v2.12.5

New features

• The codeql pack install command now accepts a --additional-packs option. This option takes a list of directories to search for locally available packs when resolving which packs to install. Any pack that is found locally through --additional-packs will override any other version of a pack found in the package registry. Locally resolved packs are not added to the lock file.

  Because the use of --additional-packs when running codeql pack install makes running queries dependent on the local state of the machine initially invoking codeql pack install, a warning is emitted if any pack is found outside of the package registry. This warning can be suppressed by using the --no-strict-mode option.

Bugs fixed

• Fix a bug in codeql query run where queries whose path contain colons cannot be run.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.12.5.

v2.12.4

Breaking changes

• The default value of the --mode switch to codeql pack install has changed. The default is now --mode minimal-update.
  Previously, it was use-lock.

New features

• The per-pack compilation cache has been replaced with a global compilation cache
  found within ~/.codeql.
• codeql pack install now uses a new algorithm to determine which versions of
  the pack's dependencies to use, based on the PubGrub
  algorithm.
• Added a new command, codeql pack upgrade. This command is similar to codeql pack install,
  except that it ignores any existing lock file, installs the latest compatible version of each
  dependency, and writes a new lock file.
• Added a new command, codeql pack ci. This command is similar to codeql pack install,
  except if the existing lock file is missing, or if it conflicts with the version constraints in
  the qlpack.yml file, the command generates an error.

Deprecations

• The --freeze switch for codeql pack create, codeql pack bundle, and codeql pack publish
  is now deprecated and ignored, as there is no longer a cache within a pack.
• The --mode update switch to codeql pack resolve-dependencies is now deprecated.
• The --mode switch to codeql pack install is now deprecated.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.12.4.

v2.12.3

New features

• The CodeQL compiler now produces better error messages when it is unable to find a QL library that the query being evaluated depends on.

Bugs fixed

• Fixed a bug where the CLI would refuse to complete database creation if the OS reports less than about 1.5 GB of physical memory.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.12.3.

v2.12.2

Bugs fixed

• Fixed a QL evaluator bug introduced in release 2.12.1 which could in certain rare cases lead to wrong analysis results.

• Fixed handling of -Xclang <arg> arguments passed to the clang compiler which could cause missing extractions for C++ code bases.

• Fixed a bug where the --overwrite option was failing for database clusters.

Miscellaneous

• The build of Eclipse Temurin OpenJDK that is bundled with the CodeQL CLI has been updated to version 17.0.6.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.12.2.

v2.12.1

New features

• Added a new command-line flag --expect-discarded-cache, which gives a hint to the evaluator that the evaluation cache will be discarded after analysis completes. This allows it to avoid some unnecessary writes to the cache, for predicates that aren't needed by the query/suite being evaluated.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.12.1.

v2.12.0

Breaking changes

• The --[no-]count-lines option to codeql database create and related commands that was
  deprecated in 2.11.1 has been removed. Users of this option should instead pass
  --[no-]calculate-baseline.

New features

• Query packs created by codeql pack create, codeql pack bundle, and codeql pack release now
  contain precompiled queries in a new format that aims to be compatible with future (and, to a
  certain extent, past) releases of the CodeQL CLI. Previously the precompiled queries were in a
  format specific to each CLI release, and all other releases would need to re-compile queries.
• The codeql database init command now accepts a PAT that allows you to download queries from
  external, private repositories when using the --codescanning-config <config-file> option.
• The baseline information produced by codeql database init and
  codeql database create now accounts for
  paths and paths-ignore configuration.
• In the VS Code extension, recursive calls will be marked with inlay
  hints.
• The CLI now gives a more helpful error message when asked to run queries on a
  database that has not been finalized.

Bugs fixed

• Fixed a bug where the codeql pack install command would fail if
  a CodeQL configuration file
  is used and the --additional-packs option is specified.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.12.0.

v2.11.6

Breaking changes

• Java and Kotlin analyses in this release of the CLI and all earlier releases are incompatible with Kotlin 1.7.30 and later. To prevent code scanning alerts being spuriously dismissed, Java and Kotlin analyses will now fail when using Kotlin 1.7.30 or later.

Bugs fixed

• Fixed a bug where it was not possible to run queries in CodeQL query packs for C# that use the legacy libraryPathDependencies property in their qlpack.yml file. The associated error message complained about undefined extensional predicates.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.11.6.

v2.11.5

Bugs Fixed

• Fixed a bug that could cause log summary generation to fail in vscode.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.11.5.

v2.11.4

New features

• Kotlin support is now in beta. This means that Java analyses will also include Kotlin code by default.

Potentially breaking changes

• CodeQL 2.11.1 to 2.11.3 contained a bug in indirect build tracing on Windows. See the full notes in the CodeQL CLI changelog for details.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.11.4.

v2.11.3

Breaking changes

• The codeql pack ls --format json deep plumbing command now returns only the name and version properties for each found pack.

Potentially breaking changes

• codeql pack download, codeql pack install, and codeql pack add will ignore CodeQL packs with pre-release versions, unless the --allow-prerelease option is passed to the command. This brings these commands into alignment with codeql pack publish that will avoid publishing CodeQL packs with pre-release versions unless the --allow-prerelease option is specified.

Deprecations

• The --[no-]fast-compilation option to codeql query compile is now deprecated.

New features

• codeql resolve files and codeql database index-files have a new --find-any option, which finds at most one match.

Miscellaneous

• The build of Apache Commons Text that is bundled with the CodeQL CLI has been updated to version 1.10.0. While previous releases shipped with version 1.6 of the library, no part of the CodeQL CLI references the StringSubstitutor class that the recently disclosed CVE-2022-42889 vulnerability applies to. We therefore do not believe that running previous releases of CodeQL exposes users to this vulnerability.
• The build of Eclipse Temurin OpenJDK that is bundled with the CodeQL CLI has been updated to version 17.0.5.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.11.3.