v2.18.0

Breaking changes

• A number of breaking changes have been made to the C and C++ CodeQL
  test environment as used by codeql test run:

  • The test environment no longer defines any GNU-specific builtin
    macros. If these macros are still needed by a test, please define
    them via semmle-extractor-options.

  • The --force-recompute option is no longer directly supported by
    semmle-extractor-options. Instead, --edg --force-recompute
    should be specified.

  • The --gnu_version and --microsoft_version options that can be
    specified via semmle-extractor-options are now synonyms, and only
    one should be specified as part of semmle-extractor-options.
    Furthermore, is also no longer possible to specify these options
    via the following syntax.

    • --edg --gnu_version --edg <version number>, and
    • --edg --microsoft_version --edg <version number>

    The shorter --gnu_version <version number> and
    --microsoft_version <version number> should be used.

• The --build_error_dir and --predefined_macros command line options
  have been removed from the C/C++ extractor. It has never been possible
  to pass these options through the CLI, but some customers with advanced
  setups may have been passing them through internal undocumented interfaces.
  Passing the option --build_error_dir did not have any effect, and it
  is safe to remove the option. The --predefined_macros option should
  have been unnecessary, as long as the extractor was invoked with the
  --mimic option.

Regressions

• Compilation of QL queries is about 30% slower than in previous releases. This
  only affects users who write custom queries, and only at compilation time, not
  at run time. This regression will be fixed in the upcoming 2.18.1 release.

Improvements

• Introduced the --include-logs option to the codeql database bundle
  command. This new feature allows users to include logs in the generated
  database bundle, allowing for a more complete treatment of the bundle, and
  bringing the tool capabilities up-to-speed with the documentation.
• Extract .xsaccess, *.xsjs and *.xsjslib files for SAP HANA XS as
  Javascript.

Bugs fixed

• Where a MacOS unsigned binary cannot be signed, CodeQL will now continue
  trying to trace compiler invocations created by that process and its
  children. In particular this means that Bazel builds on MacOS are now
  traceable.
• Fixed a bug where test discovery would fail if there is a syntax error in a
  qlpack file. Now, a warning message will be printed and discovery will
  continue.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.18.0.

v2.17.6

New features

• Beta support is now available for analyzing C# codebases without needing a working build. To use
  this, pass the --build-mode none option to codeql database create.

Improvements

• The --model-packs option is now publicly available. This option allows commands like codeql database analyze
  to accept a list of model packs that are used to augment the analysis of all queries involved in the analysis.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.17.6.

v2.17.5

Breaking changes

• All the commands that output SARIF will output a minified version to reduce the size.
  The codeql database analyze, codeql database interpret-results, codeql generate query-help, and codeql bqrs interpret commands support the option --no-sarif-minify to output a pretty printed SARIF file.

• A number of breaking changes have been made to the semmle-extractor-options
  functionality available for C and C++ CodeQL tests, removing various flags that don't work well in the context of tests.
  These do not affect the creation of databases through the CodeQL CLI,
  or when calling the C/C++ extractor directly with the --mimic or --linker flags.

Improvements

• codeql generate log-summary now reports completed pipeline runs that
  are part of an incomplete recursive predicate.

Miscellaneous

• The OWASP Java HTML Sanitizer library used by the CodeQL CLI for internal
  documentation generation commands has been updated to version
  20240325.1.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.17.5.

v2.17.4

• There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.17.4.

v2.17.3

Improvements

• The language server that our IDE integration is built on now defaults to fine-grained dependency tracking for incremental error-checking after file changes. This slightly improves the latency of refreshing errors after local source code edits and will enable significant speedups in the future.
• We now properly handle globs (such as folder/**/*.py) in paths configuration to specify what files to include for Python analysis (see documentation here).
• TRAP import (a part of codeql database create and codeql database finalize) now supports allocating 2^32 IDs during the import process. The previous limit was 2^31 IDs.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.17.3.

v2.17.2

Known issues

• The beta support for analyzing Swift in this release and all previous releases requires g++-13 when running on Linux. Users analyzing Swift using the ubuntu-latest, ubuntu-22.04, or ubuntu-20.04 runner images for GitHub Actions should update their workflows to install g++-13. For more information, see the runner images announcement.

Improvements

• When uploading a SARIF file to GitHub using codeql github upload-results, the CodeQL CLI now waits for the file to be processed by GitHub. If any errors occurred during processing of the analysis results, the command will log these and return a non-zero exit code. To disable this behaviour, pass the --no-wait-for-processing flag.

  By default, the command will wait for the SARIF file to be processed for a maximum of 2 minutes, however this is configurable with the --wait-for-processing-timeout option.

• The build tracer is no longer enabled when using the none build mode to analyze a compiled language, thus improving performance.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.17.2.

v2.17.1

Release 2.17.1 (2024-04-24)

Deprecations

• The --mode option and -m alias to codeql database create,
  codeql database cleanup, and codeql dataset cleanup has been
  deprecated. Instead, use the new --cache-cleanup option, which has
  identical behavior.

Improvements

• Improved the diagnostic message produced when no code is processed
  when creating a database. If a build mode was specified using
  --build-mode, the message is now tailored to your build mode.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.17.1.

v2.17.0

Deprecations

• The --[no-]analysis-summary-v2 and --[no-]new-analysis-summary options that were used to enable (or disable) improved summary information printed at the end of a codeql database analyze invocation are no longer supported. Improved summary information is now enabled for all invocations.
• Support for overwriting default CodeQL SARIF run properties using the --sarif-run-property command line option has been removed. This removes the ability to overwrite the semmle.formatSpecifier, metricResults, and codeqlConfigSummary properties in the SARIF run file.

Improvements

• TRAP import (a part of codeql database create and codeql database finalize) now performs better in low-memory situations. (Put another way, it now needs less RAM to achieve the same performance as before.)
• The worst-case performance of transitive closure computation (using the + or * postfix operators or the fastTC higher-order primitive in QL) has been greatly improved.

Miscellaneous

• The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.2.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.17.0.

v2.16.6

Bugs fixed

• Fixes a bug where extractor logs would be output at a lower than expected verbosity level when using the codeql database create command.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.16.6.

v2.16.5

New features

• Beta support has been added for analyzing Java codebases without needing a working build. To enable
  this, pass the --build-mode none option to codeql database create.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.16.5.