Fix missing pack dependency upgrades

Author: data-douser

javascript/frameworks/cap/src/qlpack.yml

@@ -6,5 +6,5 @@ suites: codeql-suites
 extractor: javascript
 dependencies:
   codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-cap-all: "2.25.0"
+  advanced-security/javascript-sap-cap-all: "2.25.1"
 default-suite-file: codeql-suites/javascript-code-scanning.qls

javascript/frameworks/cap/test/qlpack.yml

@@ -4,6 +4,6 @@ version: 2.25.1
 extractor: javascript
 dependencies:
   codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-cap-queries: "2.25.0"
-  advanced-security/javascript-sap-cap-models: "2.25.0"
-  advanced-security/javascript-sap-cap-all: "2.25.0"
+  advanced-security/javascript-sap-cap-queries: "2.25.1"
+  advanced-security/javascript-sap-cap-models: "2.25.1"
+  advanced-security/javascript-sap-cap-all: "2.25.1"

javascript/frameworks/ui5-webcomponents/test/qlpack.yml

@@ -3,4 +3,4 @@ version: 2.25.1
 extractor: javascript
 dependencies:
   codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-ui5-all: "2.25.0"
+  advanced-security/javascript-sap-ui5-all: "2.25.1"

javascript/frameworks/ui5/src/qlpack.yml

@@ -6,5 +6,5 @@ suites: codeql-suites
 extractor: javascript
 dependencies:
   codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-ui5-all: "2.25.0"
+  advanced-security/javascript-sap-ui5-all: "2.25.1"
 default-suite-file: codeql-suites/javascript-code-scanning.qls

javascript/frameworks/ui5/test/qlpack.yml

@@ -7,6 +7,6 @@ dependencies:
   # no overlap occurs with the SAP UI5 queries. We therefore allow any version
   # greater than or equal to 1.2.0, as major breaking changes are not a concern.
   codeql/javascript-queries: ">1.2.0"
-  advanced-security/javascript-sap-ui5-queries: "2.25.0"
-  advanced-security/javascript-sap-ui5-models: "2.25.0"
-  advanced-security/javascript-sap-ui5-all: "2.25.0"
+  advanced-security/javascript-sap-ui5-queries: "2.25.1"
+  advanced-security/javascript-sap-ui5-models: "2.25.1"
+  advanced-security/javascript-sap-ui5-all: "2.25.1"

javascript/frameworks/xsjs/src/qlpack.yml

@@ -6,5 +6,5 @@ suites: codeql-suites
 extractor: javascript
 dependencies:
   codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-xsjs-all: "2.25.0"
+  advanced-security/javascript-sap-xsjs-all: "2.25.1"
 default-suite-file: codeql-suites/javascript-code-scanning.qls

javascript/frameworks/xsjs/test/qlpack.yml

@@ -4,6 +4,6 @@ version: 2.25.1
 extractor: javascript
 dependencies:
   codeql/javascript-all: "^2.6.24"
-  advanced-security/javascript-sap-xsjs-queries: "2.25.0"
-  advanced-security/javascript-sap-xsjs-all: "2.25.0"
-  advanced-security/javascript-sap-xsjs-models: "2.25.0"
+  advanced-security/javascript-sap-xsjs-queries: "2.25.1"
+  advanced-security/javascript-sap-xsjs-all: "2.25.1"
+  advanced-security/javascript-sap-xsjs-models: "2.25.1"

javascript/heuristic-models/tests/qlpack.yml

@@ -5,4 +5,4 @@ version: 2.25.1
 extractor: javascript
 dependencies:
   "codeql/javascript-all": "^2.6.24"
-  "advanced-security/javascript-heuristic-models": "2.25.0"
+  "advanced-security/javascript-heuristic-models": "2.25.1"

scripts/install-packs.sh

@@ -92,7 +92,8 @@ install_framework() {
   echo "Installing packs for: ${framework_path}"
 
   # Find all qlpack.yml files under this framework and install their packs
-  find "${REPO_ROOT}/${framework_path}" -name "qlpack.yml" -type f | sort | while read -r qlpack_file; do
+  # Exclude .codeql cache directories which contain cached pack dependencies
+  find "${REPO_ROOT}/${framework_path}" -name "qlpack.yml" -not -path "*/.codeql/*" -type f | sort | while read -r qlpack_file; do
     local pack_dir
     pack_dir=$(dirname "${qlpack_file}")
     # Use relative path for cleaner output

scripts/update-release-version.sh

@@ -258,9 +258,10 @@ update_qlt_config() {
 }
 
 ## Update internal dependency references in a qlpack.yml file
-## e.g., advanced-security/javascript-sap-cap-models: "^2.3.0" -> "^2.4.0"
-## e.g., advanced-security/javascript-sap-cap-models: "^2.3.0" -> "^2.4.0-alpha"
-## and   advanced-security/javascript-heuristic-models: 2.3.0 -> 2.4.0
+## Handles three observed formats:
+##   pack_name: "X.Y.Z"         (unquoted key, quoted value — most common)
+##   "pack_name": "X.Y.Z"       (quoted key and value — heuristic-models)
+##   pack_name: X.Y.Z            (unquoted key and value — rare/legacy)
 update_internal_deps() {
   local file="$1"
   local old_version="$2"
@@ -271,10 +272,13 @@ update_internal_deps() {
   escaped_old_version=$(printf '%s' "${old_version}" | sed 's/\./\\./g')
 
   for pack_name in "${INTERNAL_PACKS[@]}"; do
-    # Update quoted caret-prefixed versions: "^X.Y.Z"
-    sed -i.bak "s|${pack_name}: \"\\^${escaped_old_version}\"|${pack_name}: \"^${new_version}\"|g" "${file}"
+    # Update quoted exact versions: pack_name: "X.Y.Z"
+    sed -i.bak "s|${pack_name}: \"${escaped_old_version}\"|${pack_name}: \"${new_version}\"|g" "${file}"
     rm -f "${file}.bak"
-    # Update unquoted exact versions: X.Y.Z
+    # Update quoted key + quoted value: "pack_name": "X.Y.Z"
+    sed -i.bak "s|\"${pack_name}\": \"${escaped_old_version}\"|\"${pack_name}\": \"${new_version}\"|g" "${file}"
+    rm -f "${file}.bak"
+    # Update unquoted exact versions: pack_name: X.Y.Z
     sed -i.bak "s|${pack_name}: ${escaped_old_version}$|${pack_name}: ${new_version}|g" "${file}"
     rm -f "${file}.bak"
   done