diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md index 07a807f58118..a252887c7ab3 100644 --- a/cpp/ql/lib/CHANGELOG.md +++ b/cpp/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.1.1 + +No user-facing changes. + ## 1.1.0 ### New Features diff --git a/cpp/ql/lib/change-notes/released/1.1.1.md b/cpp/ql/lib/change-notes/released/1.1.1.md new file mode 100644 index 000000000000..7fb56d366105 --- /dev/null +++ b/cpp/ql/lib/change-notes/released/1.1.1.md @@ -0,0 +1,3 @@ +## 1.1.1 + +No user-facing changes. diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml index 2ac15439f561..1a19084be3f7 100644 --- a/cpp/ql/lib/codeql-pack.release.yml +++ b/cpp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.1.0 +lastReleaseVersion: 1.1.1 diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml index cd3b312c4f21..97ef52e32e17 100644 --- a/cpp/ql/lib/qlpack.yml +++ b/cpp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-all -version: 1.1.1-dev +version: 1.1.2-dev groups: cpp dbscheme: semmlecode.cpp.dbscheme extractor: cpp diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md index 6220366fce3d..b97d4226e1c4 100644 --- a/cpp/ql/src/CHANGELOG.md +++ b/cpp/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.0.2 + +No user-facing changes. + ## 1.0.1 ### Minor Analysis Improvements diff --git a/cpp/ql/src/change-notes/released/1.0.2.md b/cpp/ql/src/change-notes/released/1.0.2.md new file mode 100644 index 000000000000..5c0259c4959d --- /dev/null +++ b/cpp/ql/src/change-notes/released/1.0.2.md @@ -0,0 +1,3 @@ +## 1.0.2 + +No user-facing changes. diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml index 2f5886268c61..71f311e736a6 100644 --- a/cpp/ql/src/codeql-pack.release.yml +++ b/cpp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.0.1 +lastReleaseVersion: 1.0.2 diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml index bb0e03fecd5a..0b8404ea8eec 100644 --- a/cpp/ql/src/qlpack.yml +++ b/cpp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/cpp-queries -version: 1.0.2-dev +version: 1.0.3-dev groups: - cpp - queries diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md index bbb697a9b542..a82949387012 100644 --- a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.7.19 + +No user-facing changes. + ## 1.7.18 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.19.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.19.md new file mode 100644 index 000000000000..caf5d2a6d4ec --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.19.md @@ -0,0 +1,3 @@ +## 1.7.19 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml index e516d2acfd5c..c93ed8d67b9f 100644 --- a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.7.18 +lastReleaseVersion: 1.7.19 diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml index b841613f7deb..95fb6b6b98a7 100644 --- a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-all -version: 1.7.19-dev +version: 1.7.20-dev groups: - csharp - solorigate diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md index bbb697a9b542..a82949387012 100644 --- a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md +++ b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.7.19 + +No user-facing changes. + ## 1.7.18 No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.19.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.19.md new file mode 100644 index 000000000000..caf5d2a6d4ec --- /dev/null +++ b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.19.md @@ -0,0 +1,3 @@ +## 1.7.19 + +No user-facing changes. diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml index e516d2acfd5c..c93ed8d67b9f 100644 --- a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml +++ b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.7.18 +lastReleaseVersion: 1.7.19 diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml index 27b5722a6336..f2c028483b0d 100644 --- a/csharp/ql/campaigns/Solorigate/src/qlpack.yml +++ b/csharp/ql/campaigns/Solorigate/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-solorigate-queries -version: 1.7.19-dev +version: 1.7.20-dev groups: - csharp - solorigate diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md index 0b3326f0e26d..cd1d5307b891 100644 --- a/csharp/ql/lib/CHANGELOG.md +++ b/csharp/ql/lib/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.0.2 + +No user-facing changes. + ## 1.0.1 No user-facing changes. diff --git a/csharp/ql/lib/change-notes/released/1.0.2.md b/csharp/ql/lib/change-notes/released/1.0.2.md new file mode 100644 index 000000000000..5c0259c4959d --- /dev/null +++ b/csharp/ql/lib/change-notes/released/1.0.2.md @@ -0,0 +1,3 @@ +## 1.0.2 + +No user-facing changes. diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml index 2f5886268c61..71f311e736a6 100644 --- a/csharp/ql/lib/codeql-pack.release.yml +++ b/csharp/ql/lib/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.0.1 +lastReleaseVersion: 1.0.2 diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml index 8310b0a03646..bd2e4acaea51 100644 --- a/csharp/ql/lib/qlpack.yml +++ b/csharp/ql/lib/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-all -version: 1.0.2-dev +version: 1.0.3-dev groups: csharp dbscheme: semmlecode.csharp.dbscheme extractor: csharp diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md index f01de76bce8e..fccbebebc8dd 100644 --- a/csharp/ql/src/CHANGELOG.md +++ b/csharp/ql/src/CHANGELOG.md @@ -1,3 +1,7 @@ +## 1.0.2 + +No user-facing changes. + ## 1.0.1 ### Minor Analysis Improvements diff --git a/csharp/ql/src/change-notes/released/1.0.2.md b/csharp/ql/src/change-notes/released/1.0.2.md new file mode 100644 index 000000000000..5c0259c4959d --- /dev/null +++ b/csharp/ql/src/change-notes/released/1.0.2.md @@ -0,0 +1,3 @@ +## 1.0.2 + +No user-facing changes. diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml index 2f5886268c61..71f311e736a6 100644 --- a/csharp/ql/src/codeql-pack.release.yml +++ b/csharp/ql/src/codeql-pack.release.yml @@ -1,2 +1,2 @@ --- -lastReleaseVersion: 1.0.1 +lastReleaseVersion: 1.0.2 diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml index 51f40420b0a1..d0f00f8b608d 100644 --- a/csharp/ql/src/qlpack.yml +++ b/csharp/ql/src/qlpack.yml @@ -1,5 +1,5 @@ name: codeql/csharp-queries -version: 1.0.2-dev +version: 1.0.3-dev groups: - csharp - queries diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.4.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.4.rst index b8048e5ffd6f..aa1d16332da1 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.4.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.4.rst @@ -19,7 +19,10 @@ CodeQL 2.17.4 runs a total of 414 security queries when configured with the Defa CodeQL CLI ---------- -There are no user-facing CLI changes in this release. +New Features +~~~~~~~~~~~~ + +* CodeQL package management is now generally available, and all GitHub-produced CodeQL packages have had their version numbers increased to 1.0.0. Query Packs ----------- diff --git a/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.5.rst b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.5.rst new file mode 100644 index 000000000000..62ba5fad39a9 --- /dev/null +++ b/docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.5.rst @@ -0,0 +1,127 @@ +.. _codeql-cli-2.17.5: + +========================== +CodeQL 2.17.5 (2024-06-12) +========================== + +.. contents:: Contents + :depth: 2 + :local: + :backlinks: none + +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog `__, `relevant GitHub Changelog updates `__, `changes in the CodeQL extension for Visual Studio Code `__, and the `CodeQL Action changelog `__. + +Security Coverage +----------------- + +CodeQL 2.17.5 runs a total of 414 security queries when configured with the Default suite (covering 161 CWE). The Extended suite enables an additional 131 queries (covering 35 more CWE). + +CodeQL CLI +---------- + +Breaking Changes +~~~~~~~~~~~~~~~~ + +* All the commands that output SARIF will output a minified version to reduce the size. + The :code:`codeql database analyze`, :code:`codeql database interpret-results`, :code:`codeql generate query-help`, and :code:`codeql bqrs interpret` commands support the option :code:`--no-sarif-minify` to output a pretty printed SARIF file. + +* A number of breaking changes have been made to the :code:`semmle-extractor-options` functionality available for C and C++ CodeQL tests. + + * The Arm, Intel, and CodeWarrior compilers are no longer supported and the + :code:`--armcc`, :code:`--intel`, :code:`--codewarrior` flags are now ignored, as are all the flags that only applied to those compilers. + * The :code:`--threads` and :code:`-main-file-name` options, which did not have any effect on tests, are now ignored. Any specification of these options as part of + :code:`semmle-extractor-options` should be removed. + * Support for :code:`--linker`, all flags that would only invoke the preprocessor, + and the :code:`/clr` flag have been removed, as those flags would never produce any usable test output. + * Support for the :code:`--include_path_environment` flag has been removed. All include paths should directly be specified as part of :code:`semmle-extractor-options`. + * Microsoft C/C++ compiler response files specified via :code:`@some_file_name` are now ignored. Instead, all options should directly be specified as part of + :code:`semmle-extractor-options`. + * Support for Microsoft :code:`#import` preprocessor directive has been removed, as support depends on the availability of the Microsoft C/C++ compiler, and availability cannot be guaranteed on all platforms while executing tests. + * Support for the Microsoft :code:`/EHa`, :code:`/EHs`, :code:`/GX`, :code:`/GZ`, :code:`/Tc`, :code:`/Tp`, and :code:`/Zl` flags, and all :code:`/RTC` flags have been removed. Any specification of these options as part of :code:`semmle-extractor-options` should be removed. + * Support for the Apple-specific :code:`-F` and :code:`-iframework` flags has been removed. + The :code:`-F` flag can still be used by replacing :code:`-F ` by + :code:`--edg -F --edg `. Any occurrence of :code:`-iframework ` should be replaced by :code:`--edg --sys_framework --edg `. + * Support for the :code:`/TC`, :code:`/TP`, and :code:`-x` flags has been removed. Please ensure all C, respectively C++, source files have a :code:`.c`, respectively :code:`.cpp`, + extension. + * The :code:`--build_error_dir`, :code:`-db`, :code:`--edg_base_dir`, :code:`--error_limit`, + :code:`--src_archive`, :code:`--trapfolder`, and :code:`--variadic_macros` flags are now ignored. + + The above changes do not affect the creation of databases through the CodeQL CLI, + or when calling the C/C++ extractor directly with the :code:`--mimic` or :code:`--linker` flags. + Similar functionality continues to be supported in those scenarios, except for CodeWarrior and the :code:`--edg_base_dir`, :code:`--include_path_environment`, :code:`/Tc`, and :code:`/Tp` flags, which were never supported. + +Improvements +~~~~~~~~~~~~ + +* :code:`codeql generate log-summary` now reports completed pipeline runs that are part of an incomplete recursive predicate. + +Miscellaneous +~~~~~~~~~~~~~ + +* The OWASP Java HTML Sanitizer library used by the CodeQL CLI for internal documentation generation commands has been updated to version + \ `20240325.1 `__. + +Query Packs +----------- + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* The :code:`cpp/dangerous-function-overflow` no longer produces a false positive alert when the :code:`gets` function does not have exactly one parameter. + +C# +"" + +* .NET 8 Runtime models have been updated based on the newest version of the model generator. Furthermore, the database sources have been changed slightly to reduce result multiplicity. + +Java +"""" + +* The query :code:`java/spring-disabled-csrf-protection` detects disabling CSRF via :code:`ServerHttpSecurity$CsrfSpec::disable`. +* Added more :code:`java.io.File`\ -related sinks to the path injection query. + +Python +"""""" + +* Added models for :code:`opml` library. + +Language Libraries +------------------ + +Major Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Java +"""" + +* The precision of virtual dispatch has been improved. This increases precision in general for all data flow queries. + +Minor Analysis Improvements +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +C/C++ +""""" + +* A partial model for the :code:`Boost.Asio` network library has been added. This includes sources, sinks and summaries for certain functions in :code:`Boost.Asio`, such as :code:`read_until` and :code:`write`. + +Java +"""" + +* Support for Eclipse Compiler for Java (ecj) has been fixed to work with (a) runs that don't pass :code:`-noExit` and (b) runs that use post-Java-9 command-line arguments. + +New Features +~~~~~~~~~~~~ + +C/C++ +""""" + +* Data models can now be added with data extensions. In this way source, sink and summary models can be added in extension :code:`.model.yml` files, rather than by writing classes in QL code. New models should be added in the :code:`lib/ext` folder. + +Golang +"""""" + +* When writing models-as-data models, the receiver is now referred to as :code:`Argument[receiver]` rather than :code:`Argument[-1]`. +* Neutral models are now supported. They have no effect except that a manual neutral summary model will stop a generated summary model from having any effect. diff --git a/docs/codeql/codeql-overview/codeql-changelog/index.rst b/docs/codeql/codeql-overview/codeql-changelog/index.rst index 4ebcbe6c3177..efed5f453b77 100644 --- a/docs/codeql/codeql-overview/codeql-changelog/index.rst +++ b/docs/codeql/codeql-overview/codeql-changelog/index.rst @@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here