All pull requests

Pull requests

• JavaScript: preserve sanitizer barriers on guarded phi inputs

  documentationexternal-contributionJS
  #23005·nikhilred2619 opened Nov 3, 2026·

  ·
  1

• build(deps): bump actions/cache from 3 to 6

  dependenciesgithub_actionsQL-for-QL
  #23004·dependabot[bot] opened Nov 3, 2026Bot·

  ·

• build(deps): bump lazy_static from 1.5.0 to 1.5.1 in /ql

  dependenciesQL-for-QL
  #23003·dependabot[bot] opened Nov 3, 2026Bot·

  ·

• build(deps): bump actions/labeler from 4 to 7

  dependenciesgithub_actions
  #23002·dependabot[bot] opened Nov 3, 2026Bot·

  ·

• Unified: Add Unsafe JS eval / JavaScript injection query

  documentationno-change-note-requiredUnified
  #22998·geoffw0 opened Nov 3, 2026Contributor·

  ·
  1

• Rust: Skip parentheses in extraction

  documentationRust
  #22997·hvitved opened Nov 3, 2026Contributor·

  ·
  4

• Go: reduce intermediate tuples in embedded method resolution

  Gono-change-note-required
  #22995·owen-mc opened Nov 3, 2026Contributor·

  ·
  2

• Unified: Support Swift conditional compilation blocks

  no-change-note-requiredUnified
  #22992·paldepind opened Nov 3, 2026Contributor·

  ·
  12

• JS: Remove TypeScript parser memory limits

  JS
  #22991·paldepind opened Nov 3, 2026Contributor·

  ·
  3

• Unified: Add Uncontrolled format string query

  documentationno-change-note-requiredUnified
  #22985·geoffw0 opened Nov 2, 2026Contributor·

  ·
  4

• Rust: Do not treat account identifiers as sensitive in cleartext queries

  documentationexternal-contributionRust
  #22981·LucaCappelletti94 opened Nov 2, 2026Contributor·

  ·
  3

• Unified: use type-inferred field resolution in data flow

  Unified
  #22980·hvitved opened Nov 2, 2026Contributor·

  ·
  7

• JS: Report command injection through child_process argument arrays when shell is enabled

  documentationexternal-contributionJS
  #22978·vishalshetagar opened Nov 2, 2026·

  ·
  1

  1

• build(deps): bump rules_dotnet from 0.21.5-codeql.1 to 0.22.2

  bazeldependencies
  #22977·dependabot[bot] opened Nov 2, 2026Bot·

  ·

• Type inference: Add support for named arguments

  RustUnified
  #22973·hvitved opened Nov 2, 2026Contributor·

  ·

• Type inference: Consistency check for escaping type parameters

  RustUnified
  #22972·hvitved opened Nov 2, 2026Contributor·

  ·

• JS: Fix multiline regexp sanitization

  documentationJS
  #22966·owen-mc opened Oct 31, 2026Contributor·

  ·
  1

  2

• Python: reintroduce instance-attribute type-tracking without the classInstanceTracker blow-up (try 2)

  documentationPython
  #22965·owen-mc opened Oct 30, 2026Contributor·

  ·
  4

• yeast: Isolate interpolation contexts from each other

  no-change-note-requiredUnified
  #22964·tausbn opened Oct 30, 2026Contributor·

  ·
  3

• Shared: Treat trusted_schema names as non-sensitive

  documentationexternal-contributionJSPythonRubyRustSwift
  #22962·LucaCappelletti94 opened Oct 30, 2026Contributor·

  ·
  5

• Unified: Fix two bugs in parameter name scoping

  no-change-note-requiredUnified
  #22960·asgerf opened Oct 30, 2026Contributor·

  ·
  1

• yeast: Add explicit locationless nodes

  documentationno-change-note-required
  #22959·tausbn opened Oct 30, 2026Contributor·

  ·
  3

• Unified: Handle Swift default with an ignore pattern

  Unified
  #22957·paldepind opened Oct 30, 2026Contributor·

  ·

• Use patched latest fmt and rules_dotnet modules

  C#
  #22954·jketema opened Oct 30, 2026Contributor·

  ·
  8

• build(deps): bump fmt from 12.1.0-codeql.1 to 12.2.0.bcr.1

  bazeldependencies
  #22951·dependabot[bot] opened Oct 30, 2026Bot·

  ·