Skip to content

Pull requests: github/codeql

New pull request New
Clear current search query, filters, and sorts
408 Open 15,368 Closed
408 Open 15,368 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Java: Fix File.getName() path sanitizer documentation Java
#22175 opened Jul 11, 2026 by owen-mc Contributor Loading…
1
Add way to customize environmentCheck Actions QL Actions Analysis of GitHub Actions
#22173 opened Jul 10, 2026 by knewbury01 Contributor • Draft
Java: Improve join order. Java no-change-note-required This PR does not need a change note
#22159 opened Jul 10, 2026 by aschackmull Contributor Loading…
2
Ruby: Replace CFG with shared implementation Ruby
#22158 opened Jul 10, 2026 by aschackmull Contributor • Draft
1
Make actions/unpinned-tag lockfile- and $/-aware Actions Analysis of GitHub Actions documentation
#22155 opened Jul 10, 2026 by nodeselector • Draft
1
Actions Query Fix: UntrustedCheckoutTOCTOU[High|Critical] ControlCheck model fix Actions Analysis of GitHub Actions documentation
#22154 opened Jul 9, 2026 by knewbury01 Contributor Loading…
1
Support MISSING promotion and SPURIOUS clearing in --learn inline expectations C# C++ Go Java JS Python QL-for-QL Ruby Rust Pull requests that update Rust code Swift
#22148 opened Jul 9, 2026 by d10c Contributor • Draft
Go: skip extracting ast.ParenExpr nodes Go
#22146 opened Jul 9, 2026 by owen-mc Contributor • Draft
FlowSummaryImpl: Embed AST nodes in source/sink summary nodes for better locations C# C++ DataFlow Library Go Java JS Python Ruby Rust Pull requests that update Rust code Swift
#22145 opened Jul 9, 2026 by hvitved Contributor • Draft
2
JS: Model Sails Action2 inputs as remote sources documentation JS
#22142 opened Jul 9, 2026 by theinfosecguy Loading…
1
1
Support --learn for inline expectations via learnEdits C# C++ Go Java JS Python QL-for-QL Ruby Rust Pull requests that update Rust code Swift
#22140 opened Jul 8, 2026 by d10c Contributor • Draft
3
Java: Support JDK 27 documentation Java
#22138 opened Jul 8, 2026 by IdrissRio Contributor • Draft
TEMP PR C# C++ DataFlow Library Go Java JS Python Ruby Rust Pull requests that update Rust code Swift
#22137 opened Jul 8, 2026 by hvitved Contributor • Draft
2
Unify Kotlin test suites Java Kotlin
#22135 opened Jul 8, 2026 by andersfugmann Contributor • Draft
Introduce canonicalization library for Windows subst drives C# depends on internal PR This PR should only be merged in sync with an internal Semmle PR Go Java JS Kotlin Python Ruby Rust Pull requests that update Rust code
#22129 opened Jul 6, 2026 by jketema Contributor • Draft
Bump the maven group across 30 directories with 11 updates dependencies Pull requests that update a dependency file Java
#22122 opened Jul 4, 2026 by dependabot Bot Loading…
Python: unpin legacy CFG/ESSA from the AST cached stage (DCA measurement) Python
#22116 opened Jul 2, 2026 by yoff Contributor • Draft
C++: Support access paths for flow sources C++
#22113 opened Jul 2, 2026 by MathiasVP Contributor • Draft
1
Swift: Turn off caching and integrated driver in autobuild Swift
#22111 opened Jul 2, 2026 by jketema Contributor Loading…
5
unified: Test CI checks
#22102 opened Jul 1, 2026 by asgerf Contributor • Draft
Python: revert "remove imprecise container steps" for performance reasons Python
#22098 opened Jun 30, 2026 by owen-mc Contributor Loading…
2
C#: Simplify the Nuget Package restorer. C#
#22094 opened Jun 30, 2026 by michaelnebel Contributor • Draft
A query for detecting cyclic joins in QL QL-for-QL
#22093 opened Jun 30, 2026 by josefs Contributor Loading…
3
Kotlin extractor: fix K2 regressions without expected churn Java Kotlin
#22076 opened Jun 29, 2026 by andersfugmann Contributor • Draft
Go: Update to 1.27 depends on internal PR This PR should only be merged in sync with an internal Semmle PR documentation Go
#22042 opened Jun 24, 2026 by jketema Contributor • Draft
12
ProTip! Add no:assignee to see everything that’s not assigned.