Pulse · github/codeql · GitHub

8000 Pulse · github/codeql · GitHub

More Web Proxy on the site http://driver.im/

July 8, 2025 – July 15, 2025

Overview

54 Active pull requests

10 Active issues

41 Pull requests merged by 17 people

C++: Fix global variable dataflow FP
#20040 merged Jul 14, 2025
JavaScript: Ignore outDirs that would exclude everything
#20030 merged Jul 14, 2025
Kotlin: tweak plugin test
#20039 merged Jul 14, 2025
Rust: Rename type inference test inline expectation tag
#20037 merged Jul 14, 2025
Ruby: enable overlay compilation
#19731 merged Jul 14, 2025
Rust: Update legacy MaD models 3
#19946 merged Jul 14, 2025
Kotlin: Update regex patterns to use raw string notation
#20034 merged Jul 14, 2025
Bump golang.org/x/tools from 0.34.0 to 0.35.0 in /go/extractor in the extractor-dependencies group
#20035 merged Jul 14, 2025
Actions: Fix Critical Artifact poisoning False Positive
#19388 merged Jul 14, 2025
C++: Fix C++20 concept related class extensions
#20026 merged Jul 13, 2025
Go: Add Head and Client.Head from net/http as request forgery sinks
#20000 merged Jul 11, 2025
Java: add extra sink for java/unsafe-deserialization
#20025 merged Jul 11, 2025
Rust: add more type inference tests for patterns and a simple one for a closure call
#20029 merged Jul 11, 2025
Python: Support type annotations in call graph
#19672 merged Jul 11, 2025
Rust: Remove Resolvable.resolvesAsItem
#20027 merged Jul 11, 2025
C++: Better dataflow for function objects
#20023 merged Jul 11, 2025
C++: Do not alert on unreachable code in cpp/incorrect-string-type-conversion
#20014 merged Jul 11, 2025
Rust: Type inference for pattern matching
#20020 merged Jul 11, 2025
Support approximate related locations
#19943 merged Jul 11, 2025
Rust: Fix type inference for library parameters
#19658 merged Jul 11, 2025
Rust: Disambiguate associated function calls
#19995 merged Jul 10, 2025
C++: Add dataflow predicate for checking if a node is the final value of a parameter
#20017 merged Jul 10, 2025
Ruby: add overlay annotations to AST/CFG/SSA layers
#19989 merged Jul 10, 2025
C++: Add more thread creation models
#20016 merged Jul 10, 2025
Rust: Update legacy MaD models 2
#19942 merged Jul 10, 2025
Rust: Add more test cases for sensitive data
#20002 merged Jul 10, 2025
Rust: Update legacy MaD models 4
#19948 merged Jul 10, 2025
Java: Add query to detect non-case labels in switch statements
#19998 merged Jul 10, 2025
Rust: Fix bad join
#20015 merged Jul 10, 2025
Bump golang.org/x/mod from 0.25.0 to 0.26.0 in /go/extractor in the extractor-dependencies group
#20009 merged Jul 10, 2025
Rust: add test cases for basic unwrapping and pattern matching
#20003 merged Jul 10, 2025
QL4QL: Discard predicates are always alive
#20013 merged Jul 10, 2025
Download GitHub database: fix gh invocation
#10923 merged Jul 10, 2025
Rust: fix missing canonical paths for trait impls on builtin numeric types
#20001 merged Jul 10, 2025
C++: Fix some typos in recent change notes
#20010 merged Jul 10, 2025
Rust: Add type inference test cases for tuples.
#20004 merged Jul 10, 2025
Rust: set SHA256s in MODULE.bazel
#19999 merged Jul 9, 2025
Rust: Adjust the inferred type of string literals
#19996 merged Jul 8, 2025
Java: Add query to detect special characters in string literals
#19875 merged Jul 8, 2025
Java: Add 'Useless serialization member in record class' query
#19950 merged Jul 8, 2025
Rust: Improve type inference for for loops and range expressions
#19971 merged Jul 8, 2025

13 Pull requests opened by 12 people

Java: Promote Insecure Spring Boot Actuator Configuration query from experimental
#20006 opened Jul 9, 2025
feat: add getASupertype() predicate in ValueOrRefType.
#20008 opened Jul 10, 2025
Overlay: Add XML and Java property discarding
#20011 opened Jul 10, 2025
Java: Update qhelp: SnakeYaml is safe from version 2.0
#20018 opened Jul 10, 2025
Shared: Improve sensitive data heuristics
#20024 opened Jul 11, 2025
Experiment: Make all data flow incremental
#20028 opened Jul 11, 2025
Kotlin: Run the tests with 2.2.0
#20031 opened Jul 11, 2025
Python: Modernize 3 quality queries for comparison methods
#20038 opened Jul 14, 2025
Rust: Type inference for tuples
#20041 opened Jul 14, 2025
Rust: Make rust/summary/query-sinks less noisy
#20042 opened Jul 14, 2025
Shared: Overhaul the AlertFiltering QLDoc
#20047 opened Jul 14, 2025
JS: Exclude patched libraries from `xml-bomb` sink
#20048 opened Jul 15, 2025
Java: use `overlayChangedFiles` in discard prediactes
#20049 opened Jul 15, 2025

4 Issues closed by 3 people

C# ReturnStmt (and other statements) doesn't return any getExpr() nor any getAChild() since v2.21.1
#20033 closed Jul 14, 2025
- Add rake task to verify <<next>> placeholders are replaced when VERSION changes
#20036 closed Jul 14, 2025
False positive
#20022 closed Jul 11, 2025
Rust: Learn from other security products
#20007 closed Jul 10, 2025

6 Issues opened by 4 people

General issue: How to make QL scripts support accepting command-line arguments
#20050 opened Jul 15, 2025
d7c4374a9629fdd66972ffdcaf04909297017e15
#20046 opened Jul 14, 2025
Hi Ivana! I'm not Bosnian but I'm Croatian, and that's close. Thank you for your contribution! I have started reviewing the text, but it seems to me that there needs to be a lot more work done on this before it's ready, as there seem to be a lot of errors with cases. I would like to help rewrite some of the more complex sentences, but I fear that I don't know very well the subtle boundaries of our languages and that I might express myself in Croatian in places where Bosnian is different. So, I suggest that we find someone who is really proficient with the Bosnian language who can make a pass at this. How does that sound?
#20045 opened Jul 14, 2025
General issuehttps://eu.docworkspace.com/d/sIBHUgsO7AoXC1cMG?sa=601.1074
#20044 opened Jul 14, 2025
False positive: go/zipslip when `filepath.IsLocal` is already used
#20043 opened Jul 14, 2025
General issue: Find the annotated type of a C# base interface
#20032 opened Jul 11, 2025

11 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

Python: Modernize 4 queries for missing/multiple calls to init/del methods
#19932 commented on Jul 14, 2025 • 8 new comments
Diff-informed queries: phase 3 (non-trivial locations)
#19957 commented on Jul 15, 2025 • 4 new comments
Rust: Update SqlxQuery, SqlxExecute to use getCanonicalPath
#19802 commented on Jul 11, 2025 • 3 new comments
sec shared
#19984 commented on Jul 14, 2025 • 1 new comment
[Rust] weird behavior in dataflow when trying to select a specific node
#19983 commented on Jul 9, 2025 • 0 new comments
CodeQL Docs: SnakeYaml is now secure by default
#19664 commented on Jul 10, 2025 • 0 new comments
ShellEscape aint always escaping shells
#19906 commented on Jul 10, 2025 • 0 new comments
Idea/Feature request: codeql as MCP Server
#19150 commented on Jul 14, 2025 • 0 new comments
Overlay: Enable overlay compilation for Java
#19872 commented on Jul 14, 2025 • 0 new comments
Rust: Rework type inference for impl Trait in return position
#19954 commented on Jul 11, 2025 • 0 new comments
Just: introduce common "verbs"
#19978 commented on Jul 10, 2025 • 0 new comments

0