Skip to content

Conversation

@codeql-ci
Copy link
Collaborator

This PR merges back all of the changes from the release of codeql-cli-2.23.4. And it bumps the version version strings in semmle-code in preparation for the next release of 2.23.5.

@mbg mbg marked this pull request as ready for review November 4, 2025 18:24
Copilot AI review requested due to automatic review settings November 4, 2025 18:24
@mbg mbg requested review from a team as code owners November 4, 2025 18:24
@mbg mbg requested review from a team as code owners November 4, 2025 18:24
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR performs version bumps and changelog consolidation across multiple CodeQL language packs following a release cycle. The changes update version numbers, release metadata, and consolidate change notes from individual feature files into released changelog entries.

  • Version bumps across all language packs (Swift, Rust, Ruby, Python, JavaScript, Java, Go, C#, C++, Actions) and shared libraries
  • Consolidation of pending change notes into official release changelogs
  • Creation of release-specific change note files

Reviewed Changes

Copilot reviewed 183 out of 183 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
swift/ql/src/qlpack.yml Bumped version from 1.2.8-dev to 1.2.9-dev
swift/ql/lib/qlpack.yml Bumped version from 5.0.10-dev to 6.0.1-dev (major version bump)
swift/ql/lib/change-notes/released/6.0.0.md Created changelog for Swift 6.0.0 with breaking changes, new features, and Swift 6.2 support
rust/ql/src/change-notes/released/0.1.19.md Consolidated Rust 0.1.19 release notes with analysis improvements
python/ql/lib/qlpack.yml Bumped version from 4.0.18-dev to 4.1.1-dev (minor version bump)
java/ql/src/change-notes/released/1.9.0.md Created changelog for Java 1.9.0 with new thread safety queries
csharp/ql/lib/change-notes/released/5.3.0.md Created changelog for C# 5.3.0 with major control-flow graph changes
csharp/ql/src/CHANGELOG.md Fixed trailing whitespace issues in existing changelog entries
javascript/extractor/src/com/semmle/js/extractor/EnvironmentVariables.java Added Actions extractor support with new environment variable
javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java Modified extraction logic to handle Actions extractor differently
shared/*/qlpack.yml Version bumps for all shared libraries (yaml, xml, util, typos, typetracking, etc.)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.


### Major Analysis Improvements

* The representation of the C# control-flow graph has been significantly changed. This has minor effects on a wide range of queries including both minor improvements and minor regressions. For example, improved precision has been observed for `cs/inefficient-containskey` and `cs/stringbuilder-creation-in-loop`. Two queries stand out as being significantly affected with great improvements: `cs/dereferenced-value-may-be-null` has been completely rewritten which removes a very significant number of false positives. Furthermore, `cs/constant-condition` has been updated to report many new results - these new results are primarily expected to be true positives, but a few new false positives are expected as well. As part of these changes, `cs/dereferenced-value-may-be-null` has been changed from a `path-problem` query to a `problem` query, so paths are no longer reported for this query.
Copy link

Copilot AI Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] This changelog entry is excessively long (over 700 characters) and difficult to parse. Consider breaking it into multiple bullet points to improve readability. For example, separate the general impact, the improvements to specific queries, and the change in query type.

Suggested change
* The representation of the C# control-flow graph has been significantly changed. This has minor effects on a wide range of queries including both minor improvements and minor regressions. For example, improved precision has been observed for `cs/inefficient-containskey` and `cs/stringbuilder-creation-in-loop`. Two queries stand out as being significantly affected with great improvements: `cs/dereferenced-value-may-be-null` has been completely rewritten which removes a very significant number of false positives. Furthermore, `cs/constant-condition` has been updated to report many new results - these new results are primarily expected to be true positives, but a few new false positives are expected as well. As part of these changes, `cs/dereferenced-value-may-be-null` has been changed from a `path-problem` query to a `problem` query, so paths are no longer reported for this query.
* The representation of the C# control-flow graph has been significantly changed. This has minor effects on a wide range of queries, including both minor improvements and minor regressions.
* Improved precision has been observed for `cs/inefficient-containskey` and `cs/stringbuilder-creation-in-loop`.
* Two queries stand out as being significantly affected with great improvements:
* `cs/dereferenced-value-may-be-null` has been completely rewritten, which removes a very significant number of false positives.
* `cs/constant-condition` has been updated to report many new results. These new results are primarily expected to be true positives, but a few new false positives are expected as well.
* As part of these changes, `cs/dereferenced-value-may-be-null` has been changed from a `path-problem` query to a `problem` query, so paths are no longer reported for this query.

Copilot uses AI. Check for mistakes.
warn("No JavaScript or TypeScript code found.");
}
// ensuring that the finalize steps detects that no code was seen.
// Ensuring that the finalize steps detects that no code was seen.
Copy link

Copilot AI Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Corrected grammar: 'steps' should be singular 'step' or change 'detects' to 'detect'.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants