Repository navigation

Merge upstream CodeQL 2.27.0 release - #400

Merged

Chanel (chanel-y) merged 362 commits into

mainfrom

Sep 14, 2026

This pull request is big! We're only showing the most recent 250 commits

Commits on Aug 21, 2026
Commits on Aug 22, 2026
- Use HTTPS for Wikimedia query-help links
  Mia Miao (miachillgood)
  committed
  c8afb1d
- Improve performance
  Jaroslav Lobačevski (JarLob)
  committed
  06d874f
- Extracted isMicrosoftAspNetCoreMvcApplication to predicate
  Jaroslav Lobačevski (JarLob)
  committed
  c52545f
- Implement code review suggestion
  Jaroslav Lobačevski (JarLob)
  committed
  d0c3738
- Rust: Accept changes to test .expected file, result of upgrades on main.
  
  Geoffrey White (geoffw0)
  authored and
  CHMANG
  committed
  35ccfb1
- Rust: Add more test cases for barrier guards.
  
  Geoffrey White (geoffw0)
  authored and
  CHMANG
  committed
  1b3c870
- Rust: Add barrier guards to the query.
  
  Geoffrey White (geoffw0)
  authored and
  CHMANG
  committed
  1a8b5b5
- Merge branch 'main' into rust-cwe-078-command-injection
  Lalith Chaitanya Mangalagiri (lcmangalagiri)
  authored
  519c40b
- Rust: Clarify comment in CommandInjectionGood.rs example per review suggestion
  CHMANG
  committed
  9fc84bf
Commits on Aug 24, 2026
Commits on Aug 25, 2026
Commits on Aug 26, 2026
- Apply batched suggestions from code review
  
  Asger F (asgerf)
  and
  Copilot
  authored
  94165df
- unified: Use getStaticBindingTarget in Candidate.getTarget
  Asger F (asgerf)
  committed
  7190c8c
- C++: Add comments.
  Mathias Vorreiter Pedersen (MathiasVP)
  committed
  49600c1
- C#: Use ProcessStartInfo.ArgumentList instead of Arguments to automatically handled escaping and quoting.
  Michael Nebel (michaelnebel)
  committed
  08f0b16
- Python: Split up `except Alpha, Beta:` case across language versions
  Taus (tausbn)
  committed
  b4e561a
- Merge branch 'main' into aausch/python-pep758-legacy-parser
  Taus (tausbn)
  authored
  7f8d03d
- update codeql documentation
  github-actions[bot]
  committed
  9500a4e
- Merge pull request #22430 from github/codeql-spark-run-32971203150
  Paolo Tranquilli (redsun82)
  authored
  3bb6726
- Merge pull request #22425 from MathiasVP/speed-up-get-an-ultimate-definition
  Mathias Vorreiter Pedersen (MathiasVP)
  authored
  b756a08
- C#: address further OData review comments
  
  hugo-syn
  and
  Claude (claude)
  committed
  cf4c3d0
- Unified: Hand-roll the mashalling of the JSON
  Jeroen Ketema (jketema)
  committed
  f6efc34
- Rust: Rename isConstant -> hasConstant.
  Geoffrey White (geoffw0)
  committed
  fcdb89c
- Rust: Additional test case for arrays.
  Geoffrey White (geoffw0)
  committed
  c0baa61
- Rust: Make hasConstant behaviour on arrays consistent.
  Geoffrey White (geoffw0)
  committed
  02d670a
Commits on Aug 27, 2026
- Docs: add linux-arm64 to supported platforms
  
  Paolo Tranquilli (redsun82)
  and
  Copilot
  committed
  fd0b813
- Python: translate Rust escapes in `tsg-python` output
  
  Paolo Tranquilli (redsun82)
  and
  Copilot
  committed
  abf5a0d
- Docs: note Rosetta 2 requirement for Apple Silicon
  
  Paolo Tranquilli (redsun82)
  and
  Copilot
  committed
  e464c99
- Merge pull request #22377 from michaelnebel/csharp/dotnetquoting
  Michael Nebel (michaelnebel)
  authored
  68f4039
- Merge pull request #22364 from michaelnebel/csharp/tspreportbadfeeds
  Michael Nebel (michaelnebel)
  authored
  d0aa8f8
- Merge pull request #22386 from aausch/aausch/python-pep758-legacy-parser
  Taus (tausbn)
  authored
  1ec44f9
- yeast: Support optional guards in rules
  Taus (tausbn)
  committed
  3e88b36
- C#: Convert the OData test to use the Sink for the alert location and update test expected output.
  
  Michael Nebel (michaelnebel)
  authored and
  hugo-syn
  committed
  51a107e
- C#: Convert the test to use inline expectations and update expected test output.
  
  Michael Nebel (michaelnebel)
  authored and
  hugo-syn
  committed
  538d51f
- C#: Use unique types pr test case (otherwise they will interfere with each other in relation to identifying which members will be tainted).
  
  Michael Nebel (michaelnebel)
  authored and
  hugo-syn
  committed
  5b2568d
- C#: Remove recursion.
  
  Michael Nebel (michaelnebel)
  authored and
  hugo-syn
  committed
  8519b91
- Widen escape round-trip test to all printable ASCII neighbours
  
  Paolo Tranquilli (redsun82)
  and
  Copilot
  committed
  caac5d8
- Merge pull request #22426 from geoffw0/match
  Geoffrey White (geoffw0)
  authored
  4236d7a
- Rust: Accept changes to .expected files.
  
  Geoffrey White (geoffw0)
  authored and
  CHMANG
  committed
  3d4cd37
- Merge pull request #22436 from github/tausbn/yeast-support-optional-guards-in-rules
  Taus (tausbn)
  authored
  a035968
- Merge pull request #22443 from github/redsun82-python-tsg-variation-selector-crash
  Paolo Tranquilli (redsun82)
  authored
  9567f1a
- cpp: model libpq query functions as SQL-injection sinks
  Akshay K (kumarak)
  committed
  4623819
- Merge main into rc/3.23 mergeback for 2.26.4
  Paolo Tranquilli (redsun82)
  committed
  421078b
- Merge pull request #22323 from lcmangalagiri/rust-cwe-078-command-injection
  Geoffrey White (geoffw0)
  authored
  04816f1
Commits on Aug 28, 2026
Commits on Aug 29, 2026
- Fix synchronized query-help file
  Mia Miao (miachillgood)
  committed
  ef1b821
Commits on Aug 30, 2026
- cpp: address review feedback on libpq SQL-injection sinks
  Akshay K (kumarak)
  committed
  4796ff4
Commits on Aug 31, 2026
Commits on Sep 1, 2026
Commits on Sep 2, 2026
Commits on Sep 3, 2026
Commits on Sep 14, 2026
- Merge upstream CodeQL 2.27.0 release
  Chanel (chanel-y)
  committed
  58dc5ff
- C++: Resolve unsafe days array query merge conflict
  Chanel (chanel-y)
  committed
  5099490
- C++: Resolve unsafe days array test merge conflict
  Chanel (chanel-y)
  committed
  19addb7
- Java: Resolve XSS query-help merge conflict
  Chanel (chanel-y)
  committed
  cd6ddb7
- Merge branch 'main' into bump-2-27-0
  Chanel (chanel-y)
  authored
  be5ec0a