Merge branch 'main' into python-log-injection

Author: Ali-Razmjoo

Cargo.lock

@@ -9,7 +9,6 @@ members = [
     "shared/yeast-schema",
     "ruby/extractor",
     "unified/extractor",
-    "unified/extractor/tree-sitter-swift",
     "unified/swift-syntax-rs",
     "rust/extractor",
     "rust/extractor/macros",

Cargo.toml

@@ -19,7 +19,7 @@ bazel_dep(name = "rules_cc", version = "0.2.17")
 bazel_dep(name = "rules_go", version = "0.60.0")
 bazel_dep(name = "rules_java", version = "9.6.1")
 bazel_dep(name = "rules_pkg", version = "1.2.0")
-bazel_dep(name = "rules_nodejs", version = "6.7.3")
+bazel_dep(name = "rules_nodejs", version = "6.7.5")
 bazel_dep(name = "rules_python", version = "1.9.0")
 bazel_dep(name = "rules_shell", version = "0.7.1")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
@@ -109,7 +109,6 @@ use_repo(
     tree_sitter_extractors_deps,
     "vendor_ts__anyhow-1.0.100",
     "vendor_ts__argfile-0.2.1",
-    "vendor_ts__cc-1.2.61",
     "vendor_ts__chalk-ir-0.104.0",
     "vendor_ts__chrono-0.4.42",
     "vendor_ts__clap-4.5.48",
@@ -157,9 +156,7 @@ use_repo(
     "vendor_ts__tracing-subscriber-0.3.20",
     "vendor_ts__tree-sitter-0.26.8",
     "vendor_ts__tree-sitter-embedded-template-0.25.0",
-    "vendor_ts__tree-sitter-generate-0.26.8",
     "vendor_ts__tree-sitter-json-0.24.8",
-    "vendor_ts__tree-sitter-language-0.1.5",
     "vendor_ts__tree-sitter-python-0.23.6",
     "vendor_ts__tree-sitter-ql-0.23.1",
     "vendor_ts__tree-sitter-ruby-0.23.1",
@@ -322,7 +319,7 @@ go_sdk.download(version = "1.26.5")
 
 go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
 go_deps.from_file(go_mod = "//go/extractor:go.mod")
-use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_tools")
+use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_sys", "org_golang_x_tools")
 
 ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archive")
 

MODULE.bazel

@@ -1,3 +1,9 @@
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+
 ## 0.4.39
 
 No user-facing changes.

actions/ql/lib/CHANGELOG.md

@@ -1,4 +1,5 @@
----
-category: minorAnalysis
----
-* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.
+## 0.4.40
+
+### Minor Analysis Improvements
+
+* Altered the logic of `EnvironmentCheck` to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: `actions/untrusted-checkout-toctou/high` and `actions/untrusted-checkout-toctou/critical`.

…26-07-09-environment-check-alteration.md …s/ql/lib/change-notes/released/0.4.40.mdactions/ql/lib/change-notes/2026-07-09-environment-check-alteration.md renamed to actions/ql/lib/change-notes/released/0.4.40.md actions/ql/lib/change-notes/2026-07-09-environment-check-alteration.md renamed to actions/ql/lib/change-notes/released/0.4.40.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.39
+lastReleaseVersion: 0.4.40

actions/ql/lib/codeql-pack.release.yml

@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.40-dev
+version: 0.4.41-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

actions/ql/lib/qlpack.yml

@@ -1,3 +1,7 @@
+## 0.6.32
+
+No user-facing changes.
+
 ## 0.6.31
 
 No user-facing changes.

actions/ql/src/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 0.6.32
+
+No user-facing changes.

actions/ql/src/change-notes/released/0.6.32.md

@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.31
+lastReleaseVersion: 0.6.32