From b2cc03ffdfb96a72a253371b3cdcde0ae999283e Mon Sep 17 00:00:00 2001 From: data-douser <70299490+data-douser@users.noreply.github.com> Date: Wed, 21 Oct 2026 05:58:47 +0000 Subject: [PATCH 1/3] Upgrade CodeQL CLI to v2.27.3 --- .codeql-version | 2 +- internal/customql/customql.go | 2 +- internal/harness/copilot.go | 2 +- internal/runner/printast.go | 2 +- ql/actions/findings/src/codeql-pack.lock.yml | 32 +++++++++---------- ql/actions/findings/src/codeql-pack.yml | 6 ++-- .../abom-experimental-findings.qls | 2 +- .../src/codeql-suites/abom-findings.qls | 2 +- ql/actions/findings/test/codeql-pack.lock.yml | 32 +++++++++---------- ql/actions/findings/test/codeql-pack.yml | 2 +- .../graph-extraction/src/codeql-pack.lock.yml | 28 ++++++++-------- .../graph-extraction/src/codeql-pack.yml | 4 +-- .../test/codeql-pack.lock.yml | 28 ++++++++-------- .../graph-extraction/test/codeql-pack.yml | 2 +- ql/actions/lib/codeql-pack.lock.yml | 28 ++++++++-------- ql/actions/lib/codeql-pack.yml | 4 +-- ql/actions/selfcheck/src/codeql-pack.lock.yml | 32 +++++++++---------- ql/actions/selfcheck/src/codeql-pack.yml | 4 +-- .../src/codeql-suites/abom-selfcheck.qls | 2 +- ql/csharp/quality/src/codeql-pack.lock.yml | 26 +++++++-------- ql/csharp/quality/src/codeql-pack.yml | 4 +-- .../src/codeql-suites/abom-csharp-quality.qls | 2 +- ql/go/quality/src/codeql-pack.lock.yml | 24 +++++++------- ql/go/quality/src/codeql-pack.yml | 4 +-- .../src/codeql-suites/abom-go-quality.qls | 2 +- .../quality/src/codeql-pack.lock.yml | 32 +++++++++---------- ql/javascript/quality/src/codeql-pack.yml | 4 +-- .../codeql-suites/abom-javascript-quality.qls | 2 +- ql/python/quality/src/codeql-pack.lock.yml | 30 ++++++++--------- ql/python/quality/src/codeql-pack.yml | 4 +-- .../src/codeql-suites/abom-python-quality.qls | 2 +- 31 files changed, 176 insertions(+), 176 deletions(-) diff --git a/.codeql-version b/.codeql-version index 8c3f85f9..e22d902c 100644 --- a/.codeql-version +++ b/.codeql-version @@ -1 +1 @@ -v2.27.2 +v2.27.3 diff --git a/internal/customql/customql.go b/internal/customql/customql.go index 6d3b6894..ab1d558b 100644 --- a/internal/customql/customql.go +++ b/internal/customql/customql.go @@ -30,7 +30,7 @@ const SuitePath = "codeql-suites/abom-custom.qls" // ActionsAll is the codeql/actions-all both scaffolded packs pin: the version ABOM's own queries // and ql-mcp's tool queries resolve, so a query is written and run against one library. -const ActionsAll = "0.6.3" +const ActionsAll = "0.7.0" // Postprocess is the query, relative to the test pack, that reads a fixture's `# $ Alert` markers. const Postprocess = "utils/InlineExpectationsTestQuery.ql" diff --git a/internal/harness/copilot.go b/internal/harness/copilot.go index 889db053..9ac066a2 100644 --- a/internal/harness/copilot.go +++ b/internal/harness/copilot.go @@ -53,7 +53,7 @@ var builtins = []string{"view", "glob", "grep", "create", "edit"} const DefaultModel = "claude-opus-5" // DefaultQLMCP starts the ql-mcp release the loop was recorded against. -const DefaultQLMCP = "npx -y codeql-development-mcp-server@2.27.2" +const DefaultQLMCP = "npx -y codeql-development-mcp-server@2.27.3" // mcpTimeout bounds one ql-mcp call; extracting and testing run CodeQL. const mcpTimeout = int((20 * time.Minute) / time.Millisecond) diff --git a/internal/runner/printast.go b/internal/runner/printast.go index 0736cfa8..4ec4322c 100644 --- a/internal/runner/printast.go +++ b/internal/runner/printast.go @@ -19,7 +19,7 @@ const toolsPackName = "advanced-security/ql-mcp-actions-tools-src" // ToolsPack is that pack, pinned, so a tree ABOM prints and one a session printed come from the // same query. -const ToolsPack = toolsPackName + "@2.27.2" +const ToolsPack = toolsPackName + "@2.27.3" // printASTSources names the data extension that tells PrintAST which fixtures to print. const printASTSources = "abom/print-ast-sources" diff --git a/ql/actions/findings/src/codeql-pack.lock.yml b/ql/actions/findings/src/codeql-pack.lock.yml index bbf49e9c..07ba8725 100644 --- a/ql/actions/findings/src/codeql-pack.lock.yml +++ b/ql/actions/findings/src/codeql-pack.lock.yml @@ -2,35 +2,35 @@ lockVersion: 1.0.0 dependencies: codeql/actions-all: - version: 0.6.3 + version: 0.7.0 codeql/actions-queries: - version: 0.6.37 + version: 0.6.38 codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/javascript-all: - version: 2.10.3 + version: 2.10.4 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/suite-helpers: - version: 1.0.59 + version: 1.0.60 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/actions/findings/src/codeql-pack.yml b/ql/actions/findings/src/codeql-pack.yml index 0b2e5d73..11377c18 100644 --- a/ql/actions/findings/src/codeql-pack.yml +++ b/ql/actions/findings/src/codeql-pack.yml @@ -1,9 +1,9 @@ name: advanced-security/abom-actions-findings-src -version: 2.27.2 +version: 2.27.3 description: 'Actions queries whose findings ABOM records and attributes, upstream and its own' library: false suites: codeql-suites dependencies: - codeql/actions-queries: 0.6.37 - codeql/actions-all: 0.6.3 + codeql/actions-queries: 0.6.38 + codeql/actions-all: 0.7.0 advanced-security/abom-actions-lib: ${workspace} diff --git a/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls b/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls index 3ca38798..99119642 100644 --- a/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls +++ b/ql/actions/findings/src/codeql-suites/abom-experimental-findings.qls @@ -20,4 +20,4 @@ # so the set of rules ABOM attributes could change with no commit here. - queries: experimental from: codeql/actions-queries - version: 0.6.37 + version: 0.6.38 diff --git a/ql/actions/findings/src/codeql-suites/abom-findings.qls b/ql/actions/findings/src/codeql-suites/abom-findings.qls index 8c100c03..cfe2b0f3 100644 --- a/ql/actions/findings/src/codeql-suites/abom-findings.qls +++ b/ql/actions/findings/src/codeql-suites/abom-findings.qls @@ -13,7 +13,7 @@ # so the set of rules ABOM attributes could change with no commit here. - import: codeql-suites/actions-all.qls from: codeql/actions-queries - version: 0.6.37 + version: 0.6.38 # The nine `experimental/` queries stay in. Precision is a property of the rule, and a consumer # filtering on rule id can always drop them — whereas a finding never collected cannot be diff --git a/ql/actions/findings/test/codeql-pack.lock.yml b/ql/actions/findings/test/codeql-pack.lock.yml index bbf49e9c..07ba8725 100644 --- a/ql/actions/findings/test/codeql-pack.lock.yml +++ b/ql/actions/findings/test/codeql-pack.lock.yml @@ -2,35 +2,35 @@ lockVersion: 1.0.0 dependencies: codeql/actions-all: - version: 0.6.3 + version: 0.7.0 codeql/actions-queries: - version: 0.6.37 + version: 0.6.38 codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/javascript-all: - version: 2.10.3 + version: 2.10.4 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/suite-helpers: - version: 1.0.59 + version: 1.0.60 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/actions/findings/test/codeql-pack.yml b/ql/actions/findings/test/codeql-pack.yml index e3edebd3..6e906c95 100644 --- a/ql/actions/findings/test/codeql-pack.yml +++ b/ql/actions/findings/test/codeql-pack.yml @@ -1,5 +1,5 @@ name: advanced-security/abom-actions-findings-test -version: 2.27.2 +version: 2.27.3 dependencies: advanced-security/abom-actions-findings-src: ${workspace} extractor: actions diff --git a/ql/actions/graph-extraction/src/codeql-pack.lock.yml b/ql/actions/graph-extraction/src/codeql-pack.lock.yml index 4429df3e..8a9b8340 100644 --- a/ql/actions/graph-extraction/src/codeql-pack.lock.yml +++ b/ql/actions/graph-extraction/src/codeql-pack.lock.yml @@ -2,31 +2,31 @@ lockVersion: 1.0.0 dependencies: codeql/actions-all: - version: 0.6.3 + version: 0.7.0 codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/javascript-all: - version: 2.10.3 + version: 2.10.4 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/actions/graph-extraction/src/codeql-pack.yml b/ql/actions/graph-extraction/src/codeql-pack.yml index 6a506f12..3fe81b14 100644 --- a/ql/actions/graph-extraction/src/codeql-pack.yml +++ b/ql/actions/graph-extraction/src/codeql-pack.yml @@ -1,8 +1,8 @@ name: advanced-security/abom-actions-graph-extraction-src -version: 2.27.2 +version: 2.27.3 description: 'Extraction queries for the Actions Bill of Materials (ABOM)' library: false suites: codeql-suites dependencies: - codeql/actions-all: 0.6.3 + codeql/actions-all: 0.7.0 advanced-security/abom-actions-lib: ${workspace} diff --git a/ql/actions/graph-extraction/test/codeql-pack.lock.yml b/ql/actions/graph-extraction/test/codeql-pack.lock.yml index 4429df3e..8a9b8340 100644 --- a/ql/actions/graph-extraction/test/codeql-pack.lock.yml +++ b/ql/actions/graph-extraction/test/codeql-pack.lock.yml @@ -2,31 +2,31 @@ lockVersion: 1.0.0 dependencies: codeql/actions-all: - version: 0.6.3 + version: 0.7.0 codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/javascript-all: - version: 2.10.3 + version: 2.10.4 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/actions/graph-extraction/test/codeql-pack.yml b/ql/actions/graph-extraction/test/codeql-pack.yml index 8f0124ea..85a79980 100644 --- a/ql/actions/graph-extraction/test/codeql-pack.yml +++ b/ql/actions/graph-extraction/test/codeql-pack.yml @@ -1,5 +1,5 @@ name: advanced-security/abom-actions-graph-extraction-test -version: 2.27.2 +version: 2.27.3 dependencies: advanced-security/abom-actions-graph-extraction-src: ${workspace} extractor: actions diff --git a/ql/actions/lib/codeql-pack.lock.yml b/ql/actions/lib/codeql-pack.lock.yml index 4429df3e..8a9b8340 100644 --- a/ql/actions/lib/codeql-pack.lock.yml +++ b/ql/actions/lib/codeql-pack.lock.yml @@ -2,31 +2,31 @@ lockVersion: 1.0.0 dependencies: codeql/actions-all: - version: 0.6.3 + version: 0.7.0 codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/javascript-all: - version: 2.10.3 + version: 2.10.4 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/actions/lib/codeql-pack.yml b/ql/actions/lib/codeql-pack.yml index 2576608a..a9567c28 100644 --- a/ql/actions/lib/codeql-pack.yml +++ b/ql/actions/lib/codeql-pack.yml @@ -1,6 +1,6 @@ name: advanced-security/abom-actions-lib -version: 2.27.2 +version: 2.27.3 description: 'Shared Actions libraries for ABOM queries' library: true dependencies: - codeql/actions-all: 0.6.3 + codeql/actions-all: 0.7.0 diff --git a/ql/actions/selfcheck/src/codeql-pack.lock.yml b/ql/actions/selfcheck/src/codeql-pack.lock.yml index bbf49e9c..07ba8725 100644 --- a/ql/actions/selfcheck/src/codeql-pack.lock.yml +++ b/ql/actions/selfcheck/src/codeql-pack.lock.yml @@ -2,35 +2,35 @@ lockVersion: 1.0.0 dependencies: codeql/actions-all: - version: 0.6.3 + version: 0.7.0 codeql/actions-queries: - version: 0.6.37 + version: 0.6.38 codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/javascript-all: - version: 2.10.3 + version: 2.10.4 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/suite-helpers: - version: 1.0.59 + version: 1.0.60 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/actions/selfcheck/src/codeql-pack.yml b/ql/actions/selfcheck/src/codeql-pack.yml index 64447032..4551dc5e 100644 --- a/ql/actions/selfcheck/src/codeql-pack.yml +++ b/ql/actions/selfcheck/src/codeql-pack.yml @@ -1,8 +1,8 @@ name: advanced-security/abom-actions-selfcheck-src -version: 2.27.2 +version: 2.27.3 description: "Queries ABOM runs against ABOM's own workflows" library: false suites: codeql-suites dependencies: - codeql/actions-queries: 0.6.37 + codeql/actions-queries: 0.6.38 advanced-security/abom-actions-findings-src: ${workspace} diff --git a/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls b/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls index ea2c93c2..23ab91b5 100644 --- a/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls +++ b/ql/actions/selfcheck/src/codeql-suites/abom-selfcheck.qls @@ -5,7 +5,7 @@ # for, so the experimental queries that abom-findings.qls keeps are absent. - import: codeql-suites/actions-security-and-quality.qls from: codeql/actions-queries - version: 0.6.37 + version: 0.6.38 # Retains `Debug/SyntaxError` and `Diagnostics/SuccessfullyExtractedFiles`, which the upstream # suite includes and which report nothing about security. They stay because a self audit that diff --git a/ql/csharp/quality/src/codeql-pack.lock.yml b/ql/csharp/quality/src/codeql-pack.lock.yml index 9e42b023..f67b4cc4 100644 --- a/ql/csharp/quality/src/codeql-pack.lock.yml +++ b/ql/csharp/quality/src/codeql-pack.lock.yml @@ -2,29 +2,29 @@ lockVersion: 1.0.0 dependencies: codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/csharp-all: - version: 7.4.0 + version: 7.4.1 codeql/csharp-queries: - version: 1.10.1 + version: 1.10.2 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/rangeanalysis: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/suite-helpers: - version: 1.0.59 + version: 1.0.60 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/csharp/quality/src/codeql-pack.yml b/ql/csharp/quality/src/codeql-pack.yml index a9504cff..62ce2d73 100644 --- a/ql/csharp/quality/src/codeql-pack.yml +++ b/ql/csharp/quality/src/codeql-pack.yml @@ -1,7 +1,7 @@ name: advanced-security/abom-csharp-quality-src -version: 2.27.2 +version: 2.27.3 description: "Code quality queries ABOM runs against its own C#" library: false suites: codeql-suites dependencies: - codeql/csharp-queries: 1.10.1 + codeql/csharp-queries: 1.10.2 diff --git a/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls b/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls index 92428f38..3778bcb3 100644 --- a/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls +++ b/ql/csharp/quality/src/codeql-suites/abom-csharp-quality.qls @@ -4,7 +4,7 @@ # newest, so the finding count moves without the code moving. - import: codeql-suites/csharp-security-and-quality.qls from: codeql/csharp-queries - version: 1.10.1 + version: 1.10.2 # Read and rejected, 2026-09-10 — the only rule this suite excludes, and it stays the exception. # diff --git a/ql/go/quality/src/codeql-pack.lock.yml b/ql/go/quality/src/codeql-pack.lock.yml index f105a4dd..618dd4dc 100644 --- a/ql/go/quality/src/codeql-pack.lock.yml +++ b/ql/go/quality/src/codeql-pack.lock.yml @@ -2,27 +2,27 @@ lockVersion: 1.0.0 dependencies: codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/go-all: - version: 8.0.0 + version: 8.0.1 codeql/go-queries: - version: 1.6.12 + version: 1.6.13 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/suite-helpers: - version: 1.0.59 + version: 1.0.60 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 compiled: false diff --git a/ql/go/quality/src/codeql-pack.yml b/ql/go/quality/src/codeql-pack.yml index 0a3147db..48b1f913 100644 --- a/ql/go/quality/src/codeql-pack.yml +++ b/ql/go/quality/src/codeql-pack.yml @@ -1,7 +1,7 @@ name: advanced-security/abom-go-quality-src -version: 2.27.2 +version: 2.27.3 description: "Code quality queries ABOM runs against its own Go" library: false suites: codeql-suites dependencies: - codeql/go-queries: 1.6.12 + codeql/go-queries: 1.6.13 diff --git a/ql/go/quality/src/codeql-suites/abom-go-quality.qls b/ql/go/quality/src/codeql-suites/abom-go-quality.qls index 50f4cbf1..2d4a95a2 100644 --- a/ql/go/quality/src/codeql-suites/abom-go-quality.qls +++ b/ql/go/quality/src/codeql-suites/abom-go-quality.qls @@ -10,4 +10,4 @@ # that moves on its own cannot be a baseline, and a gate built on one cannot be a gate. - import: codeql-suites/go-security-and-quality.qls from: codeql/go-queries - version: 1.6.12 + version: 1.6.13 diff --git a/ql/javascript/quality/src/codeql-pack.lock.yml b/ql/javascript/quality/src/codeql-pack.lock.yml index 5babfa51..e4b8c114 100644 --- a/ql/javascript/quality/src/codeql-pack.lock.yml +++ b/ql/javascript/quality/src/codeql-pack.lock.yml @@ -2,35 +2,35 @@ lockVersion: 1.0.0 dependencies: codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/javascript-all: - version: 2.10.3 + version: 2.10.4 codeql/javascript-queries: - version: 2.4.7 + version: 2.4.8 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/suite-helpers: - version: 1.0.59 + version: 1.0.60 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/typos: - version: 1.0.59 + version: 1.0.60 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/javascript/quality/src/codeql-pack.yml b/ql/javascript/quality/src/codeql-pack.yml index 11f298ec..ddb33db4 100644 --- a/ql/javascript/quality/src/codeql-pack.yml +++ b/ql/javascript/quality/src/codeql-pack.yml @@ -1,7 +1,7 @@ name: advanced-security/abom-javascript-quality-src -version: 2.27.2 +version: 2.27.3 description: "Code quality queries ABOM runs against its own browser code" library: false suites: codeql-suites dependencies: - codeql/javascript-queries: 2.4.7 + codeql/javascript-queries: 2.4.8 diff --git a/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls b/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls index 38399102..730ff889 100644 --- a/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls +++ b/ql/javascript/quality/src/codeql-suites/abom-javascript-quality.qls @@ -5,4 +5,4 @@ # vendored code never reaches these queries. - import: codeql-suites/javascript-security-and-quality.qls from: codeql/javascript-queries - version: 2.4.7 + version: 2.4.8 diff --git a/ql/python/quality/src/codeql-pack.lock.yml b/ql/python/quality/src/codeql-pack.lock.yml index 4a7ffff8..faf30bab 100644 --- a/ql/python/quality/src/codeql-pack.lock.yml +++ b/ql/python/quality/src/codeql-pack.lock.yml @@ -2,33 +2,33 @@ lockVersion: 1.0.0 dependencies: codeql/concepts: - version: 0.0.33 + version: 0.0.34 codeql/controlflow: - version: 2.0.43 + version: 2.0.44 codeql/dataflow: - version: 2.1.15 + version: 2.1.16 codeql/mad: - version: 1.0.59 + version: 1.0.60 codeql/python-all: - version: 7.2.7 + version: 7.2.8 codeql/python-queries: - version: 1.8.12 + version: 1.8.13 codeql/regex: - version: 1.0.59 + version: 1.0.60 codeql/ssa: - version: 2.0.35 + version: 2.0.36 codeql/suite-helpers: - version: 1.0.59 + version: 1.0.60 codeql/threat-models: - version: 1.0.59 + version: 1.1.0 codeql/tutorial: - version: 1.0.59 + version: 1.0.60 codeql/typetracking: - version: 2.0.43 + version: 2.0.44 codeql/util: - version: 2.0.46 + version: 2.0.47 codeql/xml: - version: 1.0.59 + version: 1.0.60 codeql/yaml: - version: 1.0.59 + version: 1.0.60 compiled: false diff --git a/ql/python/quality/src/codeql-pack.yml b/ql/python/quality/src/codeql-pack.yml index 13233c17..aa0b156b 100644 --- a/ql/python/quality/src/codeql-pack.yml +++ b/ql/python/quality/src/codeql-pack.yml @@ -1,7 +1,7 @@ name: advanced-security/abom-python-quality-src -version: 2.27.2 +version: 2.27.3 description: "Security and quality queries ABOM runs against its own Python" library: false suites: codeql-suites dependencies: - codeql/python-queries: 1.8.12 + codeql/python-queries: 1.8.13 diff --git a/ql/python/quality/src/codeql-suites/abom-python-quality.qls b/ql/python/quality/src/codeql-suites/abom-python-quality.qls index 5106b114..e70e2aff 100644 --- a/ql/python/quality/src/codeql-suites/abom-python-quality.qls +++ b/ql/python/quality/src/codeql-suites/abom-python-quality.qls @@ -9,4 +9,4 @@ # cache last downloaded. A baseline that moves on its own cannot be a baseline. - import: codeql-suites/python-security-and-quality.qls from: codeql/python-queries - version: 1.8.12 + version: 1.8.13 From 599bec9d7c29889b8839bfdbbc883b615426a43b Mon Sep 17 00:00:00 2001 From: Nathan Randall Date: Thu, 22 Oct 2026 12:24:34 -0600 Subject: [PATCH 2/3] chore(docs): update docs for v2.27.3 release --- README.md | 6 ++++-- docs/demo.md | 4 ++-- docs/deployment/index.md | 20 ++++++++++---------- docs/deployment/operations.md | 2 +- 4 files changed, 17 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index 3c501797..3b4ca9d2 100644 --- a/README.md +++ b/README.md @@ -8,8 +8,10 @@ including findings about private code that cannot travel the public advisory rou ## GETTING STARTED -**ABOM is unreleased. Building from source is the only supported installation.** GitHub Release -downloads and Helm deployment are not available. +**ABOM is published as [GitHub Releases](https://github.com/advanced-security/codeql-abom/releases)**: +verifiable archives for Linux and macOS on amd64 and arm64, each built against the CodeQL CLI its +version names. A release's notes say how to verify its archive and start it. You can also build +from source, as the steps below do. Helm deployment is planned but not yet available. To try ABOM without an organization, run a [Demo](docs/demo.md) from an archive of this repository: `make demo-check`, then `make demo`. Or diff --git a/docs/demo.md b/docs/demo.md index b77a574e..9c825f15 100644 --- a/docs/demo.md +++ b/docs/demo.md @@ -185,11 +185,11 @@ Install the CodeQL CLI with the [GitHub CLI](https://cli.github.com/)'s `gh code ```bash gh auth login # once; the extension downloads CodeQL from GitHub gh extension install github/gh-codeql -gh codeql set-version v2.27.2 +gh codeql set-version v2.27.3 mkdir -p "$HOME/.local/bin" gh codeql install-stub "$HOME/.local/bin" # puts `codeql` on PATH export PATH="$HOME/.local/bin:$PATH" # add this line to your shell profile too -codeql version --format=terse # prints 2.27.2 +codeql version --format=terse # prints 2.27.3 ``` Any patch release of the minor version in [`.codeql-version`](../.codeql-version) (`v2.27.x`, at diff --git a/docs/deployment/index.md b/docs/deployment/index.md index e1b23438..3e68161b 100644 --- a/docs/deployment/index.md +++ b/docs/deployment/index.md @@ -1,15 +1,14 @@ # Deploy ABOM -Deployment means installing and configuring ABOM itself. **ABOM is unreleased; source installation -is the only supported deployment.** There are no supported GitHub Release archives, container -images or Helm installation instructions to use yet. +Deployment means installing and configuring ABOM itself. **ABOM is published as +[GitHub Release](https://github.com/advanced-security/codeql-abom/releases) archives, and can be +built from source.** There are no container images or Helm installation instructions to use yet. ```mermaid flowchart LR - SOURCE["Build from source"] -->|"supported route"| LOCAL["Local ABOM
API and browser UI"] - RELEASE["GitHub Release archives"] -. "not available" .-> LOCAL + SOURCE["Build from source"] -->|"source setup"| LOCAL["Local ABOM
API and browser UI"] + RELEASE["GitHub Release archives"] -->|"release notes"| LOCAL HELM["Helm deployment"] -. "not available" .-> CLUSTER["Distributed Kubernetes execution"] - style RELEASE fill:#3d2d1d style HELM fill:#3d2d1d style CLUSTER fill:#3d2d1d ``` @@ -18,6 +17,7 @@ flowchart LR | Need | Guide | | --- | --- | +| Verify, unpack and start a published release archive | That release's [notes](https://github.com/advanced-security/codeql-abom/releases) | | Install tools, query packs and the local application | [Build from source](source.md) | | Authenticate, declare ownership and choose paths or optional features | [Configuration](configuration.md) | | Start, stop, inspect, back up or troubleshoot an installation | [Operations](operations.md) | @@ -36,7 +36,7 @@ state; copying only the main database file is not a backup. ABOM applies [best-effort remote-source checks](configuration.md#remote-source-eligibility). The [deployment plan](../../plans/tools/deployment.md) owns release archives and Kubernetes work, -including the proposed Linux/macOS amd64/arm64 release matrix. Windows is outside that workstream. -Until qualification is complete, the proposed matrix is not a certification of every operating -system, architecture or external service. Future user guides will accompany usable release and -Helm routes, not placeholders that suggest those routes already exist. +including the Linux/macOS amd64/arm64 release matrix. Windows is outside that workstream. Until +qualification is complete, that matrix is not a certification of every operating system, +architecture or external service. Future user guides will accompany a usable Helm route, not +placeholders that suggest that route already exists. diff --git a/docs/deployment/operations.md b/docs/deployment/operations.md index 4eabd675..d47c6027 100644 --- a/docs/deployment/operations.md +++ b/docs/deployment/operations.md @@ -84,7 +84,7 @@ is not available merely because SQLite can produce a snapshot. ## Checkout updates and removal -ABOM is unreleased and has no supported release-to-release upgrade or downgrade procedure. Before +ABOM has no supported release-to-release upgrade or downgrade procedure. Before changing a working checkout, stop its server and preserve its state. Follow [source setup](source.md) again for changed toolchain pins or query dependencies, then rebuild. Startup migrations are not a promise that an older executable can read the resulting database. From 21de9954d4929ec71b93220e1d246b5ef9717666 Mon Sep 17 00:00:00 2001 From: Nathan Randall Date: Thu, 22 Oct 2026 12:25:30 -0600 Subject: [PATCH 3/3] chore(docs): update docs for v2.27.3 release --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 3b4ca9d2..1dd80206 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,6 @@ claim traces back to the query or advisory that made it. If `actions/unpinned-ta a reference, this tool will not tell you it is safe — it will tell you the rule did not look. Coverage, unresolved dependencies and unplaceable findings are reported as first-class output. -Silence about what was not analyzed reads as completeness, and would be a lie. ## Native Actions lockfiles