All: delete outdated deprecations

cpp/ql/lib/change-notes/2025-01-27-outdated-deprecations.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* Deleted the deprecated `getAllocatorCall` predicate from `DeleteOrDeleteArrayExpr`, use `getDeallocatorCall` instead.

cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll

@@ -1110,11 +1110,6 @@ class DeleteOrDeleteArrayExpr extends Expr, TDeleteOrDeleteArrayExpr {
     expr_deallocator(underlyingElement(this), unresolveElement(result), _)
   }
 
-  /**
-   * DEPRECATED: use `getDeallocatorCall` instead.
-   */
-  deprecated FunctionCall getAllocatorCall() { result = this.getChild(0) }
-
   /**
    * Gets the call to a non-default `operator delete`/`delete[]` that deallocates storage, if any.
    *

csharp/ql/lib/change-notes/2025-01-27-outdated-deprecations.md

@@ -0,0 +1,5 @@
+---
+category: breaking
+---
+* Deleted the deprecated `getInstanceType` predicate from the `UnboundGenericType` class.
+* Deleted the deprecated `getElement` predicate from the `Node` class in `ControlFlowGraph.qll`, use `getAstNode` instead.

csharp/ql/lib/semmle/code/csharp/Generics.qll

@@ -143,18 +143,6 @@ class UnboundGenericType extends ValueOrRefType, UnboundGeneric {
     result = UnboundGeneric.super.getAConstructedGeneric()
   }
 
-  /**
-   * DEPRECATED: predicate does not contain any tuples.
-   *
-   * Gets the instance type of this type. For an unbound generic type, the instance type
-   * is a constructed type created from the unbound type, with each of the supplied type
-   * arguments being the corresponding type parameter.
-   */
-  deprecated ConstructedType getInstanceType() {
-    result = this.getAConstructedGeneric() and
-    forall(TypeParameter tp, int i | tp = this.getTypeParameter(i) | tp = result.getTypeArgument(i))
-  }
-
   override Location getALocation() { type_location(this, result) }
 
   override UnboundGenericType getUnboundDeclaration() {
@@ -312,10 +300,6 @@ class TypeParameterConstraints extends Element, @type_parameter_constraints {
  * ```
  */
 class UnboundGenericStruct extends Struct, UnboundGenericType {
-  deprecated override ConstructedStruct getInstanceType() {
-    result = UnboundGenericType.super.getInstanceType()
-  }
-
   override ConstructedStruct getAConstructedGeneric() {
     result = UnboundGenericType.super.getAConstructedGeneric()
   }
@@ -335,10 +319,6 @@ class UnboundGenericStruct extends Struct, UnboundGenericType {
  * ```
  */
 class UnboundGenericClass extends Class, UnboundGenericType {
-  deprecated override ConstructedClass getInstanceType() {
-    result = UnboundGenericType.super.getInstanceType()
-  }
-
   override ConstructedClass getAConstructedGeneric() {
     result = UnboundGenericType.super.getAConstructedGeneric()
   }
@@ -358,10 +338,6 @@ class UnboundGenericClass extends Class, UnboundGenericType {
  * ```
  */
 class UnboundGenericInterface extends Interface, UnboundGenericType {
-  deprecated override ConstructedInterface getInstanceType() {
-    result = UnboundGenericType.super.getInstanceType()
-  }
-
   override ConstructedInterface getAConstructedGeneric() {
     result = UnboundGenericType.super.getAConstructedGeneric()
   }
@@ -382,10 +358,6 @@ class UnboundGenericInterface extends Interface, UnboundGenericType {
  * ```
  */
 class UnboundGenericDelegateType extends DelegateType, UnboundGenericType {
-  deprecated override ConstructedDelegateType getInstanceType() {
-    result = UnboundGenericType.super.getInstanceType()
-  }
-
   override ConstructedDelegateType getAConstructedGeneric() {
     result = UnboundGenericType.super.getAConstructedGeneric()
   }

csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowGraph.qll

@@ -29,13 +29,6 @@ module ControlFlow {
     /** Gets the control flow element that this node corresponds to, if any. */
     final ControlFlowElement getAstNode() { result = super.getAstNode() }
 
-    /**
-     * DEPRECATED: Use `getAstNode` instead.
-     *
-     * Gets the control flow element that this node corresponds to, if any.
-     */
-    deprecated ControlFlowElement getElement() { result = this.getAstNode() }
-
     /** Gets the basic block that this control flow node belongs to. */
     BasicBlock getBasicBlock() { result.getANode() = this }
 

go/ql/lib/change-notes/2025-01-27-outdated-deprecations.md

@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+* Deleted the deprecated `describeBitSize` predicate from `IncorrectIntegerConversionLib.qll`

go/ql/lib/semmle/go/security/IncorrectIntegerConversionLib.qll

@@ -448,20 +448,6 @@ private module ConversionWithoutBoundsCheckConfig implements DataFlow::StateConf
  */
 module Flow = DataFlow::GlobalWithState<ConversionWithoutBoundsCheckConfig>;
 
-/** Gets a string describing the size of the integer parsed. */
-deprecated string describeBitSize(int bitSize, int intTypeBitSize) {
-  intTypeBitSize in [0, 32, 64] and
-  if bitSize != 0
-  then bitSize in [8, 16, 32, 64] and result = "a " + bitSize + "-bit integer"
-  else
-    if intTypeBitSize = 0
-    then result = "an integer with architecture-dependent bit size"
-    else
-      result =
-        "a number with architecture-dependent bit-width, which is constrained to be " +
-          intTypeBitSize + "-bit by build constraints,"
-}
-
 /** Gets a string describing the size of the integer parsed. */
 string describeBitSize2(DataFlow::Node source) {
   exists(int sourceBitSize, int intTypeBitSize, boolean isSigned, string signedString |

java/ql/lib/change-notes/2025-01-27-outdated-deprecations.md

@@ -0,0 +1,11 @@
+---
+category: breaking
+---
+* Deleted the deprecated `isLValue` and `isRValue` predicates from the `VarAccess` class, use `isVarWrite` and `isVarRead` respectively instead.
+* Deleted the deprecated `getRhs` predicate from the `VarWrite` class, use `getASource` instead.
+* Deleted the deprecated `LValue` and `RValue` classes, use `VarWrite` and `VarRead` respectively instead.
+* Deleted a lot of deprecated classes ending in "*Access", use the corresponding "*Call" classes instead.
+* Deleted a lot of deprecated predicates ending in "*Access", use the corresponding "*Call" predicates instead.
+* Deleted the deprecated `EnvInput` and `DatabaseInput` classes from `FlowSources.qll`, use the threat models feature instead.
+* Deleted some deprecated API predicates from `SensitiveApi.qll`, use the Sink classes from that file instead.
+

java/ql/lib/semmle/code/java/Expr.qll

@@ -1924,9 +1924,6 @@ class VarAccess extends Expr, @varaccess {
     exists(UnaryAssignExpr e | e.getExpr() = this)
   }
 
-  /** DEPRECATED: Alias for `isVarWrite`. */
-  deprecated predicate isLValue() { this.isVarWrite() }
-
   /**
    * Holds if this variable access is a read access.
    *
@@ -1936,9 +1933,6 @@ class VarAccess extends Expr, @varaccess {
    */
   predicate isVarRead() { not exists(AssignExpr a | a.getDest() = this) }
 
-  /** DEPRECATED: Alias for `isVarRead`. */
-  deprecated predicate isRValue() { this.isVarRead() }
-
   /** Gets a printable representation of this expression. */
   override string toString() {
     exists(Expr q | q = this.getQualifier() |
@@ -2002,14 +1996,8 @@ class VarWrite extends VarAccess {
    * are source expressions of the assignment.
    */
   Expr getASource() { exists(Assignment e | e.getDest() = this and e.getSource() = result) }
-
-  /** DEPRECATED: (Inaccurately-named) alias for `getASource` */
-  deprecated Expr getRhs() { result = this.getASource() }
 }
 
-/** DEPRECATED: Alias for `VarWrite`. */
-deprecated class LValue = VarWrite;
-
 /**
  * A read access to a variable.
  *
@@ -2021,9 +2009,6 @@ class VarRead extends VarAccess {
   VarRead() { this.isVarRead() }
 }
 
-/** DEPRECATED: Alias for `VarRead`. */
-deprecated class RValue = VarRead;
-
 /** A method call is an invocation of a method with a list of arguments. */
 class MethodCall extends Expr, Call, @methodaccess {
   /** Gets the qualifying expression of this method access, if any. */
@@ -2082,25 +2067,16 @@ class MethodCall extends Expr, Call, @methodaccess {
    */
   predicate isOwnMethodCall() { Qualifier::ownMemberAccess(this) }
 
-  /** DEPRECATED: Alias for `isOwnMethodCall`. */
-  deprecated predicate isOwnMethodAccess() { this.isOwnMethodCall() }
-
   /**
    * Holds if this is a method call to an instance method of the enclosing
    * class `t`. That is, the qualifier is either an explicit or implicit
    * `t`-qualified `this` or `super`.
    */
   predicate isEnclosingMethodCall(RefType t) { Qualifier::enclosingMemberAccess(this, t) }
 
-  /** DEPRECATED: Alias for `isEnclosingMethodCall`. */
-  deprecated predicate isEnclosingMethodAccess(RefType t) { this.isEnclosingMethodCall(t) }
-
   override string getAPrimaryQlClass() { result = "MethodCall" }
 }
 
-/** DEPRECATED: Alias for `MethodCall`. */
-deprecated class MethodAccess = MethodCall;
-
 /** A type access is a (possibly qualified) reference to a type. */
 class TypeAccess extends Expr, Annotatable, @typeaccess {
   /** Gets the qualifier of this type access, if any. */
@@ -2275,25 +2251,16 @@ class VirtualMethodCall extends MethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `VirtualMethodCall`. */
-deprecated class VirtualMethodAccess = VirtualMethodCall;
-
 /** A static method call. */
 class StaticMethodCall extends MethodCall {
   StaticMethodCall() { this.getMethod().isStatic() }
 }
 
-/** DEPRECATED: Alias for `StaticMethodCall`. */
-deprecated class StaticMethodAccess = StaticMethodCall;
-
 /** A call to a method in the superclass. */
 class SuperMethodCall extends MethodCall {
   SuperMethodCall() { this.getQualifier() instanceof SuperAccess }
 }
 
-/** DEPRECATED: Alias for `SuperMethodCall`. */
-deprecated class SuperMethodAccess = SuperMethodCall;
-
 /**
  * A constructor call, which occurs either as a constructor invocation inside a
  * constructor, or as part of a class instance expression.

java/ql/lib/semmle/code/java/JDK.qll

@@ -250,9 +250,6 @@ class MethodCallSystemGetProperty extends MethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `MethodCallSystemGetProperty`. */
-deprecated class MethodAccessSystemGetProperty = MethodCallSystemGetProperty;
-
 /**
  * Any method named `exit` on class `java.lang.Runtime` or `java.lang.System`.
  */

java/ql/lib/semmle/code/java/Reflection.qll

@@ -83,9 +83,6 @@ class ReflectiveClassIdentifierMethodCall extends ReflectiveClassIdentifier, Met
   }
 }
 
-/** DEPRECATED: Alias for `ReflectiveClassIdentifierMethodCall`. */
-deprecated class ReflectiveClassIdentifierMethodAccess = ReflectiveClassIdentifierMethodCall;
-
 /**
  * Gets a `ReflectiveClassIdentifier` that we believe may represent the value of `expr`.
  */
@@ -320,9 +317,6 @@ class ClassMethodCall extends MethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `ClassMethodCall`. */
-deprecated class ClassMethodAccess = ClassMethodCall;
-
 /**
  * A call to `Class.getConstructors(..)` or `Class.getDeclaredConstructors(..)`.
  */
@@ -333,9 +327,6 @@ class ReflectiveGetConstructorsCall extends ClassMethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `ReflectiveGetConstructorsCall`. */
-deprecated class ReflectiveConstructorsAccess = ReflectiveGetConstructorsCall;
-
 /**
  * A call to `Class.getMethods(..)` or `Class.getDeclaredMethods(..)`.
  */
@@ -346,9 +337,6 @@ class ReflectiveGetMethodsCall extends ClassMethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `ReflectiveGetMethodsCall`. */
-deprecated class ReflectiveMethodsAccess = ReflectiveGetMethodsCall;
-
 /**
  * A call to `Class.getMethod(..)` or `Class.getDeclaredMethod(..)`.
  */
@@ -378,9 +366,6 @@ class ReflectiveGetMethodCall extends ClassMethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `ReflectiveGetMethodCall`. */
-deprecated class ReflectiveMethodAccess = ReflectiveGetMethodCall;
-
 /**
  * A call to `Class.getAnnotation(..)`.
  */
@@ -395,9 +380,6 @@ class ReflectiveGetAnnotationCall extends ClassMethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `ReflectiveGetAnnotationCall`. */
-deprecated class ReflectiveAnnotationAccess = ReflectiveGetAnnotationCall;
-
 /**
  * A call to `Class.getField(..)` that accesses a field.
  */
@@ -423,6 +405,3 @@ class ReflectiveGetFieldCall extends ClassMethodCall {
     result.hasName(this.getArgument(0).(StringLiteral).getValue())
   }
 }
-
-/** DEPRECATED: Alias for `ReflectiveGetFieldCall`. */
-deprecated class ReflectiveFieldAccess = ReflectiveGetFieldCall;

java/ql/lib/semmle/code/java/dataflow/FlowSources.qll

@@ -200,25 +200,6 @@ abstract class LocalUserInput extends UserInput {
   override string getThreatModel() { result = "local" }
 }
 
-/**
- * DEPRECATED: Use the threat models feature.
- * That is, use `ActiveThreatModelSource` as the class of nodes for sources
- * and set up the threat model configuration to filter source nodes.
- * Alternatively, use `getThreatModel` to filter nodes to create the
- * class of nodes you need.
- *
- * A node with input from the local environment, such as files, standard in,
- * environment variables, and main method parameters.
- */
-deprecated class EnvInput extends DataFlow::Node {
-  EnvInput() {
-    this instanceof EnvironmentInput or
-    this instanceof CliInput or
-    this instanceof FileInput or
-    this instanceof StdinInput
-  }
-}
-
 /**
  * A node with input from the local environment, such as
  * environment variables.
@@ -271,17 +252,6 @@ private class FileInput extends LocalUserInput {
   override string getThreatModel() { result = "file" }
 }
 
-/**
- * DEPRECATED: Use the threat models feature.
- * That is, use `ActiveThreatModelSource` as the class of nodes for sources
- * and set up the threat model configuration to filter source nodes.
- * Alternatively, use `getThreatModel` to filter nodes to create the
- * class of nodes you need.
- *
- * A node with input from a database.
- */
-deprecated class DatabaseInput = DbInput;
-
 /**
  * A node with input from a database.
  */

java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll

@@ -484,9 +484,6 @@ class ObjectOutputStreamVar extends LocalVariableDecl {
     result.getQualifier() = this.getAnAccess() and
     result.getMethod().hasName("writeObject")
   }
-
-  /** DEPRECATED: Alias for `getAWriteObjectMethodCall`. */
-  deprecated MethodCall getAWriteObjectMethodAccess() { result = this.getAWriteObjectMethodCall() }
 }
 
 /** Flow through string formatting. */

java/ql/lib/semmle/code/java/deadcode/EntryPoints.qll

@@ -168,9 +168,6 @@ class ReflectiveGetMethodCallEntryPoint extends EntryPoint, ReflectiveGetMethodC
   }
 }
 
-/** DEPRECATED: Alias for `ReflectiveGetMethodCallEntryPoint`. */
-deprecated class ReflectiveMethodAccessEntryPoint = ReflectiveGetMethodCallEntryPoint;
-
 /**
  * Classes that are entry points recognised by annotations.
  */

java/ql/lib/semmle/code/java/frameworks/Mockito.qll

@@ -25,9 +25,6 @@ class MockitoVerifiedMethodCall extends MethodCall {
   }
 }
 
-/** DEPRECATED: Alias for `MockitoVerifiedMethodCall`. */
-deprecated class MockitoVerifiedMethodAccess = MockitoVerifiedMethodCall;
-
 /**
  * A type that can be mocked by Mockito.
  */

java/ql/lib/semmle/code/java/security/CleartextStorageAndroidDatabaseQuery.qll

@@ -45,9 +45,6 @@ class LocalDatabaseOpenMethodCall extends Storable, Call {
   }
 }
 
-/** DEPRECATED: Alias for `LocalDatabaseOpenMethodCall`. */
-deprecated class LocalDatabaseOpenMethodAccess = LocalDatabaseOpenMethodCall;
-
 /** A method that is both a database input and a database store. */
 private class LocalDatabaseInputStoreMethod extends Method {
   LocalDatabaseInputStoreMethod() {