mikeyhodl · pull · Oct 14, 2025 · Oct 12, 2025 · Oct 14, 2025 · Oct 14, 2025
diff --git a/actions/ql/lib/CHANGELOG.md b/actions/ql/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.4.19
+
+No user-facing changes.
+
 ## 0.4.18
 
 No user-facing changes.

diff --git a/actions/ql/lib/change-notes/released/0.4.19.md b/actions/ql/lib/change-notes/released/0.4.19.md
@@ -0,0 +1,3 @@
+## 0.4.19
+
+No user-facing changes.
diff --git a/actions/ql/lib/codeql-pack.release.yml b/actions/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.4.18
+lastReleaseVersion: 0.4.19
diff --git a/actions/ql/lib/qlpack.yml b/actions/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-all
-version: 0.4.19-dev
+version: 0.4.20-dev
 library: true
 warnOnImplicitThis: true
 dependencies:

diff --git a/actions/ql/src/CHANGELOG.md b/actions/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.6.11
+
+No user-facing changes.
+
 ## 0.6.10
 
 No user-facing changes.

diff --git a/actions/ql/src/change-notes/released/0.6.11.md b/actions/ql/src/change-notes/released/0.6.11.md
@@ -0,0 +1,3 @@
+## 0.6.11
+
+No user-facing changes.
diff --git a/actions/ql/src/codeql-pack.release.yml b/actions/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.6.10
+lastReleaseVersion: 0.6.11
diff --git a/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql b/actions/ql/src/experimental/Security/CWE-200/SecretExfiltration.ql
@@ -19,5 +19,5 @@ import SecretExfiltrationFlow::PathGraph
 from SecretExfiltrationFlow::PathNode source, SecretExfiltrationFlow::PathNode sink
 where SecretExfiltrationFlow::flowPath(source, sink)
 select sink.getNode(), source, sink,
-  "Potential secret exfiltration in $@, which may be be leaked to an attacker-controlled resource.",
+  "Potential secret exfiltration in $@, which may be leaked to an attacker-controlled resource.",
   sink, sink.getNode().asExpr().(Expression).getRawExpression()
diff --git a/actions/ql/src/qlpack.yml b/actions/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/actions-queries
-version: 0.6.11-dev
+version: 0.6.12-dev
 library: false
 warnOnImplicitThis: true
 groups: [actions, queries]

diff --git a/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.expected b/actions/ql/test/query-tests/Security/CWE-200/SecretExfiltration.expected
@@ -3,4 +3,4 @@ nodes
 | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | semmle.label | github.event.pull_request.title |
 subpaths
 #select
-| .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | Potential secret exfiltration in $@, which may be be leaked to an attacker-controlled resource. | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | ${{ github.event.pull_request.title }} |
+| .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | Potential secret exfiltration in $@, which may be leaked to an attacker-controlled resource. | .github/workflows/test1.yml:15:11:16:75 | github.event.pull_request.title | ${{ github.event.pull_request.title }} |
diff --git a/cpp/ql/lib/CHANGELOG.md b/cpp/ql/lib/CHANGELOG.md
@@ -1,3 +1,13 @@
+## 6.0.0
+
+### Breaking Changes
+
+* The "Guards" libraries (`semmle.code.cpp.controlflow.Guards` and `semmle.code.cpp.controlflow.IRGuards`) have been totally rewritten to recognize many more guards. The API remains unchanged, but the `GuardCondition` class now extends `Element` instead of `Expr`.
+
+### New Features
+
+* C/C++ `build-mode: none` support is now generally available.
+
 ## 5.6.1
 
 No user-facing changes.

diff --git a/cpp/ql/lib/change-notes/2025-10-07-bmn-ga.md b/cpp/ql/lib/change-notes/2025-10-07-bmn-ga.md
diff --git a/cpp/ql/lib/change-notes/2025-09-18-guards.md → cpp/ql/lib/change-notes/released/6.0.0.md b/cpp/ql/lib/change-notes/2025-09-18-guards.md → cpp/ql/lib/change-notes/released/6.0.0.md
@@ -1,4 +1,9 @@
----
-category: breaking
----
-* The "Guards" libraries (`semmle.code.cpp.controlflow.Guards` and `semmle.code.cpp.controlflow.IRGuards`) have been totally rewritten to recognize many more guards. The API remains unchanged, but the `GuardCondition` class now extends `Element` instead of `Expr`.
+## 6.0.0
+
+### Breaking Changes
+
+* The "Guards" libraries (`semmle.code.cpp.controlflow.Guards` and `semmle.code.cpp.controlflow.IRGuards`) have been totally rewritten to recognize many more guards. The API remains unchanged, but the `GuardCondition` class now extends `Element` instead of `Expr`.
+
+### New Features
+
+* C/C++ `build-mode: none` support is now generally available.
diff --git a/cpp/ql/lib/codeql-pack.release.yml b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 5.6.1
+lastReleaseVersion: 6.0.0
diff --git a/cpp/ql/lib/qlpack.yml b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 5.6.2-dev
+version: 6.0.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

diff --git a/cpp/ql/src/CHANGELOG.md b/cpp/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.5.2
+
+No user-facing changes.
+
 ## 1.5.1
 
 No user-facing changes.

diff --git a/cpp/ql/src/change-notes/released/1.5.2.md b/cpp/ql/src/change-notes/released/1.5.2.md
@@ -0,0 +1,3 @@
+## 1.5.2
+
+No user-facing changes.
diff --git a/cpp/ql/src/codeql-pack.release.yml b/cpp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.5.1
+lastReleaseVersion: 1.5.2
diff --git a/cpp/ql/src/qlpack.yml b/cpp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-queries
-version: 1.5.2-dev
+version: 1.5.3-dev
 groups:
   - cpp
   - queries

diff --git a/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/lib/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.50
+
+No user-facing changes.
+
 ## 1.7.49
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.50.md b/csharp/ql/campaigns/Solorigate/lib/change-notes/released/1.7.50.md
@@ -0,0 +1,3 @@
+## 1.7.50
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.49
+lastReleaseVersion: 1.7.50
diff --git a/csharp/ql/campaigns/Solorigate/lib/qlpack.yml b/csharp/ql/campaigns/Solorigate/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-all
-version: 1.7.50-dev
+version: 1.7.51-dev
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md b/csharp/ql/campaigns/Solorigate/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.7.50
+
+No user-facing changes.
+
 ## 1.7.49
 
 No user-facing changes.

diff --git a/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.50.md b/csharp/ql/campaigns/Solorigate/src/change-notes/released/1.7.50.md
@@ -0,0 +1,3 @@
+## 1.7.50
+
+No user-facing changes.
diff --git a/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml b/csharp/ql/campaigns/Solorigate/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.7.49
+lastReleaseVersion: 1.7.50
diff --git a/csharp/ql/campaigns/Solorigate/src/qlpack.yml b/csharp/ql/campaigns/Solorigate/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-solorigate-queries
-version: 1.7.50-dev
+version: 1.7.51-dev
 groups:
   - csharp
   - solorigate

diff --git a/csharp/ql/lib/CHANGELOG.md b/csharp/ql/lib/CHANGELOG.md
@@ -1,3 +1,12 @@
+## 5.2.6
+
+### Minor Analysis Improvements
+
+* The extraction of location information for parameters, fields, constructors, destructors and user operators has been optimized. Previously, location information was extracted multiple times for each bound generic. Now, only the location of the unbound generic declaration is extracted during the extraction phase, and the QL library explicitly reuses this location for all bound instances of the same generic.
+* The extraction of location information for type parameters and tuples types has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.
+* The extraction of location information for named types (classes, structs, etc.) has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.
+* The extraction of the location for bound generic entities (methods, accessors, indexers, properties, and events) has been optimized. Previously, location information was extracted multiple times for each bound generic. Now, only the location of the unbound generic declaration is extracted during the extraction phase, and the QL library explicitly reuses this location for all bound instances of the same generic.
+
 ## 5.2.5
 
 No user-facing changes.

diff --git a/csharp/ql/lib/change-notes/2025-10-02-entity-locations.md b/csharp/ql/lib/change-notes/2025-10-02-entity-locations.md
diff --git a/csharp/ql/lib/change-notes/2025-10-07-entity-locations.md b/csharp/ql/lib/change-notes/2025-10-07-entity-locations.md
diff --git a/csharp/ql/lib/change-notes/2025-10-08-entity-locations.md b/csharp/ql/lib/change-notes/2025-10-08-entity-locations.md
diff --git a/csharp/ql/lib/change-notes/2025-10-10-entity-locations.md b/csharp/ql/lib/change-notes/2025-10-10-entity-locations.md
diff --git a/csharp/ql/lib/change-notes/released/5.2.6.md b/csharp/ql/lib/change-notes/released/5.2.6.md
@@ -0,0 +1,8 @@
+## 5.2.6
+
+### Minor Analysis Improvements
+
+* The extraction of location information for parameters, fields, constructors, destructors and user operators has been optimized. Previously, location information was extracted multiple times for each bound generic. Now, only the location of the unbound generic declaration is extracted during the extraction phase, and the QL library explicitly reuses this location for all bound instances of the same generic.
+* The extraction of location information for type parameters and tuples types has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.
+* The extraction of location information for named types (classes, structs, etc.) has been optimized. Previously, location information was extracted multiple times for each type when it was declared across multiple files. Now, the extraction context is respected during the extraction phase, ensuring locations are only extracted within the appropriate context. This change should be transparent to end-users but may improve extraction performance in some cases.
+* The extraction of the location for bound generic entities (methods, accessors, indexers, properties, and events) has been optimized. Previously, location information was extracted multiple times for each bound generic. Now, only the location of the unbound generic declaration is extracted during the extraction phase, and the QL library explicitly reuses this location for all bound instances of the same generic.
diff --git a/csharp/ql/lib/codeql-pack.release.yml b/csharp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 5.2.5
+lastReleaseVersion: 5.2.6
diff --git a/csharp/ql/lib/ext/System.ComponentModel.model.yml b/csharp/ql/lib/ext/System.ComponentModel.model.yml
@@ -36,3 +36,8 @@ extensions:
       - ["System.ComponentModel", "PropertyDescriptorCollection", False, "set_Item", "(System.Int32,System.Object)", "", "Argument[0]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Key]", "value", "manual"]
       - ["System.ComponentModel", "PropertyDescriptorCollection", False, "set_Item", "(System.Int32,System.Object)", "", "Argument[1]", "Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Value]", "value", "manual"]
       - ["System.ComponentModel", "PropertyDescriptorCollection", False, "set_Item", "(System.Object,System.Object)", "", "Argument[1]", "Argument[this].Element", "value", "manual"]
+  - addsTo:
+      pack: codeql/csharp-all
+      extensible: neutralModel
+    data:
+       - ["System.ComponentModel", "PropertyDescriptor", "GetValue", "(System.Object)", "summary", "manual"]
diff --git a/csharp/ql/lib/qlpack.yml b/csharp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-all
-version: 5.2.6-dev
+version: 5.2.7-dev
 groups: csharp
 dbscheme: semmlecode.csharp.dbscheme
 extractor: csharp

diff --git a/csharp/ql/src/CHANGELOG.md b/csharp/ql/src/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.4.2
+
+No user-facing changes.
+
 ## 1.4.1
 
 ### Minor Analysis Improvements

diff --git a/csharp/ql/src/change-notes/released/1.4.2.md b/csharp/ql/src/change-notes/released/1.4.2.md
@@ -0,0 +1,3 @@
+## 1.4.2
+
+No user-facing changes.
diff --git a/csharp/ql/src/codeql-pack.release.yml b/csharp/ql/src/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.4.1
+lastReleaseVersion: 1.4.2
diff --git a/csharp/ql/src/qlpack.yml b/csharp/ql/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/csharp-queries
-version: 1.4.2-dev
+version: 1.4.3-dev
 groups:
   - csharp
   - queries

diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummaries.expected
@@ -3715,7 +3715,6 @@ summary
 | Newtonsoft.Json.Linq;JObject;set_Item;(System.String,Newtonsoft.Json.Linq.JToken);Argument[0];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Key];value;manual |
 | Newtonsoft.Json.Linq;JObject;set_Item;(System.String,Newtonsoft.Json.Linq.JToken);Argument[1];Argument[this].Element.Property[System.Collections.Generic.KeyValuePair`2.Value];value;manual |
 | Newtonsoft.Json.Linq;JObject;set_Item;(System.String,Newtonsoft.Json.Linq.JToken);Argument[1];Argument[this].Element;value;manual |
-| Newtonsoft.Json.Linq;JPropertyDescriptor;GetValue;(System.Object);Argument[0];ReturnValue;taint;dfc-generated |
 | Newtonsoft.Json.Linq;JPropertyDescriptor;ResetValue;(System.Object);Argument[this];Argument[0];taint;df-generated |
 | Newtonsoft.Json.Linq;JPropertyDescriptor;SetValue;(System.Object,System.Object);Argument[0];Argument[this];taint;df-generated |
 | Newtonsoft.Json.Linq;JPropertyDescriptor;SetValue;(System.Object,System.Object);Argument[1];Argument[0];taint;df-generated |
@@ -9085,7 +9084,6 @@ summary
 | System.ComponentModel;PropertyDescriptor;FillAttributes;(System.Collections.IList);Argument[this];Argument[0].Element;taint;df-generated |
 | System.ComponentModel;PropertyDescriptor;GetEditor;(System.Type);Argument[this];ReturnValue;taint;df-generated |
 | System.ComponentModel;PropertyDescriptor;GetInvocationTarget;(System.Type,System.Object);Argument[1];ReturnValue;value;dfc-generated |
-| System.ComponentModel;PropertyDescriptor;GetValue;(System.Object);Argument[0];ReturnValue;taint;dfc-generated |
 | System.ComponentModel;PropertyDescriptor;RemoveValueChanged;(System.Object,System.EventHandler);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
 | System.ComponentModel;PropertyDescriptor;ResetValue;(System.Object);Argument[this];Argument[0];taint;df-generated |
 | System.ComponentModel;PropertyDescriptor;SetValue;(System.Object,System.Object);Argument[0];Argument[this];taint;df-generated |
@@ -25715,6 +25713,7 @@ neutral
 | Newtonsoft.Json.Linq;JObject;remove_PropertyChanged;(System.ComponentModel.PropertyChangedEventHandler);summary;df-generated |
 | Newtonsoft.Json.Linq;JObject;remove_PropertyChanging;(System.ComponentModel.PropertyChangingEventHandler);summary;df-generated |
 | Newtonsoft.Json.Linq;JPropertyDescriptor;CanResetValue;(System.Object);summary;df-generated |
+| Newtonsoft.Json.Linq;JPropertyDescriptor;GetValue;(System.Object);summary;manual |
 | Newtonsoft.Json.Linq;JPropertyDescriptor;ShouldSerializeValue;(System.Object);summary;df-generated |
 | Newtonsoft.Json.Linq;JPropertyDescriptor;get_ComponentType;();summary;df-generated |
 | Newtonsoft.Json.Linq;JPropertyDescriptor;get_IsReadOnly;();summary;df-generated |
@@ -28812,6 +28811,7 @@ neutral
 | System.ComponentModel;PropertyDescriptor;GetChildProperties;(System.Object,System.Attribute[]);summary;df-generated |
 | System.ComponentModel;PropertyDescriptor;GetHashCode;();summary;df-generated |
 | System.ComponentModel;PropertyDescriptor;GetTypeFromName;(System.String);summary;df-generated |
+| System.ComponentModel;PropertyDescriptor;GetValue;(System.Object);summary;manual |
 | System.ComponentModel;PropertyDescriptor;GetValueChangedHandler;(System.Object);summary;df-generated |
 | System.ComponentModel;PropertyDescriptor;OnValueChanged;(System.Object,System.EventArgs);summary;df-generated |
 | System.ComponentModel;PropertyDescriptor;PropertyDescriptor;(System.ComponentModel.MemberDescriptor);summary;df-generated |

diff --git a/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected b/csharp/ql/test/library-tests/dataflow/library/FlowSummariesFiltered.expected
@@ -6727,7 +6727,6 @@
 | System.ComponentModel;PropertyChangingEventHandler;BeginInvoke;(System.Object,System.ComponentModel.PropertyChangingEventArgs,System.AsyncCallback,System.Object);Argument[2];Argument[2].Parameter[delegate-self];value;hq-generated |
 | System.ComponentModel;PropertyDescriptor;AddValueChanged;(System.Object,System.EventHandler);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
 | System.ComponentModel;PropertyDescriptor;GetEditor;(System.Type);Argument[this];ReturnValue;taint;df-generated |
-| System.ComponentModel;PropertyDescriptor;GetValue;(System.Object);Argument[0];ReturnValue;taint;dfc-generated |
 | System.ComponentModel;PropertyDescriptor;RemoveValueChanged;(System.Object,System.EventHandler);Argument[1];Argument[1].Parameter[delegate-self];value;hq-generated |
 | System.ComponentModel;PropertyDescriptor;ResetValue;(System.Object);Argument[this];Argument[0];taint;df-generated |
 | System.ComponentModel;PropertyDescriptor;SetValue;(System.Object,System.Object);Argument[0];Argument[this];taint;df-generated |

diff --git a/go/ql/consistency-queries/CHANGELOG.md b/go/ql/consistency-queries/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 1.0.33
+
+No user-facing changes.
+
 ## 1.0.32
 
 No user-facing changes.

diff --git a/go/ql/consistency-queries/change-notes/released/1.0.33.md b/go/ql/consistency-queries/change-notes/released/1.0.33.md
@@ -0,0 +1,3 @@
+## 1.0.33
+
+No user-facing changes.
diff --git a/go/ql/consistency-queries/codeql-pack.release.yml b/go/ql/consistency-queries/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 1.0.32
+lastReleaseVersion: 1.0.33
diff --git a/go/ql/consistency-queries/qlpack.yml b/go/ql/consistency-queries/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql-go-consistency-queries
-version: 1.0.33-dev
+version: 1.0.34-dev
 groups:
   - go
   - queries

diff --git a/go/ql/lib/CHANGELOG.md b/go/ql/lib/CHANGELOG.md
@@ -1,3 +1,25 @@
+## 5.0.0
+
+### Breaking Changes
+
+* The member predicate `writesField` on `DataFlow::Write` now uses the post-update node for `base` when that is the node being updated, which is in all cases except initializing a struct literal. A new member predicate `writesFieldPreUpdate` has been added for cases where this behaviour is not desired.
+* The member predicate `writesElement` on `DataFlow::Write` now uses the post-update node for `base` when that is the node being updated, which is in all cases except initializing an array/slice/map literal. A new member predicate `writesElementPreUpdate` has been added for cases where this behaviour is not desired.
+
+### Deprecated APIs
+
+* The class `SqlInjection::NumericOrBooleanSanitizer` has been deprecated. Use `SimpleTypeSanitizer` from `semmle.go.security.Sanitizers` instead.
+* The member predicate `writesComponent` on `DataFlow::Write` has been deprecated. Instead, use `writesFieldPreUpdate` and `writesElementPreUpdate`, or their new versions `writesField` and `writesElement`.
+
+### Major Analysis Improvements
+
+* The shape of the Go data-flow graph has changed. Previously for code like `x := def(); use1(x); use2(x)`, there would be edges from the definition of `x` to each use. Now there is an edge from the definition to the first use, then another from the first use to the second, and so on. This means that data-flow barriers work differently - flow will not reach any uses after the barrier node. Where this is not desired it may be necessary to add an additional flow step to propagate the flow forward. Additionally, when a variable may be subject to a side-effect, such as updating an array, passing a pointer to a function that might write through it or writing to a field of a struct, there is now a dedicated post-update node representing the variable after this side-effect has taken place. Previously post-update nodes were aliases for either a variable's definition, or were equal to the pre-update node. This led to backwards steps in the data-flow graph, which could cause false positives. For example, in the previous code there would be an edge from `x` in `use2(x)` back to the definition of `x`. If we define our sources as any argument of `use2` and our sinks as any argument of `use1` then this would lead to a false positive path. Now there are distinct post-update nodes and no backwards edge to the definition, so we will not find this false positive path.
+
+### Minor Analysis Improvements
+
+* The query `go/request-forgery` will no longer report alerts when the user input is of a simple type, like a number or a boolean.
+* For the query `go/unvalidated-url-redirection`, when untrusted data is assigned to the `Host` field of a `url.URL` struct, we consider the whole struct untrusted. We now also include the case when this happens during struct initialization, for example `&url.URL{Host: untrustedData}`.
+* `go/unvalidated-url-redirection` and `go/request-forgery` have a shared notion of a safe URL, which is known to not be malicious. Some URLs which were incorrectly considered safe are now correctly considered unsafe. This may lead to more alerts for those two queries.
+
 ## 4.3.5
 
 No user-facing changes.