29 Pull requests merged by 14 people

• Add extra Customizations files

  #20252 merged Aug 20, 2025

• Rust: update README to remove experimental warning

  #20251 merged Aug 20, 2025

• Update CSV framework coverage reports

  #20244 merged Aug 20, 2025

• Rust: Update StreamCipherInit to use getCanonicalPath.

  #20238 merged Aug 19, 2025

• C++: Mark the write to fprintf's 0'th argument as partial

  #20242 merged Aug 19, 2025

• Rust: Distinguish internal/external items in path resolution

  #20191 merged Aug 19, 2025

• Guards: Cache nullGuard predicate.

  #20237 merged Aug 19, 2025

• Rust: Take transitive dependencies into account when computing canonical paths

  #20243 merged Aug 19, 2025

• Post-release preparation for codeql-cli-2.22.4

  #20241 merged Aug 18, 2025

• Release preparation for version 2.22.4

  #20240 merged Aug 18, 2025

• Rust: Remove TC from ImplTraitTypeRepr.isInReturnPos

  #20233 merged Aug 18, 2025

• C++: SloppyGlobal: Don't alert on template instantiations, only the template

  #20232 merged Aug 18, 2025

• Shared: Skip non-CFG children in StandardTree

  #20230 merged Aug 18, 2025

• Rust: Add a type inference test case resembling PathBuf.canonicalize.

  #20222 merged Aug 18, 2025

• Add data extensions for remote tainted sources

  #20228 merged Aug 18, 2025

• C++: Diff-informed queries: phase 3 (non-trivial locations)

  #20073 merged Aug 18, 2025

• Python: Diff-informed queries: phase 3 (non-trivial locations)

  #20079 merged Aug 18, 2025

• JS: Enhance command injection detection for CLI argument parsing libraries

  #20151 merged Aug 18, 2025

• JS: Exclude environment variables from js/regex-injection query by default

  #20148 merged Aug 18, 2025

• Actions: Diff-informed queries: phase 3 (non-trivial locations)

  #20072 merged Aug 15, 2025

• Go: Mention Go 1.25 as supported

  #20223 merged Aug 15, 2025

• Go: Diff-informed queries: phase 3 (non-trivial locations)

  #20075 merged Aug 15, 2025

• C#: Diff-informed queries: phase 3 (non-trivial locations)

  #20074 merged Aug 15, 2025

• C#: Replace input interpolation with environment variable

  #20229 merged Aug 15, 2025

• Rust: Handle chained let expressions

  #20203 merged Aug 14, 2025

• Java: Enable BarrierGuard wrappers

  #20183 merged Aug 14, 2025

• Rust: Remove references to getResolvedPath and getExtendedCanonicalPath

  #20224 merged Aug 14, 2025

• Rust: Update StartswithCall to use getCanonicalPath

  #20226 merged Aug 14, 2025

• C++: Improvements to IRGuards

  #20218 merged Aug 14, 2025

11 Pull requests opened by 8 people

• Rust: Fallback crate resolution

  #20225 opened Aug 14, 2025

• Type inference: Rename some variables

  #20234 opened Aug 15, 2025

• Rust: Model `async` return types as `dyn Future`

  #20236 opened Aug 17, 2025

• C#: Streamline MaD summaries for Byte- and Char arrays and pointers

  #20239 opened Aug 18, 2025

• Java: accept new test results after extractor update

  #20247 opened Aug 19, 2025

• Rust: Adjust jump-to-def for paths with generic arguments

  #20248 opened Aug 19, 2025

• C++: Use the shared type-tracking library for virtual dispatch resolution

  #20249 opened Aug 19, 2025

• Bazel: do not force `lld` and fix `platforms` warning

  #20250 opened Aug 19, 2025

• Shared: Add and use a signature for basic blocks

  #20253 opened Aug 20, 2025

• CS: Update `cs/ldap-injection` qhelp

  #20254 opened Aug 20, 2025

• Add reuse nonce test for java

  #20258 opened Aug 20, 2025

3 Issues closed by 2 people

• "No code found during the build." after successful compilation for C++ in Visual Studio 2019

  #7365 closed Aug 18, 2025

• Superflous paths-ignore warning?

  #6845 closed Aug 18, 2025

• Default java database creation with gradle does not include all source sets

  #20227 closed Aug 14, 2025

2 Issues opened by 2 people

• CodeQL Ruby parser fails on bare & block forwarding in multi-line method calls

  #20257 opened Aug 20, 2025

• [Rust] Unused variable False positive

  #20256 opened Aug 20, 2025

21 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Rust: upgrade to rust-analyzer 0.0.300

  #20055 commented on Aug 19, 2025 • 22 new comments

• Rust: Implement a new query for Log Injection

  #20221 commented on Aug 18, 2025 • 9 new comments

• Java: Add support to Compact Source Files

  #20116 commented on Aug 20, 2025 • 4 new comments

• Python: Modernize the Signature Mismatch query

  #20217 commented on Aug 19, 2025 • 3 new comments

• Python extractor: overlay support

  #20206 commented on Aug 20, 2025 • 3 new comments

• C#: Allow implicit collection reads in sink nodes.

  #20089 commented on Aug 20, 2025 • 3 new comments

• Java: Add support to `ModuleImportDeclaration`

  #20097 commented on Aug 20, 2025 • 1 new comment

• [Rust] Unused variable false positive in compound conditional statements

  #20201 commented on Aug 14, 2025 • 0 new comments

• Java: Enhance `java/jvm-exit` query and add to quality

  #20190 commented on Aug 18, 2025 • 0 new comments

• Bump the extractor-dependencies group in /go/extractor with 2 updates

  #20188 commented on Aug 20, 2025 • 0 new comments

• JS: Move cors-misconfiguration query from experimental to Security

  #20146 commented on Aug 20, 2025 • 0 new comments

• Java: Add test for flexible constructor support

  #20136 commented on Aug 18, 2025 • 0 new comments

• Why doesn't CodeQL support auditing PHP

  #12376 commented on Aug 14, 2025 • 0 new comments

• Just: introduce common "verbs"

  #19978 commented on Aug 14, 2025 • 0 new comments

• Signature model refactor

  #19944 commented on Aug 20, 2025 • 0 new comments

• Quantum: Refactor OpenSSL padding modeling

  #19908 commented on Aug 20, 2025 • 0 new comments

• Should `qlpack.yml` `compileForOverlayEval` be documented?

  #20186 commented on Aug 20, 2025 • 0 new comments

• CWE 134

  #20131 commented on Aug 19, 2025 • 0 new comments

• How to write CodeQL rules?

  #20159 commented on Aug 15, 2025 • 0 new comments

• Codeql pack create warning - is not an extension target of xxx

  #20211 commented on Aug 15, 2025 • 0 new comments

• CodeQL for php

  #14000 commented on Aug 14, 2025 • 0 new comments