C++ regex parse tree and RegexTreeViewSig implementation (Phase 1 of ReDoS support)

cpp/ql/lib/change-notes/2026-07-15-cpp-regex-tree-view.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added an internal C++ regular-expression parse library (`semmle.code.cpp.regex.RegexTreeView`) that implements the shared `RegexTreeViewSig` signature. This is the foundation for future ReDoS analyses for C++ (`cpp/polynomial-redos` and `cpp/redos`). No new queries are added in this release.

cpp/ql/lib/change-notes/2026-07-16-cpp-regex-flow-configs.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added internal C++ regex usage and flow modeling (`semmle.code.cpp.regex.RegexFlowConfigs`). The `RegexTreeView` `RegExp` class now only matches `StringLiteral`s that flow to a `std::basic_regex` construction/assignment or a `std::regex_match`/`std::regex_search`/`std::regex_replace`/`std::regex_iterator`/`std::regex_token_iterator` call. Construction-site flags in `std::regex_constants` are detected (`icase`, `multiline`, and the grammar flags), including bitwise-`|` combinations. Literals constructed with an explicit non-ECMAScript grammar flag (`basic`, `extended`, `awk`, `grep`, `egrep`) are excluded from the ECMAScript-only parser. No new queries are added in this release.

cpp/ql/lib/qlpack.yml

@@ -10,6 +10,7 @@ dependencies:
   codeql/mad: ${workspace}
   codeql/quantum: ${workspace}
   codeql/rangeanalysis: ${workspace}
+  codeql/regex: ${workspace}
   codeql/ssa: ${workspace}
   codeql/typeflow: ${workspace}
   codeql/tutorial: ${workspace}