Repository navigation
Upgrade to codeql cli 2.27.4 - #471
Merged
Merged
Conversation
CodeQL 2.27.4 bundles codeql/javascript-all 3.0.0. The SAP model packs targeted ^2.6.24, so CodeQL ignored them and dropped CAP, UI5, and XSJS Code Scanning results. Upgrade all javascript-all dependencies and extension targets to ^3.0.0, regenerate the pack lock files, and align these ranges automatically in future CodeQL upgrade PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
CodeQL upgrade PRs updated qlt.conf.json but left .codeql-version stale. Update the pinned CLI version with the other version-bearing files and validate it in --check. Skip missing pins so older release tags remain checkable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The javascript-all 3.0.0 major upgrade requires CodeQL test and model-regression confirmation that could not be obtained because runtimes were unavailable and upstream release metadata was inaccessible.
No open issues 🎉
What changed in this PR
This PR aligns the repository’s SAP CodeQL packs with CodeQL CLI 2.27.4 and JavaScript library 3.0.0, updating model compatibility ranges and automating alignment for future upgrades.
Changes:
- Bumps CLI configuration and internal pack versions to 2.27.4.
- Updates JavaScript dependencies and model extension targets to
^3.0.0, with refreshed lock files. - Adds workflow automation to derive JavaScript library versions from the selected CLI release.
| File | Description |
|---|---|
qlt.conf.json |
Updates CLI, standard-library, and bundle references to 2.27.4. |
javascript/heuristic-models/tests/qlpack.yml |
Aligns heuristic test pack versions and dependencies. |
javascript/heuristic-models/tests/codeql-pack.lock.yml |
Refreshes heuristic test dependency locks. |
javascript/heuristic-models/ext/qlpack.yml |
Updates heuristic model version and extension target. |
javascript/frameworks/xsjs/test/qlpack.yml |
Aligns XSJS test pack versions and dependencies. |
javascript/frameworks/xsjs/test/codeql-pack.lock.yml |
Refreshes XSJS test dependency locks. |
javascript/frameworks/xsjs/src/qlpack.yml |
Updates XSJS query pack version and dependencies. |
javascript/frameworks/xsjs/src/codeql-pack.lock.yml |
Refreshes XSJS query dependency locks. |
javascript/frameworks/xsjs/lib/qlpack.yml |
Updates XSJS library version and JavaScript dependency. |
javascript/frameworks/xsjs/lib/codeql-pack.lock.yml |
Refreshes XSJS library dependency locks. |
javascript/frameworks/xsjs/ext/qlpack.yml |
Updates XSJS model version and extension target. |
javascript/frameworks/ui5/test/qlpack.yml |
Aligns UI5 test pack versions and dependencies. |
javascript/frameworks/ui5/test/codeql-pack.lock.yml |
Refreshes UI5 test locks, including JavaScript queries 2.5.0. |
javascript/frameworks/ui5/src/qlpack.yml |
Updates UI5 query pack version and dependencies. |
javascript/frameworks/ui5/src/codeql-pack.lock.yml |
Refreshes UI5 query dependency locks. |
javascript/frameworks/ui5/lib/qlpack.yml |
Updates UI5 library version and JavaScript dependency. |
javascript/frameworks/ui5/lib/codeql-pack.lock.yml |
Refreshes UI5 library dependency locks. |
javascript/frameworks/ui5/ext/qlpack.yml |
Updates UI5 model version and extension target. |
javascript/frameworks/ui5-webcomponents/test/qlpack.yml |
Aligns Web Components test versions and dependencies. |
javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml |
Refreshes Web Components test dependency locks. |
javascript/frameworks/cap/test/qlpack.yml |
Aligns CAP test pack versions and dependencies. |
javascript/frameworks/cap/test/codeql-pack.lock.yml |
Refreshes CAP test dependency locks. |
javascript/frameworks/cap/src/qlpack.yml |
Updates CAP query pack version and dependencies. |
javascript/frameworks/cap/src/codeql-pack.lock.yml |
Refreshes CAP query dependency locks. |
javascript/frameworks/cap/lib/qlpack.yml |
Updates CAP library version and JavaScript dependency. |
javascript/frameworks/cap/lib/codeql-pack.lock.yml |
Refreshes CAP library dependency locks. |
javascript/frameworks/cap/ext/qlpack.yml |
Updates CAP model version and extension target. |
.github/workflows/update-codeql.yml |
Automates JavaScript dependency and model-target alignment. |
.codeql-version |
Sets the CLI version to v2.27.4. |
Review effort: Balanced
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The javascript-all 3.0.0 major upgrade still needs cross-platform tests, bundle-loading regression checks, and code-scanning CI confirmation, while access restrictions blocked upstream compatibility and manifest validation.
No open issues 🎉
Review effort: Balanced
mbaluda
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request upgrades the CodeQL JavaScript packs and all related dependencies to version 3.0.0, aligning all
qlpack.ymland lock files accordingly. It also updates the automation workflow to ensure JavaScript dependency versions are automatically aligned with the selected CodeQL CLI release. All relevant package versions have been bumped to 2.27.4 to reflect these changes.Dependency and Version Alignment
codeql/javascript-alldependency to^3.0.0across allqlpack.ymlfiles for CAP, UI5, and XSJS frameworks, and updated internal package dependencies to version2.27.4for consistency.codeql-pack.lock.ymlfiles to referencecodeql/javascript-allversion3.0.0and bumped all other CodeQL dependencies to their latest compatible versions.Automation and Workflow Improvements
update-codeql.ymlGitHub Actions workflow to automatically align JavaScript dependency and model target ranges with the selected CodeQL CLI release, ensuring consistency and reducing manual intervention.General Maintenance
2.27.3to2.27.4in.codeql-versionfor consistency with the new pack versions.These changes ensure compatibility with the latest CodeQL JavaScript libraries and streamline future updates.