Skip to content

Remove obsolete Java/Python local-source suites superseded by threat-models: local - #218

Draft
felickz with Copilot wants to merge 2 commits into
mainfrom
copilot/end-of-life-local-packs
Draft

Remove obsolete Java/Python local-source suites superseded by threat-models: local#218
felickz with Copilot wants to merge 2 commits into
mainfrom
copilot/end-of-life-local-packs

Conversation

Copilot AI commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

CodeQL's built-in threat-models: local setting, applied to the default (non-local) queries, now provides the coverage these community-pack -local suites were built for. Both suites were also independently non-functional.

Removed suites

  • java/src/suites/java-local.qls: referenced an undeclared codeql/java-queries dependency (unresolvable); all 12 listed upstream query IDs were deleted in CodeQL 2.17.4 anyway; its one GHSL query reference (java/xxe-local) never matched the query's actual @id (githubsecuritylab/xxe-local).
  • python/src/suites/python-local.qls: always resolved to zero queries due to a YAML bug:
# tags contain: -local  parses as the literal string "-local", not a list
# exclusion of the "local" tag — this filter never matched anything.
- include:
    tags contain: -local

Config

  • configs/synthetics.yml: dropped the two -local suite entries. threat-models: local stays, since it's the mechanism now providing equivalent coverage on the default (non-suffixed) queries.

Versioning

  • Bumped java/src/qlpack.yml and python/src/qlpack.yml (0.7.50.8.0), since a named, externally-referenceable suite is being removed from each pack.

Out of scope

The individual *Local.ql queries and LocalSources.qll/XMLLocalLib.qll libraries are untouched. They already run via the default java.qls/python.qls suites regardless of the removed suites, and GHSL's local-source libraries cover some file-read sources (e.g. pickle, pandas, yaml) beyond upstream's "file" threat model, so removing them isn't a pure no-op. Left as a separate follow-up if desired.

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
Copilot AI changed the title [WIP] End of life local packs with new configurable threat-models setting Remove obsolete Java/Python local-source suites superseded by threat-models: local Aug 10, 2026
Copilot AI requested a review from felickz August 10, 2026 20:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

End of life the local packs with new configurable threat-models setting in CodeQL

2 participants