diff --git a/.codeql-version b/.codeql-version
index 8c3f85f9..e22d902c 100644
--- a/.codeql-version
+++ b/.codeql-version
@@ -1 +1 @@
-v2.27.2
+v2.27.3
diff --git a/README.md b/README.md
index 3c501797..1dd80206 100644
--- a/README.md
+++ b/README.md
@@ -8,8 +8,10 @@ including findings about private code that cannot travel the public advisory rou
## GETTING STARTED
-**ABOM is unreleased. Building from source is the only supported installation.** GitHub Release
-downloads and Helm deployment are not available.
+**ABOM is published as [GitHub Releases](https://github.com/advanced-security/codeql-abom/releases)**:
+verifiable archives for Linux and macOS on amd64 and arm64, each built against the CodeQL CLI its
+version names. A release's notes say how to verify its archive and start it. You can also build
+from source, as the steps below do. Helm deployment is planned but not yet available.
To try ABOM without an organization, run a [Demo](docs/demo.md) from an archive of this
repository: `make demo-check`, then `make demo`. Or
@@ -62,7 +64,6 @@ claim traces back to the query or advisory that made it. If `actions/unpinned-ta
a reference, this tool will not tell you it is safe — it will tell you the rule did not look.
Coverage, unresolved dependencies and unplaceable findings are reported as first-class output.
-Silence about what was not analyzed reads as completeness, and would be a lie.
## Native Actions lockfiles
diff --git a/docs/demo.md b/docs/demo.md
index b77a574e..9c825f15 100644
--- a/docs/demo.md
+++ b/docs/demo.md
@@ -185,11 +185,11 @@ Install the CodeQL CLI with the [GitHub CLI](https://cli.github.com/)'s `gh code
```bash
gh auth login # once; the extension downloads CodeQL from GitHub
gh extension install github/gh-codeql
-gh codeql set-version v2.27.2
+gh codeql set-version v2.27.3
mkdir -p "$HOME/.local/bin"
gh codeql install-stub "$HOME/.local/bin" # puts `codeql` on PATH
export PATH="$HOME/.local/bin:$PATH" # add this line to your shell profile too
-codeql version --format=terse # prints 2.27.2
+codeql version --format=terse # prints 2.27.3
```
Any patch release of the minor version in [`.codeql-version`](../.codeql-version) (`v2.27.x`, at
diff --git a/docs/deployment/index.md b/docs/deployment/index.md
index e1b23438..3e68161b 100644
--- a/docs/deployment/index.md
+++ b/docs/deployment/index.md
@@ -1,15 +1,14 @@
# Deploy ABOM
-Deployment means installing and configuring ABOM itself. **ABOM is unreleased; source installation
-is the only supported deployment.** There are no supported GitHub Release archives, container
-images or Helm installation instructions to use yet.
+Deployment means installing and configuring ABOM itself. **ABOM is published as
+[GitHub Release](https://github.com/advanced-security/codeql-abom/releases) archives, and can be
+built from source.** There are no container images or Helm installation instructions to use yet.
```mermaid
flowchart LR
- SOURCE["Build from source"] -->|"supported route"| LOCAL["Local ABOM
API and browser UI"]
- RELEASE["GitHub Release archives"] -. "not available" .-> LOCAL
+ SOURCE["Build from source"] -->|"source setup"| LOCAL["Local ABOM
API and browser UI"]
+ RELEASE["GitHub Release archives"] -->|"release notes"| LOCAL
HELM["Helm deployment"] -. "not available" .-> CLUSTER["Distributed Kubernetes execution"]
- style RELEASE fill:#3d2d1d
style HELM fill:#3d2d1d
style CLUSTER fill:#3d2d1d
```
@@ -18,6 +17,7 @@ flowchart LR
| Need | Guide |
| --- | --- |
+| Verify, unpack and start a published release archive | That release's [notes](https://github.com/advanced-security/codeql-abom/releases) |
| Install tools, query packs and the local application | [Build from source](source.md) |
| Authenticate, declare ownership and choose paths or optional features | [Configuration](configuration.md) |
| Start, stop, inspect, back up or troubleshoot an installation | [Operations](operations.md) |
@@ -36,7 +36,7 @@ state; copying only the main database file is not a backup.
ABOM applies [best-effort remote-source checks](configuration.md#remote-source-eligibility).
The [deployment plan](../../plans/tools/deployment.md) owns release archives and Kubernetes work,
-including the proposed Linux/macOS amd64/arm64 release matrix. Windows is outside that workstream.
-Until qualification is complete, the proposed matrix is not a certification of every operating
-system, architecture or external service. Future user guides will accompany usable release and
-Helm routes, not placeholders that suggest those routes already exist.
+including the Linux/macOS amd64/arm64 release matrix. Windows is outside that workstream. Until
+qualification is complete, that matrix is not a certification of every operating system,
+architecture or external service. Future user guides will accompany a usable Helm route, not
+placeholders that suggest that route already exists.
diff --git a/docs/deployment/operations.md b/docs/deployment/operations.md
index 4eabd675..d47c6027 100644
--- a/docs/deployment/operations.md
+++ b/docs/deployment/operations.md
@@ -84,7 +84,7 @@ is not available merely because SQLite can produce a snapshot.
## Checkout updates and removal
-ABOM is unreleased and has no supported release-to-release upgrade or downgrade procedure. Before
+ABOM has no supported release-to-release upgrade or downgrade procedure. Before
changing a working checkout, stop its server and preserve its state. Follow
[source setup](source.md) again for changed toolchain pins or query dependencies, then rebuild.
Startup migrations are not a promise that an older executable can read the resulting database.
diff --git a/internal/customql/customql.go b/internal/customql/customql.go
index 6d3b6894..ab1d558b 100644
--- a/internal/customql/customql.go
+++ b/internal/customql/customql.go
@@ -30,7 +30,7 @@ const SuitePath = "codeql-suites/abom-custom.qls"
// ActionsAll is the codeql/actions-all both scaffolded packs pin: the version ABOM's own queries
// and ql-mcp's tool queries resolve, so a query is written and run against one library.
-const ActionsAll = "0.6.3"
+const ActionsAll = "0.7.0"
// Postprocess is the query, relative to the test pack, that reads a fixture's `# $ Alert` markers.
const Postprocess = "utils/InlineExpectationsTestQuery.ql"
diff --git a/internal/harness/copilot.go b/internal/harness/copilot.go
index 889db053..9ac066a2 100644
--- a/internal/harness/copilot.go
+++ b/internal/harness/copilot.go
@@ -53,7 +53,7 @@ var builtins = []string{"view", "glob", "grep", "create", "edit"}
const DefaultModel = "claude-opus-5"
// DefaultQLMCP starts the ql-mcp release the loop was recorded against.
-const DefaultQLMCP = "npx -y codeql-development-mcp-server@2.27.2"
+const DefaultQLMCP = "npx -y codeql-development-mcp-server@2.27.3"
// mcpTimeout bounds one ql-mcp call; extracting and testing run CodeQL.
const mcpTimeout = int((20 * time.Minute) / time.Millisecond)
diff --git a/internal/runner/printast.go b/internal/runner/printast.go
index 0736cfa8..4ec4322c 100644
--- a/internal/runner/printast.go
+++ b/internal/runner/printast.go
@@ -19,7 +19,7 @@ const toolsPackName = "advanced-security/ql-mcp-actions-tools-src"
// ToolsPack is that pack, pinned, so a tree ABOM prints and one a session printed come from the
// same query.
-const ToolsPack = toolsPackName + "@2.27.2"
+const ToolsPack = toolsPackName + "@2.27.3"
// printASTSources names the data extension that tells PrintAST which fixtures to print.
const printASTSources = "abom/print-ast-sources"
diff --git a/ql/actions/findings/src/codeql-pack.lock.yml b/ql/actions/findings/src/codeql-pack.lock.yml
index bbf49e9c..07ba8725 100644
--- a/ql/actions/findings/src/codeql-pack.lock.yml
+++ b/ql/actions/findings/src/codeql-pack.lock.yml
@@ -2,35 +2,35 @@
lockVersion: 1.0.0
dependencies:
codeql/actions-all:
- version: 0.6.3
+ version: 0.7.0
codeql/actions-queries:
- version: 0.6.37
+ version: 0.6.38
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/javascript-all:
- version: 2.10.3
+ version: 2.10.4
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/suite-helpers:
- version: 1.0.59
+ version: 1.0.60
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/actions/findings/src/codeql-pack.yml b/ql/actions/findings/src/codeql-pack.yml
index 0b2e5d73..11377c18 100644
--- a/ql/actions/findings/src/codeql-pack.yml
+++ b/ql/actions/findings/src/codeql-pack.yml
@@ -1,9 +1,9 @@
name: advanced-security/abom-actions-findings-src
-version: 2.27.2
+version: 2.27.3
description: 'Actions queries whose findings ABOM records and attributes, upstream and its own'
library: false
suites: codeql-suites
dependencies:
- codeql/actions-queries: 0.6.37
- codeql/actions-all: 0.6.3
+ codeql/actions-queries: 0.6.38
+ codeql/actions-all: 0.7.0
advanced-security/abom-actions-lib: ${workspace}
diff --git a/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls b/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls
index 3ca38798..99119642 100644
--- a/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls
+++ b/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls
@@ -20,4 +20,4 @@
# so the set of rules ABOM attributes could change with no commit here.
- queries: experimental
from: codeql/actions-queries
- version: 0.6.37
+ version: 0.6.38
diff --git a/ql/actions/findings/src/codeql-suites/abom-findings.qls b/ql/actions/findings/src/codeql-suites/abom-findings.qls
index 8c100c03..cfe2b0f3 100644
--- a/ql/actions/findings/src/codeql-suites/abom-findings.qls
+++ b/ql/actions/findings/src/codeql-suites/abom-findings.qls
@@ -13,7 +13,7 @@
# so the set of rules ABOM attributes could change with no commit here.
- import: codeql-suites/actions-all.qls
from: codeql/actions-queries
- version: 0.6.37
+ version: 0.6.38
# The nine `experimental/` queries stay in. Precision is a property of the rule, and a consumer
# filtering on rule id can always drop them — whereas a finding never collected cannot be
diff --git a/ql/actions/findings/test/codeql-pack.lock.yml b/ql/actions/findings/test/codeql-pack.lock.yml
index bbf49e9c..07ba8725 100644
--- a/ql/actions/findings/test/codeql-pack.lock.yml
+++ b/ql/actions/findings/test/codeql-pack.lock.yml
@@ -2,35 +2,35 @@
lockVersion: 1.0.0
dependencies:
codeql/actions-all:
- version: 0.6.3
+ version: 0.7.0
codeql/actions-queries:
- version: 0.6.37
+ version: 0.6.38
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/javascript-all:
- version: 2.10.3
+ version: 2.10.4
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/suite-helpers:
- version: 1.0.59
+ version: 1.0.60
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/actions/findings/test/codeql-pack.yml b/ql/actions/findings/test/codeql-pack.yml
index e3edebd3..6e906c95 100644
--- a/ql/actions/findings/test/codeql-pack.yml
+++ b/ql/actions/findings/test/codeql-pack.yml
@@ -1,5 +1,5 @@
name: advanced-security/abom-actions-findings-test
-version: 2.27.2
+version: 2.27.3
dependencies:
advanced-security/abom-actions-findings-src: ${workspace}
extractor: actions
diff --git a/ql/actions/graph-extraction/src/codeql-pack.lock.yml b/ql/actions/graph-extraction/src/codeql-pack.lock.yml
index 4429df3e..8a9b8340 100644
--- a/ql/actions/graph-extraction/src/codeql-pack.lock.yml
+++ b/ql/actions/graph-extraction/src/codeql-pack.lock.yml
@@ -2,31 +2,31 @@
lockVersion: 1.0.0
dependencies:
codeql/actions-all:
- version: 0.6.3
+ version: 0.7.0
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/javascript-all:
- version: 2.10.3
+ version: 2.10.4
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/actions/graph-extraction/src/codeql-pack.yml b/ql/actions/graph-extraction/src/codeql-pack.yml
index 6a506f12..3fe81b14 100644
--- a/ql/actions/graph-extraction/src/codeql-pack.yml
+++ b/ql/actions/graph-extraction/src/codeql-pack.yml
@@ -1,8 +1,8 @@
name: advanced-security/abom-actions-graph-extraction-src
-version: 2.27.2
+version: 2.27.3
description: 'Extraction queries for the Actions Bill of Materials (ABOM)'
library: false
suites: codeql-suites
dependencies:
- codeql/actions-all: 0.6.3
+ codeql/actions-all: 0.7.0
advanced-security/abom-actions-lib: ${workspace}
diff --git a/ql/actions/graph-extraction/test/codeql-pack.lock.yml b/ql/actions/graph-extraction/test/codeql-pack.lock.yml
index 4429df3e..8a9b8340 100644
--- a/ql/actions/graph-extraction/test/codeql-pack.lock.yml
+++ b/ql/actions/graph-extraction/test/codeql-pack.lock.yml
@@ -2,31 +2,31 @@
lockVersion: 1.0.0
dependencies:
codeql/actions-all:
- version: 0.6.3
+ version: 0.7.0
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/javascript-all:
- version: 2.10.3
+ version: 2.10.4
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/actions/graph-extraction/test/codeql-pack.yml b/ql/actions/graph-extraction/test/codeql-pack.yml
index 8f0124ea..85a79980 100644
--- a/ql/actions/graph-extraction/test/codeql-pack.yml
+++ b/ql/actions/graph-extraction/test/codeql-pack.yml
@@ -1,5 +1,5 @@
name: advanced-security/abom-actions-graph-extraction-test
-version: 2.27.2
+version: 2.27.3
dependencies:
advanced-security/abom-actions-graph-extraction-src: ${workspace}
extractor: actions
diff --git a/ql/actions/lib/codeql-pack.lock.yml b/ql/actions/lib/codeql-pack.lock.yml
index 4429df3e..8a9b8340 100644
--- a/ql/actions/lib/codeql-pack.lock.yml
+++ b/ql/actions/lib/codeql-pack.lock.yml
@@ -2,31 +2,31 @@
lockVersion: 1.0.0
dependencies:
codeql/actions-all:
- version: 0.6.3
+ version: 0.7.0
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/javascript-all:
- version: 2.10.3
+ version: 2.10.4
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/actions/lib/codeql-pack.yml b/ql/actions/lib/codeql-pack.yml
index 2576608a..a9567c28 100644
--- a/ql/actions/lib/codeql-pack.yml
+++ b/ql/actions/lib/codeql-pack.yml
@@ -1,6 +1,6 @@
name: advanced-security/abom-actions-lib
-version: 2.27.2
+version: 2.27.3
description: 'Shared Actions libraries for ABOM queries'
library: true
dependencies:
- codeql/actions-all: 0.6.3
+ codeql/actions-all: 0.7.0
diff --git a/ql/actions/selfcheck/src/codeql-pack.lock.yml b/ql/actions/selfcheck/src/codeql-pack.lock.yml
index bbf49e9c..07ba8725 100644
--- a/ql/actions/selfcheck/src/codeql-pack.lock.yml
+++ b/ql/actions/selfcheck/src/codeql-pack.lock.yml
@@ -2,35 +2,35 @@
lockVersion: 1.0.0
dependencies:
codeql/actions-all:
- version: 0.6.3
+ version: 0.7.0
codeql/actions-queries:
- version: 0.6.37
+ version: 0.6.38
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/javascript-all:
- version: 2.10.3
+ version: 2.10.4
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/suite-helpers:
- version: 1.0.59
+ version: 1.0.60
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/actions/selfcheck/src/codeql-pack.yml b/ql/actions/selfcheck/src/codeql-pack.yml
index 64447032..4551dc5e 100644
--- a/ql/actions/selfcheck/src/codeql-pack.yml
+++ b/ql/actions/selfcheck/src/codeql-pack.yml
@@ -1,8 +1,8 @@
name: advanced-security/abom-actions-selfcheck-src
-version: 2.27.2
+version: 2.27.3
description: "Queries ABOM runs against ABOM's own workflows"
library: false
suites: codeql-suites
dependencies:
- codeql/actions-queries: 0.6.37
+ codeql/actions-queries: 0.6.38
advanced-security/abom-actions-findings-src: ${workspace}
diff --git a/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls b/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls
index ea2c93c2..23ab91b5 100644
--- a/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls
+++ b/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls
@@ -5,7 +5,7 @@
# for, so the experimental queries that abom-findings.qls keeps are absent.
- import: codeql-suites/actions-security-and-quality.qls
from: codeql/actions-queries
- version: 0.6.37
+ version: 0.6.38
# Retains `Debug/SyntaxError` and `Diagnostics/SuccessfullyExtractedFiles`, which the upstream
# suite includes and which report nothing about security. They stay because a self audit that
diff --git a/ql/csharp/quality/src/codeql-pack.lock.yml b/ql/csharp/quality/src/codeql-pack.lock.yml
index 9e42b023..f67b4cc4 100644
--- a/ql/csharp/quality/src/codeql-pack.lock.yml
+++ b/ql/csharp/quality/src/codeql-pack.lock.yml
@@ -2,29 +2,29 @@
lockVersion: 1.0.0
dependencies:
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/csharp-all:
- version: 7.4.0
+ version: 7.4.1
codeql/csharp-queries:
- version: 1.10.1
+ version: 1.10.2
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/rangeanalysis:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/suite-helpers:
- version: 1.0.59
+ version: 1.0.60
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/csharp/quality/src/codeql-pack.yml b/ql/csharp/quality/src/codeql-pack.yml
index a9504cff..62ce2d73 100644
--- a/ql/csharp/quality/src/codeql-pack.yml
+++ b/ql/csharp/quality/src/codeql-pack.yml
@@ -1,7 +1,7 @@
name: advanced-security/abom-csharp-quality-src
-version: 2.27.2
+version: 2.27.3
description: "Code quality queries ABOM runs against its own C#"
library: false
suites: codeql-suites
dependencies:
- codeql/csharp-queries: 1.10.1
+ codeql/csharp-queries: 1.10.2
diff --git a/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls b/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls
index 92428f38..3778bcb3 100644
--- a/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls
+++ b/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls
@@ -4,7 +4,7 @@
# newest, so the finding count moves without the code moving.
- import: codeql-suites/csharp-security-and-quality.qls
from: codeql/csharp-queries
- version: 1.10.1
+ version: 1.10.2
# Read and rejected, 2026-09-10 — the only rule this suite excludes, and it stays the exception.
#
diff --git a/ql/go/quality/src/codeql-pack.lock.yml b/ql/go/quality/src/codeql-pack.lock.yml
index f105a4dd..618dd4dc 100644
--- a/ql/go/quality/src/codeql-pack.lock.yml
+++ b/ql/go/quality/src/codeql-pack.lock.yml
@@ -2,27 +2,27 @@
lockVersion: 1.0.0
dependencies:
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/go-all:
- version: 8.0.0
+ version: 8.0.1
codeql/go-queries:
- version: 1.6.12
+ version: 1.6.13
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/suite-helpers:
- version: 1.0.59
+ version: 1.0.60
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
compiled: false
diff --git a/ql/go/quality/src/codeql-pack.yml b/ql/go/quality/src/codeql-pack.yml
index 0a3147db..48b1f913 100644
--- a/ql/go/quality/src/codeql-pack.yml
+++ b/ql/go/quality/src/codeql-pack.yml
@@ -1,7 +1,7 @@
name: advanced-security/abom-go-quality-src
-version: 2.27.2
+version: 2.27.3
description: "Code quality queries ABOM runs against its own Go"
library: false
suites: codeql-suites
dependencies:
- codeql/go-queries: 1.6.12
+ codeql/go-queries: 1.6.13
diff --git a/ql/go/quality/src/codeql-suites/abom-go-quality.qls b/ql/go/quality/src/codeql-suites/abom-go-quality.qls
index 50f4cbf1..2d4a95a2 100644
--- a/ql/go/quality/src/codeql-suites/abom-go-quality.qls
+++ b/ql/go/quality/src/codeql-suites/abom-go-quality.qls
@@ -10,4 +10,4 @@
# that moves on its own cannot be a baseline, and a gate built on one cannot be a gate.
- import: codeql-suites/go-security-and-quality.qls
from: codeql/go-queries
- version: 1.6.12
+ version: 1.6.13
diff --git a/ql/javascript/quality/src/codeql-pack.lock.yml b/ql/javascript/quality/src/codeql-pack.lock.yml
index 5babfa51..e4b8c114 100644
--- a/ql/javascript/quality/src/codeql-pack.lock.yml
+++ b/ql/javascript/quality/src/codeql-pack.lock.yml
@@ -2,35 +2,35 @@
lockVersion: 1.0.0
dependencies:
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/javascript-all:
- version: 2.10.3
+ version: 2.10.4
codeql/javascript-queries:
- version: 2.4.7
+ version: 2.4.8
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/suite-helpers:
- version: 1.0.59
+ version: 1.0.60
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/typos:
- version: 1.0.59
+ version: 1.0.60
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/javascript/quality/src/codeql-pack.yml b/ql/javascript/quality/src/codeql-pack.yml
index 11f298ec..ddb33db4 100644
--- a/ql/javascript/quality/src/codeql-pack.yml
+++ b/ql/javascript/quality/src/codeql-pack.yml
@@ -1,7 +1,7 @@
name: advanced-security/abom-javascript-quality-src
-version: 2.27.2
+version: 2.27.3
description: "Code quality queries ABOM runs against its own browser code"
library: false
suites: codeql-suites
dependencies:
- codeql/javascript-queries: 2.4.7
+ codeql/javascript-queries: 2.4.8
diff --git a/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls b/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls
index 38399102..730ff889 100644
--- a/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls
+++ b/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls
@@ -5,4 +5,4 @@
# vendored code never reaches these queries.
- import: codeql-suites/javascript-security-and-quality.qls
from: codeql/javascript-queries
- version: 2.4.7
+ version: 2.4.8
diff --git a/ql/python/quality/src/codeql-pack.lock.yml b/ql/python/quality/src/codeql-pack.lock.yml
index 4a7ffff8..faf30bab 100644
--- a/ql/python/quality/src/codeql-pack.lock.yml
+++ b/ql/python/quality/src/codeql-pack.lock.yml
@@ -2,33 +2,33 @@
lockVersion: 1.0.0
dependencies:
codeql/concepts:
- version: 0.0.33
+ version: 0.0.34
codeql/controlflow:
- version: 2.0.43
+ version: 2.0.44
codeql/dataflow:
- version: 2.1.15
+ version: 2.1.16
codeql/mad:
- version: 1.0.59
+ version: 1.0.60
codeql/python-all:
- version: 7.2.7
+ version: 7.2.8
codeql/python-queries:
- version: 1.8.12
+ version: 1.8.13
codeql/regex:
- version: 1.0.59
+ version: 1.0.60
codeql/ssa:
- version: 2.0.35
+ version: 2.0.36
codeql/suite-helpers:
- version: 1.0.59
+ version: 1.0.60
codeql/threat-models:
- version: 1.0.59
+ version: 1.1.0
codeql/tutorial:
- version: 1.0.59
+ version: 1.0.60
codeql/typetracking:
- version: 2.0.43
+ version: 2.0.44
codeql/util:
- version: 2.0.46
+ version: 2.0.47
codeql/xml:
- version: 1.0.59
+ version: 1.0.60
codeql/yaml:
- version: 1.0.59
+ version: 1.0.60
compiled: false
diff --git a/ql/python/quality/src/codeql-pack.yml b/ql/python/quality/src/codeql-pack.yml
index 13233c17..aa0b156b 100644
--- a/ql/python/quality/src/codeql-pack.yml
+++ b/ql/python/quality/src/codeql-pack.yml
@@ -1,7 +1,7 @@
name: advanced-security/abom-python-quality-src
-version: 2.27.2
+version: 2.27.3
description: "Security and quality queries ABOM runs against its own Python"
library: false
suites: codeql-suites
dependencies:
- codeql/python-queries: 1.8.12
+ codeql/python-queries: 1.8.13
diff --git a/ql/python/quality/src/codeql-suites/abom-python-quality.qls b/ql/python/quality/src/codeql-suites/abom-python-quality.qls
index 5106b114..e70e2aff 100644
--- a/ql/python/quality/src/codeql-suites/abom-python-quality.qls
+++ b/ql/python/quality/src/codeql-suites/abom-python-quality.qls
@@ -9,4 +9,4 @@
# cache last downloaded. A baseline that moves on its own cannot be a baseline.
- import: codeql-suites/python-security-and-quality.qls
from: codeql/python-queries
- version: 1.8.12
+ version: 1.8.13