github · mbg · Sep 17, 2026 · Sep 17, 2026
@@ -1,3 +1,7 @@
+## 0.6.2
+
+No user-facing changes.
+
 ## 0.6.1
 
 ### New Features

@@ -0,0 +1,3 @@
+## 0.6.2
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.1
+lastReleaseVersion: 0.6.2
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.6.2-dev
+version: 0.6.2
 library: true
 warnOnImplicitThis: true
 dependencies:

@@ -1,3 +1,10 @@
+## 0.6.36
+
+### Minor Analysis Improvements
+
+* The `actions/unpinned-tag` query no longer reports action references pinned by a structurally valid `.github/workflows/actions.lock` entry for the enclosing workflow.
+* The `actions/unpinned-tag` query no longer reports `$/` self repository references (e.g. `uses: $/path/to/action`), which resolve to the same repository at the running commit and are therefore inherently pinned, just like `./` self workspace (local) references.
+
 ## 0.6.35
 
 No user-facing changes.

@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 0.6.36
+
+### Minor Analysis Improvements
+
+* The `actions/unpinned-tag` query no longer reports action references pinned by a structurally valid `.github/workflows/actions.lock` entry for the enclosing workflow.
 * The `actions/unpinned-tag` query no longer reports `$/` self repository references (e.g. `uses: $/path/to/action`), which resolve to the same repository at the running commit and are therefore inherently pinned, just like `./` self workspace (local) references.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.35
+lastReleaseVersion: 0.6.36
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.36-dev
+version: 0.6.36
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

@@ -1,3 +1,11 @@
+## 12.1.1
+
+### Minor Analysis Improvements
+
+* Added taint flow models for the `boost::asio::ip::basic_resolver::resolve` function.
+* Added flow summaries for the BDE `BloombergLP::bdlbb::Blob` segmented byte buffer.
+* Added flow summaries for the Protocol Buffers `google::protobuf::MessageLite` C++ API.
+
 ## 12.1.0
 
 ### New Features

@@ -0,0 +1,7 @@
+## 12.1.1
+
+### Minor Analysis Improvements
+
+* Added taint flow models for the `boost::asio::ip::basic_resolver::resolve` function.
+* Added flow summaries for the BDE `BloombergLP::bdlbb::Blob` segmented byte buffer.
+* Added flow summaries for the Protocol Buffers `google::protobuf::MessageLite` C++ API.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 12.1.0
+lastReleaseVersion: 12.1.1
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 12.1.1-dev
+version: 12.1.1
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

@@ -1,3 +1,11 @@
+## 1.9.0
+
+### New Queries
+
+* Added a new query, `cpp/ambiguous-assignment-of-comparison`, to detect potentially
+  ambiguous expressions where a comparison result is assigned to a variable and the
+  assignment is used as a truth value.
+
 ## 1.8.3
 
 ### Minor Analysis Improvements

@@ -1,6 +1,7 @@
----
-category: newQuery
----
+## 1.9.0
+
+### New Queries
+
 * Added a new query, `cpp/ambiguous-assignment-of-comparison`, to detect potentially
   ambiguous expressions where a comparison result is assigned to a variable and the
   assignment is used as a truth value.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.8.3
+lastReleaseVersion: 1.9.0
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.8.4-dev
+version: 1.9.0
 groups:
   - cpp
   - queries

@@ -1,3 +1,7 @@
+## 1.7.75
+
+No user-facing changes.
+
 ## 1.7.74
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.75
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.74
+lastReleaseVersion: 1.7.75
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.75-dev
+version: 1.7.75
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,7 @@
+## 1.7.75
+
+No user-facing changes.
+
 ## 1.7.74
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.7.75
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.74
+lastReleaseVersion: 1.7.75
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.75-dev
+version: 1.7.75
 groups:
   - csharp
   - solorigate

@@ -1,3 +1,9 @@
+## 7.3.1
+
+### Minor Analysis Improvements
+
+* Private NuGet registries for which the "Replaces base" option is enabled in the organization-level private registry configuration now replace default NuGet feeds whenever dependencies are downloaded, including when default NuGet feeds are configured explicitly for a project.
+
 ## 7.3.0
 
 ### New Features

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 7.3.1
+
+### Minor Analysis Improvements
+
 * Private NuGet registries for which the "Replaces base" option is enabled in the organization-level private registry configuration now replace default NuGet feeds whenever dependencies are downloaded, including when default NuGet feeds are configured explicitly for a project.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.3.0
+lastReleaseVersion: 7.3.1
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 7.3.1-dev
+version: 7.3.1
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

@@ -1,3 +1,14 @@
+## 1.10.0
+
+### New Queries
+
+* Added a new query, `cs/linq/missed-firstordefault`, that detects `foreach` loops that can be expressed more clearly using LINQ's `FirstOrDefault` method.
+
+### Minor Analysis Improvements
+
+* The `cs/linq/missed-*` queries no longer suggest rewrites that would capture `in`, `out`, or `ref` parameters in a lambda, fixing false-positive results for transformations that would not compile.
+* The `cs/web/missing-token-validation` query now recognizes an ASP.NET Core `AutoValidateAntiforgeryTokenAttribute` registered as a global MVC filter through `AddControllersWithViews` (and friends), avoiding false-positive results for covered actions.
+
 ## 1.9.3
 
 ### Minor Analysis Improvements

@@ -0,0 +1,10 @@
+## 1.10.0
+
+### New Queries
+
+* Added a new query, `cs/linq/missed-firstordefault`, that detects `foreach` loops that can be expressed more clearly using LINQ's `FirstOrDefault` method.
+
+### Minor Analysis Improvements
+
+* The `cs/linq/missed-*` queries no longer suggest rewrites that would capture `in`, `out`, or `ref` parameters in a lambda, fixing false-positive results for transformations that would not compile.
+* The `cs/web/missing-token-validation` query now recognizes an ASP.NET Core `AutoValidateAntiforgeryTokenAttribute` registered as a global MVC filter through `AddControllersWithViews` (and friends), avoiding false-positive results for covered actions.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.9.3
+lastReleaseVersion: 1.10.0
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.9.4-dev
+version: 1.10.0
 groups:
   - csharp
   - queries

@@ -1,3 +1,7 @@
+## 1.0.58
+
+No user-facing changes.
+
 ## 1.0.57
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.0.58
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.57
+lastReleaseVersion: 1.0.58
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.58-dev
+version: 1.0.58
 groups:
   - go
   - queries

@@ -1,3 +1,12 @@
+## 7.3.2
+
+### Minor Analysis Improvements
+
+* Added or improved data flow models for the following Go standard-library APIs introduced or updated in Go 1.27:
+	* `bytes.CutLast`, `database/sql.ConvertAssign`, `database/sql/driver.RowsColumnScanner.ScanColumn`, `net/url.URL.Clone`, `net/url.Values.Clone` and `strings.CutLast`.
+	* The new `encoding/json/jsontext` package.
+* Added more data flow models for the `strings` package: `strings.Clone`, `Cut`, `CutPrefix`, `CutSuffix`, `Fields`, `FieldsFunc`, and `Join`; `strings.Builder.String`, `Builder.WriteByte`, and `Builder.WriteRune`; `strings.Reader.ReadByte` and `Reader.ReadRune`; and `strings.Replacer.Replace` and `Replacer.WriteString`.
+
 ## 7.3.1
 
 No user-facing changes.

@@ -1,6 +1,7 @@
----
-category: minorAnalysis
----
+## 7.3.2
+
+### Minor Analysis Improvements
+
 * Added or improved data flow models for the following Go standard-library APIs introduced or updated in Go 1.27:
 	* `bytes.CutLast`, `database/sql.ConvertAssign`, `database/sql/driver.RowsColumnScanner.ScanColumn`, `net/url.URL.Clone`, `net/url.Values.Clone` and `strings.CutLast`.
 	* The new `encoding/json/jsontext` package.

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.3.1
+lastReleaseVersion: 7.3.2
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 7.3.2-dev
+version: 7.3.2
 groups: go
 dbscheme: go.dbscheme
 extractor: go

@@ -1,3 +1,7 @@
+## 1.6.11
+
+No user-facing changes.
+
 ## 1.6.10
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.6.11
+
+No user-facing changes.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.6.10
+lastReleaseVersion: 1.6.11
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.6.11-dev
+version: 1.6.11
 groups:
   - go
   - queries

@@ -1,3 +1,10 @@
+## 9.3.1
+
+### Minor Analysis Improvements
+
+* Support for Kotlin 2.4.20 has been added.
+* Fixed an issue where `Foo::class.java` arguments were dropped during extraction under the Kotlin K2 compiler, which could cause false positives in queries such as `java/android/implicit-pendingintents`.
+
 ## 9.3.0
 
 ### New Features

@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 9.3.1
+
+### Minor Analysis Improvements
+
+* Support for Kotlin 2.4.20 has been added.
 * Fixed an issue where `Foo::class.java` arguments were dropped during extraction under the Kotlin K2 compiler, which could cause false positives in queries such as `java/android/implicit-pendingintents`.
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 9.3.0
+lastReleaseVersion: 9.3.1
@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 9.3.1-dev
+version: 9.3.1
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

@@ -1,3 +1,7 @@
+## 1.11.11
+
+No user-facing changes.
+
 ## 1.11.10
 
 No user-facing changes.

@@ -0,0 +1,3 @@
+## 1.11.11
+
+No user-facing changes.