43 Pull requests merged by 16 people

• Go: Add Head and Client.Head from net/http as request forgery sinks

  #20000 merged Jul 11, 2025

• Java: add extra sink for java/unsafe-deserialization

  #20025 merged Jul 11, 2025

• Rust: add more type inference tests for patterns and a simple one for a closure call

  #20029 merged Jul 11, 2025

• Python: Support type annotations in call graph

  #19672 merged Jul 11, 2025

• Rust: Remove Resolvable.resolvesAsItem

  #20027 merged Jul 11, 2025

• C++: Better dataflow for function objects

  #20023 merged Jul 11, 2025

• C++: Do not alert on unreachable code in cpp/incorrect-string-type-conversion

  #20014 merged Jul 11, 2025

• Rust: Type inference for pattern matching

  #20020 merged Jul 11, 2025

• Support approximate related locations

  #19943 merged Jul 11, 2025

• Rust: Fix type inference for library parameters

  #19658 merged Jul 11, 2025

• Rust: Disambiguate associated function calls

  #19995 merged Jul 10, 2025

• C++: Add dataflow predicate for checking if a node is the final value of a parameter

  #20017 merged Jul 10, 2025

• Ruby: add overlay annotations to AST/CFG/SSA layers

  #19989 merged Jul 10, 2025

• C++: Add more thread creation models

  #20016 merged Jul 10, 2025

• Rust: Update legacy MaD models 2

  #19942 merged Jul 10, 2025

• Rust: Add more test cases for sensitive data

  #20002 merged Jul 10, 2025

• Rust: Update legacy MaD models 4

  #19948 merged Jul 10, 2025

• Java: Add query to detect non-case labels in switch statements

  #19998 merged Jul 10, 2025

• Rust: Fix bad join

  #20015 merged Jul 10, 2025

• Bump golang.org/x/mod from 0.25.0 to 0.26.0 in /go/extractor in the extractor-dependencies group

  #20009 merged Jul 10, 2025

• Rust: add test cases for basic unwrapping and pattern matching

  #20003 merged Jul 10, 2025

• QL4QL: Discard predicates are always alive

  #20013 merged Jul 10, 2025

• Download GitHub database: fix gh invocation

  #10923 merged Jul 10, 2025

• Rust: fix missing canonical paths for trait impls on builtin numeric types

  #20001 merged Jul 10, 2025

• C++: Fix some typos in recent change notes

  #20010 merged Jul 10, 2025

• Rust: Add type inference test cases for tuples.

  #20004 merged Jul 10, 2025

• Rust: set SHA256s in MODULE.bazel

  #19999 merged Jul 9, 2025

• Rust: Adjust the inferred type of string literals

  #19996 merged Jul 8, 2025

• Java: Add query to detect special characters in string literals

  #19875 merged Jul 8, 2025

• Java: Add 'Useless serialization member in record class' query

  #19950 merged Jul 8, 2025

• Rust: Improve type inference for for loops and range expressions

  #19971 merged Jul 8, 2025

• Java: Use MaD in log injection test

  #19997 merged Jul 8, 2025

• Post-release preparation for codeql-cli-2.22.2

  #19994 merged Jul 7, 2025

• Rust: Add type inference inline expectations for all function calls

  #19993 merged Jul 7, 2025

• Rust: path resolution: handle items in extern blocks

  #19988 merged Jul 7, 2025

• Release preparation for version 2.22.2

  #19992 merged Jul 7, 2025

• Merge pull request #19956 from github/redsun82/java-fix-tests

  #19987 merged Jul 7, 2025

• Improve query docs for java/java-util-concurrent-scheduledthreadpoolexecutor

  #19991 merged Jul 7, 2025

• C++: Output CopyValue in the IR when there is a non-transparent conversion

  #19976 merged Jul 7, 2025

• C++: Rename a changenote file

  #19990 merged Jul 7, 2025

• Ruby/QL: add discard predicates for locations

  #19963 merged Jul 7, 2025

• Rust: Remove source vs library deduplication logic

  #19577 merged Jul 7, 2025

• Rust: Fix SSA inconsistencies

  #19975 merged Jul 7, 2025

10 Pull requests opened by 9 people

• sec shared

  #19984 opened Jul 6, 2025

• Java: Promote Insecure Spring Boot Actuator Configuration query from experimental

  #20006 opened Jul 9, 2025

• feat: add getASupertype() predicate in ValueOrRefType.

  #20008 opened Jul 10, 2025

• Overlay: Add XML and Java property discarding

  #20011 opened Jul 10, 2025

• Java: Update qhelp: SnakeYaml is safe from version 2.0

  #20018 opened Jul 10, 2025

• Shared: Improve sensitive data heuristics

  #20024 opened Jul 11, 2025

• C++: Fix C++20 concept related class extensions

  #20026 opened Jul 11, 2025

• Experiment: Make all data flow incremental

  #20028 opened Jul 11, 2025

• JavaScript: Ignore `outDir`s that would exclude everything

  #20030 opened Jul 11, 2025

• Kotlin: Run the tests with 2.2.0

  #20031 opened Jul 11, 2025

3 Issues closed by 2 people

• False positive

  #20022 closed Jul 11, 2025

• Rust: Learn from other security products

  #20007 closed Jul 10, 2025

• False positive

  #19986 closed Jul 7, 2025

1 Issue opened by 1 person

• General issue: Find the annotated type of a C# base interface

  #20032 opened Jul 11, 2025

18 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Rust: Update legacy MaD models 3

  #19946 commented on Jul 11, 2025 • 14 new comments

• Python: Modernize 4 queries for missing/multiple calls to init/del methods

  #19932 commented on Jul 11, 2025 • 7 new comments

• Diff-informed queries: phase 3 (non-trivial locations)

  #19957 commented on Jul 11, 2025 • 6 new comments

• Actions: Fix Critical Artifact poisoning False Positive

  #19388 commented on Jul 11, 2025 • 6 new comments

• Rust: Update SqlxQuery, SqlxExecute to use getCanonicalPath

  #19802 commented on Jul 11, 2025 • 3 new comments

• C++: accept new test results after extractor changes

  #19941 commented on Jul 9, 2025 • 1 new comment

• Just: introduce common "verbs"

  #19978 commented on Jul 10, 2025 • 0 new comments

• Rust: Rework type inference for impl Trait in return position

  #19954 commented on Jul 11, 2025 • 0 new comments

• Rust: upgrade `rust-analyzer` to 0.0.289

  #19930 commented on Jul 7, 2025 • 0 new comments

• Ruby: enable overlay compilation

  #19731 commented on Jul 11, 2025 • 0 new comments

• ShellEscape aint always escaping shells

  #19906 commented on Jul 10, 2025 • 0 new comments

• CodeQL Docs: SnakeYaml is now secure by default

  #19664 commented on Jul 10, 2025 • 0 new comments

• [Rust] weird behavior in dataflow when trying to select a specific node

  #19983 commented on Jul 9, 2025 • 0 new comments

• [Rust] macro expansion failed warnings 2

  #19982 commented on Jul 7, 2025 • 0 new comments

• Problem installing local package

  #19979 commented on Jul 7, 2025 • 0 new comments

• [Rust] macro expansion failed warnings

  #19966 commented on Jul 7, 2025 • 0 new comments

• C++: request for support more C++ features to avoid failures in CodeQL compile

  #16652 commented on Jul 7, 2025 • 0 new comments

• CodeQL Python query runs extremely slow on medium-sized project using TaintTracking::Global

  #19928 commented on Jul 6, 2025 • 0 new comments