Skip to content

Pull requests: github/codeql

New pull request New
406 Open 16,545 Closed
406 Open 16,545 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Extend actions/unpinned-tag to analyze composite action metadata (action.yml / action.yaml)
#21692 opened Apr 10, 2026 by Copilot AI • Draft
@oscarsj
Bump the extractor-dependencies group in /go/extractor with 2 updates dependencies Pull requests that update a dependency file Go
#21691 opened Apr 10, 2026 by dependabot bot Loading…
Python: Port NonIteratorInForLoop.ql no-change-note-required This PR does not need a change note Python
#21688 opened Apr 9, 2026 by tausbn Contributor • Draft
Python: Port InconsistentMRO.ql no-change-note-required This PR does not need a change note Python
#21687 opened Apr 9, 2026 by tausbn Contributor • Draft
Python: Port HashedButNoHash.ql no-change-note-required This PR does not need a change note Python
#21686 opened Apr 9, 2026 by tausbn Contributor • Draft
1
C#: Improve BMN feed checking & handling. C# documentation
#21684 opened Apr 9, 2026 by michaelnebel Contributor • Draft
1
Python: Port ContainsNonContainer.ql no-change-note-required This PR does not need a change note Python
#21680 opened Apr 9, 2026 by tausbn Contributor • Draft
Rust: Replace recursion through forall with ranked recursion Rust Pull requests that update Rust code
#21679 opened Apr 9, 2026 by hvitved Contributor • Draft
2
Actions: Add experimental queries for AI output validation CWE 1426 Actions Analysis of GitHub Actions documentation
#21678 opened Apr 9, 2026 by data-douser Contributor • Draft
1
Bump buildifier_prebuilt from 6.4.0 to 8.5.1.2 bazel Pull requests that update bazel code dependencies Pull requests that update a dependency file
#21676 opened Apr 9, 2026 by dependabot bot Loading…
Actions: Add experimental prompt injection queries for CWE 1427 Actions Analysis of GitHub Actions documentation
#21675 opened Apr 9, 2026 by data-douser Contributor • Draft
2
Add extra source to actions CWE-094/CodeInjectionMedium Actions Analysis of GitHub Actions documentation
#21672 opened Apr 8, 2026 by knewbury01 Contributor Loading…
@knewbury01
3
Python: Add exception, reachability, and other kinds of modelling no-change-note-required This PR does not need a change note Python
#21668 opened Apr 8, 2026 by tausbn Contributor • Draft
Swift: Update to Swift 6.3 documentation Swift
#21667 opened Apr 8, 2026 by jketema Contributor Loading…
5
Rename CONTRIBUTING.md to 1CONTRIBUTING.md documentation
#21664 opened Apr 7, 2026 by g66b166-hub Loading…
Actions: Add workflow_dispatch and workflow_call input sources for code injection Actions Analysis of GitHub Actions documentation
#21660 opened Apr 6, 2026 by tspascoal Contributor Loading…
8
Post-release preparation for codeql-cli-2.25.2 Actions Analysis of GitHub Actions C# C++ DataFlow Library documentation Go Java JS Python Ruby Rust Pull requests that update Rust code Swift
#21658 opened Apr 6, 2026 by codeql-ci Collaborator • Draft
@oscarsj
Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers documentation Java
#21656 opened Apr 4, 2026 by MarkLee131 Contributor Loading…
4
Java: treat hash/encrypt/digest methods as sensitive-log sanitizers documentation Java
#21654 opened Apr 4, 2026 by MarkLee131 Contributor Loading…
1
1
Java: recognize Path.toRealPath() as path normalization sanitizer documentation Java
#21652 opened Apr 4, 2026 by MarkLee131 Contributor Loading…
1
1
Java: reduce false positives in sensitive-log documentation Java
#21650 opened Apr 4, 2026 by MarkLee131 Contributor Loading…
1
3
JavaScript: Add setHTMLUnsafe and parseHTMLUnsafe as XSS sinks JS
#21648 opened Apr 3, 2026 by sunnyeo Loading…
1
Bump google.golang.org/protobuf from 1.30.0 to 1.33.0 in /go/ql/test/query-tests/Security/CWE-347 dependencies Pull requests that update a dependency file documentation Go
#21644 opened Apr 3, 2026 by dependabot bot Loading…
Bump golang.org/x/crypto from 0.7.0 to 0.45.0 in /go/ql/test/library-tests/semmle/go/frameworks/Fasthttp dependencies Pull requests that update a dependency file documentation Go
#21643 opened Apr 3, 2026 by dependabot bot Loading…
Improve prompt inject for Python no-change-note-required This PR does not need a change note Python
#21641 opened Apr 2, 2026 by josefs • Draft
4
ProTip! Exclude everything labeled bug with -label:bug.