Merge pull request #17316 from github/revert-17279-release-prep/2.18.3

Revert "Release preparation for version 2.18.3"

cpp/ql/lib/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.4.1
-
-No user-facing changes.
-
 ## 1.4.0
 
 ### New Features

cpp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.1
+lastReleaseVersion: 1.4.0

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 1.4.1
+version: 1.4.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/src/CHANGELOG.md

@@ -1,9 +1,3 @@
-## 1.2.1
-
-### Minor Analysis Improvements
-
-* The `cpp/uncontrolled-allocation-size` ("Uncontrolled allocation size") query now considers arithmetic operations that might reduce the size of user input as a barrier. The query therefore produces fewer false positive results.
-
 ## 1.2.0
 
 ### Query Metadata Changes

cpp/ql/src/change-notes/released/1.2.1.md → cpp/ql/src/change-notes/2024-08-16-uncontrolled-allocation-size.md

@@ -1,5 +1,4 @@
-## 1.2.1
-
-### Minor Analysis Improvements
-
-* The `cpp/uncontrolled-allocation-size` ("Uncontrolled allocation size") query now considers arithmetic operations that might reduce the size of user input as a barrier. The query therefore produces fewer false positive results.
+---
+category: minorAnalysis
+---
+* The `cpp/uncontrolled-allocation-size` ("Uncontrolled allocation size") query now considers arithmetic operations that might reduce the size of user input as a barrier. The query therefore produces fewer false positive results.

cpp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.2.1
+lastReleaseVersion: 1.2.0

cpp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.2.1
+version: 1.2.1-dev
 groups:
   - cpp
   - queries

csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.7.23
-
-No user-facing changes.
-
 ## 1.7.22
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.23
+lastReleaseVersion: 1.7.22

csharp/ql/campaigns/Solorigate/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.23
+version: 1.7.23-dev
 groups:
   - csharp
   - solorigate

csharp/ql/campaigns/Solorigate/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.7.23
-
-No user-facing changes.
-
 ## 1.7.22
 
 No user-facing changes.

csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.23
+lastReleaseVersion: 1.7.22

csharp/ql/campaigns/Solorigate/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.23
+version: 1.7.23-dev
 groups:
   - csharp
   - solorigate

csharp/ql/lib/CHANGELOG.md

@@ -1,14 +1,3 @@
-## 1.1.0
-
-### Major Analysis Improvements
-
-* Added support for data flow through side-effects on static fields. For example, when a static field containing an array is updated.
-
-### Minor Analysis Improvements
-
-* Added some new `local` source models. Most prominently `System.IO.Path.GetTempPath` and `System.Environment.GetFolderPath`. This might produce more alerts, if the `local` threat model is enabled.
-* The extractor has been changed to not skip source files that have already been seen. This has an impact on source files that are compiled multiple times in the build process. Source files with conditional compilation preprocessor directives (such as `#if`) are now extracted for each set of preprocessor symbols that are used during the build process.
-
 ## 1.0.5
 
 No user-facing changes.

csharp/ql/lib/change-notes/2024-05-23-static-field-side-effect.md

@@ -0,0 +1,4 @@
+---
+category: majorAnalysis
+---
+* Added support for data flow through side-effects on static fields. For example, when a static field containing an array is updated.

csharp/ql/lib/change-notes/2024-07-10-conditional-compilation.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The extractor has been changed to not skip source files that have already been seen. This has an impact on source files that are compiled multiple times in the build process. Source files with conditional compilation preprocessor directives (such as `#if`) are now extracted for each set of preprocessor symbols that are used during the build process.

csharp/ql/lib/change-notes/2024-07-19-added-sources.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added some new `local` source models. Most prominently `System.IO.Path.GetTempPath` and `System.Environment.GetFolderPath`. This might produce more alerts, if the `local` threat model is enabled.

csharp/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.1.0
+lastReleaseVersion: 1.0.5

csharp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 1.1.0
+version: 1.0.6-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

csharp/ql/src/CHANGELOG.md

@@ -1,10 +1,3 @@
-## 1.0.6
-
-### Minor Analysis Improvements
-
-* Attributes in the `System.Runtime.CompilerServices` namespace are ignored when checking if a declaration requires documentation comments.
-* C# build-mode `none` analyses now report a warning on the CodeQL status page when there are significant analysis problems -- defined as 5% of expressions lacking a type, or 5% of call targets being unknown. Other messages reported on the status page are downgraded from warnings to notes and so are less prominent, but are still available for review.
-
 ## 1.0.5
 
 No user-facing changes.

csharp/ql/src/change-notes/2024-08-07-db-quality-diagnostic.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* C# build-mode `none` analyses now report a warning on the CodeQL status page when there are significant analysis problems-- defined as 5% of expressions lacking a type, or 5% of call targets being unknown. Other messages reported on the status page are downgraded from warnings to notes and so are less prominent, but are still available for review.

csharp/ql/src/change-notes/2024-08-12-doc-comments.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Attributes in the `System.Runtime.CompilerServices` namespace are ignored when checking if a declaration requires documentation comments.

csharp/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.6
+lastReleaseVersion: 1.0.5

csharp/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.0.6
+version: 1.0.6-dev
 groups:
   - csharp
   - queries

go/ql/consistency-queries/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.0.6
-
-No user-facing changes.
-
 ## 1.0.5
 
 No user-facing changes.

go/ql/consistency-queries/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.6
+lastReleaseVersion: 1.0.5

go/ql/consistency-queries/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.6
+version: 1.0.6-dev
 groups:
   - go
   - queries

go/ql/lib/CHANGELOG.md

@@ -1,17 +1,3 @@
-## 1.1.5
-
-### Minor Analysis Improvements
-
-* Local source models for reading and parsing environment variables have been added for the following libraries:
-  - os
-  - syscall
-  - github.com/caarlos0/env
-  - github.com/gobuffalo/envy
-  - github.com/hashicorp/go-envparse
-  - github.com/joho/godotenv
-  - github.com/kelseyhightower/envconfig
-* Local source models have been added for the APIs which open files in the `io/fs`, `io/ioutil` and `os` packages in the Go standard library. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).
-
 ## 1.1.4
 
 No user-facing changes.

go/ql/lib/change-notes/2024-08-12-add-environment-models.md

@@ -0,0 +1,11 @@
+---
+category: minorAnalysis
+---
+* Local source models for reading and parsing environment variables have been added for the following libraries:
+  - os
+  - syscall
+  - github.com/caarlos0/env
+  - github.com/gobuffalo/envy
+  - github.com/hashicorp/go-envparse
+  - github.com/joho/godotenv
+  - github.com/kelseyhightower/envconfig

go/ql/lib/change-notes/released/1.1.5.md → go/ql/lib/change-notes/2024-08-12-add-file-models.md

@@ -1,13 +1,4 @@
-## 1.1.5
-
-### Minor Analysis Improvements
-
-* Local source models for reading and parsing environment variables have been added for the following libraries:
-  - os
-  - syscall
-  - github.com/caarlos0/env
-  - github.com/gobuffalo/envy
-  - github.com/hashicorp/go-envparse
-  - github.com/joho/godotenv
-  - github.com/kelseyhightower/envconfig
+---
+category: minorAnalysis
+---
 * Local source models have been added for the APIs which open files in the `io/fs`, `io/ioutil` and `os` packages in the Go standard library. You can optionally include threat models as appropriate when using the CodeQL CLI and in GitHub code scanning. For more information, see [Analyzing your code with CodeQL queries](https://docs.github.com/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#including-model-packs-to-add-potential-sources-of-tainted-data>) and [Customizing your advanced setup for code scanning](https://docs.github.com/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#extending-codeql-coverage-with-threat-models).

go/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.1.5
+lastReleaseVersion: 1.1.4

go/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 1.1.5
+version: 1.1.5-dev
 groups: go
 dbscheme: go.dbscheme
 extractor: go

go/ql/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.0.6
-
-No user-facing changes.
-
 ## 1.0.5
 
 No user-facing changes.

go/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.6
+lastReleaseVersion: 1.0.5

go/ql/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.0.6
+version: 1.0.6-dev
 groups:
   - go
   - queries

java/ql/automodel/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.0.6
-
-No user-facing changes.
-
 ## 1.0.5
 
 No user-facing changes.

java/ql/automodel/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.6
+lastReleaseVersion: 1.0.5

java/ql/automodel/src/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-automodel-queries
-version: 1.0.6
+version: 1.0.6-dev
 groups:
     - java
     - automodel

java/ql/lib/CHANGELOG.md

@@ -1,15 +1,3 @@
-## 3.0.1
-
-### Minor Analysis Improvements
-
-* Threat-model for `System.in` changed from `commandargs` to newly created `stdin` (both subgroups of `local`).
-
-### Bug Fixes
-
-* Fixed an issue where analysis in `build-mode: none` may very occasionally throw a `CoderMalfunctionError` while resolving dependencies provided by a build system (Maven or Gradle), which could cause some dependency resolution and consequently alerts to vary unpredictably from one run to another.
-* Fixed an issue where Java analysis in `build-mode: none` would fail to resolve dependencies using the `executable-war` Maven artifact type.
-* Fixed an issue where analysis in `build-mode: none` may fail to resolve dependencies of Gradle projects where the dependency uses a non-empty artifact classifier -- for example, `someproject-1.2.3-tests.jar`, which has the classifier `tests`.
-
 ## 3.0.0
 
 ### Breaking Changes

java/ql/lib/change-notes/2024-08-09-buildless-executable-war.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue where Java analysis in `build-mode: none` would fail to resolve dependencies using the `executable-war` Maven artifact type.

java/ql/lib/change-notes/2024-08-09-buildless-gradle-classifiers.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue where analysis in `build-mode: none` may fail to resolve dependencies of Gradle projects where the dependency uses a non-empty artifact classifier -- for example, `someproject-1.2.3-tests.jar`, which has the classifier `tests`.

java/ql/lib/change-notes/2024-08-13-stdin-threat-model.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Threat-model for `System.in` changed from `commandargs` to newly created `stdin` (both subgroups of `local`).

java/ql/lib/change-notes/2024-08-14-buildless-coder-malfunction.md

@@ -0,0 +1,4 @@
+---
+category: fix
+---
+* Fixed an issue where analysis in `build-mode: none` may very occasionally throw a `CoderMalfunctionError` while resolving dependencies provided by a build system (Maven or Gradle), which could cause some dependency resolution and consequently alerts to vary unpredictably from one run to another.

java/ql/lib/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 3.0.1
+lastReleaseVersion: 3.0.0

java/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 3.0.1
+version: 3.0.1-dev
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

java/ql/src/CHANGELOG.md

@@ -1,7 +1,3 @@
-## 1.1.3
-
-No user-facing changes.
-
 ## 1.1.2
 
 ### Minor Analysis Improvements

java/ql/src/codeql-pack.release.yml

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.1.3
+lastReleaseVersion: 1.1.2