Merge pull request #1724 from github/henrymercer/bump-minimum-codeql-version

Bump minimum CodeQL version to 2.9.4

.github/workflows/__analyze-ref-input.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: "PR Check - Analyze: 'ref' and 'sha' from inputs"
@@ -25,12 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -49,6 +43,12 @@ jobs:
           version: stable-20221211
         - os: windows-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
+        - os: windows-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__autobuild-action.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - autobuild-action

.github/workflows/__config-export.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Config export

.github/workflows/__diagnostics-export.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Diagnostic export

.github/workflows/__export-file-baseline-information.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Export file baseline information

.github/workflows/__extractor-ram-threads.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Extractor ram and threads options test

.github/workflows/__go-custom-queries.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Go: Custom queries'
@@ -25,12 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -49,6 +43,12 @@ jobs:
           version: stable-20221211
         - os: windows-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
+        - os: windows-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__go-tracing-autobuilder.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Go: tracing with autobuilder step'
@@ -25,10 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -41,6 +37,10 @@ jobs:
           version: stable-20221211
         - os: macos-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__go-tracing-custom-build-steps.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Go: tracing with custom build steps'
@@ -25,10 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -41,6 +37,10 @@ jobs:
           version: stable-20221211
         - os: macos-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__go-tracing-legacy-workflow.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Go: tracing with legacy workflow'
@@ -25,10 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -41,6 +37,10 @@ jobs:
           version: stable-20221211
         - os: macos-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__init-with-registries.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Download using registries'

.github/workflows/__javascript-source-root.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Custom source root

.github/workflows/__ml-powered-queries.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - ML-powered queries
@@ -25,12 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -49,6 +43,12 @@ jobs:
           version: stable-20221211
         - os: windows-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
+        - os: windows-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest
@@ -110,8 +110,6 @@ jobs:
 
     - name: Check sarif
       uses: ./../action/.github/actions/check-sarif
-    # Running on Windows requires CodeQL CLI 2.9.0+.
-      if: "!(matrix.version == 'stable-20220401' && runner.os == 'Windows')"
       with:
         sarif-file: ${{ runner.temp }}/results/javascript.sarif
         queries-run: 
@@ -119,14 +117,8 @@ jobs:
         queries-not-run: foo,bar
 
     - name: Check results
-      env:
-      # Running on Windows requires CodeQL CLI 2.9.0+.
-        SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220401' &&
-          runner.os == 'Windows') }}
       shell: bash
       run: |
-        echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"
-
         cd "$RUNNER_TEMP/results"
         # We should run at least the ML-powered queries in `expected_rules`.
         expected_rules="js/ml-powered/nosql-injection js/ml-powered/path-injection js/ml-powered/sql-injection js/ml-powered/xss"
@@ -135,12 +127,9 @@ jobs:
           found_rule=$(jq --arg rule "${rule}" '[.runs[0].tool.extensions[].rules | select(. != null) |
             flatten | .[].id] | any(. == $rule)' javascript.sarif)
           echo "Did find rule '${rule}': ${found_rule}"
-          if [[ "${found_rule}" != "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
+          if [[ "${found_rule}" != "true" ]]; then
             echo "Expected SARIF output to contain rule '${rule}', but found no such rule."
             exit 1
-          elif [[ "${found_rule}" == "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
-            echo "Found rule '${rule}' in the SARIF output which shouldn't have been part of the analysis."
-            exit 1
           fi
         done
 
@@ -149,12 +138,9 @@ jobs:
           select(.properties.score != null and (.rule.id | startswith("js/ml-powered/")))] | length' \
           javascript.sarif)
         echo "Found ${num_alerts} alerts from ML-powered queries.";
-        if [[ "${num_alerts}" -eq 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
+        if [[ "${num_alerts}" -eq 0 ]]; then
           echo "Expected to find at least one alert from an ML-powered query but found ${num_alerts}."
           exit 1
-        elif [[ "${num_alerts}" -ne 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
-          echo "Expected not to find any alerts from an ML-powered query but found ${num_alerts}."
-          exit 1
         fi
     env:
       CODEQL_ACTION_TEST_MODE: true

.github/workflows/__multi-language-autodetect.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Multi-language repository
@@ -25,10 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -41,6 +37,10 @@ jobs:
           version: stable-20221211
         - os: macos-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__packaging-codescanning-config-inputs-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Config and input passed to the CLI'

.github/workflows/__packaging-config-inputs-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Config and input'

.github/workflows/__packaging-config-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Config file'

.github/workflows/__packaging-inputs-js.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: 'PR Check - Packaging: Action input'

.github/workflows/__remote-config.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Remote config file
@@ -25,12 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -49,6 +43,12 @@ jobs:
           version: stable-20221211
         - os: windows-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
+        - os: windows-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__resolve-environment-action.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Resolve environment

.github/workflows/__rubocop-multi-language.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - RuboCop multi-language

.github/workflows/__ruby.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Ruby analysis

.github/workflows/__scaling-reserved-ram.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Scaling reserved RAM
@@ -25,10 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -41,6 +37,10 @@ jobs:
           version: stable-20221211
         - os: macos-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__split-workflow.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Split workflow

.github/workflows/__submit-sarif-failure.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Submit SARIF after failure

.github/workflows/__swift-custom-build.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Swift analysis using a custom build command

.github/workflows/__test-autobuild-working-dir.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Autobuild working directory

.github/workflows/__test-local-codeql.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Local CodeQL bundle

.github/workflows/__test-proxy.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Proxy test

.github/workflows/__unset-environment.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Test unsetting environment variables
@@ -25,14 +25,14 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: ubuntu-latest
           version: stable-20220908
         - os: ubuntu-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: ubuntu-latest

.github/workflows/__upload-ref-sha-input.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: "PR Check - Upload-sarif: 'ref' and 'sha' from inputs"
@@ -25,12 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -49,6 +43,12 @@ jobs:
           version: stable-20221211
         - os: windows-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
+        - os: windows-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/__with-checkout-path.yml

@@ -1,6 +1,6 @@
 # Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 name: PR Check - Use a custom `checkout_path`
@@ -25,12 +25,6 @@ jobs:
     strategy:
       matrix:
         include:
-        - os: ubuntu-latest
-          version: stable-20220401
-        - os: macos-latest
-          version: stable-20220401
-        - os: windows-latest
-          version: stable-20220401
         - os: ubuntu-latest
           version: stable-20220615
         - os: macos-latest
@@ -49,6 +43,12 @@ jobs:
           version: stable-20221211
         - os: windows-latest
           version: stable-20221211
+        - os: ubuntu-latest
+          version: stable-20230418
+        - os: macos-latest
+          version: stable-20230418
+        - os: windows-latest
+          version: stable-20230418
         - os: ubuntu-latest
           version: cached
         - os: macos-latest

.github/workflows/debug-artifacts.yml

@@ -25,10 +25,10 @@ jobs:
         - ubuntu-latest
         - macos-latest
         version:
-        - stable-20220401
         - stable-20220615
         - stable-20220908
         - stable-20221211
+        - stable-20230418
         - cached
         - latest
         - nightly-latest
@@ -74,7 +74,7 @@ jobs:
       - name: Check expected artifacts exist
         shell: bash
         run: |
-          VERSIONS="stable-20220401 stable-20220615 stable-20220908 stable-20221211 cached latest nightly-latest"
+          VERSIONS="stable-20220615 stable-20220908 stable-20221211 stable-20230418 cached latest nightly-latest"
           LANGUAGES="cpp csharp go java javascript python"
           for version in $VERSIONS; do
             for os in ubuntu-latest macos-latest; do

.github/workflows/pr-checks.yml

@@ -47,12 +47,13 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: 3.8
+          python-version: 3.11
 
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install ruamel.yaml
+          # When updating this, update the autogenerated code header in `sync.py` too.
+          pip install ruamel.yaml==0.17.31
 
       # Ensure the generated PR check workflows are up to date.
       - name: Verify PR checks up to date

CHANGELOG.md

@@ -1,10 +1,10 @@
 # CodeQL Action Changelog
 
+See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
+
 ## [UNRELEASED]
 
-No user facing changes.
-
-See the [releases page](https://github.com/github/codeql-action/releases) for the relevant changes to the CodeQL CLI and language packs.
+- CodeQL Action now requires CodeQL CLI 2.9.4 or later. For more information, see the corresponding changelog entry for CodeQL Action version 2.20.4. [#1724](https://github.com/github/codeql-action/pull/1724)
 
 ## 2.20.4 - 14 Jul 2023
 

lib/codeql.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_NEW_ANALYSIS_SUMMARY = exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
+exports.getExtraOptions = exports.getCodeQLForCmd = exports.getCodeQLForTesting = exports.getCachedCodeQL = exports.setCodeQL = exports.getCodeQL = exports.setupCodeQL = exports.CODEQL_VERSION_NEW_ANALYSIS_SUMMARY = exports.CODEQL_VERSION_BUNDLE_SEMANTICALLY_VERSIONED = exports.CODEQL_VERSION_RESOLVE_ENVIRONMENT = exports.CODEQL_VERSION_INIT_WITH_QLCONFIG = exports.CODEQL_VERSION_EXPORT_CODE_SCANNING_CONFIG = exports.CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE = exports.CODEQL_VERSION_BETTER_RESOLVE_LANGUAGES = exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = exports.CommandInvocationError = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const core = __importStar(require("@actions/core"));
@@ -62,7 +62,7 @@ let cachedCodeQL = undefined;
  * The version flags below can be used to conditionally enable certain features
  * on versions newer than this.
  */
-const CODEQL_MINIMUM_VERSION = "2.8.5";
+const CODEQL_MINIMUM_VERSION = "2.9.4";
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
  */
@@ -76,12 +76,6 @@ const CODEQL_VERSION_LUA_TRACER_CONFIG = "2.10.0";
 const CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED = "2.10.4";
 exports.CODEQL_VERSION_GHES_PACK_DOWNLOAD = "2.10.4";
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
-/**
- * Versions 2.9.0+ of the CodeQL CLI run machine learning models from a temporary directory, which
- * resolves an issue on Windows where TensorFlow models are not correctly loaded due to the path of
- * some of their files being greater than MAX_PATH (260 characters).
- */
-exports.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = "2.9.0";
 /**
  * Previous versions had the option already, but were missing the
  * --extractor-options-verbosity that we need.

lib/codeql.test.js

@@ -363,7 +363,7 @@ for (const isBundleVersionInUrl of [true, false]) {
     await util.withTmpDir(async (tempDir) => {
         const runnerConstructorStub = stubToolRunnerConstructor();
         const codeqlObject = await codeql.getCodeQLForTesting();
-        sinon.stub(codeqlObject, "getVersion").resolves("2.8.1");
+        sinon.stub(codeqlObject, "getVersion").resolves("2.9.4");
         // safeWhich throws because of the test CodeQL object.
         sinon.stub(safeWhich, "safeWhich").resolves("");
         const thisStubConfig = {

lib/config-utils.js

@@ -156,11 +156,7 @@ async function addBuiltinSuiteQueries(languages, codeQL, resultMap, packs, suite
     // If we're running the JavaScript security-extended analysis (or a superset of it), the repo is
     // opted into the ML-powered queries beta, and a user hasn't already added the ML-powered query
     // pack, then add the ML-powered query pack so that we run ML-powered queries.
-    if (
-    // Only run ML-powered queries on Windows if we have a CLI that supports it.
-    (process.platform !== "win32" ||
-        (await (0, util_1.codeQlVersionAbove)(codeQL, codeql_1.CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS))) &&
-        languages.includes("javascript") &&
+    if (languages.includes("javascript") &&
         (found === "security-experimental" ||
             found === "security-extended" ||
             found === "security-and-quality") &&

lib/config-utils.test.js

@@ -1101,37 +1101,23 @@ const mlPoweredQueriesMacro = ava_1.default.macro({
 });
 // macro, codeQLVersion, isMlPoweredQueriesEnabled, packsInput, queriesInput, expectedVersionString
 // Test that ML-powered queries aren't run when the feature is off.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.7.5", false, undefined, "security-extended", undefined);
-// Test that the ~0.1.0 version of ML-powered queries is run on v2.8.3 of the CLI.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.8.3", true, undefined, "security-extended", process.platform === "win32" ? undefined : "~0.1.0");
+(0, ava_1.default)(mlPoweredQueriesMacro, "2.12.3", false, undefined, "security-extended", undefined);
 // Test that ML-powered queries aren't run when the user hasn't specified that we should run the
 //  `security-extended`, `security-and-quality`, or `security-experimental` query suite.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.7.5", true, undefined, undefined, undefined);
-// Test that ML-powered queries are run on non-Windows platforms running `security-extended` on
-// versions of the CodeQL CLI prior to 2.9.0.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.8.5", true, undefined, "security-extended", process.platform === "win32" ? undefined : "~0.2.0");
-// Test that ML-powered queries are run on non-Windows platforms running `security-and-quality` on
-// versions of the CodeQL CLI prior to 2.9.0.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.8.5", true, undefined, "security-and-quality", process.platform === "win32" ? undefined : "~0.2.0");
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL CLI
-// 2.9.0+.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.0", true, undefined, "security-extended", "~0.2.0");
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.9.0+.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.0", true, undefined, "security-and-quality", "~0.2.0");
+(0, ava_1.default)(mlPoweredQueriesMacro, "2.12.3", true, undefined, undefined, undefined);
 // Test that we don't inject an ML-powered query pack if the user has already specified one.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.0", true, "codeql/javascript-experimental-atm-queries@0.0.1", "security-and-quality", "0.0.1");
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL
-// CLI 2.9.3+.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.3", true, undefined, "security-extended", "~0.3.0");
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.9.3+.
-(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.3", true, undefined, "security-and-quality", "~0.3.0");
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL
-// CLI 2.11.3+.
+(0, ava_1.default)(mlPoweredQueriesMacro, "2.12.3", true, "codeql/javascript-experimental-atm-queries@0.0.1", "security-and-quality", "0.0.1");
+// Test that ML-powered queries ~0.3.0 are run on all platforms running `security-extended` on
+// CodeQL CLI 2.9.4+.
+(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.4", true, undefined, "security-extended", "~0.3.0");
+// Test that ML-powered queries ~0.3.0 are run on all platforms running `security-and-quality` on
+// CodeQL CLI 2.9.4+.
+(0, ava_1.default)(mlPoweredQueriesMacro, "2.9.4", true, undefined, "security-and-quality", "~0.3.0");
+// Test that ML-powered queries ~0.4.0 are run on all platforms running `security-extended` on
+// CodeQL CLI 2.11.3+.
 (0, ava_1.default)(mlPoweredQueriesMacro, "2.11.3", true, undefined, "security-extended", "~0.4.0");
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.11.3+.
+// Test that ML-powered queries ~0.4.0 are run on all platforms running `security-and-quality` on
+// CodeQL CLI 2.11.3+.
 (0, ava_1.default)(mlPoweredQueriesMacro, "2.11.3", true, undefined, "security-and-quality", "~0.4.0");
 // Test that ML-powered queries are run on all platforms running `security-experimental` on CodeQL
 // CLI 2.12.1+.

lib/feature-flags.js

@@ -63,7 +63,7 @@ exports.featureConfig = {
     },
     [Feature.MlPoweredQueriesEnabled]: {
         envVar: "CODEQL_ML_POWERED_QUERIES",
-        minimumVersion: "2.7.5",
+        minimumVersion: undefined,
         defaultValue: false,
     },
     [Feature.NewAnalysisSummaryEnabled]: {

lib/util.js

@@ -455,14 +455,8 @@ async function getMlPoweredJsQueriesPack(codeQL) {
     if (await codeQlVersionAbove(codeQL, "2.11.3")) {
         version = "~0.4.0";
     }
-    else if (await codeQlVersionAbove(codeQL, "2.9.3")) {
-        version = `~0.3.0`;
-    }
-    else if (await codeQlVersionAbove(codeQL, "2.8.4")) {
-        version = `~0.2.0`;
-    }
     else {
-        version = `~0.1.0`;
+        version = `~0.3.0`;
     }
     return (0, config_utils_1.prettyPrintPack)({
         name: exports.ML_POWERED_JS_QUERIES_PACK_NAME,

node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.20.5",
+  "version": "2.21.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codeql",
-  "version": "2.20.5",
+  "version": "2.21.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "codeql",
-      "version": "2.20.5",
+      "version": "2.21.0",
       "license": "MIT",
       "dependencies": {
         "@actions/artifact": "^1.1.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql",
-  "version": "2.20.5",
+  "version": "2.21.0",
   "private": true,
   "description": "CodeQL action",
   "scripts": {

pr-checks/checks/ml-powered-queries.yml

@@ -22,21 +22,14 @@ steps:
 
   - name: Check sarif
     uses: ./../action/.github/actions/check-sarif
-    # Running on Windows requires CodeQL CLI 2.9.0+.
-    if: "!(matrix.version == 'stable-20220401' && runner.os == 'Windows')"
     with:
       sarif-file: ${{ runner.temp }}/results/javascript.sarif
       queries-run: js/ml-powered/nosql-injection,js/ml-powered/path-injection,js/ml-powered/sql-injection,js/ml-powered/xss
       queries-not-run: foo,bar
 
   - name: Check results
-    env:
-      # Running on Windows requires CodeQL CLI 2.9.0+.
-      SHOULD_RUN_ML_POWERED_QUERIES: ${{ !(matrix.version == 'stable-20220401' && runner.os == 'Windows') }}
     shell: bash
     run: |
-      echo "Expecting ML-powered queries to be run: ${SHOULD_RUN_ML_POWERED_QUERIES}"
-
       cd "$RUNNER_TEMP/results"
       # We should run at least the ML-powered queries in `expected_rules`.
       expected_rules="js/ml-powered/nosql-injection js/ml-powered/path-injection js/ml-powered/sql-injection js/ml-powered/xss"
@@ -45,12 +38,9 @@ steps:
         found_rule=$(jq --arg rule "${rule}" '[.runs[0].tool.extensions[].rules | select(. != null) |
           flatten | .[].id] | any(. == $rule)' javascript.sarif)
         echo "Did find rule '${rule}': ${found_rule}"
-        if [[ "${found_rule}" != "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
+        if [[ "${found_rule}" != "true" ]]; then
           echo "Expected SARIF output to contain rule '${rule}', but found no such rule."
           exit 1
-        elif [[ "${found_rule}" == "true" && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
-          echo "Found rule '${rule}' in the SARIF output which shouldn't have been part of the analysis."
-          exit 1
         fi
       done
 
@@ -59,10 +49,7 @@ steps:
         select(.properties.score != null and (.rule.id | startswith("js/ml-powered/")))] | length' \
         javascript.sarif)
       echo "Found ${num_alerts} alerts from ML-powered queries.";
-      if [[ "${num_alerts}" -eq 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" == "true" ]]; then
+      if [[ "${num_alerts}" -eq 0 ]]; then
         echo "Expected to find at least one alert from an ML-powered query but found ${num_alerts}."
         exit 1
-      elif [[ "${num_alerts}" -ne 0 && "${SHOULD_RUN_ML_POWERED_QUERIES}" != "true" ]]; then
-        echo "Expected not to find any alerts from an ML-powered query but found ${num_alerts}."
-        exit 1
       fi

pr-checks/sync.py

@@ -5,14 +5,14 @@ import textwrap
 
 # The default set of CodeQL Bundle versions to use for the PR checks.
 defaultTestVersions = [
-    # The oldest supported CodeQL version: 2.8.5. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
-    "stable-20220401",
-    # The last CodeQL release in the 2.9 series: 2.9.4.
+    # The oldest supported CodeQL version: 2.9.4. If bumping, update `CODEQL_MINIMUM_VERSION` in `codeql.ts`
     "stable-20220615",
     # The last CodeQL release in the 2.10 series: 2.10.5.
     "stable-20220908",
     # The last CodeQL release in the 2.11 series: 2.11.6.
     "stable-20221211",
+    # The last CodeQL release in the 2.12 series: 2.12.7.
+    "stable-20230418",
     # The version of CodeQL currently in the toolcache. Typically either the latest release or the one before.
     "cached",
     # The latest release of CodeQL.
@@ -21,10 +21,11 @@ defaultTestVersions = [
     "nightly-latest"
 ]
 
-
+# When updating the ruamel.yaml version here, update the PR check in
+# `.github/workflows/pr-checks.yml` too.
 header = """# Warning: This file is generated automatically, and should not be modified.
 # Instead, please modify the template in the pr-checks directory and run:
-#     (cd pr-checks; pip install ruamel.yaml && python3 sync.py)
+#     (cd pr-checks; pip install ruamel.yaml@0.17.31 && python3 sync.py)
 # to regenerate this file.
 
 """

src/codeql.test.ts

@@ -538,7 +538,7 @@ test("databaseInitCluster() without injected codescanning config", async (t) =>
   await util.withTmpDir(async (tempDir) => {
     const runnerConstructorStub = stubToolRunnerConstructor();
     const codeqlObject = await codeql.getCodeQLForTesting();
-    sinon.stub(codeqlObject, "getVersion").resolves("2.8.1");
+    sinon.stub(codeqlObject, "getVersion").resolves("2.9.4");
     // safeWhich throws because of the test CodeQL object.
     sinon.stub(safeWhich, "safeWhich").resolves("");
 

src/codeql.ts

@@ -270,7 +270,7 @@ let cachedCodeQL: CodeQL | undefined = undefined;
  * The version flags below can be used to conditionally enable certain features
  * on versions newer than this.
  */
-const CODEQL_MINIMUM_VERSION = "2.8.5";
+const CODEQL_MINIMUM_VERSION = "2.9.4";
 
 /**
  * This version will shortly become the oldest version of CodeQL that the Action will run with.
@@ -287,13 +287,6 @@ const CODEQL_VERSION_LUA_TRACING_GO_WINDOWS_FIXED = "2.10.4";
 export const CODEQL_VERSION_GHES_PACK_DOWNLOAD = "2.10.4";
 const CODEQL_VERSION_FILE_BASELINE_INFORMATION = "2.11.3";
 
-/**
- * Versions 2.9.0+ of the CodeQL CLI run machine learning models from a temporary directory, which
- * resolves an issue on Windows where TensorFlow models are not correctly loaded due to the path of
- * some of their files being greater than MAX_PATH (260 characters).
- */
-export const CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS = "2.9.0";
-
 /**
  * Previous versions had the option already, but were missing the
  * --extractor-options-verbosity that we need.

src/config-utils.test.ts

@@ -2189,95 +2189,46 @@ const mlPoweredQueriesMacro = test.macro({
 // Test that ML-powered queries aren't run when the feature is off.
 test(
   mlPoweredQueriesMacro,
-  "2.7.5",
+  "2.12.3",
   false,
   undefined,
   "security-extended",
   undefined
 );
-// Test that the ~0.1.0 version of ML-powered queries is run on v2.8.3 of the CLI.
-test(
-  mlPoweredQueriesMacro,
-  "2.8.3",
-  true,
-  undefined,
-  "security-extended",
-  process.platform === "win32" ? undefined : "~0.1.0"
-);
 // Test that ML-powered queries aren't run when the user hasn't specified that we should run the
 //  `security-extended`, `security-and-quality`, or `security-experimental` query suite.
-test(mlPoweredQueriesMacro, "2.7.5", true, undefined, undefined, undefined);
-// Test that ML-powered queries are run on non-Windows platforms running `security-extended` on
-// versions of the CodeQL CLI prior to 2.9.0.
-test(
-  mlPoweredQueriesMacro,
-  "2.8.5",
-  true,
-  undefined,
-  "security-extended",
-  process.platform === "win32" ? undefined : "~0.2.0"
-);
-// Test that ML-powered queries are run on non-Windows platforms running `security-and-quality` on
-// versions of the CodeQL CLI prior to 2.9.0.
-test(
-  mlPoweredQueriesMacro,
-  "2.8.5",
-  true,
-  undefined,
-  "security-and-quality",
-  process.platform === "win32" ? undefined : "~0.2.0"
-);
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL CLI
-// 2.9.0+.
-test(
-  mlPoweredQueriesMacro,
-  "2.9.0",
-  true,
-  undefined,
-  "security-extended",
-  "~0.2.0"
-);
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.9.0+.
-test(
-  mlPoweredQueriesMacro,
-  "2.9.0",
-  true,
-  undefined,
-  "security-and-quality",
-  "~0.2.0"
-);
+test(mlPoweredQueriesMacro, "2.12.3", true, undefined, undefined, undefined);
 // Test that we don't inject an ML-powered query pack if the user has already specified one.
 test(
   mlPoweredQueriesMacro,
-  "2.9.0",
+  "2.12.3",
   true,
   "codeql/javascript-experimental-atm-queries@0.0.1",
   "security-and-quality",
   "0.0.1"
 );
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL
-// CLI 2.9.3+.
+// Test that ML-powered queries ~0.3.0 are run on all platforms running `security-extended` on
+// CodeQL CLI 2.9.4+.
 test(
   mlPoweredQueriesMacro,
-  "2.9.3",
+  "2.9.4",
   true,
   undefined,
   "security-extended",
   "~0.3.0"
 );
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.9.3+.
+// Test that ML-powered queries ~0.3.0 are run on all platforms running `security-and-quality` on
+// CodeQL CLI 2.9.4+.
 test(
   mlPoweredQueriesMacro,
-  "2.9.3",
+  "2.9.4",
   true,
   undefined,
   "security-and-quality",
   "~0.3.0"
 );
-// Test that ML-powered queries are run on all platforms running `security-extended` on CodeQL
-// CLI 2.11.3+.
+// Test that ML-powered queries ~0.4.0 are run on all platforms running `security-extended` on
+// CodeQL CLI 2.11.3+.
 test(
   mlPoweredQueriesMacro,
   "2.11.3",
@@ -2286,8 +2237,8 @@ test(
   "security-extended",
   "~0.4.0"
 );
-// Test that ML-powered queries are run on all platforms running `security-and-quality` on CodeQL
-// CLI 2.11.3+.
+// Test that ML-powered queries ~0.4.0 are run on all platforms running `security-and-quality` on
+// CodeQL CLI 2.11.3+.
 test(
   mlPoweredQueriesMacro,
   "2.11.3",

src/config-utils.ts

@@ -9,7 +9,6 @@ import * as api from "./api-client";
 import {
   CodeQL,
   CODEQL_VERSION_GHES_PACK_DOWNLOAD,
-  CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS,
   CODEQL_VERSION_SECURITY_EXPERIMENTAL_SUITE,
   ResolveQueriesOutput,
 } from "./codeql";
@@ -425,12 +424,6 @@ async function addBuiltinSuiteQueries(
   // opted into the ML-powered queries beta, and a user hasn't already added the ML-powered query
   // pack, then add the ML-powered query pack so that we run ML-powered queries.
   if (
-    // Only run ML-powered queries on Windows if we have a CLI that supports it.
-    (process.platform !== "win32" ||
-      (await codeQlVersionAbove(
-        codeQL,
-        CODEQL_VERSION_ML_POWERED_QUERIES_WINDOWS
-      ))) &&
     languages.includes("javascript") &&
     (found === "security-experimental" ||
       found === "security-extended" ||

src/feature-flags.ts

@@ -64,7 +64,7 @@ export const featureConfig: Record<
   },
   [Feature.MlPoweredQueriesEnabled]: {
     envVar: "CODEQL_ML_POWERED_QUERIES",
-    minimumVersion: "2.7.5",
+    minimumVersion: undefined,
     defaultValue: false,
   },
   [Feature.NewAnalysisSummaryEnabled]: {

src/util.ts

@@ -586,12 +586,8 @@ export async function getMlPoweredJsQueriesPack(
   let version;
   if (await codeQlVersionAbove(codeQL, "2.11.3")) {
     version = "~0.4.0";
-  } else if (await codeQlVersionAbove(codeQL, "2.9.3")) {
-    version = `~0.3.0`;
-  } else if (await codeQlVersionAbove(codeQL, "2.8.4")) {
-    version = `~0.2.0`;
   } else {
-    version = `~0.1.0`;
+    version = `~0.3.0`;
   }
   return prettyPrintPack({
     name: ML_POWERED_JS_QUERIES_PACK_NAME,