All pull requests

Pull requests

• Python: unpin legacy CFG/ESSA from the AST cached stage (DCA measurement)

  documentationPython
  #22116·yoff opened Jul 2, 2026Contributor·

  ·

• C++: Support access paths for flow sources

  C++
  #22113·MathiasVP opened Jul 2, 2026Contributor·

  ·
  1

• unified: Test CI checks

  Unified
  #22102·asgerf opened Jul 1, 2026Contributor·

  ·

• A query for detecting cyclic joins in QL

  QL-for-QL
  #22093·josefs opened Jun 30, 2026Contributor·

  ·
  3

• Kotlin extractor: fix K2 regressions without expected churn

  JavaKotlin
  #22076·andersfugmann opened Jun 29, 2026Contributor·

  ·

• Add repr() and %r sanitizers to py/log-injection query to reduce false positives

  external-contributionPython
  #22038·mrigankpawagi opened Jun 23, 2026Contributor·

  ·
  1

• Add java data extensions various

  documentationJava
  #22034·knewbury01 opened Jun 22, 2026Contributor·

  ·
  19

• Python: fix py/insecure-protocol false positive on ssl.create_default_context()

  documentationPython
  #22028·parkerbxyz opened Jun 21, 2026Member·

  ·
  1

• Add CWE-295 query for C# (accepting any TLS certificate)

  C#documentation
  #22019·owen-mc with CopilotAI opened Jun 19, 2026·

  ·
  4

  

• Update Apache Avro MaDs - Now including summaries

  Java
  #22015·BazookaMusic opened Jun 19, 2026Contributor·

  ·
  21

• Prompt injection detection for python

  documentationPython
  #22008·BazookaMusic opened Jun 18, 2026Contributor·

  ·
  16

• Java: model LDAP bind-DN sinks for java/ldap-injection

  documentationexternal-contributionJava
  #22002·tonghuaroot opened Jun 18, 2026Contributor·

  ·
  3

• Add experimental C# query: SSRF host guard missing IPv6-transition unwrap (CWE-918/CWE-1389)

  C#documentationexternal-contribution
  #21964·tonghuaroot opened Jun 10, 2026Contributor·

  ·
  3

• Python: switch dataflow library to new (shared) CFG + SSA

  Awaiting evaluationdocumentationPython
  #21925·yoff opened Jun 1, 2026Contributor·

  ·
  13

• Python: add new shared-SSA-backed SSA adapter (additive)

  no-change-note-requiredPython
  #21923·yoff opened Jun 1, 2026Contributor·

  ·
  21

• C++: Proper indirection in all QL models

  C++no-change-note-required
  #21908·MathiasVP opened May 29, 2026Contributor·

  ·

• [MaD][Test] Add Apache Axis2 models

  documentationJava
  #21903·BazookaMusic opened May 28, 2026Contributor·

  ·
  1

• Yoff/python use shared cfg for dataflow

  documentationPython
  #21894·yoff opened May 26, 2026Contributor·

  ·
  2

• C++: Model formatting functions with a va_list parameter

  C++depends on internal PR
  #21886·MathiasVP opened May 21, 2026Contributor·

  ·

• Go: Add pragma[nomagic] to hasBuildConstraints

  Go
  #21872·owen-mc opened May 20, 2026Contributor·

  ·

• C++: Remove FunctionWithWrappers from cpp/tainted-format-string

  C++depends on internal PR
  #21863·MathiasVP opened May 18, 2026Contributor·

  ·

• Swift: prototype implementation of type inference in QL

  RustSwift
  #21837·hvitved opened May 12, 2026Contributor·

  ·
  9

• Add MaDs for Quarkus, Hibernate ORM with Panache

  Java
  #21828·jacknojo opened May 11, 2026Contributor·

  ·
  1

• C#: Include user defined operator calls in UnaryOperations.

  C#
  #21820·michaelnebel opened May 8, 2026Contributor·

  ·

• Enable local threat-model by default

  #21792·jacknojo opened May 5, 2026Contributor·

  ·