* Improved modeling of data flow through destructuring assignments may give additional results for the security queries and other queries that rely on data flow.

* Improved modeling of global variables may give more true-positive results and fewer false-positive results for a variety of queries.

* Improved modeling of re-export declarations may result in fewer false-positive results for a variety of queries.

* Improved modeling of taint flow through array operations may give additional results for the security queries.

* Additional heuristics have been added to `semmle.javascript.heuristics`. Add `import semmle.javascript.heuristics.all` to a query in order to activate all of the heuristics at once.

* Handling of ambient TypeScript code has been improved. As a result, fewer false-positive results will be reported in `.d.ts` files.

[axios](https://github.com/axios/axios),

[bluebird](https://bluebirdjs.com),

[browserid-crypto](https://github.com/mozilla/browserid-crypto),

[compose-function](https://github.com/stoeffel/compose-function),

[cookie-parser](https://github.com/expressjs/cookie-parser),

[cookie-session](https://github.com/expressjs/cookie-session),

[cross-fetch](https://github.com/lquixada/cross-fetch),

[crypto-js](https://github.com/https://github.com/brix/crypto-js),

[deep-assign](https://github.com/sindresorhus/deep-assign),

[deep-extend](https://github.com/unclechu/node-deep-extend),

[deep-merge](https://github.com/Raynos/deep-merge),

[deep](https://github.com/jeffomatic/deep),

[deepmerge](https://github.com/KyleAMathews/deepmerge),

[defaults-deep](https://github.com/jonschlinkert/defaults-deep),

[defaults](https://github.com/tmpvar/defaults),

[dottie](https://github.com/mickhansen/dottie.js),

[dotty](https://github.com/deoxxa/dotty),

[ent](https://github.com/substack/node-ent),

[entities](https://github.com/fb55/node-entities),

[escape-goat](https://github.com/sindresorhus/escape-goat),

[express-jwt](https://github.com/auth0/express-jwt),

[express-session](https://github.com/expressjs/session),

[extend-shallow](https://github.com/jonschlinkert/extend-shallow),

[extend](https://github.com/justmoon/node-extend),

[extend2](https://github.com/eggjs/extend2),

[fast-json-parse](https://github.com/mcollina/fast-json-parse),

[forge](https://github.com/digitalbazaar/forge),

[format-util](https://github.com/tmpfs/format-util),

[got](https://github.com/sindresorhus/got),

[global](https://github.com/Raynos/global),

[he](https://github.com/mathiasbynens/he),

[html-entities](https://github.com/mdevils/node-html-entities),

[isomorphic-fetch](https://github.com/matthew-andrews/isomorphic-fetch),

[jquery](https://jquery.com),

[js-extend](https://github.com/vmattos/js-extend),

[json-parse-better-errors](https://github.com/zkat/json-parse-better-errors),

[json-parse-safe](https://github.com/joaquimserafim/json-parse-safe),

[json-safe-parse](https://github.com/bahamas10/node-json-safe-parse),

[just-compose](https://github.com/angus-c/just),

[just-extend](https://github.com/angus-c/just),

[lodash](https://lodash.com),

[merge-deep](https://github.com/jonschlinkert/merge-deep),

[merge-options](https://github.com/schnittstabil/merge-options),

[merge](https://github.com/yeikos/js.merge),

[mixin-deep](https://github.com/jonschlinkert/mixin-deep),

[mixin-object](https://github.com/jonschlinkert/mixin-object),

[MySQL2](https://github.com/sidorares/node-mysql2),

[node.extend](https://github.com/dreamerslab/node.extend),

[node-fetch](https://github.com/bitinn/node-fetch),

[object-assign](https://github.com/sindresorhus/object-assign),

[object.assign](https://github.com/ljharb/object.assign),

[object.defaults](https://github.com/jonschlinkert/object.defaults),

[parse-json](https://github.com/sindresorhus/parse-json),

[printf](https://github.com/adaltas/node-printf),

[printj](https://github.com/SheetJS/printj),

[q](https://documentup.com/kriskowal/q/),

[ramda](https://ramdajs.com),

[request](https://github.com/request/request),

[request-promise](https://github.com/request/request-promise),

[request-promise-any](https://github.com/request/request-promise-any),

[request-promise-native](https://github.com/request/request-promise-native),

[React Native](https://facebook.github.io/react-native/),

[safe-json-parse](https://github.com/Raynos/safe-json-parse),

[sanitize](https://github.com/pocketly/node-sanitize),

[sanitizer](https://github.com/theSmaw/Caja-HTML-Sanitizer),

[smart-extend](https://github.com/danielkalen/smart-extend),

[sprintf.js](https://github.com/alexei/sprintf.js),

[string-template](https://github.com/Matt-Esch/string-template),

[superagent](https://github.com/visionmedia/superagent),

[underscore](https://underscorejs.org),

[util-extend](https://github.com/isaacs/util-extend),

[utils-merge](https://github.com/jaredhanson/utils-merge),

[validator](https://github.com/chriso/validator.js),

[xss](https://github.com/leizongmin/js-xss),

[xtend](https://github.com/Raynos/xtend).

| Uncontrolled data used in remote request (`js/request-forgery`) | security, external/cwe/cwe-918 | Highlights remote requests that are built from unsanitized user input, indicating a violation of [CWE-918](https://cwe.mitre.org/data/definitions/918.html). Results are hidden on LGTM by default. |

| Comparison between inconvertible types | Fewer results | This rule now flags fewer comparisons involving parameters. The severity of this rule has been revised to "warning". |

| Incomplete string escaping or encoding | New name, more true-positive results | This rule now recognizes incomplete URL encoding and decoding. As a consequence, the name was updated to reflect the change in behavior. |

| Missing rate limiting | More true-positive results, fewer false-positive results | This rule now recognizes additional rate limiters and expensive route handlers. |

| Unused variable | New name, fewer results | This rule has been renamed to "Unused variable, import, function or class" to reflect the fact that it flags different kinds of unused program elements. The rule no longer flags class expressions that could be made anonymous. While technically true, these results are not interesting. |

| Use of incompletely initialized object| Fewer results | This rule now flags the constructor instead of its errorneous `this` or `super` expressions. |

| Useless conditional | Fewer results | This rule no longer flags uses of boolean return values and highlights fewer comparisons involving parameters. |

* HTTP and HTTPS requests made using the Node.js `http.request` and `https.request` APIs, and the Electron `Electron.net.request` and `Electron.ClientRequest` APIs, are modeled as `RemoteFlowSources`.

* HTTP header names are now always normalized to lower case to reflect the fact that they are case insensitive. In particular, the result of `HeaderDefinition.getAHeaderName`, and the first parameter of `HeaderDefinition.defines`, `ExplicitHeaderDefinition.definesExplicitly`, and `RouteHandler.getAResponseHeader` are now always a lower-case string.

* The class `JsonParseCall` has been deprecated. Update your queries to use `JsonParserCall` instead.