Release preparation for version 2.26.1#22151
Merged
Merged
Conversation
github-actions
Bot
added
C#
JS
C++
documentation
Java
Python
Go
Ruby
Rust
oscarsj
approved these changes
Jul 9, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Prepares the repository’s CodeQL packs and release notes for the 2.26.1 release by finalizing pack versions, updating lastReleaseVersion metadata, and rolling change notes into per-version “released” notes/changelog entries.
Changes:
- Promote multiple packs from
*-devto released versions and update correspondinglastReleaseVersionfields. - Add new version sections to pack changelogs and add per-version files under
change-notes/released/. - Consolidate some dated change-note entries into the released notes (removing the dated files where applicable).
Reviewed changes
Copilot reviewed 171 out of 171 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| swift/ql/src/qlpack.yml | Finalize Swift queries pack version for release. |
| swift/ql/src/codeql-pack.release.yml | Update Swift queries lastReleaseVersion. |
| swift/ql/src/CHANGELOG.md | Add Swift queries changelog entry for the release. |
| swift/ql/src/change-notes/released/1.3.6.md | Add released change note for Swift queries. |
| swift/ql/lib/qlpack.yml | Finalize Swift libraries pack version for release. |
| swift/ql/lib/codeql-pack.release.yml | Update Swift libraries lastReleaseVersion. |
| swift/ql/lib/CHANGELOG.md | Add Swift libraries changelog entry for the release. |
| swift/ql/lib/change-notes/released/6.7.2.md | Add released change note for Swift libraries. |
| shared/yaml/qlpack.yml | Finalize shared YAML pack version for release. |
| shared/yaml/codeql-pack.release.yml | Update shared YAML lastReleaseVersion. |
| shared/yaml/CHANGELOG.md | Add shared YAML changelog entry for the release. |
| shared/yaml/change-notes/released/1.0.53.md | Add released change note for shared YAML. |
| shared/xml/qlpack.yml | Finalize shared XML pack version for release. |
| shared/xml/codeql-pack.release.yml | Update shared XML lastReleaseVersion. |
| shared/xml/CHANGELOG.md | Add shared XML changelog entry for the release. |
| shared/xml/change-notes/released/1.0.53.md | Add released change note for shared XML. |
| shared/util/qlpack.yml | Finalize shared util pack version for release. |
| shared/util/codeql-pack.release.yml | Update shared util lastReleaseVersion. |
| shared/util/CHANGELOG.md | Add shared util changelog entry for the release. |
| shared/util/change-notes/released/2.0.40.md | Add released change note for shared util. |
| shared/typos/qlpack.yml | Finalize shared typos pack version for release. |
| shared/typos/codeql-pack.release.yml | Update shared typos lastReleaseVersion. |
| shared/typos/CHANGELOG.md | Add shared typos changelog entry for the release. |
| shared/typos/change-notes/released/1.0.53.md | Add released change note for shared typos. |
| shared/typetracking/qlpack.yml | Finalize shared typetracking pack version for release. |
| shared/typetracking/codeql-pack.release.yml | Update shared typetracking lastReleaseVersion. |
| shared/typetracking/CHANGELOG.md | Add shared typetracking changelog entry for the release. |
| shared/typetracking/change-notes/released/2.0.37.md | Add released change note for shared typetracking. |
| shared/typeinference/qlpack.yml | Finalize shared typeinference pack version for release. |
| shared/typeinference/codeql-pack.release.yml | Update shared typeinference lastReleaseVersion. |
| shared/typeinference/CHANGELOG.md | Add shared typeinference changelog entry for the release. |
| shared/typeinference/change-notes/released/0.0.34.md | Add released change note for shared typeinference. |
| shared/typeflow/qlpack.yml | Finalize shared typeflow pack version for release. |
| shared/typeflow/codeql-pack.release.yml | Update shared typeflow lastReleaseVersion. |
| shared/typeflow/CHANGELOG.md | Add shared typeflow changelog entry for the release. |
| shared/typeflow/change-notes/released/1.0.53.md | Add released change note for shared typeflow. |
| shared/tutorial/qlpack.yml | Finalize shared tutorial pack version for release. |
| shared/tutorial/codeql-pack.release.yml | Update shared tutorial lastReleaseVersion. |
| shared/tutorial/CHANGELOG.md | Add shared tutorial changelog entry for the release. |
| shared/tutorial/change-notes/released/1.0.53.md | Add released change note for shared tutorial. |
| shared/threat-models/qlpack.yml | Finalize shared threat-models pack version for release. |
| shared/threat-models/codeql-pack.release.yml | Update shared threat-models lastReleaseVersion. |
| shared/threat-models/CHANGELOG.md | Add shared threat-models changelog entry for the release. |
| shared/threat-models/change-notes/released/1.0.53.md | Add released change note for shared threat-models. |
| shared/ssa/qlpack.yml | Finalize shared SSA pack version for release. |
| shared/ssa/codeql-pack.release.yml | Update shared SSA lastReleaseVersion. |
| shared/ssa/CHANGELOG.md | Add shared SSA changelog entry for the release. |
| shared/ssa/change-notes/released/2.0.29.md | Add released change note for shared SSA. |
| shared/regex/qlpack.yml | Finalize shared regex pack version for release. |
| shared/regex/codeql-pack.release.yml | Update shared regex lastReleaseVersion. |
| shared/regex/CHANGELOG.md | Add shared regex changelog entry for the release. |
| shared/regex/change-notes/released/1.0.53.md | Add released change note for shared regex. |
| shared/rangeanalysis/qlpack.yml | Finalize shared rangeanalysis pack version for release. |
| shared/rangeanalysis/codeql-pack.release.yml | Update shared rangeanalysis lastReleaseVersion. |
| shared/rangeanalysis/CHANGELOG.md | Add shared rangeanalysis changelog entry for the release. |
| shared/rangeanalysis/change-notes/released/1.0.53.md | Add released change note for shared rangeanalysis. |
| shared/quantum/qlpack.yml | Finalize shared quantum pack version for release. |
| shared/quantum/codeql-pack.release.yml | Update shared quantum lastReleaseVersion. |
| shared/quantum/CHANGELOG.md | Add shared quantum changelog entry for the release. |
| shared/quantum/change-notes/released/0.0.31.md | Add released change note for shared quantum. |
| shared/namebinding/qlpack.yml | Finalize shared namebinding pack version for release. |
| shared/namebinding/codeql-pack.release.yml | Update shared namebinding lastReleaseVersion. |
| shared/namebinding/CHANGELOG.md | Add shared namebinding changelog entry for the release. |
| shared/namebinding/change-notes/released/0.0.2.md | Add released change note for shared namebinding. |
| shared/mad/qlpack.yml | Finalize shared mad pack version for release. |
| shared/mad/codeql-pack.release.yml | Update shared mad lastReleaseVersion. |
| shared/mad/CHANGELOG.md | Add shared mad changelog entry for the release. |
| shared/mad/change-notes/released/1.0.53.md | Add released change note for shared mad. |
| shared/dataflow/qlpack.yml | Finalize shared dataflow pack version for release. |
| shared/dataflow/codeql-pack.release.yml | Update shared dataflow lastReleaseVersion. |
| shared/dataflow/CHANGELOG.md | Add shared dataflow changelog entry for the release. |
| shared/dataflow/change-notes/released/2.1.9.md | Add released change note for shared dataflow. |
| shared/controlflow/qlpack.yml | Finalize shared controlflow pack version for release. |
| shared/controlflow/codeql-pack.release.yml | Update shared controlflow lastReleaseVersion. |
| shared/controlflow/CHANGELOG.md | Add shared controlflow changelog entry for the release. |
| shared/controlflow/change-notes/released/2.0.37.md | Add released change note for shared controlflow. |
| shared/concepts/qlpack.yml | Finalize shared concepts pack version for release. |
| shared/concepts/codeql-pack.release.yml | Update shared concepts lastReleaseVersion. |
| shared/concepts/CHANGELOG.md | Add shared concepts changelog entry for the release. |
| shared/concepts/change-notes/released/0.0.27.md | Add released change note for shared concepts. |
| rust/ql/src/qlpack.yml | Finalize Rust queries pack version for release. |
| rust/ql/src/codeql-pack.release.yml | Update Rust queries lastReleaseVersion. |
| rust/ql/src/CHANGELOG.md | Add Rust queries changelog entry for the release (minor analysis note). |
| rust/ql/src/change-notes/released/0.1.38.md | Update released change note formatting/content for Rust queries. |
| rust/ql/lib/qlpack.yml | Finalize Rust libraries pack version for release. |
| rust/ql/lib/codeql-pack.release.yml | Update Rust libraries lastReleaseVersion. |
| rust/ql/lib/CHANGELOG.md | Add Rust libraries changelog entry for the release. |
| rust/ql/lib/change-notes/released/0.2.17.md | Add released change note for Rust libraries. |
| ruby/ql/src/qlpack.yml | Finalize Ruby queries pack version for release. |
| ruby/ql/src/codeql-pack.release.yml | Update Ruby queries lastReleaseVersion. |
| ruby/ql/src/CHANGELOG.md | Add Ruby queries changelog entry for the release. |
| ruby/ql/src/change-notes/released/1.6.6.md | Add released change note for Ruby queries. |
| ruby/ql/lib/qlpack.yml | Finalize Ruby libraries pack version for release. |
| ruby/ql/lib/codeql-pack.release.yml | Update Ruby libraries lastReleaseVersion. |
| ruby/ql/lib/CHANGELOG.md | Add Ruby libraries changelog entry for the release. |
| ruby/ql/lib/change-notes/released/6.0.1.md | Add released change note for Ruby libraries. |
| python/ql/src/qlpack.yml | Finalize Python queries pack version for release. |
| python/ql/src/codeql-pack.release.yml | Update Python queries lastReleaseVersion. |
| python/ql/src/CHANGELOG.md | Add Python queries changelog entry for the release. |
| python/ql/src/change-notes/released/1.8.6.md | Add released change note for Python queries. |
| python/ql/lib/qlpack.yml | Finalize Python libraries pack version for release. |
| python/ql/lib/codeql-pack.release.yml | Update Python libraries lastReleaseVersion. |
| python/ql/lib/CHANGELOG.md | Add Python libraries changelog entry for the release and adjust formatting. |
| python/ql/lib/change-notes/released/7.2.1.md | Update released change note formatting/content for Python libraries. |
| misc/suite-helpers/qlpack.yml | Finalize suite-helpers pack version for release. |
| misc/suite-helpers/codeql-pack.release.yml | Update suite-helpers lastReleaseVersion. |
| misc/suite-helpers/CHANGELOG.md | Add suite-helpers changelog entry for the release. |
| misc/suite-helpers/change-notes/released/1.0.53.md | Add released change note for suite-helpers. |
| javascript/ql/src/qlpack.yml | Finalize JavaScript queries pack version for release. |
| javascript/ql/src/codeql-pack.release.yml | Update JavaScript queries lastReleaseVersion. |
| javascript/ql/src/CHANGELOG.md | Add JavaScript queries changelog entry for the release. |
| javascript/ql/src/change-notes/released/2.4.1.md | Add released change note for JavaScript queries. |
| javascript/ql/lib/qlpack.yml | Finalize JavaScript libraries pack version for release. |
| javascript/ql/lib/codeql-pack.release.yml | Update JavaScript libraries lastReleaseVersion. |
| javascript/ql/lib/CHANGELOG.md | Add JavaScript libraries changelog entry for the release (minor analysis note). |
| javascript/ql/lib/change-notes/released/2.8.1.md | Update released change note formatting/content for JavaScript libraries. |
| java/ql/src/qlpack.yml | Finalize Java queries pack version for release. |
| java/ql/src/codeql-pack.release.yml | Update Java queries lastReleaseVersion. |
| java/ql/src/CHANGELOG.md | Add Java queries changelog entry for the release. |
| java/ql/src/change-notes/released/1.11.6.md | Add released change note for Java queries. |
| java/ql/lib/qlpack.yml | Finalize Java libraries pack version for release. |
| java/ql/lib/codeql-pack.release.yml | Update Java libraries lastReleaseVersion. |
| java/ql/lib/CHANGELOG.md | Add Java libraries changelog entry for the release (minor analysis notes). |
| java/ql/lib/change-notes/released/9.2.1.md | Update released change note to include consolidated items for Java libraries. |
| java/ql/lib/change-notes/2026-07-03-fix-pattern-sanitizer-tainted-path.md | Remove dated change note after consolidation into released note. |
| java/ql/lib/change-notes/2026-07-01-org.apache.poi-mads.md | Remove dated change note after consolidation into released note. |
| go/ql/src/qlpack.yml | Finalize Go queries pack version for release. |
| go/ql/src/codeql-pack.release.yml | Update Go queries lastReleaseVersion. |
| go/ql/src/CHANGELOG.md | Add Go queries changelog entry for the release. |
| go/ql/src/change-notes/released/1.6.6.md | Add released change note for Go queries. |
| go/ql/lib/qlpack.yml | Finalize Go libraries pack version for release. |
| go/ql/lib/codeql-pack.release.yml | Update Go libraries lastReleaseVersion. |
| go/ql/lib/CHANGELOG.md | Add Go libraries changelog entry for the release (minor analysis note). |
| go/ql/lib/change-notes/released/7.2.1.md | Update released change note formatting/content for Go libraries. |
| go/ql/consistency-queries/qlpack.yml | Finalize Go consistency queries pack version for release. |
| go/ql/consistency-queries/codeql-pack.release.yml | Update Go consistency queries lastReleaseVersion. |
| go/ql/consistency-queries/CHANGELOG.md | Add Go consistency queries changelog entry for the release. |
| go/ql/consistency-queries/change-notes/released/1.0.53.md | Add released change note for Go consistency queries. |
| csharp/ql/src/qlpack.yml | Finalize C# queries pack version for release. |
| csharp/ql/src/codeql-pack.release.yml | Update C# queries lastReleaseVersion. |
| csharp/ql/src/CHANGELOG.md | Add C# queries changelog entry for the release (metadata change note). |
| csharp/ql/src/change-notes/released/1.8.0.md | Update released change note formatting/content for C# queries. |
| csharp/ql/lib/qlpack.yml | Finalize C# libraries pack version for release. |
| csharp/ql/lib/codeql-pack.release.yml | Update C# libraries lastReleaseVersion. |
| csharp/ql/lib/CHANGELOG.md | Add C# libraries changelog entry for the release (major analysis note). |
| csharp/ql/lib/change-notes/released/7.1.0.md | Update released change note formatting/content for C# libraries. |
| csharp/ql/campaigns/Solorigate/src/qlpack.yml | Finalize Solorigate queries pack version for release. |
| csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml | Update Solorigate queries lastReleaseVersion. |
| csharp/ql/campaigns/Solorigate/src/CHANGELOG.md | Add Solorigate queries changelog entry for the release. |
| csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.70.md | Add released change note for Solorigate queries. |
| csharp/ql/campaigns/Solorigate/lib/qlpack.yml | Finalize Solorigate libraries pack version for release. |
| csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml | Update Solorigate libraries lastReleaseVersion. |
| csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md | Add Solorigate libraries changelog entry for the release. |
| csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.70.md | Add released change note for Solorigate libraries. |
| cpp/ql/src/qlpack.yml | Finalize C/C++ queries pack version for release. |
| cpp/ql/src/codeql-pack.release.yml | Update C/C++ queries lastReleaseVersion. |
| cpp/ql/src/CHANGELOG.md | Add C/C++ queries changelog entry for the release (metadata change note). |
| cpp/ql/src/change-notes/released/1.7.0.md | Update released change note formatting/content for C/C++ queries. |
| cpp/ql/lib/qlpack.yml | Finalize C/C++ libraries pack version for release. |
| cpp/ql/lib/codeql-pack.release.yml | Update C/C++ libraries lastReleaseVersion. |
| cpp/ql/lib/CHANGELOG.md | Add C/C++ libraries changelog entry for the release (breaking/deprecation notes). |
| cpp/ql/lib/change-notes/released/12.0.0.md | Update released change note to include consolidated breaking/deprecation items. |
| cpp/ql/lib/change-notes/2026-06-30-variables-as-mad-sources-and-sinks.md | Remove dated change note after consolidation into released note. |
| actions/ql/src/qlpack.yml | Finalize Actions queries pack version for release. |
| actions/ql/src/codeql-pack.release.yml | Update Actions queries lastReleaseVersion. |
| actions/ql/src/CHANGELOG.md | Add Actions queries changelog entry for the release. |
| actions/ql/src/change-notes/released/0.6.31.md | Add released change note for Actions queries. |
| actions/ql/lib/qlpack.yml | Finalize Actions libraries pack version for release. |
| actions/ql/lib/codeql-pack.release.yml | Update Actions libraries lastReleaseVersion. |
| actions/ql/lib/CHANGELOG.md | Add Actions libraries changelog entry for the release. |
| actions/ql/lib/change-notes/released/0.4.39.md | Add released change note for Actions libraries. |
Comments suppressed due to low confidence (1)
go/ql/lib/change-notes/released/7.2.1.md:5
- This bullet is indented with extra leading spaces. Please align it with other top-level bullets by removing the leading whitespace.
| ### Minor Analysis Improvements | ||
|
|
||
| * Added new full SSRF sanitization barrier from the new AntiSSRF library. | ||
| * Added new full SSRF sanitization barrier from the new AntiSSRF library. |
|
|
||
| - The modelling of Psycopg2 now supports the use of `psycopg2.pool` connection pools for handling database connections. | ||
| * Removed `lxml` as an XML bomb sink. The underlying libxml2 library now includes [entity reference loop detection](https://github.com/lxml/lxml/blob/f33ac2c2f5f9c4c4c1fc47f363be96db308f2fa6/doc/FAQ.txt#L1077) that prevents XML bomb attacks. | ||
| * Removed `lxml` as an XML bomb sink. The underlying libxml2 library now includes [entity reference loop detection](https://github.com/lxml/lxml/blob/f33ac2c2f5f9c4c4c1fc47f363be96db308f2fa6/doc/FAQ.txt#L1077) that prevents XML bomb attacks. |
|
|
||
| * The sensitive data library has been improved so that `snake_case` style variable names are recognized more reliably. This may result in more sensitive data being identified, and more results from queries that use the sensitive data library. | ||
| - Additional taint steps through methods of `lxml.etree.Element` and `lxml.etree.ElementTree` objects from the `lxml` PyPI package have been modeled. | ||
| - Additional taint steps through methods of `lxml.etree.Element` and `lxml.etree.ElementTree` objects from the `lxml` PyPI package have been modeled. |
| ### Minor Analysis Improvements | ||
|
|
||
| * The common sanitizer guard `StringConstCompareBarrier` has been renamed to `ConstCompareBarrier` and expanded to cover comparisons with other constant values such as `None`. This may result in fewer false positive results for several queries. | ||
| * The common sanitizer guard `StringConstCompareBarrier` has been renamed to `ConstCompareBarrier` and expanded to cover comparisons with other constant values such as `None`. This may result in fewer false positive results for several queries. |
| ### New Features | ||
|
|
||
| * The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`. | ||
| * The `DataFlow::StateConfigSig` signature module has gained default implementations for `isBarrier/2` and `isAdditionalFlowStep/4`. |
| * Deleted the deprecated `getName()` predicate from the `Container` class, use `getAbsolutePath()` instead. | ||
| * Deleted many deprecated module names that started with a lowercase letter, use the versions that start with an uppercase letter instead. | ||
| * Deleted many deprecated predicates in `PointsTo.qll`. | ||
| * Deleted many deprecated predicates in `PointsTo.qll`. |
Comment on lines
+738
to
739
| * Some classes/modules with upper-case acronyms in their name have been renamed to follow our style-guide. | ||
| The old name still exists as a deprecated alias. |
Comment on lines
+757
to
760
| * Many classes/predicates/modules with upper-case acronyms in their name have been renamed to follow our style-guide. | ||
| The old name still exists as a deprecated alias. | ||
| * The utility files previously in the `semmle.python.security.performance` package have been moved to the `semmle.python.security.regexp` package. | ||
| * The utility files previously in the `semmle.python.security.performance` package have been moved to the `semmle.python.security.regexp` package. | ||
| The previous files still exist as deprecated aliases. |
Comment on lines
+852
to
855
| * Many classes/predicates/modules that had upper-case acronyms have been renamed to follow our style-guide. | ||
| The old name still exists as a deprecated alias. | ||
| * Some modules that started with a lowercase letter have been renamed to follow our style-guide. | ||
| * Some modules that started with a lowercase letter have been renamed to follow our style-guide. | ||
| The old name still exists as a deprecated alias. |
|
|
||
| ### Minor Analysis Improvements | ||
|
|
||
| * Improved models for the `log/slog` package (Go 1.21+), including `*slog.Logger` methods, `With`/`WithGroup`, and `Attr`/`Value` helpers, improving coverage for the `go/log-injection` and `go/clear-text-logging` queries. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.