Merge branch 'main' of https://github.com/github/codeql into post-release-prep/codeql-cli-2.26.2

Author: oscarsj

Cargo.lock

@@ -9,7 +9,6 @@ members = [
     "shared/yeast-schema",
     "ruby/extractor",
     "unified/extractor",
-    "unified/extractor/tree-sitter-swift",
     "unified/swift-syntax-rs",
     "rust/extractor",
     "rust/extractor/macros",

Cargo.toml

@@ -109,7 +109,6 @@ use_repo(
     tree_sitter_extractors_deps,
     "vendor_ts__anyhow-1.0.100",
     "vendor_ts__argfile-0.2.1",
-    "vendor_ts__cc-1.2.61",
     "vendor_ts__chalk-ir-0.104.0",
     "vendor_ts__chrono-0.4.42",
     "vendor_ts__clap-4.5.48",
@@ -157,9 +156,7 @@ use_repo(
     "vendor_ts__tracing-subscriber-0.3.20",
     "vendor_ts__tree-sitter-0.26.8",
     "vendor_ts__tree-sitter-embedded-template-0.25.0",
-    "vendor_ts__tree-sitter-generate-0.26.8",
     "vendor_ts__tree-sitter-json-0.24.8",
-    "vendor_ts__tree-sitter-language-0.1.5",
     "vendor_ts__tree-sitter-python-0.23.6",
     "vendor_ts__tree-sitter-ql-0.23.1",
     "vendor_ts__tree-sitter-ruby-0.23.1",

MODULE.bazel

@@ -1,5 +1,8 @@
-codeql_platform = select({
-    "@platforms//os:linux": "linux64",
-    "@platforms//os:macos": "osx64",
-    "@platforms//os:windows": "win64",
-})
+load("//misc/bazel:os.bzl", "codeql_platform_select")
+
+codeql_platform = codeql_platform_select(
+    linux64 = "linux64",
+    linux_arm64 = "linux-arm64",
+    osx64 = "osx64",
+    win64 = "win64",
+)

defs.bzl

@@ -0,0 +1,79 @@
+.. _codeql-cli-2.26.2:
+
+==========================
+CodeQL 2.26.2 (2026-07-23)
+==========================
+
+.. contents:: Contents
+   :depth: 2
+   :local:
+   :backlinks: none
+
+This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
+
+Security Coverage
+-----------------
+
+CodeQL 2.26.2 runs a total of 497 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).
+
+CodeQL CLI
+----------
+
+Breaking Changes
+~~~~~~~~~~~~~~~~
+
+*   Removed support for parsing :code:`[[`\ -style links in alert messages. This was an undocumented legacy feature that allowed query authors to embed links inline in select clause message strings using :code:`[["text"|"url"]]` syntax. Queries should use :code:`$@` placeholder pairs instead.
+
+Query Packs
+-----------
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+C#
+""
+
+*   :code:`System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for :code:`cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
+
+Query Metadata Changes
+~~~~~~~~~~~~~~~~~~~~~~
+
+C/C++
+"""""
+
+*   Added the tag :code:`external/cwe/cwe-762` to :code:`cpp/new-free-mismatch`, and removed the tag :code:`external/cwe/cwe-401`. This better matches the behavior of the query.
+
+C#
+""
+
+*   The query :code:`cs/useless-assignment-to-local` has been removed from the :code:`code-quality` suite, but it remains in the :code:`code-quality-extended` suite.
+
+Language Libraries
+------------------
+
+Major Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Swift
+"""""
+
+*   Upgraded to allow analysis of Swift 6.3.3.
+
+Minor Analysis Improvements
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Golang
+""""""
+
+*   The function :code:`Rel` in :code:`path/filepath` was incorrectly considered a sanitizer for :code:`go/path-injection` and :code:`go/zipslip`. This has now been fixed, which may lead to more results for those queries.
+
+Java/Kotlin
+"""""""""""
+
+*   Kotlin versions up to 2.4.10 are now supported.
+*   :code:`java.io.File.getName()` is no longer treated as a complete sanitizer for :code:`java/path-injection`, since it does not remove a :code:`..` path component (for example :code:`new File("..").getName()` returns :code:`".."`). It is now only recognized as a sanitizer when combined with a subsequent check for :code:`..` components, which may result in new alerts.
+
+GitHub Actions
+""""""""""""""
+
+*   Altered the logic of :code:`EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: :code:`actions/untrusted-checkout-toctou/high` and :code:`actions/untrusted-checkout-toctou/critical`.

docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.26.2.rst

@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
 .. toctree::
    :maxdepth: 1
 
+   codeql-cli-2.26.2
    codeql-cli-2.26.1
    codeql-cli-2.26.0
    codeql-cli-2.25.6

docs/codeql/codeql-overview/codeql-changelog/index.rst

@@ -191,6 +191,7 @@ and the CodeQL library pack ``codeql/javascript-all`` (`changelog <https://githu
    react native, HTML framework
    request, Network communicator
    restify, Server
+   Sails.js Action2 controllers, Server
    sequelize, Database
    socket.io, Network communicator
    sqlite3, Database

docs/codeql/reusables/supported-frameworks.rst

@@ -232,13 +232,13 @@ func ExtractWithFlags(buildFlags []string, patterns []string, extractTests bool,
 		// This should only cause some wasted time and not inconsistency because the names for
 		// objects seen in this process should be the same each time.
 
-		log.Printf("Processing package %s.", pkg.PkgPath)
+		slog.Debug("Processing package", "package", pkg.PkgPath)
 
 		if _, ok := pkgInfos[pkg.PkgPath]; !ok {
 			pkgInfos[pkg.PkgPath] = toolchain.GetPkgInfo(pkg.PkgPath, modFlags...)
 		}
 
-		log.Printf("Extracting types for package %s.", pkg.PkgPath)
+		slog.Debug("Extracting types for package", "package", pkg.PkgPath)
 
 		tw, err := trap.NewWriter(pkg.PkgPath, pkg)
 		if err != nil {

go/extractor/extractor.go

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added support for treating declared `inputs` properties in Sails Action2 controller files as remote flow sources. This may improve results for security queries such as `js/path-injection`.

javascript/ql/lib/change-notes/2026-07-07-sails-action2-inputs.md

@@ -7,4 +7,5 @@ import semmle.javascript.frameworks.Micro
 import semmle.javascript.frameworks.Restify
 import semmle.javascript.frameworks.Connect
 import semmle.javascript.frameworks.Fastify
+import semmle.javascript.frameworks.Sails
 import semmle.javascript.frameworks.Spife