github · henrymercer · Sep 3, 2026 · Sep 3, 2026
@@ -1,3 +1,14 @@
+## 0.6.1
+
+### New Features
+
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.
+
+### Minor Analysis Improvements
+
+* Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
+
 ## 0.6.0
 
 ### Breaking Changes

@@ -1,4 +1,10 @@
----
-category: minorAnalysis
----
+## 0.6.1
+
+### New Features
+
+* GitHub Actions databases now extract `actions.lock` files. The new `ActionsLock` class
+  provides access to their YAML abstract syntax trees.
+
+### Minor Analysis Improvements
+
 * Checks on author association fields read from the event payload (e.g. `github.event.pull_request.author_association`) now only count as protection for events whose payload actually populates that field. Previously, a condition such as `github.event.pull_request.author_association != 'NONE'` on a workflow triggered by `issues` events was treated as a protective check even though `github.event.pull_request` is not populated for `issues` events, which makes the condition vacuous. This change may result in more alerts for queries using the `ControlCheck` class.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.0
+lastReleaseVersion: 0.6.1
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.6.1-dev
+version: 0.6.1
 library: true
 warnOnImplicitThis: true
 dependencies:

@@ -1,3 +1,7 @@
+## 0.6.35
+
+No user-facing changes.
+
 ## 0.6.34
 
 ### Minor Analysis Improvements

@@ -0,0 +1,3 @@
+## 0.6.35
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.34
+lastReleaseVersion: 0.6.35
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.35-dev
+version: 0.6.35
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

@@ -1,3 +1,14 @@
+## 12.1.0
+
+### New Features
+
+* Sources and sinks defined using models-as-data now support access paths with fields. For example, the path `ReturnValue.Field[S::f]` makes the field `S::f` a flow source when it is returned by a call.
+
+### Minor Analysis Improvements
+
+* Added the PostgreSQL libpq (asynchronous) query-execution functions `PQexec`, `PQexecParams`, `PQprepare`, `PQsendQuery`, `PQsendQueryParams`, `PQsendPrepare` as `sql-injection` sinks.
+* Initializers of compiler-generated variables are now recognized as compiler-generated. A new predicate `isCompilerGenerated` on `Initializer` has been added to reflect this.
+
 ## 12.0.3
 
 No user-facing changes.

@@ -0,0 +1,10 @@
+## 12.1.0
+
+### New Features
+
+* Sources and sinks defined using models-as-data now support access paths with fields. For example, the path `ReturnValue.Field[S::f]` makes the field `S::f` a flow source when it is returned by a call.
+
+### Minor Analysis Improvements
+
+* Added the PostgreSQL libpq (asynchronous) query-execution functions `PQexec`, `PQexecParams`, `PQprepare`, `PQsendQuery`, `PQsendQueryParams`, `PQsendPrepare` as `sql-injection` sinks.
+* Initializers of compiler-generated variables are now recognized as compiler-generated. A new predicate `isCompilerGenerated` on `Initializer` has been added to reflect this.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 12.0.3
+lastReleaseVersion: 12.1.0
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 12.0.4-dev
+version: 12.1.0
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

@@ -1,3 +1,9 @@
+## 1.8.3
+
+### Minor Analysis Improvements
+
+* The `cpp/leap-year/unsafe-array-for-days-of-the-year` query ("Unsafe array for days of the year") no longer reports an alert on the `__PRETTY_FUNCTION__` variable (and related variables) when the enclosing function has a signature that is exactly 364 characters.
+
 ## 1.8.2
 
 No user-facing changes.

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* The `cpp/leap-year/unsafe-array-for-days-of-the-year` query ("Unsafe array for days of the year") no longer reports an alert on the `__PRETTY_FUNCTION__` variable (and related variables) when the enclosing function has a signature that is exactly 364 characters.
+## 1.8.3
+
+### Minor Analysis Improvements
+
+* The `cpp/leap-year/unsafe-array-for-days-of-the-year` query ("Unsafe array for days of the year") no longer reports an alert on the `__PRETTY_FUNCTION__` variable (and related variables) when the enclosing function has a signature that is exactly 364 characters.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.8.2
+lastReleaseVersion: 1.8.3
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.8.3-dev
+version: 1.8.3
 groups:
   - cpp
   - queries

@@ -1,3 +1,7 @@
+## 1.7.74
+
+No user-facing changes.
+
 ## 1.7.73
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.74
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.73
+lastReleaseVersion: 1.7.74
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.74-dev
+version: 1.7.74
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,7 @@
+## 1.7.74
+
+No user-facing changes.
+
 ## 1.7.73
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.74
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.73
+lastReleaseVersion: 1.7.74
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.74-dev
+version: 1.7.74
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,15 @@
+## 7.3.0
+
+### New Features
+
+* Added taint modeling for OData action parameter binding (`Microsoft.AspNet.OData`/`Microsoft.AspNetCore.OData`). Values cast, `as`-converted, or type-tested out of `ODataActionParameters`, and entities tracked by `Delta<T>` (via `GetInstance`, `Patch`, `Put`, `CopyChangedValues`, and `CopyUnchangedValues`), now taint the members of the target type.
+
+### Minor Analysis Improvements
+
+* In `build-mode: none`, project and solution restoration is now always attempted using the feeds available.
+* C# analysis with build mode `none` now lists unreachable explicitly configured NuGet feeds in both the extraction warning and the tool status page note. This makes it easier to identify feeds that may cause dependencies to be missing from the analysis.
+* Improved ASP.NET Core MVC controller and action discovery to more closely match runtime behavior, including application parts, endpoint mappings, inherited actions, and controller and action exclusions. Service-injected action parameters are no longer modeled as remote input.
+
 ## 7.2.0
 
 ### New Features

@@ -0,0 +1,11 @@
+## 7.3.0
+
+### New Features
+
+* Added taint modeling for OData action parameter binding (`Microsoft.AspNet.OData`/`Microsoft.AspNetCore.OData`). Values cast, `as`-converted, or type-tested out of `ODataActionParameters`, and entities tracked by `Delta<T>` (via `GetInstance`, `Patch`, `Put`, `CopyChangedValues`, and `CopyUnchangedValues`), now taint the members of the target type.
+
+### Minor Analysis Improvements
+
+* In `build-mode: none`, project and solution restoration is now always attempted using the feeds available.
+* C# analysis with build mode `none` now lists unreachable explicitly configured NuGet feeds in both the extraction warning and the tool status page note. This makes it easier to identify feeds that may cause dependencies to be missing from the analysis.
+* Improved ASP.NET Core MVC controller and action discovery to more closely match runtime behavior, including application parts, endpoint mappings, inherited actions, and controller and action exclusions. Service-injected action parameters are no longer modeled as remote input.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.2.0
+lastReleaseVersion: 7.3.0
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 7.2.1-dev
+version: 7.3.0
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

@@ -1,3 +1,9 @@
+## 1.9.3
+
+### Minor Analysis Improvements
+
+* The `cs/linq/missed-where` query no longer flags `foreach` loops where the matching branch terminates the method, iterator, or loop instead of continuing with filtered loop work.
+
 ## 1.9.2
 
 ### Minor Analysis Improvements

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 1.9.3
+
+### Minor Analysis Improvements
+
 * The `cs/linq/missed-where` query no longer flags `foreach` loops where the matching branch terminates the method, iterator, or loop instead of continuing with filtered loop work.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.9.2
+lastReleaseVersion: 1.9.3
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.9.3-dev
+version: 1.9.3
 groups:
   - csharp
   - queries

@@ -1,3 +1,7 @@
+## 1.0.57
+
+No user-facing changes.
+
 ## 1.0.56
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.0.57
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.56
+lastReleaseVersion: 1.0.57
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.57-dev
+version: 1.0.57
 groups:
   - go
   - queries

@@ -1,3 +1,7 @@
+## 7.3.1
+
+No user-facing changes.
+
 ## 7.3.0
 
 ### Major Analysis Improvements

@@ -0,0 +1,3 @@
+## 7.3.1
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.3.0
+lastReleaseVersion: 7.3.1
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 7.3.1-dev
+version: 7.3.1
 groups: go
 dbscheme: go.dbscheme
 extractor: go

@@ -1,3 +1,7 @@
+## 1.6.10
+
+No user-facing changes.
+
 ## 1.6.9
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.6.10
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.6.9
+lastReleaseVersion: 1.6.10
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.6.10-dev
+version: 1.6.10
 groups:
   - go
   - queries

@@ -1,3 +1,14 @@
+## 9.3.0
+
+### New Features
+
+* Factories returned by the Apache Commons Secure XML (`org.apache.commons.xml.secure`) hardening library's `SecureDocumentBuilderFactory`, `SecureSAXParserFactory`, `SecureXMLInputFactory`, `SecureTransformerFactory` and `SecureSchemaFactory` classes are now recognized as safely configured by the XXE query.
+* A new extensible class `SafeXmlFactorySource` was added to `semmle.code.java.security.XmlParsers` for modeling sources of pre-hardened JAXP factories.
+
+### Minor Analysis Improvements
+
+* Added modeling for the Micronaut framework, including HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.
+
 ## 9.2.4
 
 ### Minor Analysis Improvements

@@ -1,5 +1,10 @@
----
-category: feature
----
+## 9.3.0
+
+### New Features
+
 * Factories returned by the Apache Commons Secure XML (`org.apache.commons.xml.secure`) hardening library's `SecureDocumentBuilderFactory`, `SecureSAXParserFactory`, `SecureXMLInputFactory`, `SecureTransformerFactory` and `SecureSchemaFactory` classes are now recognized as safely configured by the XXE query.
 * A new extensible class `SafeXmlFactorySource` was added to `semmle.code.java.security.XmlParsers` for modeling sources of pre-hardened JAXP factories.
+
+### Minor Analysis Improvements
+
+* Added modeling for the Micronaut framework, including HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 9.2.4
+lastReleaseVersion: 9.3.0