Merge pull request #16715 from github/release-prep/2.17.5

Release preparation for version 2.17.5
github · Jun 10, 2024 · a160b89 · snoofoxes · Jun 24, 2024 · a160b89
2 parents 7ecf1f9 + 877bfa2
commit a160b89
Show file tree

Hide file tree

Showing 147 changed files with 359 additions and 107 deletions.
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 1.1.0
+
+### New Features
+
+* Data models can now be added with data extensions. In this way source, sink and summary models can be added in extension `.model.yml` files, rather than by writing classes in QL code. New models should be added in the `lib/ext` folder.
+
+### Minor Analysis Improvements
+
+* A partial model for the `Boost.Asio` network library has been added. This includes sources, sinks and summaries for certain functions in `Boost.Asio`, such as `read_until` and `write`.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/cpp/ql/lib/change-notes/2024-06-14-boost-asio.md b/cpp/ql/lib/change-notes/2024-06-14-boost-asio.md
diff --git a/cpp/ql/lib/change-notes/2024-06-14-models-as-data-yml-extensions.md b/cpp/ql/lib/change-notes/2024-06-14-models-as-data-yml-extensions.md
diff --git a/cpp/ql/lib/change-notes/released/1.1.0.md b/cpp/ql/lib/change-notes/released/1.1.0.md
@@ -0,0 +1,9 @@
+## 1.1.0
+
+### New Features
+
+* Data models can now be added with data extensions. In this way source, sink and summary models can be added in extension `.model.yml` files, rather than by writing classes in QL code. New models should be added in the `lib/ext` folder.
+
+### Minor Analysis Improvements
+
+* A partial model for the `Boost.Asio` network library has been added. This includes sources, sinks and summaries for certain functions in `Boost.Asio`, such as `read_until` and `write`.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.1.0
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 1.0.1-dev
+version: 1.1.0
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.0.1
+
+### Minor Analysis Improvements
+
+* The `cpp/dangerous-function-overflow` no longer produces a false positive alert when the `gets` function does not have exactly one parameter.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/...change-notes/2014-06-05-gets-parameter.md → cpp/ql/src/change-notes/released/1.0.1.md b/...change-notes/2014-06-05-gets-parameter.md → cpp/ql/src/change-notes/released/1.0.1.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 1.0.1
+
+### Minor Analysis Improvements
+
 * The `cpp/dangerous-function-overflow` no longer produces a false positive alert when the `gets` function does not have exactly one parameter.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.0.1-dev
+version: 1.0.1
 groups:
   - cpp
   - queries

diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.18
+
+No user-facing changes.
+
 ## 1.7.17
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.18.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.18.md
@@ -0,0 +1,3 @@
+## 1.7.18
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.17
+lastReleaseVersion: 1.7.18
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.18-dev
+version: 1.7.18
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.18
+
+No user-facing changes.
+
 ## 1.7.17
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.18.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.18.md
@@ -0,0 +1,3 @@
+## 1.7.18
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.17
+lastReleaseVersion: 1.7.18
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.18-dev
+version: 1.7.18
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.1
+
+No user-facing changes.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/csharp/ql/lib/change-notes/released/1.0.1.md b/csharp/ql/lib/change-notes/released/1.0.1.md
@@ -0,0 +1,3 @@
+## 1.0.1
+
+No user-facing changes.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 1.0.1-dev
+version: 1.0.1
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.0.1
+
+### Minor Analysis Improvements
+
+* .NET 8 Runtime models have been updated based on the newest version of the model generator. Furthermore, the database sources have been changed slightly to reduce result multiplicity.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/...-notes/2024-05-30-update-dotnet-models.md → csharp/ql/src/change-notes/released/1.0.1.md b/...-notes/2024-05-30-update-dotnet-models.md → csharp/ql/src/change-notes/released/1.0.1.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 1.0.1
+
+### Minor Analysis Improvements
+
 * .NET 8 Runtime models have been updated based on the newest version of the model generator. Furthermore, the database sources have been changed slightly to reduce result multiplicity.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.0.1-dev
+version: 1.0.1
 groups:
   - csharp
   - queries

diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.1
+
+No user-facing changes.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/go/ql/consistency-queries/change-notes/released/1.0.1.md b/go/ql/consistency-queries/change-notes/released/1.0.1.md
@@ -0,0 +1,3 @@
+## 1.0.1
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.1-dev
+version: 1.0.1
 groups:
   - go
   - queries

diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.1.0
+
+### New Features
+
+* When writing models-as-data models, the receiver is now referred to as `Argument[receiver]` rather than `Argument[-1]`.
+* Neutral models are now supported. They have no effect except that a manual neutral summary model will stop a generated summary model from having any effect.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/...05-23-models-as-data-argument-receiver.md → go/ql/lib/change-notes/released/1.1.0.md b/...05-23-models-as-data-argument-receiver.md → go/ql/lib/change-notes/released/1.1.0.md
@@ -1,5 +1,6 @@
----
-category: feature
----
+## 1.1.0
+
+### New Features
+
 * When writing models-as-data models, the receiver is now referred to as `Argument[receiver]` rather than `Argument[-1]`.
 * Neutral models are now supported. They have no effect except that a manual neutral summary model will stop a generated summary model from having any effect.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.1.0
diff --git a/go/ql/lib/qlpack.yml b/go/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 1.0.1-dev
+version: 1.1.0
 groups: go
 dbscheme: go.dbscheme
 extractor: go

diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.1
+
+No user-facing changes.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/go/ql/src/change-notes/released/1.0.1.md b/go/ql/src/change-notes/released/1.0.1.md
@@ -0,0 +1,3 @@
+## 1.0.1
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/go/ql/src/qlpack.yml b/go/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.0.1-dev
+version: 1.0.1
 groups:
   - go
   - queries

diff --git a/java/ql/automodel/src/CHANGELOG.md b/java/ql/automodel/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.1
+
+No user-facing changes.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/java/ql/automodel/src/change-notes/released/1.0.1.md b/java/ql/automodel/src/change-notes/released/1.0.1.md
@@ -0,0 +1,3 @@
+## 1.0.1
+
+No user-facing changes.
diff --git a/java/ql/automodel/src/codeql-pack.release.yml b/java/ql/automodel/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/java/ql/automodel/src/qlpack.yml b/java/ql/automodel/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-automodel-queries
-version: 1.0.1-dev
+version: 1.0.1
 groups:
     - java
     - automodel

diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 1.1.0
+
+### Major Analysis Improvements
+
+* The precision of virtual dispatch has been improved. This increases precision in general for all data flow queries. 
+
+### Minor Analysis Improvements
+
+* Support for Eclipse Compiler for Java (ecj) has been fixed to work with (a) runs that don't pass `-noExit` and (b) runs that use post-Java-9 command-line arguments.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/java/ql/lib/change-notes/2024-05-23-typeflow-precision.md b/java/ql/lib/change-notes/2024-05-23-typeflow-precision.md
diff --git a/java/ql/lib/change-notes/2024-06-05-ecj-support.md b/java/ql/lib/change-notes/2024-06-05-ecj-support.md
diff --git a/java/ql/lib/change-notes/released/1.1.0.md b/java/ql/lib/change-notes/released/1.1.0.md
@@ -0,0 +1,9 @@
+## 1.1.0
+
+### Major Analysis Improvements
+
+* The precision of virtual dispatch has been improved. This increases precision in general for all data flow queries. 
+
+### Minor Analysis Improvements
+
+* Support for Eclipse Compiler for Java (ecj) has been fixed to work with (a) runs that don't pass `-noExit` and (b) runs that use post-Java-9 command-line arguments.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.1.0
diff --git a/java/ql/lib/qlpack.yml b/java/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 1.0.1-dev
+version: 1.1.0
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 1.0.1
+
+### Minor Analysis Improvements
+
+* The query `java/spring-disabled-csrf-protection` detects disabling CSRF via `ServerHttpSecurity$CsrfSpec::disable`.
+* Added more `java.io.File`-related sinks to the path injection query.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/java/ql/src/change-notes/2024-05-27-path-injection-file-sinks.md b/java/ql/src/change-notes/2024-05-27-path-injection-file-sinks.md
diff --git a/java/ql/src/change-notes/2024-05-30-disabled-csrf-query.md b/java/ql/src/change-notes/2024-05-30-disabled-csrf-query.md
diff --git a/java/ql/src/change-notes/released/1.0.1.md b/java/ql/src/change-notes/released/1.0.1.md
@@ -0,0 +1,6 @@
+## 1.0.1
+
+### Minor Analysis Improvements
+
+* The query `java/spring-disabled-csrf-protection` detects disabling CSRF via `ServerHttpSecurity$CsrfSpec::disable`.
+* Added more `java.io.File`-related sinks to the path injection query.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/java/ql/src/qlpack.yml b/java/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 1.0.1-dev
+version: 1.0.1
 groups:
   - java
   - queries

diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.1
+
+No user-facing changes.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/javascript/ql/lib/change-notes/released/1.0.1.md b/javascript/ql/lib/change-notes/released/1.0.1.md
@@ -0,0 +1,3 @@
+## 1.0.1
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1
diff --git a/javascript/ql/lib/qlpack.yml b/javascript/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/javascript-all
-version: 1.0.1-dev
+version: 1.0.1
 groups: javascript
 dbscheme: semmlecode.javascript.dbscheme
 extractor: javascript

diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.1
+
+No user-facing changes.
+
 ## 1.0.0
 
 ### Breaking Changes

diff --git a/javascript/ql/src/change-notes/released/1.0.1.md b/javascript/ql/src/change-notes/released/1.0.1.md
@@ -0,0 +1,3 @@
+## 1.0.1
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.0
+lastReleaseVersion: 1.0.1