Merge upstream CodeQL 2.27.0 release - #399

Closed

chanel-y wants to merge 358 commits into

mainfrom

sync-upstream-2026-09-10

Commits on Aug 21, 2026

C++: Update expected test results
jketema
committed
3de9880
C++: Mark initializers (and their expressions) of compiler-generated variables as compiler-generated.
MathiasVP
committed
c2c5351
C++: Add change note.
MathiasVP
committed
b711b32
C++: Add a test for the static local compiler-generated variable that's generated by the frontend on empty parameter packs.
MathiasVP
committed
3d1a64d
C++: Add a test with compiler-generated initializers from C++11 ranged for loops.
MathiasVP
committed
e0ac3d5
C++: Require orphaned variables when computing compiler-generated initializers.
MathiasVP
committed
6b87a58
Merge pull request #22321 from github/copilot/prt-migration-20260811-codeql
navntoft
authored
2876bb0
Merge branch 'main' into cpp-access-paths-for-sources-and-sinks-3
MathiasVP
committed
3ffcc1e
Merge pull request #22379 from jketema/jketema/constant-filter
jketema
authored
5eac06d
Merge branch 'main' into cpp-access-paths-for-sources-and-sinks-3
MathiasVP
committed
b34e1cc
Merge pull request #22406 from MathiasVP/compiler-generated-initializers
MathiasVP
authored
20f36e0
Swift: avoid module scan for lazy body emission
arun279
committed
ba5654f

Commits on Aug 22, 2026

Use HTTPS for Wikimedia query-help links
miachillgood
committed
c8afb1d
Improve performance
JarLob
committed
06d874f
Extracted isMicrosoftAspNetCoreMvcApplication to predicate
JarLob
committed
c52545f
Implement code review suggestion
JarLob
committed
d0c3738
Rust: Accept changes to test .expected file, result of upgrades on main.

geoffw0
authored and
CHMANG
committed
35ccfb1
Rust: Add more test cases for barrier guards.

geoffw0
authored and
CHMANG
committed
1b3c870
Rust: Add barrier guards to the query.

geoffw0
authored and
CHMANG
committed
1a8b5b5
Merge branch 'main' into rust-cwe-078-command-injection
lcmangalagiri
authored
519c40b
Rust: Clarify comment in CommandInjectionGood.rs example per review suggestion
CHMANG
committed
9fc84bf

Commits on Aug 24, 2026

Rust: Add MaD tests for blanket implementations
hvitved
committed
6d26e22
Rust: Canonical paths for blanket implementations
hvitved
committed
b12b1d0
Ruby: Add change note.
aschackmull
committed
736b110
Merge pull request #22392 from hvitved/dataflow/access-path-length
hvitved
authored
f2ce282
unified: Add test for enums
asgerf
committed
ea600a9
C++: Simplify 'getSourceDataFlowNode' for parameters.
MathiasVP
committed
6d91ebe
Merge branch 'main' into cpp-access-paths-for-sources-and-sinks-3
MathiasVP
committed
86f7ccf
Merge pull request #22374 from MathiasVP/cpp-access-paths-for-sources-and-sinks-3
MathiasVP
authored
782f1fc
Unified: Make Linux build hermetic
jketema
committed
0f1fd7f
Merge pull request #22405 from hvitved/rust/canonical-path-blanket
hvitved
authored
ec63c66
Merge pull request #22413 from github/jketema/swift-static
jketema
authored
b3f6f2e
Publish patched rules_swift as codeql.2
jketema
committed
c4ac327
Merge pull request #22416 from github/jketema/swift-static-versioning
jketema
authored
9a34fbc
Merge branch 'main' into codex/avoid-lazy-module-scan-current
jketema
authored
f361e3d
Merge pull request #22328 from geoffw0/rustsummary
geoffw0
authored
67a362a
JS: Add a test for an unusual import syntax which is not support in any modern JS implementations, but may be supported by transpilers.
MathiasVP
committed
5871b87
JS: Support an alternative syntax for imports and accept test changes.
MathiasVP
committed
df35070
Improve performance
JarLob
committed
61ec80f
Correct 'enable' to 'enabled' in ASP.NET example
jzabroski
authored
ff5a248
Fix typo in directoryBrowse attribute
jzabroski
authored
c23b3a9
Fix directoryBrowse attribute from 'enable' to 'enabled'
jzabroski
authored
ada881e
Potential fix for pull request finding

jzabroski
and
Copilot
authored
7f43245
Fix closing tag
jzabroski
authored
748fbc7

Commits on Aug 25, 2026

Merge pull request #22417 from MathiasVP/js-parse-weird-module-import
asgerf
authored
33107c2
unified: Rename TExportedNamespace -> TStaticMemberNamespace
asgerf
committed
3cf499f
unified: Add TInstanceMemberNamespace
asgerf
committed
cd0afb9
unified: Store instance members in the new node
asgerf
committed
40a0291
unified: Add inheritance between instance namespaces
asgerf
committed
2bc839d
unified: Ensure member-namespaces are always NamespaceNodes
asgerf
committed
5b31814
unified: Add language hook for inheritance restriction
asgerf
committed
981fc4d
unified: Expose handling of unqualified member accesses
asgerf
committed
2b28f75
unified: Add getStaticBindingTarget
asgerf
committed
b1ca110
unified: Sharpen set of candidates when measuring static name binding
asgerf
committed
fa36a11
Merge pull request #22408 from arun279/codex/avoid-lazy-module-scan-current
jketema
authored
e9caa4e
Merge branch 'main' into rust-cwe-078-command-injection
mchammer01
authored
2deb0f7
Merge pull request #22265 from JarLob/aspnetcore-controller-discovery
michaelnebel
authored
5027b36
Ruby: Deprecate getAControlFlowNode.
aschackmull
committed
4641bdc
Ruby: Address review comments.
aschackmull
committed
ac0438f
Merge branch 'main' into feat/xml-commons
ppkarwasz
authored
af6d1da
Merge pull request #22158 from aschackmull/ruby/cfg-swap
aschackmull
authored
daa37c0
Shared CFG: check abrupt completion origins

yoff
and
Copilot
committed
3fe4382
Merge branch 'main' into codex/issue-5163-wikimedia-links
jketema
authored
b160f27
C#: Add tool status page information and compilation info for unreachable explicit feeds.
michaelnebel
committed
fc90700
C#: Update integration test expected output.
michaelnebel
committed
cd64d68
C#: Add change-note.
michaelnebel
committed
bb6def0
C#: Avoid logging sensitive information like username and password (if hardcoded in the nuget.config feed URL).
michaelnebel
committed
9446394
Update csharp/ql/lib/ext/Microsoft.AspNet.OData.model.yml

hugo-syn
and
michaelnebel
authored
746b806
Update csharp/ql/lib/semmle/code/csharp/frameworks/OData.qll

hugo-syn
and
michaelnebel
authored
131b6be
Update csharp/ql/lib/semmle/code/csharp/frameworks/OData.qll

hugo-syn
and
michaelnebel
authored
de9eae2
C++: Implement a pruning version of 'getAnUltimateDefinition'.
MathiasVP
committed
393512f
C++: Use the optimized version of getAnUltimateDefinition in FlowSummaryImpl.qll.
MathiasVP
committed
59170ee
C++: Cleanup.
MathiasVP
committed
6214cd1
C++: Use the optimized version of getAnUltimateDefinition for iterator flow.
MathiasVP
committed
891f2e1
Merge pull request #22419 from jzabroski/patch-1
redsun82
authored
f70e0b5
Python: keep the Python 2 reading of `except A, e:`

aausch
and
claude
committed
117fc6b
fix: add fix from review
hugo-syn
committed
93baa40
Python: test the Python 2 except reading through extraction, not a unit test

aausch
and
claude
committed
7d9ae21
Rust: Add a test case for rust/hard-coded-cryptographic-value.
geoffw0
committed
e9ab160
Rust: Fix near duplicate results.
geoffw0
committed
73c4427
Rust: Change note.
geoffw0
committed
d15895c
Potential fix for pull request finding

MathiasVP
and
Copilot
authored
ff0f892

Commits on Aug 26, 2026

Apply batched suggestions from code review

asgerf
and
Copilot
authored
94165df
unified: Use getStaticBindingTarget in Candidate.getTarget
asgerf
committed
7190c8c
C++: Add comments.
MathiasVP
committed
49600c1
C#: Use ProcessStartInfo.ArgumentList instead of Arguments to automatically handled escaping and quoting.
michaelnebel
committed
08f0b16
Python: Split up `except Alpha, Beta:` case across language versions
tausbn
committed
b4e561a
Merge branch 'main' into aausch/python-pep758-legacy-parser
tausbn
authored
7f8d03d
update codeql documentation
github-actions[bot]
committed
9500a4e
Merge pull request #22430 from github/codeql-spark-run-32971203150
redsun82
authored
3bb6726
Merge pull request #22425 from MathiasVP/speed-up-get-an-ultimate-definition
MathiasVP
authored
b756a08
C#: address further OData review comments

hugo-syn
and
claude
committed
cf4c3d0
Unified: Hand-roll the mashalling of the JSON
jketema
committed
f6efc34
Rust: Rename isConstant -> hasConstant.
geoffw0
committed
fcdb89c
Rust: Additional test case for arrays.
geoffw0
committed
c0baa61
Rust: Make hasConstant behaviour on arrays consistent.
geoffw0
committed
02d670a

Commits on Aug 27, 2026

Docs: add linux-arm64 to supported platforms

redsun82
and
Copilot
committed
fd0b813
Python: translate Rust escapes in `tsg-python` output

redsun82
and
Copilot
committed
abf5a0d
Docs: note Rosetta 2 requirement for Apple Silicon

redsun82
and
Copilot
committed
e464c99
Merge pull request #22377 from michaelnebel/csharp/dotnetquoting
michaelnebel
authored
68f4039
Merge pull request #22364 from michaelnebel/csharp/tspreportbadfeeds
michaelnebel
authored
d0aa8f8
Merge pull request #22386 from aausch/aausch/python-pep758-legacy-parser
tausbn
authored
1ec44f9
yeast: Support optional guards in rules
tausbn
committed
3e88b36
C#: Convert the OData test to use the Sink for the alert location and update test expected output.

michaelnebel
authored and
hugo-syn
committed
51a107e
C#: Convert the test to use inline expectations and update expected test output.

michaelnebel
authored and
hugo-syn
committed
538d51f
C#: Use unique types pr test case (otherwise they will interfere with each other in relation to identifying which members will be tainted).

michaelnebel
authored and
hugo-syn
committed
5b2568d
C#: Remove recursion.

michaelnebel
authored and
hugo-syn
committed
8519b91
Widen escape round-trip test to all printable ASCII neighbours

redsun82
and
Copilot
committed
caac5d8
Merge pull request #22426 from geoffw0/match
geoffw0
authored
4236d7a
Rust: Accept changes to .expected files.

geoffw0
authored and
CHMANG
committed
3d4cd37
Merge pull request #22436 from github/tausbn/yeast-support-optional-guards-in-rules
tausbn
authored
a035968
Merge pull request #22443 from github/redsun82-python-tsg-variation-selector-crash
redsun82
authored
9567f1a
cpp: model libpq query functions as SQL-injection sinks
kumarak
committed
4623819
Merge main into rc/3.23 mergeback for 2.26.4
redsun82
committed
421078b
Merge pull request #22323 from lcmangalagiri/rust-cwe-078-command-injection
geoffw0
authored
04816f1

Commits on Aug 28, 2026

unified: Update qldoc
asgerf
committed
3e6e3be
unified: Remove superfluous parens
asgerf
committed
4185f75
Merge pull request #22420 from asgerf/unified/instance-members
asgerf
authored
2820e04
Unified: Implement simple LOC counting
hvitved
committed
b304770
Merge pull request #22456 from hvitved/unified/loc-count
hvitved
authored
3ee0030
Rust: Use angle brackets for trait item canonical paths
hvitved
committed
1649faf
Merge pull request #22433 from github/jketema/swift-json
jketema
authored
0780aca
Rust: Reuse Cargo target dir when running QL tests
paldepind
committed
516815c
Rust: Update command injection expected output

hvitved
and
Copilot
committed
048314d
unified: Add Swift node type schema generator

tausbn
and
Copilot
committed
c6d4f8d
Merge pull request #22451 from github/redsun82/mergeback-2.26.4
redsun82
authored
bc3447f
C++: Add a crazy false positive from a Microsoft internal issue.
MathiasVP
committed
f0de9c3
C++: Exclude compiler generated variables from a case in 'cpp/leap-year/unsafe-array-for-days-of-the-year'.
MathiasVP
committed
fcfdf81
Potential fix for pull request finding

MathiasVP
and
Copilot
authored
2fe9ff3
C++: Add an amazing change note.
MathiasVP
committed
416b3ee
Merge pull request #22460 from MathiasVP/add-crazy-fp
MathiasVP
authored
45c7a51
unified: Address review comments
tausbn
committed
4809a5e
Docs: remove blank line between supported-platform footnotes

redsun82
and
Copilot
committed
0017292
Docs: keep beta marker on Apple Silicon

redsun82
and
Copilot
committed
c4c6667
Merge pull request #22444 from github/redsun82-docs-linux-arm64-supported-platform
redsun82
authored
fa8a287

Commits on Aug 29, 2026

Fix synchronized query-help file
miachillgood
committed
ef1b821

Commits on Aug 30, 2026

cpp: address review feedback on libpq SQL-injection sinks
kumarak
committed
4796ff4

Commits on Aug 31, 2026

Merge pull request #22384 from hugo-syn/hugo-syn/csharp-odata-tainted-member
michaelnebel
authored
9e3707f
Rust: Fix model missed by Copilot
hvitved
committed
a7186e5
CFG: Exclude blocks from post-order in case they're Exprs.
aschackmull
committed
a9f60fa
C++: Improve test stability when models are added
jketema
committed
13ecf2e
Merge pull request #22467 from jketema/jketema/test-stable
jketema
authored
973d5b5
Java: update the Commons XML model to the commons-secure-xml 1.0.0 API
ppkarwasz
committed
546e64d
Merge remote-tracking branch 'ppkarwasz/feat/xml-commons' into feat/xml-commons
ppkarwasz
committed
619da40
Merge pull request #22449 from trail-of-forks/kumarak/cpp-libpq-sql-sinks
jketema
authored
ce0e2ad
C#: Add NuGet feed list to the unit tests.
michaelnebel
committed
209cd4c
C#: Move feed prefix logic out of the feed manager.
michaelnebel
committed
a14379e
C#: Update unit tests to reflect the new logic.
michaelnebel
committed
829f880
Unified: Add Callable type
aschackmull
committed
66faa15
Rust: Start canonical path part indices at zero
hvitved
committed
5e9dade
Merge pull request #22457 from github/hvitved-angle-bracket-trait-paths
hvitved
authored
bb10ccb
C#: Introduce IFileProvider interface.
michaelnebel
committed
178f12c
C#: Introduce interface for DependabotProxy.
michaelnebel
committed
29e1392
C#: Make FeedManager unit-testable.
michaelnebel
committed
0f2a7cf
C#: Move DotNetStub into its own file.
michaelnebel
committed
53972f5
C#: Add some Feed manager unit tests.
michaelnebel
committed
b76f793
Merge pull request #22446 from github/rust/reuse-cargo-target-dir
paldepind
authored
95c30d3

Commits on Sep 1, 2026

Add changed framework coverage reports
github-actions[bot]
committed
b9559cd
CPP: Disable dynamic reordering for AliasedSSA::isCoveredOffset
kaspersv
committed
6202d28
Unified: Enable on Arm64
jketema
committed
d0156c1
Merge pull request #22472 from github/workflow/coverage/update
michaelnebel
authored
5573276
Merge pull request #22469 from aschackmull/unified/callable
aschackmull
authored
56dac46
Unified: Add a debug query to view the AST as a graph.
aschackmull
committed
d3f80b6
Rust: Add source/sink/barrier MaD trait tests
hvitved
committed
2a1dbdf
Unified: Add BinaryExpr.getAnOperand to FacadeAst.
aschackmull
committed
631419a
Unified: Add more logical expressions to AstExtra.
aschackmull
committed
a1ac9b1
CFG: Exclude 'try's from post-order in case they're Exprs.
aschackmull
committed
61e11eb
FlowSummaryImpl: Align source/sink/barrier prioriterization with that for summaries
hvitved
committed
872aabc
Rust: Derive source/sink/barrier MaD implementation models from trait models
hvitved
committed
2d69fc3
Unified: Add qldoc.
aschackmull
committed
4f4ba85
Merge pull request #22476 from aschackmull/cfg/tweaks
aschackmull
authored
158d358
Skip mono/nuget C# integration tests on Ubuntu 26.04

redsun82
and
Copilot
committed
575df8e
Merge pull request #22468 from michaelnebel/csharp/refactorfeedmanager
michaelnebel
authored
c550c51
Merge pull request #22474 from aschackmull/unified/debug-ast
aschackmull
authored
8e5e63b
Merge branch 'main' into unified/ast-binaryexpr
aschackmull
authored
0909279
Merge pull request #22475 from aschackmull/unified/ast-binaryexpr
aschackmull
authored
164d97d
Unified: Add control flow graph.
aschackmull
committed
aab9cb6
Merge pull request #22480 from kaspersv/kaspersv/rtjo-disable-reordering
kaspersv
authored
b36dbd4
Unified: Move `extension` workaround into static name binding library
hvitved
committed
3ca261a
Merge pull request #22481 from hvitved/unified/static-namebinding-extensions
hvitved
authored
4138d65
Merge pull request #22478 from github/jketema/static-followup
jketema
authored
7b2695b
Unified: simplify Bazel build
jketema
committed
1a3750b
Unified: fix formatting
jketema
committed
e8c6faf
Merge pull request #22482 from github/jketema/simpilfy-bazel
jketema
authored
6b3497b
Python: test shared CFG exception reachability

yoff
and
Copilot
committed
957b713
Python: wire leaf exceptions to catch entries

yoff
and
Copilot
committed
9df64e7
Python: model throwing leaves as post-order
yoff
committed
8d65f0a
Python: Restrict the set of throwing exceptions
yoff
committed
918ff2e
Merge pull request #22445 from github/hvitved-add-source-sink-barrier-tests
hvitved
authored
b0fa3e7
FlowSummaryImpl: Model more source/sink steps as jump steps
hvitved
committed
6608984
Fix `accept-expected-changes-from-ci.py`
hvitved
committed
d64ad79
Bazel: Add `lfs_archives` function
jketema
committed
734a77d
fix: missed where opporunity false positive
baywet
committed
41ad940
Bazel: remove redundant whitespace
jketema
committed
9b57285
docs: rewording

baywet
and
Copilot
authored
dc42a4c
tests: adds a unit test to prevent regression on else cases
baywet
committed
17412f3
chore: fixes missing break case

baywet
and
Copilot
authored
3271587
Bazel: Address review comments
jketema
committed
c5f2bdb
Remove redundant consistency qltests
yoff
committed
3a36d25
tests: adds a negative test for break
baywet
committed
5e11c9a

Commits on Sep 2, 2026

Ruby: Disable dynamic reordering for select predicate
kaspersv
committed
b2721ad
Merge pull request #22410 from miachillgood/codex/issue-5163-wikimedia-links
jketema
authored
a690c0c
Merge pull request #22486 from kaspersv/kaspersv/ruby-disable-reordering
kaspersv
authored
e7181b3
Apply suggestion from @asgerf

aschackmull
and
asgerf
authored
f452bd4
JS: Report HTML/XHTML files under file coverage
asgerf
committed
479cceb
JS: Change note
asgerf
committed
35e48a6
Add actions.lock extraction
hvitved
committed
2377214
Merge pull request #22479 from aschackmull/unified/cfg
aschackmull
authored
71cf2f1
CFG: Rename ForeachStmt to ForEachStmt.
aschackmull
committed
53f30a0
Unified: Make pattern a subtype of expr.
aschackmull
committed
3d143e1
Merge pull request #22490 from aschackmull/unified/expr-pattern
aschackmull
authored
4f153c6
Merge pull request #22489 from aschackmull/cfg/rename-foreach
aschackmull
authored
738c91f
C#: Disable dynamic reordering for Unification::Gvn::unifiableTypeArguments
kaspersv
committed
d36354b
Apply suggestion from @aschackmull

yoff
and
aschackmull
authored
a92b6a8
Merge pull request #22491 from kaspersv/kaspersv/rtjo-disable-csharp-reordering
kaspersv
authored
7fda929
C#: Add explicit class with dependabot configuration.
michaelnebel
committed
ee6a179
C#: Move some logic into the DependabotProxy object construction.
michaelnebel
committed
68d8351
C#: Minor re-write to enable OS independant testing of dependabot proxy object creation.
michaelnebel
committed
b3ae7ff
C#: Add DependabotProxy unit-tests.
michaelnebel
committed
8583ecc
Merge pull request #22380 from yoff/yoff-fix-shared-cfg-ssa-regressions
yoff
authored
54415ad
Include actions.lock in baseline paths

hvitved
and
Copilot
committed
7102999
Merge pull request #22488 from asgerf/js/scan-html
asgerf
authored
be52f4c
chore: applies review suggestion

baywet
and
michaelnebel
authored
dd005e5
Merge pull request #21387 from github/nicolaswill/micronaut
owen-mc
authored
ed2b77e
Bazel: Factor out the shared attributes
jketema
committed
7814be5
Merge pull request #22450 from github/redsun82-skip-mono-integration-tests-on-ubuntu-26-04
redsun82
authored
1fe0cb5
Merge pull request #22487 from github/hvitved-actions-lock-extraction
hvitved
authored
2d9252f
docs: removes additional cases to avoid the page being too long
baywet
committed
d6ffc18
C#: Address some review comments.
michaelnebel
committed
2dc8ef9
Merge pull request #22483 from github/jketema/lfs-archives
redsun82
authored
1161393
Merge pull request #22399 from jketema/jketema/go-follow
jketema
authored
327b8e9

Commits on Sep 3, 2026

Add changed framework coverage reports
github-actions[bot]
committed
72c44b8
Rust: Make crate fallback logic more conservative in path resolution library
hvitved
committed
1925c20
Merge pull request #22496 from github/workflow/coverage/update
owen-mc
authored
42e8a32
Merge pull request #22269 from ppkarwasz/feat/xml-commons
owen-mc
authored
18dae28
chore: applies review suggestion

baywet
and
michaelnebel
authored
2a7faa5
docs: adds change note for linq where fixes
baywet
committed
dd84d7f
unified: Pin `swift-syntax` directly
tausbn
committed
51a5929
shared: consistent order for consistency checks
yoff
committed
7f8a20e
Merge pull request #22459 from github/tausbn/unified-add-swift-node-type-generator
tausbn
authored
b5d570f
Address review comment
hvitved
committed
9207c4b
Merge pull request #22477 from michaelnebel/csharp/refactordependabotproxy
michaelnebel
authored
b32e90c
Merge pull request #22470 from hvitved/flow-summary-source-sink-jump-step
MathiasVP
authored
c970d43
Merge pull request #22484 from baywet/fix/csharp-where-opportunity-false
michaelnebel
authored
cf26b00
Rename `normalizeSemVer` to `padSemVer` and adopt Ruby implementation
hvitved
committed
df7d49d
Merge pull request #22423 from yoff/yoff-abrupt-origin-consistency
yoff
authored
f1f964c
Merge pull request #22495 from hvitved/rust/path-resolution-crate-fallback-uniqueness
hvitved
authored
cb55cf1
Release preparation for version 2.27.0
github-actions[bot]
committed
da93726
Merge pull request #22504 from github/release-prep/2.27.0
henrymercer
authored
c6baf47

Commits on Sep 11, 2026

Merge upstream CodeQL 2.27.0 release

chanel-y
and
Copilot
committed
4737f67