github · oscarsj · Jul 30, 2026 · Jul 23, 2026 · Jul 27, 2026 · Jul 29, 2026
diff --git a/actions/ql/lib/CHANGELOG.md b/actions/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+
 ## 0.4.39
 
 No user-facing changes.

diff --git a/...026-07-09-environment-check-alteration.md → ...ns/ql/lib/change-notes/released/0.4.40.md b/...026-07-09-environment-check-alteration.md → ...ns/ql/lib/change-notes/released/0.4.40.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
diff --git a/actions/ql/lib/codeql-pack.release.yml b/actions/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.39
+lastReleaseVersion: 0.4.40
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.40-dev
+version: 0.4.41-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

diff --git a/actions/ql/src/CHANGELOG.md b/actions/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.32
+
+No user-facing changes.
+
 ## 0.6.31
 
 No user-facing changes.

diff --git a/actions/ql/src/change-notes/released/0.6.32.md b/actions/ql/src/change-notes/released/0.6.32.md
@@ -0,0 +1,3 @@
+## 0.6.32
+
+No user-facing changes.
diff --git a/actions/ql/src/codeql-pack.release.yml b/actions/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.31
+lastReleaseVersion: 0.6.32
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.32-dev
+version: 0.6.33-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 12.0.1
+
+No user-facing changes.
+
 ## 12.0.0
 
 ### Breaking Changes

diff --git a/cpp/ql/lib/change-notes/released/12.0.1.md b/cpp/ql/lib/change-notes/released/12.0.1.md
@@ -0,0 +1,3 @@
+## 12.0.1
+
+No user-facing changes.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 12.0.0
+lastReleaseVersion: 12.0.1
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 12.0.1-dev
+version: 12.0.2-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.8.0
+
+### Query Metadata Changes
+
+* Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query.
+
 ## 1.7.0
 
 ### Query Metadata Changes

diff --git a/...l/src/change-notes/2026-07-13-new-free.md → cpp/ql/src/change-notes/released/1.8.0.md b/...l/src/change-notes/2026-07-13-new-free.md → cpp/ql/src/change-notes/released/1.8.0.md
@@ -1,4 +1,5 @@
----
-category: queryMetadata
----
+## 1.8.0
+
+### Query Metadata Changes
+
 * Added the tag `external/cwe/cwe-762` to `cpp/new-free-mismatch`, and removed the tag `external/cwe/cwe-401`. This better matches the behavior of the query.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.0
+lastReleaseVersion: 1.8.0
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.7.1-dev
+version: 1.8.1-dev
 groups:
   - cpp
   - queries

diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.71
+
+No user-facing changes.
+
 ## 1.7.70
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.71.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.71.md
@@ -0,0 +1,3 @@
+## 1.7.71
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.70
+lastReleaseVersion: 1.7.71
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.71-dev
+version: 1.7.72-dev
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.71
+
+No user-facing changes.
+
 ## 1.7.70
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.71.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.71.md
@@ -0,0 +1,3 @@
+## 1.7.71
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.70
+lastReleaseVersion: 1.7.71
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.71-dev
+version: 1.7.72-dev
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 7.1.1
+
+No user-facing changes.
+
 ## 7.1.0
 
 ### Major Analysis Improvements

diff --git a/csharp/ql/lib/change-notes/released/7.1.1.md b/csharp/ql/lib/change-notes/released/7.1.1.md
@@ -0,0 +1,3 @@
+## 7.1.1
+
+No user-facing changes.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.1.0
+lastReleaseVersion: 7.1.1
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 7.1.1-dev
+version: 7.1.2-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 1.9.0
+
+### Query Metadata Changes
+
+* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite.
+
+### Minor Analysis Improvements
+
+* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
+
 ## 1.8.0
 
 ### Query Metadata Changes

diff --git a/csharp/ql/src/change-notes/2026-07-13-CWE-601.md b/csharp/ql/src/change-notes/2026-07-13-CWE-601.md
diff --git a/csharp/ql/src/change-notes/2026-07-15-code-quality-useless-assignment.md b/csharp/ql/src/change-notes/2026-07-15-code-quality-useless-assignment.md
diff --git a/csharp/ql/src/change-notes/released/1.9.0.md b/csharp/ql/src/change-notes/released/1.9.0.md
@@ -0,0 +1,9 @@
+## 1.9.0
+
+### Query Metadata Changes
+
+* The query `cs/useless-assignment-to-local` has been removed from the `code-quality` suite, but it remains in the `code-quality-extended` suite.
+
+### Minor Analysis Improvements
+
+* `System.Web.HttpRequest.RawUrl` is no longer treated as a sanitizer for `cs/web/unvalidated-url-redirection`, since it contains the un-normalized request line. This may lead to more results.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.8.0
+lastReleaseVersion: 1.9.0
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.8.1-dev
+version: 1.9.1-dev
 groups:
   - csharp
   - queries

diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.54
+
+No user-facing changes.
+
 ## 1.0.53
 
 No user-facing changes.

diff --git a/go/ql/consistency-queries/change-notes/released/1.0.54.md b/go/ql/consistency-queries/change-notes/released/1.0.54.md
@@ -0,0 +1,3 @@
+## 1.0.54
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.53
+lastReleaseVersion: 1.0.54
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.54-dev
+version: 1.0.55-dev
 groups:
   - go
   - queries

diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 7.2.2
+
+### Minor Analysis Improvements
+
+* The function `Rel` in `path/filepath` was incorrectly considered a sanitizer for `go/path-injection` and `go/zipslip`. This has now been fixed, which may lead to more results for those queries.
+
 ## 7.2.1
 
 ### Minor Analysis Improvements

diff --git a/...-07-09-remove-incorrect-path-sanitizer.md → go/ql/lib/change-notes/released/7.2.2.md b/...-07-09-remove-incorrect-path-sanitizer.md → go/ql/lib/change-notes/released/7.2.2.md
@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
+## 7.2.2
+
+### Minor Analysis Improvements
+
 * The function `Rel` in `path/filepath` was incorrectly considered a sanitizer for `go/path-injection` and `go/zipslip`. This has now been fixed, which may lead to more results for those queries.
diff --git a/go/ql/lib/codeql-pack.release.yml b/go/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 7.2.1
+lastReleaseVersion: 7.2.2
@@ -1,5 +1,5 @@
 name: codeql/go-all
-version: 7.2.2-dev
+version: 7.2.3-dev
 groups: go
 dbscheme: go.dbscheme
 extractor: go

diff --git a/go/ql/src/CHANGELOG.md b/go/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.6.7
+
+No user-facing changes.
+
 ## 1.6.6
 
 No user-facing changes.

diff --git a/go/ql/src/change-notes/released/1.6.7.md b/go/ql/src/change-notes/released/1.6.7.md
@@ -0,0 +1,3 @@
+## 1.6.7
+
+No user-facing changes.
diff --git a/go/ql/src/codeql-pack.release.yml b/go/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.6.6
+lastReleaseVersion: 1.6.7
@@ -1,5 +1,5 @@
 name: codeql/go-queries
-version: 1.6.7-dev
+version: 1.6.8-dev
 groups:
   - go
   - queries

diff --git a/java/ql/lib/CHANGELOG.md b/java/ql/lib/CHANGELOG.md
@@ -1,3 +1,10 @@
+## 9.2.2
+
+### Minor Analysis Improvements
+
+* Kotlin versions up to 2.4.10 are now supported.
+* `java.io.File.getName()` is no longer treated as a complete sanitizer for `java/path-injection`, since it does not remove a `..` path component (for example `new File("..").getName()` returns `".."`). It is now only recognized as a sanitizer when combined with a subsequent check for `..` components, which may result in new alerts.
+
 ## 9.2.1
 
 ### Minor Analysis Improvements

diff --git a/java/ql/lib/change-notes/2026-07-15-kotlin-2.4.10.md b/java/ql/lib/change-notes/2026-07-15-kotlin-2.4.10.md
diff --git a/...2026-07-11-file-getname-path-sanitizer.md → java/ql/lib/change-notes/released/9.2.2.md b/...2026-07-11-file-getname-path-sanitizer.md → java/ql/lib/change-notes/released/9.2.2.md
@@ -1,4 +1,6 @@
----
-category: minorAnalysis
----
+## 9.2.2
+
+### Minor Analysis Improvements
+
+* Kotlin versions up to 2.4.10 are now supported.
 * `java.io.File.getName()` is no longer treated as a complete sanitizer for `java/path-injection`, since it does not remove a `..` path component (for example `new File("..").getName()` returns `".."`). It is now only recognized as a sanitizer when combined with a subsequent check for `..` components, which may result in new alerts.
diff --git a/java/ql/lib/codeql-pack.release.yml b/java/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 9.2.1
+lastReleaseVersion: 9.2.2
@@ -1,5 +1,5 @@
 name: codeql/java-all
-version: 9.2.2-dev
+version: 9.2.3-dev
 groups: java
 dbscheme: config/semmlecode.dbscheme
 extractor: java

diff --git a/java/ql/src/CHANGELOG.md b/java/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.11.7
+
+No user-facing changes.
+
 ## 1.11.6
 
 No user-facing changes.

diff --git a/java/ql/src/change-notes/released/1.11.7.md b/java/ql/src/change-notes/released/1.11.7.md
@@ -0,0 +1,3 @@
+## 1.11.7
+
+No user-facing changes.
diff --git a/java/ql/src/codeql-pack.release.yml b/java/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.11.6
+lastReleaseVersion: 1.11.7
@@ -1,5 +1,5 @@
 name: codeql/java-queries
-version: 1.11.7-dev
+version: 1.11.8-dev
 groups:
   - java
   - queries

diff --git a/javascript/ql/lib/CHANGELOG.md b/javascript/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.8.2
+
+No user-facing changes.
+
 ## 2.8.1
 
 ### Minor Analysis Improvements

diff --git a/javascript/ql/lib/change-notes/released/2.8.2.md b/javascript/ql/lib/change-notes/released/2.8.2.md
@@ -0,0 +1,3 @@
+## 2.8.2
+
+No user-facing changes.
diff --git a/javascript/ql/lib/codeql-pack.release.yml b/javascript/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 2.8.1
+lastReleaseVersion: 2.8.2
@@ -1,5 +1,5 @@
 name: codeql/javascript-all
-version: 2.8.2-dev
+version: 2.8.3-dev
 groups: javascript
 dbscheme: semmlecode.javascript.dbscheme
 extractor: javascript

diff --git a/javascript/ql/src/CHANGELOG.md b/javascript/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 2.4.2
+
+No user-facing changes.
+
 ## 2.4.1
 
 No user-facing changes.

diff --git a/javascript/ql/src/change-notes/released/2.4.2.md b/javascript/ql/src/change-notes/released/2.4.2.md
@@ -0,0 +1,3 @@
+## 2.4.2
+
+No user-facing changes.
diff --git a/javascript/ql/src/codeql-pack.release.yml b/javascript/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 2.4.1
+lastReleaseVersion: 2.4.2