Merge pull request #16098 from github/revert-16085-release-prep/2.17.0

Revert "Release preparation for version 2.17.0"
github · Apr 2, 2024 · b87cf3c · b87cf3c
2 parents 48f9343 + 6c649c8
commit b87cf3c
Show file tree

Hide file tree

Showing 173 changed files with 249 additions and 478 deletions.
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
@@ -1,18 +1,3 @@
-## 0.12.10
-
-### New Features
-
-* Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
-* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
-* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
-* Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
-* Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.
-
-### Minor Analysis Improvements
-
-* Added destructors for temporary objects with extended lifetimes to the intermediate representation.
-
 ## 0.12.9
 
 No user-facing changes.

diff --git a/cpp/ql/lib/change-notes/2024-03-15-switches-in-guard-conditions.md b/cpp/ql/lib/change-notes/2024-03-15-switches-in-guard-conditions.md
@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a predicate `GuardCondition.valueControls` to query whether a basic block is guarded by a particular `case` of a `switch` statement.
diff --git a/cpp/ql/lib/change-notes/2024-03-19-ir-temp-extended-destructors.md b/cpp/ql/lib/change-notes/2024-03-19-ir-temp-extended-destructors.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added destructors for temporary objects with extended lifetimes to the intermediate representation.
diff --git a/cpp/ql/lib/change-notes/2024-03-19-predicates-for-switches-as-guards-2.md b/cpp/ql/lib/change-notes/2024-03-19-predicates-for-switches-as-guards-2.md
@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* Added a predicate `GuardCondition.comparesLt/4` to query whether an expression is compared to a constant. 
+* Added a predicate `GuardCondition.ensuresLt/4` to query whether a basic block is guarded by an expression being less than a constant.
diff --git a/cpp/ql/lib/change-notes/2024-03-19-predicates-for-switches-as-guards.md b/cpp/ql/lib/change-notes/2024-03-19-predicates-for-switches-as-guards.md
@@ -0,0 +1,5 @@
+---
+category: feature
+---
+* Added a predicate `GuardCondition.comparesEq/4` to query whether an expression is compared to a constant. 
+* Added a predicate `GuardCondition.ensuresEq/4` to query whether a basic block is guarded by an expression being equal to a constant.
diff --git a/cpp/ql/lib/change-notes/2024-03-26-taint-inheriting-content.md b/cpp/ql/lib/change-notes/2024-03-26-taint-inheriting-content.md
@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added a `TaintInheritingContent` class that can be extended to model taint flowing from a qualifier to a field.
diff --git a/cpp/ql/lib/change-notes/released/0.12.10.md b/cpp/ql/lib/change-notes/released/0.12.10.md
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.12.10
+lastReleaseVersion: 0.12.9
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.12.10
+version: 0.12.10-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
@@ -1,19 +1,3 @@
-## 0.9.9
-
-### New Queries
-
-* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
-
-### Query Metadata Changes
-
-* `@precision medium` metadata was added to the `cpp/boost/tls-settings-misconfiguration` and `cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The `@name` metadata of these queries were also updated.
-
-### Minor Analysis Improvements
-
-* The "Missing return-value check for a 'scanf'-like function" query (`cpp/missing-check-scanf`) has been converted to a `path-problem` query.
-* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) has been converted to a `path-problem` query.
-* Added models for `GLib` allocation and deallocation functions.
-
 ## 0.9.8
 
 No user-facing changes.

diff --git a/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md b/cpp/ql/src/change-notes/2024-03-05-type-confusion-query.md
@@ -0,0 +1,4 @@
+---
+category: newQuery
+---
+* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
diff --git a/cpp/ql/src/change-notes/2024-03-13-glib-alloc-and-dealloc.md b/cpp/ql/src/change-notes/2024-03-13-glib-alloc-and-dealloc.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added models for `GLib` allocation and deallocation functions.
diff --git a/cpp/ql/src/change-notes/2024-03-18-uninitialized-local-path-problem.md b/cpp/ql/src/change-notes/2024-03-18-uninitialized-local-path-problem.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Potentially uninitialized local variable" query (`cpp/uninitialized-local`) has been converted to a `path-problem` query.
diff --git a/cpp/ql/src/change-notes/2024-03-20-missing-check-scanf-path-problem.md b/cpp/ql/src/change-notes/2024-03-20-missing-check-scanf-path-problem.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The "Missing return-value check for a 'scanf'-like function" query (`cpp/missing-check-scanf`) has been converted to a `path-problem` query.
diff --git a/cpp/ql/src/change-notes/2024-03-22-boost-ssl.md b/cpp/ql/src/change-notes/2024-03-22-boost-ssl.md
@@ -0,0 +1,4 @@
+---
+category: queryMetadata
+---
+* `@precision medium` metadata was added to the `cpp/boost/tls-settings-misconfiguration` and `cpp/boost/use-of-deprecated-hardcoded-security-protocol` queries, and these queries are now included in the security-extended suite. The `@name` metadata of these queries were also updated.
diff --git a/cpp/ql/src/change-notes/released/0.9.9.md b/cpp/ql/src/change-notes/released/0.9.9.md
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.9.9
+lastReleaseVersion: 0.9.8
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 0.9.9
+version: 0.9.9-dev
 groups:
   - cpp
   - queries

diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.13
-
-No user-facing changes.
-
 ## 1.7.12
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.13.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.13.md
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.13
+lastReleaseVersion: 1.7.12
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.13
+version: 1.7.13-dev
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 1.7.13
-
-No user-facing changes.
-
 ## 1.7.12
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.13.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.13.md
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.13
+lastReleaseVersion: 1.7.12
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.13
+version: 1.7.13-dev
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
@@ -1,21 +1,3 @@
-## 0.9.0
-
-### Breaking Changes
-
-* The CIL extractor has been deleted and the corresponding extractor option `cil` has been removed. It is no longer possible to do CIL extraction.
-* The QL library C# classes no longer extend their corresponding `DotNet` classes. Furthermore, CIL related data flow functionality has been deleted and all `DotNet` and `CIL` related classes have been deprecated. This effectively means that it no longer has any effect to enable CIL extraction.
-
-### Minor Analysis Improvements
-
-* Added new source models for the `Dapper` package. These models can be enabled by enabling the `database` threat model.
-* Additional models have been added for `System.IO`. These are primarily source models with the `file` threat model, and summaries related to reading from a file or stream.
-* Support for C# 12 / .NET8.
-* Added the `windows-registry` source kind and threat model to represent values which come from the registry on Windows.
-* The models for `System.Net.Http.HttpRequestMessage` have been modified to better model the flow of tainted URIs.
-* The .NET standard libraries APIs for accessing command line arguments and environment variables have been modeled using the `commandargs` and `environment` threat models.
-* The `cs/assembly-path-injection` query has been modified so that it's sources rely on `ThreatModelFlowSource`. In order to restore results from command line arguments, you should enable the `commandargs` threat model.
-* The models for `System.IO.TextReader` have been modified to better model the flow of tainted text from a `TextReader`.
-
 ## 0.8.12
 
 No user-facing changes.

diff --git a/csharp/ql/lib/change-notes/2024-03-04-deprecate-dotnet-and-cil.md b/csharp/ql/lib/change-notes/2024-03-04-deprecate-dotnet-and-cil.md
@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The QL library C# classes no longer extend their corresponding `DotNet` classes. Furthermore, CIL related data flow functionality has been deleted and all `DotNet` and `CIL` related classes have been deprecated. This effectively means that it no longer has any effect to enable CIL extraction.
diff --git a/csharp/ql/lib/change-notes/2024-03-04-fixed-system.io.textreader-models.md b/csharp/ql/lib/change-notes/2024-03-04-fixed-system.io.textreader-models.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The models for `System.IO.TextReader` have been modified to better model the flow of tainted text from a `TextReader`.
diff --git a/csharp/ql/lib/change-notes/2024-03-05-new-commandargs-and-environment-models.md b/csharp/ql/lib/change-notes/2024-03-05-new-commandargs-and-environment-models.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* The .NET standard libraries APIs for accessing command line arguments and environment variables have been modeled using the `commandargs` and `environment` threat models.
+* The `cs/assembly-path-injection` query has been modified so that it's sources rely on `ThreatModelFlowSource`. In order to restore results from command line arguments, you should enable the `commandargs` threat model.
diff --git a/csharp/ql/lib/change-notes/2024-03-07-remove-cil-extractor.md b/csharp/ql/lib/change-notes/2024-03-07-remove-cil-extractor.md
@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* The CIL extractor has been deleted and the corresponding extractor option `cil` has been removed. It is no longer possible to do CIL extraction.
diff --git a/...lib/change-notes/2024-03-07-update-system.net.http.httprequestmessage-models.md b/...lib/change-notes/2024-03-07-update-system.net.http.httprequestmessage-models.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The models for `System.Net.Http.HttpRequestMessage` have been modified to better model the flow of tainted URIs.
diff --git a/csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md b/csharp/ql/lib/change-notes/2024-03-11-csharp12-dotnet8.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Support for C# 12 / .NET8.
diff --git a/csharp/ql/lib/change-notes/2024-03-11-registry-sources.md b/csharp/ql/lib/change-notes/2024-03-11-registry-sources.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added the `windows-registry` source kind and threat model to represent values which come from the registry on Windows.
diff --git a/csharp/ql/lib/change-notes/2024-03-13-system.io-models.md b/csharp/ql/lib/change-notes/2024-03-13-system.io-models.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Additional models have been added for `System.IO`. These are primarily source models with the `file` threat model, and summaries related to reading from a file or stream.
diff --git a/csharp/ql/lib/change-notes/2024-03-14-dapper-source-models.md b/csharp/ql/lib/change-notes/2024-03-14-dapper-source-models.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added new source models for the `Dapper` package. These models can be enabled by enabling the `database` threat model.
diff --git a/csharp/ql/lib/change-notes/released/0.9.0.md b/csharp/ql/lib/change-notes/released/0.9.0.md
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.9.0
+lastReleaseVersion: 0.8.12
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 0.9.0
+version: 0.8.13-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
@@ -1,14 +1,3 @@
-## 0.8.13
-
-### Major Analysis Improvements
-
-* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`, `cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
-
-### Minor Analysis Improvements
-
-* The alert message of `cs/wrong-compareto-signature` has been changed to remove unnecessary element references.
-* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are `cs/code-injection`, `cs/resource-injection`, `cs/sql-injection`, and `cs/uncontrolled-format-string`.
-
 ## 0.8.12
 
 No user-facing changes.

diff --git a/csharp/ql/src/change-notes/2024-03-06-remove-default-local-sources.md b/csharp/ql/src/change-notes/2024-03-06-remove-default-local-sources.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* Data flow queries that track flow from *local* flow sources now use the current *threat model* configuration instead. This may lead to changes in the produced alerts if the threat model configuration only uses *remote* flow sources. The changed queries are `cs/code-injection`, `cs/resource-injection`, `cs/sql-injection`, and `cs/uncontrolled-format-string`.
+
diff --git a/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md b/csharp/ql/src/change-notes/2024-03-11-remove-stored-query-variants.md
@@ -0,0 +1,5 @@
+---
+category: majorAnalysis
+---
+* The `Stored` variants of some queries (`cs/stored-command-line-injection`, `cs/web/stored-xss`, `cs/stored-ldap-injection`, `cs/xml/stored-xpath-injection`, `cs/second-order-sql-injection`) have been removed. If you were using these queries, their results can be restored by enabling the `file` and `database` threat models in your threat model configuration.
+
diff --git a/csharp/ql/src/change-notes/2024-03-21-change-compareto-signature.md b/csharp/ql/src/change-notes/2024-03-21-change-compareto-signature.md
@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+* The alert message of `cs/wrong-compareto-signature` has been changed to remove unnecessary element references.
+
diff --git a/csharp/ql/src/change-notes/released/0.8.13.md b/csharp/ql/src/change-notes/released/0.8.13.md
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.8.13
+lastReleaseVersion: 0.8.12
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 0.8.13
+version: 0.8.13-dev
 groups:
   - csharp
   - queries

diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,7 +1,3 @@
-## 0.0.12
-
-No user-facing changes.
-
 ## 0.0.11
 
 No user-facing changes.

diff --git a/go/ql/consistency-queries/change-notes/released/0.0.12.md b/go/ql/consistency-queries/change-notes/released/0.0.12.md
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.0.12
+lastReleaseVersion: 0.0.11
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 0.0.12
+version: 0.0.12-dev
 groups:
   - go
   - queries

diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
@@ -1,10 +1,3 @@
-## 0.7.13
-
-### Minor Analysis Improvements
-
-* The `CODEQL_EXTRACTOR_GO_FAST_PACKAGE_INFO` option, which speeds up retrieval of dependency information, is now on by default. This was originally an external contribution by @xhd2015.
-* Added dataflow sources for the package `gopkg.in/macaron.v1`.
-
 ## 0.7.12
 
 No user-facing changes.

diff --git a/go/ql/lib/change-notes/2024-03-04-macaron-sources.md b/go/ql/lib/change-notes/2024-03-04-macaron-sources.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added dataflow sources for the package `gopkg.in/macaron.v1`.
diff --git a/go/ql/lib/change-notes/released/0.7.13.md → ...-03-20-dependecy-retrieval-improvement.md b/go/ql/lib/change-notes/released/0.7.13.md → ...-03-20-dependecy-retrieval-improvement.md
@@ -1,6 +1,4 @@
-## 0.7.13
-
-### Minor Analysis Improvements
-
+---
+category: minorAnalysis
+---
 * The `CODEQL_EXTRACTOR_GO_FAST_PACKAGE_INFO` option, which speeds up retrieval of dependency information, is now on by default. This was originally an external contribution by @xhd2015.
-* Added dataflow sources for the package `gopkg.in/macaron.v1`.