github · oscarsj · Jul 30, 2026 · Jul 23, 2026 · Jul 23, 2026 · Jul 30, 2026
@@ -1,3 +1,9 @@
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+
 ## 0.4.39
 
 No user-facing changes.

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.39
+lastReleaseVersion: 0.4.40
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.40-dev
+version: 0.4.40
 library: true
 warnOnImplicitThis: true
 dependencies:

@@ -1,3 +1,7 @@
+## 0.6.32
+
+No user-facing changes.
+
 ## 0.6.31
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 0.6.32
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.31
+lastReleaseVersion: 0.6.32
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.32-dev
+version: 0.6.32
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

@@ -1,3 +1,7 @@
+## 12.0.1
+
+No user-facing changes.
+
 ## 12.0.0
 
 ### Breaking Changes

@@ -0,0 +1,3 @@
+## 12.0.1
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 12.0.0
+lastReleaseVersion: 12.0.1
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 12.0.1-dev
+version: 12.0.1
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

@@ -1,3 +1,9 @@
+## 1.8.0
+
+### Query Metadata Changes
+
+* Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query.
+
 ## 1.7.0
 
 ### Query Metadata Changes

@@ -1,4 +1,5 @@
----
-category: queryMetadata
----
+## 1.8.0
+
+### Query Metadata Changes
+
 * Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.0
+lastReleaseVersion: 1.8.0
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.7.1-dev
+version: 1.8.0
 groups:
   - cpp
   - queries

@@ -1,3 +1,7 @@
+## 1.7.71
+
+No user-facing changes.
+
 ## 1.7.70
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.71
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.70
+lastReleaseVersion: 1.7.71
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.71-dev
+version: 1.7.71
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,7 @@
+## 1.7.71
+
+No user-facing changes.
+
 ## 1.7.70
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.71
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.70
+lastReleaseVersion: 1.7.71
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.71-dev
+version: 1.7.71
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,7 @@
+## 7.1.1
+
+No user-facing changes.
+
 ## 7.1.0
 
 ### Major Analysis Improvements

@@ -0,0 +1,3 @@
+## 7.1.1
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.1.0
+lastReleaseVersion: 7.1.1
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 7.1.1-dev
+version: 7.1.1
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

@@ -1,3 +1,13 @@
+## 1.9.0
+
+### Query Metadata Changes
+
+* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite.
+
+### Minor Analysis Improvements
+
+* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
+
 ## 1.8.0
 
 ### Query Metadata Changes

@@ -0,0 +1,9 @@
+## 1.9.0
+
+### Query Metadata Changes
+
+* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite.
+
+### Minor Analysis Improvements
+
+* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.8.0
+lastReleaseVersion: 1.9.0
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.8.1-dev
+version: 1.9.0
 groups:
   - csharp
   - queries

@@ -0,0 +1,79 @@
+.. _codeql-cli-2.26.2:
+
+==========================
+CodeQL 2.26.2 (2026-07-23)
+==========================
+
+.. contents:: Contents
+   :depth: 2
+   :local:
+   :backlinks: none
+
+This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
+
+Security Coverage
+-----------------
+
+CodeQL 2.26.2 runs a total of 497 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).
+
+CodeQL CLI
+----------
+
+Breaking Changes
+~~~~~~~~~~~~~~~~
+
+*   Removed support for parsing :code:`[[`\ -style links in alert messages. This was an undocumented legacy feature that allowed query authors to embed links inline in select clause message strings using :code:`[["text"|"url"]]` syntax. Queries should use :code:`$@` placeholder pairs instead.
+
+Query Packs
+-----------
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+C#
+""
+
+*   :code:`System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for :code:`cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
+
+Query Metadata Changes
+~~~~~~~~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   Added the tag :code:`external/cwe/cwe-762` to :code:`cpp/new-free-mismatch`, and removed the tag :code:`external/cwe/cwe-401`. This better matches the behavior of the query.
+
+C#
+""
+
+*   The query :code:`cs/useless-assignment-to-local` has been removed from the :code:`code-quality` suite, but it remains in the :code:`code-quality-extended` suite.
+
+Language Libraries
+------------------
+
+Major Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Swift
+"""""
+
+*   Upgraded to allow analysis of Swift 6.3.3.
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Golang
+""""""
+
+*   The function :code:`Rel` in :code:`path/filepath` was incorrectly considered a sanitizer for :code:`go/path-injection` and :code:`go/zipslip`. This has now been fixed, which may lead to more results for those queries.
+
+Java/Kotlin
+"""""""""""
+
+*   Kotlin versions up to 2.4.10 are now supported.
+*   :code:`java.io.File.getName()` is no longer treated as a complete sanitizer for :code:`java/path-injection`, since it does not remove a :code:`..` path component (for example :code:`new File("..").getName()` returns :code:`".."`). It is now only recognized as a sanitizer when combined with a subsequent check for :code:`..` components, which may result in new alerts.
+
+GitHub Actions
+""""""""""""""
+
+*   Altered the logic of :code:`EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: :code:`actions/untrusted-checkout-toctou/high` and :code:`actions/untrusted-checkout-toctou/critical`.
@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
 .. toctree::
    :maxdepth: 1
 
+   codeql-cli-2.26.2
    codeql-cli-2.26.1
    codeql-cli-2.26.0
    codeql-cli-2.25.6

@@ -1,3 +1,7 @@
+## 1.0.54
+
+No user-facing changes.
+
 ## 1.0.53
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.0.54
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.53
+lastReleaseVersion: 1.0.54
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.54-dev
+version: 1.0.54
 groups:
   - go
   - queries

@@ -1,3 +1,9 @@
+## 7.2.2
+
+### Minor Analysis Improvements
+
+* The function `Rel` in `path/filepath` was incorrectly considered a sanitizer for `go/path-injection` and `go/zipslip`. This has now been fixed, which may lead to more results for those queries.
+
 ## 7.2.1
 
 ### Minor Analysis Improvements

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 7.2.2
+
+### Minor Analysis Improvements
+
 * The function `Rel` in `path/filepath` was incorrectly considered a sanitizer for `go/path-injection` and `go/zipslip`. This has now been fixed, which may lead to more results for those queries.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.2.1
+lastReleaseVersion: 7.2.2
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 7.2.2-dev
+version: 7.2.2
 groups: go
 dbscheme: go.dbscheme
 extractor: go

@@ -1,3 +1,7 @@
+## 1.6.7
+
+No user-facing changes.
+
 ## 1.6.6
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.6.7
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.6.6
+lastReleaseVersion: 1.6.7
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.6.7-dev
+version: 1.6.7
 groups:
   - go
   - queries

@@ -1,3 +1,10 @@
+## 9.2.2
+
+### Minor Analysis Improvements
+
+* Kotlin versions up to 2.4.10 are now supported.
+* `java.io.File.getName()` is no longer treated as a complete sanitizer for `java/path-injection`, since it does not remove a `..` path component (for example `new File("..").getName()` returns `".."`). It is now only recognized as a sanitizer when combined with a subsequent check for `..` components, which may result in new alerts.
+
 ## 9.2.1
 
 ### Minor Analysis Improvements