Draft
Remove obsolete Java/Python local-source suites superseded by threat-models: local#218
threat-models: local#218Conversation
Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] End of life local packs with new configurable threat-models setting
Remove obsolete Java/Python local-source suites superseded by Aug 10, 2026
threat-models: local
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CodeQL's built-in
threat-models: localsetting, applied to the default (non-local) queries, now provides the coverage these community-pack-localsuites were built for. Both suites were also independently non-functional.Removed suites
java/src/suites/java-local.qls: referenced an undeclaredcodeql/java-queriesdependency (unresolvable); all 12 listed upstream query IDs were deleted in CodeQL 2.17.4 anyway; its one GHSL query reference (java/xxe-local) never matched the query's actual@id(githubsecuritylab/xxe-local).python/src/suites/python-local.qls: always resolved to zero queries due to a YAML bug:Config
configs/synthetics.yml: dropped the two-localsuite entries.threat-models: localstays, since it's the mechanism now providing equivalent coverage on the default (non-suffixed) queries.Versioning
java/src/qlpack.ymlandpython/src/qlpack.yml(0.7.5→0.8.0), since a named, externally-referenceable suite is being removed from each pack.Out of scope
The individual
*Local.qlqueries andLocalSources.qll/XMLLocalLib.qlllibraries are untouched. They already run via the defaultjava.qls/python.qlssuites regardless of the removed suites, and GHSL's local-source libraries cover some file-read sources (e.g.pickle,pandas,yaml) beyond upstream's "file" threat model, so removing them isn't a pure no-op. Left as a separate follow-up if desired.localpacks with new configurablethreat-modelssetting in CodeQL #69