharp/ql/src/qlpack.yml +++ b/csharp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-queries -version: 0.5.5-dev +version: 0.5.5 groups: - csharp - queries diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md index 3bab3bf2b6a4..56c35b2f9fe6 100644 --- a/go/ql/lib/CHANGELOG.md +++ b/go/ql/lib/CHANGELOG.md @@ -1,3 +1,18 @@ +## 0.4.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + ## 0.4.4 No user-facing changes. diff --git a/go/ql/lib/change-notes/2023-03-13-mergepathgraph.md b/go/ql/lib/change-notes/2023-03-13-mergepathgraph.md deleted file mode 100644 index 63bfade2f10a..000000000000 --- a/go/ql/lib/change-notes/2023-03-13-mergepathgraph.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: feature ---- -* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. diff --git a/java/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md b/go/ql/lib/change-notes/released/0.4.5.md similarity index 64% rename from java/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md rename to go/ql/lib/change-notes/released/0.4.5.md index 89190af399f7..af3533b80182 100644 --- a/java/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md +++ b/go/ql/lib/change-notes/released/0.4.5.md @@ -1,6 +1,11 @@ ---- -category: majorAnalysis ---- +## 0.4.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + * The main data flow and taint tracking APIs have been changed. The old APIs remain in place for now and translate to the new through a backwards-compatible wrapper. If multiple configurations are in scope diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml index e9b57993a013..466cd01cf4e7 100644 --- a/go/ql/lib/codeql-pack.release.yml +++ b/go/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.4 +lastReleaseVersion: 0.4.5 diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml index 378f7b0e5e43..7770c7beaa6c 100644 --- a/go/ql/lib/qlpack.yml +++ b/go/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/go-all -version: 0.4.5-dev +version: 0.4.5 groups: go dbscheme: go.dbscheme extractor: go diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md index 89ee497c17f8..e9d64e6c8e84 100644 --- a/go/ql/src/CHANGELOG.md +++ b/go/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.4.5 + +No user-facing changes. + ## 0.4.4 ### Minor Analysis Improvements diff --git a/go/ql/src/change-notes/released/0.4.5.md b/go/ql/src/change-notes/released/0.4.5.md new file mode 100644 index 000000000000..7ba9b2e8ade1 --- /dev/null +++ b/go/ql/src/change-notes/released/0.4.5.md @@ -0,0 +1,3 @@ +## 0.4.5 + +No user-facing changes. diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml index e9b57993a013..466cd01cf4e7 100644 --- a/go/ql/src/codeql-pack.release.yml +++ b/go/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.4 +lastReleaseVersion: 0.4.5 diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml index 02c9d788969e..21f9f365c5e2 100644 --- a/go/ql/src/qlpack.yml +++ b/go/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/go-queries -version: 0.4.5-dev +version: 0.4.5 groups: - go - queries diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md index d7428d81c279..5ff003fb8cb6 100644 --- a/java/ql/lib/CHANGELOG.md +++ b/java/ql/lib/CHANGELOG.md @@ -1,3 +1,34 @@ +## 0.5.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* Removed low-confidence call edges to known neutral call targets from the call graph used in data flow analysis. This includes, for example, custom `List.contains` implementations when the best inferrable type at the call site is simply `List`. +* Added more sink and summary dataflow models for the following packages: + * `java.io` + * `java.lang` + * `java.sql` + * `javafx.scene.web` + * `org.apache.commons.compress.archivers.tar` + * `org.apache.http.client.utils` + * `org.codehaus.cargo.container.installer` +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. +* Deleted the deprecated `getRepresentedString` predicate from the `StringLiteral` class. +* Deleted the deprecated `ServletWriterSource` class. +* Deleted the deprecated `getGroupID`, `getArtefactID`, and `artefactMatches` predicates from the `MavenRepoJar` class. + ## 0.5.4 ### Minor Analysis Improvements diff --git a/java/ql/lib/change-notes/2023-03-03-delete-deps.md b/java/ql/lib/change-notes/2023-03-03-delete-deps.md deleted file mode 100644 index bdc84d43d26e..000000000000 --- a/java/ql/lib/change-notes/2023-03-03-delete-deps.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -category: minorAnalysis ---- -* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. -* Deleted the deprecated `getRepresentedString` predicate from the `StringLiteral` class. -* Deleted the deprecated `ServletWriterSource` class. -* Deleted the deprecated `getGroupID`, `getArtefactID`, and `artefactMatches` predicates from the `MavenRepoJar` class. \ No newline at end of file diff --git a/java/ql/lib/change-notes/2023-03-09-more-models.md b/java/ql/lib/change-notes/2023-03-09-more-models.md deleted file mode 100644 index 2d763c0d22b2..000000000000 --- a/java/ql/lib/change-notes/2023-03-09-more-models.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -category: majorAnalysis ---- -* Added more sink and summary dataflow models for the following packages: - * `java.io` - * `java.lang` - * `java.sql` - * `javafx.scene.web` - * `org.apache.commons.compress.archivers.tar` - * `org.apache.http.client.utils` - * `org.codehaus.cargo.container.installer` diff --git a/java/ql/lib/change-notes/2023-03-13-mergepathgraph.md b/java/ql/lib/change-notes/2023-03-13-mergepathgraph.md deleted file mode 100644 index 63bfade2f10a..000000000000 --- a/java/ql/lib/change-notes/2023-03-13-mergepathgraph.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: feature ---- -* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. diff --git a/java/ql/lib/change-notes/2023-03-14-neutral-dispatch.md b/java/ql/lib/change-notes/2023-03-14-neutral-dispatch.md deleted file mode 100644 index f01e87007570..000000000000 --- a/java/ql/lib/change-notes/2023-03-14-neutral-dispatch.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: majorAnalysis ---- -* Removed low-confidence call edges to known neutral call targets from the call graph used in data flow analysis. This includes, for example, custom `List.contains` implementations when the best inferrable type at the call site is simply `List`. diff --git a/java/ql/lib/change-notes/released/0.5.5.md b/java/ql/lib/change-notes/released/0.5.5.md new file mode 100644 index 000000000000..60e487e4c0c5 --- /dev/null +++ b/java/ql/lib/change-notes/released/0.5.5.md @@ -0,0 +1,30 @@ +## 0.5.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* Removed low-confidence call edges to known neutral call targets from the call graph used in data flow analysis. This includes, for example, custom `List.contains` implementations when the best inferrable type at the call site is simply `List`. +* Added more sink and summary dataflow models for the following packages: + * `java.io` + * `java.lang` + * `java.sql` + * `javafx.scene.web` + * `org.apache.commons.compress.archivers.tar` + * `org.apache.http.client.utils` + * `org.codehaus.cargo.container.installer` +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. +* Deleted the deprecated `getRepresentedString` predicate from the `StringLiteral` class. +* Deleted the deprecated `ServletWriterSource` class. +* Deleted the deprecated `getGroupID`, `getArtefactID`, and `artefactMatches` predicates from the `MavenRepoJar` class. diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/java/ql/lib/codeql-pack.release.yml +++ b/java/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml index 90fcc57cebf5..bf49dec886c9 100644 --- a/java/ql/lib/qlpack.yml +++ b/java/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/java-all -version: 0.5.5-dev +version: 0.5.5 groups: java dbscheme: config/semmlecode.dbscheme extractor: java diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md index e2a9e8a56f00..0b18bced9b31 100644 --- a/java/ql/src/CHANGELOG.md +++ b/java/ql/src/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.5.5 + +### New Queries + +* Added a new query, `java/android/arbitrary-apk-installation`, to detect installation of APKs from untrusted sources. + ## 0.5.4 No user-facing changes. diff --git a/java/ql/src/change-notes/2023-01-19-arbitrary-apk-installation.md b/java/ql/src/change-notes/released/0.5.5.md similarity index 81% rename from java/ql/src/change-notes/2023-01-19-arbitrary-apk-installation.md rename to java/ql/src/change-notes/released/0.5.5.md index 93eb13f87d5e..197c7ae1b693 100644 --- a/java/ql/src/change-notes/2023-01-19-arbitrary-apk-installation.md +++ b/java/ql/src/change-notes/released/0.5.5.md @@ -1,5 +1,5 @@ ---- -category: newQuery ---- -* Added a new query, `java/android/arbitrary-apk-installation`, to detect installation of APKs from untrusted sources. +## 0.5.5 + +### New Queries +* Added a new query, `java/android/arbitrary-apk-installation`, to detect installation of APKs from untrusted sources. diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/java/ql/src/codeql-pack.release.yml +++ b/java/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml index 6c1783ce1cb4..1d3c43f7e282 100644 --- a/java/ql/src/qlpack.yml +++ b/java/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/java-queries -version: 0.5.5-dev +version: 0.5.5 groups: - java - queries diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md index bb0c197b3f24..53553dad5f4c 100644 --- a/javascript/ql/lib/CHANGELOG.md +++ b/javascript/ql/lib/CHANGELOG.md @@ -1,3 +1,15 @@ +## 0.5.1 + +### Minor Analysis Improvements + +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. +* Deleted the deprecated `getId` from the `Function`, `NamespaceDefinition`, and `ImportEqualsDeclaration` classes. +* Deleted the deprecated `flowsTo` predicate from the `HTTP::Servers::RequestSource` and `HTTP::Servers::ResponseSource` class. +* Deleted the deprecated `getEventName` predicate from the `SocketIO::ReceiveNode`, `SocketIO::SendNode`, `SocketIOClient::SendNode` classes. +* Deleted the deprecated `RateLimitedRouteHandlerExpr` and `RouteHandlerExpressionWithRateLimiter` classes. +* [Import assertions](https://github.com/tc39/proposal-import-assertions) are now supported. + Previously this feature was only supported in TypeScript code, but is now supported for plain JavaScript as well and is also accessible in the AST. + ## 0.5.0 ### Breaking Changes diff --git a/javascript/ql/lib/change-notes/2023-03-03-import-assertion.md b/javascript/ql/lib/change-notes/2023-03-03-import-assertion.md deleted file mode 100644 index b6ee92a66600..000000000000 --- a/javascript/ql/lib/change-notes/2023-03-03-import-assertion.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -category: minorAnalysis ---- -* [Import assertions](https://github.com/tc39/proposal-import-assertions) are now supported. - Previously this feature was only supported in TypeScript code, but is now supported for plain JavaScript as well and is also accessible in the AST. diff --git a/javascript/ql/lib/change-notes/2023-03-03-delete-deps.md b/javascript/ql/lib/change-notes/released/0.5.1.md similarity index 61% rename from javascript/ql/lib/change-notes/2023-03-03-delete-deps.md rename to javascript/ql/lib/change-notes/released/0.5.1.md index 3ac871fa8a24..972b37b573b2 100644 --- a/javascript/ql/lib/change-notes/2023-03-03-delete-deps.md +++ b/javascript/ql/lib/change-notes/released/0.5.1.md @@ -1,8 +1,11 @@ ---- -category: minorAnalysis ---- +## 0.5.1 + +### Minor Analysis Improvements + * Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. * Deleted the deprecated `getId` from the `Function`, `NamespaceDefinition`, and `ImportEqualsDeclaration` classes. * Deleted the deprecated `flowsTo` predicate from the `HTTP::Servers::RequestSource` and `HTTP::Servers::ResponseSource` class. * Deleted the deprecated `getEventName` predicate from the `SocketIO::ReceiveNode`, `SocketIO::SendNode`, `SocketIOClient::SendNode` classes. -* Deleted the deprecated `RateLimitedRouteHandlerExpr` and `RouteHandlerExpressionWithRateLimiter` classes. \ No newline at end of file +* Deleted the deprecated `RateLimitedRouteHandlerExpr` and `RouteHandlerExpressionWithRateLimiter` classes. +* [Import assertions](https://github.com/tc39/proposal-import-assertions) are now supported. + Previously this feature was only supported in TypeScript code, but is now supported for plain JavaScript as well and is also accessible in the AST. diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml index 30e271c5361c..0bf7024c337b 100644 --- a/javascript/ql/lib/codeql-pack.release.yml +++ b/javascript/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.0 +lastReleaseVersion: 0.5.1 diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml index 22328fa622bb..8eaa891b23e1 100644 --- a/javascript/ql/lib/qlpack.yml +++ b/javascript/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/javascript-all -version: 0.5.1-dev +version: 0.5.1 groups: javascript dbscheme: semmlecode.javascript.dbscheme extractor: javascript diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md index 2b0ef33f565c..1abcc918b2ce 100644 --- a/javascript/ql/src/CHANGELOG.md +++ b/javascript/ql/src/CHANGELOG.md @@ -1,3 +1,11 @@ +## 0.5.5 + +### Minor Analysis Improvements + +* The following queries now recognize HTML sanitizers as propagating taint: `js/sql-injection`, + `js/path-injection`, `js/server-side-unvalidated-url-redirection`, `js/client-side-unvalidated-url-redirection`, + and `js/request-forgery`. + ## 0.5.4 ### Minor Analysis Improvements diff --git a/javascript/ql/src/change-notes/2023-03-07-html-sanitizer-for-sql.md b/javascript/ql/src/change-notes/released/0.5.5.md similarity index 84% rename from javascript/ql/src/change-notes/2023-03-07-html-sanitizer-for-sql.md rename to javascript/ql/src/change-notes/released/0.5.5.md index b26c1caec02c..78f2dd33acfb 100644 --- a/javascript/ql/src/change-notes/2023-03-07-html-sanitizer-for-sql.md +++ b/javascript/ql/src/change-notes/released/0.5.5.md @@ -1,6 +1,7 @@ ---- -category: minorAnalysis ---- +## 0.5.5 + +### Minor Analysis Improvements + * The following queries now recognize HTML sanitizers as propagating taint: `js/sql-injection`, `js/path-injection`, `js/server-side-unvalidated-url-redirection`, `js/client-side-unvalidated-url-redirection`, and `js/request-forgery`. diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/javascript/ql/src/codeql-pack.release.yml +++ b/javascript/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/javascript/ql/src/qlpack.yml b/javascript/ql/src/qlpack.yml index eda7c965604b..45819411de32 100644 --- a/javascript/ql/src/qlpack.yml +++ b/javascript/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/javascript-queries -version: 0.5.5-dev +version: 0.5.5 groups: - javascript - queries diff --git a/misc/suite-helpers/CHANGELOG.md b/misc/suite-helpers/CHANGELOG.md index d9ec2274496a..80c3e1ddeb5e 100644 --- a/misc/suite-helpers/CHANGELOG.md +++ b/misc/suite-helpers/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.4.5 + +No user-facing changes. + ## 0.4.4 No user-facing changes. diff --git a/misc/suite-helpers/change-notes/released/0.4.5.md b/misc/suite-helpers/change-notes/released/0.4.5.md new file mode 100644 index 000000000000..7ba9b2e8ade1 --- /dev/null +++ b/misc/suite-helpers/change-notes/released/0.4.5.md @@ -0,0 +1,3 @@ +## 0.4.5 + +No user-facing changes. diff --git a/misc/suite-helpers/codeql-pack.release.yml b/misc/suite-helpers/codeql-pack.release.yml index e9b57993a013..466cd01cf4e7 100644 --- a/misc/suite-helpers/codeql-pack.release.yml +++ b/misc/suite-helpers/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.4.4 +lastReleaseVersion: 0.4.5 diff --git a/misc/suite-helpers/qlpack.yml b/misc/suite-helpers/qlpack.yml index e6e1a9280604..eeda1afd1ea7 100644 --- a/misc/suite-helpers/qlpack.yml +++ b/misc/suite-helpers/qlpack.yml @@ -1,3 +1,3 @@ name: codeql/suite-helpers -version: 0.4.5-dev +version: 0.4.5 groups: shared diff --git a/python/ql/lib/CHANGELOG.md b/python/ql/lib/CHANGELOG.md index cd00bbba31a0..de1895d3b6b8 100644 --- a/python/ql/lib/CHANGELOG.md +++ b/python/ql/lib/CHANGELOG.md @@ -1,3 +1,22 @@ +## 0.8.2 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. + ## 0.8.1 ### Major Analysis Improvements diff --git a/python/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md b/python/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md deleted file mode 100644 index 89190af399f7..000000000000 --- a/python/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -category: majorAnalysis ---- -* The main data flow and taint tracking APIs have been changed. The old APIs - remain in place for now and translate to the new through a - backwards-compatible wrapper. If multiple configurations are in scope - simultaneously, then this may affect results slightly. The new API is quite - similar to the old, but makes use of a configuration module instead of a - configuration class. diff --git a/python/ql/lib/change-notes/2023-03-03-delete-deps.md b/python/ql/lib/change-notes/2023-03-03-delete-deps.md deleted file mode 100644 index 887db05e8c9e..000000000000 --- a/python/ql/lib/change-notes/2023-03-03-delete-deps.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: minorAnalysis ---- -* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. \ No newline at end of file diff --git a/python/ql/lib/change-notes/2023-03-13-mergepathgraph.md b/python/ql/lib/change-notes/2023-03-13-mergepathgraph.md deleted file mode 100644 index 63bfade2f10a..000000000000 --- a/python/ql/lib/change-notes/2023-03-13-mergepathgraph.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: feature ---- -* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. diff --git a/go/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md b/python/ql/lib/change-notes/released/0.8.2.md similarity index 53% rename from go/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md rename to python/ql/lib/change-notes/released/0.8.2.md index 89190af399f7..6855fdaf72a8 100644 --- a/go/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md +++ b/python/ql/lib/change-notes/released/0.8.2.md @@ -1,9 +1,18 @@ ---- -category: majorAnalysis ---- +## 0.8.2 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + * The main data flow and taint tracking APIs have been changed. The old APIs remain in place for now and translate to the new through a backwards-compatible wrapper. If multiple configurations are in scope simultaneously, then this may affect results slightly. The new API is quite similar to the old, but makes use of a configuration module instead of a configuration class. + +### Minor Analysis Improvements + +* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class. diff --git a/python/ql/lib/codeql-pack.release.yml b/python/ql/lib/codeql-pack.release.yml index 2f693f95ba69..404110129dc4 100644 --- a/python/ql/lib/codeql-pack.release.yml +++ b/python/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.8.1 +lastReleaseVersion: 0.8.2 diff --git a/python/ql/lib/qlpack.yml b/python/ql/lib/qlpack.yml index 77b07a5c101f..c25f554065b7 100644 --- a/python/ql/lib/qlpack.yml +++ b/python/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/python-all -version: 0.8.2-dev +version: 0.8.2 groups: python dbscheme: semmlecode.python.dbscheme extractor: python diff --git a/python/ql/src/CHANGELOG.md b/python/ql/src/CHANGELOG.md index aa03127e1605..3872807e4c5f 100644 --- a/python/ql/src/CHANGELOG.md +++ b/python/ql/src/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.6.5 + +### New Queries + +* Added a new query, `py/shell-command-constructed-from-input`, to detect libraries that unsafely construct shell commands from their inputs. + ## 0.6.4 No user-facing changes. diff --git a/python/ql/src/change-notes/2023-02-03-unsafe-shell-command-construction.md b/python/ql/src/change-notes/released/0.6.5.md similarity index 84% rename from python/ql/src/change-notes/2023-02-03-unsafe-shell-command-construction.md rename to python/ql/src/change-notes/released/0.6.5.md index 0654a93582b3..90a9171e732c 100644 --- a/python/ql/src/change-notes/2023-02-03-unsafe-shell-command-construction.md +++ b/python/ql/src/change-notes/released/0.6.5.md @@ -1,4 +1,5 @@ ---- -category: newQuery ---- +## 0.6.5 + +### New Queries + * Added a new query, `py/shell-command-constructed-from-input`, to detect libraries that unsafely construct shell commands from their inputs. diff --git a/python/ql/src/codeql-pack.release.yml b/python/ql/src/codeql-pack.release.yml index ced8cf94614b..86780fb61480 100644 --- a/python/ql/src/codeql-pack.release.yml +++ b/python/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.6.4 +lastReleaseVersion: 0.6.5 diff --git a/python/ql/src/qlpack.yml b/python/ql/src/qlpack.yml index 99238b665e52..c3808c0e9f01 100644 --- a/python/ql/src/qlpack.yml +++ b/python/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/python-queries -version: 0.6.5-dev +version: 0.6.5 groups: - python - queries diff --git a/ruby/ql/lib/CHANGELOG.md b/ruby/ql/lib/CHANGELOG.md index 9613a598176f..fd99d1504a2e 100644 --- a/ruby/ql/lib/CHANGELOG.md +++ b/ruby/ql/lib/CHANGELOG.md @@ -1,3 +1,29 @@ +## 0.5.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Data flow through `initialize` methods is now taken into account also when the receiver of a `new` call is an (implicit or explicit) `self`. +* The Active Record query methods `reorder` and `count_by_sql` are now recognized as SQL executions. +* Calls to `ActiveRecord::Connection#execute`, including those via subclasses, are now recognized as SQL executions. +* Data flow through `ActionController::Parameters#require` is now tracked properly. +* The severity of parse errors was reduced to warning (previously error). +* Deleted the deprecated `getQualifiedName` predicate from the `ConstantWriteAccess` class. +* Deleted the deprecated `getWhenBranch` and `getAWhenBranch` predicates from the `CaseExpr` class. +* Deleted the deprecated `Self`, `PatternParameter`, `Pattern`, `VariablePattern`, `TuplePattern`, and `TuplePatternParameter` classes. + ## 0.5.4 ### Minor Analysis Improvements diff --git a/ruby/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md b/ruby/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md deleted file mode 100644 index 89190af399f7..000000000000 --- a/ruby/ql/lib/change-notes/2023-03-02-dataflow-conf-module.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -category: majorAnalysis ---- -* The main data flow and taint tracking APIs have been changed. The old APIs - remain in place for now and translate to the new through a - backwards-compatible wrapper. If multiple configurations are in scope - simultaneously, then this may affect results slightly. The new API is quite - similar to the old, but makes use of a configuration module instead of a - configuration class. diff --git a/ruby/ql/lib/change-notes/2023-03-03-delete-deps.md b/ruby/ql/lib/change-notes/2023-03-03-delete-deps.md deleted file mode 100644 index aab1e76bf707..000000000000 --- a/ruby/ql/lib/change-notes/2023-03-03-delete-deps.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -category: minorAnalysis ---- -* Deleted the deprecated `getQualifiedName` predicate from the `ConstantWriteAccess` class. -* Deleted the deprecated `getWhenBranch` and `getAWhenBranch` predicates from the `CaseExpr` class. -* Deleted the deprecated `Self`, `PatternParameter`, `Pattern`, `VariablePattern`, `TuplePattern`, and `TuplePatternParameter` classes. \ No newline at end of file diff --git a/ruby/ql/lib/change-notes/2023-03-09-parse-error.md b/ruby/ql/lib/change-notes/2023-03-09-parse-error.md deleted file mode 100644 index da07ab22b5f1..000000000000 --- a/ruby/ql/lib/change-notes/2023-03-09-parse-error.md +++ /dev/null @@ -1,4 +0,0 @@ ---- - category: minorAnalysis ---- -* The severity of parse errors was reduced to warning (previously error). diff --git a/ruby/ql/lib/change-notes/2023-03-13-initalize-flow.md b/ruby/ql/lib/change-notes/2023-03-13-initalize-flow.md deleted file mode 100644 index bc366496e6fa..000000000000 --- a/ruby/ql/lib/change-notes/2023-03-13-initalize-flow.md +++ /dev/null @@ -1,4 +0,0 @@ ---- - category: minorAnalysis ---- -* Data flow through `initialize` methods is now taken into account also when the receiver of a `new` call is an (implicit or explicit) `self`. diff --git a/ruby/ql/lib/change-notes/2023-03-13-mergepathgraph.md b/ruby/ql/lib/change-notes/2023-03-13-mergepathgraph.md deleted file mode 100644 index 63bfade2f10a..000000000000 --- a/ruby/ql/lib/change-notes/2023-03-13-mergepathgraph.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: feature ---- -* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. diff --git a/ruby/ql/lib/change-notes/2023-03-13-rails-sinks.md b/ruby/ql/lib/change-notes/2023-03-13-rails-sinks.md deleted file mode 100644 index 6827b2755ed3..000000000000 --- a/ruby/ql/lib/change-notes/2023-03-13-rails-sinks.md +++ /dev/null @@ -1,6 +0,0 @@ ---- - category: minorAnalysis ---- -* The Active Record query methods `reorder` and `count_by_sql` are now recognised as SQL executions. -* Calls to `ActiveRecord::Connection#execute`, including those via subclasses, are now recognised as SQL executions. -* Data flow through `ActionController::Parameters#require` is now tracked properly. \ No newline at end of file diff --git a/ruby/ql/lib/change-notes/released/0.5.5.md b/ruby/ql/lib/change-notes/released/0.5.5.md new file mode 100644 index 000000000000..a6c6618886d8 --- /dev/null +++ b/ruby/ql/lib/change-notes/released/0.5.5.md @@ -0,0 +1,25 @@ +## 0.5.5 + +### New Features + +* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query. + +### Major Analysis Improvements + +* The main data flow and taint tracking APIs have been changed. The old APIs + remain in place for now and translate to the new through a + backwards-compatible wrapper. If multiple configurations are in scope + simultaneously, then this may affect results slightly. The new API is quite + similar to the old, but makes use of a configuration module instead of a + configuration class. + +### Minor Analysis Improvements + +* Data flow through `initialize` methods is now taken into account also when the receiver of a `new` call is an (implicit or explicit) `self`. +* The Active Record query methods `reorder` and `count_by_sql` are now recognized as SQL executions. +* Calls to `ActiveRecord::Connection#execute`, including those via subclasses, are now recognized as SQL executions. +* Data flow through `ActionController::Parameters#require` is now tracked properly. +* The severity of parse errors was reduced to warning (previously error). +* Deleted the deprecated `getQualifiedName` predicate from the `ConstantWriteAccess` class. +* Deleted the deprecated `getWhenBranch` and `getAWhenBranch` predicates from the `CaseExpr` class. +* Deleted the deprecated `Self`, `PatternParameter`, `Pattern`, `VariablePattern`, `TuplePattern`, and `TuplePatternParameter` classes. diff --git a/ruby/ql/lib/codeql-pack.release.yml b/ruby/ql/lib/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/ruby/ql/lib/codeql-pack.release.yml +++ b/ruby/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/ruby/ql/lib/qlpack.yml b/ruby/ql/lib/qlpack.yml index 767902b86d95..ecd2b8b0a00a 100644 --- a/ruby/ql/lib/qlpack.yml +++ b/ruby/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/ruby-all -version: 0.5.5-dev +version: 0.5.5 groups: ruby extractor: ruby dbscheme: ruby.dbscheme diff --git a/ruby/ql/src/CHANGELOG.md b/ruby/ql/src/CHANGELOG.md index 03759edabe67..39ca0718982e 100644 --- a/ruby/ql/src/CHANGELOG.md +++ b/ruby/ql/src/CHANGELOG.md @@ -1,3 +1,9 @@ +## 0.5.5 + +### New Queries + +* Added a new query, `rb/zip-slip`, to detect arbitrary file writes during extraction of zip/tar archives. + ## 0.5.4 No user-facing changes. diff --git a/ruby/ql/src/change-notes/2023-02-17-zip-slip-query.md b/ruby/ql/src/change-notes/2023-02-17-zip-slip-query.md deleted file mode 100644 index ebf17acb7be5..000000000000 --- a/ruby/ql/src/change-notes/2023-02-17-zip-slip-query.md +++ /dev/null @@ -1,4 +0,0 @@ ---- -category: newQuery ---- -* Added a new query, `rb/zip-slip`, to detect arbitrary file writes during extraction of zip/tar archives. \ No newline at end of file diff --git a/ruby/ql/src/change-notes/released/0.5.5.md b/ruby/ql/src/change-notes/released/0.5.5.md new file mode 100644 index 000000000000..20cdffb63070 --- /dev/null +++ b/ruby/ql/src/change-notes/released/0.5.5.md @@ -0,0 +1,5 @@ +## 0.5.5 + +### New Queries + +* Added a new query, `rb/zip-slip`, to detect arbitrary file writes during extraction of zip/tar archives. diff --git a/ruby/ql/src/codeql-pack.release.yml b/ruby/ql/src/codeql-pack.release.yml index cd3f72e25138..03e491f0899a 100644 --- a/ruby/ql/src/codeql-pack.release.yml +++ b/ruby/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.5.4 +lastReleaseVersion: 0.5.5 diff --git a/ruby/ql/src/qlpack.yml b/ruby/ql/src/qlpack.yml index ca67c75eca66..08c92e6b22a6 100644 --- a/ruby/ql/src/qlpack.yml +++ b/ruby/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/ruby-queries -version: 0.5.5-dev +version: 0.5.5 groups: - ruby - queries diff --git a/shared/regex/CHANGELOG.md b/shared/regex/CHANGELOG.md index cf315546ed9c..771960678f56 100644 --- a/shared/regex/CHANGELOG.md +++ b/shared/regex/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.9 + +No user-facing changes. + ## 0.0.8 No user-facing changes. diff --git a/shared/regex/change-notes/released/0.0.9.md b/shared/regex/change-notes/released/0.0.9.md new file mode 100644 index 000000000000..c9e17c6d6cf2 --- /dev/null +++ b/shared/regex/change-notes/released/0.0.9.md @@ -0,0 +1,3 @@ +## 0.0.9 + +No user-facing changes. diff --git a/shared/regex/codeql-pack.release.yml b/shared/regex/codeql-pack.release.yml index 58fdc6b45deb..ecdd64fbab86 100644 --- a/shared/regex/codeql-pack.release.yml +++ b/shared/regex/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.8 +lastReleaseVersion: 0.0.9 diff --git a/shared/regex/qlpack.yml b/shared/regex/qlpack.yml index f688e4a8e282..ddf814e93b57 100644 --- a/shared/regex/qlpack.yml +++ b/shared/regex/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/regex -version: 0.0.9-dev +version: 0.0.9 groups: shared library: true dependencies: diff --git a/shared/ssa/CHANGELOG.md b/shared/ssa/CHANGELOG.md index b051605d8b6e..68bd110c2679 100644 --- a/shared/ssa/CHANGELOG.md +++ b/shared/ssa/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.13 + +No user-facing changes. + ## 0.0.12 No user-facing changes. diff --git a/shared/ssa/change-notes/released/0.0.13.md b/shared/ssa/change-notes/released/0.0.13.md new file mode 100644 index 000000000000..f679eaf0313a --- /dev/null +++ b/shared/ssa/change-notes/released/0.0.13.md @@ -0,0 +1,3 @@ +## 0.0.13 + +No user-facing changes. diff --git a/shared/ssa/codeql-pack.release.yml b/shared/ssa/codeql-pack.release.yml index 997fb8da83cd..044e54e4f7e5 100644 --- a/shared/ssa/codeql-pack.release.yml +++ b/shared/ssa/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.12 +lastReleaseVersion: 0.0.13 diff --git a/shared/ssa/qlpack.yml b/shared/ssa/qlpack.yml index da55082c66ba..ae3687f98c11 100644 --- a/shared/ssa/qlpack.yml +++ b/shared/ssa/qlpack.yml @@ -1,4 +1,4 @@ name: codeql/ssa -version: 0.0.13-dev +version: 0.0.13 groups: shared library: true diff --git a/shared/tutorial/CHANGELOG.md b/shared/tutorial/CHANGELOG.md index c2a0dedaa8e0..282cc1b48570 100644 --- a/shared/tutorial/CHANGELOG.md +++ b/shared/tutorial/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.6 + +No user-facing changes. + ## 0.0.5 No user-facing changes. diff --git a/shared/tutorial/change-notes/released/0.0.6.md b/shared/tutorial/change-notes/released/0.0.6.md new file mode 100644 index 000000000000..ccbce856079d --- /dev/null +++ b/shared/tutorial/change-notes/released/0.0.6.md @@ -0,0 +1,3 @@ +## 0.0.6 + +No user-facing changes. diff --git a/shared/tutorial/codeql-pack.release.yml b/shared/tutorial/codeql-pack.release.yml index bb45a1ab0182..cf398ce02aa4 100644 --- a/shared/tutorial/codeql-pack.release.yml +++ b/shared/tutorial/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.5 +lastReleaseVersion: 0.0.6 diff --git a/shared/tutorial/qlpack.yml b/shared/tutorial/qlpack.yml index b1958a441e0d..f1f209426c48 100644 --- a/shared/tutorial/qlpack.yml +++ b/shared/tutorial/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/tutorial description: Library for the CodeQL detective tutorials, helping new users learn to write CodeQL queries. -version: 0.0.6-dev +version: 0.0.6 groups: shared library: true diff --git a/shared/typetracking/CHANGELOG.md b/shared/typetracking/CHANGELOG.md index 8d859f9b9e6b..9e7951e8ea83 100644 --- a/shared/typetracking/CHANGELOG.md +++ b/shared/typetracking/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.6 + +No user-facing changes. + ## 0.0.5 No user-facing changes. diff --git a/shared/typetracking/change-notes/released/0.0.6.md b/shared/typetracking/change-notes/released/0.0.6.md new file mode 100644 index 000000000000..ccbce856079d --- /dev/null +++ b/shared/typetracking/change-notes/released/0.0.6.md @@ -0,0 +1,3 @@ +## 0.0.6 + +No user-facing changes. diff --git a/shared/typetracking/codeql-pack.release.yml b/shared/typetracking/codeql-pack.release.yml index bb45a1ab0182..cf398ce02aa4 100644 --- a/shared/typetracking/codeql-pack.release.yml +++ b/shared/typetracking/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.5 +lastReleaseVersion: 0.0.6 diff --git a/shared/typetracking/qlpack.yml b/shared/typetracking/qlpack.yml index c1d91c841cb2..93e5003b9be7 100644 --- a/shared/typetracking/qlpack.yml +++ b/shared/typetracking/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/typetracking -version: 0.0.6-dev +version: 0.0.6 groups: shared library: true dependencies: diff --git a/shared/typos/CHANGELOG.md b/shared/typos/CHANGELOG.md index 803a23bed1a7..5c1e2e83225c 100644 --- a/shared/typos/CHANGELOG.md +++ b/shared/typos/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.13 + +No user-facing changes. + ## 0.0.12 No user-facing changes. diff --git a/shared/typos/change-notes/released/0.0.13.md b/shared/typos/change-notes/released/0.0.13.md new file mode 100644 index 000000000000..f679eaf0313a --- /dev/null +++ b/shared/typos/change-notes/released/0.0.13.md @@ -0,0 +1,3 @@ +## 0.0.13 + +No user-facing changes. diff --git a/shared/typos/codeql-pack.release.yml b/shared/typos/codeql-pack.release.yml index 997fb8da83cd..044e54e4f7e5 100644 --- a/shared/typos/codeql-pack.release.yml +++ b/shared/typos/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.12 +lastReleaseVersion: 0.0.13 diff --git a/shared/typos/qlpack.yml b/shared/typos/qlpack.yml index e913e54cb728..723b891ab21f 100644 --- a/shared/typos/qlpack.yml +++ b/shared/typos/qlpack.yml @@ -1,4 +1,4 @@ name: codeql/typos -version: 0.0.13-dev +version: 0.0.13 groups: shared library: true diff --git a/shared/util/CHANGELOG.md b/shared/util/CHANGELOG.md index 152fb8942775..3d405b525ea3 100644 --- a/shared/util/CHANGELOG.md +++ b/shared/util/CHANGELOG.md @@ -1,3 +1,7 @@ +## 0.0.6 + +No user-facing changes. + ## 0.0.5 No user-facing changes. diff --git a/shared/util/change-notes/released/0.0.6.md b/shared/util/change-notes/released/0.0.6.md new file mode 100644 index 000000000000..ccbce856079d --- /dev/null +++ b/shared/util/change-notes/released/0.0.6.md @@ -0,0 +1,3 @@ +## 0.0.6 + +No user-facing changes. diff --git a/shared/util/codeql-pack.release.yml b/shared/util/codeql-pack.release.yml index bb45a1ab0182..cf398ce02aa4 100644 --- a/shared/util/codeql-pack.release.yml +++ b/shared/util/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 0.0.5 +lastReleaseVersion: 0.0.6 diff --git a/shared/util/qlpack.yml b/shared/util/qlpack.yml index 27ebf28723dd..b6cab33264fb 100644 --- a/shared/util/qlpack.yml +++ b/shared/util/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/util -version: 0.0.6-dev +version: 0.0.6 groups: shared library: true dependencies: