module(

name = "ql",

version = "0.0",

repo_name = "codeql",

)

# this points to our internal repository when `codeql` is checked out as a submodule thereof

# when building things from `codeql` independently this is stubbed out in `.bazelrc`

bazel_dep(name = "semmle_code", version = "0.0")

local_path_override(

module_name = "semmle_code",

path = "..",

)

# see https://registry.bazel.build/ for a list of available packages

bazel_dep(name = "platforms", version = "1.0.0")

bazel_dep(name = "rules_cc", version = "0.2.20")

bazel_dep(name = "rules_go", version = "0.60.0")

bazel_dep(name = "rules_java", version = "9.6.1")

bazel_dep(name = "rules_pkg", version = "1.2.0")

bazel_dep(name = "rules_nodejs", version = "6.7.5")

bazel_dep(name = "rules_python", version = "1.9.0")

bazel_dep(name = "rules_shell", version = "0.7.1")

bazel_dep(name = "bazel_skylib", version = "1.9.0")

bazel_dep(name = "abseil-cpp", version = "20260107.1", repo_name = "absl")

bazel_dep(name = "nlohmann_json", version = "3.12.0.bcr.1", repo_name = "json")

bazel_dep(name = "fmt", version = "12.1.0-codeql.1")

bazel_dep(name = "rules_kotlin", version = "2.2.2-codeql.1")

bazel_dep(name = "gazelle", version = "0.50.0")

bazel_dep(name = "rules_dotnet", version = "0.21.5-codeql.1")

bazel_dep(name = "googletest", version = "1.17.0.bcr.2")

bazel_dep(name = "rules_rust", version = "0.73.0")

bazel_dep(name = "rules_swift", version = "4.0.0-rc5-codeql.2")

bazel_dep(name = "swift-syntax", version = "603.0.2")

bazel_dep(name = "zstd", version = "1.5.7.bcr.1")

bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)

# Keep edition and version approximately in sync with internal repo.

# the versions there are canonical, the versions here are used for CI in github/codeql, as well as for the vendoring of dependencies.

RUST_EDITION = "2024"

# run buildutils-internal/scripts/fill-rust-sha256s.py when updating (internal repo)

# a nightly toolchain is required to enable experimental_use_cc_common_link, which we require internally

# we prefer to run the same version as internally, even if experimental_use_cc_common_link is not really

# required in this repo

RUST_VERSION = "nightly/2026-07-15"

rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")

rust.toolchain(

edition = RUST_EDITION,

# We need those extra target triples so that we can build universal binaries on macos

extra_target_triples = [

"x86_64-apple-darwin",

"aarch64-apple-darwin",

],

# generated by buildutils-internal/scripts/fill-rust-sha256s.py (internal repo)

sha256s = {

"2026-07-15/rustc-nightly-x86_64-unknown-linux-gnu.tar.xz": "dad49ece98c6d0e5f3bfd7c532b5111f55319a0e2a880ef1a87379643348cf8e",

"2026-07-15/rustc-nightly-x86_64-apple-darwin.tar.xz": "54fe056dd41fd0ae2e74e8a941ee207af21e9b86700636fa254f11f0f1fa0783",

"2026-07-15/rustc-nightly-aarch64-apple-darwin.tar.xz": "0e8c44436fefd06850a343e244236bf8e2b7eadaee447c53a91bc4e17e6710d1",

"2026-07-15/rustc-nightly-x86_64-pc-windows-msvc.tar.xz": "a55c3933faf617a47a10545a072bae1de03aa3fe7363d0779baad35bed2cf259",

"2026-07-15/clippy-nightly-x86_64-unknown-linux-gnu.tar.xz": "49425e37f45e428b569098174a28985aae3102965dfa7434ca8472d1b3e58b5e",

"2026-07-15/clippy-nightly-x86_64-apple-darwin.tar.xz": "2b1ca2938c8d3d35f9c26badd696d575db876260569900684c766cf8319960a7",

"2026-07-15/clippy-nightly-aarch64-apple-darwin.tar.xz": "7c95556525376e0250dcdfb9c36725e8c0c131c1c6ac3b7e5872279e040852fb",

"2026-07-15/clippy-nightly-x86_64-pc-windows-msvc.tar.xz": "e737590737fdf81e08af55c7cbc3e7f4883d5f68cbec4bd572ccb7af44fc15d8",

"2026-07-15/cargo-nightly-x86_64-unknown-linux-gnu.tar.xz": "4df5b9f2ad9b597d272fa9500d650561f22c8543233485078a13a64693e567c3",

"2026-07-15/cargo-nightly-x86_64-apple-darwin.tar.xz": "e45a0ab75df0e61a3429ab450e35551ca920b138be39dc5cf8af824dd36fcb15",

"2026-07-15/cargo-nightly-aarch64-apple-darwin.tar.xz": "81e1469252cd4630fdf221f9390cdb4604472c0ef6774e6162370864e5adc3e0",

"2026-07-15/cargo-nightly-x86_64-pc-windows-msvc.tar.xz": "077cf2ad9811cba2596faab7b5763f8430791263ab7f3961fa31f23aaa3d741d",

"2026-07-15/llvm-tools-nightly-x86_64-unknown-linux-gnu.tar.xz": "25823477ba51d4aba12beb19cb7d2c46d453357a4b6d1c301102fc06d0c5db28",

"2026-07-15/llvm-tools-nightly-x86_64-apple-darwin.tar.xz": "168f79a128b34c88a8cef03af0ced8986a99c52df4016e5d111cba3c4638e4e3",

"2026-07-15/llvm-tools-nightly-aarch64-apple-darwin.tar.xz": "f95a27de3a30e6ba3d36548663b434e625cd1bbbfb015eadd90f67d80f657c5a",

"2026-07-15/llvm-tools-nightly-x86_64-pc-windows-msvc.tar.xz": "1d48b7b8f511a23f270e9380f729ee414db918abbc88535fe419dd53aa0d5429",

"2026-07-15/rust-std-nightly-x86_64-unknown-linux-gnu.tar.xz": "4c1a2f508b6791a1059924e6369d813b46888215add0a5906af95266b33219b2",

"2026-07-15/rust-std-nightly-x86_64-apple-darwin.tar.xz": "a2438da77f7eb292f80a5cab3de1aa2e8deb718b89c0ba6e26ef5c76299cc048",

"2026-07-15/rust-std-nightly-aarch64-apple-darwin.tar.xz": "02c36fc7728dc17376062e7a0f3bf26439e1317317971ba9339b3a3a34dee2fa",

"2026-07-15/rust-std-nightly-x86_64-pc-windows-msvc.tar.xz": "5e724d34d34ec4ed34161bb890452640ddda11fd9ef64f6a74e47541d5b02583",

},

versions = [RUST_VERSION],

)

use_repo(rust, "rust_toolchains")

register_toolchains("@rust_toolchains//:all")

# deps for python extractor

# keep in sync by running `misc/bazel/3rdparty/update_cargo_deps.sh`

py_deps = use_extension("//misc/bazel/3rdparty:py_deps_extension.bzl", "p")

use_repo(

py_deps,

"vendor_py",

"vendor_py__anyhow-1.0.95",

"vendor_py__cc-1.2.14",

"vendor_py__clap-4.5.30",

"vendor_py__regex-1.11.1",

"vendor_py__tree-sitter-0.24.7",

"vendor_py__tree-sitter-graph-0.12.0",

)

# deps for ruby+rust

# keep in sync by running `misc/bazel/3rdparty/update_cargo_deps.sh`

tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")

use_repo(

tree_sitter_extractors_deps,

"vendor_ts",

"vendor_ts__anyhow-1.0.104",

"vendor_ts__argfile-1.0.0",

"vendor_ts__chalk-ir-0.104.0",

"vendor_ts__chrono-0.4.45",

"vendor_ts__clap-4.6.6",

"vendor_ts__dunce-1.0.5",

"vendor_ts__either-1.17.0",

"vendor_ts__encoding-0.2.33",

"vendor_ts__figment-0.10.19",

"vendor_ts__flate2-1.1.9",

"vendor_ts__glob-0.3.4",

"vendor_ts__globset-0.4.18",

"vendor_ts__itertools-0.15.0",

"vendor_ts__lazy_static-1.5.0",

"vendor_ts__mustache-0.9.0",

"vendor_ts__num-traits-0.2.19",

"vendor_ts__num_cpus-1.17.0",

"vendor_ts__proc-macro2-1.0.107",

"vendor_ts__quote-1.0.47",

"vendor_ts__ra_ap_base_db-0.0.347",

"vendor_ts__ra_ap_cfg-0.0.347",

"vendor_ts__ra_ap_hir-0.0.347",

"vendor_ts__ra_ap_hir_def-0.0.347",

"vendor_ts__ra_ap_hir_expand-0.0.347",

"vendor_ts__ra_ap_hir_ty-0.0.347",

"vendor_ts__ra_ap_ide_db-0.0.347",

"vendor_ts__ra_ap_intern-0.0.347",

"vendor_ts__ra_ap_load-cargo-0.0.347",

"vendor_ts__ra_ap_parser-0.0.347",

"vendor_ts__ra_ap_paths-0.0.347",

"vendor_ts__ra_ap_project_model-0.0.347",

"vendor_ts__ra_ap_span-0.0.347",

"vendor_ts__ra_ap_stdx-0.0.347",

"vendor_ts__ra_ap_syntax-0.0.347",

"vendor_ts__ra_ap_syntax-bridge-0.0.347",

"vendor_ts__ra_ap_toolchain-0.0.347",

"vendor_ts__ra_ap_vfs-0.0.347",

"vendor_ts__rand-0.10.2",

"vendor_ts__rayon-1.12.0",

"vendor_ts__regex-1.13.1",

"vendor_ts__serde-1.0.229",

"vendor_ts__serde_json-1.0.151",

"vendor_ts__serde_with-3.22.0",

"vendor_ts__serde_yaml-0.9.34-deprecated",

"vendor_ts__syn-3.0.3",

"vendor_ts__toml-1.1.4-spec-1.1.0",

"vendor_ts__tracing-0.1.44",

"vendor_ts__tracing-flame-0.2.0",

"vendor_ts__tracing-subscriber-0.3.23",

"vendor_ts__tree-sitter-0.26.9",

"vendor_ts__tree-sitter-embedded-template-0.25.0",

"vendor_ts__tree-sitter-json-0.24.8",

"vendor_ts__tree-sitter-python-0.25.0",

"vendor_ts__tree-sitter-ql-0.23.1",

"vendor_ts__tree-sitter-ruby-0.23.1",

"vendor_ts__triomphe-0.1.16",

"vendor_ts__ungrammar-1.16.1",

"vendor_ts__zstd-0.13.3",

)

http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

# rust-analyzer sources needed by the rust ast-generator (see `rust/ast-generator/README.md`)

RUST_ANALYZER_SRC_TAG = "2026-04-13"

http_archive(

name = "rust-analyzer-src",

build_file = "//rust/ast-generator:BUILD.rust-analyzer-src.bazel",

integrity = "sha256-UB/+EVx/6j4VGvnb7jfRqPaoc7Uwci3rEt6il+2J1Ds=",

patch_args = ["-p1"],

patches = [

"//rust/ast-generator:patches/rust-analyzer.patch",

],

strip_prefix = "rust-analyzer-%s" % RUST_ANALYZER_SRC_TAG,

url = "https://github.com/rust-lang/rust-analyzer/archive/refs/tags/%s.tar.gz" % RUST_ANALYZER_SRC_TAG,

)

dotnet = use_extension("@rules_dotnet//dotnet:extensions.bzl", "dotnet")

dotnet.toolchain(dotnet_version = "10.0.100")

use_repo(dotnet, "dotnet_toolchains")

register_toolchains("@dotnet_toolchains//:all")

csharp_main_extension = use_extension("//csharp:paket.main_extension.bzl", "main_extension")

use_repo(csharp_main_extension, "paket.main")

pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")

pip.parse(

hub_name = "codegen_deps",

python_version = "3.12",

requirements_lock = "//misc/codegen:requirements_lock.txt",

)

use_repo(pip, "codegen_deps")

python = use_extension("@rules_python//python/extensions:python.bzl", "python")

python.toolchain(

is_default = True,

python_version = "3.12",

)

use_repo(python, "python_3_12", "python_versions")

register_toolchains("@python_versions//3.12:all")

swift_deps = use_extension("//swift/third_party:load.bzl", "swift_deps")

# following list can be kept in sync with `bazel mod tidy`

use_repo(

swift_deps,

"binlog",

"picosha2",

"swift-prebuilt-linux",

"swift-prebuilt-linux-download-only",

"swift-prebuilt-macos",

"swift-prebuilt-macos-download-only",

"swift-resource-dir-linux",

"swift-resource-dir-macos",

)

# Hermetic swift.org toolchain for building `unified/swift-syntax-rs`.

#

# The version is pinned as a literal rather than read from

# `unified/swift-syntax-rs/.swift-version` via `swift_version_file`: the latter

# makes the extension `module_ctx.read` a `//unified/...` label, which fails to

# resolve when this repo is consumed as a dependency module (`@@ql+`) whose

# `unified/swift-syntax-rs` package is not loadable in that context. Keep this

# in sync with `unified/swift-syntax-rs/.swift-version` (used by the `cargo`

# build) and the `swift-syntax` release in `swift/Package.swift`.

swift = use_extension("@rules_swift//swift:extensions.bzl", "swift", dev_dependency = True)

swift.toolchain(

name = "swift_toolchain",

swift_version = "6.3.3",

)

use_repo(

swift,

"swift_toolchain",

"swift_toolchain_ubuntu22.04",

"swift_toolchain_ubuntu22.04-aarch64",

"swift_toolchain_xcode",

)

register_toolchains(

"@swift_toolchain//:swift_toolchain_exec_ubuntu22.04",

"@swift_toolchain//:swift_toolchain_exec_ubuntu22.04-aarch64",

"@swift_toolchain//:swift_toolchain_exec_xcode",

dev_dependency = True,

)

node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")

node.toolchain(

name = "nodejs",

node_urls = [

"https://nodejs.org/dist/v{version}/{filename}",

"https://mirrors.dotsrc.org/nodejs/release/v{version}/{filename}",

],

node_version = "18.15.0",

)

use_repo(node, "nodejs", "nodejs_toolchains")

kotlin_extractor_deps = use_extension("//java/kotlin-extractor:deps.bzl", "kotlin_extractor_deps")

# following list can be kept in sync by running `bazel mod tidy` in `codeql`

use_repo(

kotlin_extractor_deps,

"codeql_kotlin_defaults",

"codeql_kotlin_embeddable",

"kotlin-compiler-1.8.0",

"kotlin-compiler-1.9.0-Beta",

"kotlin-compiler-1.9.20-Beta",

"kotlin-compiler-2.0.0-RC1",

"kotlin-compiler-2.0.20-Beta2",

"kotlin-compiler-2.1.0-Beta1",

"kotlin-compiler-2.1.20-Beta1",

"kotlin-compiler-2.2.0-Beta1",

"kotlin-compiler-2.2.20-Beta2",

"kotlin-compiler-2.3.0",

"kotlin-compiler-2.3.20",

"kotlin-compiler-2.4.0",

"kotlin-compiler-2.4.20",

"kotlin-compiler-embeddable-1.8.0",

"kotlin-compiler-embeddable-1.9.0-Beta",

"kotlin-compiler-embeddable-1.9.20-Beta",

"kotlin-compiler-embeddable-2.0.0-RC1",

"kotlin-compiler-embeddable-2.0.20-Beta2",

"kotlin-compiler-embeddable-2.1.0-Beta1",

"kotlin-compiler-embeddable-2.1.20-Beta1",

"kotlin-compiler-embeddable-2.2.0-Beta1",

"kotlin-compiler-embeddable-2.2.20-Beta2",

"kotlin-compiler-embeddable-2.3.0",

"kotlin-compiler-embeddable-2.3.20",

"kotlin-compiler-embeddable-2.4.0",

"kotlin-compiler-embeddable-2.4.20",

"kotlin-stdlib-1.8.0",

"kotlin-stdlib-1.9.0-Beta",

"kotlin-stdlib-1.9.20-Beta",

"kotlin-stdlib-2.0.0-RC1",

"kotlin-stdlib-2.0.20-Beta2",

"kotlin-stdlib-2.1.0-Beta1",

"kotlin-stdlib-2.1.20-Beta1",

"kotlin-stdlib-2.2.0-Beta1",

"kotlin-stdlib-2.2.20-Beta2",

"kotlin-stdlib-2.3.0",

"kotlin-stdlib-2.3.20",

"kotlin-stdlib-2.4.0",

"kotlin-stdlib-2.4.20",

)

go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")

go_sdk.download(version = "1.27.1")

go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")

go_deps.from_file(go_mod = "//go/extractor:go.mod")

use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_sys", "org_golang_x_tools")

ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archive")

# go to https://github.com/GoogleChrome/ripunzip/releases to find latest version and corresponding sha256s

ripunzip_archive(

name = "ripunzip",

sha256_linux_arm64 = "a282740ef376ff8dc0de3c589b7457598db15cc045b7daa688f15531612e0bbe",

sha256_linux_x64 = "71482d7a7e4ea9176d5596161c49250c34b136b157c45f632b1111323fbfc0de",

sha256_macos_arm64 = "604194ab13f0aba3972995d995f11002b8fc285c8170401fcd46655065df20c9",

sha256_macos_x64 = "65367b94fd579d93d46f2d2595cc4c9a60cfcf497e3c824f9d1a7b80fa8bd38a",

sha256_windows_x64 = "ac3874075def2b9e5074a3b5945005ab082cc6e689e1de658da8965bc23e643e",

version = "2.0.4",

)

register_toolchains(

"@nodejs_toolchains//:all",

)