Update dependencies to packs shipped with 2.21.1#124
Merged
GeekMasher merged 6 commits intoJun 13, 2025
Merged
Conversation
Contributor
Contributor
|
@jorgectf The changes are merged now so you can directly set the CodeQL version in a single place. Let me know if you need any other help with this PR |
jcogs33
force-pushed
the
jcogs33/update-package-dependencies-2.21.0
branch
from
a560faf to
35abd73
Compare
jcogs33
changed the title
jcogs33
force-pushed
the
jcogs33/update-package-dependencies-2.21.0
branch
from
e19059b to
0d767fd
Compare
Closed
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR updates all CodeQL dependency versions and adjusts configuration files to align with CodeQL 2.21.1. Key changes include:
- Updating all lock files and the .codeqlversion file to 2.21.1.
- Replacing outdated import paths (semmle.code.xml.MyBatisMapperXML) with the new semmle.code.java.frameworks.MyBatis in MyBatis-related queries.
- Removing Spring Boot actuator related queries and configuration files that no longer compile.
Reviewed Changes
Copilot reviewed 62 out of 62 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| java/src/security/CWE-089/MyBatisMapperXmlSqlInjectionLib.qll | Updated MyBatis import to the new framework path. |
| java/src/security/CWE-089/MyBatisMapperXmlSqlInjection.ql | Updated MyBatis import to the new framework path. |
| java/src/security/CWE-089/MyBatisCommonLib.qll | Removed the old MyBatis XML import in favor of the new frameworks import. |
| java/src/security/CWE-016/* (multiple files) | Removed security rules and configuration for Spring Boot actuators. |
| (Various *.yml files in java, go, csharp, and cpp directories) | Updated package versions in lock files. |
| .codeqlversion | Updated version from 2.20.1 to 2.21.1. |
Comments suppressed due to low confidence (3)
java/src/security/CWE-089/MyBatisMapperXmlSqlInjectionLib.qll:5
- The import of 'semmle.code.xml.MyBatisMapperXML' has been replaced with 'semmle.code.java.frameworks.MyBatis'. Please verify that all dependent references are compatible with the new API.
import semmle.code.xml.MyBatisMapperXML
java/src/security/CWE-089/MyBatisMapperXmlSqlInjection.ql:16
- The outdated import 'semmle.code.xml.MyBatisMapperXML' has been updated to 'semmle.code.java.frameworks.MyBatis'. Confirm that this change aligns with the expected behavior of the query.
import semmle.code.xml.MyBatisMapperXML
java/src/security/CWE-089/MyBatisCommonLib.qll:5
- The removal of 'semmle.code.xml.MyBatisMapperXML' in favor of using 'semmle.code.java.frameworks.MyBatis' should be checked for compatibility across all MyBatis-related queries.
import semmle.code.xml.MyBatisMapperXML
GeekMasher
approved these changes
Jun 13, 2025
This was referenced Jul 6, 2026
felickz
added a commit
that referenced
this pull request
Jul 7, 2026
- Clarify #126 (bump-all-packs) has sat unmerged since Apr 2025, predating #124's CLI 2.21.1 refresh - so only java has actually published 2.21.1-era content; other 6 languages' GHCR packages are still stale. - Clarify the .release.yml configs/*.yml pattern is dead (never matched in repo history) and the libs: pin pattern only applies to 5/7 langs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
felickz
added a commit
that referenced
this pull request
Jul 7, 2026
…state - Rephrase pack-directory checklist item to list pack roots explicitly instead of mixing a generic notion with one example path. - Recast the #124/#126 note as a historical lesson instead of asserting #126's current PR state (which will go stale once it merges/closes). - Describe the release/publish version drift conceptually instead of citing specific version numbers that will rot as things change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
felickz
added a commit
that referenced
this pull request
Jul 7, 2026
* docs: document the current release/publish process in CONTRIBUTING.md Add a "Releases & publishing" section describing how things actually work today, as checkbox checklists rather than prose: - Shipping a change to a query/library pack: publish.yml only publishes a pack when its qlpack.yml `version:` differs from what's on GHCR, so merging alone never publishes anything - a version bump is a required manual step. - Updating the pinned CodeQL CLI/library version: also fully manual today (.codeqlversion bump, `codeql pack upgrade` per pack, fixing breakage, bumping affected pack versions). Notes that the current v2.21.1 update split this across #124 (dependency refresh) and #126 (still-open pack version bump PR) as a live example of the gap. - What GitHub Releases are for: clarifies .release.yml/update-release.yml and the Releases tab are a separate, decoupled, manual changelog process - and that they're currently out of sync with what's actually published on GHCR. This documents the process as it exists today; no new automation, scripts, or workflows are introduced. Kept intentionally minimal per feedback that a heavier automation-first pass (branch release-process-health-roadmap / PR #156) should stay a separate, future option rather than ship alongside this doc update. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: clarify publish.yml is per-language/pack-type independent Each <language> x <pack type> combination (queries/lib/ext/ext-library-sources) is checked and published completely independently in publish.yml - touching one language's pack only requires bumping that pack's own version, not any other language or pack type. Added an explicit callout plus inline notes in the checklist so this isn't ambiguous. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: correct release-process claims with confirmed repo state - Clarify #126 (bump-all-packs) has sat unmerged since Apr 2025, predating #124's CLI 2.21.1 refresh - so only java has actually published 2.21.1-era content; other 6 languages' GHCR packages are still stale. - Clarify the .release.yml configs/*.yml pattern is dead (never matched in repo history) and the libs: pin pattern only applies to 5/7 langs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: address review feedback - avoid hardcoding volatile PR/version state - Rephrase pack-directory checklist item to list pack roots explicitly instead of mixing a generic notion with one example path. - Recast the #124/#126 note as a historical lesson instead of asserting #126's current PR state (which will go stale once it merges/closes). - Describe the release/publish version drift conceptually instead of citing specific version numbers that will rot as things change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: remove em-dashes, use standard punctuation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR:
.codeqlversionto 2.21.1This PR is based on #123, and will be merged after that PR is merged.