Merge upstream CodeQL 2.27.0 release - #400

Open

Chanel (chanel-y) wants to merge 358 commits into

mainfrom

This pull request is big! We're only showing the most recent 250 commits

Commits on Aug 21, 2026

C++: Update expected test results
Jeroen Ketema (jketema)
committed
3de9880
C++: Mark initializers (and their expressions) of compiler-generated variables as compiler-generated.
Mathias Vorreiter Pedersen (MathiasVP)
committed
c2c5351
C++: Add change note.
Mathias Vorreiter Pedersen (MathiasVP)
committed
b711b32
C++: Add a test for the static local compiler-generated variable that's generated by the frontend on empty parameter packs.
Mathias Vorreiter Pedersen (MathiasVP)
committed
3d1a64d
C++: Add a test with compiler-generated initializers from C++11 ranged for loops.
Mathias Vorreiter Pedersen (MathiasVP)
committed
e0ac3d5
C++: Require orphaned variables when computing compiler-generated initializers.
Mathias Vorreiter Pedersen (MathiasVP)
committed
6b87a58
Merge pull request #22321 from github/copilot/prt-migration-20260811-codeql
Mads Navntoft (navntoft)
authored
2876bb0
Merge branch 'main' into cpp-access-paths-for-sources-and-sinks-3
Mathias Vorreiter Pedersen (MathiasVP)
committed
3ffcc1e
Merge pull request #22379 from jketema/jketema/constant-filter
Jeroen Ketema (jketema)
authored
5eac06d
Merge branch 'main' into cpp-access-paths-for-sources-and-sinks-3
Mathias Vorreiter Pedersen (MathiasVP)
committed
b34e1cc
Merge pull request #22406 from MathiasVP/compiler-generated-initializers
Mathias Vorreiter Pedersen (MathiasVP)
authored
20f36e0
Swift: avoid module scan for lazy body emission
Arun Krishnamurthy (arun279)
committed
ba5654f

Commits on Aug 22, 2026

Use HTTPS for Wikimedia query-help links
Mia Miao (miachillgood)
committed
c8afb1d
Improve performance
Jaroslav Lobačevski (JarLob)
committed
06d874f
Extracted isMicrosoftAspNetCoreMvcApplication to predicate
Jaroslav Lobačevski (JarLob)
committed
c52545f
Implement code review suggestion
Jaroslav Lobačevski (JarLob)
committed
d0c3738
Rust: Accept changes to test .expected file, result of upgrades on main.

Geoffrey White (geoffw0)
authored and
CHMANG
committed
35ccfb1
Rust: Add more test cases for barrier guards.

Geoffrey White (geoffw0)
authored and
CHMANG
committed
1b3c870
Rust: Add barrier guards to the query.

Geoffrey White (geoffw0)
authored and
CHMANG
committed
1a8b5b5
Merge branch 'main' into rust-cwe-078-command-injection
Lalith Chaitanya Mangalagiri (lcmangalagiri)
authored
519c40b
Rust: Clarify comment in CommandInjectionGood.rs example per review suggestion
CHMANG
committed
9fc84bf

Commits on Aug 24, 2026

Commits on Aug 25, 2026

Commits on Aug 26, 2026

Apply batched suggestions from code review

Asger F (asgerf)
and
Copilot
authored
94165df
unified: Use getStaticBindingTarget in Candidate.getTarget
Asger F (asgerf)
committed
7190c8c
C++: Add comments.
Mathias Vorreiter Pedersen (MathiasVP)
committed
49600c1
C#: Use ProcessStartInfo.ArgumentList instead of Arguments to automatically handled escaping and quoting.
Michael Nebel (michaelnebel)
committed
08f0b16
Python: Split up `except Alpha, Beta:` case across language versions
Taus (tausbn)
committed
b4e561a
Merge branch 'main' into aausch/python-pep758-legacy-parser
Taus (tausbn)
authored
7f8d03d
update codeql documentation
github-actions[bot]
committed
9500a4e
Merge pull request #22430 from github/codeql-spark-run-32971203150
Paolo Tranquilli (redsun82)
authored
3bb6726
Merge pull request #22425 from MathiasVP/speed-up-get-an-ultimate-definition
Mathias Vorreiter Pedersen (MathiasVP)
authored
b756a08
C#: address further OData review comments

hugo-syn
and
Claude (claude)
committed
cf4c3d0
Unified: Hand-roll the mashalling of the JSON
Jeroen Ketema (jketema)
committed
f6efc34
Rust: Rename isConstant -> hasConstant.
Geoffrey White (geoffw0)
committed
fcdb89c
Rust: Additional test case for arrays.
Geoffrey White (geoffw0)
committed
c0baa61
Rust: Make hasConstant behaviour on arrays consistent.
Geoffrey White (geoffw0)
committed
02d670a

Commits on Aug 27, 2026

Docs: add linux-arm64 to supported platforms

Paolo Tranquilli (redsun82)
and
Copilot
committed
fd0b813
Python: translate Rust escapes in `tsg-python` output

Paolo Tranquilli (redsun82)
and
Copilot
committed
abf5a0d
Docs: note Rosetta 2 requirement for Apple Silicon

Paolo Tranquilli (redsun82)
and
Copilot
committed
e464c99
Merge pull request #22377 from michaelnebel/csharp/dotnetquoting
Michael Nebel (michaelnebel)
authored
68f4039
Merge pull request #22364 from michaelnebel/csharp/tspreportbadfeeds
Michael Nebel (michaelnebel)
authored
d0aa8f8
Merge pull request #22386 from aausch/aausch/python-pep758-legacy-parser
Taus (tausbn)
authored
1ec44f9
yeast: Support optional guards in rules
Taus (tausbn)
committed
3e88b36
C#: Convert the OData test to use the Sink for the alert location and update test expected output.

Michael Nebel (michaelnebel)
authored and
hugo-syn
committed
51a107e
C#: Convert the test to use inline expectations and update expected test output.

Michael Nebel (michaelnebel)
authored and
hugo-syn
committed
538d51f
C#: Use unique types pr test case (otherwise they will interfere with each other in relation to identifying which members will be tainted).

Michael Nebel (michaelnebel)
authored and
hugo-syn
committed
5b2568d
C#: Remove recursion.

Michael Nebel (michaelnebel)
authored and
hugo-syn
committed
8519b91
Widen escape round-trip test to all printable ASCII neighbours

Paolo Tranquilli (redsun82)
and
Copilot
committed
caac5d8
Merge pull request #22426 from geoffw0/match
Geoffrey White (geoffw0)
authored
4236d7a
Rust: Accept changes to .expected files.

Geoffrey White (geoffw0)
authored and
CHMANG
committed
3d4cd37
Merge pull request #22436 from github/tausbn/yeast-support-optional-guards-in-rules
Taus (tausbn)
authored
a035968
Merge pull request #22443 from github/redsun82-python-tsg-variation-selector-crash
Paolo Tranquilli (redsun82)
authored
9567f1a
cpp: model libpq query functions as SQL-injection sinks
Akshay K (kumarak)
committed
4623819
Merge main into rc/3.23 mergeback for 2.26.4
Paolo Tranquilli (redsun82)
committed
421078b
Merge pull request #22323 from lcmangalagiri/rust-cwe-078-command-injection
Geoffrey White (geoffw0)
authored
04816f1

Commits on Aug 28, 2026

Commits on Aug 29, 2026

Fix synchronized query-help file
Mia Miao (miachillgood)
committed
ef1b821

Commits on Aug 30, 2026

cpp: address review feedback on libpq SQL-injection sinks
Akshay K (kumarak)
committed
4796ff4

Commits on Aug 31, 2026

Commits on Sep 1, 2026

Commits on Sep 2, 2026

Commits on Sep 3, 2026

Commits on Sep 11, 2026

Merge upstream CodeQL 2.27.0 release

Chanel (chanel-y)
and
Copilot
committed
4737f67