Jami

Java: query to detect android:debuggable attribute enabled

1

This query warns about `android:debuggable="true"` set in the application section of the `AndroidManifest.xml` file.

This PR adds a query to detect implicitly exported components in `AndroidManifest.xml` files.

Java: Android deeplink analysis

1

**Summary:** This PR adds flow steps to model the routing aspect of a [deeplink](https://developer.android.com/training/app-links#deep-links)-handling Android component (i.e. wire the [Intent](https://developer.android.com/reference/android/content/Intent) being sent from the deeplink router to its destination). **Description:**...

Java: Promote Unsafe URL Forward query from experimental

2

Draft PR.

Java: remove SpringBootActuators query

8

### Description This PR removes the `githubsecuritylab/java/spring-boot-exposed-actuators` query. This query was added to the default code scanning query suite by https://github.com/github/codeql/pull/18793 and released in [CodeQL 2.21.0](https://github.blog/changelog/2025-04-15-codeql-2-21-0-supports-typescript-5-8-and-expands-language-coverage/#improved-java-analysis). I will make follow-up...

Bumps the version number of all packs to 0.2.2. This PR will be merged after https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/pull/123 and https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/pull/124.

Update dependencies to packs shipped with 2.21.1

2

This PR: - Updates all the lock files to packages shipped with CodeQL 2.21.1 - Updates the `.codeqlversion` to 2.21.1 - Fixes compilation errors - Fixes test errors This PR...