Update changelog documentation site for codeql-cli-2.25.6 by henrymercer · Pull Request #21945 · github/codeql

henrymercer

Conversation

This pull request was automatically generated to synchronize the CodeQL changelog documentation based on recent changes to CodeQL.

Overview

Ensures that the documentation remains current with the source Markdown changelogs.
- Incorporates any detected changes in the CodeQL CLI changelog.
- Incorporates any detected changes in the CodeQL languages' changelogs.
- Regenerates the formatted changelog documentation.

Next Steps

Please review the rendered docs and verify that the changelog content is correct. Edit as necessary.
Once you're satisfied with the changes, please merge this PR.

…25.6

Post-release preparation for codeql-cli-2.25.6

Copilot AI review requested due to automatic review settings

June 4, 2026 17:04

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the CodeQL changelog documentation site to include the autogenerated release notes for CodeQL CLI 2.25.6, and links it from the changelog index.

Changes:

Added a new changelog page: CodeQL 2.25.6 (2026-06-04).
Updated the changelog toctree to include the new 2.25.6 entry.

Show a summary per file

File	Description
docs/codeql/codeql-overview/codeql-changelog/index.rst	Adds `codeql-cli-2.25.6` to the changelog toctree.
docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.25.6.rst	Introduces the release notes page for CodeQL CLI 2.25.6 (needs minor copy edits).

Copilot's findings

Files reviewed: 2/2 changed files
Comments generated: 3

		GitHub Actions
		""""""""""""""

		* Adjusted (minor) help file descriptions for queries: :code:`actions/untrusted-checkout/critical`, :code:`actions/untrusted-checkout/high`, :code:`actions/untrusted-checkout/medium`. Clarified wording on in minor point, added one more listed resource and added one more recommendation for things to check.

		Python
		""""""

		* The sensitive data heuristics used to identify code that handles passwords and private data have been improved. Most of the changes permit more variations of established patterns, thereby finding more sensitive data. Queries that use the sensitive data library (for example :code:`py/clear-text-logging-sensitive-data`) may find more correct results and less fewer positive results after these changes.

		GitHub Actions
		""""""""""""""

		* The GitHub Actions analysis now recognizes more Bash regex checks that restrict a value to alphanumeric characters, include regexes like :code:`^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$` which check for a sha1 or sha256 hash. This may reduce false positive results where command output is validated with grouped or optional alphanumeric patterns before being used.