Upgrade CodeQL dependencies and prep for v2.27.1 release (#369)

* Upgrade CodeQL CLI dependency to v2.27.1

* chore(PR369): update CHANGELOG and fix CodeQL unit tests

---------

Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
Co-authored-by: Nathan Randall <data-douser@github.com>

Author: github-actions[bot]

.codeql-version

@@ -1 +1 @@
-v2.27.0
+v2.27.1

CHANGELOG.md

@@ -14,6 +14,33 @@ release cadence.
 
 _Changes on `main` since the latest tagged release that have not yet been included in a stable release._
 
+## [v2.27.1] — 2026-09-22
+
+### Highlights
+
+- **Upgraded CodeQL CLI to v2.27.1** — All bundled CodeQL tool query packs were re-resolved against the v2.27.1 library set (`actions-all` 0.6.2, `cpp-all` 12.1.1, `csharp-all` 7.3.1, `go-all` 7.3.2, `java-all` 9.3.1, `javascript-all` 2.10.2, `python-all` 7.2.6, `ruby-all` 7.0.1, `rust-all` 0.2.22, `swift-all` 6.8.4). ([#369](https://github.com/advanced-security/codeql-development-mcp-server/pull/369))
+- **Actions query unit tests now cover `.github/workflows/actions.lock`** — `codeql/actions-all` 0.6.2 is the first library version to ship `codeql/actions/Lock.qll`, so the Actions tool pack gained a dedicated test asserting that the lockfile is extracted and that `ActionsLock.pins` resolves the `uses:` steps it covers. ([#369](https://github.com/advanced-security/codeql-development-mcp-server/pull/369))
+
+### Added
+
+#### CodeQL Query Packs
+
+- **Added an `actions` query unit test for `.github/workflows/actions.lock` extraction.** The new `server/ql/actions/tools/test/ActionsLock` test uses a `semmle-extractor-options: --file-type YAML` directive so `codeql test run` indexes the lockfile (which `codeql database create` picks up automatically via the Actions autobuilder path filters), then asserts that `ActionsLock.pins` resolves both a repository-level pin and a sub-action pin while leaving an unpinned `uses:` step uncovered. ([#369](https://github.com/advanced-security/codeql-development-mcp-server/pull/369))
+
+### Fixed
+
+- **C# `PrintAST` unit tests failed after the `csharp-all` 7.3.1 upgrade.** Regenerated the expected output for the upstream `ForeachStmt` → `ForEachStmt` AST class rename introduced with CodeQL CLI v2.27.1. ([#369](https://github.com/advanced-security/codeql-development-mcp-server/pull/369))
+- **Rust `PrintAST` unit tests failed after the `rust-all` 0.2.22 upgrade.** Regenerated the expected output for the changed standard-library macro expansions — `format!` now expands through `$crate::intrinsics::must_use(...)` and `vec!` through `$crate::boxed::box_assume_init_into_vec_unsafe(...)`. The query implementation and MCP API are unchanged. ([#369](https://github.com/advanced-security/codeql-development-mcp-server/pull/369))
+- **The `Create GitHub Release` job failed during release packaging.** `release.yml` now runs `actions/setup-node` with `node-version-file: '.node-version'` before packaging, and `release-npm.yml` sets `include-hidden-files: true` on the build artifact upload so `.node-version` is carried through. ([#368](https://github.com/advanced-security/codeql-development-mcp-server/pull/368))
+
+### Dependencies
+
+- **Upgraded the CodeQL CLI dependency to v2.27.1.** All version-bearing files (including `.codeql-version`, the root/server/extension `package.json` files, the per-language `codeql-pack.yml` manifests, and the server `VERSION` constant) and all `codeql-pack.lock.yml` files were updated. ([#369](https://github.com/advanced-security/codeql-development-mcp-server/pull/369))
+
+**Full Changelog**: [`v2.27.0...v2.27.1`](https://github.com/advanced-security/codeql-development-mcp-server/compare/v2.27.0...v2.27.1)
+
+---
+
 ## [v2.27.0] — 2026-09-13
 
 ### Highlights
@@ -732,7 +759,8 @@ _Initial public release of the CodeQL Development MCP Server._
 
 <!-- Link definitions -->
 
-[Unreleased]: https://github.com/advanced-security/codeql-development-mcp-server/compare/v2.27.0...HEAD
+[Unreleased]: https://github.com/advanced-security/codeql-development-mcp-server/compare/v2.27.1...HEAD
+[v2.27.1]: https://github.com/advanced-security/codeql-development-mcp-server/releases/tag/v2.27.1
 [v2.27.0]: https://github.com/advanced-security/codeql-development-mcp-server/releases/tag/v2.27.0
 [v2.26.4]: https://github.com/advanced-security/codeql-development-mcp-server/releases/tag/v2.26.4
 [v2.26.3]: https://github.com/advanced-security/codeql-development-mcp-server/releases/tag/v2.26.3

client/integration-tests/primitives/tools/codeql_bqrs_interpret/sarif_format/after/results.sarif

@@ -1 +1 @@
-{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.27.0","rules":[{"id":"test/query","name":"test/query","shortDescription":{"text":"ExampleQuery1"},"fullDescription":{"text":"Example query for integration testing of the codeql_test_extract MCP server tool."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n","markdown":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n"},"properties":{"tags":["mcp-integration-tests"],"description":"Example query for integration testing of the codeql_test_extract MCP server tool.","id":"test/query","kind":"problem","name":"ExampleQuery1","precision":"medium","problem.severity":"warning"}}]},"extensions":[{"name":"mcp-client-integration-tests-static-javascript-src","semanticVersion":"0.0.1+fe0e7d2a7059ebb6c6075ff8eaea04f382747656","locations":[{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/codeql-pack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/javascript-all","semanticVersion":"2.6.11+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.31+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"artifacts":[{"location":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}],"results":[{"ruleId":"test/query","ruleIndex":0,"rule":{"id":"test/query","index":0},"message":{"text":"Example test code file found for codeql_test_extract example query."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]}
+{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.27.1","rules":[{"id":"test/query","name":"test/query","shortDescription":{"text":"ExampleQuery1"},"fullDescription":{"text":"Example query for integration testing of the codeql_test_extract MCP server tool."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n","markdown":"# Query Help for JavaScript ExampleQuery1\n\nTODO\n"},"properties":{"tags":["mcp-integration-tests"],"description":"Example query for integration testing of the codeql_test_extract MCP server tool.","id":"test/query","kind":"problem","name":"ExampleQuery1","precision":"medium","problem.severity":"warning"}}]},"extensions":[{"name":"mcp-client-integration-tests-static-javascript-src","semanticVersion":"0.0.1+fe0e7d2a7059ebb6c6075ff8eaea04f382747656","locations":[{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/src/codeql-pack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/javascript-all","semanticVersion":"2.6.11+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/javascript-all/2.6.11/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.31+ce9c8e6e9fd41ef0967b13849bb6ae2183caf9ad","locations":[{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/.codeql/packages/codeql/threat-models/1.0.31/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]}]},"artifacts":[{"location":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}],"results":[{"ruleId":"test/query","ruleIndex":0,"rule":{"id":"test/query","index":0},"message":{"text":"Example test code file found for codeql_test_extract example query."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"file:///home/runner/work/codeql-development-mcp-server/codeql-development-mcp-server/client/integration-tests/static/javascript/test/ExampleQuery1/ExampleQuery1.js","index":0}}}]}],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest"}}]}

extensions/vscode/package.json

@@ -2,7 +2,7 @@
   "name": "vscode-codeql-development-mcp-server",
   "displayName": "CodeQL Development MCP Server",
   "description": "LLM-assisted development of CodeQL queries, libraries, and tests via #ql-mcp prompts, resources, and tools.",
-  "version": "2.27.0",
+  "version": "2.27.1",
   "publisher": "advanced-security",
   "license": "LicenseRef-CodeQL-Terms",
   "icon": "media/codeql-icon.png",

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codeql-development-mcp-server_repo",
-  "version": "2.27.0",
+  "version": "2.27.1",
   "description": "An MCP server supporting LLM requests for CodeQL development tools and resources.",
   "private": true,
   "type": "module",

package.json

@@ -203959,7 +203959,7 @@ init_package_paths();
 init_logger();
 import_dotenv.default.config({ path: resolve14(packageRootDir, ".env"), quiet: true });
 var PACKAGE_NAME = "codeql-development-mcp-server";
-var VERSION = "2.27.0";
+var VERSION = "2.27.1";
 async function startServer(mode = "stdio") {
   logger.info(`Starting CodeQL Development MCP McpServer v${VERSION} in ${mode} mode`);
   const codeqlBinary = resolveCodeQLBinary();

server/dist/codeql-development-mcp-server.js

@@ -1,6 +1,6 @@
 {
   "name": "codeql-development-mcp-server",
-  "version": "2.27.0",
+  "version": "2.27.1",
   "description": "An MCP server supporting LLM requests for CodeQL development tools and resources.",
   "main": "dist/codeql-development-mcp-server.js",
   "type": "module",

server/dist/codeql-development-mcp-server.js.map

@@ -2,31 +2,31 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/actions-all:
-    version: 0.6.1
+    version: 0.6.2
   codeql/concepts:
-    version: 0.0.31
+    version: 0.0.32
   codeql/controlflow:
-    version: 2.0.41
+    version: 2.0.42
   codeql/dataflow:
-    version: 2.1.13
+    version: 2.1.14
   codeql/javascript-all:
-    version: 2.10.1
+    version: 2.10.2
   codeql/mad:
-    version: 1.0.57
+    version: 1.0.58
   codeql/regex:
-    version: 1.0.57
+    version: 1.0.58
   codeql/ssa:
-    version: 2.0.33
+    version: 2.0.34
   codeql/threat-models:
-    version: 1.0.57
+    version: 1.0.58
   codeql/tutorial:
-    version: 1.0.57
+    version: 1.0.58
   codeql/typetracking:
-    version: 2.0.41
+    version: 2.0.42
   codeql/util:
-    version: 2.0.44
+    version: 2.0.45
   codeql/xml:
-    version: 1.0.57
+    version: 1.0.58
   codeql/yaml:
-    version: 1.0.57
+    version: 1.0.58
 compiled: false