data-douser · Nov 11, 2026 · Nov 3, 2026 · Nov 10, 2026 · Nov 10, 2026 · Nov 10, 2026
diff --git a/.codeql-version b/.codeql-version
@@ -1 +1 @@
-v2.27.3
+v2.27.4
diff --git a/.github/workflows/update-codeql.yml b/.github/workflows/update-codeql.yml
@@ -107,9 +107,10 @@ jobs:
   # ─────────────────────────────────────────────────────────────────────────────
   # Step 2: Update version, test, and create PR
   #
-  # Updates all version-bearing files (qlt.conf.json, qlpack.yml files),
-  # installs CodeQL, upgrades pack lock files, compiles CDS files, runs unit
-  # tests, and creates a pull request with the changes.
+  # Updates all version-bearing files (qlt.conf.json, .codeql-version, qlpack.yml files),
+  # installs CodeQL, aligns JavaScript dependency and model target ranges with
+  # the selected standard-library release, upgrades pack lock files, compiles
+  # CDS files, runs unit tests, and creates a pull request with the changes.
   #
   # This does NOT trigger the release pipeline. Merging the PR and creating a
   # release tag is a separate, human-initiated step via release.yml.
@@ -150,6 +151,34 @@ jobs:
           export PATH="${STUB_DIR}:${PATH}"
           echo "CodeQL version: $(codeql version --format=terse)"
 
+      - name: Update - Align JavaScript library versions
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CODEQL_VERSION: ${{ needs.detect-update.outputs.latest_version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          library_manifest=$(gh api \
+            "repos/github/codeql/contents/javascript/ql/lib/qlpack.yml?ref=codeql-cli/v${CODEQL_VERSION}" \
+            -H "Accept: application/vnd.github.raw+json")
+          javascript_all_version=$(awk '/^version:/ { print $2 }' <<< "${library_manifest}")
+          if [[ ! "${javascript_all_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Could not determine codeql/javascript-all version for CodeQL ${CODEQL_VERSION}"
+            exit 1
+          fi
+
+          if ! manifests=$(git grep -l -E '^[[:space:]]*"?codeql/javascript-all"?:' -- '**/qlpack.yml'); then
+            echo "::error::No codeql/javascript-all dependencies or extension targets found"
+            exit 1
+          fi
+          echo "Updating codeql/javascript-all dependencies and extension targets to ^${javascript_all_version}"
+          while IFS= read -r manifest; do
+            sed -i.bak -E \
+              "s|^([[:space:]]*\"?codeql/javascript-all\"?:).*|\1 \"^${javascript_all_version}\"|" \
+              "${manifest}"
+            rm "${manifest}.bak"
+          done <<< "${manifests}"
+
       - name: Update - Upgrade CodeQL pack lock files
         run: ./scripts/upgrade-packs.sh
 
@@ -185,6 +214,7 @@ jobs:
 
             **Changes made:**
             - Updated `qlt.conf.json` (CodeQLCLI, CodeQLStandardLibrary, CodeQLCLIBundle) to `${{ needs.detect-update.outputs.latest_version }}`
+            - Updated `.codeql-version` to `v${{ needs.detect-update.outputs.latest_version }}`
             - Updated all version-bearing qlpack.yml files to `${{ needs.detect-update.outputs.latest_version }}`
             - Upgraded CodeQL pack lock files
             - Compiled CAP CDS files
@@ -208,6 +238,7 @@ jobs:
           echo "| Property | Old Value | New Value |" >> $GITHUB_STEP_SUMMARY
           echo "| -------- | --------- | --------- |" >> $GITHUB_STEP_SUMMARY
           echo "| qlt.conf.json CodeQLCLI | ${CURRENT} | ${LATEST} |" >> $GITHUB_STEP_SUMMARY
+          echo "| .codeql-version | v${CURRENT} | v${LATEST} |" >> $GITHUB_STEP_SUMMARY
           echo "| qlpack.yml versions | ${CURRENT} | ${LATEST} |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "A pull request has been created with these changes." >> $GITHUB_STEP_SUMMARY
diff --git a/javascript/frameworks/cap/ext/qlpack.yml b/javascript/frameworks/cap/ext/qlpack.yml
@@ -1,8 +1,8 @@
 ---
 library: true
 name: advanced-security/javascript-sap-cap-models
-version: 2.27.3
+version: 2.27.4
 extensionTargets:
-  codeql/javascript-all: "^2.6.24"
+  codeql/javascript-all: "^3.0.0"
 dataExtensions:
   - "*.model.yml"
diff --git a/javascript/frameworks/cap/lib/codeql-pack.lock.yml b/javascript/frameworks/cap/lib/codeql-pack.lock.yml
@@ -2,29 +2,29 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/concepts:
-    version: 0.0.34
+    version: 0.0.35
   codeql/controlflow:
-    version: 2.0.44
+    version: 2.0.45
   codeql/dataflow:
-    version: 2.1.16
+    version: 2.1.17
   codeql/javascript-all:
-    version: 2.10.4
+    version: 3.0.0
   codeql/mad:
-    version: 1.0.60
+    version: 1.0.61
   codeql/regex:
-    version: 1.0.60
+    version: 1.0.61
   codeql/ssa:
-    version: 2.0.36
+    version: 2.0.37
   codeql/threat-models:
-    version: 1.1.0
+    version: 1.1.1
   codeql/tutorial:
-    version: 1.0.60
+    version: 1.0.61
   codeql/typetracking:
-    version: 2.0.44
+    version: 2.0.45
   codeql/util:
-    version: 2.0.47
+    version: 2.0.48
   codeql/xml:
-    version: 1.0.60
+    version: 1.0.61
   codeql/yaml:
-    version: 1.0.60
+    version: 1.0.61
 compiled: false
diff --git a/javascript/frameworks/cap/lib/qlpack.yml b/javascript/frameworks/cap/lib/qlpack.yml
@@ -1,8 +1,8 @@
 ---
 library: true
 name: advanced-security/javascript-sap-cap-all
-version: 2.27.3
+version: 2.27.4
 suites: codeql-suites
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.6.24"
+  codeql/javascript-all: "^3.0.0"
diff --git a/javascript/frameworks/cap/src/codeql-pack.lock.yml b/javascript/frameworks/cap/src/codeql-pack.lock.yml
@@ -2,29 +2,29 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/concepts:
-    version: 0.0.34
+    version: 0.0.35
   codeql/controlflow:
-    version: 2.0.44
+    version: 2.0.45
   codeql/dataflow:
-    version: 2.1.16
+    version: 2.1.17
   codeql/javascript-all:
-    version: 2.10.4
+    version: 3.0.0
   codeql/mad:
-    version: 1.0.60
+    version: 1.0.61
   codeql/regex:
-    version: 1.0.60
+    version: 1.0.61
   codeql/ssa:
-    version: 2.0.36
+    version: 2.0.37
   codeql/threat-models:
-    version: 1.1.0
+    version: 1.1.1
   codeql/tutorial:
-    version: 1.0.60
+    version: 1.0.61
   codeql/typetracking:
-    version: 2.0.44
+    version: 2.0.45
   codeql/util:
-    version: 2.0.47
+    version: 2.0.48
   codeql/xml:
-    version: 1.0.60
+    version: 1.0.61
   codeql/yaml:
-    version: 1.0.60
+    version: 1.0.61
 compiled: false
diff --git a/javascript/frameworks/cap/src/qlpack.yml b/javascript/frameworks/cap/src/qlpack.yml
@@ -1,10 +1,10 @@
 ---
 library: false
 name: advanced-security/javascript-sap-cap-queries
-version: 2.27.3
+version: 2.27.4
 suites: codeql-suites
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-cap-all: "2.27.3"
+  codeql/javascript-all: "^3.0.0"
+  advanced-security/javascript-sap-cap-all: "2.27.4"
 default-suite-file: codeql-suites/javascript-code-scanning.qls
diff --git a/javascript/frameworks/cap/test/codeql-pack.lock.yml b/javascript/frameworks/cap/test/codeql-pack.lock.yml
@@ -2,29 +2,29 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/concepts:
-    version: 0.0.34
+    version: 0.0.35
   codeql/controlflow:
-    version: 2.0.44
+    version: 2.0.45
   codeql/dataflow:
-    version: 2.1.16
+    version: 2.1.17
   codeql/javascript-all:
-    version: 2.10.4
+    version: 3.0.0
   codeql/mad:
-    version: 1.0.60
+    version: 1.0.61
   codeql/regex:
-    version: 1.0.60
+    version: 1.0.61
   codeql/ssa:
-    version: 2.0.36
+    version: 2.0.37
   codeql/threat-models:
-    version: 1.1.0
+    version: 1.1.1
   codeql/tutorial:
-    version: 1.0.60
+    version: 1.0.61
   codeql/typetracking:
-    version: 2.0.44
+    version: 2.0.45
   codeql/util:
-    version: 2.0.47
+    version: 2.0.48
   codeql/xml:
-    version: 1.0.60
+    version: 1.0.61
   codeql/yaml:
-    version: 1.0.60
+    version: 1.0.61
 compiled: false
diff --git a/javascript/frameworks/cap/test/qlpack.yml b/javascript/frameworks/cap/test/qlpack.yml
@@ -1,9 +1,9 @@
 ---
 name: advanced-security/javascript-sap-cap-queries-tests
-version: 2.27.3
+version: 2.27.4
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-cap-queries: "2.27.3"
-  advanced-security/javascript-sap-cap-models: "2.27.3"
-  advanced-security/javascript-sap-cap-all: "2.27.3"
+  codeql/javascript-all: "^3.0.0"
+  advanced-security/javascript-sap-cap-queries: "2.27.4"
+  advanced-security/javascript-sap-cap-models: "2.27.4"
+  advanced-security/javascript-sap-cap-all: "2.27.4"
diff --git a/javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml b/javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml
@@ -2,29 +2,29 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/concepts:
-    version: 0.0.34
+    version: 0.0.35
   codeql/controlflow:
-    version: 2.0.44
+    version: 2.0.45
   codeql/dataflow:
-    version: 2.1.16
+    version: 2.1.17
   codeql/javascript-all:
-    version: 2.10.4
+    version: 3.0.0
   codeql/mad:
-    version: 1.0.60
+    version: 1.0.61
   codeql/regex:
-    version: 1.0.60
+    version: 1.0.61
   codeql/ssa:
-    version: 2.0.36
+    version: 2.0.37
   codeql/threat-models:
-    version: 1.1.0
+    version: 1.1.1
   codeql/tutorial:
-    version: 1.0.60
+    version: 1.0.61
   codeql/typetracking:
-    version: 2.0.44
+    version: 2.0.45
   codeql/util:
-    version: 2.0.47
+    version: 2.0.48
   codeql/xml:
-    version: 1.0.60
+    version: 1.0.61
   codeql/yaml:
-    version: 1.0.60
+    version: 1.0.61
 compiled: false
diff --git a/javascript/frameworks/ui5-webcomponents/test/qlpack.yml b/javascript/frameworks/ui5-webcomponents/test/qlpack.yml
@@ -1,6 +1,6 @@
 name: advanced-security/javascript-sap-ui5-webcomponents-for-react-test
-version: 2.27.3
+version: 2.27.4
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-ui5-all: "2.27.3"
+  codeql/javascript-all: "^3.0.0"
+  advanced-security/javascript-sap-ui5-all: "2.27.4"
diff --git a/javascript/frameworks/ui5/ext/qlpack.yml b/javascript/frameworks/ui5/ext/qlpack.yml
@@ -1,8 +1,8 @@
 ---
 library: true
 name: advanced-security/javascript-sap-ui5-models
-version: 2.27.3
+version: 2.27.4
 extensionTargets:
-  codeql/javascript-all: "^2.6.24"
+  codeql/javascript-all: "^3.0.0"
 dataExtensions:
   - "*.model.yml"
diff --git a/javascript/frameworks/ui5/lib/codeql-pack.lock.yml b/javascript/frameworks/ui5/lib/codeql-pack.lock.yml
@@ -2,29 +2,29 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/concepts:
-    version: 0.0.34
+    version: 0.0.35
   codeql/controlflow:
-    version: 2.0.44
+    version: 2.0.45
   codeql/dataflow:
-    version: 2.1.16
+    version: 2.1.17
   codeql/javascript-all:
-    version: 2.10.4
+    version: 3.0.0
   codeql/mad:
-    version: 1.0.60
+    version: 1.0.61
   codeql/regex:
-    version: 1.0.60
+    version: 1.0.61
   codeql/ssa:
-    version: 2.0.36
+    version: 2.0.37
   codeql/threat-models:
-    version: 1.1.0
+    version: 1.1.1
   codeql/tutorial:
-    version: 1.0.60
+    version: 1.0.61
   codeql/typetracking:
-    version: 2.0.44
+    version: 2.0.45
   codeql/util:
-    version: 2.0.47
+    version: 2.0.48
   codeql/xml:
-    version: 1.0.60
+    version: 1.0.61
   codeql/yaml:
-    version: 1.0.60
+    version: 1.0.61
 compiled: false
diff --git a/javascript/frameworks/ui5/lib/qlpack.yml b/javascript/frameworks/ui5/lib/qlpack.yml
@@ -1,8 +1,8 @@
 ---
 library: true
 name: advanced-security/javascript-sap-ui5-all
-version: 2.27.3
+version: 2.27.4
 suites: codeql-suites
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.6.24"
+  codeql/javascript-all: "^3.0.0"