diff --git a/.github/workflows/code-scanning-pack-gen.yml b/.github/workflows/code-scanning-pack-gen.yml
index 1b620260c3..678b3be403 100644
--- a/.github/workflows/code-scanning-pack-gen.yml
+++ b/.github/workflows/code-scanning-pack-gen.yml
@@ -80,6 +80,8 @@ jobs:
 
       - name: Checkout external help files
         id: checkout-external-help-files
+        # PRs from forks and dependabot do not have access to an appropriate token for cloning the help files repos
+        if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
         uses: actions/checkout@v4
         with:
           ssh-key: ${{ secrets.CODEQL_CODING_STANDARDS_HELP_KEY }}
@@ -88,7 +90,7 @@ jobs:
           path: external-help-files
 
       - name: Include external help files
-        if: steps.checkout-external-help-files.outcome == 'success'
+        if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]'&& steps.checkout-external-help-files.outcome == 'success' }}
         run: |
           pushd external-help-files
           find . -name '*.md' -exec rsync -av --relative {} "$GITHUB_WORKSPACE" \;
diff --git a/.github/workflows/dispatch-matrix-test-on-comment.yml b/.github/workflows/dispatch-matrix-test-on-comment.yml
index 964fb7e9f3..972cabdb89 100644
--- a/.github/workflows/dispatch-matrix-test-on-comment.yml
+++ b/.github/workflows/dispatch-matrix-test-on-comment.yml
@@ -19,7 +19,7 @@ jobs:
 
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/dispatch-release-performance-check.yml b/.github/workflows/dispatch-release-performance-check.yml
index a8df297f7d..5886bb2ea8 100644
--- a/.github/workflows/dispatch-release-performance-check.yml
+++ b/.github/workflows/dispatch-release-performance-check.yml
@@ -19,7 +19,7 @@ jobs:
 
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/finalize-release.yml b/.github/workflows/finalize-release.yml
index a7ccc0375e..b3a96f32d3 100644
--- a/.github/workflows/finalize-release.yml
+++ b/.github/workflows/finalize-release.yml
@@ -103,7 +103,7 @@ jobs:
       - name: Generate token
         if: env.HOTFIX_RELEASE == 'false'
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
index 19dbe1adbd..75e297d42e 100644
--- a/.github/workflows/prepare-release.yml
+++ b/.github/workflows/prepare-release.yml
@@ -143,7 +143,7 @@ jobs:
 
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/update-release.yml b/.github/workflows/update-release.yml
index 4f779d0841..e3b8045514 100644
--- a/.github/workflows/update-release.yml
+++ b/.github/workflows/update-release.yml
@@ -43,7 +43,7 @@ jobs:
 
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/.github/workflows/upgrade_codeql_dependencies.yml b/.github/workflows/upgrade_codeql_dependencies.yml
index 841b78fcd6..1ffc874bb4 100644
--- a/.github/workflows/upgrade_codeql_dependencies.yml
+++ b/.github/workflows/upgrade_codeql_dependencies.yml
@@ -53,7 +53,7 @@ jobs:
           find c \( -name '*.ql' -or -name '*.qll' \) -print0 | xargs -0 --max-procs "$XARGS_MAX_PROCS" codeql query format --in-place
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           title: "Upgrade `github/codeql` dependency to ${{ github.event.inputs.codeql_cli_version }}"
           body: |
diff --git a/.github/workflows/validate-release.yml b/.github/workflows/validate-release.yml
index 63aa9e90e3..cd7d27f6fa 100644
--- a/.github/workflows/validate-release.yml
+++ b/.github/workflows/validate-release.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
@@ -108,7 +108,7 @@ jobs:
     steps:
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.AUTOMATION_APP_ID }}
           private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
diff --git a/README.md b/README.md
index 0f24587afe..02c226f84a 100644
--- a/README.md
+++ b/README.md
@@ -15,14 +15,15 @@ The following coding standards are supported:
 - [MISRA C 2012, 3rd Edition, 1st revision](https://www.misra.org.uk/product/misra-c2012-third-edition-first-revision/) (incoporating Amendment 1 & Technical Corrigendum 1). In addition, we support the following additional amendments and technical corrigendums:
    - [MISRA C 2012 Amendment 2](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD2.pdf)
    - [MISRA C 2012 Technical Corrigendum 2](https://misra.org.uk/app/uploads/2022/04/MISRA-C-2012-TC2.pdf)
+   - [MISRA C 2012 Amendment 3](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD3.pdf)
+   - [MISRA C 2012 Amendment 4](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD4.pdf)
+- [MISRA C 2023](https://misra.org.uk/product/misra-c2023/)
 
 ## :construction: Standards under development :construction:
 
-The following standards are under active development:
+The following standards are under active development for [C++17](https://www.iso.org/standard/68564.html):
 
-- [MISRA C++ 2023](https://misra.org.uk/product/misra-cpp2023/) - under development - _scheduled for release 2025 Q1_
-- [MISRA C 2023](https://misra.org.uk/product/misra-c2023/) - under development - _scheduled for release 2025 Q1_
-  - This includes the development of [MISRA C 2012 Amendment 3](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD3.pdf) and [MISRA C 2012 Amendment 4](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD4.pdf), which are incorporated into MISRA C 2023.
+- [MISRA C++ 2023](https://misra.org.uk/product/misra-cpp2023/) - under development - _scheduled for release 2025 Q2/Q3_
 
 ## How do I use the CodeQL Coding Standards Queries?
 
diff --git a/amendments.csv b/amendments.csv
index ce285a29ba..7bcc65327c 100644
--- a/amendments.csv
+++ b/amendments.csv
@@ -1,49 +1,49 @@
 language,standard,amendment,rule_id,supportable,implementation_category,implemented,difficulty
-c,MISRA-C-2012,Amendment3,DIR-4-6,Yes,Expand,No,Easy
-c,MISRA-C-2012,Amendment3,DIR-4-9,Yes,Refine,No,Easy
-c,MISRA-C-2012,Amendment3,DIR-4-11,Yes,Refine,No,Import
-c,MISRA-C-2012,Amendment3,RULE-1-4,Yes,Replace,No,Easy
-c,MISRA-C-2012,Amendment3,RULE-10-1,Yes,Replace,No,Easy
-c,MISRA-C-2012,Amendment3,RULE-10-3,Yes,Refine,No,Easy
-c,MISRA-C-2012,Amendment3,RULE-10-4,Yes,Refine,No,Import
-c,MISRA-C-2012,Amendment3,RULE-10-5,Yes,Expand,No,Easy
-c,MISRA-C-2012,Amendment3,RULE-10-7,Yes,Refine,No,Import
-c,MISRA-C-2012,Amendment3,RULE-10-8,Yes,Refine,No,Import
-c,MISRA-C-2012,Amendment3,RULE-21-11,Yes,Clarification,No,Import
-c,MISRA-C-2012,Amendment3,RULE-21-12,Yes,Replace,No,Easy
-c,MISRA-C-2012,Amendment4,RULE-11-3,Yes,Expand,No,Easy
-c,MISRA-C-2012,Amendment4,RULE-11-8,Yes,Expand,No,Easy
-c,MISRA-C-2012,Amendment4,RULE-13-2,Yes,Expand,No,Very Hard
-c,MISRA-C-2012,Amendment4,RULE-18-6,Yes,Expand,No,Medium
+c,MISRA-C-2012,Amendment3,DIR-4-6,Yes,Expand,Yes,Easy
+c,MISRA-C-2012,Amendment3,DIR-4-9,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Amendment3,DIR-4-11,Yes,Refine,Yes,Import
+c,MISRA-C-2012,Amendment3,RULE-1-4,Yes,Replace,Yes,Easy
+c,MISRA-C-2012,Amendment3,RULE-10-1,Yes,Replace,Yes,Easy
+c,MISRA-C-2012,Amendment3,RULE-10-3,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Amendment3,RULE-10-4,Yes,Refine,Yes,Import
+c,MISRA-C-2012,Amendment3,RULE-10-5,Yes,Expand,Yes,Easy
+c,MISRA-C-2012,Amendment3,RULE-10-7,Yes,Refine,Yes,Import
+c,MISRA-C-2012,Amendment3,RULE-10-8,Yes,Refine,Yes,Import
+c,MISRA-C-2012,Amendment3,RULE-21-11,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment3,RULE-21-12,Yes,Replace,Yes,Easy
+c,MISRA-C-2012,Amendment4,RULE-11-3,Yes,Expand,Yes,Easy
+c,MISRA-C-2012,Amendment4,RULE-11-8,Yes,Expand,Yes,Easy
+c,MISRA-C-2012,Amendment4,RULE-13-2,Yes,Expand,Yes,Very Hard
+c,MISRA-C-2012,Amendment4,RULE-18-6,Yes,Expand,Yes,Medium
 c,MISRA-C-2012,Amendment4,RULE-18-8,Yes,Split,Yes,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-2-2,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-2-7,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-3-1,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-8-6,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-8-9,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-9-4,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-10-1,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-18-3,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-1-4,Yes,Replace,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-9-1,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-9-2,Yes,Refine,No,Import
-c,MISRA-C-2012,Corrigendum2,DIR-4-10,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-7-4,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-8-2,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-8-3,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-8-7,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-10-2,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-10-3,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-11-3,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-11-6,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-13-2,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-13-6,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-14-3,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-15-7,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-17-4,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-17-5,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-18-1,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-20-14,No,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-21-19,Yes,Clarification,No,Import
-c,MISRA-C-2012,Corrigendum2,RULE-21-20,Yes,Refine,No,Easy
-c,MISRA-C-2012,Corrigendum2,RULE-22-9,Yes,Clarification,No,Import
\ No newline at end of file
+c,MISRA-C-2012,Amendment4,RULE-2-2,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment4,RULE-2-7,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment4,RULE-3-1,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Amendment4,RULE-8-6,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment4,RULE-8-9,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment4,RULE-9-4,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment4,RULE-10-1,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment4,RULE-18-3,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Amendment4,RULE-1-4,Yes,Replace,Yes,Easy
+c,MISRA-C-2012,Amendment4,RULE-9-1,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Corrigendum2,DIR-4-10,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-7-4,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Corrigendum2,RULE-8-2,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-8-3,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Corrigendum2,RULE-8-7,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-10-1,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-10-2,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Corrigendum2,RULE-10-3,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-11-3,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-11-6,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-13-2,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-13-6,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-14-3,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Corrigendum2,RULE-15-7,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-17-4,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-17-5,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-18-1,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Corrigendum2,RULE-20-14,No,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-21-19,Yes,Clarification,Yes,Import
+c,MISRA-C-2012,Corrigendum2,RULE-21-20,Yes,Refine,Yes,Easy
+c,MISRA-C-2012,Corrigendum2,RULE-22-9,Yes,Clarification,Yes,Import
diff --git a/c/cert/src/codeql-pack.lock.yml b/c/cert/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/c/cert/src/codeql-pack.lock.yml
+++ b/c/cert/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/c/cert/src/codeql-suites/cert-c-default.qls b/c/cert/src/codeql-suites/cert-c-default.qls
new file mode 100644
index 0000000000..348d2f37ae
--- /dev/null
+++ b/c/cert/src/codeql-suites/cert-c-default.qls
@@ -0,0 +1,10 @@
+- description: CERT C 2016 (Default)
+- qlpack: codeql/cert-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/rule
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
diff --git a/c/cert/src/codeql-suites/cert-c-l1.qls b/c/cert/src/codeql-suites/cert-c-l1.qls
new file mode 100644
index 0000000000..b2056fbec8
--- /dev/null
+++ b/c/cert/src/codeql-suites/cert-c-l1.qls
@@ -0,0 +1,12 @@
+- description: CERT C 2016 Level 1 Rules (Priority 12 - Priority 27)
+- qlpack: codeql/cert-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/rule
+    tags contain:
+    - external/cert/level/l1
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
\ No newline at end of file
diff --git a/c/cert/src/codeql-suites/cert-c-l2.qls b/c/cert/src/codeql-suites/cert-c-l2.qls
new file mode 100644
index 0000000000..9c0a4b1ef9
--- /dev/null
+++ b/c/cert/src/codeql-suites/cert-c-l2.qls
@@ -0,0 +1,12 @@
+- description: CERT C 2016 Level 2 Rules (Priority 6 - Priority 9)
+- qlpack: codeql/cert-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/rule
+    tags contain:
+    - external/cert/level/l2
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
\ No newline at end of file
diff --git a/c/cert/src/codeql-suites/cert-c-l3.qls b/c/cert/src/codeql-suites/cert-c-l3.qls
new file mode 100644
index 0000000000..462a6d816f
--- /dev/null
+++ b/c/cert/src/codeql-suites/cert-c-l3.qls
@@ -0,0 +1,12 @@
+- description: CERT C 2016 Level 3 Rules (Priority 1 - Priority 4)
+- qlpack: codeql/cert-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/rule
+    tags contain:
+    - external/cert/level/l3
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
\ No newline at end of file
diff --git a/c/cert/src/codeql-suites/cert-c-recommendation.qls b/c/cert/src/codeql-suites/cert-c-recommendation.qls
new file mode 100644
index 0000000000..59ac5e9c2d
--- /dev/null
+++ b/c/cert/src/codeql-suites/cert-c-recommendation.qls
@@ -0,0 +1,10 @@
+- description: CERT C 2016 (Recommendations)
+- qlpack: codeql/cert-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/recommendation
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
diff --git a/c/cert/src/codeql-suites/cert-default.qls b/c/cert/src/codeql-suites/cert-default.qls
index 1e11a0afca..c093b31fa7 100644
--- a/c/cert/src/codeql-suites/cert-default.qls
+++ b/c/cert/src/codeql-suites/cert-default.qls
@@ -1,9 +1,2 @@
-- description: CERT C 2016 (Default)
-- qlpack: codeql/cert-c-coding-standards
-- include:
-    kind:
-    - problem
-    - path-problem
-- exclude:
-    tags contain:
-    - external/cert/default-disabled
+- description: "DEPRECATED - CERT C 2016 - use cert-c-default.qls instead"
+- import: codeql-suites/cert-c-default.qls
diff --git a/c/cert/src/qlpack.yml b/c/cert/src/qlpack.yml
index 00a8221f28..f79744a4fc 100644
--- a/c/cert/src/qlpack.yml
+++ b/c/cert/src/qlpack.yml
@@ -1,8 +1,9 @@
 name: codeql/cert-c-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 description: CERT C 2016
 suites: codeql-suites
 license: MIT
+default-suite-file: codeql-suites/cert-c-default.qls
 dependencies:
   codeql/common-c-coding-standards: '*'
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
diff --git a/c/cert/src/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.ql b/c/cert/src/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.ql
index cc4c99c002..fed579bf34 100644
--- a/c/cert/src/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.ql
+++ b/c/cert/src/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/arr30-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.ql b/c/cert/src/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.ql
index 40a800aa69..1356777e5f 100644
--- a/c/cert/src/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.ql
+++ b/c/cert/src/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.ql
@@ -9,12 +9,18 @@
  * @tags external/cert/id/arr32-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Overflow
+import semmle.code.cpp.dataflow.TaintTracking
 
 /**
  * Gets the maximum size (in bytes) a variable-length array
diff --git a/c/cert/src/rules/ARR36-C/DoNotRelatePointersThatDoNotReferToTheSameArray.ql b/c/cert/src/rules/ARR36-C/DoNotRelatePointersThatDoNotReferToTheSameArray.ql
index 93244bd483..e42437042f 100644
--- a/c/cert/src/rules/ARR36-C/DoNotRelatePointersThatDoNotReferToTheSameArray.ql
+++ b/c/cert/src/rules/ARR36-C/DoNotRelatePointersThatDoNotReferToTheSameArray.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/arr36-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ARR36-C/DoNotSubtractPointersThatDoNotReferToTheSameArray.ql b/c/cert/src/rules/ARR36-C/DoNotSubtractPointersThatDoNotReferToTheSameArray.ql
index b3ed62d5d7..a9e53e68b7 100644
--- a/c/cert/src/rules/ARR36-C/DoNotSubtractPointersThatDoNotReferToTheSameArray.ql
+++ b/c/cert/src/rules/ARR36-C/DoNotSubtractPointersThatDoNotReferToTheSameArray.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/arr36-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql b/c/cert/src/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql
index 2f8ecec25d..635d9d5c03 100644
--- a/c/cert/src/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql
+++ b/c/cert/src/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql
@@ -8,12 +8,17 @@
  * @problem.severity error
  * @tags external/cert/id/arr37-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import NonArrayPointerToArrayIndexingExprFlow::PathGraph
 
 /**
diff --git a/c/cert/src/rules/ARR38-C/LibraryFunctionArgumentOutOfBounds.ql b/c/cert/src/rules/ARR38-C/LibraryFunctionArgumentOutOfBounds.ql
index 5082743193..04e1c8a505 100644
--- a/c/cert/src/rules/ARR38-C/LibraryFunctionArgumentOutOfBounds.ql
+++ b/c/cert/src/rules/ARR38-C/LibraryFunctionArgumentOutOfBounds.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/arr38-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.ql b/c/cert/src/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.ql
index ff1517c5b1..c3ebd6ede6 100644
--- a/c/cert/src/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.ql
+++ b/c/cert/src/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.ql
@@ -8,13 +8,18 @@
  * @problem.severity error
  * @tags external/cert/id/arr39-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.Pointers
-import codingstandards.cpp.dataflow.TaintTracking
+import codingstandards.cpp.types.Pointers
+import semmle.code.cpp.dataflow.TaintTracking
 import ScaledIntegerPointerArithmeticFlow::PathGraph
 
 /**
diff --git a/c/cert/src/rules/CON30-C/CleanUpThreadSpecificStorage.ql b/c/cert/src/rules/CON30-C/CleanUpThreadSpecificStorage.ql
index 59fab6e455..1e03c089e8 100644
--- a/c/cert/src/rules/CON30-C/CleanUpThreadSpecificStorage.ql
+++ b/c/cert/src/rules/CON30-C/CleanUpThreadSpecificStorage.ql
@@ -9,14 +9,18 @@
  * @tags external/cert/id/con30-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Concurrency
-import codingstandards.cpp.dataflow.TaintTracking
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 module TssCreateToTssDeleteConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node node) {
diff --git a/c/cert/src/rules/CON31-C/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql b/c/cert/src/rules/CON31-C/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql
index 0bde0b0de7..345623fe0d 100644
--- a/c/cert/src/rules/CON31-C/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql
+++ b/c/cert/src/rules/CON31-C/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con31-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON31-C/DoNotDestroyAMutexWhileItIsLocked.ql b/c/cert/src/rules/CON31-C/DoNotDestroyAMutexWhileItIsLocked.ql
index b37dccab3a..40c4e936dd 100644
--- a/c/cert/src/rules/CON31-C/DoNotDestroyAMutexWhileItIsLocked.ql
+++ b/c/cert/src/rules/CON31-C/DoNotDestroyAMutexWhileItIsLocked.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/con31-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON32-C/PreventDataRacesWithMultipleThreads.ql b/c/cert/src/rules/CON32-C/PreventDataRacesWithMultipleThreads.ql
index d4f3cbbe10..3ea9e1e1fd 100644
--- a/c/cert/src/rules/CON32-C/PreventDataRacesWithMultipleThreads.ql
+++ b/c/cert/src/rules/CON32-C/PreventDataRacesWithMultipleThreads.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con32-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON33-C/RaceConditionsWhenUsingLibraryFunctions.ql b/c/cert/src/rules/CON33-C/RaceConditionsWhenUsingLibraryFunctions.ql
index 4efafd8ebf..c9bcaa6bd2 100644
--- a/c/cert/src/rules/CON33-C/RaceConditionsWhenUsingLibraryFunctions.ql
+++ b/c/cert/src/rules/CON33-C/RaceConditionsWhenUsingLibraryFunctions.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/con33-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON34-C/AppropriateThreadObjectStorageDurations.ql b/c/cert/src/rules/CON34-C/AppropriateThreadObjectStorageDurations.ql
index e0617c266d..4fb034406b 100644
--- a/c/cert/src/rules/CON34-C/AppropriateThreadObjectStorageDurations.ql
+++ b/c/cert/src/rules/CON34-C/AppropriateThreadObjectStorageDurations.ql
@@ -9,35 +9,53 @@
  * @tags external/cert/id/con34-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
+import codingstandards.c.Objects
 import codingstandards.cpp.Concurrency
-import codingstandards.cpp.dataflow.TaintTracking
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.commons.Alloc
 
-from C11ThreadCreateCall tcc, StackVariable sv, Expr arg, Expr acc
+from C11ThreadCreateCall tcc, Expr arg
 where
   not isExcluded(tcc, Concurrency4Package::appropriateThreadObjectStorageDurationsQuery()) and
   tcc.getArgument(2) = arg and
-  sv.getAnAccess() = acc and
-  // a stack variable that is given as an argument to a thread
-  TaintTracking::localTaint(DataFlow::exprNode(acc), DataFlow::exprNode(arg)) and
-  // or isn't one of the allowed usage patterns
-  not exists(Expr mfc |
-    isAllocationExpr(mfc) and
-    sv.getAnAssignedValue() = mfc and
-    acc.getAPredecessor*() = mfc
-  ) and
-  not exists(TSSGetFunctionCall tsg, TSSSetFunctionCall tss, DataFlow::Node src |
-    sv.getAnAssignedValue() = tsg and
-    acc.getAPredecessor*() = tsg and
-    // there should be dataflow from somewhere (the same somewhere)
-    // into each of the first arguments
-    DataFlow::localFlow(src, DataFlow::exprNode(tsg.getArgument(0))) and
-    DataFlow::localFlow(src, DataFlow::exprNode(tss.getArgument(0)))
+  (
+    exists(ObjectIdentity obj, Expr acc |
+      obj.getASubobjectAccess() = acc and
+      obj.getStorageDuration().isAutomatic() and
+      exists(DataFlow::Node addrNode |
+        (
+          addrNode = DataFlow::exprNode(any(AddressOfExpr e | e.getOperand() = acc))
+          or
+          addrNode = DataFlow::exprNode(acc) and
+          exists(ArrayToPointerConversion c | c.getExpr() = acc)
+        ) and
+        TaintTracking::localTaint(addrNode, DataFlow::exprNode(arg))
+      )
+    )
+    or
+    // TODO: This case is handling threadlocals in a useful way that's not intended to be covered
+    // by the rule. See issue #801. The actual rule should expect no tss_t objects is used, and
+    // this check that this is initialized doesn't seem to belong here. However, it is a useful
+    // check in and of itself, so we should figure out if this is part of an optional rule we
+    // haven't yet implemented and move this behavior there.
+    exists(TSSGetFunctionCall tsg |
+      TaintTracking::localTaint(DataFlow::exprNode(tsg), DataFlow::exprNode(arg)) and
+      not exists(TSSSetFunctionCall tss, DataFlow::Node src |
+        // there should be dataflow from somewhere (the same somewhere)
+        // into each of the first arguments
+        DataFlow::localFlow(src, DataFlow::exprNode(tsg.getArgument(0))) and
+        DataFlow::localFlow(src, DataFlow::exprNode(tss.getArgument(0)))
+      )
+    )
   )
 select tcc, "$@ not declared with appropriate storage duration", arg, "Shared object"
diff --git a/c/cert/src/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.ql b/c/cert/src/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.ql
index 0fd94911ec..07b114d6ca 100644
--- a/c/cert/src/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.ql
+++ b/c/cert/src/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.ql
@@ -10,14 +10,18 @@
  *       external/cert/audit
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Concurrency
-import codingstandards.cpp.dataflow.TaintTracking
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 from TSSGetFunctionCall tsg, ThreadedFunction tf
 where
diff --git a/c/cert/src/rules/CON35-C/DeadlockByLockingInPredefinedOrder.ql b/c/cert/src/rules/CON35-C/DeadlockByLockingInPredefinedOrder.ql
index 143e0a58be..764b0f263f 100644
--- a/c/cert/src/rules/CON35-C/DeadlockByLockingInPredefinedOrder.ql
+++ b/c/cert/src/rules/CON35-C/DeadlockByLockingInPredefinedOrder.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con35-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON36-C/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql b/c/cert/src/rules/CON36-C/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql
index 430a0e7c19..d0d948d9b2 100644
--- a/c/cert/src/rules/CON36-C/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql
+++ b/c/cert/src/rules/CON36-C/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con36-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON37-C/DoNotCallSignalInMultithreadedProgram.ql b/c/cert/src/rules/CON37-C/DoNotCallSignalInMultithreadedProgram.ql
index 00cf456948..17691f24dd 100644
--- a/c/cert/src/rules/CON37-C/DoNotCallSignalInMultithreadedProgram.ql
+++ b/c/cert/src/rules/CON37-C/DoNotCallSignalInMultithreadedProgram.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con37-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON38-C/PreserveSafetyWhenUsingConditionVariables.ql b/c/cert/src/rules/CON38-C/PreserveSafetyWhenUsingConditionVariables.ql
index 470480ae62..3b2ae558d8 100644
--- a/c/cert/src/rules/CON38-C/PreserveSafetyWhenUsingConditionVariables.ql
+++ b/c/cert/src/rules/CON38-C/PreserveSafetyWhenUsingConditionVariables.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con38-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.ql b/c/cert/src/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.ql
index a8dead535d..6ef617ca72 100644
--- a/c/cert/src/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.ql
+++ b/c/cert/src/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.ql
@@ -9,42 +9,20 @@
  * @tags external/cert/id/con39-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.Concurrency
+import codingstandards.cpp.rules.joinordetachthreadonlyonce.JoinOrDetachThreadOnlyOnce
 
-// OK
-// 1) Thread calls detach parent DOES NOT call join
-// 2) Parent calls join, thread does NOT call detach()
-// NOT OK
-// 1) Thread calls detach, parent calls join
-// 2) Thread calls detach twice, parent does not call join
-// 3) Parent calls join twice, thread does not call detach
-from C11ThreadCreateCall tcc
-where
-  not isExcluded(tcc, Concurrency5Package::threadWasPreviouslyJoinedOrDetachedQuery()) and
-  // Note: These cases can be simplified but they are presented like this for clarity
-  // case 1 - calls to `thrd_join` and `thrd_detach` within the parent or
-  // within the parent / child CFG.
-  exists(C11ThreadWait tw, C11ThreadDetach dt |
-    tw = getAThreadContextAwareSuccessor(tcc) and
-    dt = getAThreadContextAwareSuccessor(tcc)
-  )
-  or
-  // case 2 - multiple calls to `thrd_detach` within the threaded CFG.
-  exists(C11ThreadDetach dt1, C11ThreadDetach dt2 |
-    dt1 = getAThreadContextAwareSuccessor(tcc) and
-    dt2 = getAThreadContextAwareSuccessor(tcc) and
-    not dt1 = dt2
-  )
-  or
-  // case 3 - multiple calls to `thrd_join` within the threaded CFG.
-  exists(C11ThreadWait tw1, C11ThreadWait tw2 |
-    tw1 = getAThreadContextAwareSuccessor(tcc) and
-    tw2 = getAThreadContextAwareSuccessor(tcc) and
-    not tw1 = tw2
-  )
-select tcc, "Thread may call join or detach after the thread is joined or detached."
+class ThreadWasPreviouslyJoinedOrDetachedQuery extends JoinOrDetachThreadOnlyOnceSharedQuery {
+  ThreadWasPreviouslyJoinedOrDetachedQuery() {
+    this = Concurrency5Package::threadWasPreviouslyJoinedOrDetachedQuery()
+  }
+}
diff --git a/c/cert/src/rules/CON40-C/AtomicVariableTwiceInExpression.ql b/c/cert/src/rules/CON40-C/AtomicVariableTwiceInExpression.ql
index 8a44013277..0ec195868f 100644
--- a/c/cert/src/rules/CON40-C/AtomicVariableTwiceInExpression.ql
+++ b/c/cert/src/rules/CON40-C/AtomicVariableTwiceInExpression.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con40-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.ql b/c/cert/src/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.ql
index dd8aed6a55..57be1bc488 100644
--- a/c/cert/src/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.ql
+++ b/c/cert/src/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con41-c
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.ql b/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.ql
index 9097f14297..2e1064ee9d 100644
--- a/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.ql
+++ b/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.ql
@@ -8,15 +8,26 @@
  * @problem.severity error
  * @tags external/cert/id/dcl30-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.DataFlow
+import codingstandards.c.Objects
+import semmle.code.cpp.dataflow.DataFlow
 
-class Source extends StackVariable {
-  Source() { not this instanceof Parameter }
+class Source extends Expr {
+  ObjectIdentity rootObject;
+
+  Source() {
+    rootObject.getStorageDuration().isAutomatic() and
+    this = rootObject.getASubobjectAddressExpr()
+  }
 }
 
 class Sink extends DataFlow::Node {
@@ -40,7 +51,7 @@ from DataFlow::Node src, DataFlow::Node sink
 where
   not isExcluded(sink.asExpr(),
     Declarations8Package::appropriateStorageDurationsFunctionReturnQuery()) and
-  exists(Source s | src.asExpr() = s.getAnAccess()) and
+  exists(Source s | src.asExpr() = s) and
   sink instanceof Sink and
   DataFlow::localFlow(src, sink)
 select sink, "$@ with automatic storage may be accessible outside of its lifetime.", src,
diff --git a/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsStackAdressEscape.ql b/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsStackAdressEscape.ql
index fb9b13b39c..a5749aa8bc 100644
--- a/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsStackAdressEscape.ql
+++ b/c/cert/src/rules/DCL30-C/AppropriateStorageDurationsStackAdressEscape.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl30-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL31-C/DeclareIdentifiersBeforeUsingThem.ql b/c/cert/src/rules/DCL31-C/DeclareIdentifiersBeforeUsingThem.ql
index 369baa4a63..35e6cd057a 100644
--- a/c/cert/src/rules/DCL31-C/DeclareIdentifiersBeforeUsingThem.ql
+++ b/c/cert/src/rules/DCL31-C/DeclareIdentifiersBeforeUsingThem.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/dcl31-c
  *       correctness
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL37-C/DoNotDeclareOrDefineAReservedIdentifier.ql b/c/cert/src/rules/DCL37-C/DoNotDeclareOrDefineAReservedIdentifier.ql
index 99c5a9708b..04a3030cc1 100644
--- a/c/cert/src/rules/DCL37-C/DoNotDeclareOrDefineAReservedIdentifier.ql
+++ b/c/cert/src/rules/DCL37-C/DoNotDeclareOrDefineAReservedIdentifier.ql
@@ -9,6 +9,11 @@
  *       correctness
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL38-C/DeclaringAFlexibleArrayMember.ql b/c/cert/src/rules/DCL38-C/DeclaringAFlexibleArrayMember.ql
index e9fa3f1017..d6000852c6 100644
--- a/c/cert/src/rules/DCL38-C/DeclaringAFlexibleArrayMember.ql
+++ b/c/cert/src/rules/DCL38-C/DeclaringAFlexibleArrayMember.ql
@@ -10,6 +10,11 @@
  *       correctness
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.md b/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.md
index cdc62493a1..4dd3bcbe3c 100644
--- a/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.md
+++ b/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.md
@@ -249,7 +249,7 @@ In addition, this solution assumes that there are no integer padding bits in an
 
 From this situation, it can be seen that special care must be taken because no solution to the bit-field padding issue will be 100% portable.
 
-Risk Assessment
+## Risk Assessment
 
 Padding units might contain sensitive data because the C Standard allows any padding to take [unspecified values](https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-unspecifiedvalue). A pointer to such a structure could be passed to other functions, causing information leakage.
 
diff --git a/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.ql b/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.ql
index 1199fbeb9b..dd2c1217cf 100644
--- a/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.ql
+++ b/c/cert/src/rules/DCL39-C/InformationLeakageAcrossTrustBoundariesC.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl39-c
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p1
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL40-C/ExcessLengthNamesIdentifiersNotDistinct.ql b/c/cert/src/rules/DCL40-C/ExcessLengthNamesIdentifiersNotDistinct.ql
index ba2cc5c23f..d002326fae 100644
--- a/c/cert/src/rules/DCL40-C/ExcessLengthNamesIdentifiersNotDistinct.ql
+++ b/c/cert/src/rules/DCL40-C/ExcessLengthNamesIdentifiersNotDistinct.ql
@@ -9,6 +9,11 @@
  *       correctness
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL40-C/IncompatibleFunctionDeclarations.ql b/c/cert/src/rules/DCL40-C/IncompatibleFunctionDeclarations.ql
index 20b6e5e59e..3811d4e417 100644
--- a/c/cert/src/rules/DCL40-C/IncompatibleFunctionDeclarations.ql
+++ b/c/cert/src/rules/DCL40-C/IncompatibleFunctionDeclarations.ql
@@ -11,30 +11,45 @@
  *       correctness
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.Compatible
+import codingstandards.cpp.types.Compatible
 import ExternalIdentifiers
 
+predicate interestedInFunctions(
+  FunctionDeclarationEntry f1, FunctionDeclarationEntry f2, ExternalIdentifiers d
+) {
+  not f1 = f2 and
+  d = f1.getDeclaration() and
+  d = f2.getDeclaration()
+}
+
+predicate interestedInFunctions(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
+  interestedInFunctions(f1, f2, _)
+}
+
+module FuncDeclEquiv =
+  FunctionDeclarationTypeEquivalence<TypesCompatibleConfig, interestedInFunctions/2>;
+
 from ExternalIdentifiers d, FunctionDeclarationEntry f1, FunctionDeclarationEntry f2
 where
   not isExcluded(f1, Declarations2Package::incompatibleFunctionDeclarationsQuery()) and
   not isExcluded(f2, Declarations2Package::incompatibleFunctionDeclarationsQuery()) and
-  not f1 = f2 and
-  f1.getDeclaration() = d and
-  f2.getDeclaration() = d and
-  f1.getName() = f2.getName() and
+  interestedInFunctions(f1, f2, d) and
   (
     //return type check
-    not typesCompatible(f1.getType(), f2.getType())
+    not FuncDeclEquiv::equalReturnTypes(f1, f2)
     or
     //parameter type check
-    parameterTypesIncompatible(f1, f2)
-    or
-    not f1.getNumberOfParameters() = f2.getNumberOfParameters()
+    not FuncDeclEquiv::equalParameterTypes(f1, f2)
   ) and
   // Apply ordering on start line, trying to avoid the optimiser applying this join too early
   // in the pipeline
diff --git a/c/cert/src/rules/DCL40-C/IncompatibleObjectDeclarations.ql b/c/cert/src/rules/DCL40-C/IncompatibleObjectDeclarations.ql
index 151d33db5c..8e220062d4 100644
--- a/c/cert/src/rules/DCL40-C/IncompatibleObjectDeclarations.ql
+++ b/c/cert/src/rules/DCL40-C/IncompatibleObjectDeclarations.ql
@@ -10,6 +10,11 @@
  *       correctness
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/DCL41-C/VariablesInsideSwitchStatement.ql b/c/cert/src/rules/DCL41-C/VariablesInsideSwitchStatement.ql
index db42f7102c..6f06174b99 100644
--- a/c/cert/src/rules/DCL41-C/VariablesInsideSwitchStatement.ql
+++ b/c/cert/src/rules/DCL41-C/VariablesInsideSwitchStatement.ql
@@ -10,6 +10,11 @@
  *       correctness
  *       maintainability
  *       readability
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ENV30-C/DoNotModifyTheReturnValueOfCertainFunctions.ql b/c/cert/src/rules/ENV30-C/DoNotModifyTheReturnValueOfCertainFunctions.ql
index 42f13f6244..f69a78ba2c 100644
--- a/c/cert/src/rules/ENV30-C/DoNotModifyTheReturnValueOfCertainFunctions.ql
+++ b/c/cert/src/rules/ENV30-C/DoNotModifyTheReturnValueOfCertainFunctions.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/env30-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ENV31-C/EnvPointerIsInvalidAfterCertainOperations.ql b/c/cert/src/rules/ENV31-C/EnvPointerIsInvalidAfterCertainOperations.ql
index a925b80e74..b4d4a74d57 100644
--- a/c/cert/src/rules/ENV31-C/EnvPointerIsInvalidAfterCertainOperations.ql
+++ b/c/cert/src/rules/ENV31-C/EnvPointerIsInvalidAfterCertainOperations.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/env31-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ENV32-C/ExitHandlersMustReturnNormally.ql b/c/cert/src/rules/ENV32-C/ExitHandlersMustReturnNormally.ql
index 1b360ca0d8..19cf28b3e9 100644
--- a/c/cert/src/rules/ENV32-C/ExitHandlersMustReturnNormally.ql
+++ b/c/cert/src/rules/ENV32-C/ExitHandlersMustReturnNormally.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/env32-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ENV33-C/DoNotCallSystem.ql b/c/cert/src/rules/ENV33-C/DoNotCallSystem.ql
index 58a9c8db79..3b21cd7544 100644
--- a/c/cert/src/rules/ENV33-C/DoNotCallSystem.ql
+++ b/c/cert/src/rules/ENV33-C/DoNotCallSystem.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/env33-c
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvFunctions.ql b/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvFunctions.ql
index 505f26046a..af54dfa823 100644
--- a/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvFunctions.ql
+++ b/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvFunctions.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/env34-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvironmentFunWarn.ql b/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvironmentFunWarn.ql
index b5dd9f4d80..784b7898d6 100644
--- a/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvironmentFunWarn.ql
+++ b/c/cert/src/rules/ENV34-C/DoNotStorePointersReturnedByEnvironmentFunWarn.ql
@@ -9,6 +9,11 @@
  * @problem.severity warning
  * @tags external/cert/id/env34-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ERR30-C/ErrnoNotSetToZero.ql b/c/cert/src/rules/ERR30-C/ErrnoNotSetToZero.ql
index cc1dd82bbb..06ac9d1198 100644
--- a/c/cert/src/rules/ERR30-C/ErrnoNotSetToZero.ql
+++ b/c/cert/src/rules/ERR30-C/ErrnoNotSetToZero.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err30-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/ERR30-C/ErrnoReadBeforeReturn.ql b/c/cert/src/rules/ERR30-C/ErrnoReadBeforeReturn.ql
index df8519f13f..13f7e40303 100644
--- a/c/cert/src/rules/ERR30-C/ErrnoReadBeforeReturn.ql
+++ b/c/cert/src/rules/ERR30-C/ErrnoReadBeforeReturn.ql
@@ -8,12 +8,18 @@
  * @problem.severity error
  * @tags external/cert/id/err30-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.c.Errno
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * A call to an `OutOfBandErrnoSettingFunction`
diff --git a/c/cert/src/rules/ERR30-C/FunctionCallBeforeErrnoCheck.ql b/c/cert/src/rules/ERR30-C/FunctionCallBeforeErrnoCheck.ql
index 8d63bb5d06..8bf583faff 100644
--- a/c/cert/src/rules/ERR30-C/FunctionCallBeforeErrnoCheck.ql
+++ b/c/cert/src/rules/ERR30-C/FunctionCallBeforeErrnoCheck.ql
@@ -8,13 +8,17 @@
  * @problem.severity error
  * @tags external/cert/id/err30-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.c.Errno
-import codingstandards.cpp.dataflow.DataFlow
 
 /**
  * A call to an `OutOfBandErrnoSettingFunction`
diff --git a/c/cert/src/rules/ERR30-C/SetlocaleMightSetErrno.ql b/c/cert/src/rules/ERR30-C/SetlocaleMightSetErrno.ql
index 899fa49e60..a7ccf8c041 100644
--- a/c/cert/src/rules/ERR30-C/SetlocaleMightSetErrno.ql
+++ b/c/cert/src/rules/ERR30-C/SetlocaleMightSetErrno.ql
@@ -7,12 +7,18 @@
  * @problem.severity error
  * @tags external/cert/id/err30-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.c.Errno
+import semmle.code.cpp.dataflow.DataFlow
 
 class SetlocaleFunctionCall extends FunctionCall {
   SetlocaleFunctionCall() { this.getTarget().hasGlobalName("setlocale") }
diff --git a/c/cert/src/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.ql b/c/cert/src/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.ql
index ab121a5cc6..146d0cb30f 100644
--- a/c/cert/src/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.ql
+++ b/c/cert/src/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/err32-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
@@ -15,22 +20,23 @@ import codingstandards.c.cert
 import codingstandards.c.Errno
 import codingstandards.c.Signal
 import semmle.code.cpp.controlflow.Guards
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * A check on `signal` call return value
  * `if (signal(SIGINT, handler) == SIG_ERR)`
  */
-class SignalCheckOperation extends EqualityOperation, GuardCondition {
+class SignalCheckOperation extends EqualityOperation instanceof GuardCondition {
   BasicBlock errorSuccessor;
 
   SignalCheckOperation() {
     this.getAnOperand() = any(MacroInvocation m | m.getMacroName() = "SIG_ERR").getExpr() and
     (
       this.getOperator() = "==" and
-      this.controls(errorSuccessor, true)
+      super.controls(errorSuccessor, true)
       or
       this.getOperator() = "!=" and
-      this.controls(errorSuccessor, false)
+      super.controls(errorSuccessor, false)
     )
   }
 
diff --git a/c/cert/src/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.ql b/c/cert/src/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.ql
index 6641fe8a52..5e473b226e 100644
--- a/c/cert/src/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.ql
+++ b/c/cert/src/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err33-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
@@ -15,6 +20,7 @@ import cpp
 import codingstandards.c.cert
 import semmle.code.cpp.commons.NULL
 import codingstandards.cpp.ReadErrorsAndEOF
+import semmle.code.cpp.dataflow.DataFlow
 
 ComparisonOperation getAValidComparison(string spec) {
   spec = "=0" and result.(EqualityOperation).getAnOperand().getValue() = "0"
diff --git a/c/cert/src/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.md b/c/cert/src/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.md
new file mode 100644
index 0000000000..b5a7c98bd6
--- /dev/null
+++ b/c/cert/src/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.md
@@ -0,0 +1,129 @@
+# EXP16-C: Do not compare function pointers to constant values
+
+This query implements the CERT-C rule EXP16-C:
+
+> Do not compare function pointers to constant values
+
+
+## Description
+
+Comparing a function pointer to a value that is not a null function pointer of the same type will be diagnosed because it typically indicates programmer error and can result in [unexpected behavior](https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-unexpectedbehavior). Implicit comparisons will be diagnosed, as well.
+
+## Noncompliant Code Example
+
+In this noncompliant code example, the addresses of the POSIX functions `getuid` and `geteuid` are compared for equality to 0. Because no function address shall be null, the first subexpression will always evaluate to false (0), and the second subexpression always to true (nonzero). Consequently, the entire expression will always evaluate to true, leading to a potential security vulnerability.
+
+```cpp
+/* First the options that are allowed only for root */
+if (getuid == 0 || geteuid != 0) {
+  /* ... */
+}
+
+```
+
+## Noncompliant Code Example
+
+In this noncompliant code example, the function pointers `getuid` and `geteuid` are compared to 0. This example is from an actual [vulnerability](https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-vulnerability) ([VU\#837857](http://www.kb.cert.org/vuls/id/837857)) discovered in some versions of the X Window System server. The vulnerability exists because the programmer neglected to provide the open and close parentheses following the `geteuid()` function identifier. As a result, the `geteuid` token returns the address of the function, which is never equal to 0. Consequently, the `or` condition of this `if` statement is always true, and access is provided to the protected block for all users. Many compilers issue a warning noting such pointless expressions. Therefore, this coding error is normally detected by adherence to [MSC00-C. Compile cleanly at high warning levels](https://wiki.sei.cmu.edu/confluence/display/c/MSC00-C.+Compile+cleanly+at+high+warning+levels).
+
+```cpp
+/* First the options that are allowed only for root */
+if (getuid() == 0 || geteuid != 0) {
+  /* ... */
+}
+
+```
+
+## Compliant Solution
+
+The solution is to provide the open and close parentheses following the `geteuid` token so that the function is properly invoked:
+
+```cpp
+/* First the options that are allowed only for root */
+if (getuid() == 0 || geteuid() != 0) {
+  /* ... */
+}
+
+```
+
+## Compliant Solution
+
+A function pointer can be compared to a null function pointer of the same type:
+
+```cpp
+/* First the options that are allowed only for root */ 
+if (getuid == (uid_t(*)(void))0 || geteuid != (uid_t(*)(void))0) { 
+  /* ... */ 
+} 
+
+```
+This code should not be diagnosed by an analyzer.
+
+## Noncompliant Code Example
+
+In this noncompliant code example, the function pointer `do_xyz` is implicitly compared unequal to 0:
+
+```cpp
+int do_xyz(void); 
+ 
+int f(void) {
+/* ... */
+  if (do_xyz) { 
+    return -1; /* Indicate failure */ 
+  }
+/* ... */
+  return 0;
+} 
+
+```
+
+## Compliant Solution
+
+In this compliant solution, the function `do_xyz()` is invoked and the return value is compared to 0:
+
+```cpp
+int do_xyz(void); 
+ 
+int f(void) {
+/* ... */ 
+  if (do_xyz()) { 
+    return -1; /* Indicate failure */
+  }
+/* ... */
+  return 0;  
+} 
+
+```
+
+## Risk Assessment
+
+Errors of omission can result in unintended program flow.
+
+<table> <tbody> <tr> <th> Recommendation </th> <th> Severity </th> <th> Likelihood </th> <th> Remediation Cost </th> <th> Priority </th> <th> Level </th> </tr> <tr> <td> EXP16-C </td> <td> Low </td> <td> Likely </td> <td> Medium </td> <td> <strong>P6</strong> </td> <td> <strong>L2</strong> </td> </tr> </tbody> </table>
+
+
+## Automated Detection
+
+<table> <tbody> <tr> <th> Tool </th> <th> Version </th> <th> Checker </th> <th> Description </th> </tr> <tr> <td> <a> Astrée </a> </td> <td> 24.04 </td> <td> <strong>function-name-constant-comparison</strong> </td> <td> Partially checked </td> </tr> <tr> <td> <a> Coverity </a> </td> <td> 2017.07 </td> <td> <strong>BAD_COMPARE</strong> </td> <td> Can detect the specific instance where the address of a function is compared against 0, such as in the case of <code>geteuid</code> versus <code>getuid()</code> in the implementation-specific details </td> </tr> <tr> <td> <a> GCC </a> </td> <td> 4.3.5 </td> <td> </td> <td> Can detect violations of this recommendation when the <code>-Wall</code> flag is used </td> </tr> <tr> <td> <a> Helix QAC </a> </td> <td> 2024.4 </td> <td> <strong>C0428, C3004, C3344</strong> </td> <td> </td> </tr> <tr> <td> <a> Klocwork </a> </td> <td> 2024.4 </td> <td> <strong>CWARN.NULLCHECK.FUNCNAMECWARN.FUNCADDR</strong> </td> <td> </td> </tr> <tr> <td> <a> LDRA tool suite </a> </td> <td> 9.7.1 </td> <td> <strong>99 S</strong> </td> <td> Partially implemented </td> </tr> <tr> <td> <a> Parasoft C/C++test </a> </td> <td> 2024.2 </td> <td> <strong>CERT_C-EXP16-a</strong> </td> <td> Function address should not be compared to zero </td> </tr> <tr> <td> <a> PC-lint Plus </a> </td> <td> 1.4 </td> <td> <strong>2440, 2441</strong> </td> <td> Partially supported: reports address of function, array, or variable directly or indirectly compared to null </td> </tr> <tr> <td> <a> PVS-Studio </a> </td> <td> 7.35 </td> <td> <strong><a>V516</a>, <a>V1058</a></strong> </td> <td> </td> </tr> <tr> <td> <a> RuleChecker </a> </td> <td> 24.04 </td> <td> <strong>function-name-constant-comparison</strong> </td> <td> Partially checked </td> </tr> </tbody> </table>
+
+
+## Related Vulnerabilities
+
+Search for [vulnerabilities](https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-vulnerability) resulting from the violation of this rule on the [CERT website](https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+EXP16-C).
+
+## Related Guidelines
+
+<table> <tbody> <tr> <td> <a> SEI CERT C++ Coding Standard </a> </td> <td> <a> VOID EXP16-CPP. Avoid conversions using void pointers </a> </td> </tr> <tr> <td> <a> ISO/IEC TR 24772:2013 </a> </td> <td> Likely incorrect expressions \[KOA\] </td> </tr> <tr> <td> <a> ISO/IEC TS 17961 </a> </td> <td> Comparing function addresses to zero \[funcaddr\] </td> </tr> <tr> <td> <a> MITRE CWE </a> </td> <td> <a> CWE-480 </a> , Use of incorrect operator <a> CWE-482 </a> , Comparing instead of assigning </td> </tr> </tbody> </table>
+
+
+## Bibliography
+
+<table> <tbody> <tr> <td> \[ <a> Hatton 1995 </a> \] </td> <td> Section 2.7.2, "Errors of Omission and Addition" </td> </tr> </tbody> </table>
+
+
+## Implementation notes
+
+None
+
+## References
+
+* CERT-C: [EXP16-C: Do not compare function pointers to constant values](https://wiki.sei.cmu.edu/confluence/display/c)
diff --git a/c/cert/src/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.ql b/c/cert/src/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.ql
new file mode 100644
index 0000000000..5f347d817a
--- /dev/null
+++ b/c/cert/src/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.ql
@@ -0,0 +1,73 @@
+/**
+ * @id c/cert/do-not-compare-function-pointers-to-constant-values
+ * @name EXP16-C: Do not compare function pointers to constant values
+ * @description Comparing function pointers to a constant value is not reliable and likely indicates
+ *              a programmer error.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/cert/id/exp16-c
+ *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
+ *       external/cert/obligation/recommendation
+ */
+
+import cpp
+import semmle.code.cpp.controlflow.IRGuards
+import codingstandards.c.cert
+import codingstandards.cpp.types.FunctionType
+import codingstandards.cpp.exprs.FunctionExprs
+import codingstandards.cpp.exprs.Guards
+
+final class FinalElement = Element;
+
+abstract class EffectivelyComparison extends FinalElement {
+  abstract string getExplanation();
+
+  abstract FunctionExpr getFunctionExpr();
+}
+
+final class FinalComparisonOperation = ComparisonOperation;
+
+class ExplicitComparison extends EffectivelyComparison, FinalComparisonOperation {
+  Expr constantExpr;
+  FunctionExpr funcExpr;
+
+  ExplicitComparison() {
+    funcExpr = getAnOperand() and
+    constantExpr = getAnOperand() and
+    exists(constantExpr.getValue()) and
+    not funcExpr = constantExpr and
+    not constantExpr.getExplicitlyConverted().getUnderlyingType() =
+      funcExpr.getExplicitlyConverted().getUnderlyingType()
+  }
+
+  override string getExplanation() { result = "$@ compared to constant value." }
+
+  override FunctionExpr getFunctionExpr() { result = funcExpr }
+}
+
+class ImplicitComparison extends EffectivelyComparison, GuardCondition {
+  ImplicitComparison() {
+    this instanceof FunctionExpr and
+    not getParent() instanceof ComparisonOperation
+  }
+
+  override string getExplanation() { result = "$@ undergoes implicit constant comparison." }
+
+  override FunctionExpr getFunctionExpr() { result = this }
+}
+
+from EffectivelyComparison comparison, FunctionExpr funcExpr, Element function, string funcName
+where
+  not isExcluded(comparison,
+    Expressions2Package::doNotCompareFunctionPointersToConstantValuesQuery()) and
+  funcExpr = comparison.getFunctionExpr() and
+  not exists(NullFunctionCallGuard nullGuard | nullGuard.getFunctionExpr() = funcExpr) and
+  function = funcExpr.getFunction() and
+  funcName = funcExpr.describe()
+select comparison, comparison.getExplanation(), function, funcName
diff --git a/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql b/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql
index bf8f99fd27..48b9487728 100644
--- a/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql
+++ b/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql
@@ -8,14 +8,18 @@
  * @problem.severity warning
  * @tags external/cert/id/exp30-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.SideEffect
-import codingstandards.cpp.dataflow.DataFlow
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /** Holds if the function's return value is derived from the `AliasParamter` p. */
diff --git a/c/cert/src/rules/EXP30-C/DependenceOnOrderOfScalarEvaluationForSideEffects.ql b/c/cert/src/rules/EXP30-C/DependenceOnOrderOfScalarEvaluationForSideEffects.ql
index c478a3d51e..51b505ec63 100644
--- a/c/cert/src/rules/EXP30-C/DependenceOnOrderOfScalarEvaluationForSideEffects.ql
+++ b/c/cert/src/rules/EXP30-C/DependenceOnOrderOfScalarEvaluationForSideEffects.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp30-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP32-C/DoNotAccessVolatileObjectWithNonVolatileReference.ql b/c/cert/src/rules/EXP32-C/DoNotAccessVolatileObjectWithNonVolatileReference.ql
index 47b94c5288..891b93bcda 100644
--- a/c/cert/src/rules/EXP32-C/DoNotAccessVolatileObjectWithNonVolatileReference.ql
+++ b/c/cert/src/rules/EXP32-C/DoNotAccessVolatileObjectWithNonVolatileReference.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp32-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP33-C/DoNotReadUninitializedMemory.ql b/c/cert/src/rules/EXP33-C/DoNotReadUninitializedMemory.ql
index ef59be1c10..94deea912e 100644
--- a/c/cert/src/rules/EXP33-C/DoNotReadUninitializedMemory.ql
+++ b/c/cert/src/rules/EXP33-C/DoNotReadUninitializedMemory.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/exp33-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP34-C/DoNotDereferenceNullPointers.ql b/c/cert/src/rules/EXP34-C/DoNotDereferenceNullPointers.ql
index 042e55dbfd..51b93c8000 100644
--- a/c/cert/src/rules/EXP34-C/DoNotDereferenceNullPointers.ql
+++ b/c/cert/src/rules/EXP34-C/DoNotDereferenceNullPointers.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp34-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.ql b/c/cert/src/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.ql
index 6a018ed8c4..3f7d9ae142 100644
--- a/c/cert/src/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.ql
+++ b/c/cert/src/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.ql
@@ -8,20 +8,23 @@
  * @problem.severity error
  * @tags external/cert/id/exp35-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.lifetimes.CLifetimes
+import codingstandards.c.Objects
 
 // Note: Undefined behavior is possible regardless of whether the accessed field from the returned
 // struct is an array or a scalar (i.e. arithmetic and pointer types) member, according to the standard.
-from FieldAccess fa, FunctionCall fc
+from FieldAccess fa, TemporaryObjectIdentity tempObject
 where
   not isExcluded(fa, InvalidMemory2Package::doNotModifyObjectsWithTemporaryLifetimeQuery()) and
-  not fa.getQualifier().isLValue() and
-  fa.getQualifier().getUnconverted() = fc and
-  fa.getQualifier().getUnconverted().getUnspecifiedType() instanceof StructOrUnionTypeWithArrayField
-select fa, "Field access on $@ qualifier occurs after its temporary object lifetime.", fc,
-  "function call"
+  fa.getQualifier().getUnconverted() = tempObject
+select fa, "Field access on $@ qualifier occurs after its temporary object lifetime.", tempObject,
+  "temporary object"
diff --git a/c/cert/src/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.ql b/c/cert/src/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.ql
index e5735a5fda..0d294e48b1 100644
--- a/c/cert/src/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.ql
+++ b/c/cert/src/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.ql
@@ -8,13 +8,18 @@
  * @problem.severity error
  * @tags external/cert/id/exp36-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Alignment
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 import ExprWithAlignmentToCStyleCastFlow::PathGraph
 
diff --git a/c/cert/src/rules/EXP37-C/CallPOSIXOpenWithCorrectArgumentCount.ql b/c/cert/src/rules/EXP37-C/CallPOSIXOpenWithCorrectArgumentCount.ql
index ad8520e321..a6e633d7f6 100644
--- a/c/cert/src/rules/EXP37-C/CallPOSIXOpenWithCorrectArgumentCount.ql
+++ b/c/cert/src/rules/EXP37-C/CallPOSIXOpenWithCorrectArgumentCount.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/exp37-c
  *       correctness
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.ql b/c/cert/src/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.ql
index e28dbddaaf..6d223dab72 100644
--- a/c/cert/src/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.ql
+++ b/c/cert/src/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.ql
@@ -8,12 +8,17 @@
  * @problem.severity error
  * @tags external/cert/id/exp37-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import SuspectFunctionPointerToCallFlow::PathGraph
 
 /**
diff --git a/c/cert/src/rules/EXP37-C/DoNotCallFunctionsWithIncompatibleArguments.ql b/c/cert/src/rules/EXP37-C/DoNotCallFunctionsWithIncompatibleArguments.ql
index e76c62ee2d..4c5ba57504 100644
--- a/c/cert/src/rules/EXP37-C/DoNotCallFunctionsWithIncompatibleArguments.ql
+++ b/c/cert/src/rules/EXP37-C/DoNotCallFunctionsWithIncompatibleArguments.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp37-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.ql b/c/cert/src/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.ql
index 825f85b0bd..856cad1d58 100644
--- a/c/cert/src/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.ql
+++ b/c/cert/src/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.ql
@@ -8,12 +8,17 @@
  * @problem.severity error
  * @tags external/cert/id/exp39-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.controlflow.Dominance
 import IndirectCastFlow::PathGraph
 
diff --git a/c/cert/src/rules/EXP40-C/DoNotModifyConstantObjects.ql b/c/cert/src/rules/EXP40-C/DoNotModifyConstantObjects.ql
index d79224435f..9d8e4b16d4 100644
--- a/c/cert/src/rules/EXP40-C/DoNotModifyConstantObjects.ql
+++ b/c/cert/src/rules/EXP40-C/DoNotModifyConstantObjects.ql
@@ -7,12 +7,17 @@
  * @problem.severity error
  * @tags external/cert/id/exp40-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import CastFlow::PathGraph
 import codingstandards.cpp.SideEffect
 
diff --git a/c/cert/src/rules/EXP42-C/DoNotComparePaddingData.ql b/c/cert/src/rules/EXP42-C/DoNotComparePaddingData.ql
index 9592ebfd30..4fb80352a3 100644
--- a/c/cert/src/rules/EXP42-C/DoNotComparePaddingData.ql
+++ b/c/cert/src/rules/EXP42-C/DoNotComparePaddingData.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp42-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP43-C/DoNotPassAliasedPointerToRestrictQualifiedParam.ql b/c/cert/src/rules/EXP43-C/DoNotPassAliasedPointerToRestrictQualifiedParam.ql
index 08121f8c2b..4aced57136 100644
--- a/c/cert/src/rules/EXP43-C/DoNotPassAliasedPointerToRestrictQualifiedParam.ql
+++ b/c/cert/src/rules/EXP43-C/DoNotPassAliasedPointerToRestrictQualifiedParam.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp43-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.ql b/c/cert/src/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.ql
index eac0f8826c..31618785d2 100644
--- a/c/cert/src/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.ql
+++ b/c/cert/src/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.ql
@@ -7,11 +7,16 @@
  * @problem.severity error
  * @tags external/cert/id/exp43-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.controlflow.Dominance
 import codingstandards.c.cert
 import codingstandards.cpp.Variable
diff --git a/c/cert/src/rules/EXP44-C/UnevaluatedOperandWithSideEffect.ql b/c/cert/src/rules/EXP44-C/UnevaluatedOperandWithSideEffect.ql
index 32d30a09ad..02d71b3497 100644
--- a/c/cert/src/rules/EXP44-C/UnevaluatedOperandWithSideEffect.ql
+++ b/c/cert/src/rules/EXP44-C/UnevaluatedOperandWithSideEffect.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp44-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP45-C/AssignmentsInSelectionStatements.ql b/c/cert/src/rules/EXP45-C/AssignmentsInSelectionStatements.ql
index f6e29eb28c..c831713486 100644
--- a/c/cert/src/rules/EXP45-C/AssignmentsInSelectionStatements.ql
+++ b/c/cert/src/rules/EXP45-C/AssignmentsInSelectionStatements.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp45-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/EXP46-C/DoNotUseABitwiseOperatorWithABooleanLikeOperand.ql b/c/cert/src/rules/EXP46-C/DoNotUseABitwiseOperatorWithABooleanLikeOperand.ql
index 040a8bb6ee..549e57236a 100644
--- a/c/cert/src/rules/EXP46-C/DoNotUseABitwiseOperatorWithABooleanLikeOperand.ql
+++ b/c/cert/src/rules/EXP46-C/DoNotUseABitwiseOperatorWithABooleanLikeOperand.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/exp46-c
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO30-C/ExcludeUserInputFromFormatStrings.ql b/c/cert/src/rules/FIO30-C/ExcludeUserInputFromFormatStrings.ql
index b9df838b06..81ecf56ccf 100644
--- a/c/cert/src/rules/FIO30-C/ExcludeUserInputFromFormatStrings.ql
+++ b/c/cert/src/rules/FIO30-C/ExcludeUserInputFromFormatStrings.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio30-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql b/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql
index 5784e820d9..78817d31e9 100644
--- a/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql
+++ b/c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio32-c
  *       correctness
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO34-C/DistinguishBetweenCharReadFromAFileAndEofOrWeof.ql b/c/cert/src/rules/FIO34-C/DistinguishBetweenCharReadFromAFileAndEofOrWeof.ql
index a55c2dbf29..01c13e642b 100644
--- a/c/cert/src/rules/FIO34-C/DistinguishBetweenCharReadFromAFileAndEofOrWeof.ql
+++ b/c/cert/src/rules/FIO34-C/DistinguishBetweenCharReadFromAFileAndEofOrWeof.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio34-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO34-C/EndOfFileCheckPortability.ql b/c/cert/src/rules/FIO34-C/EndOfFileCheckPortability.ql
index 274514e598..3336a059cd 100644
--- a/c/cert/src/rules/FIO34-C/EndOfFileCheckPortability.ql
+++ b/c/cert/src/rules/FIO34-C/EndOfFileCheckPortability.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/fio34-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO37-C/SuccessfulFgetsOrFgetwsMayReturnAnEmptyString.ql b/c/cert/src/rules/FIO37-C/SuccessfulFgetsOrFgetwsMayReturnAnEmptyString.ql
index 2dce0d465c..ad3a2c8192 100644
--- a/c/cert/src/rules/FIO37-C/SuccessfulFgetsOrFgetwsMayReturnAnEmptyString.ql
+++ b/c/cert/src/rules/FIO37-C/SuccessfulFgetsOrFgetwsMayReturnAnEmptyString.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/fio37-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
@@ -14,7 +19,7 @@ import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.FgetsErrorManagement
 import codingstandards.cpp.Dereferenced
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.DataFlow
 
 /*
  * CFG nodes that follows a successful call to `fgets`
diff --git a/c/cert/src/rules/FIO38-C/DoNotCopyAFileObject.ql b/c/cert/src/rules/FIO38-C/DoNotCopyAFileObject.ql
index e8e897009e..5b5a043395 100644
--- a/c/cert/src/rules/FIO38-C/DoNotCopyAFileObject.ql
+++ b/c/cert/src/rules/FIO38-C/DoNotCopyAFileObject.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio38-c
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO39-C/DoNotAlternatelyIOFromAStreamWithoutPositioning.ql b/c/cert/src/rules/FIO39-C/DoNotAlternatelyIOFromAStreamWithoutPositioning.ql
index 668a7d982e..09289d1f79 100644
--- a/c/cert/src/rules/FIO39-C/DoNotAlternatelyIOFromAStreamWithoutPositioning.ql
+++ b/c/cert/src/rules/FIO39-C/DoNotAlternatelyIOFromAStreamWithoutPositioning.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/fio39-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.ql b/c/cert/src/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.ql
index 69fb92a15c..9b0882ac66 100644
--- a/c/cert/src/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.ql
+++ b/c/cert/src/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/fio40-c
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
@@ -16,6 +21,7 @@ import cpp
 import codingstandards.cpp.FgetsErrorManagement
 import codingstandards.cpp.Dereferenced
 import codingstandards.c.cert
+import semmle.code.cpp.dataflow.DataFlow
 
 /*
  * Models calls to `memcpy` `strcpy` `strncpy` and their wrappers
diff --git a/c/cert/src/rules/FIO41-C/DoNotCallGetcAndPutcWithSideEffects.ql b/c/cert/src/rules/FIO41-C/DoNotCallGetcAndPutcWithSideEffects.ql
index 7fc1c11d26..5c7d759606 100644
--- a/c/cert/src/rules/FIO41-C/DoNotCallGetcAndPutcWithSideEffects.ql
+++ b/c/cert/src/rules/FIO41-C/DoNotCallGetcAndPutcWithSideEffects.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/fio41-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO42-C/CloseFilesWhenTheyAreNoLongerNeeded.ql b/c/cert/src/rules/FIO42-C/CloseFilesWhenTheyAreNoLongerNeeded.ql
index 3650fad82f..26f8aa239d 100644
--- a/c/cert/src/rules/FIO42-C/CloseFilesWhenTheyAreNoLongerNeeded.ql
+++ b/c/cert/src/rules/FIO42-C/CloseFilesWhenTheyAreNoLongerNeeded.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/fio42-c
  *       correctness
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql b/c/cert/src/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql
index 33a906136f..bc0a417bd0 100644
--- a/c/cert/src/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql
+++ b/c/cert/src/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql
@@ -7,12 +7,17 @@
  * @problem.severity error
  * @tags external/cert/id/fio44-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 class FgetposCall extends FunctionCall {
   FgetposCall() { this.getTarget().hasGlobalOrStdName("fgetpos") }
diff --git a/c/cert/src/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.ql b/c/cert/src/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.ql
index 2ddfa6cf4c..85369b502e 100644
--- a/c/cert/src/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.ql
+++ b/c/cert/src/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.ql
@@ -8,13 +8,18 @@
  * @tags external/cert/id/fio45-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.standardlibrary.FileAccess
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /**
diff --git a/c/cert/src/rules/FIO46-C/UndefinedBehaviorAccessingAClosedFile.ql b/c/cert/src/rules/FIO46-C/UndefinedBehaviorAccessingAClosedFile.ql
index 6bc284c2c7..dc52dca487 100644
--- a/c/cert/src/rules/FIO46-C/UndefinedBehaviorAccessingAClosedFile.ql
+++ b/c/cert/src/rules/FIO46-C/UndefinedBehaviorAccessingAClosedFile.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/fio46-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO47-C/UseValidSpecifiers.ql b/c/cert/src/rules/FIO47-C/UseValidSpecifiers.ql
index 2062cba2c4..8ed99d4541 100644
--- a/c/cert/src/rules/FIO47-C/UseValidSpecifiers.ql
+++ b/c/cert/src/rules/FIO47-C/UseValidSpecifiers.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio47-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO47-C/WrongNumberOfFormatArguments.ql b/c/cert/src/rules/FIO47-C/WrongNumberOfFormatArguments.ql
index a8b9e9fbac..7266f1fc7c 100644
--- a/c/cert/src/rules/FIO47-C/WrongNumberOfFormatArguments.ql
+++ b/c/cert/src/rules/FIO47-C/WrongNumberOfFormatArguments.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio47-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FIO47-C/WrongTypeFormatArguments.ql b/c/cert/src/rules/FIO47-C/WrongTypeFormatArguments.ql
index 66cbe409f6..00853abfbc 100644
--- a/c/cert/src/rules/FIO47-C/WrongTypeFormatArguments.ql
+++ b/c/cert/src/rules/FIO47-C/WrongTypeFormatArguments.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio47-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FLP30-C/FloatingPointLoopCounters.ql b/c/cert/src/rules/FLP30-C/FloatingPointLoopCounters.ql
index a26736707c..a042d80ba5 100644
--- a/c/cert/src/rules/FLP30-C/FloatingPointLoopCounters.ql
+++ b/c/cert/src/rules/FLP30-C/FloatingPointLoopCounters.ql
@@ -9,6 +9,11 @@
  *       maintainability
  *       readability
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.md b/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.md
index d6427b9081..ca24a02498 100644
--- a/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.md
+++ b/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.md
@@ -345,7 +345,7 @@ Independent( INT34-C, FLP32-C, INT33-C) CWE-682 = Union( FLP32-C, list) where li
 
 ## Implementation notes
 
-None
+This query identifies possible domain, pole and range errors on a selection of C standard library fuctions from math.h.
 
 ## References
 
diff --git a/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.ql b/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.ql
index fc054d7289..1e87aa3fae 100644
--- a/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.ql
+++ b/c/cert/src/rules/FLP32-C/UncheckedRangeDomainPoleErrors.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/flp32-c
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FLP34-C/UncheckedFloatingPointConversion.ql b/c/cert/src/rules/FLP34-C/UncheckedFloatingPointConversion.ql
index 4637985076..eebc16afe3 100644
--- a/c/cert/src/rules/FLP34-C/UncheckedFloatingPointConversion.ql
+++ b/c/cert/src/rules/FLP34-C/UncheckedFloatingPointConversion.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/flp34-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FLP36-C/IntToFloatPreservePrecision.ql b/c/cert/src/rules/FLP36-C/IntToFloatPreservePrecision.ql
index e3b98c61c5..81e5670b11 100644
--- a/c/cert/src/rules/FLP36-C/IntToFloatPreservePrecision.ql
+++ b/c/cert/src/rules/FLP36-C/IntToFloatPreservePrecision.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/flp36-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/FLP37-C/MemcmpUsedToCompareFloats.ql b/c/cert/src/rules/FLP37-C/MemcmpUsedToCompareFloats.ql
index 0e3031262e..8735a804fa 100644
--- a/c/cert/src/rules/FLP37-C/MemcmpUsedToCompareFloats.ql
+++ b/c/cert/src/rules/FLP37-C/MemcmpUsedToCompareFloats.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/flp37-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/INT30-C/UnsignedIntegerOperationsWrapAround.ql b/c/cert/src/rules/INT30-C/UnsignedIntegerOperationsWrapAround.ql
index 1c7ae3e31b..c893584a1e 100644
--- a/c/cert/src/rules/INT30-C/UnsignedIntegerOperationsWrapAround.ql
+++ b/c/cert/src/rules/INT30-C/UnsignedIntegerOperationsWrapAround.ql
@@ -10,6 +10,11 @@
  * @tags external/cert/id/int30-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/INT31-C/IntegerConversionCausesDataLoss.ql b/c/cert/src/rules/INT31-C/IntegerConversionCausesDataLoss.ql
index 51ae704461..203e60a9e3 100644
--- a/c/cert/src/rules/INT31-C/IntegerConversionCausesDataLoss.ql
+++ b/c/cert/src/rules/INT31-C/IntegerConversionCausesDataLoss.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/int31-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/INT32-C/SignedIntegerOverflow.md b/c/cert/src/rules/INT32-C/SignedIntegerOverflow.md
index dbe36775bf..50a9d01dcd 100644
--- a/c/cert/src/rules/INT32-C/SignedIntegerOverflow.md
+++ b/c/cert/src/rules/INT32-C/SignedIntegerOverflow.md
@@ -398,7 +398,8 @@ void func(signed long s_a) {
 }
 
 ```
-Risk Assessment
+
+## Risk Assessment
 
 Integer overflow can lead to buffer overflows and the execution of arbitrary code by an attacker.
 
diff --git a/c/cert/src/rules/INT32-C/SignedIntegerOverflow.ql b/c/cert/src/rules/INT32-C/SignedIntegerOverflow.ql
index 4c781c4e50..2edee2e5c6 100644
--- a/c/cert/src/rules/INT32-C/SignedIntegerOverflow.ql
+++ b/c/cert/src/rules/INT32-C/SignedIntegerOverflow.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/int32-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/INT33-C/DivOrRemByZero.ql b/c/cert/src/rules/INT33-C/DivOrRemByZero.ql
index a5e34f13c4..6090e8842a 100644
--- a/c/cert/src/rules/INT33-C/DivOrRemByZero.ql
+++ b/c/cert/src/rules/INT33-C/DivOrRemByZero.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/int33-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/INT34-C/ExprShiftedbyNegativeOrGreaterPrecisionOperand.ql b/c/cert/src/rules/INT34-C/ExprShiftedbyNegativeOrGreaterPrecisionOperand.ql
index d6445d4937..4260a5e677 100644
--- a/c/cert/src/rules/INT34-C/ExprShiftedbyNegativeOrGreaterPrecisionOperand.ql
+++ b/c/cert/src/rules/INT34-C/ExprShiftedbyNegativeOrGreaterPrecisionOperand.ql
@@ -7,6 +7,11 @@
  * @precision very-high
  * @problem.severity error
  * @tags external/cert/id/int34-c
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/INT35-C/UseCorrectIntegerPrecisions.ql b/c/cert/src/rules/INT35-C/UseCorrectIntegerPrecisions.ql
index cf510bf999..1bc372506d 100644
--- a/c/cert/src/rules/INT35-C/UseCorrectIntegerPrecisions.ql
+++ b/c/cert/src/rules/INT35-C/UseCorrectIntegerPrecisions.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/int35-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/INT36-C/ConvertingAPointerToIntegerOrIntegerToPointer.ql b/c/cert/src/rules/INT36-C/ConvertingAPointerToIntegerOrIntegerToPointer.ql
index 3052f0aadd..1cbdcc4e12 100644
--- a/c/cert/src/rules/INT36-C/ConvertingAPointerToIntegerOrIntegerToPointer.ql
+++ b/c/cert/src/rules/INT36-C/ConvertingAPointerToIntegerOrIntegerToPointer.ql
@@ -7,6 +7,11 @@
  * @precision very-high
  * @problem.severity error
  * @tags external/cert/id/int36-c
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MEM30-C/DoNotAccessFreedMemory.ql b/c/cert/src/rules/MEM30-C/DoNotAccessFreedMemory.ql
index 800ec103ff..59ab0df670 100644
--- a/c/cert/src/rules/MEM30-C/DoNotAccessFreedMemory.ql
+++ b/c/cert/src/rules/MEM30-C/DoNotAccessFreedMemory.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/mem30-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MEM31-C/FreeMemoryWhenNoLongerNeededCert.ql b/c/cert/src/rules/MEM31-C/FreeMemoryWhenNoLongerNeededCert.ql
index d4c81748a2..18e9478aee 100644
--- a/c/cert/src/rules/MEM31-C/FreeMemoryWhenNoLongerNeededCert.ql
+++ b/c/cert/src/rules/MEM31-C/FreeMemoryWhenNoLongerNeededCert.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/mem31-c
  *       correctness
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MEM33-C/AllocStructsWithAFlexibleArrayMemberDynamically.ql b/c/cert/src/rules/MEM33-C/AllocStructsWithAFlexibleArrayMemberDynamically.ql
index 620c4486a9..2ed5035ff0 100644
--- a/c/cert/src/rules/MEM33-C/AllocStructsWithAFlexibleArrayMemberDynamically.ql
+++ b/c/cert/src/rules/MEM33-C/AllocStructsWithAFlexibleArrayMemberDynamically.ql
@@ -8,12 +8,18 @@
  * @problem.severity error
  * @tags external/cert/id/mem33-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.c.Variable
+import codingstandards.c.Objects
 import semmle.code.cpp.models.interfaces.Allocation
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
@@ -21,7 +27,7 @@ abstract class FlexibleArrayAlloc extends Element {
   /**
    * Returns the `Variable` being allocated.
    */
-  abstract Variable getVariable();
+  abstract Element getReportElement();
 }
 
 /**
@@ -53,18 +59,26 @@ class FlexibleArrayStructDynamicAlloc extends FlexibleArrayAlloc, FunctionCall {
       )
   }
 
-  override Variable getVariable() { result = v }
+  override Element getReportElement() { result = v }
 }
 
 /**
  * A `Variable` of type `FlexibleArrayStructType` that is not allocated dynamically.
  */
-class FlexibleArrayNonDynamicAlloc extends FlexibleArrayAlloc, Variable {
+class FlexibleArrayNonDynamicAlloc extends FlexibleArrayAlloc {
+  ObjectIdentity object;
+
   FlexibleArrayNonDynamicAlloc() {
-    this.getUnspecifiedType().getUnspecifiedType() instanceof FlexibleArrayStructType
+    this = object and
+    not object.getStorageDuration().isAllocated() and
+    // Exclude temporaries. Though they should violate this rule, in practice these results are
+    // often spurious and redundant, such as (*x = *x) which creates an unused temporary object.
+    not object.hasTemporaryLifetime() and
+    object.getType().getUnspecifiedType() instanceof FlexibleArrayStructType and
+    not exists(Variable v | v.getInitializer().getExpr() = this)
   }
 
-  override Variable getVariable() { result = this }
+  override Element getReportElement() { result = object }
 }
 
 from FlexibleArrayAlloc alloc, string message
@@ -77,4 +91,4 @@ where
     alloc instanceof FlexibleArrayNonDynamicAlloc and
     message = "$@ contains a flexible array member but is not dynamically allocated."
   )
-select alloc, message, alloc.getVariable(), alloc.getVariable().getName()
+select alloc, message, alloc.getReportElement(), alloc.getReportElement().toString()
diff --git a/c/cert/src/rules/MEM33-C/CopyStructsWithAFlexibleArrayMemberDynamically.ql b/c/cert/src/rules/MEM33-C/CopyStructsWithAFlexibleArrayMemberDynamically.ql
index b4993e2cae..b4d2a9127b 100644
--- a/c/cert/src/rules/MEM33-C/CopyStructsWithAFlexibleArrayMemberDynamically.ql
+++ b/c/cert/src/rules/MEM33-C/CopyStructsWithAFlexibleArrayMemberDynamically.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/mem33-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MEM34-C/OnlyFreeMemoryAllocatedDynamicallyCert.ql b/c/cert/src/rules/MEM34-C/OnlyFreeMemoryAllocatedDynamicallyCert.ql
index 95da1cc86a..78081944be 100644
--- a/c/cert/src/rules/MEM34-C/OnlyFreeMemoryAllocatedDynamicallyCert.ql
+++ b/c/cert/src/rules/MEM34-C/OnlyFreeMemoryAllocatedDynamicallyCert.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/mem34-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MEM35-C/InsufficientMemoryAllocatedForObject.ql b/c/cert/src/rules/MEM35-C/InsufficientMemoryAllocatedForObject.ql
index 7683140327..06fd267560 100644
--- a/c/cert/src/rules/MEM35-C/InsufficientMemoryAllocatedForObject.ql
+++ b/c/cert/src/rules/MEM35-C/InsufficientMemoryAllocatedForObject.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/mem35-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
@@ -16,7 +21,7 @@ import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Overflow
 import semmle.code.cpp.controlflow.Guards
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.models.Models
 
 /**
diff --git a/c/cert/src/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.ql b/c/cert/src/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.ql
index 512b783030..90c34a44a2 100644
--- a/c/cert/src/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.ql
+++ b/c/cert/src/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.ql
@@ -9,13 +9,18 @@
  * @tags external/cert/id/mem36-c
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Alignment
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import AlignedAllocToReallocFlow::PathGraph
 
 int getStatedValue(Expr e) {
diff --git a/c/cert/src/rules/MSC30-C/RandUsedForGeneratingPseudorandomNumbers.ql b/c/cert/src/rules/MSC30-C/RandUsedForGeneratingPseudorandomNumbers.ql
index ed553b9814..722e6fff80 100644
--- a/c/cert/src/rules/MSC30-C/RandUsedForGeneratingPseudorandomNumbers.ql
+++ b/c/cert/src/rules/MSC30-C/RandUsedForGeneratingPseudorandomNumbers.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/msc30-c
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MSC32-C/ProperlySeedPseudorandomNumberGenerators.ql b/c/cert/src/rules/MSC32-C/ProperlySeedPseudorandomNumberGenerators.ql
index 2c3db87ee8..85623d9390 100644
--- a/c/cert/src/rules/MSC32-C/ProperlySeedPseudorandomNumberGenerators.ql
+++ b/c/cert/src/rules/MSC32-C/ProperlySeedPseudorandomNumberGenerators.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/msc32-c
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.ql b/c/cert/src/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.ql
index 52dd0b1046..67fa83e852 100644
--- a/c/cert/src/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.ql
+++ b/c/cert/src/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.ql
@@ -9,12 +9,17 @@
  * @tags external/cert/id/msc33-c
  *       security
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p27
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * The argument of a call to `asctime`
diff --git a/c/cert/src/rules/MSC37-C/ControlFlowReachesTheEndOfANonVoidFunction.ql b/c/cert/src/rules/MSC37-C/ControlFlowReachesTheEndOfANonVoidFunction.ql
index c56f3e48c1..265fc0af55 100644
--- a/c/cert/src/rules/MSC37-C/ControlFlowReachesTheEndOfANonVoidFunction.ql
+++ b/c/cert/src/rules/MSC37-C/ControlFlowReachesTheEndOfANonVoidFunction.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/msc37-c
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MSC38-C/DoNotTreatAPredefinedIdentifierAsObject.ql b/c/cert/src/rules/MSC38-C/DoNotTreatAPredefinedIdentifierAsObject.ql
index 76e9c4539f..828f86dd95 100644
--- a/c/cert/src/rules/MSC38-C/DoNotTreatAPredefinedIdentifierAsObject.ql
+++ b/c/cert/src/rules/MSC38-C/DoNotTreatAPredefinedIdentifierAsObject.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/msc38-c
  *       correctness
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql b/c/cert/src/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql
index 2fc334ba50..56613c1943 100644
--- a/c/cert/src/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql
+++ b/c/cert/src/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql
@@ -7,13 +7,18 @@
  * @problem.severity error
  * @tags external/cert/id/msc39-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Macro
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 abstract class VaAccess extends Expr { }
 
diff --git a/c/cert/src/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.md b/c/cert/src/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.md
new file mode 100644
index 0000000000..f767c91baf
--- /dev/null
+++ b/c/cert/src/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.md
@@ -0,0 +1,210 @@
+# MSC40-C: Do not violate inline linkage constraints
+
+This query implements the CERT-C rule MSC40-C:
+
+> Do not violate constraints
+
+
+## Description
+
+According to the C Standard, 3.8 \[[ISO/IEC 9899:2011](https://wiki.sei.cmu.edu/confluence/display/c/AA.+Bibliography#AA.Bibliography-ISO%2FIEC9899-2011)\], a constraint is a "restriction, either syntactic or semantic, by which the exposition of language elements is to be interpreted." Despite the similarity of the terms, a runtime constraint is not a kind of constraint.
+
+Violating any *shall* statement within a constraint clause in the C Standard requires an [implementation](https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-implementation) to issue a diagnostic message, the C Standard, 5.1.1.3 \[[ISO/IEC 9899:2011](https://wiki.sei.cmu.edu/confluence/display/c/AA.+Bibliography#AA.Bibliography-ISO%2FIEC9899-2011)\] states
+
+> A conforming implementation shall produce at least one diagnostic message (identified in an implementation-defined manner) if a preprocessing translation unit or translation unit contains a violation of any syntax rule or constraint, even if the behavior is also explicitly specified as undefined or implementation-defined. Diagnostic messages need not be produced in other circumstances.
+
+
+The C Standard further explains in a footnote
+
+> The intent is that an implementation should identify the nature of, and where possible localize, each violation. Of course, an implementation is free to produce any number of diagnostics as long as a valid program is still correctly translated. It may also successfully translate an invalid program.
+
+
+Any constraint violation is a violation of this rule because it can result in an invalid program.
+
+## Noncompliant Code Example (Inline, Internal Linkage)
+
+The C Standard, 6.7.4, paragraph 3 \[[ISO/IEC 9899:2011](https://wiki.sei.cmu.edu/confluence/display/c/AA.+Bibliography#AA.Bibliography-ISO%2FIEC9899-2011)\], states
+
+> An inline definition of a function with external linkage shall not contain a definition of a modifiable object with static or thread storage duration, and shall not contain a reference to an identifier with internal linkage.
+
+
+The motivation behind this constraint lies in the semantics of inline definitions. Paragraph 7 of subclause 6.7.4 reads, in part:
+
+> An inline definition provides an alternative to an external definition, which a translator may use to implement any call to the function in the same translation unit. It is unspecified whether a call to the function uses the inline definition or the external definition.
+
+
+That is, if a function has an external and inline definition, implementations are free to choose which definition to invoke (two distinct invocations of the function may call different definitions, one the external definition, the other the inline definition). Therefore, issues can arise when these definitions reference internally linked objects or mutable objects with static or thread storage duration.
+
+This noncompliant code example refers to a static variable with file scope and internal linkage from within an external inline function:
+
+```cpp
+static int I = 12;
+extern inline void func(int a) {
+  int b = a * I;
+  /* ... */
+}
+
+```
+
+## Compliant Solution (Inline, Internal Linkage)
+
+This compliant solution omits the `static` qualifier; consequently, the variable `I` has external linkage by default:
+
+```cpp
+int I = 12;
+extern inline void func(int a) {
+  int b = a * I;
+  /* ... */
+}
+
+```
+
+## Noncompliant Code Example (inline, Modifiable Static)
+
+This noncompliant code example defines a modifiable `static` variable within an `extern inline` function.
+
+```cpp
+extern inline void func(void) {
+  static int I = 12;
+  /* Perform calculations which may modify I */
+}
+
+```
+
+## Compliant Solution (Inline, Modifiable Static)
+
+This compliant solution removes the `static` keyword from the local variable definition. If the modifications to `I` must be retained between invocations of `func()`, it must be declared at file scope so that it will be defined with external linkage.
+
+```cpp
+extern inline void func(void) {
+  int I = 12;
+  /* Perform calculations which may modify I */
+}
+```
+
+## Noncompliant Code Example (Inline, Modifiable static)
+
+This noncompliant code example includes two translation units: `file1.c` and `file2.c`. The first file, `file1.c`, defines a pseudorandom number generation function:
+
+```cpp
+/* file1.c */
+
+/* Externally linked definition of the function get_random() */
+extern unsigned int get_random(void) {
+  /* Initialize the seeds */
+  static unsigned int m_z = 0xdeadbeef;
+  static unsigned int m_w = 0xbaddecaf;
+
+  /* Compute the next pseudorandom value and update the seeds */
+  m_z = 36969 * (m_z & 65535) + (m_z >> 16);
+  m_w = 18000 * (m_w & 65535) + (m_w >> 16);
+  return (m_z << 16) + m_w;
+}
+
+```
+The left-shift operation in the last line may wrap, but this is permitted by exception INT30-C-EX3 to rule [INT30-C. Ensure that unsigned integer operations do not wrap](https://wiki.sei.cmu.edu/confluence/display/c/INT30-C.+Ensure+that+unsigned+integer+operations+do+not+wrap).
+
+The second file, `file2.c`, defines an `inline` version of this function that references mutable `static` objects—namely, objects that maintain the state of the pseudorandom number generator. Separate invocations of the `get_random()` function can call different definitions, each operating on separate static objects, resulting in a faulty pseudorandom number generator.
+
+```cpp
+/* file2.c */
+
+/* Inline definition of get_random function */
+inline unsigned int get_random(void) {
+  /* 
+   * Initialize the seeds 
+   * Constraint violation: static duration storage referenced
+   * in non-static inline definition
+   */
+  static unsigned int m_z = 0xdeadbeef;
+  static unsigned int m_w = 0xbaddecaf;
+
+  /* Compute the next pseudorandom value and update the seeds */
+  m_z = 36969 * (m_z & 65535) + (m_z >> 16);
+  m_w = 18000 * (m_w & 65535) + (m_w >> 16);
+  return (m_z << 16) + m_w;
+}
+
+int main(void) {
+  unsigned int rand_no;
+  for (int ii = 0; ii < 100; ii++) {
+    /* 
+     * Get a pseudorandom number. Implementation defined whether the
+     * inline definition in this file or the external definition  
+     * in file2.c is called. 
+     */
+    rand_no = get_random();
+    /* Use rand_no... */
+  }
+
+  /* ... */
+
+  /* 
+   * Get another pseudorandom number. Behavior is
+   * implementation defined.
+   */
+  rand_no = get_random();
+  /* Use rand_no... */
+  return 0;
+}
+
+```
+
+## Compliant Solution (Inline, Modifiable static)
+
+This compliant solution adds the `static` modifier to the `inline` function definition in `file2.c`, giving it internal linkage. All references to `get_random()` in `file.2.c` will now reference the internally linked definition. The first file, which was not changed, is not shown here.
+
+```cpp
+/* file2.c */
+
+/* Static inline definition of get_random function */
+static inline unsigned int get_random(void) {
+  /* 
+   * Initialize the seeds. 
+   * No more constraint violation; the inline function is now 
+   * internally linked. 
+   */
+  static unsigned int m_z = 0xdeadbeef;
+  static unsigned int m_w = 0xbaddecaf;
+
+  /* Compute the next pseudorandom value and update the seeds  */
+  m_z = 36969 * (m_z & 65535) + (m_z >> 16);
+  m_w = 18000 * (m_w & 65535) + (m_w >> 16);
+  return (m_z << 16) + m_w;
+}
+
+int main(void) {
+  /* Generate pseudorandom numbers using get_random()... */
+  return 0;
+}
+
+```
+
+## Risk Assessment
+
+Constraint violations are a broad category of error that can result in unexpected control flow and corrupted data.
+
+<table> <tbody> <tr> <th> Rule </th> <th> Severity </th> <th> Likelihood </th> <th> Remediation Cost </th> <th> Priority </th> <th> Level </th> </tr> <tr> <td> MSC40-C </td> <td> Low </td> <td> Unlikely </td> <td> Medium </td> <td> <strong>P2</strong> </td> <td> <strong>L3</strong> </td> </tr> </tbody> </table>
+
+
+## Automated Detection
+
+<table> <tbody> <tr> <th> Tool </th> <th> Version </th> <th> Checker </th> <th> Description </th> </tr> <tr> <td> <a> Astrée </a> </td> <td> 23.04 </td> <td> <strong>alignas-extended</strong> <strong>assignment-to-non-modifiable-lvalue</strong> <strong>cast-pointer-void-arithmetic-implicit</strong> <strong>element-type-incomplete</strong> <strong>function-pointer-integer-cast-implicit</strong> <strong>function-return-type</strong> <strong>inappropriate-pointer-cast-implicit</strong> <strong>incompatible-function-pointer-conversion</strong> <strong>incompatible-object-pointer-conversion</strong> <strong>initializer-excess</strong> <strong>invalid-array-size</strong> <strong>non-constant-static-assert</strong> <strong>parameter-match-type</strong> <strong>pointer-integral-cast-implicit</strong> <strong>pointer-qualifier-cast-const-implicit</strong> <strong>pointer-qualifier-cast-volatile-implicit</strong> <strong>redeclaration</strong> <strong>return-empty</strong> <strong>return-non-empty</strong> <strong>static-assert</strong> <strong>type-compatibility</strong> <strong>type-compatibility-link</strong> <strong>type-specifier</strong> <strong>undeclared-parameter</strong> <strong>unnamed-parameter</strong> </td> <td> Partially checked </td> </tr> <tr> <td> <a> Helix QAC </a> </td> <td> 2023.4 </td> <td> <strong>C0232, C0233, C0244, C0268, C0321, C0322, C0338, C0422, C0423, C0426, C0427, C0429, C0430, C0431, C0432, C0435, C0436, C0437, C0446, C0447, C0448, C0449, C0451, C0452, C0453, C0454, C0456, C0457, C0458, C0460, C0461, C0462, C0463, C0466, C0467, C0468, C0469, C0476, C0477, C0478, C0481, C0482, C0483, C0484, C0485, C0486, C0487, C0493, C0494, C0495, C0496, C0497, C0513, C0514, C0515, C0536, C0537, C0540, C0541, C0542, C0546, C0547, C0550, C0554, C0555, C0556, C0557, C0558, C0559, C0560, C0561, C0562, C0563, C0564, C0565, C0580, C0588, C0589, C0590, C0591, C0605, C0616, C0619, C0620, C0621, C0622, C0627, C0628, C0629, C0631, C0638, C0640, C0641, C0642, C0643, C0644, C0645, C0646, C0649, C0650, C0651, C0653, C0655, C0656, C0657, C0659, C0664, C0665, C0669, C0671, C0673, C0674, C0675, C0677, C0682, C0683, C0684, C0685, C0690, C0698, C0699, C0708, C0709, C0736, C0737, C0738, C0746, C0747, C0755, C0756, C0757, C0758, C0766, C0767, C0768, C0774, C0775, C0801, C0802, C0803, C0804, C0811, C0821, C0834, C0835, C0844, C0845, C0851, C0852, C0866, C0873, C0877, C0940, C0941, C0943, C0944, C1023, C1024, C1025, C1033, C1047, C1048, C1050, C1061, C1062, C3236, C3237, C3238, C3244</strong> <strong>C++4122</strong> </td> <td> </td> </tr> <tr> <td> <a> Klocwork </a> </td> <td> 2023.4 </td> <td> <strong>MISRA.FUNC.STATIC.REDECL</strong> </td> <td> </td> </tr> <tr> <td> <a> LDRA tool suite </a> </td> <td> 9.7.1 </td> <td> <strong>21 S, 145 S, 323 S, 345 S, 387 S, 404 S, 481 S, 580 S, 612 S, 615 S, 646 S</strong> </td> <td> </td> </tr> <tr> <td> <a> Parasoft C/C++test </a> </td> <td> 2023.1 </td> <td> <strong>CERT_C-MSC40-a</strong> </td> <td> An inline definition of a function with external linkage shall not contain definitions and uses of static objects </td> </tr> <tr> <td> <a> Polyspace Bug Finder </a> </td> <td> </td> <td> <a> CERT C: Rule MSC40-C </a> </td> <td> Checks for inline constraint not respected (rule partially covered) </td> </tr> <tr> <td> <a> RuleChecker </a> </td> <td> 23.04 </td> <td> <strong>alignas-extended</strong> <strong>assignment-to-non-modifiable-lvalue</strong> <strong>cast-pointer-void-arithmetic-implicit</strong> <strong>element-type-incomplete</strong> <strong>function-pointer-integer-cast-implicit</strong> <strong>function-return-type</strong> <strong>inappropriate-pointer-cast-implicit</strong> <strong>incompatible-function-pointer-conversion</strong> <strong>incompatible-object-pointer-conversion</strong> <strong>initializer-excess</strong> <strong>invalid-array-size</strong> <strong>non-constant-static-assert</strong> <strong>parameter-match-type</strong> <strong>pointer-integral-cast-implicit</strong> <strong>pointer-qualifier-cast-const-implicit</strong> <strong>pointer-qualifier-cast-volatile-implicit</strong> <strong>redeclaration</strong> <strong>return-empty</strong> <strong>return-non-empty</strong> <strong>static-assert</strong> <strong>type-compatibility</strong> <strong>type-compatibility-link</strong> <strong>type-specifier</strong> <strong>undeclared-parameter</strong> <strong>unnamed-parameter</strong> </td> <td> Partially checked </td> </tr> </tbody> </table>
+
+
+## Related Vulnerabilities
+
+Search for [vulnerabilities](https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-vulnerability) resulting from the violation of this rule on the [CERT website](https://www.kb.cert.org/vulnotes/bymetric?searchview&query=FIELD+KEYWORDS+contains+MSC40-C).
+
+## Bibliography
+
+<table> <tbody> <tr> <td> \[ <a> ISO/IEC 9899:2011 </a> \] </td> <td> 4, "Conformance" 5.1.1.3, "Diagnostics" 6.7.4, "Function Specifiers" </td> </tr> </tbody> </table>
+
+
+## Implementation notes
+
+This query only considers the constraints related to inline extern functions.
+
+## References
+
+* CERT-C: [MSC40-C: Do not violate constraints](https://wiki.sei.cmu.edu/confluence/display/c)
diff --git a/c/cert/src/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.ql b/c/cert/src/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.ql
new file mode 100644
index 0000000000..746cea2e9f
--- /dev/null
+++ b/c/cert/src/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.ql
@@ -0,0 +1,64 @@
+/**
+ * @id c/cert/do-not-violate-in-line-linkage-constraints
+ * @name MSC40-C: Do not violate inline linkage constraints
+ * @description Inlined external functions are prohibited by the language standard from defining
+ *              modifiable static or thread storage objects, or referencing identifiers with
+ *              internal linkage.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/cert/id/msc40-c
+ *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
+ *       external/cert/obligation/rule
+ */
+
+import cpp
+import codingstandards.c.cert
+import codingstandards.cpp.Linkage
+
+/*
+ * This is C specific, because in C++ all extern function definitions must be identical.
+ * Only in C is it permitted for an extern function to be defined in multiple translation
+ * units with different implementations, when using the inline keyword.
+ */
+
+from Element accessOrDecl, Variable v, Function f, string message
+where
+  not isExcluded(f, ContractsPackage::doNotViolateInLineLinkageConstraintsQuery()) and
+  f.isInline() and
+  hasExternalLinkage(f) and
+  // Pre-emptively exclude compiler generated functions
+  not f.isCompilerGenerated() and
+  // This rule does not apply to C++, but exclude C++ specific cases anyway
+  not f instanceof MemberFunction and
+  not f.isFromUninstantiatedTemplate(_) and
+  (
+    // There exists a modifiable local variable which is static or thread local
+    exists(LocalVariable lsv, string storageModifier |
+      lsv.isStatic() and storageModifier = "Static"
+      or
+      lsv.isThreadLocal() and storageModifier = "Thread-local"
+    |
+      lsv.getFunction() = f and
+      not lsv.isConst() and
+      accessOrDecl = lsv and
+      message = storageModifier + " local variable $@ declared" and
+      v = lsv
+    )
+    or
+    // References an identifier with internal linkage
+    exists(GlobalOrNamespaceVariable gv |
+      accessOrDecl = v.getAnAccess() and
+      accessOrDecl.(VariableAccess).getEnclosingFunction() = f and
+      hasInternalLinkage(v) and
+      message = "Identifier $@ with internal linkage referenced" and
+      v = gv
+    )
+  )
+select accessOrDecl, message + " in the extern inlined function $@.", v, v.getName(), f,
+  f.getQualifiedName()
diff --git a/c/cert/src/rules/PRE31-C/SideEffectsInArgumentsToUnsafeMacros.ql b/c/cert/src/rules/PRE31-C/SideEffectsInArgumentsToUnsafeMacros.ql
index 4ae6619227..322048f6de 100644
--- a/c/cert/src/rules/PRE31-C/SideEffectsInArgumentsToUnsafeMacros.ql
+++ b/c/cert/src/rules/PRE31-C/SideEffectsInArgumentsToUnsafeMacros.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/pre31-c
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
@@ -15,7 +20,6 @@ import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Macro
 import codingstandards.cpp.SideEffect
-import codingstandards.cpp.StructuralEquivalence
 import codingstandards.cpp.sideeffect.DefaultEffects
 import codingstandards.cpp.sideeffect.Customizations
 import semmle.code.cpp.valuenumbering.HashCons
diff --git a/c/cert/src/rules/PRE32-C/MacroOrFunctionArgsContainHashToken.ql b/c/cert/src/rules/PRE32-C/MacroOrFunctionArgsContainHashToken.ql
index 9680bea813..0a777dc25d 100644
--- a/c/cert/src/rules/PRE32-C/MacroOrFunctionArgsContainHashToken.ql
+++ b/c/cert/src/rules/PRE32-C/MacroOrFunctionArgsContainHashToken.ql
@@ -10,6 +10,11 @@
  * @tags external/cert/id/pre32-c
  *       correctness
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql b/c/cert/src/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql
index 19730b4677..e5dc33f817 100644
--- a/c/cert/src/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql
+++ b/c/cert/src/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql
@@ -8,13 +8,18 @@
  * @tags external/cert/id/sig30-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.c.Signal
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * Does not access an external variable except
@@ -32,7 +37,7 @@ class AsyncSafeVariableAccess extends VariableAccess {
 abstract class AsyncSafeFunction extends Function { }
 
 /**
- * C standard library ayncronous-safe functions
+ * C standard library asynchronous-safe functions
  */
 class CAsyncSafeFunction extends AsyncSafeFunction {
   //tion, or the signal function with the first argument equal to the signal number corresponding to the signal that caused the invocation of the handler
@@ -40,7 +45,7 @@ class CAsyncSafeFunction extends AsyncSafeFunction {
 }
 
 /**
- * POSIX defined ayncronous-safe functions
+ * POSIX defined asynchronous-safe functions
  */
 class PosixAsyncSafeFunction extends AsyncSafeFunction {
   PosixAsyncSafeFunction() {
@@ -68,7 +73,7 @@ class PosixAsyncSafeFunction extends AsyncSafeFunction {
 }
 
 /**
- * Application defined ayncronous-safe functions
+ * Application defined asynchronous-safe functions
  */
 class ApplicationAsyncSafeFunction extends AsyncSafeFunction {
   pragma[nomagic]
@@ -117,5 +122,5 @@ where
     or
     fc instanceof AsyncUnsafeRaiseCall
   )
-select fc, "Asyncronous-unsafe function calls within a $@ can lead to undefined behavior.",
+select fc, "Asynchronous-unsafe function calls within a $@ can lead to undefined behavior.",
   handler.getRegistration(), "signal handler"
diff --git a/c/cert/src/rules/SIG31-C/DoNotAccessSharedObjectsInSignalHandlers.ql b/c/cert/src/rules/SIG31-C/DoNotAccessSharedObjectsInSignalHandlers.ql
index 2a7a6a77f2..eaa0a446b5 100644
--- a/c/cert/src/rules/SIG31-C/DoNotAccessSharedObjectsInSignalHandlers.ql
+++ b/c/cert/src/rules/SIG31-C/DoNotAccessSharedObjectsInSignalHandlers.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/sig31-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/SIG34-C/DoNotCallSignalFromInterruptibleSignalHandlers.ql b/c/cert/src/rules/SIG34-C/DoNotCallSignalFromInterruptibleSignalHandlers.ql
index d1eb773acb..0586c40c36 100644
--- a/c/cert/src/rules/SIG34-C/DoNotCallSignalFromInterruptibleSignalHandlers.ql
+++ b/c/cert/src/rules/SIG34-C/DoNotCallSignalFromInterruptibleSignalHandlers.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/sig34-c
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.ql b/c/cert/src/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.ql
index 5a064c0904..bd65019f98 100644
--- a/c/cert/src/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.ql
+++ b/c/cert/src/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.ql
@@ -8,13 +8,18 @@
  * @tags external/cert/id/sig35-c
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p1
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.c.Signal
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * CFG nodes preceeding a `ReturnStmt`
diff --git a/c/cert/src/rules/STR30-C/DoNotAttemptToModifyStringLiterals.ql b/c/cert/src/rules/STR30-C/DoNotAttemptToModifyStringLiterals.ql
index 40f19ed4a0..397e1bfc9e 100644
--- a/c/cert/src/rules/STR30-C/DoNotAttemptToModifyStringLiterals.ql
+++ b/c/cert/src/rules/STR30-C/DoNotAttemptToModifyStringLiterals.ql
@@ -8,13 +8,18 @@
  * @tags external/cert/id/str30-c
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import semmle.code.cpp.security.BufferWrite
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * Class that includes into `BufferWrite` functions that will modify their
diff --git a/c/cert/src/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.ql b/c/cert/src/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.ql
index 4e2e48708a..437b13f7f9 100644
--- a/c/cert/src/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.ql
+++ b/c/cert/src/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.ql
@@ -10,12 +10,17 @@
  * @tags external/cert/id/str31-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 
 /**
diff --git a/c/cert/src/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.ql b/c/cert/src/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.ql
index b5f246ca65..723c8ee0ea 100644
--- a/c/cert/src/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.ql
+++ b/c/cert/src/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.ql
@@ -9,13 +9,18 @@
  * @tags external/cert/id/str32-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.Naming
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
diff --git a/c/cert/src/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.ql b/c/cert/src/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.ql
index b0d4088f9f..d814951b37 100644
--- a/c/cert/src/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.ql
+++ b/c/cert/src/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.ql
@@ -9,23 +9,21 @@
  * @tags external/cert/id/str34-c
  *       correctness
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.c.cert
-import semmle.code.cpp.commons.CommonType
+import codingstandards.cpp.rules.castcharbeforeconvertingtolargersizes.CastCharBeforeConvertingToLargerSizes
 
-from Cast c
-where
-  not isExcluded(c, Strings3Package::castCharBeforeConvertingToLargerSizesQuery()) and
-  // find cases where there is a conversion happening wherein the
-  // base type is a char
-  c.getExpr().getType() instanceof CharType and
-  not c.getExpr().getType() instanceof UnsignedCharType and
-  // it's a bigger type
-  c.getType().getSize() > c.getExpr().getType().getSize() and
-  // and it's some kind of integer type
-  c.getType() instanceof IntegralType
-select c.getExpr(),
-  "Expression not converted to `unsigned char` before converting to a larger integer type."
+class CastCharBeforeConvertingToLargerSizesQuery extends CastCharBeforeConvertingToLargerSizesSharedQuery
+{
+  CastCharBeforeConvertingToLargerSizesQuery() {
+    this = Strings3Package::castCharBeforeConvertingToLargerSizesQuery()
+  }
+}
diff --git a/c/cert/src/rules/STR37-C/ToCharacterHandlingFunctionsRepresentableAsUChar.ql b/c/cert/src/rules/STR37-C/ToCharacterHandlingFunctionsRepresentableAsUChar.ql
index 8dda9012d2..a29dbd34b9 100644
--- a/c/cert/src/rules/STR37-C/ToCharacterHandlingFunctionsRepresentableAsUChar.ql
+++ b/c/cert/src/rules/STR37-C/ToCharacterHandlingFunctionsRepresentableAsUChar.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/str37-c
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/src/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.ql b/c/cert/src/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.ql
index a45f7ec7e1..58b2b1c7dd 100644
--- a/c/cert/src/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.ql
+++ b/c/cert/src/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/str38-c
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p27
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/c/cert/test/codeql-pack.lock.yml b/c/cert/test/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/c/cert/test/codeql-pack.lock.yml
+++ b/c/cert/test/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/c/cert/test/qlpack.yml b/c/cert/test/qlpack.yml
index a79ef5f692..9f5f21ba1b 100644
--- a/c/cert/test/qlpack.yml
+++ b/c/cert/test/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cert-c-coding-standards-tests
-version: 2.39.0-dev
+version: 2.49.0-dev
 extractor: cpp
 license: MIT
 dependencies:
diff --git a/c/cert/test/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.expected b/c/cert/test/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.expected
index 25153f195b..1617571bbe 100644
--- a/c/cert/test/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.expected
+++ b/c/cert/test/rules/ARR32-C/VariableLengthArraySizeNotInValidRange.expected
@@ -1,3 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (VariableLengthArraySizeNotInValidRange.ql:110,11-19)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (VariableLengthArraySizeNotInValidRange.ql:93,5-18)
 | test.c:14:8:14:8 | VLA declaration | Variable-length array dimension size may be in an invalid range. |
 | test.c:15:8:15:8 | VLA declaration | Variable-length array dimension size may be in an invalid range. |
 | test.c:16:8:16:8 | VLA declaration | Variable-length array dimension size may be in an invalid range. |
diff --git a/c/cert/test/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.expected b/c/cert/test/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.expected
index e5e0252e3a..fb0074e0e6 100644
--- a/c/cert/test/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.expected
+++ b/c/cert/test/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.expected
@@ -1,3 +1,8 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql:28,60-68)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql:29,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql:41,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql:49,26-34)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql:70,3-11)
 edges
 | test.c:14:38:14:39 | p1 | test.c:18:10:18:11 | v1 | provenance |  |
 | test.c:14:38:14:39 | p1 | test.c:19:10:19:11 | v2 | provenance |  |
diff --git a/c/cert/test/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.expected b/c/cert/test/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.expected
index bfd6b23128..0a6471deac 100644
--- a/c/cert/test/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.expected
+++ b/c/cert/test/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAddOrSubtractAScaledIntegerToAPointer.ql:77,56-64)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAddOrSubtractAScaledIntegerToAPointer.ql:78,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAddOrSubtractAScaledIntegerToAPointer.ql:80,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAddOrSubtractAScaledIntegerToAPointer.ql:89,45-53)
 edges
 | test.c:7:13:7:14 | p1 | test.c:9:9:9:10 | p1 | provenance |  |
 | test.c:16:19:16:41 | ... - ... | test.c:18:26:18:31 | offset | provenance |  |
diff --git a/c/cert/test/rules/CON30-C/CleanUpThreadSpecificStorage.expected b/c/cert/test/rules/CON30-C/CleanUpThreadSpecificStorage.expected
index e03b665a1c..f3ea87136a 100644
--- a/c/cert/test/rules/CON30-C/CleanUpThreadSpecificStorage.expected
+++ b/c/cert/test/rules/CON30-C/CleanUpThreadSpecificStorage.expected
@@ -1,3 +1,9 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CleanUpThreadSpecificStorage.ql:25,46-54)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CleanUpThreadSpecificStorage.ql:26,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CleanUpThreadSpecificStorage.ql:35,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CleanUpThreadSpecificStorage.ql:45,35-43)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CleanUpThreadSpecificStorage.ql:53,36-44)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CleanUpThreadSpecificStorage.ql:55,36-44)
 | test.c:27:3:27:12 | call to tss_create | Resources used by thread specific storage may not be cleaned up. |
 | test.c:49:3:49:12 | call to tss_create | Resources used by thread specific storage may not be cleaned up. |
 | test.c:71:3:71:12 | call to tss_create | Resources used by thread specific storage may not be cleaned up. |
diff --git a/c/cert/test/rules/CON34-C/AppropriateThreadObjectStorageDurations.expected b/c/cert/test/rules/CON34-C/AppropriateThreadObjectStorageDurations.expected
index c3cdc8bd7b..2cd844f81b 100644
--- a/c/cert/test/rules/CON34-C/AppropriateThreadObjectStorageDurations.expected
+++ b/c/cert/test/rules/CON34-C/AppropriateThreadObjectStorageDurations.expected
@@ -1,3 +1,16 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:35,14-22)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:37,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:39,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:42,45-53)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:52,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:52,58-66)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:53,42-50)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:56,9-17)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:56,34-42)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:57,9-17)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:57,34-42)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:42,9-22)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (AppropriateThreadObjectStorageDurations.ql:52,7-20)
 | test.c:23:3:23:13 | call to thrd_create | $@ not declared with appropriate storage duration | test.c:23:24:23:29 | & ... | Shared object |
 | test.c:74:3:74:13 | call to thrd_create | $@ not declared with appropriate storage duration | test.c:74:24:74:24 | p | Shared object |
 | test.c:85:3:85:13 | call to thrd_create | $@ not declared with appropriate storage duration | test.c:85:24:85:24 | p | Shared object |
diff --git a/c/cert/test/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.expected b/c/cert/test/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.expected
index 95d0a20041..b2ac853fbf 100644
--- a/c/cert/test/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.expected
+++ b/c/cert/test/rules/CON34-C/ThreadObjectStorageDurationsNotInitialized.expected
@@ -1 +1,6 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ThreadObjectStorageDurationsNotInitialized.ql:32,38-46)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ThreadObjectStorageDurationsNotInitialized.ql:35,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ThreadObjectStorageDurationsNotInitialized.ql:35,30-38)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ThreadObjectStorageDurationsNotInitialized.ql:36,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ThreadObjectStorageDurationsNotInitialized.ql:36,30-38)
 | test.c:14:7:14:13 | call to tss_get | Call to a thread specific storage function from within a threaded context on an object that may not be owned by this thread. |
diff --git a/c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.qlref b/c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.qlref
deleted file mode 100644
index 5daa5a5046..0000000000
--- a/c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.qlref
+++ /dev/null
@@ -1 +0,0 @@
-rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.ql
\ No newline at end of file
diff --git a/c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.testref b/c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.testref
new file mode 100644
index 0000000000..61fa88fd08
--- /dev/null
+++ b/c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.testref
@@ -0,0 +1 @@
+c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.ql
\ No newline at end of file
diff --git a/c/cert/test/rules/CON40-C/AtomicVariableTwiceInExpression.expected b/c/cert/test/rules/CON40-C/AtomicVariableTwiceInExpression.expected
index ddff311b59..42d3ea924d 100644
--- a/c/cert/test/rules/CON40-C/AtomicVariableTwiceInExpression.expected
+++ b/c/cert/test/rules/CON40-C/AtomicVariableTwiceInExpression.expected
@@ -1,6 +1,6 @@
 | test.c:7:18:7:39 | ATOMIC_VAR_INIT(value) | Atomic variable possibly referred to twice in an $@. | test.c:33:3:33:10 | ... += ... | expression |
 | test.c:7:18:7:39 | ATOMIC_VAR_INIT(value) | Atomic variable possibly referred to twice in an $@. | test.c:34:3:34:13 | ... = ... | expression |
-| test.c:11:3:11:23 | atomic_store(a,b) | Atomic variable possibly referred to twice in an $@. | test.c:11:3:11:23 | atomic_store(a,b) | expression |
-| test.c:12:3:12:35 | atomic_store_explicit(a,b,c) | Atomic variable possibly referred to twice in an $@. | test.c:12:3:12:35 | atomic_store_explicit(a,b,c) | expression |
-| test.c:25:3:25:49 | atomic_compare_exchange_weak(a,b,c) | Atomic variable possibly referred to twice in an $@. | test.c:25:3:25:49 | atomic_compare_exchange_weak(a,b,c) | expression |
-| test.c:26:3:27:42 | atomic_compare_exchange_weak_explicit(a,b,c,d,e) | Atomic variable possibly referred to twice in an $@. | test.c:26:3:27:42 | atomic_compare_exchange_weak_explicit(a,b,c,d,e) | expression |
+| test.c:11:3:11:23 | atomic_store(object,desired) | Atomic variable possibly referred to twice in an $@. | test.c:11:3:11:23 | atomic_store(object,desired) | expression |
+| test.c:12:3:12:23 | atomic_store_explicit | Atomic variable possibly referred to twice in an $@. | test.c:12:3:12:23 | atomic_store_explicit | expression |
+| test.c:25:3:25:49 | atomic_compare_exchange_weak(object,expected,desired) | Atomic variable possibly referred to twice in an $@. | test.c:25:3:25:49 | atomic_compare_exchange_weak(object,expected,desired) | expression |
+| test.c:26:3:26:39 | atomic_compare_exchange_weak_explicit | Atomic variable possibly referred to twice in an $@. | test.c:26:3:26:39 | atomic_compare_exchange_weak_explicit | expression |
diff --git a/c/cert/test/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.expected b/c/cert/test/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.expected
index 0c1e25cd00..b1c224173e 100644
--- a/c/cert/test/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.expected
+++ b/c/cert/test/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.expected
@@ -1,4 +1,4 @@
-| test.c:6:8:6:46 | atomic_compare_exchange_weak(a,b,c) | Function that can spuriously fail not wrapped in a loop. |
-| test.c:10:3:10:41 | atomic_compare_exchange_weak(a,b,c) | Function that can spuriously fail not wrapped in a loop. |
-| test.c:12:8:13:47 | atomic_compare_exchange_weak_explicit(a,b,c,d,e) | Function that can spuriously fail not wrapped in a loop. |
-| test.c:17:3:17:56 | atomic_compare_exchange_weak_explicit(a,b,c,d,e) | Function that can spuriously fail not wrapped in a loop. |
+| test.c:6:8:6:46 | atomic_compare_exchange_weak(object,expected,desired) | Function that can spuriously fail not wrapped in a loop. |
+| test.c:10:3:10:41 | atomic_compare_exchange_weak(object,expected,desired) | Function that can spuriously fail not wrapped in a loop. |
+| test.c:12:8:12:44 | atomic_compare_exchange_weak_explicit | Function that can spuriously fail not wrapped in a loop. |
+| test.c:17:3:17:39 | atomic_compare_exchange_weak_explicit | Function that can spuriously fail not wrapped in a loop. |
diff --git a/c/cert/test/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.expected b/c/cert/test/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.expected
index ff842ddcad..a4359d7000 100644
--- a/c/cert/test/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.expected
+++ b/c/cert/test/rules/DCL30-C/AppropriateStorageDurationsFunctionReturn.expected
@@ -1,2 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateStorageDurationsFunctionReturn.ql:33,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateStorageDurationsFunctionReturn.ql:37,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateStorageDurationsFunctionReturn.ql:50,6-14)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateStorageDurationsFunctionReturn.ql:50,26-34)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AppropriateStorageDurationsFunctionReturn.ql:56,3-11)
 | test.c:3:10:3:10 | a | $@ with automatic storage may be accessible outside of its lifetime. | test.c:3:10:3:10 | a | a |
 | test.c:15:4:15:8 | param [inner post update] | $@ with automatic storage may be accessible outside of its lifetime. | test.c:15:12:15:13 | a2 | a2 |
diff --git a/c/cert/test/rules/ERR30-C/ErrnoReadBeforeReturn.expected b/c/cert/test/rules/ERR30-C/ErrnoReadBeforeReturn.expected
index b6d7caa513..125f55118b 100644
--- a/c/cert/test/rules/ERR30-C/ErrnoReadBeforeReturn.expected
+++ b/c/cert/test/rules/ERR30-C/ErrnoReadBeforeReturn.expected
@@ -1,3 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ErrnoReadBeforeReturn.ql:46,7-15)
 | test.c:69:7:69:11 | * ... | Do not read `errno` before checking the return value of function $@. | test.c:68:3:68:7 | call to ftell | call to ftell |
 | test.c:69:7:69:11 | call to __errno_location | Do not read `errno` before checking the return value of function $@. | test.c:68:3:68:7 | call to ftell | call to ftell |
 | test.c:70:5:70:10 | call to perror | Do not read `errno` before checking the return value of function $@. | test.c:68:3:68:7 | call to ftell | call to ftell |
diff --git a/c/cert/test/rules/ERR30-C/SetlocaleMightSetErrno.expected b/c/cert/test/rules/ERR30-C/SetlocaleMightSetErrno.expected
index 9ab88a3395..20a7ff60b1 100644
--- a/c/cert/test/rules/ERR30-C/SetlocaleMightSetErrno.expected
+++ b/c/cert/test/rules/ERR30-C/SetlocaleMightSetErrno.expected
@@ -1,2 +1,3 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (SetlocaleMightSetErrno.ql:70,7-15)
 | test.c:98:3:98:11 | call to setlocale | Do not read `errno` before checking the return value of a call to `setlocale`. |
 | test.c:104:7:104:15 | call to setlocale | The value of `errno` may be different than `0` when `setlocale` is called. The following `errno` check might be invalid. |
diff --git a/c/cert/test/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.expected b/c/cert/test/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.expected
index da9122cfd4..b79a17ca35 100644
--- a/c/cert/test/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.expected
+++ b/c/cert/test/rules/ERR32-C/DoNotRelyOnIndeterminateValuesOfErrno.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotRelyOnIndeterminateValuesOfErrno.ql:56,7-15)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotRelyOnIndeterminateValuesOfErrno.ql:56,27-35)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotRelyOnIndeterminateValuesOfErrno.ql:57,9-17)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotRelyOnIndeterminateValuesOfErrno.ql:60,9-17)
 | test.c:12:5:12:10 | call to perror | `errno` has indeterminate value after this $@. | test.c:10:21:10:26 | call to signal | call to signal |
 | test.c:30:5:30:10 | call to perror | `errno` has indeterminate value after this $@. | test.c:26:21:26:26 | call to signal | call to signal |
 | test.c:49:5:49:10 | call to perror | `errno` has indeterminate value after this $@. | test.c:45:21:45:26 | call to signal | call to signal |
diff --git a/c/cert/test/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.expected b/c/cert/test/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.expected
index fbcc44b856..f4006c013e 100644
--- a/c/cert/test/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.expected
+++ b/c/cert/test/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.expected
@@ -1,3 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleStandardLibraryErrors.ql:459,5-13)
 | test.c:18:3:18:11 | call to setlocale | Missing error detection for the call to function `setlocale`. |
 | test.c:24:23:24:31 | call to setlocale | Missing error detection for the call to function `setlocale`. |
 | test.c:29:22:29:27 | call to calloc | Missing error detection for the call to function `calloc`. |
diff --git a/c/cert/test/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.expected b/c/cert/test/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.expected
new file mode 100644
index 0000000000..403d211651
--- /dev/null
+++ b/c/cert/test/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.expected
@@ -0,0 +1,20 @@
+| test.c:17:7:17:13 | ... == ... | $@ compared to constant value. | test.c:3:5:3:6 | f1 | Address of function f1 |
+| test.c:20:7:20:12 | ... > ... | $@ compared to constant value. | test.c:3:5:3:6 | f1 | Address of function f1 |
+| test.c:29:7:29:13 | ... == ... | $@ compared to constant value. | test.c:4:8:4:9 | g1 | Function pointer variable g1 |
+| test.c:32:7:32:16 | ... == ... | $@ compared to constant value. | test.c:5:7:5:8 | g2 | Function pointer variable g2 |
+| test.c:35:7:35:15 | ... != ... | $@ compared to constant value. | test.c:4:8:4:9 | g1 | Function pointer variable g1 |
+| test.c:38:7:38:8 | f1 | $@ undergoes implicit constant comparison. | test.c:3:5:3:6 | f1 | Address of function f1 |
+| test.c:41:7:41:8 | g1 | $@ undergoes implicit constant comparison. | test.c:4:8:4:9 | g1 | Function pointer variable g1 |
+| test.c:68:7:68:27 | ... == ... | $@ compared to constant value. | test.c:3:5:3:6 | f1 | Address of function f1 |
+| test.c:71:7:71:18 | ... == ... | $@ compared to constant value. | test.c:3:5:3:6 | f1 | Address of function f1 |
+| test.c:74:7:76:14 | ... == ... | $@ compared to constant value. | test.c:3:5:3:6 | f1 | Address of function f1 |
+| test.c:83:3:83:9 | ... == ... | $@ compared to constant value. | test.c:82:10:82:11 | l1 | Function pointer variable l1 |
+| test.c:84:3:84:12 | ... == ... | $@ compared to constant value. | test.c:82:10:82:11 | l1 | Function pointer variable l1 |
+| test.c:91:3:91:4 | g1 | $@ undergoes implicit constant comparison. | test.c:4:8:4:9 | g1 | Function pointer variable g1 |
+| test.c:96:7:96:18 | ... == ... | $@ compared to constant value. | test.c:9:9:9:10 | fp | Function pointer variable fp |
+| test.c:102:7:102:22 | ... == ... | $@ compared to constant value. | test.c:14:11:14:21 | get_handler | Address of function get_handler |
+| test.c:105:7:105:24 | ... == ... | $@ compared to constant value. | test.c:105:7:105:17 | call to get_handler | Expression with function pointer type |
+| test.c:121:7:121:13 | ... != ... | $@ compared to constant value. | test.c:3:5:3:6 | f1 | Address of function f1 |
+| test.c:133:7:133:13 | ... != ... | $@ compared to constant value. | test.c:4:8:4:9 | g1 | Function pointer variable g1 |
+| test.c:139:7:139:13 | ... == ... | $@ compared to constant value. | test.c:4:8:4:9 | g1 | Function pointer variable g1 |
+| test.c:149:8:149:9 | g1 | $@ undergoes implicit constant comparison. | test.c:4:8:4:9 | g1 | Function pointer variable g1 |
diff --git a/c/cert/test/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.qlref b/c/cert/test/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.qlref
new file mode 100644
index 0000000000..7d99fa9879
--- /dev/null
+++ b/c/cert/test/rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.qlref
@@ -0,0 +1 @@
+rules/EXP16-C/DoNotCompareFunctionPointersToConstantValues.ql
\ No newline at end of file
diff --git a/c/cert/test/rules/EXP16-C/test.c b/c/cert/test/rules/EXP16-C/test.c
new file mode 100644
index 0000000000..16dfea9bc2
--- /dev/null
+++ b/c/cert/test/rules/EXP16-C/test.c
@@ -0,0 +1,153 @@
+#include <stdlib.h>
+
+int f1();
+void (*g1)(void);
+int (*g2)(int);
+void *g3 = NULL;
+
+struct S {
+  int (*fp)(void);
+  int x;
+};
+
+typedef int (*handler_t)(void);
+handler_t get_handler(void);
+
+void f2(void) {
+  if (f1 == 0) // NON-COMPLIANT
+    return;
+
+  if (f1 > 0) // NON-COMPLIANT
+    return;
+
+  if (f1() == 0) // COMPLIANT
+    return;
+
+  if (f1() > 0) // COMPLIANT
+    return;
+
+  if (g1 == 0) // NON-COMPLIANT
+    return;
+
+  if (g2 == NULL) // NON-COMPLIANT
+    return;
+
+  if (g1 != 0x0) // NON-COMPLIANT
+    return;
+
+  if (f1) // NON-COMPLIANT - implicit comparison
+    return;
+
+  if (g1) // NON-COMPLIANT - implicit comparison
+    return;
+}
+
+void f3(void *p1) {
+  if (g1 == p1) // COMPLIANT - comparing to variable
+    return;
+
+  if (g2 == g3) // COMPLIANT - comparing to variable
+    return;
+}
+
+void f4(void) {
+  int (*l1)(void) = 0;
+
+  if (f1 == f1) // COMPLIANT - comparing to constant value of same type
+    return;
+
+  if (f1 == l1) // COMPLIANT - comparing to constant value of same type
+    return;
+
+  if (f1 == (int (*)(void))0) // COMPLIANT - explicit cast
+    return;
+
+  if (f1 == (int (*)(void))0) // COMPLIANT - explicit cast
+    return;
+
+  if (f1 == (int (*)(int))0) // NON-COMPLIANT - explicit cast to wrong type
+    return;
+
+  if (f1 == (int)0) // NON-COMPLIANT - cast to non-function pointer type
+    return;
+
+  if (f1 ==
+      (int)(int (*)(void))
+          NULL) // NON-COMPLIANT - compliant cast subsumed by non-compliant cast
+    return;
+}
+
+typedef void (*func_t)(void);
+void f5(void) {
+  func_t l1 = g1;
+  l1 == 0;         // NON-COMPLIANT
+  l1 == NULL;      // NON-COMPLIANT
+  l1 == (func_t)0; // COMPLIANT - cast to function pointer type
+}
+
+void f6(void) {
+  g1 + 0;     // COMPLIANT - not a comparison
+  g1 == g2;   // COMPLIANT - not comparing to constant
+  g1 ? 1 : 0; // NON-COMPLIANT - implicit comparison
+}
+
+void f7(void) {
+  struct S s;
+  if (s.fp == NULL) // NON-COMPLIANT
+    f1();
+
+  if (s.fp() == NULL) // COMPLIANT
+    return;
+
+  if (get_handler == 0) // NON-COMPLIANT - missing parentheses
+    return;
+
+  if (get_handler() == 0) // NON-COMPLIANT
+    return;
+
+  if (get_handler() == (handler_t)0) // COMPLIANT
+    return;
+
+  if (get_handler()() == 0) // COMPLIANT
+    return;
+}
+
+void f8(void) {
+  // Test instances of where the function pointer check is used to guard calls
+  // to that function.
+
+  // Technically, this function may perhaps be set to NULL by the linker. But
+  // it is not a variable that should need to be null-checked at runtime.
+  if (f1 != 0) // NON-COMPLIANT
+  {
+    f1();
+  }
+
+  // Check guards a call, so it is compliant.
+  if (g1 != 0) // COMPLIANT
+  {
+    g1();
+  }
+
+  // Incorrect check, not compliant.
+  if (g1 != 0) // NON-COMPLIANT
+  {
+    f1();
+  }
+
+  // Incorrect check, not compliant.
+  if (g1 == 0) // NON-COMPLIANT
+  {
+    g1();
+  }
+
+  if (g1) // COMPLIANT
+  {
+    g1();
+  }
+
+  if (!g1) // NON-COMPLIANT
+  {
+    g1();
+  }
+}
\ No newline at end of file
diff --git a/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected b/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected
index 3ea1a05fd7..034f7e9366 100644
--- a/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected
+++ b/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected
@@ -1 +1,25 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:28,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:28,59-67)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:31,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:31,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:35,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:35,59-67)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:44,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:44,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:44,53-61)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:47,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:47,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:56,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:56,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:63,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:63,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:75,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:75,55-63)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:28,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:31,7-20)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:35,7-20)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:47,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:56,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:63,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:75,5-18)
 | test.c:20:3:20:4 | call to f1 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.c:20:6:20:7 | call to f2 | call to f2 | test.c:20:12:20:13 | call to f3 | call to f3 |
diff --git a/c/cert/test/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.expected b/c/cert/test/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.expected
index f14ab4de4a..3fb10f3267 100644
--- a/c/cert/test/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.expected
+++ b/c/cert/test/rules/EXP35-C/DoNotModifyObjectsWithTemporaryLifetime.expected
@@ -1,4 +1,4 @@
-| test.c:65:18:65:18 | a | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:65:9:65:14 | call to get_s1 | function call |
-| test.c:67:18:67:19 | s1 | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:67:9:67:14 | call to get_s3 | function call |
-| test.c:68:18:68:19 | i1 | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:68:9:68:14 | call to get_s3 | function call |
-| test.c:69:18:69:21 | af12 | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:69:9:69:14 | call to get_s4 | function call |
+| test.c:65:18:65:18 | a | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:65:9:65:14 | call to get_s1 | temporary object |
+| test.c:67:18:67:19 | s1 | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:67:9:67:14 | call to get_s3 | temporary object |
+| test.c:68:18:68:19 | i1 | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:68:9:68:14 | call to get_s3 | temporary object |
+| test.c:69:18:69:21 | af12 | Field access on $@ qualifier occurs after its temporary object lifetime. | test.c:69:9:69:14 | call to get_s4 | temporary object |
diff --git a/c/cert/test/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.expected b/c/cert/test/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.expected
index c4bc63cc94..eb7642ae28 100644
--- a/c/cert/test/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.expected
+++ b/c/cert/test/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.expected
@@ -1,3 +1,13 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:103,86-94)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:125,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:127,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:132,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:138,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:144,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:145,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:147,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:154,26-34)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCastPointerToMoreStrictlyAlignedPointerType.ql:169,44-52)
 edges
 | test.c:75:14:75:16 | & ... | test.c:76:11:76:12 | v1 | provenance |  |
 | test.c:75:14:75:16 | & ... | test.c:77:12:77:13 | v1 | provenance |  |
diff --git a/c/cert/test/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.expected b/c/cert/test/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.expected
index 546c753ebb..8daaf8361a 100644
--- a/c/cert/test/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.expected
+++ b/c/cert/test/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallFunctionPointerWithIncompatibleType.ql:45,54-62)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallFunctionPointerWithIncompatibleType.ql:46,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallFunctionPointerWithIncompatibleType.ql:50,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallFunctionPointerWithIncompatibleType.ql:55,43-51)
 edges
 | test.c:48:68:48:70 | fns [f1] | test.c:49:3:49:5 | fns [f1] | provenance |  |
 | test.c:49:3:49:5 | fns [f1] | test.c:49:8:49:9 | f1 | provenance |  |
diff --git a/c/cert/test/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.expected b/c/cert/test/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.expected
index 137017d53a..381e409d2a 100644
--- a/c/cert/test/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.expected
+++ b/c/cert/test/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.expected
@@ -1,3 +1,10 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:66,38-46)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:69,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:74,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:107,23-31)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:116,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:116,45-53)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:138,27-35)
 edges
 | test.c:49:8:49:9 | s3 | test.c:50:8:50:9 | s1 | provenance |  |
 | test.c:60:16:60:18 | E1A | test.c:61:16:61:17 | e1 | provenance |  |
@@ -9,7 +16,7 @@ edges
 | test.c:97:32:97:37 | call to malloc | test.c:98:40:98:41 | s2 | provenance |  |
 | test.c:98:32:98:38 | call to realloc | test.c:99:3:99:4 | s3 | provenance |  |
 | test.c:98:32:98:38 | call to realloc | test.c:100:10:100:11 | s3 | provenance |  |
-| test.c:98:40:98:41 | s2 | test.c:98:32:98:38 | call to realloc | provenance |  |
+| test.c:98:40:98:41 | s2 | test.c:98:32:98:38 | call to realloc | provenance | Config |
 nodes
 | test.c:6:19:6:20 | & ... | semmle.label | & ... |
 | test.c:11:10:11:11 | & ... | semmle.label | & ... |
diff --git a/c/cert/test/rules/EXP40-C/DoNotModifyConstantObjects.expected b/c/cert/test/rules/EXP40-C/DoNotModifyConstantObjects.expected
index bef45f3841..2ac874e770 100644
--- a/c/cert/test/rules/EXP40-C/DoNotModifyConstantObjects.expected
+++ b/c/cert/test/rules/EXP40-C/DoNotModifyConstantObjects.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyConstantObjects.ql:40,30-38)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyConstantObjects.ql:41,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyConstantObjects.ql:47,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyConstantObjects.ql:52,19-27)
 edges
 | test.c:5:8:5:9 | & ... | test.c:6:4:6:5 | aa | provenance |  |
 | test.c:26:15:26:15 | a | test.c:27:4:27:4 | a | provenance |  |
diff --git a/c/cert/test/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.expected b/c/cert/test/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.expected
index 3746991c09..40009edc03 100644
--- a/c/cert/test/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.expected
+++ b/c/cert/test/rules/EXP43-C/RestrictPointerReferencesOverlappingObject.expected
@@ -1,3 +1,10 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (RestrictPointerReferencesOverlappingObject.ql:47,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (RestrictPointerReferencesOverlappingObject.ql:48,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (RestrictPointerReferencesOverlappingObject.ql:52,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (RestrictPointerReferencesOverlappingObject.ql:58,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (RestrictPointerReferencesOverlappingObject.ql:61,58-66)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (RestrictPointerReferencesOverlappingObject.ql:77,64-72)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (RestrictPointerReferencesOverlappingObject.ql:78,64-72)
 | test.c:18:22:18:23 | i2 | Assignment to restrict-qualified pointer $@ results in pointers aliasing $@. | test.c:18:17:18:18 | i3 | i3 | test.c:18:22:18:23 | i2 | the object pointed to by i2 |
 | test.c:19:8:19:9 | g2 | Assignment to restrict-qualified pointer $@ results in pointers aliasing $@. | test.c:5:15:5:16 | g1 | g1 | test.c:19:8:19:9 | g2 | the object pointed to by g2 |
 | test.c:20:8:20:9 | i2 | Assignment to restrict-qualified pointer $@ results in pointers aliasing $@. | test.c:16:17:16:18 | i1 | i1 | test.c:20:8:20:9 | i2 | the object pointed to by i2 |
diff --git a/c/cert/test/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.expected b/c/cert/test/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.expected
index 20c108cfa0..52cb85e5c4 100644
--- a/c/cert/test/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.expected
+++ b/c/cert/test/rules/FIO40-C/ResetStringsOnFgetsOrFgetwsFailure.expected
@@ -1,3 +1,6 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ResetStringsOnFgetsOrFgetwsFailure.ql:48,11-19)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ResetStringsOnFgetsOrFgetwsFailure.ql:48,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ResetStringsOnFgetsOrFgetwsFailure.ql:49,13-21)
 | test.c:20:10:20:12 | buf | The buffer is not reset before being referenced following a failed $@. | test.c:15:7:15:11 | call to fgets | call to fgets |
 | test.c:57:10:57:12 | buf | The buffer is not reset before being referenced following a failed $@. | test.c:52:7:52:11 | call to fgets | call to fgets |
 | test.c:66:18:66:20 | buf | The buffer is not reset before being referenced following a failed $@. | test.c:61:7:61:11 | call to fgets | call to fgets |
diff --git a/c/cert/test/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.expected b/c/cert/test/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.expected
index 8074710738..ec05727161 100644
--- a/c/cert/test/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.expected
+++ b/c/cert/test/rules/FIO44-C/OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.expected
@@ -1,2 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql:30,32-40)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql:31,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql:33,14-22)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql:36,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (OnlyUseValuesForFsetposThatAreReturnedFromFgetpos.ql:42,21-29)
 | test.c:7:24:7:30 | & ... | The position argument of a call to `fsetpos()` should be obtained from a call to `fgetpos()`. |
 | test.c:33:24:33:30 | & ... | The position argument of a call to `fsetpos()` should be obtained from a call to `fgetpos()`. |
diff --git a/c/cert/test/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.expected b/c/cert/test/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.expected
index 1b2923b780..a211aa4002 100644
--- a/c/cert/test/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.expected
+++ b/c/cert/test/rules/FIO45-C/ToctouRaceConditionsWhileAccessingFiles.expected
@@ -1,2 +1,3 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ToctouRaceConditionsWhileAccessingFiles.ql:32,35-43)
 | test.c:4:13:4:17 | call to fopen | This call is trying to prevent an existing file from being overwritten by $@. An attacker might be able to exploit the race window between the two calls. | test.c:11:9:11:13 | call to fopen | another call |
 | test.c:88:13:88:17 | call to fopen | This call is trying to prevent an existing file from being overwritten by $@. An attacker might be able to exploit the race window between the two calls. | test.c:95:9:95:13 | call to fopen | another call |
diff --git a/c/cert/test/rules/MEM35-C/InsufficientMemoryAllocatedForObject.expected b/c/cert/test/rules/MEM35-C/InsufficientMemoryAllocatedForObject.expected
index 30dece9299..86bdeedf5f 100644
--- a/c/cert/test/rules/MEM35-C/InsufficientMemoryAllocatedForObject.expected
+++ b/c/cert/test/rules/MEM35-C/InsufficientMemoryAllocatedForObject.expected
@@ -1,3 +1,5 @@
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (InsufficientMemoryAllocatedForObject.ql:90,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (InsufficientMemoryAllocatedForObject.ql:148,5-18)
 | test.c:12:19:12:24 | call to malloc | Allocation size (32 bytes) is not a multiple of the size of 'S1' (36 bytes). | test.c:12:26:12:32 | 32 |  |
 | test.c:15:19:15:24 | call to malloc | Allocation size calculated from the size of a different type ($@). | test.c:15:26:15:35 | sizeof(<expr>) | sizeof(S1 *) |
 | test.c:20:19:20:24 | call to malloc | Allocation size (128 bytes) is not a multiple of the size of 'S1' (36 bytes). | test.c:20:26:20:36 | ... * ... |  |
diff --git a/c/cert/test/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.expected b/c/cert/test/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.expected
index 0ae87f2ee8..587ae786d1 100644
--- a/c/cert/test/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.expected
+++ b/c/cert/test/rules/MEM36-C/DoNotModifyAlignmentOfMemoryWithRealloc.expected
@@ -1,3 +1,8 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyAlignmentOfMemoryWithRealloc.ql:31,36-44)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyAlignmentOfMemoryWithRealloc.ql:45,47-55)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyAlignmentOfMemoryWithRealloc.ql:46,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyAlignmentOfMemoryWithRealloc.ql:50,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotModifyAlignmentOfMemoryWithRealloc.ql:55,36-44)
 edges
 | test.c:5:10:5:22 | call to aligned_alloc | test.c:15:8:15:28 | call to aligned_alloc_wrapper | provenance |  |
 | test.c:8:29:8:31 | ptr | test.c:8:64:8:66 | ptr | provenance |  |
diff --git a/c/cert/test/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.expected b/c/cert/test/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.expected
index 70d60c528a..7ebeb7a8c1 100644
--- a/c/cert/test/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.expected
+++ b/c/cert/test/rules/MSC33-C/DoNotPassInvalidDataToTheAsctimeFunction.expected
@@ -1 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotPassInvalidDataToTheAsctimeFunction.ql:38,38-46)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotPassInvalidDataToTheAsctimeFunction.ql:39,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotPassInvalidDataToTheAsctimeFunction.ql:46,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotPassInvalidDataToTheAsctimeFunction.ql:49,27-35)
 | test.c:6:24:6:30 | time_tm | The function `asctime` and `asctime_r` should be discouraged. Unsanitized input can overflow the output buffer. |
diff --git a/c/cert/test/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.expected b/c/cert/test/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.expected
index 2b7bb2bdbc..4e14eb2873 100644
--- a/c/cert/test/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.expected
+++ b/c/cert/test/rules/MSC39-C/DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.expected
@@ -1,3 +1,10 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql:43,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql:44,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql:49,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql:52,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql:73,10-18)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql:74,29-37)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue.ql:75,29-37)
 | test.c:23:32:23:33 | ap | The value of ap is indeterminate after the $@. | test.c:17:7:17:19 | call to contains_zero | call to contains_zero |
 | test.c:26:10:26:11 | ap | The value of ap is indeterminate after the $@. | test.c:17:7:17:19 | call to contains_zero | call to contains_zero |
 | test.c:39:12:39:13 | ap | The value of ap is indeterminate after the $@. | test.c:35:7:35:19 | call to contains_zero | call to contains_zero |
diff --git a/c/cert/test/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.expected b/c/cert/test/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.expected
new file mode 100644
index 0000000000..f258d4adef
--- /dev/null
+++ b/c/cert/test/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.expected
@@ -0,0 +1,6 @@
+| test.c:6:14:6:14 | i | Static local variable $@ declared in the extern inlined function $@. | test.c:6:14:6:14 | i | i | test.c:5:20:5:24 | test1 | test1 |
+| test.c:7:3:7:4 | g1 | Identifier $@ with internal linkage referenced in the extern inlined function $@. | test.c:1:12:1:13 | g1 | g1 | test.c:5:20:5:24 | test1 | test1 |
+| test.c:9:3:9:4 | g3 | Identifier $@ with internal linkage referenced in the extern inlined function $@. | test.c:3:11:3:12 | g3 | g3 | test.c:5:20:5:24 | test1 | test1 |
+| test.c:27:14:27:14 | i | Static local variable $@ declared in the extern inlined function $@. | test.c:27:14:27:14 | i | i | test.c:26:13:26:17 | test4 | test4 |
+| test.c:28:3:28:4 | g1 | Identifier $@ with internal linkage referenced in the extern inlined function $@. | test.c:1:12:1:13 | g1 | g1 | test.c:26:13:26:17 | test4 | test4 |
+| test.c:30:3:30:4 | g3 | Identifier $@ with internal linkage referenced in the extern inlined function $@. | test.c:3:11:3:12 | g3 | g3 | test.c:26:13:26:17 | test4 | test4 |
diff --git a/c/cert/test/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.qlref b/c/cert/test/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.qlref
new file mode 100644
index 0000000000..f14d4270cc
--- /dev/null
+++ b/c/cert/test/rules/MSC40-C/DoNotViolateInLineLinkageConstraints.qlref
@@ -0,0 +1 @@
+rules/MSC40-C/DoNotViolateInLineLinkageConstraints.ql
\ No newline at end of file
diff --git a/c/cert/test/rules/MSC40-C/test.c b/c/cert/test/rules/MSC40-C/test.c
new file mode 100644
index 0000000000..d892935d41
--- /dev/null
+++ b/c/cert/test/rules/MSC40-C/test.c
@@ -0,0 +1,31 @@
+static int g1 = 0;
+extern int g2 = 1;
+const int g3 = 1; // defaults to internal linkage
+
+extern inline void test1() {
+  static int i = 0; // NON_COMPLIANT
+  g1++;             // NON_COMPLIANT
+  g2++;             // COMPLIANT
+  g3;               // NON_COMPLIANT
+}
+
+extern void test2() {
+  static int i = 0; // COMPLIANT
+  g1++;             // COMPLIANT
+  g2++;             // COMPLIANT
+  g3;               // COMPLIANT
+}
+
+void test3() {
+  static int i = 0; // COMPLIANT
+  g1++;             // COMPLIANT
+  g2++;             // COMPLIANT
+  g3;               // COMPLIANT
+}
+
+inline void test4() {
+  static int i = 0; // NON_COMPLIANT
+  g1++;             // NON_COMPLIANT
+  g2++;             // COMPLIANT
+  g3;               // NON_COMPLIANT
+}
\ No newline at end of file
diff --git a/c/cert/test/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.expected b/c/cert/test/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.expected
index a601fe63f4..ce13ee69a7 100644
--- a/c/cert/test/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.expected
+++ b/c/cert/test/rules/SIG30-C/CallOnlyAsyncSafeFunctionsWithinSignalHandlers.expected
@@ -1,4 +1,7 @@
-| test.c:10:3:10:18 | call to log_local_unsafe | Asyncronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:16:7:16:12 | call to signal | signal handler |
-| test.c:11:3:11:6 | call to free | Asyncronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:16:7:16:12 | call to signal | signal handler |
-| test.c:46:3:46:9 | call to longjmp | Asyncronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:50:7:50:12 | call to signal | signal handler |
-| test.c:76:7:76:11 | call to raise | Asyncronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:91:7:91:12 | call to signal | signal handler |
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql:110,11-19)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql:110,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql:111,9-17)
+| test.c:10:3:10:18 | call to log_local_unsafe | Asynchronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:16:7:16:12 | call to signal | signal handler |
+| test.c:11:3:11:6 | call to free | Asynchronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:16:7:16:12 | call to signal | signal handler |
+| test.c:46:3:46:9 | call to longjmp | Asynchronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:50:7:50:12 | call to signal | signal handler |
+| test.c:76:7:76:11 | call to raise | Asynchronous-unsafe function calls within a $@ can lead to undefined behavior. | test.c:91:7:91:12 | call to signal | signal handler |
diff --git a/c/cert/test/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.expected b/c/cert/test/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.expected
index 31412c466a..fb78049d25 100644
--- a/c/cert/test/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.expected
+++ b/c/cert/test/rules/SIG35-C/DoNotReturnFromAComputationalExceptionHandler.expected
@@ -1 +1,2 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotReturnFromAComputationalExceptionHandler.ql:44,5-13)
 | test.c:10:1:10:1 | return ... | Do not return from a $@ signal handler. | test.c:13:10:13:15 | SIGFPE | computational exception |
diff --git a/c/cert/test/rules/STR30-C/DoNotAttemptToModifyStringLiterals.expected b/c/cert/test/rules/STR30-C/DoNotAttemptToModifyStringLiterals.expected
index 27ef66bc7a..d95b48e1c3 100644
--- a/c/cert/test/rules/STR30-C/DoNotAttemptToModifyStringLiterals.expected
+++ b/c/cert/test/rules/STR30-C/DoNotAttemptToModifyStringLiterals.expected
@@ -1,3 +1,18 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:47,65-73)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:48,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:69,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:82,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:106,11-19)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:106,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:106,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:111,11-19)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:111,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:111,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:144,11-19)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:144,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:144,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:155,53-61)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAttemptToModifyStringLiterals.ql:156,5-13)
 | test.c:7:3:7:3 | a | This operation may write to a string that may be a string literal that was $@. | test.c:6:13:6:20 | codeql | created here |
 | test.c:30:3:30:3 | a | This operation may write to a string that may be a string literal that was $@. | test.c:29:13:29:18 | call to strchr | created here |
 | test.c:36:3:36:3 | b | This operation may write to a string that may be a string literal that was $@. | test.c:35:13:35:18 | call to strchr | created here |
diff --git a/c/cert/test/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.expected b/c/cert/test/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.expected
index 71e713d120..9a87a6775b 100644
--- a/c/cert/test/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.expected
+++ b/c/cert/test/rules/STR31-C/StringsHasSufficientSpaceForTheNullTerminator.expected
@@ -1,3 +1,9 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:62,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:62,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:68,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:68,54-62)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:62,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (StringsHasSufficientSpaceForTheNullTerminator.ql:68,5-18)
 | test.c:10:20:10:24 | Cod | Expression produces or consumes a string that may not have sufficient space for a null-terminator. |
 | test.c:16:3:16:9 | call to strncpy | Expression produces or consumes a string that may not have sufficient space for a null-terminator. |
 | test.c:26:3:26:10 | call to snprintf | Expression produces or consumes a string that may not have sufficient space for a null-terminator. |
diff --git a/c/cert/test/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.expected b/c/cert/test/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.expected
index 8409d95628..f537cc72ac 100644
--- a/c/cert/test/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.expected
+++ b/c/cert/test/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.expected
@@ -1,3 +1,13 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:69,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:71,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:79,39-47)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:80,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:86,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:88,34-42)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:88,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:128,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:128,26-34)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (NonNullTerminatedToFunctionThatExpectsAString.ql:125,17-30)
 | test.c:20:3:20:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:8:20:8:24 | Cod | this expression |
 | test.c:21:3:21:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:8:20:8:24 | Cod | this expression |
 | test.c:23:3:23:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:14:3:14:9 | call to strncpy | this expression |
diff --git a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected b/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected
deleted file mode 100644
index 1c6424dc0c..0000000000
--- a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected
+++ /dev/null
@@ -1,21 +0,0 @@
-| test.c:7:7:7:14 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:28:11:28:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:29:3:29:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:29:11:29:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:31:11:31:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:32:11:32:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:33:3:33:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:33:11:33:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:34:3:34:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:34:11:34:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:35:3:35:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:35:11:35:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:36:3:36:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:36:11:36:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:37:11:37:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:38:11:38:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:39:3:39:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:39:11:39:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:40:12:40:13 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:42:11:42:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:43:11:43:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
diff --git a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.qlref b/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.qlref
deleted file mode 100644
index 379d3b3f68..0000000000
--- a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.qlref
+++ /dev/null
@@ -1 +0,0 @@
-rules/STR34-C/CastCharBeforeConvertingToLargerSizes.ql
\ No newline at end of file
diff --git a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.testref b/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.testref
new file mode 100644
index 0000000000..0e13e05dc3
--- /dev/null
+++ b/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.testref
@@ -0,0 +1 @@
+c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.ql
\ No newline at end of file
diff --git a/c/common/src/codeql-pack.lock.yml b/c/common/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/c/common/src/codeql-pack.lock.yml
+++ b/c/common/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/c/common/src/codingstandards/c/Errno.qll b/c/common/src/codingstandards/c/Errno.qll
index 86ecabe8f1..768927f505 100644
--- a/c/common/src/codingstandards/c/Errno.qll
+++ b/c/common/src/codingstandards/c/Errno.qll
@@ -1,7 +1,6 @@
 /** Provides a library for errno-setting functions. */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
 
 /**
  * An errno-setting function
diff --git a/c/common/src/codingstandards/c/Generic.qll b/c/common/src/codingstandards/c/Generic.qll
new file mode 100644
index 0000000000..19d5aad443
--- /dev/null
+++ b/c/common/src/codingstandards/c/Generic.qll
@@ -0,0 +1,150 @@
+import cpp
+import codingstandards.cpp.Macro
+import codingstandards.cpp.MatchingParenthesis
+
+string genericRegexp() { result = "\\b_Generic\\s*\\(\\s*(.+),.*" }
+
+bindingset[input]
+string deparenthesize(string input) {
+  input = "(" + result + ")" and
+  result = input.substring(1, input.length() - 1)
+}
+
+class GenericMacro extends Macro {
+  string ctrlExpr;
+
+  GenericMacro() { ctrlExpr = getBody().regexpCapture(genericRegexp(), 1).trim() }
+
+  string getAParameter() { result = this.(FunctionLikeMacro).getAParameter() }
+
+  string getControllingExprString() {
+    if exists(string s | s = deparenthesize(ctrlExpr))
+    then result = deparenthesize(ctrlExpr).trim()
+    else result = ctrlExpr
+  }
+
+  /**
+   * Whether the controlling expression of the `_Generic` expr in this macro's controlling
+   * expression refers to one of this macro's parameters.
+   */
+  predicate hasControllingExprFromMacroParameter() {
+    getControllingExprString().matches(getAParameter())
+  }
+}
+
+class GenericMacroString extends string {
+  GenericMacroString() { this = any(Macro m).getBody() and this.matches("%_Generic%") }
+}
+
+import MatchingParenthesis<GenericMacroString>
+
+class ParsedGenericMacro extends Macro {
+  ParsedRoot macroBody;
+  Parsed genericBody;
+  string beforeGenericBody;
+  string afterGenericBody;
+
+  ParsedGenericMacro() {
+    macroBody.getInputString() = this.getBody() and
+    exists(ParsedText genericText |
+      genericText.getText().matches("%_Generic%") and
+      genericBody = genericText.getParent().getChild(genericText.getChildIdx() + 1) and
+      genericBody.getRoot() = macroBody
+    ) and
+    beforeGenericBody =
+      textFrom(macroBody.getStartToken(), genericBody.getStartToken().getPrevious()) and
+    (
+      if exists(genericBody.getEndToken().getNext())
+      then afterGenericBody = textFrom(genericBody.getEndToken().getNext(), macroBody.getEndToken())
+      else afterGenericBody = ""
+    )
+  }
+
+  string getAParameter() { result = this.(FunctionLikeMacro).getAParameter() }
+
+  int getAParsedGenericCommaSeparatorOffset() {
+    exists(ParsedText text |
+      text.getParent() = genericBody and
+      result = text.getStartToken().getStartPos() + text.getText().indexOf(",")
+    )
+  }
+
+  int getAParsedGenericColonSeparatorOffset() {
+    exists(ParsedText text |
+      text.getParent() = genericBody and
+      result = text.getStartToken().getStartPos() + text.getText().indexOf(":")
+    )
+  }
+
+  int getParsedGenericCommaSeparatorOffset(int i) {
+    result = rank[i](int index | index = getAParsedGenericCommaSeparatorOffset())
+  }
+
+  bindingset[start, end]
+  int getParsedGenericColon(int start, int end) {
+    result =
+      min(int offset |
+        offset = getAParsedGenericColonSeparatorOffset() and
+        offset >= start and
+        offset <= end
+      )
+  }
+
+  predicate hasParsedFullSelectionRange(int idx, int start, int end) {
+    idx = 1 and
+    start = genericBody.getStartToken().getEndPos() and
+    end = getParsedGenericCommaSeparatorOffset(idx)
+    or
+    not exists(getParsedGenericCommaSeparatorOffset(idx)) and
+    start = getParsedGenericCommaSeparatorOffset(idx - 1) and
+    end = genericBody.getEndToken().getStartPos()
+    or
+    start = getParsedGenericCommaSeparatorOffset(idx - 1) and
+    end = getParsedGenericCommaSeparatorOffset(idx)
+  }
+
+  string getSelectionString(int idx) {
+    exists(int start, int rawStart, int end |
+      hasParsedFullSelectionRange(idx, rawStart, end) and
+      (
+        if exists(getParsedGenericColon(rawStart, end))
+        then start = getParsedGenericColon(rawStart, end)
+        else start = rawStart
+      ) and
+      result = genericBody.getInputString().substring(start, end)
+    )
+  }
+
+  string getControllingExprString() { result = getSelectionString(1).trim() }
+
+  bindingset[str, word]
+  private int countWordInString(string word, string str) {
+    result =
+      max(int occurrence |
+        exists(str.regexpFind("\\b" + word + "\\b", occurrence, _)) or occurrence = -1
+      |
+        occurrence + 1
+      )
+  }
+
+  int expansionsOutsideExpr(string parameter) {
+    parameter = getAParameter() and
+    result =
+      countWordInString(parameter, beforeGenericBody) +
+        countWordInString(parameter, afterGenericBody)
+  }
+
+  int expansionsInsideSelection(string parameter, int idx) {
+    parameter = getAParameter() and
+    result = countWordInString(parameter, getSelectionString(idx))
+  }
+
+  int expansionsInsideControllingExpr(string parameter) {
+    result = expansionsInsideSelection(parameter, 1)
+  }
+
+  int expansionsInsideAssociation(string parameter, int idx) {
+    not idx = 0 and
+    result = expansionsInsideSelection(parameter, idx + 1)
+  }
+}
diff --git a/c/common/src/codingstandards/c/IdentifierLinkage.qll b/c/common/src/codingstandards/c/IdentifierLinkage.qll
new file mode 100644
index 0000000000..085ebf5a7b
--- /dev/null
+++ b/c/common/src/codingstandards/c/IdentifierLinkage.qll
@@ -0,0 +1,47 @@
+import cpp
+
+newtype TIdentifierLinkage =
+  TIdentifierLinkageExternal() or
+  TIdentifierLinkageInternal() or
+  TIdentifierLinkageNone()
+
+/**
+ * In C, identifiers have internal linkage, or external linkage, or no linkage (6.2.2.1).
+ *
+ * The linkage of an identifier is used to, among other things, determine the storage duration
+ * and/or lifetime of that identifier. Storage durations and lifetimes are often used to define
+ * rules in the various coding standards.
+ */
+class IdentifierLinkage extends TIdentifierLinkage {
+  predicate isExternal() { this = TIdentifierLinkageExternal() }
+
+  predicate isInternal() { this = TIdentifierLinkageInternal() }
+
+  predicate isNone() { this = TIdentifierLinkageNone() }
+
+  string toString() {
+    this.isExternal() and result = "external linkage"
+    or
+    this.isInternal() and result = "internal linkage"
+    or
+    this.isNone() and result = "no linkage"
+  }
+}
+
+/**
+ * Determine the linkage of a variable: external, or static, or none.
+ *
+ * The linkage of a variable is determined by its scope and storage class. Note that other types of
+ * identifiers (e.g. functions) may also have linkage, but that behavior is not covered in this
+ * predicate.
+ */
+IdentifierLinkage linkageOfVariable(Variable v) {
+  // 6.2.2.3, file scope identifiers marked static have internal linkage.
+  v.isTopLevel() and v.isStatic() and result.isInternal()
+  or
+  // 6.2.2.4 describes generally non-static file scope identifiers, which have external linkage.
+  v.isTopLevel() and not v.isStatic() and result.isExternal()
+  or
+  // Note: Not all identifiers have linkage, see 6.2.2.6
+  not v.isTopLevel() and result.isNone()
+}
diff --git a/c/common/src/codingstandards/c/Objects.qll b/c/common/src/codingstandards/c/Objects.qll
new file mode 100644
index 0000000000..9a0206771b
--- /dev/null
+++ b/c/common/src/codingstandards/c/Objects.qll
@@ -0,0 +1,398 @@
+import cpp
+import codingstandards.c.StorageDuration
+import codingstandards.c.IdentifierLinkage
+import semmle.code.cpp.valuenumbering.HashCons
+import codingstandards.cpp.Clvalues
+
+/**
+ * A libary for handling "Objects" in C.
+ *
+ * Objects may be stored in registers or memory, they have an address, a type, a storage duration,
+ * and a lifetime (which is different than storage duration). Objects which are structs or arrays
+ * have subobjects, which share the storage duration and lifetime of the parent object.
+ *
+ * Note: lifetime analysis is not performed in this library, but is available in
+ * the module `codingstandards.cpp.lifetimes.LifetimeProfile`. In the future, these libraries could
+ * be merged for more complete analysis.
+ *
+ * To get objects in a project, use the `ObjectIdentity` class which finds the following types of
+ * objects:
+ * - global variables
+ * - local variables
+ * - literals
+ * - malloc calls
+ * - certain temporary object expressions
+ *
+ * And direct references to these objects can be found via the member predicate `getAnAccess()`.
+ * However, much of a project's code will not refer to these objects directly, but rather, refer to
+ * their subobjects. The class `ObjectIdentity` exposes several member predicates for finding when
+ * these subobjects are used:
+ * - `getASubobjectType()`
+ * - `getASubobjectAccess()`
+ * - `getASubobjectAddressExpr()`
+ *
+ * These methods do not use flow analysis, and will not return a conclusive list of accesses. To
+ * get better results here, this library should be integrated with flow analysis or the library
+ * `LifetimeProfile.qll`.
+ *
+ * Additionally, subobjects are currently not tracked individually. In the future subobjects could
+ * be tracked as a root object and an access chain to refer to them. For now, however, finding *any*
+ * subobject access is sufficient for many analyses.
+ *
+ * To get the storage duration, `ObjectIdentity` exposes the member predicate
+ * `getStorageDuration()` with the following options:
+ * - `obj.getStorageDuration().isAutomatic()`: Stack objects
+ * - `obj.getStorageDuration().isStatic()`: Global objects
+ * - `obj.getStorageDuration().isThread()`: Threadlocal objects
+ * - `obj.getStorageDuration().isAllocated()`: Dynamic objects
+ *
+ * Note that lifetimes are not storage durations. The only lifetime tracking currently implemented
+ * is `hasTemporaryLifetime()`, which is a subset of automatic storage duration objects, and may
+ * be filtered out, or selected directly with `TemporaryObjectIdentity`.
+ */
+final class ObjectIdentity = ObjectIdentityBase;
+
+/**
+ * A base class for objects in C, along with the source location where the object can be identified
+ * in the project code (thus, this class extends `Element`), which may be variable, or may be an
+ * expression such as a literal or a malloc call.
+ *
+ * Extend this class to define a new type of object identity. To create a class which filters the
+ * set of object identities, users of this library should extend the final subclass
+ * `ObjectIdentity` instead.
+ */
+abstract class ObjectIdentityBase extends Element {
+  /**
+   * The type of this object.
+   *
+   * Note that for allocated objects, this is inferred from the sizeof() statement or the variable
+   * it is assigned to.
+   */
+  abstract Type getType();
+
+  /* The storage duration of this object: static, thread, automatic, or allocated. */
+  abstract StorageDuration getStorageDuration();
+
+  /**
+   * Get the nested objects within this object (members, array element types).
+   *
+   * Note that if a struct has a pointer member, the pointer itself is a subobject, but the value
+   * it points to is not. Therefore `struct { int* x; }` has a subobject of type `int*`, but not
+   * `int`.
+   */
+  Type getASubObjectType() { result = getADirectSubobjectType*(getType()) }
+
+  /**
+   * Get expressions which trivially access this object. Does not perform flow analysis.
+   *
+   * For dynamically allocated objects, this is a dereference of the malloc call.
+   */
+  abstract Expr getAnAccess();
+
+  /**
+   * Get expressions which trivially access this object or a subobject of this object. Does not
+   * perform flow analysis.
+   *
+   * For dynamically allocated objects, this is a dereference of the malloc call or direct access
+   * of the result of dereferencing the malloc call.
+   */
+  Expr getASubobjectAccess() { result = getASubobjectAccessOf(getAnAccess()) }
+
+  /**
+   * Get expressions which trivially take the address of this object or a subobject of this object.
+   * Does not perform flow analysis.
+   */
+  Expr getASubobjectAddressExpr() {
+    exists(Expr subobject |
+      subobject = getASubobjectAccess() and
+      (
+        // Holds for address-of expressions.
+        result = any(AddressOfExpr e | e.getOperand() = subobject)
+        or
+        // Holds for array-to-pointer conversions, which evaluate to a usable subobject address.
+        exists(ArrayToPointerConversion c | c.getExpr() = subobject) and
+        // Note that `arr[x]` has an array-to-pointer conversion, and returns the `x`th item by
+        // value, not the address of the `x`th item. Therefore, exclude `arr` if `arr` is part of
+        // an expression `arr[x]`.
+        not exists(ArrayExpr a | a.getArrayBase() = subobject) and
+        result = subobject
+      )
+    )
+  }
+
+  /**
+   * Holds if the object has temporary lifetime. This is not a storage duration, but only objects
+   * with automatic storage duration have temporary lifetime.
+   */
+  abstract predicate hasTemporaryLifetime();
+}
+
+/**
+ * Finds expressions `e.x` or `e[x]` for expression `e`, recursively. Does not resolve pointers.
+ *
+ * Note that this does not hold for `e->x` or `e[x]` where `e` is a pointer.
+ */
+private Expr getASubobjectAccessOf(Expr e) {
+  result = e
+  or
+  result.(DotFieldAccess).getQualifier() = getASubobjectAccessOf(e)
+  or
+  result.(ArrayExpr).getArrayBase() = getASubobjectAccessOf(e) and
+  not result.(ArrayExpr).getArrayBase().getUnspecifiedType() instanceof PointerType
+}
+
+/**
+ * Find the object types that are embedded within the current type.
+ *
+ * For example, a block of memory with type `T[]` has subobjects of type `T`, and a struct with a
+ * member of `T member;` has a subobject of type `T`.
+ *
+ * Note that subobjects may be pointers, but the value they point to is not a subobject. For
+ * instance, `struct { int* x; }` has a subobject of type `int*`, but not `int`.
+ */
+Type getADirectSubobjectType(Type type) {
+  result = type.stripTopLevelSpecifiers().(Struct).getAMember().getADeclarationEntry().getType()
+  or
+  result = type.stripTopLevelSpecifiers().(ArrayType).getBaseType()
+}
+
+/**
+ * An object in memory which may be identified by the variable that holds it.
+ *
+ * This may be a local variable, a global variable, or a parameter, etc. However, it cannot be a
+ * member of a struct or union, as these do not have storage duration.
+ */
+class VariableObjectIdentity extends Variable, ObjectIdentityBase {
+  VariableObjectIdentity() {
+    // Exclude members; member definitions does not allocate storage and thus do not have a storage
+    // duration. They are therefore not objects. To get the storage duration of members, use one of
+    // the predicates related to sub objects, e.g. `getASubObjectType()`.
+    not isMember()
+  }
+
+  override StorageDuration getStorageDuration() {
+    // 6.2.4.4, objects declared _Thread_local have thread storage duration.
+    isThreadLocal() and result.isThread()
+    or
+    // 6.2.4.3, Non _ThreadLocal objects with internal or external linkage or declared static have
+    // static storage duration.
+    not isThreadLocal() and
+    (hasLinkage() or isStatic()) and
+    result.isStatic()
+    or
+    // 6.2.4.3, Non _ThreadLocal objects no linkage that are not static have automatic storage
+    // duration.
+    not isThreadLocal() and
+    not hasLinkage() and
+    not isStatic() and
+    result.isAutomatic()
+  }
+
+  override Type getType() {
+    // Caution here: If we use `Variable.super.getType()` then override resolution is skipped, and
+    // it uses the base predicate defined as `none()`. By casting this to `Variable` and calling
+    // `getType()`, all overrides (harmlessly, *including this one*...) are considered, which means
+    // we defer to the subclasses such as `GlobalVariable` overrides of `getType()`, which is what
+    // we want.
+    result = this.(Variable).getType()
+  }
+
+  /* The storage duration of a variable depends on its linkage. */
+  IdentifierLinkage getLinkage() { result = linkageOfVariable(this) }
+
+  predicate hasLinkage() { not getLinkage().isNone() }
+
+  override VariableAccess getAnAccess() { result = Variable.super.getAnAccess() }
+
+  override predicate hasTemporaryLifetime() {
+    none() // Objects identified by a variable do not have temporary lifetime.
+  }
+}
+
+/**
+ * A string literal is an object with static storage duration.
+ *
+ * 6.4.5.6, multibyte character sequences initialize an array of static storage duration.
+ */
+class LiteralObjectIdentity extends Literal, ObjectIdentityBase {
+  override StorageDuration getStorageDuration() { result.isStatic() }
+
+  override Type getType() { result = Literal.super.getType() }
+
+  override Expr getAnAccess() { result = this }
+
+  override predicate hasTemporaryLifetime() {
+    none() // String literal objects do not have temporary lifetime.
+  }
+}
+
+/**
+ * An object identifiable as a struct or array literal, which is an lvalue that may have static or
+ * automatic storage duration depending on context.
+ *
+ * 6.5.2.5.5, compound literals outside of a function have static storage duration, while literals
+ * inside a function have automatic storage duration.
+ */
+class AggregateLiteralObjectIdentity extends AggregateLiteral, ObjectIdentityBase {
+  override StorageDuration getStorageDuration() {
+    if exists(getEnclosingFunction()) then result.isAutomatic() else result.isStatic()
+  }
+
+  override Type getType() { result = AggregateLiteral.super.getType() }
+
+  override Expr getAnAccess() { result = this }
+
+  override predicate hasTemporaryLifetime() {
+    // Confusing; a struct literal is an lvalue, and therefore does not have temporary lifetime.
+    none()
+  }
+}
+
+/**
+ * An object identified by a call to `malloc`.
+ *
+ * Note: the malloc expression returns an address to this object, not the object itself. Therefore,
+ * `getAnAccess()` returns cases where this malloc result is dereferenced, and not the malloc call
+ * itself.
+ *
+ * Note that the predicates for tracking accesses, subobject accesses, and address expresisons may
+ * be less reliable as dynamic memory is fundamentally more difficult to track. However, this class
+ * attempts to give reasonable results. In the future, this could be improved by integrating with
+ * LifetimeProfile.qll or by integrating flow analysis.
+ *
+ * Additionally, the type of this object is inferred based on its size and use.
+ */
+class AllocatedObjectIdentity extends AllocationExpr, ObjectIdentityBase {
+  AllocatedObjectIdentity() {
+    this.(FunctionCall).getTarget().(AllocationFunction).requiresDealloc()
+  }
+
+  override StorageDuration getStorageDuration() { result.isAllocated() }
+
+  /** Attempt to infer the type of the allocated memory */
+  override Type getType() { result = this.getAllocatedElementType() }
+
+  /** Find dereferences of direct aliases of this pointer result. */
+  override Expr getAnAccess() { result.(PointerDereferenceExpr).getOperand() = getAnAlias() }
+
+  /**
+   * Find the following subobject accesses, given a pointer alias `x`:
+   * - `(*x)`
+   * - `(*x).y`
+   * - `(*x)[i]`
+   * - `x->y`
+   * - `x[i]`
+   * - `x->y.z`
+   * - `x[i].y`
+   * - all direct accesses (`foo.x`, `foo[i]`) of the above
+   */
+  override Expr getASubobjectAccess() {
+    result = getASubobjectAccessOf(getAnAccess())
+    or
+    exists(PointerFieldAccess pfa |
+      pfa.getQualifier() = getASubobjectAddressExpr() and
+      result = getASubobjectAccessOf(pfa)
+    )
+    or
+    exists(ArrayExpr arrayExpr |
+      arrayExpr.getArrayBase() = getASubobjectAddressExpr() and
+      result = getASubobjectAccessOf(arrayExpr)
+    )
+  }
+
+  /**
+   * Given a pointer alias `x`, finds `x` itself. Additionally, defers to the default class
+   * behavior, which finds address-of (`&`) and array-to-pointer conversions of all subobject
+   * accesses. (See `AllocatedObjectIdentity.getASubobjectAccess()`.)
+   */
+  override Expr getASubobjectAddressExpr() {
+    result = getAnAlias()
+    or
+    result = super.getASubobjectAddressExpr()
+  }
+
+  /**
+   * Find an obvious direct reference to the result of a `malloc()` function call. This includes
+   * the function call itself, but additionally:
+   * - For `T* x = malloc(...)`, accesses to variable `x` are likely aliases of the malloc result
+   * - For `(expr) = malloc(...)` future lexically identical uses of `expr` are likely aliases of
+   *   the malloc result.
+   *
+   * This is used so that member predicates such as `getAnAccess()`, `getASubobjectAccess()` can
+   * find cases such as:
+   *
+   * ```c
+   *   int *x = malloc(sizeof(int));
+   *   return *x; // accesses the malloc result
+   * ```
+   */
+  Expr getAnAlias() {
+    result = this
+    or
+    exists(AssignExpr assignExpr |
+      assignExpr.getRValue() = this and
+      hashCons(result) = hashCons(assignExpr.getLValue())
+    )
+    or
+    exists(Variable v |
+      v.getInitializer().getExpr() = this and
+      result = v.getAnAccess()
+    )
+  }
+
+  override predicate hasTemporaryLifetime() {
+    none() // Allocated objects do not have "temporary lifetime."
+  }
+}
+
+/**
+ * A struct or union type that contains an array type, used to find objects with temporary
+ * lifetime.
+ */
+private class StructOrUnionTypeWithArrayField extends Struct {
+  StructOrUnionTypeWithArrayField() {
+    this.getAField().getUnspecifiedType() instanceof ArrayType
+    or
+    // nested struct or union containing an array type
+    this.getAField().getUnspecifiedType().(Struct) instanceof StructOrUnionTypeWithArrayField
+  }
+}
+
+/**
+ * 6.2.4.7, A non-lvalue expression with struct or or union type that has a field member of array
+ * type, refers to an object with automatic storage duration (and has temporary lifetime).
+ *
+ * The spec uses the lanugage "refers to." This is likely intended to mean that the expression
+ * `foo().x` does not create a new temporary object, but rather "refers to" the temporary object
+ * storing the value of the expression `foo()`.
+ *
+ * Separate this predicate to avoid non-monotonic recursion (`C() { not exists(C c | ... ) }`).
+ */
+private class TemporaryObjectIdentityExpr extends Expr {
+  TemporaryObjectIdentityExpr() {
+    getType() instanceof StructOrUnionTypeWithArrayField and
+    not isCLValue(this)
+  }
+}
+
+/**
+ * 6.2.4.7, A non-lvalue expression with struct or or union type that has a field member of array
+ * type, is an object with automatic storage duration (and has temporary lifetime).
+ */
+class TemporaryObjectIdentity extends ObjectIdentityBase instanceof TemporaryObjectIdentityExpr {
+  TemporaryObjectIdentity() {
+    // See comment in `TemporaryObjectIdentityExpr` for why we check `getASubobjectAccess()` here.
+    not exists(TemporaryObjectIdentityExpr parent |
+      this = getASubobjectAccessOf(parent) and
+      not this = parent
+    )
+  }
+
+  override StorageDuration getStorageDuration() { result.isAutomatic() }
+
+  override Type getType() { result = this.(Expr).getType() }
+
+  override Expr getAnAccess() { result = this }
+
+  override predicate hasTemporaryLifetime() { any() }
+}
diff --git a/c/common/src/codingstandards/c/OutOfBounds.qll b/c/common/src/codingstandards/c/OutOfBounds.qll
index 21255827dd..1f1680f56c 100644
--- a/c/common/src/codingstandards/c/OutOfBounds.qll
+++ b/c/common/src/codingstandards/c/OutOfBounds.qll
@@ -5,13 +5,13 @@
  */
 
 import cpp
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 import codingstandards.c.Variable
 import codingstandards.cpp.Allocations
 import codingstandards.cpp.Overflow
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 import codingstandards.cpp.SimpleRangeAnalysisCustomizations
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 module OOB {
diff --git a/c/common/src/codingstandards/c/Signal.qll b/c/common/src/codingstandards/c/Signal.qll
index 35286be4d9..2a570b654f 100644
--- a/c/common/src/codingstandards/c/Signal.qll
+++ b/c/common/src/codingstandards/c/Signal.qll
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * A signal corresponding to a computational exception
diff --git a/c/common/src/codingstandards/c/StorageDuration.qll b/c/common/src/codingstandards/c/StorageDuration.qll
new file mode 100644
index 0000000000..4669d467bb
--- /dev/null
+++ b/c/common/src/codingstandards/c/StorageDuration.qll
@@ -0,0 +1,31 @@
+import cpp
+
+class DeclarationWithStorageDuration extends Declaration { }
+
+newtype TStorageDuration =
+  StorageDurationStatic() or
+  StorageDurationAutomatic() or
+  StorageDurationThread() or
+  StorageDurationAllocated()
+
+class StorageDuration extends TStorageDuration {
+  predicate isStatic() { this = StorageDurationStatic() }
+
+  predicate isAutomatic() { this = StorageDurationAutomatic() }
+
+  predicate isThread() { this = StorageDurationThread() }
+
+  predicate isAllocated() { this = StorageDurationAllocated() }
+
+  string toString() { result = getStorageTypeName() + " storage duration" }
+
+  string getStorageTypeName() {
+    isStatic() and result = "static"
+    or
+    isAutomatic() and result = "automatic"
+    or
+    isThread() and result = "thread"
+    or
+    isAllocated() and result = "allocated"
+  }
+}
diff --git a/c/common/src/codingstandards/c/SubObjects.qll b/c/common/src/codingstandards/c/SubObjects.qll
new file mode 100644
index 0000000000..66f15cd18c
--- /dev/null
+++ b/c/common/src/codingstandards/c/SubObjects.qll
@@ -0,0 +1,125 @@
+/**
+ * A library that expands upon the `Objects.qll` library, to support nested "Objects" such as
+ * `x.y.z` or `x[i][j]` within an object `x`.
+ *
+ * Objects in C are values in memory, that have a type and a storage duration. In the case of
+ * array objects and struct objects, the object will contain other objects. The these subobjects
+ * will share properties of the root object such as storage duration. This library can be used to,
+ * for instance, find all usages of a struct member to ensure that member is initialized before it
+ * is used.
+ *
+ * To use this library, select `SubObject` and find its usages in the AST via `getAnAccess()` (to
+ * find usages of the subobject by value) or `getAnAddressOfExpr()` (to find usages of the object
+ * by address).
+ *
+ * Note that a struct or array object may contain a pointer. In this case, the pointer itself is
+ * a subobject of the struct or array object, but the object that the pointer points to is not.
+ * This is because the pointed-to object does not necessarily have the same storage duration,
+ * lifetime, or linkage as the pointer and the object containing the pointer.
+ *
+ * Note as well that `getAnAccess()` on an array subobject will return all accesses to the array,
+ * not just accesses to a particular index. For this reason, `SubObject` exposes the predicate
+ * `isPrecise()`. If a subobject is precise, that means all results of `getAnAccess()` will
+ * definitely refer to the same object in memory. If it is not precise, the different accesses
+ * may refer to the same or different objects in memory. For instance, `x[i].y` and `x[j].y` are
+ * the same object if `i` and `j` are the same, but they are different objects if `i` and `j` are
+ * different.
+ */
+
+import codingstandards.c.Objects
+
+newtype TSubObject =
+  TObjectRoot(ObjectIdentity i) or
+  TObjectMember(SubObject struct, MemberVariable m) {
+    m = struct.getType().(Struct).getAMemberVariable()
+  } or
+  TObjectIndex(SubObject array) { array.getType() instanceof ArrayType }
+
+class SubObject extends TSubObject {
+  string toString() {
+    exists(ObjectIdentity i |
+      this = TObjectRoot(i) and
+      result = i.toString()
+    )
+    or
+    exists(SubObject struct, Variable m |
+      this = TObjectMember(struct, m) and
+      result = struct.toString() + "." + m.getName()
+    )
+    or
+    exists(SubObject array |
+      this = TObjectIndex(array) and
+      result = array.toString()
+    )
+  }
+
+  Type getType() {
+    exists(ObjectIdentity i |
+      this = TObjectRoot(i) and
+      result = i.getType()
+    )
+    or
+    exists(Variable m |
+      this = TObjectMember(_, m) and
+      result = m.getType()
+    )
+    or
+    exists(SubObject array |
+      this = TObjectIndex(array) and
+      result = array.getType().(ArrayType).getBaseType()
+    )
+  }
+
+  /**
+   * Holds for object roots and for member accesses on that root, not for array accesses.
+   *
+   * This is useful for cases where we do not wish to treat `x[y]` and `x[z]` as the same object.
+   */
+  predicate isPrecise() { not getParent*() = TObjectIndex(_) }
+
+  SubObject getParent() {
+    exists(SubObject struct, MemberVariable m |
+      this = TObjectMember(struct, m) and
+      result = struct
+    )
+    or
+    exists(SubObject array |
+      this = TObjectIndex(array) and
+      result = array
+    )
+  }
+
+  Expr getAnAccess() {
+    exists(ObjectIdentity i |
+      this = TObjectRoot(i) and
+      result = i.getAnAccess()
+    )
+    or
+    exists(MemberVariable m |
+      this = TObjectMember(_, m) and
+      result = m.getAnAccess() and
+      // Only consider `DotFieldAccess`es, not `PointerFieldAccess`es, as the latter
+      // are not subobjects of the root object:
+      result.(DotFieldAccess).getQualifier() = getParent().getAnAccess()
+    )
+    or
+    this = TObjectIndex(_) and
+    result.(ArrayExpr).getArrayBase() = getParent().getAnAccess()
+  }
+
+  AddressOfExpr getAnAddressOfExpr() { result.getOperand() = this.getAnAccess() }
+
+  /**
+   * Get the "root" object identity to which this subobject belongs. For instance, in the
+   * expression `x.y.z`, the root object is `x`. This subobject will share properties with the root
+   * object such as storage duration, lifetime, and linkage.
+   */
+  ObjectIdentity getRootIdentity() {
+    exists(ObjectIdentity i |
+      this = TObjectRoot(i) and
+      result = i
+    )
+    or
+    result = getParent().getRootIdentity()
+  }
+}
diff --git a/c/common/src/codingstandards/c/TgMath.qll b/c/common/src/codingstandards/c/TgMath.qll
new file mode 100644
index 0000000000..8d68cd2574
--- /dev/null
+++ b/c/common/src/codingstandards/c/TgMath.qll
@@ -0,0 +1,102 @@
+import cpp
+
+private string getATgMathMacroName(boolean allowComplex, int numberOfParameters) {
+  allowComplex = true and
+  numberOfParameters = 1 and
+  result =
+    [
+      "acos", "acosh", "asin", "asinh", "atan", "atanh", "carg", "cimag", "conj", "cos", "cosh",
+      "cproj", "creal", "exp", "fabs", "log", "sin", "sinh", "sqrt", "tan", "tanh"
+    ]
+  or
+  allowComplex = true and
+  numberOfParameters = 2 and
+  result = "pow"
+  or
+  allowComplex = false and
+  numberOfParameters = 1 and
+  result =
+    [
+      "cbrt", "ceil", "erf", "erfc", "exp2", "expm1", "floor", "ilogb", "lgamma", "llrint",
+      "llround", "log10", "log1p", "log2", "logb", "lrint", "lround", "nearbyint", "rint", "round",
+      "tgamma", "trunc",
+    ]
+  or
+  allowComplex = false and
+  numberOfParameters = 2 and
+  result =
+    [
+      "atan2", "copysign", "fdim", "fmax", "fmin", "fmod", "frexp", "hypot", "ldexp", "nextafter",
+      "nexttoward", "remainder", "scalbn", "scalbln"
+    ]
+  or
+  allowComplex = false and
+  numberOfParameters = 3 and
+  result = ["fma", "remquo"]
+}
+
+private predicate hasOutputArgument(string macroName, int index) {
+  macroName = "frexp" and index = 1
+  or
+  macroName = "remquo" and index = 2
+}
+
+class TgMathInvocation extends MacroInvocation {
+  Call call;
+  boolean allowComplex;
+  int numberOfParameters;
+
+  TgMathInvocation() {
+    this.getMacro().getName() = getATgMathMacroName(allowComplex, numberOfParameters) and
+    call = getBestCallInExpansion(this)
+  }
+
+  /** Account for extra parameters added by gcc */
+  private int getParameterOffset() {
+    // Gcc calls look something like: `__builtin_tgmath(cosf, cosd, cosl, arg)`, in this example
+    // there is a parameter offset of 3, so `getOperandArgument(0)` is equivalent to
+    // `call.getArgument(3)`.
+    result = call.getNumberOfArguments() - numberOfParameters
+  }
+
+  Expr getOperandArgument(int i) {
+    i >= 0 and
+    result = call.getArgument(i + getParameterOffset()) and
+    //i in [0..numberOfParameters - 1] and
+    not hasOutputArgument(getMacro().getName(), i)
+  }
+
+  /** Get all explicit conversions, except those added by clang in the macro body */
+  Expr getExplicitlyConvertedOperandArgument(int i) {
+    exists(Expr explicitConv |
+      explicitConv = getOperandArgument(i).getExplicitlyConverted() and
+      // clang explicitly casts most arguments, but not some integer arguments such as in `scalbn`.
+      if call.getTarget().getName().matches("__tg_%") and explicitConv instanceof Conversion
+      then result = explicitConv.(Conversion).getExpr()
+      else result = explicitConv
+    )
+  }
+
+  int getNumberOfOperandArguments() {
+    result = numberOfParameters - count(int i | hasOutputArgument(getMacroName(), i))
+  }
+
+  Expr getAnOperandArgument() { result = getOperandArgument(_) }
+
+  predicate allowsComplex() { allowComplex = true }
+}
+
+private Call getACallInExpansion(MacroInvocation mi) { result = mi.getAnExpandedElement() }
+
+private Call getNameMatchedCallInExpansion(MacroInvocation mi) {
+  result = getACallInExpansion(mi) and result.getTarget().getName() = mi.getMacroName()
+}
+
+private Call getBestCallInExpansion(MacroInvocation mi) {
+  count(getACallInExpansion(mi)) = 1 and result = getACallInExpansion(mi)
+  or
+  count(getNameMatchedCallInExpansion(mi)) = 1 and result = getNameMatchedCallInExpansion(mi)
+  or
+  count(getNameMatchedCallInExpansion(mi)) > 1 and
+  result = rank[1](Call c | c = getACallInExpansion(mi) | c order by c.getTarget().getName())
+}
diff --git a/c/common/src/codingstandards/c/UndefinedBehavior.qll b/c/common/src/codingstandards/c/UndefinedBehavior.qll
index 6a72cb6eb7..47461aa613 100644
--- a/c/common/src/codingstandards/c/UndefinedBehavior.qll
+++ b/c/common/src/codingstandards/c/UndefinedBehavior.qll
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 import codingstandards.cpp.UndefinedBehavior
 
 /**
diff --git a/c/common/src/codingstandards/c/initialization/GlobalInitializationAnalysis.qll b/c/common/src/codingstandards/c/initialization/GlobalInitializationAnalysis.qll
new file mode 100644
index 0000000000..2906883ae9
--- /dev/null
+++ b/c/common/src/codingstandards/c/initialization/GlobalInitializationAnalysis.qll
@@ -0,0 +1,95 @@
+import cpp
+import codingstandards.c.Objects
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.Type
+
+signature module GlobalInitializationAnalysisConfigSig {
+  /** A function which is not called or started as a thread */
+  default predicate isRootFunction(Function f) {
+    not exists(Function f2 | f2.calls(f)) and
+    not f instanceof ThreadedFunction and
+    // Exclude functions which are used as function pointers.
+    not exists(FunctionAccess access | f = access.getTarget())
+  }
+
+  ObjectIdentity getAnInitializedObject(Expr e);
+
+  ObjectIdentity getAUsedObject(Expr e);
+}
+
+module GlobalInitalizationAnalysis<GlobalInitializationAnalysisConfigSig Config> {
+  final class FinalFunction = Function;
+
+  final class FinalExpr = Expr;
+
+  class RootFunction extends FinalFunction {
+    RootFunction() { Config::isRootFunction(this) }
+  }
+
+  /** A function call which initializes a mutex or a condition */
+  class ObjectInit extends FinalExpr {
+    ObjectIdentity owningObject;
+
+    ObjectInit() { owningObject = Config::getAnInitializedObject(this) }
+
+    ObjectIdentity getOwningObject() { result = owningObject }
+  }
+
+  /**
+   * A function argument where that argument is used as a mutex or condition object.
+   */
+  class ObjectUse extends FinalExpr {
+    ObjectIdentity owningObject;
+
+    ObjectUse() { owningObject = Config::getAUsedObject(this) }
+
+    ObjectIdentity getOwningObject() { result = owningObject }
+  }
+
+  predicate requiresInitializedMutexObject(
+    Function func, ObjectUse mutexUse, ObjectIdentity owningObject
+  ) {
+    mutexUse.getEnclosingFunction() = func and
+    owningObject = mutexUse.getOwningObject() and
+    not exists(ObjectInit init |
+      init.getEnclosingFunction() = func and
+      init.getOwningObject() = owningObject and
+      mutexUse.getAPredecessor+() = init
+    )
+    or
+    exists(FunctionCall call |
+      func = call.getEnclosingFunction() and
+      requiresInitializedMutexObject(call.getTarget(), mutexUse, owningObject) and
+      not exists(ObjectInit init |
+        call.getAPredecessor*() = init and
+        init.getOwningObject() = owningObject
+      )
+    )
+    or
+    exists(C11ThreadCreateCall call |
+      func = call.getEnclosingFunction() and
+      not owningObject.getStorageDuration().isThread() and
+      requiresInitializedMutexObject(call.getFunction(), mutexUse, owningObject) and
+      not exists(ObjectInit init |
+        call.getAPredecessor*() = init and
+        init.getOwningObject() = owningObject
+      )
+    )
+  }
+
+  predicate uninitializedFrom(Expr e, ObjectIdentity obj, Function callRoot) {
+    exists(ObjectUse use | use = e |
+      obj = use.getOwningObject() and
+      requiresInitializedMutexObject(callRoot, use, obj) and
+      (
+        if obj.getStorageDuration().isAutomatic()
+        then obj.getEnclosingElement+() = callRoot
+        else (
+          obj.getStorageDuration().isThread() and callRoot instanceof ThreadedFunction
+          or
+          callRoot instanceof RootFunction
+        )
+      )
+    )
+  }
+}
diff --git a/c/common/src/qlpack.yml b/c/common/src/qlpack.yml
index 41bf42d337..068e7c3f2f 100644
--- a/c/common/src/qlpack.yml
+++ b/c/common/src/qlpack.yml
@@ -1,6 +1,6 @@
 name: codeql/common-c-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 license: MIT
 dependencies:
   codeql/common-cpp-coding-standards: '*'
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
diff --git a/c/common/test/codeql-pack.lock.yml b/c/common/test/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/c/common/test/codeql-pack.lock.yml
+++ b/c/common/test/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/c/common/test/includes/standard-library/stdatomic.h b/c/common/test/includes/standard-library/stdatomic.h
index 66b74ae61a..21e4f995f4 100644
--- a/c/common/test/includes/standard-library/stdatomic.h
+++ b/c/common/test/includes/standard-library/stdatomic.h
@@ -1,9 +1,70 @@
-#define atomic_compare_exchange_weak(a, b, c) 0
-#define atomic_compare_exchange_weak_explicit(a, b, c, d, e) 0
-#define atomic_load(a) 0
-#define atomic_load_explicit(a, b)
-#define atomic_store(a, b) 0
-#define atomic_store_explicit(a, b, c) 0
 #define ATOMIC_VAR_INIT(value) (value)
+#define atomic_init __c11_atomic_init
 #define atomic_is_lock_free(obj) __c11_atomic_is_lock_free(sizeof(*(obj)))
-typedef _Atomic(int) atomic_int;
\ No newline at end of file
+typedef _Atomic(int) atomic_int;
+
+#define __ATOMIC_RELAXED 0
+#define __ATOMIC_CONSUME 1
+#define __ATOMIC_ACQUIRE 2
+#define __ATOMIC_RELEASE 3
+#define __ATOMIC_ACQ_REL 4
+#define __ATOMIC_SEQ_CST 5
+
+typedef enum memory_order {
+  memory_order_relaxed = __ATOMIC_RELAXED,
+  memory_order_consume = __ATOMIC_CONSUME,
+  memory_order_acquire = __ATOMIC_ACQUIRE,
+  memory_order_release = __ATOMIC_RELEASE,
+  memory_order_acq_rel = __ATOMIC_ACQ_REL,
+  memory_order_seq_cst = __ATOMIC_SEQ_CST
+} memory_order;
+
+void atomic_thread_fence(memory_order);
+void atomic_signal_fence(memory_order);
+
+#define atomic_thread_fence(order) __c11_atomic_thread_fence(order)
+#define atomic_signal_fence(order) __c11_atomic_signal_fence(order)
+
+#define atomic_store(object, desired) __c11_atomic_store(object, desired, __ATOMIC_SEQ_CST)
+#define atomic_store_explicit __c11_atomic_store
+
+#define atomic_load(object) __c11_atomic_load(object, __ATOMIC_SEQ_CST)
+#define atomic_load_explicit __c11_atomic_load
+
+#define atomic_exchange(object, desired) __c11_atomic_exchange(object, desired, __ATOMIC_SEQ_CST)
+#define atomic_exchange_explicit __c11_atomic_exchange
+
+#define atomic_compare_exchange_strong(object, expected, desired) __c11_atomic_compare_exchange_strong(object, expected, desired, __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST)
+#define atomic_compare_exchange_strong_explicit __c11_atomic_compare_exchange_strong
+
+#define atomic_compare_exchange_weak(object, expected, desired) __c11_atomic_compare_exchange_weak(object, expected, desired, __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST)
+#define atomic_compare_exchange_weak_explicit __c11_atomic_compare_exchange_weak
+
+#define atomic_fetch_add(object, operand) __c11_atomic_fetch_add(object, operand, __ATOMIC_SEQ_CST)
+#define atomic_fetch_add_explicit __c11_atomic_fetch_add
+
+#define atomic_fetch_sub(object, operand) __c11_atomic_fetch_sub(object, operand, __ATOMIC_SEQ_CST)
+#define atomic_fetch_sub_explicit __c11_atomic_fetch_sub
+
+#define atomic_fetch_or(object, operand) __c11_atomic_fetch_or(object, operand, __ATOMIC_SEQ_CST)
+#define atomic_fetch_or_explicit __c11_atomic_fetch_or
+
+#define atomic_fetch_xor(object, operand) __c11_atomic_fetch_xor(object, operand, __ATOMIC_SEQ_CST)
+#define atomic_fetch_xor_explicit __c11_atomic_fetch_xor
+
+#define atomic_fetch_and(object, operand) __c11_atomic_fetch_and(object, operand, __ATOMIC_SEQ_CST)
+#define atomic_fetch_and_explicit __c11_atomic_fetch_and
+
+typedef struct atomic_flag { _Atomic(_Bool) _Value; } atomic_flag;
+
+_Bool atomic_flag_test_and_set(volatile atomic_flag *);
+_Bool atomic_flag_test_and_set_explicit(volatile atomic_flag *, memory_order);
+
+void atomic_flag_clear(volatile atomic_flag *);
+void atomic_flag_clear_explicit(volatile atomic_flag *, memory_order);
+
+#define atomic_flag_test_and_set(object) __c11_atomic_exchange(&(object)->_Value, 1, __ATOMIC_SEQ_CST)
+#define atomic_flag_test_and_set_explicit(object, order) __c11_atomic_exchange(&(object)->_Value, 1, order)
+
+#define atomic_flag_clear(object) __c11_atomic_store(&(object)->_Value, 0, __ATOMIC_SEQ_CST)
+#define atomic_flag_clear_explicit(object, order) __c11_atomic_store(&(object)->_Value, 0, order)
\ No newline at end of file
diff --git a/c/common/test/includes/standard-library/stdlib.h b/c/common/test/includes/standard-library/stdlib.h
index b54a051fe9..1af95223d1 100644
--- a/c/common/test/includes/standard-library/stdlib.h
+++ b/c/common/test/includes/standard-library/stdlib.h
@@ -49,6 +49,7 @@ int at_quick_exit (void (*) (void));
 _Noreturn void quick_exit (int);
 
 char *getenv (const char *);
+char *getenv_s (size_t *restrict len, char *restrict value, size_t valuesz, const char *restrict name);
 
 int system (const char *);
 
diff --git a/c/common/test/library/identifierlinkage/IdentifierLinkage.expected b/c/common/test/library/identifierlinkage/IdentifierLinkage.expected
new file mode 100644
index 0000000000..c3f1bc39ef
--- /dev/null
+++ b/c/common/test/library/identifierlinkage/IdentifierLinkage.expected
@@ -0,0 +1,10 @@
+| identifierlinkage.c:2:5:2:10 | g_ext1 | external linkage |
+| identifierlinkage.c:3:12:3:17 | g_ext2 | external linkage |
+| identifierlinkage.c:6:12:6:17 | g_int1 | internal linkage |
+| identifierlinkage.c:9:5:9:10 | g_ext3 | external linkage |
+| identifierlinkage.c:12:12:12:17 | g_int2 | internal linkage |
+| identifierlinkage.c:15:12:15:12 | p | no linkage |
+| identifierlinkage.c:16:7:16:13 | l_none1 | no linkage |
+| identifierlinkage.c:17:14:17:20 | l_none2 | no linkage |
+| identifierlinkage.c:18:14:18:19 | l_ext1 | external linkage |
+| identifierlinkage.c:24:7:24:7 | m | no linkage |
diff --git a/c/common/test/library/identifierlinkage/IdentifierLinkage.ql b/c/common/test/library/identifierlinkage/IdentifierLinkage.ql
new file mode 100644
index 0000000000..37e5b4cd58
--- /dev/null
+++ b/c/common/test/library/identifierlinkage/IdentifierLinkage.ql
@@ -0,0 +1,5 @@
+import codingstandards.c.IdentifierLinkage
+
+from Variable v
+where not v.getLocation().toString() = "file://:0:0:0:0"
+select v, linkageOfVariable(v)
diff --git a/c/common/test/library/identifierlinkage/identifierlinkage.c b/c/common/test/library/identifierlinkage/identifierlinkage.c
new file mode 100644
index 0000000000..25265aa144
--- /dev/null
+++ b/c/common/test/library/identifierlinkage/identifierlinkage.c
@@ -0,0 +1,28 @@
+// Simple external linkage
+int g_ext1;
+extern int g_ext2;
+
+// Simple internal linkage
+static int g_int1;
+
+// Redefined maintaining linkage
+int g_ext3;
+extern int g_ext3;
+
+static int g_int2;
+extern int g_int2;
+
+void f(int p) {
+  int l_none1;
+  static int l_none2;
+  extern int l_ext1;
+}
+
+// Structs are not variables
+struct s {
+  // Struct members are variables with no linkage.
+  int m;
+};
+
+// Enums and enum constants are not variables and have no linkage.
+enum e { E1 };
\ No newline at end of file
diff --git a/c/common/test/library/objects/ObjectIdentity.expected b/c/common/test/library/objects/ObjectIdentity.expected
new file mode 100644
index 0000000000..34be1974f5
--- /dev/null
+++ b/c/common/test/library/objects/ObjectIdentity.expected
@@ -0,0 +1,21 @@
+| objectidentity.c:3:5:3:14 | g_statstg1 | static storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:4:12:4:21 | g_statstg2 | static storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:5:12:5:21 | g_statstg3 | static storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:8:13:8:22 | p_autostg1 | automatic storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:8:31:8:40 | l_autostg2 | automatic storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:12:14:12:23 | l_statstg1 | static storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:13:14:13:23 | l_statstg2 | static storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:17:15:17:24 | g_thrdstg1 | thread storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:18:22:18:31 | g_thrdstg2 | thread storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:19:22:19:31 | g_thrdstg3 | thread storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:21:24:21:33 | l_statstg3 | thread storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:22:24:22:33 | l_statstg4 | thread storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:35:11:35:20 | g_statstg4 | static storage duration | file://:0:0:0:0 | s * |
+| objectidentity.c:35:35:35:37 | {...} | static storage duration | objectidentity.c:27:8:27:8 | s |
+| objectidentity.c:35:36:35:36 | 0 | static storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:36:7:36:16 | g_statstg5 | static storage duration | file://:0:0:0:0 | char * |
+| objectidentity.c:36:20:36:26 | hello | static storage duration | file://:0:0:0:0 | char[6] |
+| objectidentity.c:38:3:38:3 | 1 | static storage duration | file://:0:0:0:0 | int |
+| objectidentity.c:39:3:39:9 | hello | static storage duration | file://:0:0:0:0 | char[6] |
+| objectidentity.c:40:3:40:15 | {...} | automatic storage duration | objectidentity.c:27:8:27:8 | s |
+| objectidentity.c:40:14:40:14 | 1 | static storage duration | file://:0:0:0:0 | int |
diff --git a/c/common/test/library/objects/ObjectIdentity.ql b/c/common/test/library/objects/ObjectIdentity.ql
new file mode 100644
index 0000000000..0e92e588ba
--- /dev/null
+++ b/c/common/test/library/objects/ObjectIdentity.ql
@@ -0,0 +1,5 @@
+import codingstandards.c.Objects
+
+from ObjectIdentity obj
+where obj.getFile().getBaseName() = "objectidentity.c"
+select obj, obj.getStorageDuration(), obj.getType()
diff --git a/c/common/test/library/objects/objectidentity.c b/c/common/test/library/objects/objectidentity.c
new file mode 100644
index 0000000000..066f68b1fd
--- /dev/null
+++ b/c/common/test/library/objects/objectidentity.c
@@ -0,0 +1,41 @@
+#include "threads.h"
+// Basic static storage duration
+int g_statstg1;
+extern int g_statstg2;
+static int g_statstg3;
+
+// Basic automatic storage duration
+void f1(int p_autostg1) { int l_autostg2; }
+
+// Block identifiers with static storage duration
+void f2(void) {
+  extern int l_statstg1;
+  static int l_statstg2;
+}
+
+// Thread storage duration
+_Thread_local g_thrdstg1;
+extern _Thread_local g_thrdstg2;
+static _Thread_local g_thrdstg3;
+void f3() {
+  extern _Thread_local l_statstg3;
+  static _Thread_local l_statstg4;
+}
+
+// Struct declarations do not allocate storage, and do not have a storage
+// duration.
+struct s {
+  int m;
+};
+
+// Enums and enum constants are not variables and have no linkage.
+enum e { E1 };
+
+// Various literals:
+struct s *g_statstg4 = &(struct s){0};
+char *g_statstg5 = "hello";
+void f4(void) {
+  1;
+  "hello";
+  (struct s){1};
+}
\ No newline at end of file
diff --git a/c/common/test/qlpack.yml b/c/common/test/qlpack.yml
index 41737a34ec..da30625ddb 100644
--- a/c/common/test/qlpack.yml
+++ b/c/common/test/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/common-c-coding-standards-tests
-version: 2.39.0-dev
+version: 2.49.0-dev
 extractor: cpp
 license: MIT
 dependencies:
diff --git a/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected
new file mode 100644
index 0000000000..c318f791e9
--- /dev/null
+++ b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected
@@ -0,0 +1,21 @@
+| test.c:9:7:9:14 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:30:11:30:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:31:3:31:13 | (unsigned int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:31:11:31:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:33:11:33:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:34:11:34:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:35:3:35:13 | (unsigned int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:35:11:35:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:36:3:36:13 | (unsigned int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:36:11:36:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:37:3:37:13 | (unsigned int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:37:11:37:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:38:3:38:13 | (unsigned int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:38:11:38:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:39:11:39:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:40:11:40:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:41:3:41:13 | (unsigned int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:41:11:41:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:42:12:42:13 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:44:11:44:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:45:11:45:12 | (int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
diff --git a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.clang b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.clang
similarity index 75%
rename from c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.clang
rename to c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.clang
index 1cf143a196..0378c8a6b5 100644
--- a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.clang
+++ b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.clang
@@ -1,8 +1,6 @@
-| test.c:7:7:7:14 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:28:3:28:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:29:3:29:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:9:7:9:14 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:30:3:30:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:31:3:31:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:32:3:32:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:33:3:33:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:34:3:34:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:35:3:35:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
@@ -10,6 +8,8 @@
 | test.c:37:3:37:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:38:3:38:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:39:3:39:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:40:3:40:14 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:42:11:42:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:43:11:43:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:40:3:40:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:41:3:41:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:42:3:42:14 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:44:11:44:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:45:11:45:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
diff --git a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.gcc b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.gcc
similarity index 78%
rename from c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.gcc
rename to c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.gcc
index 1cf143a196..f729c9e42d 100644
--- a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.gcc
+++ b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.gcc
@@ -1,8 +1,6 @@
-| test.c:7:7:7:14 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:28:3:28:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:29:3:29:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:9:7:9:14 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:30:3:30:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:31:3:31:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:32:3:32:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:33:3:33:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:34:3:34:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:35:3:35:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
@@ -10,6 +8,8 @@
 | test.c:37:3:37:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:38:3:38:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:39:3:39:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:40:3:40:14 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:42:11:42:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:40:3:40:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:41:3:41:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:42:3:42:14 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:43:11:43:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:44:11:44:12 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
diff --git a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.qcc b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.qcc
similarity index 75%
rename from c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.qcc
rename to c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.qcc
index fec6522014..551423495c 100644
--- a/c/cert/test/rules/STR34-C/CastCharBeforeConvertingToLargerSizes.expected.qcc
+++ b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected.qcc
@@ -1,8 +1,6 @@
-| test.c:7:7:7:14 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:28:3:28:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:29:3:29:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:9:7:9:14 | * ... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:30:3:30:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:31:3:31:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:32:3:32:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:33:3:33:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:34:3:34:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:35:3:35:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
@@ -10,6 +8,8 @@
 | test.c:37:3:37:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:38:3:38:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
 | test.c:39:3:39:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:40:3:40:14 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:42:3:42:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
-| test.c:43:3:43:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:40:3:40:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:41:3:41:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:42:3:42:14 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:44:3:44:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.c:45:3:45:13 | (...) | Expression not converted to `unsigned char` before converting to a larger integer type. |
diff --git a/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.ql b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.ql
new file mode 100644
index 0000000000..2a1e49774f
--- /dev/null
+++ b/c/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.castcharbeforeconvertingtolargersizes.CastCharBeforeConvertingToLargerSizes
+
+class TestFileQuery extends CastCharBeforeConvertingToLargerSizesSharedQuery, TestQuery { }
diff --git a/c/cert/test/rules/STR34-C/test.c b/c/common/test/rules/castcharbeforeconvertingtolargersizes/test.c
similarity index 95%
rename from c/cert/test/rules/STR34-C/test.c
rename to c/common/test/rules/castcharbeforeconvertingtolargersizes/test.c
index d4bd825c8e..8865e477fb 100644
--- a/c/cert/test/rules/STR34-C/test.c
+++ b/c/common/test/rules/castcharbeforeconvertingtolargersizes/test.c
@@ -1,3 +1,5 @@
+// NOTICE: THE TEST CASES BELOW ARE ALSO INCLUDED IN THE C++ TEST CASE AND
+// CHANGES SHOULD BE REFLECTED THERE AS WELL.
 #include <ctype.h>
 #include <stdio.h>
 
diff --git a/c/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected b/c/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected
index c595e7e5f7..75866b8503 100644
--- a/c/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected
+++ b/c/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected
@@ -4,10 +4,10 @@ problems
 | test.c:13:10:13:11 | p4 | test.c:5:14:5:15 | l2 | test.c:13:10:13:11 | p4 | Subtraction between left operand pointing to array $@ and other operand pointing to array $@. | test.c:3:7:3:8 | l2 | l2 | test.c:2:7:2:8 | l1 | l1 |
 | test.c:13:15:13:16 | l1 | test.c:13:15:13:16 | l1 | test.c:13:15:13:16 | l1 | Subtraction between right operand pointing to array $@ and other operand pointing to array $@. | test.c:2:7:2:8 | l1 | l1 | test.c:3:7:3:8 | l2 | l2 |
 edges
-| test.c:4:14:4:15 | l1 | test.c:4:14:4:18 | access to array | provenance |  |
+| test.c:4:14:4:15 | l1 | test.c:4:14:4:18 | access to array | provenance | Config |
 | test.c:4:14:4:18 | access to array | test.c:10:10:10:11 | p1 | provenance |  |
 | test.c:4:14:4:18 | access to array | test.c:12:10:12:11 | p1 | provenance |  |
-| test.c:5:14:5:15 | l2 | test.c:5:14:5:19 | access to array | provenance |  |
+| test.c:5:14:5:15 | l2 | test.c:5:14:5:19 | access to array | provenance | Config |
 | test.c:5:14:5:19 | access to array | test.c:11:10:11:11 | p2 | provenance |  |
 | test.c:5:14:5:19 | access to array | test.c:12:15:12:16 | p2 | provenance |  |
 | test.c:5:14:5:19 | access to array | test.c:13:10:13:11 | p4 | provenance |  |
diff --git a/c/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected b/c/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected
index 1d487765df..bc471c0dc4 100644
--- a/c/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected
+++ b/c/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected
@@ -1,5 +1,5 @@
-| test.c:4:13:4:18 | ... + ... | Array pointer p2 points 1 element passed the end of $@. | test.c:2:7:2:8 | l1 | l1 |
-| test.c:5:13:5:18 | ... + ... | Array pointer p3 points 1 element passed the end of $@. | test.c:2:7:2:8 | l1 | l1 |
-| test.c:6:13:6:18 | & ... | Array pointer p4 points 1 element passed the end of $@. | test.c:2:7:2:8 | l1 | l1 |
-| test.c:11:8:11:11 | ... -- | Array pointer p7 points 1 element passed the end of $@. | test.c:2:7:2:8 | l1 | l1 |
-| test.c:12:8:12:9 | p3 | Array pointer p8 points 1 element passed the end of $@. | test.c:2:7:2:8 | l1 | l1 |
+| test.c:4:13:4:18 | ... + ... | Array pointer p2 points 1 element past the end of $@. | test.c:2:7:2:8 | l1 | l1 |
+| test.c:5:13:5:18 | ... + ... | Array pointer p3 points 1 element past the end of $@. | test.c:2:7:2:8 | l1 | l1 |
+| test.c:6:13:6:18 | & ... | Array pointer p4 points 1 element past the end of $@. | test.c:2:7:2:8 | l1 | l1 |
+| test.c:11:8:11:11 | ... -- | Array pointer p7 points 1 element past the end of $@. | test.c:2:7:2:8 | l1 | l1 |
+| test.c:12:8:12:9 | p3 | Array pointer p8 points 1 element past the end of $@. | test.c:2:7:2:8 | l1 | l1 |
diff --git a/c/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected b/c/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
index 05c0ed4ca0..bda6c7ad05 100644
--- a/c/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
+++ b/c/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
@@ -11,17 +11,17 @@ problems
 | test.c:25:7:25:14 | ... >= ... | test.c:25:13:25:14 | l3 | test.c:25:13:25:14 | l3 | Compare operation >= comparing right operand pointing to array $@ and other operand pointing to array $@. | test.c:4:7:4:8 | l3 | l3 | test.c:2:7:2:8 | l1 | l1 |
 edges
 | test.c:6:13:6:14 | l1 | test.c:13:12:13:13 | p0 | provenance |  |
-| test.c:7:14:7:15 | l1 | test.c:7:14:7:18 | access to array | provenance |  |
+| test.c:7:14:7:15 | l1 | test.c:7:14:7:18 | access to array | provenance | Config |
 | test.c:7:14:7:18 | access to array | test.c:11:7:11:8 | p1 | provenance |  |
 | test.c:7:14:7:18 | access to array | test.c:13:7:13:8 | p1 | provenance |  |
 | test.c:7:14:7:18 | access to array | test.c:15:13:15:14 | p1 | provenance |  |
 | test.c:7:14:7:18 | access to array | test.c:17:7:17:8 | p1 | provenance |  |
 | test.c:7:14:7:18 | access to array | test.c:23:13:23:14 | p1 | provenance |  |
 | test.c:7:14:7:18 | access to array | test.c:25:7:25:8 | p1 | provenance |  |
-| test.c:8:14:8:15 | l1 | test.c:8:14:8:18 | access to array | provenance |  |
+| test.c:8:14:8:15 | l1 | test.c:8:14:8:18 | access to array | provenance | Config |
 | test.c:8:14:8:18 | access to array | test.c:11:12:11:13 | p2 | provenance |  |
 | test.c:8:14:8:18 | access to array | test.c:21:7:21:8 | p2 | provenance |  |
-| test.c:9:14:9:15 | l2 | test.c:9:14:9:18 | access to array | provenance |  |
+| test.c:9:14:9:15 | l2 | test.c:9:14:9:18 | access to array | provenance | Config |
 | test.c:9:14:9:18 | access to array | test.c:21:12:21:13 | p3 | provenance |  |
 nodes
 | test.c:6:13:6:14 | l1 | semmle.label | l1 |
diff --git a/c/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.expected b/c/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.expected
new file mode 100644
index 0000000000..dc72201a8a
--- /dev/null
+++ b/c/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.expected
@@ -0,0 +1 @@
+| test.c:16:3:16:8 | call to remove | Return value from remove is not tested for errors. |
diff --git a/c/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql b/c/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql
new file mode 100644
index 0000000000..12c2196efd
--- /dev/null
+++ b/c/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.functionerroneousreturnvaluenottested.FunctionErroneousReturnValueNotTested
+
+class TestFileQuery extends FunctionErroneousReturnValueNotTestedSharedQuery, TestQuery { }
diff --git a/cpp/autosar/test/rules/M0-3-2/test.cpp b/c/common/test/rules/functionerroneousreturnvaluenottested/test.c
similarity index 100%
rename from cpp/autosar/test/rules/M0-3-2/test.cpp
rename to c/common/test/rules/functionerroneousreturnvaluenottested/test.c
diff --git a/c/common/test/rules/functionnoreturnattributecondition/test.c b/c/common/test/rules/functionnoreturnattributecondition/test.c
index 1b0ba759e1..c13654a8e0 100644
--- a/c/common/test/rules/functionnoreturnattributecondition/test.c
+++ b/c/common/test/rules/functionnoreturnattributecondition/test.c
@@ -77,7 +77,7 @@ _Noreturn void test_noreturn_f10(int i) { // COMPLIANT
   case 4:
     thrd_exit(0);
     break;
-  default:
+  default:;
     jmp_buf jb;
     longjmp(jb, 0);
   }
diff --git a/c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.expected b/c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.expected
similarity index 100%
rename from c/cert/test/rules/CON39-C/ThreadWasPreviouslyJoinedOrDetached.expected
rename to c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.expected
diff --git a/c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.ql b/c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.ql
new file mode 100644
index 0000000000..87188403af
--- /dev/null
+++ b/c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.joinordetachthreadonlyonce.JoinOrDetachThreadOnlyOnce
+
+class TestFileQuery extends JoinOrDetachThreadOnlyOnceSharedQuery, TestQuery { }
diff --git a/c/cert/test/rules/CON39-C/test.c b/c/common/test/rules/joinordetachthreadonlyonce/test.c
similarity index 100%
rename from c/cert/test/rules/CON39-C/test.c
rename to c/common/test/rules/joinordetachthreadonlyonce/test.c
diff --git a/c/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.expected b/c/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.expected
new file mode 100644
index 0000000000..f3b94b6095
--- /dev/null
+++ b/c/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.expected
@@ -0,0 +1,113 @@
+problems
+| test.c:12:8:12:9 | l2 | test.c:8:14:8:20 | ... / ... | test.c:12:8:12:9 | l2 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.c:8:14:8:20 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:13:8:13:9 | l3 | test.c:8:14:8:20 | ... / ... | test.c:13:8:13:9 | l3 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.c:8:14:8:20 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:18:8:18:9 | l2 | test.c:8:14:8:20 | ... / ... | test.c:18:3:18:9 | l2 | Possibly infinite float value $@ flows to cast to integer. | test.c:8:14:8:20 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:19:8:19:9 | l3 | test.c:8:14:8:20 | ... / ... | test.c:19:3:19:9 | l3 | Possibly infinite float value $@ flows to cast to integer. | test.c:8:14:8:20 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:27:19:27:20 | l2 | test.c:8:14:8:20 | ... / ... | test.c:27:19:27:20 | l2 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.c:8:14:8:20 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:28:19:28:20 | l3 | test.c:8:14:8:20 | ... / ... | test.c:28:19:28:20 | l3 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.c:8:14:8:20 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:38:8:38:9 | l7 | test.c:31:14:32:15 | ... / ... | test.c:38:3:38:9 | l7 | Possibly infinite float value $@ flows to cast to integer. | test.c:31:14:32:15 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:61:11:61:17 | ... / ... | test.c:61:5:61:18 | ... / ... | test.c:61:5:61:18 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.c:61:11:61:17 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:66:11:66:19 | ... / ... | test.c:66:5:66:20 | ... / ... | test.c:66:5:66:20 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.c:66:11:66:19 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:72:20:72:28 | ... / ... | test.c:72:14:72:29 | ... / ... | test.c:72:14:72:29 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.c:72:20:72:28 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:75:24:75:32 | ... / ... | test.c:75:18:75:33 | ... / ... | test.c:75:18:75:33 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.c:75:24:75:32 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:79:10:79:12 | l12 | test.c:77:15:77:21 | ... / ... | test.c:79:5:79:12 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:87:10:87:12 | l12 | test.c:77:15:77:21 | ... / ... | test.c:87:5:87:12 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:91:10:91:12 | l12 | test.c:77:15:77:21 | ... / ... | test.c:91:5:91:12 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:93:10:93:12 | l12 | test.c:77:15:77:21 | ... / ... | test.c:93:5:93:12 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:99:10:99:12 | l12 | test.c:77:15:77:21 | ... / ... | test.c:99:5:99:12 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:105:10:105:12 | l12 | test.c:77:15:77:21 | ... / ... | test.c:105:5:105:12 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:111:10:111:12 | l12 | test.c:77:15:77:21 | ... / ... | test.c:111:5:111:12 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:114:21:114:23 | l12 | test.c:77:15:77:21 | ... / ... | test.c:114:16:114:23 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:117:28:117:30 | l12 | test.c:77:15:77:21 | ... / ... | test.c:117:23:117:30 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:120:25:120:27 | l12 | test.c:77:15:77:21 | ... / ... | test.c:120:20:120:27 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.c:77:15:77:21 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:163:9:164:15 | ... / ... | test.c:163:3:164:16 | ... / ... | test.c:163:3:164:16 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.c:163:9:164:15 | ... / ... | from division by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:175:32:175:32 | p | test.c:189:51:189:59 | ... / ... | test.c:175:27:175:32 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.c:189:51:189:59 | ... / ... | from division by zero | test.c:189:6:189:24 | addInfThenCastToInt | addInfThenCastToInt |
+| test.c:175:32:175:32 | p | test.c:193:13:194:15 | ... / ... | test.c:175:27:175:32 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.c:193:13:194:15 | ... / ... | from division by zero | test.c:192:6:192:7 | f2 | f2 |
+| test.c:175:32:175:32 | p | test.c:204:19:204:27 | ... / ... | test.c:175:27:175:32 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.c:204:19:204:27 | ... / ... | from division by zero | test.c:192:6:192:7 | f2 | f2 |
+| test.c:185:18:185:18 | p | test.c:200:25:200:33 | ... / ... | test.c:185:13:185:18 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.c:200:25:200:33 | ... / ... | from division by zero | test.c:192:6:192:7 | f2 | f2 |
+edges
+| test.c:8:14:8:20 | ... / ... | test.c:8:14:8:20 | ... / ... | provenance |  |
+| test.c:8:14:8:20 | ... / ... | test.c:9:14:9:16 | - ... | provenance | Config |
+| test.c:8:14:8:20 | ... / ... | test.c:12:8:12:9 | l2 | provenance |  |
+| test.c:8:14:8:20 | ... / ... | test.c:18:3:18:9 | l2 | provenance |  |
+| test.c:8:14:8:20 | ... / ... | test.c:27:19:27:20 | l2 | provenance |  |
+| test.c:9:14:9:16 | - ... | test.c:9:14:9:16 | - ... | provenance |  |
+| test.c:9:14:9:16 | - ... | test.c:13:8:13:9 | l3 | provenance |  |
+| test.c:9:14:9:16 | - ... | test.c:19:3:19:9 | l3 | provenance |  |
+| test.c:9:14:9:16 | - ... | test.c:28:19:28:20 | l3 | provenance |  |
+| test.c:31:14:32:15 | ... / ... | test.c:31:14:32:15 | ... / ... | provenance |  |
+| test.c:31:14:32:15 | ... / ... | test.c:38:3:38:9 | l7 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:77:15:77:21 | ... / ... | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:79:5:79:12 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:87:5:87:12 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:91:5:91:12 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:93:5:93:12 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:99:5:99:12 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:105:5:105:12 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:111:5:111:12 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:114:16:114:23 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:117:23:117:30 | l12 | provenance |  |
+| test.c:77:15:77:21 | ... / ... | test.c:120:20:120:27 | l12 | provenance |  |
+| test.c:175:22:175:22 | p | test.c:175:27:175:32 | p | provenance |  |
+| test.c:183:34:183:34 | p | test.c:185:13:185:18 | p | provenance |  |
+| test.c:189:32:189:32 | p | test.c:189:47:189:59 | ... + ... | provenance | Config |
+| test.c:189:47:189:59 | ... + ... | test.c:175:22:175:22 | p | provenance |  |
+| test.c:189:47:189:59 | ... + ... | test.c:175:22:175:22 | p | provenance |  |
+| test.c:189:51:189:59 | ... / ... | test.c:189:47:189:59 | ... + ... | provenance | Config |
+| test.c:193:13:194:15 | ... / ... | test.c:175:22:175:22 | p | provenance |  |
+| test.c:200:25:200:33 | ... / ... | test.c:183:34:183:34 | p | provenance |  |
+| test.c:204:19:204:27 | ... / ... | test.c:204:19:204:27 | ... / ... | provenance |  |
+| test.c:204:19:204:27 | ... / ... | test.c:206:21:206:31 | ... + ... | provenance | Config |
+| test.c:206:21:206:31 | ... + ... | test.c:206:21:206:31 | ... + ... | provenance |  |
+| test.c:206:21:206:31 | ... + ... | test.c:208:13:208:21 | middleInf | provenance |  |
+| test.c:206:21:206:31 | ... + ... | test.c:210:23:210:31 | middleInf | provenance |  |
+| test.c:208:13:208:21 | middleInf | test.c:175:22:175:22 | p | provenance |  |
+| test.c:210:23:210:31 | middleInf | test.c:189:32:189:32 | p | provenance |  |
+nodes
+| test.c:8:14:8:20 | ... / ... | semmle.label | ... / ... |
+| test.c:8:14:8:20 | ... / ... | semmle.label | ... / ... |
+| test.c:9:14:9:16 | - ... | semmle.label | - ... |
+| test.c:9:14:9:16 | - ... | semmle.label | - ... |
+| test.c:12:8:12:9 | l2 | semmle.label | l2 |
+| test.c:13:8:13:9 | l3 | semmle.label | l3 |
+| test.c:18:3:18:9 | l2 | semmle.label | l2 |
+| test.c:19:3:19:9 | l3 | semmle.label | l3 |
+| test.c:27:19:27:20 | l2 | semmle.label | l2 |
+| test.c:28:19:28:20 | l3 | semmle.label | l3 |
+| test.c:31:14:32:15 | ... / ... | semmle.label | ... / ... |
+| test.c:31:14:32:15 | ... / ... | semmle.label | ... / ... |
+| test.c:38:3:38:9 | l7 | semmle.label | l7 |
+| test.c:61:5:61:18 | ... / ... | semmle.label | ... / ... |
+| test.c:66:5:66:20 | ... / ... | semmle.label | ... / ... |
+| test.c:72:14:72:29 | ... / ... | semmle.label | ... / ... |
+| test.c:75:18:75:33 | ... / ... | semmle.label | ... / ... |
+| test.c:77:15:77:21 | ... / ... | semmle.label | ... / ... |
+| test.c:77:15:77:21 | ... / ... | semmle.label | ... / ... |
+| test.c:79:5:79:12 | l12 | semmle.label | l12 |
+| test.c:87:5:87:12 | l12 | semmle.label | l12 |
+| test.c:91:5:91:12 | l12 | semmle.label | l12 |
+| test.c:93:5:93:12 | l12 | semmle.label | l12 |
+| test.c:99:5:99:12 | l12 | semmle.label | l12 |
+| test.c:105:5:105:12 | l12 | semmle.label | l12 |
+| test.c:111:5:111:12 | l12 | semmle.label | l12 |
+| test.c:114:16:114:23 | l12 | semmle.label | l12 |
+| test.c:117:23:117:30 | l12 | semmle.label | l12 |
+| test.c:120:20:120:27 | l12 | semmle.label | l12 |
+| test.c:163:3:164:16 | ... / ... | semmle.label | ... / ... |
+| test.c:175:22:175:22 | p | semmle.label | p |
+| test.c:175:27:175:32 | p | semmle.label | p |
+| test.c:183:34:183:34 | p | semmle.label | p |
+| test.c:185:13:185:18 | p | semmle.label | p |
+| test.c:189:32:189:32 | p | semmle.label | p |
+| test.c:189:47:189:59 | ... + ... | semmle.label | ... + ... |
+| test.c:189:47:189:59 | ... + ... | semmle.label | ... + ... |
+| test.c:189:51:189:59 | ... / ... | semmle.label | ... / ... |
+| test.c:193:13:194:15 | ... / ... | semmle.label | ... / ... |
+| test.c:200:25:200:33 | ... / ... | semmle.label | ... / ... |
+| test.c:204:19:204:27 | ... / ... | semmle.label | ... / ... |
+| test.c:204:19:204:27 | ... / ... | semmle.label | ... / ... |
+| test.c:206:21:206:31 | ... + ... | semmle.label | ... + ... |
+| test.c:206:21:206:31 | ... + ... | semmle.label | ... + ... |
+| test.c:208:13:208:21 | middleInf | semmle.label | middleInf |
+| test.c:210:23:210:31 | middleInf | semmle.label | middleInf |
+subpaths
\ No newline at end of file
diff --git a/c/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql b/c/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql
new file mode 100644
index 0000000000..f0d160a650
--- /dev/null
+++ b/c/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.misuseofinfinitefloatingpointvalue.MisuseOfInfiniteFloatingPointValue
+
+class TestFileQuery extends MisuseOfInfiniteFloatingPointValueSharedQuery, TestQuery { }
diff --git a/c/common/test/rules/misuseofinfinitefloatingpointvalue/test.c b/c/common/test/rules/misuseofinfinitefloatingpointvalue/test.c
new file mode 100644
index 0000000000..6a4ebd94b9
--- /dev/null
+++ b/c/common/test/rules/misuseofinfinitefloatingpointvalue/test.c
@@ -0,0 +1,212 @@
+#include "math.h"
+
+float getFloat() { return 1.0; }
+
+// Parameter could be infinity
+void f1(float p1) {
+  float l1 = 1;
+  float l2 = 1.0 / 0;
+  float l3 = -l2;
+
+  10 / l1;         // COMPLIANT
+  10 / l2;         // NON_COMPLIANT: Underflows to zero
+  10 / l3;         // NON_COMPLIANT: Underflow to negative zero
+  10 / p1;         // COMPLIANT: Reduce false positives by assuming not infinity
+  10 / getFloat(); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  (int)l1;         // COMPLIANT
+  (int)l2;         // NON_COMPLIANT
+  (int)l3;         // NON_COMPLIANT
+  (int)p1;         // COMPLIANT: Reduce false positives by assuming not infinity
+  (int)getFloat(); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  // Not NaN:
+  float l4 = l1 / l1; // COMPLIANT
+
+  // NaN because of infinity divided by itself:
+  float l5 = l2 / l2; // NON_COMPLIANT: Division by infinity not allowed.
+  float l6 = l3 / l3; // NON_COMPLIANT: Division by infinity not allowed.
+
+  // NaN because of zero divided by itself:
+  float l7 = getFloat() /
+             p1; // COMPLIANT: Reduce false positives by assuming not infinity
+  float l8 = 0.0 / 0.0;
+
+  (int)l4; // COMPLIANT
+  (int)l5; // COMPLIANT: Casting NaN to int
+  (int)l6; // COMPLIANT: Casting NaN to int
+  (int)l7; // NON_COMPLIANT: Casting Infinity to int
+  (int)l8; // COMPLIANT: Casting NaN to int
+
+  l4 == 0; // COMPLIANT
+  l4 != 0; // COMPLIANT
+  l4 <= 0; // COMPLIANT
+  l4 < 0;  // COMPLIANT
+  l4 >= 0; // COMPLIANT
+  l5 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 != 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 < 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 <= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 > 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 >= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l6 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l7 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l8 == 0; // NON_COMPLIANT: Comparison with NaN always false
+
+  // Guards
+  float l9 = 0;
+  if (l9 != 0) {
+    (int)(l9 / l9); // COMPLIANT: l9 is not zero
+  } else {
+    (int)(l9 / l9); // NON_COMPLIANT[False positive]: Guarded to not be NaN
+  }
+
+  float l10 = 0;
+  if (l10 == 0) {
+    (int)(l10 / l10); // NON_COMPLIANT[False positive]: Casting NaN to integer
+  } else {
+    (int)(l10 / l10); // COMPLIANT: Guarded to not be NaN
+  }
+
+  float l11 = 0;
+  l11 == 0 ? (int)(l11 / l11) : 0; // NON_COMPLIANT[False positive]
+  l11 == 0 ? 0 : (int)(l11 / l11); // COMPLIANT
+  l11 != 0 ? (int)(l11 / l11) : 0; // COMPLIANT
+  l11 != 0 ? 0 : (int)(l11 / l11); // NON_COMPLIANT[False positive]
+
+  float l12 = 1.0 / 0;
+  if (isinf(l12)) {
+    (int)l12; // NON_COMPLIANT: Casting Infinity to integer
+  } else {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  }
+
+  if (!isinf(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  if (isinf(l12) == 1) {
+    (int)l12; // NON_COMPLIANT: Must be +Infinity
+  } else {
+    (int)l12; // NON_COMPLIANT: May be -Infinity
+  }
+
+  if (isfinite(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  if (isnormal(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  if (isnan(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  isinf(l12) ? (int)l12 : 0;    // NON_COMPLIANT: Check on wrong branch
+  isinf(l12) ? 0 : (int)l12;    // COMPLIANT: Checked not infinite before use
+  isfinite(l12) ? (int)l12 : 0; // COMPLIANT: Checked finite before use
+  isfinite(l12) ? 0 : (int)l12; // NON_COMPLIANT: Checked on wrong branch
+  isnan(l12) ? (int)l12
+             : 0; // COMPLIANT: Checked NaN, therefore not infinite, before use
+  isnan(l12) ? 0 : (int)l12; // NON_COMPLIANT: Check on wrong branch
+
+  float l13 = 0.0 / 0;
+  if (isinf(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // COMPLIANT: Casting NaN to integer
+  }
+
+  if (isinf(l13) == 1) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN (must be +Infinity)
+  } else {
+    (int)l13; // COMPLIANT: Casting NaN to integer
+  }
+
+  if (isfinite(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // COMPLIANT: Casting NaN to integer
+  }
+
+  if (isnormal(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // COMPLIANT: Casting NaN to integer
+  }
+
+  if (isnan(l13)) {
+    (int)l13; // COMPLIANT: Casting NaN to integer
+  } else {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  }
+
+  isinf(l13) ? (int)l13
+             : 0; // COMPLIANT: Checked infinite, therefore not NaN, before use
+  isinf(l13) ? 0 : (int)l13;    // COMPLIANT: Check on wrong branch
+  isfinite(l13) ? (int)l13 : 0; // COMPLIANT: Checked finite before use
+  isfinite(l13) ? 0 : (int)l13; // COMPLIANT: Checked on wrong branch
+  isnan(l13) ? (int)l13 : 0;    // COMPLIANT: Check on wrong branch
+  isnan(l13) ? 0 : (int)l13;    // COMPLIANT: Checked not NaN before use
+
+  (int)pow(2, p1);      // NON_COMPLIANT[False negative]: likely to be Infinity
+  (int)pow(2, sin(p1)); // COMPLIANT: not likely to be Infinity
+  (int)(1 /
+        sin(p1)); // NON_COMPLIANT: possible infinity from zero in denominator
+  (int)(1 / log(p1)); // COMPLIANT: not possibly zero in denominator
+  (int)pow(p1, p1);   // COMPLIANT: NaN if p1 is zero
+  if (p1 != 0) {
+    (int)pow(p1, p1); // COMPLIANT: p1 is not zero
+  }
+
+  (int)acos(p1);      // COMPLIANT: NaN if p1 is not within -1..1
+  (int)acos(cos(p1)); // COMPLIANT: cos(p1) is within -1..1
+}
+
+void castToInt(float p) { (int)p; }
+
+void checkBeforeCastToInt(float p) {
+  if (isfinite(p)) {
+    castToInt(p);
+  }
+}
+
+void castToIntToFloatToInt(float p) {
+  // This should be reported as a violation, but not downstream from here.
+  castToInt((int)p);
+}
+
+void addOneThenCastToInt(float p) { castToInt(p + 1); }
+void addInfThenCastToInt(float p) { castToInt(p + 1.0 / 0.0); }
+void addNaNThenCastToInt(float p) { castToInt(p + 0.0 / 0.0); }
+
+void f2() {
+  castToInt(1.0 /
+            0.0); // NON_COMPLIANT: Infinity flows to denominator in division
+  castToInt(0.0 / 0.0);             // COMPLIANT
+  checkBeforeCastToInt(1.0 / 0.0);  // COMPLIANT
+  checkBeforeCastToInt(0.0 / 0.0);  // COMPLIANT
+  addOneThenCastToInt(1.0 / 0.0);   // NON_COMPLIANT[False negative]
+  addOneThenCastToInt(0.0 / 0.0);   // NON_COMPLIANT
+  castToIntToFloatToInt(1.0 / 0.0); // NON_COMPLIANT
+  castToIntToFloatToInt(0.0 / 0.0); // COMPLIANT
+
+  // Check that during flow analysis, we only report the true root cause:
+  float rootInf = 1.0 / 0.0;
+  float rootNaN = 0.0 / 0.0;
+  float middleInf = rootInf + 1;
+  float middleNaN = rootNaN + 1;
+  castToInt(middleInf);           // NON_COMPLIANT
+  castToInt(middleNaN);           // COMPLIANT
+  addInfThenCastToInt(middleInf); // NON_COMPLIANT
+  addNaNThenCastToInt(middleNaN); // COMPLIANT
+}
\ No newline at end of file
diff --git a/c/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.expected b/c/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.expected
new file mode 100644
index 0000000000..b567e06bc2
--- /dev/null
+++ b/c/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.expected
@@ -0,0 +1,136 @@
+problems
+| test.c:36:8:36:9 | l5 | test.c:27:14:27:20 | ... / ... | test.c:36:3:36:9 | l5 | Possible NaN value $@ flows to a cast to integer. | test.c:27:14:27:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:37:8:37:9 | l6 | test.c:28:14:28:20 | ... / ... | test.c:37:3:37:9 | l6 | Possible NaN value $@ flows to a cast to integer. | test.c:28:14:28:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:38:8:38:9 | l7 | test.c:31:14:32:15 | ... / ... | test.c:38:3:38:9 | l7 | Possible NaN value $@ flows to a cast to integer. | test.c:31:14:32:15 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:39:8:39:9 | l8 | test.c:33:14:33:22 | ... / ... | test.c:39:3:39:9 | l8 | Possible NaN value $@ flows to a cast to integer. | test.c:33:14:33:22 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:46:3:46:4 | l5 | test.c:27:14:27:20 | ... / ... | test.c:46:3:46:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:27:14:27:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:47:3:47:4 | l5 | test.c:27:14:27:20 | ... / ... | test.c:47:3:47:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:27:14:27:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:48:3:48:4 | l5 | test.c:27:14:27:20 | ... / ... | test.c:48:3:48:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:27:14:27:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:49:3:49:4 | l5 | test.c:27:14:27:20 | ... / ... | test.c:49:3:49:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:27:14:27:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:50:3:50:4 | l5 | test.c:27:14:27:20 | ... / ... | test.c:50:3:50:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:27:14:27:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:51:3:51:4 | l5 | test.c:27:14:27:20 | ... / ... | test.c:51:3:51:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:27:14:27:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:52:3:52:4 | l6 | test.c:28:14:28:20 | ... / ... | test.c:52:3:52:4 | l6 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:28:14:28:20 | ... / ... | from division of infinity by infinity | test.c:6:6:6:7 | f1 | f1 |
+| test.c:53:3:53:4 | l7 | test.c:31:14:32:15 | ... / ... | test.c:53:3:53:4 | l7 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:31:14:32:15 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:54:3:54:4 | l8 | test.c:33:14:33:22 | ... / ... | test.c:54:3:54:4 | l8 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.c:33:14:33:22 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:61:11:61:17 | ... / ... | test.c:61:5:61:18 | ... / ... | test.c:61:5:61:18 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.c:61:11:61:17 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:66:11:66:19 | ... / ... | test.c:66:5:66:20 | ... / ... | test.c:66:5:66:20 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.c:66:11:66:19 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:72:20:72:28 | ... / ... | test.c:72:14:72:29 | ... / ... | test.c:72:14:72:29 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.c:72:20:72:28 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:75:24:75:32 | ... / ... | test.c:75:18:75:33 | ... / ... | test.c:75:18:75:33 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.c:75:24:75:32 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:126:10:126:12 | l13 | test.c:122:15:122:21 | ... / ... | test.c:126:5:126:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:132:10:132:12 | l13 | test.c:122:15:122:21 | ... / ... | test.c:132:5:132:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:138:10:138:12 | l13 | test.c:122:15:122:21 | ... / ... | test.c:138:5:138:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:144:10:144:12 | l13 | test.c:122:15:122:21 | ... / ... | test.c:144:5:144:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:148:10:148:12 | l13 | test.c:122:15:122:21 | ... / ... | test.c:148:5:148:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:155:25:155:27 | l13 | test.c:122:15:122:21 | ... / ... | test.c:155:20:155:27 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:157:28:157:30 | l13 | test.c:122:15:122:21 | ... / ... | test.c:157:23:157:30 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:158:21:158:23 | l13 | test.c:122:15:122:21 | ... / ... | test.c:158:16:158:23 | l13 | Possible NaN value $@ flows to a cast to integer. | test.c:122:15:122:21 | ... / ... | from division of zero by zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:165:8:165:10 | call to pow | test.c:165:3:165:18 | call to pow | test.c:165:3:165:18 | call to pow | Possible NaN value $@ flows to a cast to integer. | test.c:165:8:165:10 | call to pow | both arguments are equal to zero | test.c:6:6:6:7 | f1 | f1 |
+| test.c:170:8:170:11 | call to acos | test.c:170:3:170:15 | call to acos | test.c:170:3:170:15 | call to acos | Possible NaN value $@ flows to a cast to integer. | test.c:170:8:170:11 | call to acos | the argument has a range -1000000000000000...1000000000000000 which is outside the domain of this function (-1.0...1.0) | test.c:6:6:6:7 | f1 | f1 |
+| test.c:174:32:174:32 | p | test.c:189:51:189:59 | ... / ... | test.c:174:27:174:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.c:189:51:189:59 | ... / ... | from division of zero by zero | test.c:189:6:189:24 | addNaNThenCastToInt | addNaNThenCastToInt |
+| test.c:174:32:174:32 | p | test.c:193:13:193:21 | ... / ... | test.c:174:27:174:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.c:193:13:193:21 | ... / ... | from division of zero by zero | test.c:191:6:191:7 | f2 | f2 |
+| test.c:174:32:174:32 | p | test.c:197:23:197:31 | ... / ... | test.c:174:27:174:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.c:197:23:197:31 | ... / ... | from division of zero by zero | test.c:191:6:191:7 | f2 | f2 |
+| test.c:174:32:174:32 | p | test.c:203:19:203:27 | ... / ... | test.c:174:27:174:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.c:203:19:203:27 | ... / ... | from division of zero by zero | test.c:191:6:191:7 | f2 | f2 |
+| test.c:184:18:184:18 | p | test.c:199:25:199:33 | ... / ... | test.c:184:13:184:18 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.c:199:25:199:33 | ... / ... | from division of zero by zero | test.c:191:6:191:7 | f2 | f2 |
+edges
+| test.c:27:14:27:20 | ... / ... | test.c:27:14:27:20 | ... / ... | provenance |  |
+| test.c:27:14:27:20 | ... / ... | test.c:36:3:36:9 | l5 | provenance |  |
+| test.c:27:14:27:20 | ... / ... | test.c:46:3:46:4 | l5 | provenance |  |
+| test.c:27:14:27:20 | ... / ... | test.c:47:3:47:4 | l5 | provenance |  |
+| test.c:27:14:27:20 | ... / ... | test.c:48:3:48:4 | l5 | provenance |  |
+| test.c:27:14:27:20 | ... / ... | test.c:49:3:49:4 | l5 | provenance |  |
+| test.c:27:14:27:20 | ... / ... | test.c:50:3:50:4 | l5 | provenance |  |
+| test.c:27:14:27:20 | ... / ... | test.c:51:3:51:4 | l5 | provenance |  |
+| test.c:28:14:28:20 | ... / ... | test.c:28:14:28:20 | ... / ... | provenance |  |
+| test.c:28:14:28:20 | ... / ... | test.c:37:3:37:9 | l6 | provenance |  |
+| test.c:28:14:28:20 | ... / ... | test.c:52:3:52:4 | l6 | provenance |  |
+| test.c:31:14:32:15 | ... / ... | test.c:31:14:32:15 | ... / ... | provenance |  |
+| test.c:31:14:32:15 | ... / ... | test.c:38:3:38:9 | l7 | provenance |  |
+| test.c:31:14:32:15 | ... / ... | test.c:53:3:53:4 | l7 | provenance |  |
+| test.c:33:14:33:22 | ... / ... | test.c:33:14:33:22 | ... / ... | provenance |  |
+| test.c:33:14:33:22 | ... / ... | test.c:39:3:39:9 | l8 | provenance |  |
+| test.c:33:14:33:22 | ... / ... | test.c:54:3:54:4 | l8 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:122:15:122:21 | ... / ... | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:126:5:126:12 | l13 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:132:5:132:12 | l13 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:138:5:138:12 | l13 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:144:5:144:12 | l13 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:148:5:148:12 | l13 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:155:20:155:27 | l13 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:157:23:157:30 | l13 | provenance |  |
+| test.c:122:15:122:21 | ... / ... | test.c:158:16:158:23 | l13 | provenance |  |
+| test.c:174:22:174:22 | p | test.c:174:27:174:32 | p | provenance |  |
+| test.c:182:34:182:34 | p | test.c:184:13:184:18 | p | provenance |  |
+| test.c:187:32:187:32 | p | test.c:187:47:187:51 | ... + ... | provenance | Config |
+| test.c:187:47:187:51 | ... + ... | test.c:174:22:174:22 | p | provenance |  |
+| test.c:189:32:189:32 | p | test.c:189:47:189:59 | ... + ... | provenance | Config |
+| test.c:189:47:189:59 | ... + ... | test.c:174:22:174:22 | p | provenance |  |
+| test.c:189:47:189:59 | ... + ... | test.c:174:22:174:22 | p | provenance |  |
+| test.c:189:51:189:59 | ... / ... | test.c:189:47:189:59 | ... + ... | provenance | Config |
+| test.c:193:13:193:21 | ... / ... | test.c:174:22:174:22 | p | provenance |  |
+| test.c:197:23:197:31 | ... / ... | test.c:187:32:187:32 | p | provenance |  |
+| test.c:199:25:199:33 | ... / ... | test.c:182:34:182:34 | p | provenance |  |
+| test.c:203:19:203:27 | ... / ... | test.c:203:19:203:27 | ... / ... | provenance |  |
+| test.c:203:19:203:27 | ... / ... | test.c:205:21:205:31 | ... + ... | provenance | Config |
+| test.c:205:21:205:31 | ... + ... | test.c:205:21:205:31 | ... + ... | provenance |  |
+| test.c:205:21:205:31 | ... + ... | test.c:207:13:207:21 | middleNaN | provenance |  |
+| test.c:205:21:205:31 | ... + ... | test.c:209:23:209:31 | middleNaN | provenance |  |
+| test.c:207:13:207:21 | middleNaN | test.c:174:22:174:22 | p | provenance |  |
+| test.c:209:23:209:31 | middleNaN | test.c:189:32:189:32 | p | provenance |  |
+nodes
+| test.c:27:14:27:20 | ... / ... | semmle.label | ... / ... |
+| test.c:27:14:27:20 | ... / ... | semmle.label | ... / ... |
+| test.c:28:14:28:20 | ... / ... | semmle.label | ... / ... |
+| test.c:28:14:28:20 | ... / ... | semmle.label | ... / ... |
+| test.c:31:14:32:15 | ... / ... | semmle.label | ... / ... |
+| test.c:31:14:32:15 | ... / ... | semmle.label | ... / ... |
+| test.c:33:14:33:22 | ... / ... | semmle.label | ... / ... |
+| test.c:33:14:33:22 | ... / ... | semmle.label | ... / ... |
+| test.c:36:3:36:9 | l5 | semmle.label | l5 |
+| test.c:37:3:37:9 | l6 | semmle.label | l6 |
+| test.c:38:3:38:9 | l7 | semmle.label | l7 |
+| test.c:39:3:39:9 | l8 | semmle.label | l8 |
+| test.c:46:3:46:4 | l5 | semmle.label | l5 |
+| test.c:47:3:47:4 | l5 | semmle.label | l5 |
+| test.c:48:3:48:4 | l5 | semmle.label | l5 |
+| test.c:49:3:49:4 | l5 | semmle.label | l5 |
+| test.c:50:3:50:4 | l5 | semmle.label | l5 |
+| test.c:51:3:51:4 | l5 | semmle.label | l5 |
+| test.c:52:3:52:4 | l6 | semmle.label | l6 |
+| test.c:53:3:53:4 | l7 | semmle.label | l7 |
+| test.c:54:3:54:4 | l8 | semmle.label | l8 |
+| test.c:61:5:61:18 | ... / ... | semmle.label | ... / ... |
+| test.c:66:5:66:20 | ... / ... | semmle.label | ... / ... |
+| test.c:72:14:72:29 | ... / ... | semmle.label | ... / ... |
+| test.c:75:18:75:33 | ... / ... | semmle.label | ... / ... |
+| test.c:122:15:122:21 | ... / ... | semmle.label | ... / ... |
+| test.c:122:15:122:21 | ... / ... | semmle.label | ... / ... |
+| test.c:126:5:126:12 | l13 | semmle.label | l13 |
+| test.c:132:5:132:12 | l13 | semmle.label | l13 |
+| test.c:138:5:138:12 | l13 | semmle.label | l13 |
+| test.c:144:5:144:12 | l13 | semmle.label | l13 |
+| test.c:148:5:148:12 | l13 | semmle.label | l13 |
+| test.c:155:20:155:27 | l13 | semmle.label | l13 |
+| test.c:157:23:157:30 | l13 | semmle.label | l13 |
+| test.c:158:16:158:23 | l13 | semmle.label | l13 |
+| test.c:165:3:165:18 | call to pow | semmle.label | call to pow |
+| test.c:170:3:170:15 | call to acos | semmle.label | call to acos |
+| test.c:174:22:174:22 | p | semmle.label | p |
+| test.c:174:27:174:32 | p | semmle.label | p |
+| test.c:182:34:182:34 | p | semmle.label | p |
+| test.c:184:13:184:18 | p | semmle.label | p |
+| test.c:187:32:187:32 | p | semmle.label | p |
+| test.c:187:47:187:51 | ... + ... | semmle.label | ... + ... |
+| test.c:189:32:189:32 | p | semmle.label | p |
+| test.c:189:47:189:59 | ... + ... | semmle.label | ... + ... |
+| test.c:189:47:189:59 | ... + ... | semmle.label | ... + ... |
+| test.c:189:51:189:59 | ... / ... | semmle.label | ... / ... |
+| test.c:193:13:193:21 | ... / ... | semmle.label | ... / ... |
+| test.c:197:23:197:31 | ... / ... | semmle.label | ... / ... |
+| test.c:199:25:199:33 | ... / ... | semmle.label | ... / ... |
+| test.c:203:19:203:27 | ... / ... | semmle.label | ... / ... |
+| test.c:203:19:203:27 | ... / ... | semmle.label | ... / ... |
+| test.c:205:21:205:31 | ... + ... | semmle.label | ... + ... |
+| test.c:205:21:205:31 | ... + ... | semmle.label | ... + ... |
+| test.c:207:13:207:21 | middleNaN | semmle.label | middleNaN |
+| test.c:209:23:209:31 | middleNaN | semmle.label | middleNaN |
+subpaths
diff --git a/c/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql b/c/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql
new file mode 100644
index 0000000000..a1f729ed02
--- /dev/null
+++ b/c/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.misuseofnanfloatingpointvalue.MisuseOfNaNFloatingPointValue
+
+class TestFileQuery extends MisuseOfNaNFloatingPointValueSharedQuery, TestQuery { }
diff --git a/c/common/test/rules/misuseofnanfloatingpointvalue/test.c b/c/common/test/rules/misuseofnanfloatingpointvalue/test.c
new file mode 100644
index 0000000000..bd997282f0
--- /dev/null
+++ b/c/common/test/rules/misuseofnanfloatingpointvalue/test.c
@@ -0,0 +1,210 @@
+#include "math.h"
+
+float getFloat() { return 1.0; }
+
+// Parameter could be infinity
+void f1(float p1) {
+  float l1 = 1;
+  float l2 = 1.0 / 0;
+  float l3 = -l2;
+
+  10 / l1;         // COMPLIANT
+  10 / l2;         // COMPLIANT: Underflows to zero
+  10 / l3;         // COMPLIANT: Underflow to negative zero
+  10 / p1;         // COMPLIANT: Reduce false positives by assuming not infinity
+  10 / getFloat(); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  (int)l1;         // COMPLIANT
+  (int)l2;         // COMPLIANT
+  (int)l3;         // COMPLIANT
+  (int)p1;         // COMPLIANT: Reduce false positives by assuming not infinity
+  (int)getFloat(); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  // Not NaN:
+  float l4 = l1 / l1; // COMPLIANT
+
+  // NaN because of infinity divided by itself:
+  float l5 = l2 / l2; // COMPLIANT: Division by infinity not allowed.
+  float l6 = l3 / l3; // COMPLIANT: Division by infinity not allowed.
+
+  // NaN because of zero divided by itself:
+  float l7 = getFloat() /
+             p1; // COMPLIANT: Reduce false positives by assuming not infinity
+  float l8 = 0.0 / 0.0;
+
+  (int)l4; // COMPLIANT
+  (int)l5; // NON_COMPLIANT: Casting NaN to int
+  (int)l6; // NON_COMPLIANT: Casting NaN to int
+  (int)l7; // NON_COMPLIANT: Casting NaN to int
+  (int)l8; // NON_COMPLIANT: Casting NaN to int
+
+  l4 == 0; // COMPLIANT
+  l4 != 0; // COMPLIANT
+  l4 <= 0; // COMPLIANT
+  l4 < 0;  // COMPLIANT
+  l4 >= 0; // COMPLIANT
+  l5 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 != 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 < 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 <= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 > 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 >= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l6 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l7 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l8 == 0; // NON_COMPLIANT: Comparison with NaN always false
+
+  // Guards
+  float l9 = 0;
+  if (l9 != 0) {
+    (int)(l9 / l9); // COMPLIANT: l9 is not zero
+  } else {
+    (int)(l9 / l9); // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  float l10 = 0;
+  if (l10 == 0) {
+    (int)(l10 / l10); // NON_COMPLIANT: Casting NaN to integer
+  } else {
+    (int)(l10 / l10); // COMPLIANT: Guarded to not be NaN
+  }
+
+  float l11 = 0;
+  l11 == 0 ? (int)(l11 / l11) : 0; // NON_COMPLIANT
+  l11 == 0 ? 0 : (int)(l11 / l11); // COMPLIANT
+  l11 != 0 ? (int)(l11 / l11) : 0; // COMPLIANT
+  l11 != 0 ? 0 : (int)(l11 / l11); // NON_COMPLIANT
+
+  float l12 = 1.0 / 0;
+  if (isinf(l12)) {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  } else {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  }
+
+  if (!isinf(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  if (isinf(l12) == 1) {
+    (int)l12; // COMPLIANT: Must be +Infinity
+  } else {
+    (int)l12; // COMPLIANT: May be -Infinity
+  }
+
+  if (isfinite(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  if (isnormal(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  if (isnan(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  isinf(l12) ? (int)l12 : 0;    // COMPLIANT: Check on wrong branch
+  isinf(l12) ? 0 : (int)l12;    // COMPLIANT: Checked not infinite before use
+  isfinite(l12) ? (int)l12 : 0; // COMPLIANT: Checked finite before use
+  isfinite(l12) ? 0 : (int)l12; // COMPLIANT: Checked on wrong branch
+  isnan(l12) ? (int)l12
+             : 0; // COMPLIANT: Checked NaN, therefore not infinite, before use
+  isnan(l12) ? 0 : (int)l12; // COMPLIANT: Check on wrong branch
+
+  float l13 = 0.0 / 0;
+  if (isinf(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (isinf(l13) == 1) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN (must be +Infinity)
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (isfinite(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (isnormal(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (isnan(l13)) {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  } else {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  }
+
+  isinf(l13) ? (int)l13
+             : 0; // COMPLIANT: Checked infinite, therefore not NaN, before use
+  isinf(l13) ? 0 : (int)l13;    // NON_COMPLIANT: Check on wrong branch
+  isfinite(l13) ? (int)l13 : 0; // COMPLIANT: Checked finite before use
+  isfinite(l13) ? 0 : (int)l13; // NON_COMPLIANT: Checked on wrong branch
+  isnan(l13) ? (int)l13 : 0;    // NON_COMPLIANT: Check on wrong branch
+  isnan(l13) ? 0 : (int)l13;    // COMPLIANT: Checked not NaN before use
+
+  (int)pow(2, p1);      // COMPLIANT: likely to be Infinity
+  (int)pow(2, sin(p1)); // COMPLIANT: not likely to be Infinity
+  (int)(1 / sin(p1));   // COMPLIANT: possible infinity from zero in denominator
+  (int)(1 / log(p1));   // COMPLIANT: not possibly zero in denominator
+  (int)pow(p1, p1);     // NON_COMPLIANT: NaN if p1 is zero
+  if (p1 != 0) {
+    (int)pow(p1, p1); // COMPLIANT: p1 is not zero
+  }
+
+  (int)acos(p1);      // NON_COMPLIANT: NaN if p1 is not within -1..1
+  (int)acos(cos(p1)); // COMPLIANT: cos(p1) is within -1..1
+}
+
+void castToInt(float p) { (int)p; }
+
+void checkBeforeCastToInt(float p) {
+  if (isfinite(p)) {
+    castToInt(p);
+  }
+}
+
+void castToIntToFloatToInt(float p) {
+  // This should be reported as a violation, but not downstream from here.
+  castToInt((int)p);
+}
+
+void addOneThenCastToInt(float p) { castToInt(p + 1); }
+void addInfThenCastToInt(float p) { castToInt(p + 1.0 / 0.0); }
+void addNaNThenCastToInt(float p) { castToInt(p + 0.0 / 0.0); }
+
+void f2() {
+  castToInt(1.0 / 0.0); // COMPLIANT: Infinity flows to denominator in division
+  castToInt(0.0 / 0.0); // COMPLIANT: NaN flows to denominator in division
+  checkBeforeCastToInt(1.0 / 0.0);  // COMPLIANT
+  checkBeforeCastToInt(0.0 / 0.0);  // COMPLIANT
+  addOneThenCastToInt(1.0 / 0.0);   // COMPLIANT
+  addOneThenCastToInt(0.0 / 0.0);   // NON_COMPLIANT
+  castToIntToFloatToInt(1.0 / 0.0); // COMPLIANT
+  castToIntToFloatToInt(0.0 / 0.0); // NON_COMPLIANT
+
+  // Check that during flow analysis, we only report the true root cause:
+  float rootInf = 1.0 / 0.0;
+  float rootNaN = 0.0 / 0.0;
+  float middleInf = rootInf + 1;
+  float middleNaN = rootNaN + 1;
+  castToInt(middleInf);           // COMPLIANT
+  castToInt(middleNaN);           // NON_COMPLIANT
+  addInfThenCastToInt(middleInf); // NON_COMPLIANT
+  addNaNThenCastToInt(middleNaN); // NON_COMPLIANT
+}
\ No newline at end of file
diff --git a/c/common/test/rules/readofuninitializedmemory/test.c b/c/common/test/rules/readofuninitializedmemory/test.c
index ce2c60484e..e76c5a22b3 100644
--- a/c/common/test/rules/readofuninitializedmemory/test.c
+++ b/c/common/test/rules/readofuninitializedmemory/test.c
@@ -94,4 +94,6 @@ void test_non_default_init() {
   static struct A ss;
   use_struct_A(
       ss); // COMPLIANT - static struct type variables are zero initialized
+  _Atomic int x;
+  use_int(x); // COMPLIANT - atomics are special, covered by other rules
 }
\ No newline at end of file
diff --git a/c/misra/src/codeql-pack.lock.yml b/c/misra/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/c/misra/src/codeql-pack.lock.yml
+++ b/c/misra/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/c/misra/src/codeql-suites/misra-c-advisory.qls b/c/misra/src/codeql-suites/misra-c-advisory.qls
index 517f449b13..39df0d6583 100644
--- a/c/misra/src/codeql-suites/misra-c-advisory.qls
+++ b/c/misra/src/codeql-suites/misra-c-advisory.qls
@@ -1,4 +1,4 @@
-- description: MISRA C 2012 (Advisory)
+- description: MISRA C 2023 (Advisory)
 - qlpack: codeql/misra-c-coding-standards
 - include:
     kind:
diff --git a/c/misra/src/codeql-suites/misra-c-audit.qls b/c/misra/src/codeql-suites/misra-c-audit.qls
new file mode 100644
index 0000000000..cac9df04ae
--- /dev/null
+++ b/c/misra/src/codeql-suites/misra-c-audit.qls
@@ -0,0 +1,8 @@
+- description: MISRA C 2023 (Audit)
+- qlpack: codeql/misra-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    tags contain:
+    - external/misra/c/audit
diff --git a/c/misra/src/codeql-suites/misra-c-default.qls b/c/misra/src/codeql-suites/misra-c-default.qls
index 343379a2b3..cdc6eb65ad 100644
--- a/c/misra/src/codeql-suites/misra-c-default.qls
+++ b/c/misra/src/codeql-suites/misra-c-default.qls
@@ -1,4 +1,4 @@
-- description: MISRA C 2012 (Default)
+- description: MISRA C 2023 (Default)
 - qlpack: codeql/misra-c-coding-standards
 - include:
     kind:
@@ -7,4 +7,5 @@
 - exclude:
     tags contain:
     - external/misra/audit
+    - external/misra/strict
     - external/misra/default-disabled
diff --git a/c/misra/src/codeql-suites/misra-c-mandatory.qls b/c/misra/src/codeql-suites/misra-c-mandatory.qls
index 454b8487ab..09eccdc50c 100644
--- a/c/misra/src/codeql-suites/misra-c-mandatory.qls
+++ b/c/misra/src/codeql-suites/misra-c-mandatory.qls
@@ -1,4 +1,4 @@
-- description: MISRA C 2012 (Advisory)
+- description: MISRA C 2023 (Advisory)
 - qlpack: codeql/misra-c-coding-standards
 - include:
     kind:
diff --git a/c/misra/src/codeql-suites/misra-c-required.qls b/c/misra/src/codeql-suites/misra-c-required.qls
index ca32b9ca97..f7c77e937a 100644
--- a/c/misra/src/codeql-suites/misra-c-required.qls
+++ b/c/misra/src/codeql-suites/misra-c-required.qls
@@ -1,4 +1,4 @@
-- description: MISRA C 2012 (Required)
+- description: MISRA C 2023 (Required)
 - qlpack: codeql/misra-c-coding-standards
 - include:
     kind:
diff --git a/c/misra/src/codeql-suites/misra-c-strict.qls b/c/misra/src/codeql-suites/misra-c-strict.qls
new file mode 100644
index 0000000000..b8f4885189
--- /dev/null
+++ b/c/misra/src/codeql-suites/misra-c-strict.qls
@@ -0,0 +1,8 @@
+- description: MISRA C 2023 (Strict)
+- qlpack: codeql/misra-c-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    tags contain:
+    - external/misra/strict
diff --git a/c/misra/src/codingstandards/c/misra/EssentialTypes.qll b/c/misra/src/codingstandards/c/misra/EssentialTypes.qll
index 4783547ed2..44193322ea 100644
--- a/c/misra/src/codingstandards/c/misra/EssentialTypes.qll
+++ b/c/misra/src/codingstandards/c/misra/EssentialTypes.qll
@@ -6,13 +6,17 @@ import codingstandards.c.misra
 import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 import MisraExpressions
 
+newtype TEssentialFloatCategory =
+  Real() or
+  Complex()
+
 newtype TEssentialTypeCategory =
   EssentiallyBooleanType() or
   EssentiallyCharacterType() or
   EssentiallyEnumType() or
   EssentiallySignedType() or
   EssentiallyUnsignedType() or
-  EssentiallyFloatingType()
+  EssentiallyFloatingType(TEssentialFloatCategory c)
 
 /** An essential type category, as specified by Appendix D.1. */
 class EssentialTypeCategory extends TEssentialTypeCategory {
@@ -27,7 +31,15 @@ class EssentialTypeCategory extends TEssentialTypeCategory {
     or
     this = EssentiallyUnsignedType() and result = "essentially Unsigned type"
     or
-    this = EssentiallyFloatingType() and result = "essentially Floating type"
+    this = EssentiallyFloatingType(Real()) and result = "essentially Floating type"
+    or
+    this = EssentiallyFloatingType(Complex()) and result = "essentially Complex Floating type"
+  }
+}
+
+class EssentiallySignedOrUnsignedType extends EssentialTypeCategory {
+  EssentiallySignedOrUnsignedType() {
+    this = EssentiallySignedType() or this = EssentiallyUnsignedType()
   }
 }
 
@@ -37,11 +49,7 @@ class EssentialTypeCategory extends TEssentialTypeCategory {
 private class ConstantIntegerExpr extends Expr {
   pragma[noinline]
   ConstantIntegerExpr() {
-    getEssentialTypeCategory(this.getType()) =
-      [
-        EssentiallyUnsignedType().(EssentialTypeCategory),
-        EssentiallySignedType().(EssentialTypeCategory)
-      ] and
+    getEssentialTypeCategory(this.getType()) instanceof EssentiallySignedOrUnsignedType and
     exists(this.getValue().toFloat()) and
     not this instanceof Conversion
   }
@@ -143,8 +151,11 @@ EssentialTypeCategory getEssentialTypeCategory(Type type) {
     essentialType instanceof NamedEnumType and
     not essentialType instanceof MisraBoolType
     or
-    result = EssentiallyFloatingType() and
-    essentialType instanceof FloatingPointType
+    result = EssentiallyFloatingType(Real()) and
+    essentialType instanceof RealNumberType
+    or
+    result = EssentiallyFloatingType(Complex()) and
+    essentialType instanceof ComplexNumberType
   )
 }
 
@@ -153,19 +164,30 @@ EssentialTypeCategory getEssentialTypeCategory(Type type) {
  */
 pragma[nomagic]
 Type getEssentialType(Expr e) {
-  if e.hasExplicitConversion()
-  then
-    if e.getConversion() instanceof ParenthesisExpr
-    then
-      if e.getConversion().(ParenthesisExpr).hasExplicitConversion()
-      then result = e.getConversion().(ParenthesisExpr).getConversion().getType()
-      else result = e.getConversion().(ParenthesisExpr).getExpr().(EssentialExpr).getEssentialType()
-    else result = e.getConversion().getType()
+  if e.hasConversion()
+  then result = getEssentialTypeOfConversion(e.getFullyConverted())
+  else result = e.(EssentialExpr).getEssentialType()
+}
+
+Type getEssentialTypeOfConversion(Expr e) {
+  if e.(Conversion).isImplicit() or e instanceof ParenthesisExpr or e instanceof C11GenericExpr
+  then result = getEssentialTypeOfConversion(e.(Conversion).getExpr())
   else result = e.(EssentialExpr).getEssentialType()
 }
 
 Type getEssentialTypeBeforeConversions(Expr e) { result = e.(EssentialExpr).getEssentialType() }
 
+/**
+ * For most essential types, `Type.getSize()` is correct, except for complex floating types.
+ *
+ * For complex floating types, the size is the size of the real part, so we divide by 2.
+ */
+int getEssentialSize(Type essentialType) {
+  if getEssentialTypeCategory(essentialType) = EssentiallyFloatingType(Complex())
+  then result = essentialType.getSize() / 2
+  else result = essentialType.getSize()
+}
+
 class EssentialExpr extends Expr {
   Type getEssentialType() { result = this.getType() }
 
@@ -192,8 +214,8 @@ class EssentialEqualityOperationExpr extends EssentialExpr, EqualityOperation {
   override Type getEssentialType() { result instanceof BoolType }
 }
 
-class EssentialBinaryBitwiseOperationExpr extends EssentialExpr, BinaryBitwiseOperation {
-  EssentialBinaryBitwiseOperationExpr() {
+class EssentialShiftOperationExpr extends EssentialExpr, BinaryBitwiseOperation {
+  EssentialShiftOperationExpr() {
     this instanceof LShiftExpr or
     this instanceof RShiftExpr
   }
@@ -235,9 +257,7 @@ class EssentialUnaryPlusExpr extends EssentialExpr, UnaryPlusExpr {
       operandEssentialType = getEssentialType(getOperand()) and
       operandEssentialTypeCategory = getEssentialTypeCategory(operandEssentialType)
     |
-      if
-        operandEssentialTypeCategory =
-          [EssentiallyUnsignedType().(TEssentialTypeCategory), EssentiallySignedType()]
+      if operandEssentialTypeCategory instanceof EssentiallySignedOrUnsignedType
       then result = operandEssentialType
       else result = getStandardType()
     )
@@ -257,6 +277,13 @@ class EssentialUnaryMinusExpr extends EssentialExpr, UnaryMinusExpr {
   }
 }
 
+bindingset[essentialTypeA, essentialTypeB]
+private Type maxRankType(Type essentialTypeA, Type essentialTypeB) {
+  if essentialTypeA.getSize() > essentialTypeB.getSize()
+  then result = essentialTypeA
+  else result = essentialTypeB
+}
+
 class EssentialConditionalExpr extends EssentialExpr, ConditionalExpr {
   override Type getEssentialType() {
     exists(Type thenEssentialType, Type elseEssentialType |
@@ -267,88 +294,108 @@ class EssentialConditionalExpr extends EssentialExpr, ConditionalExpr {
       then result = thenEssentialType
       else
         if
-          getEssentialTypeCategory(thenEssentialType) = EssentiallySignedType() and
-          getEssentialTypeCategory(elseEssentialType) = EssentiallySignedType()
-        then
-          if thenEssentialType.getSize() > elseEssentialType.getSize()
-          then result = thenEssentialType
-          else result = elseEssentialType
-        else
-          if
-            getEssentialTypeCategory(thenEssentialType) = EssentiallyUnsignedType() and
-            getEssentialTypeCategory(elseEssentialType) = EssentiallyUnsignedType()
-          then
-            if thenEssentialType.getSize() > elseEssentialType.getSize()
-            then result = thenEssentialType
-            else result = elseEssentialType
-          else result = this.getStandardType()
+          getEssentialTypeCategory(thenEssentialType) = getEssentialTypeCategory(elseEssentialType) and
+          getEssentialTypeCategory(thenEssentialType) instanceof EssentiallySignedOrUnsignedType
+        then result = maxRankType(thenEssentialType, elseEssentialType)
+        else result = this.getStandardType()
     )
   }
 }
 
-class EssentialBinaryArithmeticExpr extends EssentialExpr, BinaryArithmeticOperation {
-  EssentialBinaryArithmeticExpr() {
-    // GNU C extension has min/max which we can ignore
-    not this instanceof MinExpr and
-    not this instanceof MaxExpr
+/**
+ * A binary operation subject to usual conversions, with essential type behaviour as specified by D.7.9.
+ */
+class EssentialBinaryOperationSubjectToUsualConversions extends EssentialExpr, BinaryOperation {
+  EssentialBinaryOperationSubjectToUsualConversions() {
+    this instanceof MulExpr
+    or
+    this instanceof DivExpr
+    or
+    this instanceof RemExpr
+    or
+    this instanceof AddExpr
+    or
+    this instanceof SubExpr
+    or
+    this instanceof BitwiseAndExpr
+    or
+    this instanceof BitwiseOrExpr
+    or
+    this instanceof BitwiseXorExpr
   }
 
   override Type getEssentialType() {
     exists(
       Type leftEssentialType, Type rightEssentialType,
       EssentialTypeCategory leftEssentialTypeCategory,
-      EssentialTypeCategory rightEssentialTypeCategory
+      EssentialTypeCategory rightEssentialTypeCategory, int intTypeSize
     |
       leftEssentialType = getEssentialType(getLeftOperand()) and
       rightEssentialType = getEssentialType(getRightOperand()) and
       leftEssentialTypeCategory = getEssentialTypeCategory(leftEssentialType) and
-      rightEssentialTypeCategory = getEssentialTypeCategory(rightEssentialType)
+      rightEssentialTypeCategory = getEssentialTypeCategory(rightEssentialType) and
+      // For rules around addition/subtraction with char types:
+      intTypeSize = any(IntType i | i.isSigned()).getSize()
     |
       if
-        leftEssentialTypeCategory = EssentiallySignedType() and
-        rightEssentialTypeCategory = EssentiallySignedType()
+        leftEssentialTypeCategory = rightEssentialTypeCategory and
+        leftEssentialTypeCategory instanceof EssentiallySignedOrUnsignedType
       then
         if exists(getValue())
-        then result = stlr(this)
-        else (
-          if leftEssentialType.getSize() > rightEssentialType.getSize()
-          then result = leftEssentialType
-          else result = rightEssentialType
-        )
-      else
-        if
-          leftEssentialTypeCategory = EssentiallyUnsignedType() and
-          rightEssentialTypeCategory = EssentiallyUnsignedType()
         then
-          if exists(getValue())
-          then result = utlr(this)
-          else (
-            if leftEssentialType.getSize() > rightEssentialType.getSize()
-            then result = leftEssentialType
-            else result = rightEssentialType
-          )
-        else
-          if
-            this instanceof AddExpr and
-            (
-              leftEssentialTypeCategory = EssentiallyCharacterType()
-              or
-              rightEssentialTypeCategory = EssentiallyCharacterType()
-            ) and
-            (
-              leftEssentialTypeCategory =
-                [EssentiallySignedType(), EssentiallyUnsignedType().(TEssentialTypeCategory)]
-              or
-              rightEssentialTypeCategory =
-                [EssentiallySignedType(), EssentiallyUnsignedType().(TEssentialTypeCategory)]
-            )
-            or
-            this instanceof SubExpr and
-            leftEssentialTypeCategory = EssentiallyCharacterType() and
-            rightEssentialTypeCategory =
-              [EssentiallySignedType(), EssentiallyUnsignedType().(TEssentialTypeCategory)]
-          then result instanceof PlainCharType
-          else result = this.getStandardType()
+          leftEssentialTypeCategory = EssentiallySignedType() and result = stlr(this)
+          or
+          leftEssentialTypeCategory = EssentiallyUnsignedType() and result = utlr(this)
+        else result = maxRankType(leftEssentialType, rightEssentialType)
+      else result = this.getStandardType()
+    )
+  }
+}
+
+/**
+ * An add expression, with essential type behaviour as specified by D.7.9.
+ */
+class EssentialAddExpr extends EssentialBinaryOperationSubjectToUsualConversions, AddExpr {
+  override Type getEssentialType() {
+    exists(
+      Type otherOperandType, EssentialTypeCategory operandTypeCategory,
+      EssentialTypeCategory otherOperandTypeCategory, int intTypeSize
+    |
+      operandTypeCategory = getEssentialTypeCategory(getEssentialType(getAnOperand())) and
+      otherOperandType = getEssentialType(getAnOperand()) and
+      otherOperandTypeCategory = getEssentialTypeCategory(otherOperandType) and
+      intTypeSize = any(IntType i).getSize()
+    |
+      if
+        operandTypeCategory = EssentiallyCharacterType() and
+        otherOperandTypeCategory instanceof EssentiallySignedOrUnsignedType and
+        otherOperandType.getSize() <= intTypeSize
+      then result instanceof PlainCharType
+      else result = super.getEssentialType()
+    )
+  }
+}
+
+/**
+ * A sub expression, with essential type behaviour as specified by D.7.9.
+ */
+class EssentialSubExpr extends EssentialBinaryOperationSubjectToUsualConversions, SubExpr {
+  override Type getEssentialType() {
+    exists(
+      EssentialTypeCategory leftEssentialTypeCategory, Type rightEssentialType,
+      EssentialTypeCategory rightEssentialTypeCategory, int intTypeSize
+    |
+      leftEssentialTypeCategory = getEssentialTypeCategory(getEssentialType(getLeftOperand())) and
+      rightEssentialType = getEssentialType(getRightOperand()) and
+      rightEssentialTypeCategory = getEssentialTypeCategory(rightEssentialType) and
+      intTypeSize = any(IntType i).getSize()
+    |
+      if
+        leftEssentialTypeCategory = EssentiallyCharacterType() and
+        rightEssentialTypeCategory instanceof EssentiallySignedOrUnsignedType and
+        rightEssentialType.getSize() <= intTypeSize
+      then result instanceof PlainCharType
+      else result = super.getEssentialType()
     )
   }
 }
@@ -408,7 +455,7 @@ class EssentialLiteral extends EssentialExpr, Literal {
             if underlyingStandardType.(IntType).isSigned()
             then result = stlr(this)
             else result = utlr(this)
-          else result = underlyingStandardType
+          else result = getStandardType()
         )
     )
   }
diff --git a/c/misra/src/qlpack.yml b/c/misra/src/qlpack.yml
index b160f27b6e..8b98f26fb0 100644
--- a/c/misra/src/qlpack.yml
+++ b/c/misra/src/qlpack.yml
@@ -1,9 +1,9 @@
 name: codeql/misra-c-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 description: MISRA C 2012
 suites: codeql-suites
 license: MIT
 default-suite-file: codeql-suites/misra-c-default.qls
 dependencies:
   codeql/common-c-coding-standards: '*'
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
diff --git a/c/misra/src/rules/DIR-4-11/CheckMathLibraryFunctionParameters.ql b/c/misra/src/rules/DIR-4-11/CheckMathLibraryFunctionParameters.ql
new file mode 100644
index 0000000000..4011b210f8
--- /dev/null
+++ b/c/misra/src/rules/DIR-4-11/CheckMathLibraryFunctionParameters.ql
@@ -0,0 +1,23 @@
+/**
+ * @id c/misra/check-math-library-function-parameters
+ * @name DIR-4-11: The validity of values passed to `math.h` library functions shall be checked
+ * @description Range, domain or pole errors in math functions may return unexpected values, trigger
+ *              floating-point exceptions or set unexpected error modes.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/dir-4-11
+ *       correctness
+ *       external/misra/c/2012/third-edition-first-revision
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.rules.uncheckedrangedomainpoleerrors.UncheckedRangeDomainPoleErrors
+
+class CheckMathLibraryFunctionParametersQuery extends UncheckedRangeDomainPoleErrorsSharedQuery {
+  CheckMathLibraryFunctionParametersQuery() {
+    this = ContractsPackage::checkMathLibraryFunctionParametersQuery()
+  }
+}
diff --git a/c/misra/src/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.ql b/c/misra/src/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.ql
new file mode 100644
index 0000000000..6a910a1a71
--- /dev/null
+++ b/c/misra/src/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.ql
@@ -0,0 +1,43 @@
+/**
+ * @id c/misra/low-precision-periodic-trigonometric-function-call
+ * @name DIR-4-11: The validity of values passed to trigonometric functions shall be checked
+ * @description Trigonometric periodic functions have significantly less precision when called with
+ *              large floating-point values.
+ * @kind problem
+ * @precision high
+ * @problem.severity warning
+ * @tags external/misra/id/dir-4-11
+ *       correctness
+ *       external/misra/c/2012/third-edition-first-revision
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+float getMaxAllowedAbsoluteValue(FloatingPointType t, string description) {
+  if t.getSize() <= 4
+  then (
+    // Per MISRA, assume k=1 for float types.
+    result = 3.15 and description = "pi"
+  ) else (
+    // Allow k=10 for doubles, as the standard allows for a larger range depending on the
+    // implementation, application, and precision goals.
+    result = 10 * 3.15 and description = "10 * pi"
+  )
+}
+
+from FunctionCall fc, Expr argument, float maxValue, float maxAllowedValue, string maxAllowedStr
+where
+  not isExcluded(fc, ContractsPackage::lowPrecisionPeriodicTrigonometricFunctionCallQuery()) and
+  fc.getTarget().getName() = ["sin", "cos", "tan"] and
+  argument = fc.getArgument(0) and
+  maxValue = rank[1](float bound | bound = [lowerBound(argument), upperBound(argument)].abs()) and
+  maxAllowedValue = getMaxAllowedAbsoluteValue(argument.getType(), maxAllowedStr) and
+  maxValue > maxAllowedValue
+select fc,
+  "Call to periodic trigonometric function " + fc.getTarget().getName() +
+    " with maximum argument absolute value of " + maxValue.toString() +
+    ", which exceeds the recommended " + "maximum of " + maxAllowedStr + "."
diff --git a/c/misra/src/rules/DIR-4-15/PossibleMisuseOfUndetectedInfinity.ql b/c/misra/src/rules/DIR-4-15/PossibleMisuseOfUndetectedInfinity.ql
new file mode 100644
index 0000000000..0294fc6919
--- /dev/null
+++ b/c/misra/src/rules/DIR-4-15/PossibleMisuseOfUndetectedInfinity.ql
@@ -0,0 +1,23 @@
+/**
+ * @id c/misra/possible-misuse-of-undetected-infinity
+ * @name DIR-4-15: Evaluation of floating-point expressions shall not lead to the undetected generation of infinities
+ * @description Evaluation of floating-point expressions shall not lead to the undetected generation
+ *              of infinities.
+ * @kind path-problem
+ * @precision medium
+ * @problem.severity warning
+ * @tags external/misra/id/dir-4-15
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.rules.misuseofinfinitefloatingpointvalue.MisuseOfInfiniteFloatingPointValue
+
+class PossibleMisuseOfUndetectedInfinityQuery extends MisuseOfInfiniteFloatingPointValueSharedQuery {
+  PossibleMisuseOfUndetectedInfinityQuery() {
+    this = FloatingTypes2Package::possibleMisuseOfUndetectedInfinityQuery()
+  }
+}
diff --git a/c/misra/src/rules/DIR-4-15/PossibleMisuseOfUndetectedNaN.ql b/c/misra/src/rules/DIR-4-15/PossibleMisuseOfUndetectedNaN.ql
new file mode 100644
index 0000000000..9315a4ed4c
--- /dev/null
+++ b/c/misra/src/rules/DIR-4-15/PossibleMisuseOfUndetectedNaN.ql
@@ -0,0 +1,23 @@
+/**
+ * @id c/misra/possible-misuse-of-undetected-nan
+ * @name DIR-4-15: Evaluation of floating-point expressions shall not lead to the undetected generation of NaNs
+ * @description Evaluation of floating-point expressions shall not lead to the undetected generation
+ *              of NaNs.
+ * @kind path-problem
+ * @precision low
+ * @problem.severity warning
+ * @tags external/misra/id/dir-4-15
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.rules.misuseofnanfloatingpointvalue.MisuseOfNaNFloatingPointValue
+
+class PossibleMisuseOfUndetectedNaNQuery extends MisuseOfNaNFloatingPointValueSharedQuery {
+  PossibleMisuseOfUndetectedNaNQuery() {
+    this = FloatingTypes2Package::possibleMisuseOfUndetectedNaNQuery()
+  }
+}
diff --git a/c/misra/src/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.ql b/c/misra/src/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.ql
index 3891d8c99f..0e6c902441 100644
--- a/c/misra/src/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.ql
+++ b/c/misra/src/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.ql
@@ -29,6 +29,8 @@ class BuiltInNumericType extends BuiltInType {
     this instanceof DoubleType
     or
     this instanceof LongDoubleType
+    or
+    this instanceof ComplexNumberType
   }
 }
 
@@ -38,22 +40,64 @@ predicate forbiddenBuiltinNumericUsedInDecl(Variable var, string message) {
   message = "The type " + var.getType() + " is not a fixed-width numeric type."
 }
 
+class SizedTypeString extends string {
+  string pattern;
+  int size;
+
+  bindingset[this]
+  pragma[inline]
+  SizedTypeString() {
+    pattern = "(u?int|c?float)(4|8|16|32|64|128)_t" and
+    this.regexpMatch(pattern) and
+    size = this.regexpCapture(pattern, 2).toInt()
+  }
+
+  bindingset[this]
+  pragma[inline]
+  int getSize() { result = size }
+
+  bindingset[this]
+  pragma[inline]
+  predicate isComplex() { this.charAt(0) = "c" }
+}
+
+predicate forbiddenComplexType(CTypedefType typedef, string message) {
+  typedef.getName().(SizedTypeString).isComplex() and
+  (
+    if typedef.getBaseType().stripTopLevelSpecifiers() instanceof ComplexNumberType
+    then
+      typedef.getSize() * 8 != typedef.getName().(SizedTypeString).getSize() * 2 and
+      message = "The typedef type " + typedef.getName() + " does not have its indicated real size."
+    else message = "The typedef type " + typedef.getName() + " is not a complex type."
+  )
+}
+
+predicate forbiddenRealType(CTypedefType typedef, string message) {
+  not typedef.getName().(SizedTypeString).isComplex() and
+  (
+    if typedef.getBaseType().stripTopLevelSpecifiers() instanceof ComplexNumberType
+    then message = "The typedef name " + typedef.getName() + " does not indicate a complex type."
+    else (
+      typedef.getSize() * 8 != typedef.getName().(SizedTypeString).getSize() and
+      message = "The typedef type " + typedef.getName() + " does not have its indicated size."
+    )
+  )
+}
+
 predicate forbiddenTypedef(CTypedefType typedef, string message) {
   /* If the typedef's name contains an explicit size */
   (
-    if typedef.getName().regexpMatch("u?(int|float)(4|8|16|32|64|128)_t")
+    if typedef.getName() instanceof SizedTypeString
     then (
-      /* Then the actual type size should match. */
-      not typedef.getSize() * 8 =
-        // times 8 because getSize() gets the size in bytes
-        typedef.getName().regexpCapture("u?(int|float)(4|8|16|32|64|128)_t", 2).toInt() and
-      message = "The typedef type " + typedef.getName() + " does not have its indicated size."
+      forbiddenRealType(typedef, message)
+      or
+      forbiddenComplexType(typedef, message)
     ) else (
       (
         // type def is to a built in numeric type
         typedef.getBaseType() instanceof BuiltInNumericType and
         // but does not include the size in the name
-        not typedef.getName().regexpMatch("u?(int|float)(4|8|16|32|64|128)_t")
+        not typedef.getName() instanceof SizedTypeString
         or
         // this is a typedef to a forbidden type def
         forbiddenTypedef(typedef.getBaseType(), _)
diff --git a/c/misra/src/rules/DIR-4-7/FunctionErrorInformationUntested.ql b/c/misra/src/rules/DIR-4-7/FunctionErrorInformationUntested.ql
new file mode 100644
index 0000000000..0c0a3d7b1a
--- /dev/null
+++ b/c/misra/src/rules/DIR-4-7/FunctionErrorInformationUntested.ql
@@ -0,0 +1,28 @@
+/**
+ * @id c/misra/function-error-information-untested
+ * @name DIR-4-7: If a function generates error information, then that error information shall be tested
+ * @description A function (whether it is part of the standard library, a third party library or a
+ *              user defined function) may provide some means of indicating the occurrence of an
+ *              error. This may be via a global error flag, a parametric error flag, a special
+ *              return value or some other means. Whenever such a mechanism is provided by a
+ *              function the calling program shall check for the indication of an error as soon as
+ *              the function returns.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity recommendation
+ * @tags external/misra/id/dir-4-7
+ *       maintainability
+ *       external/misra/c/2012/third-edition-first-revision
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.rules.functionerroneousreturnvaluenottested.FunctionErroneousReturnValueNotTested
+
+class FunctionErrorInformationUntestedQuery extends FunctionErroneousReturnValueNotTestedSharedQuery
+{
+  FunctionErrorInformationUntestedQuery() {
+    this = ContractsPackage::functionErrorInformationUntestedQuery()
+  }
+}
diff --git a/c/misra/src/rules/DIR-5-1/PossibleDataRaceBetweenThreads.ql b/c/misra/src/rules/DIR-5-1/PossibleDataRaceBetweenThreads.ql
new file mode 100644
index 0000000000..edf3705a9b
--- /dev/null
+++ b/c/misra/src/rules/DIR-5-1/PossibleDataRaceBetweenThreads.ql
@@ -0,0 +1,162 @@
+/**
+ * @id c/misra/possible-data-race-between-threads
+ * @name DIR-5-1: There shall be no data races between threads
+ * @description Threads shall not access the same memory location concurrently without utilization
+ *              of thread synchronization objects.
+ * @kind problem
+ * @precision medium
+ * @problem.severity error
+ * @tags external/misra/id/dir-5-1
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Objects
+import codingstandards.c.SubObjects
+import codingstandards.cpp.Concurrency
+
+newtype TNonReentrantOperation =
+  TReadWrite(SubObject object) {
+    object.getRootIdentity().getStorageDuration().isStatic()
+    or
+    object.getRootIdentity().getStorageDuration().isAllocated()
+  } or
+  TStdFunctionCall(FunctionCall call) {
+    call.getTarget()
+        .hasName([
+            "setlocale", "tmpnam", "rand", "srand", "getenv", "getenv_s", "strok", "strerror",
+            "asctime", "ctime", "gmtime", "localtime", "mbrtoc16", "c16rtomb", "mbrtoc32",
+            "c32rtomb", "mbrlen", "mbrtowc", "wcrtomb", "mbsrtowcs", "wcsrtombs"
+          ])
+  }
+
+class NonReentrantOperation extends TNonReentrantOperation {
+  string toString() {
+    exists(SubObject object |
+      this = TReadWrite(object) and
+      result = object.toString()
+    )
+    or
+    exists(FunctionCall call |
+      this = TStdFunctionCall(call) and
+      result = call.getTarget().getName()
+    )
+  }
+
+  Expr getAReadExpr() {
+    exists(SubObject object |
+      this = TReadWrite(object) and
+      result = object.getAnAccess()
+    )
+    or
+    this = TStdFunctionCall(result)
+  }
+
+  Expr getAWriteExpr() {
+    exists(SubObject object, Assignment assignment |
+      this = TReadWrite(object) and
+      result = assignment and
+      assignment.getLValue() = object.getAnAccess()
+    )
+    or
+    this = TStdFunctionCall(result)
+  }
+
+  string getReadString() {
+    this = TReadWrite(_) and
+    result = "read operation"
+    or
+    this = TStdFunctionCall(_) and
+    result = "call to non-reentrant function"
+  }
+
+  string getWriteString() {
+    this = TReadWrite(_) and
+    result = "write to object"
+    or
+    this = TStdFunctionCall(_) and
+    result = "call to non-reentrant function"
+  }
+
+  Element getSourceElement() {
+    exists(SubObject object |
+      this = TReadWrite(object) and
+      result = object.getRootIdentity()
+    )
+    or
+    this = TStdFunctionCall(result)
+  }
+}
+
+class WritingThread extends ThreadedFunction {
+  NonReentrantOperation aWriteObject;
+  Expr aWriteExpr;
+
+  WritingThread() {
+    aWriteExpr = aWriteObject.getAWriteExpr() and
+    // This function directly contains the write expression, or transitively calls the function
+    // that contains the write expression.
+    this.calls*(aWriteExpr.getEnclosingFunction()) and
+    // The write isn't synchronized with a mutex or condition object.
+    not aWriteExpr instanceof LockProtectedControlFlowNode and
+    // The write doesn't seem to be during a special initialization phase of the program.
+    not aWriteExpr.getEnclosingFunction().getName().matches(["%init%", "%boot%", "%start%"])
+  }
+
+  Expr getAWriteExpr() { result = aWriteExpr }
+}
+
+class ReadingThread extends ThreadedFunction {
+  Expr aReadExpr;
+
+  ReadingThread() {
+    exists(NonReentrantOperation op |
+      aReadExpr = op.getAReadExpr() and
+      this.calls*(aReadExpr.getEnclosingFunction()) and
+      not aReadExpr instanceof LockProtectedControlFlowNode
+    )
+  }
+
+  Expr getAReadExpr() { result = aReadExpr }
+}
+
+predicate mayBeDataRace(Expr write, Expr read, NonReentrantOperation operation) {
+  exists(WritingThread wt |
+    wt.getAWriteExpr() = write and
+    write = operation.getAWriteExpr() and
+    exists(ReadingThread rt |
+      read = rt.getAReadExpr() and
+      read = operation.getAReadExpr() and
+      (
+        wt.isMultiplySpawned() or
+        not wt = rt
+      )
+    )
+  )
+}
+
+from
+  WritingThread wt, ReadingThread rt, Expr write, Expr read, NonReentrantOperation operation,
+  string message, string writeString, string readString
+where
+  not isExcluded(write, Concurrency9Package::possibleDataRaceBetweenThreadsQuery()) and
+  mayBeDataRace(write, read, operation) and
+  wt = min(WritingThread f | f.getAWriteExpr() = write | f order by f.getName()) and
+  rt = min(ReadingThread f | f.getAReadExpr() = read | f order by f.getName()) and
+  writeString = operation.getWriteString() and
+  readString = operation.getReadString() and
+  if wt.isMultiplySpawned()
+  then
+    message =
+      "Threaded " + writeString +
+        " $@ not synchronized from thread function $@ spawned from a loop."
+  else
+    message =
+      "Threaded " + writeString +
+        " $@ from thread function $@ is not synchronized with $@ from thread function $@."
+select write, message, operation.getSourceElement(), operation.toString(), wt, wt.getName(), read,
+  "concurrent " + readString, rt, rt.getName()
diff --git a/c/misra/src/rules/DIR-5-2/NotNoDeadlocksBetweenThreads.ql b/c/misra/src/rules/DIR-5-2/NotNoDeadlocksBetweenThreads.ql
new file mode 100644
index 0000000000..5d949f56ed
--- /dev/null
+++ b/c/misra/src/rules/DIR-5-2/NotNoDeadlocksBetweenThreads.ql
@@ -0,0 +1,25 @@
+/**
+ * @id c/misra/not-no-deadlocks-between-threads
+ * @name DIR-5-2: There shall be no deadlocks between threads
+ * @description Circular waits leading to thread deadlocks may be avoided by locking in a predefined
+ *              order.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/dir-5-2
+ *       external/misra/c/2012/amendment4
+ *       correctness
+ *       concurrency
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.rules.preventdeadlockbylockinginpredefinedorder.PreventDeadlockByLockingInPredefinedOrder
+
+class NotNoDeadlocksBetweenThreadsQuery extends PreventDeadlockByLockingInPredefinedOrderSharedQuery
+{
+  NotNoDeadlocksBetweenThreadsQuery() {
+    this = Concurrency6Package::notNoDeadlocksBetweenThreadsQuery()
+  }
+}
diff --git a/c/misra/src/rules/DIR-5-3/BannedDynamicThreadCreation.ql b/c/misra/src/rules/DIR-5-3/BannedDynamicThreadCreation.ql
new file mode 100644
index 0000000000..4bb526306b
--- /dev/null
+++ b/c/misra/src/rules/DIR-5-3/BannedDynamicThreadCreation.ql
@@ -0,0 +1,29 @@
+/**
+ * @id c/misra/banned-dynamic-thread-creation
+ * @name DIR-5-3: There shall be no dynamic thread creation
+ * @description Creating threads outside of a well-defined program start-up phase creates
+ *              uncertainty in program behavior and concurrency overhead costs.
+ * @kind problem
+ * @precision low
+ * @problem.severity error
+ * @tags external/misra/id/dir-5-3
+ *       external/misra/c/2012/amendment4
+ *       external/misra/c/audit
+ *       correctness
+ *       maintainability
+ *       concurrency
+ *       performance
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.Concurrency
+
+from CThreadCreateCall tc, Function enclosingFunction
+where
+  not isExcluded(tc, Concurrency6Package::bannedDynamicThreadCreationQuery()) and
+  enclosingFunction = tc.getEnclosingFunction() and
+  not enclosingFunction.getName() = "main"
+select tc, "Possible dynamic creation of thread outside initialization in function '$@'.",
+  enclosingFunction, enclosingFunction.toString()
diff --git a/c/misra/src/rules/DIR-5-3/ThreadCreatedByThread.ql b/c/misra/src/rules/DIR-5-3/ThreadCreatedByThread.ql
new file mode 100644
index 0000000000..207e763fa7
--- /dev/null
+++ b/c/misra/src/rules/DIR-5-3/ThreadCreatedByThread.ql
@@ -0,0 +1,38 @@
+/**
+ * @id c/misra/thread-created-by-thread
+ * @name DIR-5-3: Threads shall not be created by other threads
+ * @description Creating threads within threads creates uncertainty in program behavior and
+ *              concurrency overhead costs.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/dir-5-3
+ *       external/misra/c/2012/amendment4
+ *       correctness
+ *       maintainability
+ *       concurrency
+ *       performance
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.Concurrency
+
+class CThreadRoot extends Function {
+  CThreadCreateCall threadCreate;
+
+  CThreadRoot() { threadCreate.getFunction() = this }
+
+  /* Get a function which is reachable from this function */
+  Function getAReachableFunction() { calls*(result) }
+
+  CThreadCreateCall getACThreadCreateCall() { result = threadCreate }
+}
+
+from CThreadCreateCall tc, CThreadRoot threadRoot
+where
+  not isExcluded(tc, Concurrency6Package::threadCreatedByThreadQuery()) and
+  tc.getEnclosingFunction() = threadRoot.getAReachableFunction()
+select tc, "Thread creation call reachable from function '$@', which may also be $@.", threadRoot,
+  threadRoot.toString(), threadRoot.getACThreadCreateCall(), "started as a thread"
diff --git a/c/misra/src/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.ql b/c/misra/src/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.ql
index 10b24b8c8a..d06ba09f3d 100644
--- a/c/misra/src/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.ql
+++ b/c/misra/src/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.ql
@@ -16,6 +16,15 @@ import cpp
 import codingstandards.c.misra
 import codingstandards.c.misra.EssentialTypes
 
+predicate hasComparableFloatValue(Expr e) {
+  exists(float value |
+    value = e.getValue().toFloat() or
+    value = -e.(UnaryMinusExpr).getOperand().getValue().toFloat()
+  |
+    value in [0.0, "Infinity".toFloat(), -"Infinity".toFloat()]
+  )
+}
+
 /**
  * Holds if the operator `operator` has an operand `child` that is of an inappropriate essential type
  * according to MISRA C 2012 Rule 10.1.
@@ -33,8 +42,11 @@ predicate isInappropriateEssentialType(
       etc = EssentiallyCharacterType() and
       rationaleId = 4
       or
-      etc = EssentiallyFloatingType() and
+      etc = EssentiallyFloatingType(Real()) and
       rationaleId = 1
+      or
+      etc = EssentiallyFloatingType(Complex()) and
+      rationaleId = 9
     )
     or
     child = operator.(UnaryPlusExpr).getOperand() and
@@ -64,8 +76,6 @@ predicate isInappropriateEssentialType(
       rationaleId = 8
     )
     or
-    // The table only talks about + and -, but below it clarifies ++ and -- are also considered to
-    // be equivalent.
     child =
       [
         operator.(AddExpr).getAnOperand(), operator.(SubExpr).getAnOperand(),
@@ -80,6 +90,13 @@ predicate isInappropriateEssentialType(
       rationaleId = 5
     )
     or
+    child =
+      [operator.(IncrementOperation).getAnOperand(), operator.(DecrementOperation).getAnOperand()] and
+    (
+      etc = EssentiallyFloatingType(Complex()) and
+      rationaleId = 9
+    )
+    or
     child =
       [
         operator.(DivExpr).getAnOperand(), operator.(MulExpr).getAnOperand(),
@@ -107,13 +124,26 @@ predicate isInappropriateEssentialType(
       etc = EssentiallyEnumType() and
       rationaleId = 5
       or
-      etc = EssentiallyFloatingType() and
+      etc = EssentiallyFloatingType(Real()) and
       rationaleId = 1
+      or
+      etc = EssentiallyFloatingType(Complex()) and
+      rationaleId = 9
     )
     or
     child = operator.(RelationalOperation).getAnOperand() and
-    etc = EssentiallyBooleanType() and
-    rationaleId = 3
+    (
+      etc = EssentiallyBooleanType() and
+      rationaleId = 3
+      or
+      etc = EssentiallyFloatingType(Complex()) and
+      rationaleId = 9
+    )
+    or
+    child = operator.(EqualityOperation).getAnOperand() and
+    rationaleId = 10 and
+    not hasComparableFloatValue(operator.(EqualityOperation).getAnOperand()) and
+    etc = EssentiallyFloatingType(_)
     or
     child = [operator.(NotExpr).getAnOperand(), operator.(BinaryLogicalOperation).getAnOperand()] and
     rationaleId = 2 and
@@ -126,7 +156,7 @@ predicate isInappropriateEssentialType(
       or
       etc = EssentiallyUnsignedType()
       or
-      etc = EssentiallyFloatingType()
+      etc = EssentiallyFloatingType(_)
     )
     or
     child =
@@ -147,8 +177,11 @@ predicate isInappropriateEssentialType(
       etc = EssentiallySignedType() and
       rationaleId = 6
       or
-      etc = EssentiallyFloatingType() and
+      etc = EssentiallyFloatingType(Real()) and
       rationaleId = 1
+      or
+      etc = EssentiallyFloatingType(Complex()) and
+      rationaleId = 9
     )
     or
     child =
@@ -171,8 +204,11 @@ predicate isInappropriateEssentialType(
       etc = EssentiallySignedType() and
       rationaleId = 7
       or
-      etc = EssentiallyFloatingType() and
+      etc = EssentiallyFloatingType(Real()) and
       rationaleId = 1
+      or
+      etc = EssentiallyFloatingType(Complex()) and
+      rationaleId = 9
     )
     or
     child =
@@ -197,8 +233,11 @@ predicate isInappropriateEssentialType(
       etc = EssentiallySignedType() and
       rationaleId = 6
       or
-      etc = EssentiallyFloatingType() and
+      etc = EssentiallyFloatingType(Real()) and
       rationaleId = 1
+      or
+      etc = EssentiallyFloatingType(Complex()) and
+      rationaleId = 9
     )
     or
     child = operator.(ConditionalExpr).getCondition() and
@@ -215,7 +254,7 @@ predicate isInappropriateEssentialType(
       etc = EssentiallyUnsignedType() and
       rationaleId = 2
       or
-      etc = EssentiallyFloatingType() and
+      etc = EssentiallyFloatingType(_) and
       rationaleId = 2
     )
   )
@@ -245,6 +284,13 @@ string getRationaleMessage(int rationaleId, EssentialTypeCategory etc) {
   rationaleId = 8 and
   result =
     "Operand of essentially Unsigned type will be converted to a signed type with the signedness dependent on the implemented size of int."
+  or
+  rationaleId = 9 and
+  result = "Use of essentially Complex type in this way is a constraint violation."
+  or
+  rationaleId = 10 and
+  result =
+    "Floating point numbers have inherent error such that comparisons should consider precision and not exact equality."
 }
 
 from Expr operator, Expr child, int rationaleId, EssentialTypeCategory etc
diff --git a/c/misra/src/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.ql b/c/misra/src/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.ql
index 750e589a1c..0e98c6c570 100644
--- a/c/misra/src/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.ql
+++ b/c/misra/src/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.ql
@@ -32,7 +32,7 @@ where
     // But the overall essential type is not essentially character type
     getEssentialTypeCategory(getEssentialType(addOrSub)) = EssentiallyCharacterType()
     or
-    // Or this is a subtration of one character with another, which is permitted, but produces an integral type
+    // Or this is a subtraction of one character with another, which is permitted, but produces an integral type
     getEssentialTypeCategory(getEssentialType(addOrSub.getLeftOperand())) =
       EssentiallyCharacterType() and
     getEssentialTypeCategory(getEssentialType(addOrSub.getRightOperand())) =
diff --git a/c/misra/src/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.ql b/c/misra/src/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.ql
index af120fb13d..7574531332 100644
--- a/c/misra/src/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.ql
+++ b/c/misra/src/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.ql
@@ -48,5 +48,11 @@ where
     lValueTypeCategory = EssentiallyUnsignedType() and
     const >= 0 and
     const <= 2.pow(lValueEssentialType.getSize() * 8)
+  ) and
+  // Exception 4: Real floating point values may be assignable to complex floating point values
+  not (
+    lValueTypeCategory = EssentiallyFloatingType(Complex()) and
+    rValueTypeCategory = EssentiallyFloatingType(Real()) and
+    lValueEssentialType.getSize() >= rValueEssentialType.getSize() * 2
   )
 select rValue, message
diff --git a/c/misra/src/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.ql b/c/misra/src/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.ql
index d1fed06319..71681ad3bc 100644
--- a/c/misra/src/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.ql
+++ b/c/misra/src/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.ql
@@ -30,6 +30,11 @@ where
   rightOpTypeCategory = getEssentialTypeCategory(rightOpEssentialType) and
   (
     not leftOpTypeCategory = rightOpTypeCategory and
+    not (
+      // Exception 3: Operands where both are real or complex floating types are allowed.
+      leftOpTypeCategory = EssentiallyFloatingType(_) and
+      rightOpTypeCategory = EssentiallyFloatingType(_)
+    ) and
     message =
       "The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: "
         + leftOpTypeCategory + ", right operand: " + rightOpTypeCategory + ")."
diff --git a/c/misra/src/rules/RULE-10-5/InappropriateEssentialTypeCast.ql b/c/misra/src/rules/RULE-10-5/InappropriateEssentialTypeCast.ql
index f782a16597..7cadb104ad 100644
--- a/c/misra/src/rules/RULE-10-5/InappropriateEssentialTypeCast.ql
+++ b/c/misra/src/rules/RULE-10-5/InappropriateEssentialTypeCast.ql
@@ -23,14 +23,14 @@ predicate isIncompatibleEssentialTypeCast(EssentialTypeCategory fromCat, Essenti
   toCat =
     [
       EssentiallyCharacterType(), EssentiallyEnumType(), EssentiallySignedType(),
-      EssentiallyUnsignedType(), EssentiallyFloatingType().(TEssentialTypeCategory)
+      EssentiallyUnsignedType(), EssentiallyFloatingType(_).(TEssentialTypeCategory)
     ]
   or
   fromCat = EssentiallyCharacterType() and
   toCat =
     [
       EssentiallyBooleanType(), EssentiallyEnumType(),
-      EssentiallyFloatingType().(TEssentialTypeCategory)
+      EssentiallyFloatingType(_).(TEssentialTypeCategory)
     ]
   or
   fromCat = EssentiallyEnumType() and
@@ -42,7 +42,7 @@ predicate isIncompatibleEssentialTypeCast(EssentialTypeCategory fromCat, Essenti
   fromCat = EssentiallyUnsignedType() and
   toCat = [EssentiallyBooleanType(), EssentiallyEnumType().(TEssentialTypeCategory)]
   or
-  fromCat = EssentiallyFloatingType() and
+  fromCat = EssentiallyFloatingType(_) and
   toCat =
     [
       EssentiallyBooleanType(), EssentiallyCharacterType(),
diff --git a/c/misra/src/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.ql b/c/misra/src/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.ql
index 911aa5e00e..d674f78dc3 100644
--- a/c/misra/src/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.ql
+++ b/c/misra/src/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.ql
@@ -23,6 +23,10 @@ bindingset[essentialTypeLeft, essentialTypeRight]
 pragma[inline_late]
 predicate isSameEssentialTypeCategory(Type essentialTypeLeft, Type essentialTypeRight) {
   getEssentialTypeCategory(essentialTypeLeft) = getEssentialTypeCategory(essentialTypeRight)
+  or
+  // Complex and real floating types are considered interchangeable
+  getEssentialTypeCategory(essentialTypeLeft) = EssentiallyFloatingType(_) and
+  getEssentialTypeCategory(essentialTypeRight) = EssentiallyFloatingType(_)
 }
 
 from
@@ -35,7 +39,7 @@ where
   not otherOp = compositeOp and
   compositeEssentialType = getEssentialType(compositeOp) and
   otherOpEssentialType = getEssentialType(otherOp) and
-  compositeEssentialType.getSize() < otherOpEssentialType.getSize() and
+  getEssentialSize(compositeEssentialType) < getEssentialSize(otherOpEssentialType) and
   // Operands of a different type category in an operation with the usual arithmetic conversions is
   // prohibited by Rule 10.4, so we only report cases here where the essential type categories are
   // the same
diff --git a/c/misra/src/rules/RULE-10-8/InappropriateCastOfCompositeExpression.ql b/c/misra/src/rules/RULE-10-8/InappropriateCastOfCompositeExpression.ql
index 162ba4439c..b4d54bf2e8 100644
--- a/c/misra/src/rules/RULE-10-8/InappropriateCastOfCompositeExpression.ql
+++ b/c/misra/src/rules/RULE-10-8/InappropriateCastOfCompositeExpression.ql
@@ -30,12 +30,19 @@ where
   castTypeCategory = getEssentialTypeCategory(castEssentialType) and
   compositeTypeCategory = getEssentialTypeCategory(compositeExprEssentialType) and
   (
-    not castTypeCategory = compositeTypeCategory and
-    message =
-      "Cast from " + compositeTypeCategory + " to " + castTypeCategory + " changes type category."
-    or
-    castTypeCategory = compositeTypeCategory and
-    castEssentialType.getSize() > compositeExprEssentialType.getSize() and
-    message = "Cast from " + compositeTypeCategory + " to " + castTypeCategory + " widens type."
+    if
+      not castTypeCategory = compositeTypeCategory and
+      not (
+        // Exception 2: Casts between real or complex floating types are allowed
+        castTypeCategory = EssentiallyFloatingType(_) and
+        compositeTypeCategory = EssentiallyFloatingType(_)
+      )
+    then
+      message =
+        "Cast from " + compositeTypeCategory + " to " + castTypeCategory + " changes type category."
+    else (
+      getEssentialSize(castEssentialType) > getEssentialSize(compositeExprEssentialType) and
+      message = "Cast from " + compositeTypeCategory + " to " + castTypeCategory + " widens type."
+    )
   )
 select ce, message
diff --git a/c/misra/src/rules/RULE-11-1/ConversionBetweenFunctionPointerAndOtherType.ql b/c/misra/src/rules/RULE-11-1/ConversionBetweenFunctionPointerAndOtherType.ql
index 36157e130e..7678fc1d23 100644
--- a/c/misra/src/rules/RULE-11-1/ConversionBetweenFunctionPointerAndOtherType.ql
+++ b/c/misra/src/rules/RULE-11-1/ConversionBetweenFunctionPointerAndOtherType.ql
@@ -14,7 +14,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 
 from CStyleCast cast, Type type, Type newType
 where
diff --git a/c/misra/src/rules/RULE-11-10/AtomicQualifierAppliedToVoid.ql b/c/misra/src/rules/RULE-11-10/AtomicQualifierAppliedToVoid.ql
new file mode 100644
index 0000000000..6440e84070
--- /dev/null
+++ b/c/misra/src/rules/RULE-11-10/AtomicQualifierAppliedToVoid.ql
@@ -0,0 +1,55 @@
+/**
+ * @id c/misra/atomic-qualifier-applied-to-void
+ * @name RULE-11-10: The _Atomic qualifier shall not be applied to the incomplete type void
+ * @description Conversions between types by using an _Atomic void type may result in undefined
+ *              behavior.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-11-10
+ *       correctness
+ *       external/misra/c/2012/third-edition-first-revision
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+
+class AtomicVoidType extends Type {
+  AtomicVoidType() {
+    hasSpecifier("atomic") and
+    getUnspecifiedType() instanceof VoidType
+  }
+}
+
+predicate usesAtomicVoid(Type root) {
+  root instanceof AtomicVoidType
+  or
+  usesAtomicVoid(root.(DerivedType).getBaseType())
+  or
+  usesAtomicVoid(root.(RoutineType).getReturnType())
+  or
+  usesAtomicVoid(root.(RoutineType).getAParameterType())
+  or
+  usesAtomicVoid(root.(FunctionPointerType).getReturnType())
+  or
+  usesAtomicVoid(root.(FunctionPointerType).getAParameterType())
+  or
+  usesAtomicVoid(root.(TypedefType).getBaseType())
+}
+
+class ExplicitType extends Type {
+  Element getDeclaration(string description) {
+    result.(DeclarationEntry).getType() = this and description = result.(DeclarationEntry).getName()
+    or
+    result.(CStyleCast).getType() = this and description = "Cast"
+  }
+}
+
+from Element decl, ExplicitType explicitType, string elementDescription
+where
+  not isExcluded(decl, Declarations9Package::atomicQualifierAppliedToVoidQuery()) and
+  decl = explicitType.getDeclaration(elementDescription) and
+  usesAtomicVoid(explicitType)
+select decl, elementDescription + " declared with an atomic void type."
diff --git a/c/misra/src/rules/RULE-11-2/ConversionBetweenIncompleteTypePointerAndOtherType.ql b/c/misra/src/rules/RULE-11-2/ConversionBetweenIncompleteTypePointerAndOtherType.ql
index 6c552b0f39..5c16dc1afb 100644
--- a/c/misra/src/rules/RULE-11-2/ConversionBetweenIncompleteTypePointerAndOtherType.ql
+++ b/c/misra/src/rules/RULE-11-2/ConversionBetweenIncompleteTypePointerAndOtherType.ql
@@ -14,7 +14,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 import codingstandards.cpp.Type
 
 from Cast cast, Type type, Type newType
diff --git a/c/misra/src/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.ql b/c/misra/src/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.ql
index 8292bd3b6f..cf41cfafa5 100644
--- a/c/misra/src/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.ql
+++ b/c/misra/src/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.ql
@@ -15,7 +15,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 
 from CStyleCast cast, Type baseTypeFrom, Type baseTypeTo
 where
@@ -23,7 +23,11 @@ where
   baseTypeFrom = cast.getExpr().getType().(PointerToObjectType).getBaseType() and
   baseTypeTo = cast.getType().(PointerToObjectType).getBaseType() and
   // exception: cast to a char, signed char, or unsigned char is permitted
-  not baseTypeTo.stripType() instanceof CharType and
+  not (
+    baseTypeTo.stripType() instanceof CharType and
+    // Exception does not apply to _Atomic types
+    not baseTypeFrom.hasSpecifier("atomic")
+  ) and
   (
     (
       baseTypeFrom.isVolatile() and not baseTypeTo.isVolatile()
diff --git a/c/misra/src/rules/RULE-11-4/ConversionBetweenPointerToObjectAndIntegerType.ql b/c/misra/src/rules/RULE-11-4/ConversionBetweenPointerToObjectAndIntegerType.ql
index 8877d04323..336f5d4643 100644
--- a/c/misra/src/rules/RULE-11-4/ConversionBetweenPointerToObjectAndIntegerType.ql
+++ b/c/misra/src/rules/RULE-11-4/ConversionBetweenPointerToObjectAndIntegerType.ql
@@ -15,7 +15,7 @@
 import cpp
 import codingstandards.c.misra
 import codingstandards.cpp.Macro
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 
 MacroInvocation getAMacroInvocation(CStyleCast cast) { result.getAnExpandedElement() = cast }
 
diff --git a/c/misra/src/rules/RULE-11-5/ConversionFromPointerToVoidIntoPointerToObject.ql b/c/misra/src/rules/RULE-11-5/ConversionFromPointerToVoidIntoPointerToObject.ql
index 0363c28c19..b316b39a56 100644
--- a/c/misra/src/rules/RULE-11-5/ConversionFromPointerToVoidIntoPointerToObject.ql
+++ b/c/misra/src/rules/RULE-11-5/ConversionFromPointerToVoidIntoPointerToObject.ql
@@ -14,7 +14,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 
 from Cast cast, VoidPointerType type, PointerToObjectType newType
 where
diff --git a/c/misra/src/rules/RULE-11-6/CastBetweenPointerToVoidAndArithmeticType.ql b/c/misra/src/rules/RULE-11-6/CastBetweenPointerToVoidAndArithmeticType.ql
index cc0adf0517..2293ede61e 100644
--- a/c/misra/src/rules/RULE-11-6/CastBetweenPointerToVoidAndArithmeticType.ql
+++ b/c/misra/src/rules/RULE-11-6/CastBetweenPointerToVoidAndArithmeticType.ql
@@ -14,7 +14,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 
 from CStyleCast cast, Type typeFrom, Type typeTo
 where
diff --git a/c/misra/src/rules/RULE-11-7/CastBetweenPointerToObjectAndNonIntArithmeticType.ql b/c/misra/src/rules/RULE-11-7/CastBetweenPointerToObjectAndNonIntArithmeticType.ql
index e499ea6485..82ac620aa7 100644
--- a/c/misra/src/rules/RULE-11-7/CastBetweenPointerToObjectAndNonIntArithmeticType.ql
+++ b/c/misra/src/rules/RULE-11-7/CastBetweenPointerToObjectAndNonIntArithmeticType.ql
@@ -14,7 +14,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 
 class MisraNonIntegerArithmeticType extends Type {
   MisraNonIntegerArithmeticType() {
diff --git a/c/misra/src/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.ql b/c/misra/src/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.ql
index 17b12aaf99..c0f447d5b5 100644
--- a/c/misra/src/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.ql
+++ b/c/misra/src/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.ql
@@ -24,5 +24,9 @@ where
     baseTypeFrom.isVolatile() and not baseTypeTo.isVolatile() and qualificationName = "volatile"
     or
     baseTypeFrom.isConst() and not baseTypeTo.isConst() and qualificationName = "const"
+    or
+    baseTypeFrom.hasSpecifier("atomic") and
+    not baseTypeTo.hasSpecifier("atomic") and
+    qualificationName = "atomic"
   )
 select cast, "Cast of pointer removes " + qualificationName + " qualification from its base type."
diff --git a/c/misra/src/rules/RULE-11-9/MacroNullNotUsedAsIntegerNullPointerConstant.ql b/c/misra/src/rules/RULE-11-9/MacroNullNotUsedAsIntegerNullPointerConstant.ql
index cb18ed0d1d..28b256e85c 100644
--- a/c/misra/src/rules/RULE-11-9/MacroNullNotUsedAsIntegerNullPointerConstant.ql
+++ b/c/misra/src/rules/RULE-11-9/MacroNullNotUsedAsIntegerNullPointerConstant.ql
@@ -13,7 +13,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 import codingstandards.cpp.Type
 
 from Zero zero, Expr e, string type
diff --git a/c/misra/src/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.ql b/c/misra/src/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.ql
new file mode 100644
index 0000000000..5085e5dc7b
--- /dev/null
+++ b/c/misra/src/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.ql
@@ -0,0 +1,40 @@
+/**
+ * @id c/misra/atomic-aggregate-object-directly-accessed
+ * @name RULE-12-6: Structure and union members of atomic objects shall not be directly accessed
+ * @description Accessing a member of an atomic structure or union results in undefined behavior.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-12-6
+ *       external/misra/c/2012/amendment4
+ *       correctness
+ *       concurrency
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+
+from Expr expr, Field field
+where
+  not isExcluded(expr, Concurrency6Package::atomicAggregateObjectDirectlyAccessedQuery()) and
+  not expr.isUnevaluated() and
+  (
+    exists(FieldAccess fa |
+      expr = fa and
+      fa.getQualifier().getType().hasSpecifier("atomic") and
+      field = fa.getTarget()
+    )
+    or
+    exists(PointerFieldAccess fa |
+      expr = fa and
+      fa.getQualifier()
+          .getType()
+          .stripTopLevelSpecifiers()
+          .(PointerType)
+          .getBaseType()
+          .hasSpecifier("atomic") and
+      field = fa.getTarget()
+    )
+  )
+select expr, "Invalid access to member '$@' on atomic struct or union.", field, field.getName()
diff --git a/c/misra/src/rules/RULE-13-2/UnsequencedAtomicReads.ql b/c/misra/src/rules/RULE-13-2/UnsequencedAtomicReads.ql
new file mode 100644
index 0000000000..86756668a8
--- /dev/null
+++ b/c/misra/src/rules/RULE-13-2/UnsequencedAtomicReads.ql
@@ -0,0 +1,117 @@
+/**
+ * @id c/misra/unsequenced-atomic-reads
+ * @name RULE-13-2: The value of an atomic variable shall not depend on the evaluation order of interleaved threads
+ * @description The value of an atomic variable shall not depend on evaluation order and
+ *              interleaving of threads.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-13-2
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import semmle.code.cpp.dataflow.TaintTracking
+import codingstandards.c.misra
+import codingstandards.c.Ordering
+import codingstandards.c.orderofevaluation.VariableAccessOrdering
+import codingstandards.cpp.StdFunctionOrMacro
+
+class AtomicAccessInFullExpressionOrdering extends Ordering::Configuration {
+  AtomicAccessInFullExpressionOrdering() { this = "AtomicAccessInFullExpressionOrdering" }
+
+  override predicate isCandidate(Expr e1, Expr e2) {
+    exists(AtomicVariableAccess a, AtomicVariableAccess b, FullExpr e | a = e1 and b = e2 |
+      a.getTarget() = b.getTarget() and
+      a.getARead().(ConstituentExpr).getFullExpr() = e and
+      b.getARead().(ConstituentExpr).getFullExpr() = e and
+      not a = b
+    )
+  }
+}
+
+/**
+ * A read of a variable specified as `_Atomic`.
+ *
+ * Note, it may be accessed directly, or by passing its address into the std atomic functions.
+ */
+class AtomicVariableAccess extends VariableAccess {
+  AtomicVariableAccess() { getTarget().getType().hasSpecifier("atomic") }
+
+  /* Get the `atomic_load()` call this VarAccess occurs in. */
+  Expr getAtomicFunctionRead() {
+    exists(AddressOfExpr addrParent, AtomicReadOrWriteCall fc |
+      fc.getName().matches("atomic_load%") and
+      // StdFunctionOrMacro arguments are not necessarily reliable, so we look for any AddressOfExpr
+      // that is an argument to a call to `atomic_load`.
+      addrParent = fc.getArgument(0) and
+      addrParent.getAnOperand() = this and
+      result = fc.getExpr()
+    )
+  }
+
+  /* Get the `atomic_store()` call this VarAccess occurs in. */
+  Expr getAtomicFunctionWrite(Expr storedValue) {
+    exists(AddressOfExpr addrParent, AtomicReadOrWriteCall fc |
+      addrParent = fc.getArgument(0) and
+      addrParent.getAnOperand() = this and
+      result = fc.getExpr() and
+      (
+        fc.getName().matches(["%store%", "%exchange%", "%fetch_%"]) and
+        not fc.getName().matches("%compare%") and
+        storedValue = fc.getArgument(1)
+        or
+        fc.getName().matches(["%compare%"]) and
+        storedValue = fc.getArgument(2)
+      )
+    )
+  }
+
+  /**
+   * Gets an assigned expr, either in the form `x = <result>` or `atomic_store(&x, <result>)`.
+   */
+  Expr getAnAssignedExpr() {
+    exists(getAtomicFunctionWrite(result))
+    or
+    exists(AssignExpr assign |
+      assign.getLValue() = this and
+      result = assign.getRValue()
+    )
+  }
+
+  /**
+   * Gets the expression holding this variable access, either in the form `x` or `atomic_read(&x)`.
+   */
+  Expr getARead() {
+    result = getAtomicFunctionRead()
+    or
+    result = this
+  }
+}
+
+from
+  AtomicAccessInFullExpressionOrdering config, FullExpr e, Variable v, AtomicVariableAccess va1,
+  AtomicVariableAccess va2, Expr va1Read, Expr va2Read
+where
+  not isExcluded(e, SideEffects3Package::unsequencedAtomicReadsQuery()) and
+  va1Read = va1.getARead() and
+  va2Read = va2.getARead() and
+  e = va1Read.(ConstituentExpr).getFullExpr() and
+  // Careful here. The `VariableAccess` in a pair of atomic function calls may not be unsequenced,
+  // for instance in gcc where atomic functions expand to StmtExprs, which have clear sequences.
+  // In this case, the result of `getARead()` for a pair of atomic function calls may be
+  // unsequenced even though the `VariableAccess`es within those calls are not.
+  config.isUnsequenced(va1Read, va2Read) and
+  v = va1.getTarget() and
+  v = va2.getTarget() and
+  // Exclude cases where the variable is assigned a value tainted by the other variable access.
+  not exists(Expr write |
+    write = va1.getAnAssignedExpr() and
+    TaintTracking::localTaint(DataFlow::exprNode(va2.getARead()), DataFlow::exprNode(write))
+  ) and
+  // Impose an ordering, show the first access.
+  va1.getLocation().isBefore(va2.getLocation(), _)
+select e, "Atomic variable $@ has a $@ that is unsequenced with $@.", v, v.getName(), va1,
+  "previous read", va2, "another read"
diff --git a/c/misra/src/rules/RULE-13-6/SizeofOperandWithSideEffect.ql b/c/misra/src/rules/RULE-13-6/SizeofOperandWithSideEffect.ql
index ec1551c2a6..759ad9b06a 100644
--- a/c/misra/src/rules/RULE-13-6/SizeofOperandWithSideEffect.ql
+++ b/c/misra/src/rules/RULE-13-6/SizeofOperandWithSideEffect.ql
@@ -9,7 +9,7 @@
  * @tags external/misra/id/rule-13-6
  *       correctness
  *       external/misra/c/2012/third-edition-first-revision
- *       external/misra/obligation/mandatory
+ *       external/misra/obligation/required
  */
 
 import cpp
diff --git a/c/misra/src/rules/RULE-14-1/LoopOverEssentiallyFloatType.ql b/c/misra/src/rules/RULE-14-1/LoopOverEssentiallyFloatType.ql
index 83d91dac63..3d351c898e 100644
--- a/c/misra/src/rules/RULE-14-1/LoopOverEssentiallyFloatType.ql
+++ b/c/misra/src/rules/RULE-14-1/LoopOverEssentiallyFloatType.ql
@@ -21,6 +21,6 @@ from ForStmt forLoop, Variable loopIterationVariable
 where
   not isExcluded(loopIterationVariable, EssentialTypesPackage::loopOverEssentiallyFloatTypeQuery()) and
   getAnIterationVariable(forLoop) = loopIterationVariable and
-  getEssentialTypeCategory(loopIterationVariable.getType()) = EssentiallyFloatingType()
+  getEssentialTypeCategory(loopIterationVariable.getType()) = EssentiallyFloatingType(_)
 select loopIterationVariable,
   "Loop iteration variable " + loopIterationVariable.getName() + " is essentially Floating type."
diff --git a/c/misra/src/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.ql b/c/misra/src/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.ql
index bb29be50ac..1a142ddb22 100644
--- a/c/misra/src/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.ql
+++ b/c/misra/src/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.ql
@@ -9,12 +9,12 @@
  * @tags external/misra/id/rule-17-5
  *       correctness
  *       external/misra/c/2012/third-edition-first-revision
- *       external/misra/obligation/advisory
+ *       external/misra/obligation/required
  */
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * Models a function parameter of type array with specified size
diff --git a/c/misra/src/rules/RULE-17-7/ValueReturnedByAFunctionNotUsed.ql b/c/misra/src/rules/RULE-17-7/ValueReturnedByAFunctionNotUsed.ql
index 42b0d7a2e2..934aeb79d3 100644
--- a/c/misra/src/rules/RULE-17-7/ValueReturnedByAFunctionNotUsed.ql
+++ b/c/misra/src/rules/RULE-17-7/ValueReturnedByAFunctionNotUsed.ql
@@ -14,7 +14,6 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.dataflow.DataFlow
 
 from Call c
 where
diff --git a/c/misra/src/rules/RULE-18-10/PointersToVariablyModifiedArrayTypesUsed.ql b/c/misra/src/rules/RULE-18-10/PointersToVariablyModifiedArrayTypesUsed.ql
index 3a99ebd842..dc1433d5e4 100644
--- a/c/misra/src/rules/RULE-18-10/PointersToVariablyModifiedArrayTypesUsed.ql
+++ b/c/misra/src/rules/RULE-18-10/PointersToVariablyModifiedArrayTypesUsed.ql
@@ -16,7 +16,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.VariablyModifiedTypes
+import codingstandards.cpp.types.VariablyModifiedTypes
 
 from VmtDeclarationEntry v, string declstr, string adjuststr, string relationstr
 where
diff --git a/c/misra/src/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.ql b/c/misra/src/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.ql
new file mode 100644
index 0000000000..6a520447d1
--- /dev/null
+++ b/c/misra/src/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.ql
@@ -0,0 +1,39 @@
+/**
+ * @id c/misra/thread-local-object-address-copied-to-global-object
+ * @name RULE-18-6: The address of an object with thread-local storage shall not be copied to a global object
+ * @description Storing the address of a thread-local object in a global object will result in
+ *              undefined behavior if the address is accessed after the relevant thread is
+ *              terminated.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-18-6
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Objects
+import codingstandards.cpp.Concurrency
+
+from AssignExpr assignment, Element threadLocal, ObjectIdentity static
+where
+  not isExcluded(assignment, Pointers1Package::threadLocalObjectAddressCopiedToGlobalObjectQuery()) and
+  assignment.getLValue() = static.getASubobjectAccess() and
+  static.getStorageDuration().isStatic() and
+  (
+    exists(ObjectIdentity threadLocalObj |
+      threadLocal = threadLocalObj and
+      assignment.getRValue() = threadLocalObj.getASubobjectAddressExpr() and
+      threadLocalObj.getStorageDuration().isThread()
+    )
+    or
+    exists(TSSGetFunctionCall getCall |
+      threadLocal = getCall.getKey() and
+      assignment.getRValue() = getCall
+    )
+  )
+select assignment, "Thread local object $@ address copied to static object $@.",
+  threadLocal.getLocation(), threadLocal.toString(), static.getLocation(), static.toString()
diff --git a/c/misra/src/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.ql b/c/misra/src/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.ql
index 5317966f3b..da73214859 100644
--- a/c/misra/src/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.ql
+++ b/c/misra/src/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.ql
@@ -15,7 +15,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.lifetimes.CLifetimes
+import codingstandards.c.Objects
 
 /**
  * Holds if the value of an expression is used or stored.
@@ -58,12 +58,10 @@ Expr temporaryObjectFlowStep(Expr e) {
   e = result.(ConditionalExpr).getElse()
 }
 
-from
-  TemporaryLifetimeArrayAccess fa, TemporaryLifetimeExpr temporary,
-  ArrayToPointerConversion conversion
+from FieldAccess fa, TemporaryObjectIdentity temporary, ArrayToPointerConversion conversion
 where
   not isExcluded(conversion, InvalidMemory3Package::arrayToPointerConversionOfTemporaryObjectQuery()) and
-  fa.getTemporary() = temporary and
+  fa = temporary.getASubobjectAccess() and
   conversion.getExpr() = fa and
   isUsedOrStored(temporaryObjectFlowStep*(conversion.getExpr()))
 select conversion, "Array to pointer conversion of array $@ from temporary object $@.",
diff --git a/c/misra/src/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.ql b/c/misra/src/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.ql
index f8a341b9bd..5ccc8316ec 100644
--- a/c/misra/src/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.ql
+++ b/c/misra/src/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.ql
@@ -15,45 +15,33 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.lifetimes.CLifetimes
+import codingstandards.c.Objects
+import codeql.util.Boolean
 
-class TemporaryLifetimeArrayExpr extends ArrayExpr {
-  TemporaryLifetimeArrayAccess member;
-  Type elementType;
-
-  TemporaryLifetimeArrayExpr() {
-    member = getArrayBase() and
-    elementType = member.getType().(ArrayType).getBaseType()
-    or
-    exists(TemporaryLifetimeArrayExpr inner |
-      inner = getArrayBase() and
-      member = inner.getMember() and
-      elementType = inner.getElementType().(ArrayType).getBaseType()
-    )
-  }
-
-  TemporaryLifetimeArrayAccess getMember() { result = member }
-
-  Type getElementType() { result = elementType }
-}
-
-predicate usedAsModifiableLvalue(Expr expr) {
+predicate usedAsModifiableLvalue(Expr expr, Boolean allowArrayAccess) {
   exists(Assignment parent | parent.getLValue() = expr)
   or
   exists(CrementOperation parent | parent.getOperand() = expr)
   or
   exists(AddressOfExpr parent | parent.getOperand() = expr)
   or
-  exists(FieldAccess parent | parent.getQualifier() = expr and usedAsModifiableLvalue(parent))
+  // Don't report `x.y[0].m[0]++` twice. Recurse with `allowArrayAccess` set to false.
+  exists(FieldAccess parent |
+    parent.getQualifier() = expr and usedAsModifiableLvalue(parent, false)
+  )
+  or
+  allowArrayAccess = true and
+  exists(ArrayExpr parent | parent.getArrayBase() = expr and usedAsModifiableLvalue(parent, true))
 }
 
-from TemporaryLifetimeArrayExpr expr, TemporaryLifetimeArrayAccess member
+from ArrayExpr expr, FieldAccess fieldAccess, TemporaryObjectIdentity tempObject
 where
   not isExcluded(expr,
     InvalidMemory3Package::modifiableLValueSubscriptedWithTemporaryLifetimeQuery()) and
-  member = expr.getMember() and
+  expr = tempObject.getASubobjectAccess() and
+  fieldAccess = expr.getArrayBase() and
   not expr.isUnevaluated() and
-  usedAsModifiableLvalue(expr)
+  usedAsModifiableLvalue(expr, true)
 select expr,
   "Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@ ",
-  member, member.getTarget().getName(), member.getTemporary(), member.getTemporary().toString()
+  fieldAccess, fieldAccess.getTarget().getName(), tempObject, tempObject.toString()
diff --git a/c/misra/src/rules/RULE-19-1/ObjectCopiedToAnOverlappingObject.ql b/c/misra/src/rules/RULE-19-1/ObjectCopiedToAnOverlappingObject.ql
index e3e85faf34..33de4f84b6 100644
--- a/c/misra/src/rules/RULE-19-1/ObjectCopiedToAnOverlappingObject.ql
+++ b/c/misra/src/rules/RULE-19-1/ObjectCopiedToAnOverlappingObject.ql
@@ -14,7 +14,6 @@
 import cpp
 import codingstandards.c.misra
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
-import codingstandards.cpp.dataflow.DataFlow
 
 /**
  * Offset in bytes of a field access
diff --git a/c/misra/src/rules/RULE-2-4/UnusedTagDeclaration.ql b/c/misra/src/rules/RULE-2-4/UnusedTagDeclaration.ql
index 08fe2568e9..9ad460068b 100644
--- a/c/misra/src/rules/RULE-2-4/UnusedTagDeclaration.ql
+++ b/c/misra/src/rules/RULE-2-4/UnusedTagDeclaration.ql
@@ -15,7 +15,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.TypeUses
+import codingstandards.cpp.types.Uses
 
 from UserType s
 where
@@ -32,5 +32,5 @@ where
   // `isInMacroExpansion` is broken for `UserType`s.
   not s.isInMacroExpansion() and
   // Exclude template parameters, in case this is run on C++ code.
-  not s instanceof TemplateParameter
+  not s instanceof TypeTemplateParameter
 select s, "struct " + s.getName() + " has an unused tag."
diff --git a/c/misra/src/rules/RULE-2-8/UnusedObjectDefinition.ql b/c/misra/src/rules/RULE-2-8/UnusedObjectDefinition.ql
new file mode 100644
index 0000000000..13355b7f74
--- /dev/null
+++ b/c/misra/src/rules/RULE-2-8/UnusedObjectDefinition.ql
@@ -0,0 +1,24 @@
+/**
+ * @id c/misra/unused-object-definition
+ * @name RULE-2-8: A project should not contain unused object definitions
+ * @description Object definitions which are unused should be removed.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity recommendation
+ * @tags external/misra/id/rule-2-8
+ *       maintainability
+ *       performance
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.deadcode.UnusedObjects
+
+from ReportDeadObject report
+where
+  not isExcluded(report.getPrimaryElement(), DeadCode2Package::unusedObjectDefinitionQuery()) and
+  not report.hasAttrUnused()
+select report.getPrimaryElement(), report.getMessage(), report.getOptionalPlaceholderLocatable(),
+  report.getOptionalPlaceholderMessage()
diff --git a/c/misra/src/rules/RULE-2-8/UnusedObjectDefinitionStrict.ql b/c/misra/src/rules/RULE-2-8/UnusedObjectDefinitionStrict.ql
new file mode 100644
index 0000000000..4eb1ad9773
--- /dev/null
+++ b/c/misra/src/rules/RULE-2-8/UnusedObjectDefinitionStrict.ql
@@ -0,0 +1,26 @@
+/**
+ * @id c/misra/unused-object-definition-strict
+ * @name RULE-2-8: A project should not contain '__attribute__((unused))' object definitions
+ * @description A strict query which reports all unused object definitions with
+ *              '__attribute__((unused))'.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity recommendation
+ * @tags external/misra/id/rule-2-8
+ *       maintainability
+ *       performance
+ *       external/misra/c/2012/amendment4
+ *       external/misra/c/strict
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.deadcode.UnusedObjects
+
+from ReportDeadObject report
+where
+  not isExcluded(report.getPrimaryElement(), DeadCode2Package::unusedObjectDefinitionStrictQuery()) and
+  report.hasAttrUnused()
+select report.getPrimaryElement(), report.getMessage(), report.getOptionalPlaceholderLocatable(),
+  report.getOptionalPlaceholderMessage()
diff --git a/c/misra/src/rules/RULE-21-11/StandardHeaderFileTgmathhUsed.ql b/c/misra/src/rules/RULE-21-11/StandardHeaderFileTgmathhUsed.ql
index 1c6b1bcd3d..50c4d48cb6 100644
--- a/c/misra/src/rules/RULE-21-11/StandardHeaderFileTgmathhUsed.ql
+++ b/c/misra/src/rules/RULE-21-11/StandardHeaderFileTgmathhUsed.ql
@@ -8,7 +8,7 @@
  * @tags external/misra/id/rule-21-11
  *       correctness
  *       external/misra/c/2012/third-edition-first-revision
- *       external/misra/obligation/required
+ *       external/misra/obligation/advisory
  */
 
 import cpp
diff --git a/c/misra/src/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.ql b/c/misra/src/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.ql
index 33da2f5d03..b8d17de8aa 100644
--- a/c/misra/src/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.ql
+++ b/c/misra/src/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.ql
@@ -18,7 +18,8 @@ import codingstandards.c.misra
 class FPExceptionHandlingFunction extends Function {
   FPExceptionHandlingFunction() {
     this.hasName([
-        "feclearexcept", "fegetexceptflag", "feraiseexcept", "fesetexceptflag", "fetestexcept"
+        "feclearexcept", "fegetexceptflag", "feraiseexcept", "fesetexceptflag", "fetestexcept",
+        "fesetenv", "feupdateenv", "fesetround"
       ]) and
     this.getFile().getBaseName() = "fenv.h"
   }
@@ -33,22 +34,30 @@ class FPExceptionHandlingMacro extends Macro {
   }
 }
 
-from Locatable call, string name, string kind
+from Locatable element, string name, string message
 where
-  not isExcluded(call, BannedPackage::exceptionHandlingFeaturesOfFenvhUsedQuery()) and
+  not isExcluded(element, BannedPackage::exceptionHandlingFeaturesOfFenvhUsedQuery()) and
   (
+    exists(Include include |
+      include.getIncludedFile().getBaseName() = "fenv.h" and
+      message = "Include of banned header" and
+      name = "fenv.h" and
+      element = include
+    )
+    or
     exists(FPExceptionHandlingFunction f |
-      call = f.getACallToThisFunction() and
+      element = f.getACallToThisFunction() and
       name = f.getName() and
-      kind = "function"
+      message = "Call to banned function"
     )
     or
     exists(FPExceptionHandlingMacro m |
-      call = m.getAnInvocation() and
+      element = m.getAnInvocation() and
       name = m.getName() and
-      kind = "macro" and
+      message = "Expansion of banned macro" and
       // Exclude macro invocations expanded from other macro invocations from macros in fenv.h.
-      not call.(MacroInvocation).getParentInvocation().getMacro().getFile().getBaseName() = "fenv.h"
+      not element.(MacroInvocation).getParentInvocation().getMacro().getFile().getBaseName() =
+        "fenv.h"
     )
   )
-select call, "Call to banned " + kind + " " + name + "."
+select element, message + " '" + name + "'."
diff --git a/c/misra/src/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.ql b/c/misra/src/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.ql
index c51ff10744..b487f5b9b5 100644
--- a/c/misra/src/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.ql
+++ b/c/misra/src/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.ql
@@ -16,7 +16,7 @@
 import cpp
 import codingstandards.c.misra
 import codingstandards.c.misra.EssentialTypes
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import NullTerminatedStringToMemcmpFlow::PathGraph
 
 // Data flow from a StringLiteral or from an array of characters, to a memcmp call
diff --git a/c/misra/src/rules/RULE-21-15/MemcpyMemmoveMemcmpArgNotPointersToCompatibleTypes.ql b/c/misra/src/rules/RULE-21-15/MemcpyMemmoveMemcmpArgNotPointersToCompatibleTypes.ql
index f5d8057b3a..28dce7b638 100644
--- a/c/misra/src/rules/RULE-21-15/MemcpyMemmoveMemcmpArgNotPointersToCompatibleTypes.ql
+++ b/c/misra/src/rules/RULE-21-15/MemcpyMemmoveMemcmpArgNotPointersToCompatibleTypes.ql
@@ -13,7 +13,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 
 class MemCmpMoveCpy extends Function {
   // Couldn't extend BuiltInFunction because it misses `memcmp`
diff --git a/c/misra/src/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.ql b/c/misra/src/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.ql
new file mode 100644
index 0000000000..fc8565ade5
--- /dev/null
+++ b/c/misra/src/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.ql
@@ -0,0 +1,52 @@
+/**
+ * @id c/misra/tg-math-argument-with-invalid-essential-type
+ * @name RULE-21-22: All operand arguments to type-generic macros in <tgmath.h> shall have an appropriate essential type
+ * @description All operand arguments to any type-generic macros in <tgmath.h> shall have an
+ *              appropriate essential type.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-21-22
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.TgMath
+import codingstandards.c.misra.EssentialTypes
+
+EssentialTypeCategory getAnAllowedEssentialTypeCategory(TgMathInvocation call) {
+  result = EssentiallySignedType()
+  or
+  result = EssentiallyUnsignedType()
+  or
+  result = EssentiallyFloatingType(Real())
+  or
+  call.allowsComplex() and
+  result = EssentiallyFloatingType(Complex())
+}
+
+string getAllowedTypesString(TgMathInvocation call) {
+  if call.allowsComplex()
+  then result = "essentially signed, unsigned, or floating type"
+  else result = "essentially signed, unsigned, or real floating type"
+}
+
+from
+  TgMathInvocation call, Expr convertedArg, Expr unconverted, int argIndex, Type type,
+  EssentialTypeCategory category
+where
+  not isExcluded(call, EssentialTypes2Package::tgMathArgumentWithInvalidEssentialTypeQuery()) and
+  // We must handle conversions specially, as clang inserts casts in the macro body we want to ignore.
+  convertedArg = call.getExplicitlyConvertedOperandArgument(argIndex) and
+  unconverted = convertedArg.getUnconverted() and
+  // Do not use `convertedArg.getEssentialType()`, as that is affected by clang's casts in the macro body.
+  type = getEssentialTypeBeforeConversions(convertedArg) and
+  category = getEssentialTypeCategory(type) and
+  not category = getAnAllowedEssentialTypeCategory(call)
+select unconverted,
+  "Argument " + (argIndex + 1) + " provided to type-generic macro '" + call.getMacroName() +
+    "' has " + category.toString().toLowerCase() + ", which is not " + getAllowedTypesString(call) +
+    "."
diff --git a/c/misra/src/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.ql b/c/misra/src/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.ql
new file mode 100644
index 0000000000..34d3b62b2c
--- /dev/null
+++ b/c/misra/src/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.ql
@@ -0,0 +1,73 @@
+/**
+ * @id c/misra/tg-math-arguments-with-differing-standard-type
+ * @name RULE-21-23: Operand arguments for an invocation of a type-generic macro shall have the same standard type
+ * @description All operand arguments to any multi-argument type-generic macros in <tgmath.h> shall
+ *              have the same standard type.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-21-23
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.TgMath
+
+string argTypesString(TgMathInvocation call, int i) {
+  exists(string typeStr |
+    typeStr = getEffectiveStandardType(call.getOperandArgument(i)).toString() and
+    (
+      i = 0 and result = typeStr
+      or
+      i > 0 and result = argTypesString(call, i - 1) + ", " + typeStr
+    )
+  )
+}
+
+/**
+ * If the range of values can be represented as a signed int, it is promoted to signed int.
+ *
+ * A value may also promote to unsigned int but only if `int` cannot represent the range of
+ * values. Which basically means only an `unsigned int` promotes to `unsigned int`, so we don't
+ * need to do anything in this case.
+ *
+ * An unsigned int bitfield with fewer than 32 bits is promoted to `int`.
+ */
+predicate promotesToSignedInt(Expr e) {
+  exists(int intBits, int intBytes |
+    intBytes = any(IntType t).getSize() and
+    intBits = intBytes * 8 and
+    (
+      e.(FieldAccess).getTarget().(BitField).getNumBits() < intBits
+      or
+      e.getUnderlyingType().(IntegralType).getSize() < intBytes
+    )
+  )
+}
+
+Type getPromotedType(Expr e) {
+  if promotesToSignedInt(e) then result.(IntType).isSigned() else result = e.getUnderlyingType()
+}
+
+Type canonicalize(Type type) {
+  if type instanceof IntegralType
+  then result = type.(IntegralType).getCanonicalArithmeticType()
+  else result = type
+}
+
+Type getEffectiveStandardType(Expr e) { result = canonicalize(getPromotedType(e)) }
+
+from TgMathInvocation call, Type firstType
+where
+  not isExcluded(call, EssentialTypes2Package::tgMathArgumentsWithDifferingStandardTypeQuery()) and
+  firstType = getEffectiveStandardType(call.getExplicitlyConvertedOperandArgument(0)) and
+  not forall(Expr arg | arg = call.getExplicitlyConvertedOperandArgument(_) |
+    firstType = getEffectiveStandardType(arg)
+  )
+select call,
+  "Call to type-generic macro '" + call.getMacroName() +
+    "' has arguments with differing standard types (" +
+    argTypesString(call, call.getNumberOfOperandArguments() - 1) + ")."
diff --git a/c/misra/src/rules/RULE-21-25/InvalidMemoryOrderArgument.ql b/c/misra/src/rules/RULE-21-25/InvalidMemoryOrderArgument.ql
new file mode 100644
index 0000000000..684b4e50cb
--- /dev/null
+++ b/c/misra/src/rules/RULE-21-25/InvalidMemoryOrderArgument.ql
@@ -0,0 +1,110 @@
+/**
+ * @id c/misra/invalid-memory-order-argument
+ * @name RULE-21-25: All memory synchronization operations shall be executed in sequentially consistent order
+ * @description Only the memory ordering of 'memory_order_seq_cst' is fully portable and consistent.
+ * @kind path-problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-21-25
+ *       external/misra/c/2012/amendment4
+ *       correctness
+ *       concurrency
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.StdFunctionOrMacro
+import semmle.code.cpp.dataflow.new.DataFlow
+
+class MemoryOrderEnum extends Enum {
+  MemoryOrderEnum() {
+    this.hasGlobalOrStdName("memory_order")
+    or
+    exists(TypedefType t |
+      t.getName() = "memory_order" and
+      t.getBaseType() = this
+    )
+  }
+}
+
+/* A member of the set of memory orders defined in the `memory_order` enum */
+class MemoryOrder extends EnumConstant {
+  MemoryOrder() { getDeclaringEnum() instanceof MemoryOrderEnum }
+
+  int getIntValue() { result = getValue().toInt() }
+}
+
+/* This is the only standardized memory order, allowed by RULE-21-25. */
+class AllowedMemoryOrder extends MemoryOrder {
+  AllowedMemoryOrder() { getName() = "memory_order_seq_cst" }
+}
+
+/* An expression referring to a memory order */
+class MemoryOrderConstantAccess extends EnumConstantAccess {
+  MemoryOrderConstantAccess() { getTarget() instanceof MemoryOrder }
+
+  predicate isAllowedOrder() { getTarget() instanceof AllowedMemoryOrder }
+}
+
+/* An expression with a constant value that equals a `MemoryOrder` constant */
+class MemoryOrderConstantExpr extends Expr {
+  MemoryOrder ord;
+
+  MemoryOrderConstantExpr() {
+    if this instanceof MemoryOrderConstantAccess
+    then ord = this.(MemoryOrderConstantAccess).getTarget()
+    else ord.getIntValue() = getValue().toInt()
+  }
+
+  /* Get the name of the `MemoryOrder` this expression is valued as. */
+  string getMemoryOrderString() { result = ord.getName() }
+}
+
+module MemoryOrderFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node node) {
+    // Direct usage of memory order constant
+    exists(MemoryOrderConstantAccess constant |
+      node.asExpr() = constant and
+      not constant.isAllowedOrder()
+    )
+    or
+    // A literal with a disallowed constant integer value
+    exists(Literal literal |
+      node.asExpr() = literal and
+      not literal.getValue().toInt() = any(AllowedMemoryOrder a).getValue().toInt()
+    )
+  }
+
+  predicate isSink(DataFlow::Node node) {
+    exists(AtomicallySequencedCall call | call.getAMemoryOrderArgument() = node.asExpr())
+  }
+}
+
+module MemoryOrderFlow = DataFlow::Global<MemoryOrderFlowConfig>;
+
+import MemoryOrderFlow::PathGraph
+
+/**
+ * If the node is a memory order constant, or shares a value with a memory order constant, then
+ * return the name of that constant. Otherwise, simply print the node.
+ */
+string describeMemoryOrderNode(DataFlow::Node node) {
+  if node.asExpr() instanceof MemoryOrderConstantExpr
+  then result = node.asExpr().(MemoryOrderConstantExpr).getMemoryOrderString()
+  else result = node.toString()
+}
+
+from
+  Expr argument, AtomicallySequencedCall function, string value, MemoryOrderFlow::PathNode source,
+  MemoryOrderFlow::PathNode sink
+where
+  not isExcluded(argument, Concurrency6Package::invalidMemoryOrderArgumentQuery()) and
+  MemoryOrderFlow::flowPath(source, sink) and
+  argument = sink.getNode().asExpr() and
+  value = describeMemoryOrderNode(source.getNode()) and
+  // Double check that we didn't find flow from something equivalent to the allowed value.
+  not value = any(AllowedMemoryOrder e).getName() and
+  function.getAMemoryOrderArgument() = argument
+select argument, source, sink, "Invalid memory order '$@' in call to function '$@'.", value, value,
+  function, function.getName()
diff --git a/c/misra/src/rules/RULE-21-26/TimedlockOnInappropriateMutexType.ql b/c/misra/src/rules/RULE-21-26/TimedlockOnInappropriateMutexType.ql
new file mode 100644
index 0000000000..929eb5bd0a
--- /dev/null
+++ b/c/misra/src/rules/RULE-21-26/TimedlockOnInappropriateMutexType.ql
@@ -0,0 +1,76 @@
+/**
+ * @id c/misra/timedlock-on-inappropriate-mutex-type
+ * @name RULE-21-26: The Standard Library function mtx_timedlock() shall only be invoked on mutexes of type mtx_timed
+ * @description The Standard Library function mtx_timedlock() shall only be invoked on mutex objects
+ *              of appropriate mutex type.
+ * @kind path-problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-21-26
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import semmle.code.cpp.dataflow.new.DataFlow
+
+class MutexTimed extends EnumConstant {
+  MutexTimed() { hasName("mtx_timed") }
+}
+
+class MutexInitCall extends FunctionCall {
+  Expr mutexExpr;
+  Expr mutexTypeExpr;
+
+  MutexInitCall() {
+    getTarget().hasName("mtx_init") and
+    mutexExpr = getArgument(0) and
+    mutexTypeExpr = getArgument(1)
+  }
+
+  predicate isTimedMutexType() {
+    exists(EnumConstantAccess baseTypeAccess |
+      (
+        baseTypeAccess = mutexTypeExpr
+        or
+        baseTypeAccess = mutexTypeExpr.(BinaryBitwiseOperation).getAnOperand()
+      ) and
+      baseTypeAccess.getTarget() instanceof MutexTimed
+    )
+    or
+    mutexTypeExpr.getValue().toInt() = any(MutexTimed m).getValue().toInt()
+  }
+
+  Expr getMutexExpr() { result = mutexExpr }
+}
+
+module MutexTimedlockFlowConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node node) {
+    exists(MutexInitCall init |
+      node.asDefiningArgument() = init.getMutexExpr() and not init.isTimedMutexType()
+    )
+  }
+
+  predicate isSink(DataFlow::Node node) {
+    exists(FunctionCall fc |
+      fc.getTarget().hasName("mtx_timedlock") and
+      node.asIndirectExpr() = fc.getArgument(0)
+    )
+  }
+}
+
+module Flow = DataFlow::Global<MutexTimedlockFlowConfig>;
+
+import Flow::PathGraph
+
+from Flow::PathNode source, Flow::PathNode sink
+where
+  not isExcluded(sink.getNode().asExpr(),
+    Concurrency7Package::timedlockOnInappropriateMutexTypeQuery()) and
+  Flow::flowPath(source, sink)
+select sink.getNode(), source, sink,
+  "Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'.", source.getNode(),
+  "initialized"
diff --git a/c/misra/src/rules/RULE-22-11/ThreadPreviouslyJoinedOrDetached.ql b/c/misra/src/rules/RULE-22-11/ThreadPreviouslyJoinedOrDetached.ql
new file mode 100644
index 0000000000..1a6476b1a7
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-11/ThreadPreviouslyJoinedOrDetached.ql
@@ -0,0 +1,24 @@
+/**
+ * @id c/misra/thread-previously-joined-or-detached
+ * @name RULE-22-11: A thread that was previously either joined or detached shall not be subsequently joined nor detached
+ * @description Joining or detaching a previously joined or detached thread can lead to undefined
+ *              program behavior.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-11
+ *       external/misra/c/2012/amendment4
+ *       correctness
+ *       concurrency
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.rules.joinordetachthreadonlyonce.JoinOrDetachThreadOnlyOnce
+
+class ThreadPreviouslyJoinedOrDetachedQuery extends JoinOrDetachThreadOnlyOnceSharedQuery {
+  ThreadPreviouslyJoinedOrDetachedQuery() {
+    this = Concurrency6Package::threadPreviouslyJoinedOrDetachedQuery()
+  }
+}
diff --git a/c/misra/src/rules/RULE-22-12/NonstandardUseOfThreadingObject.ql b/c/misra/src/rules/RULE-22-12/NonstandardUseOfThreadingObject.ql
new file mode 100644
index 0000000000..d92b4ccea6
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-12/NonstandardUseOfThreadingObject.ql
@@ -0,0 +1,54 @@
+/**
+ * @id c/misra/nonstandard-use-of-threading-object
+ * @name RULE-22-12: Standard library threading objects (mutexes, threads, etc.) shall only be accessed by the appropriate Standard Library functions
+ * @description Thread objects, thread synchronization objects, and thread-specific storage pointers
+ *              shall only be accessed by the appropriate Standard Library functions.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-12
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.Type
+
+predicate isThreadingObject(Type t) { t instanceof PossiblySpecified<C11ThreadingObjectType>::Type }
+
+predicate validUseOfStdThreadObject(Expr e) {
+  e.getParent() instanceof AddressOfExpr
+  or
+  exists(Call c |
+    c.getTarget().hasName(["tss_get", "tss_set", "tss_delete"]) and
+    e = c.getArgument(0)
+  )
+}
+
+predicate isStdThreadObjectPtr(Type t) { isThreadingObject(t.(PointerType).getBaseType()) }
+
+predicate invalidStdThreadObjectUse(Expr e) {
+  // Invalid use of mtx_t, etc.
+  isThreadingObject(e.getType()) and
+  not validUseOfStdThreadObject(e)
+  or
+  // Invalid cast from mtx_t* to void*, etc.
+  isStdThreadObjectPtr(e.getType()) and
+  exists(Cast cast |
+    cast.getExpr() = e and
+    not isStdThreadObjectPtr(cast.getType())
+  )
+}
+
+from Expr e
+where
+  not isExcluded(e, Concurrency8Package::nonstandardUseOfThreadingObjectQuery()) and
+  invalidStdThreadObjectUse(e) and
+  // Deduplicate results: (mtx = mtx) is an expression of mtx type, but don't flag the equality
+  // check, only flag the two `mtx` references.
+  not invalidStdThreadObjectUse(e.getAChild+())
+select e, "Invalid usage of standard thread object type '" + e.getType().toString() + "'."
diff --git a/c/misra/src/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.ql b/c/misra/src/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.ql
new file mode 100644
index 0000000000..066cf3c295
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.ql
@@ -0,0 +1,31 @@
+/**
+ * @id c/misra/threading-object-with-invalid-storage-duration
+ * @name RULE-22-13: Threading objects (mutexes, threads, etc). shall have not have automatic or thread storage duration
+ * @description Thread objects, thread synchronization objects, and thread specific storage pointers
+ *              shall have appropriate storage duration.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-13
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Objects
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.Type
+
+from ObjectIdentity obj, StorageDuration storageDuration, Type type
+where
+  not isExcluded(obj, Concurrency8Package::threadingObjectWithInvalidStorageDurationQuery()) and
+  storageDuration = obj.getStorageDuration() and
+  not storageDuration.isStatic() and
+  type = obj.getASubObjectType() and
+  type instanceof PossiblySpecified<C11ThreadingObjectType>::Type
+select obj,
+  "Object of type '" + obj.getType().getName() + "' has invalid storage duration type '" +
+    storageDuration.getStorageTypeName() + "'."
diff --git a/c/misra/src/rules/RULE-22-14/MutexInitWithInvalidMutexType.ql b/c/misra/src/rules/RULE-22-14/MutexInitWithInvalidMutexType.ql
new file mode 100644
index 0000000000..a122a0bec4
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-14/MutexInitWithInvalidMutexType.ql
@@ -0,0 +1,36 @@
+/**
+ * @id c/misra/mutex-init-with-invalid-mutex-type
+ * @name RULE-22-14: Mutexes shall be initialized with a valid mutex type
+ * @description Mutexes shall be initialized with a valid mutex type.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-14
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.Concurrency
+
+predicate isBaseMutexType(EnumConstantAccess access) {
+  access.getTarget().hasName(["mtx_plain", "mtx_timed"])
+}
+
+predicate isValidMutexType(Expr expr) {
+  isBaseMutexType(expr)
+  or
+  exists(BinaryBitwiseOperation binOr | binOr = expr |
+    isBaseMutexType(binOr.getLeftOperand()) and
+    binOr.getRightOperand().(EnumConstantAccess).getTarget().hasName("mtx_recursive")
+  )
+}
+
+from C11MutexSource init
+where
+  not isExcluded(init, Concurrency8Package::mutexInitWithInvalidMutexTypeQuery()) and
+  not isValidMutexType(init.getMutexTypeExpr())
+select init, "Mutex initialized with incorrect type expression."
diff --git a/c/misra/src/rules/RULE-22-14/MutexInitializedInsideThread.ql b/c/misra/src/rules/RULE-22-14/MutexInitializedInsideThread.ql
new file mode 100644
index 0000000000..497fdaf14d
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-14/MutexInitializedInsideThread.ql
@@ -0,0 +1,26 @@
+/**
+ * @id c/misra/mutex-initialized-inside-thread
+ * @name RULE-22-14: Thread synchronization objects shall be initialized deterministically
+ * @description Mutex and condition objects initialized inside of threads may result in
+ *              indeterministic state.
+ * @kind problem
+ * @precision high
+ * @problem.severity recommendation
+ * @tags external/misra/id/rule-22-14
+ *       readability
+ *       maintainability
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.Concurrency
+
+from C11MutexSource mutexCreate, ThreadedFunction thread
+where
+  not isExcluded(mutexCreate, Concurrency8Package::mutexInitializedInsideThreadQuery()) and
+  thread.calls*(mutexCreate.getEnclosingFunction())
+select mutexCreate, "Mutex initialization reachable from threaded function '$@'.", thread,
+  thread.getName()
diff --git a/c/misra/src/rules/RULE-22-14/MutexNotInitializedBeforeUse.ql b/c/misra/src/rules/RULE-22-14/MutexNotInitializedBeforeUse.ql
new file mode 100644
index 0000000000..f78c25f981
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-14/MutexNotInitializedBeforeUse.ql
@@ -0,0 +1,78 @@
+/**
+ * @id c/misra/mutex-not-initialized-before-use
+ * @name RULE-22-14: Thread synchronization objects shall be initialized before being accessed
+ * @description Mutex and condition objects shall be initialized with the standard library functions
+ *              before using them.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-14
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Objects
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.Type
+import codingstandards.c.initialization.GlobalInitializationAnalysis
+
+module MutexInitializationConfig implements GlobalInitializationAnalysisConfigSig {
+  ObjectIdentity getAnInitializedObject(Expr e) {
+    e.(C11MutexSource).getMutexExpr() = result.getASubobjectAddressExpr()
+  }
+
+  ObjectIdentity getAUsedObject(Expr e) {
+    result.getASubobjectAddressExpr() = e and
+    (
+      exists(CMutexFunctionCall mutexUse | e = mutexUse.getLockExpr())
+      or
+      exists(CConditionOperation condOp | e = condOp.getMutexExpr())
+    )
+  }
+}
+
+module ConditionInitializationConfig implements GlobalInitializationAnalysisConfigSig {
+  ObjectIdentity getAnInitializedObject(Expr e) {
+    exists(CConditionOperation condOp |
+      e = condOp and
+      condOp.isInit() and
+      condOp.getConditionExpr() = result.getASubobjectAddressExpr()
+    )
+  }
+
+  ObjectIdentity getAUsedObject(Expr e) {
+    result.getASubobjectAddressExpr() = e and
+    exists(CConditionOperation condOp |
+      condOp.isUse() and
+      e = condOp.getConditionExpr()
+    )
+  }
+}
+
+import GlobalInitalizationAnalysis<MutexInitializationConfig> as MutexInitAnalysis
+import GlobalInitalizationAnalysis<ConditionInitializationConfig> as CondInitAnalysis
+
+from Expr objUse, ObjectIdentity obj, Function callRoot, string typeString, string description
+where
+  not isExcluded(objUse, Concurrency8Package::mutexNotInitializedBeforeUseQuery()) and
+  (
+    MutexInitAnalysis::uninitializedFrom(objUse, obj, callRoot) and
+    typeString = "Mutex"
+    or
+    CondInitAnalysis::uninitializedFrom(objUse, obj, callRoot) and
+    typeString = "Condition"
+  ) and
+  (
+    if
+      obj.getType() instanceof PossiblySpecified<C11MutexType>::Type or
+      obj.getType() instanceof PossiblySpecified<C11ConditionType>::Type
+    then description = typeString
+    else description = typeString + " in object"
+  )
+select objUse,
+  description + " '$@' possibly used before initialization, from entry point function '$@'.", obj,
+  obj.toString(), callRoot, callRoot.getName()
diff --git a/c/misra/src/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.ql b/c/misra/src/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.ql
new file mode 100644
index 0000000000..ec4631ef1b
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.ql
@@ -0,0 +1,113 @@
+/**
+ * @id c/misra/thread-resource-disposed-before-threads-joined
+ * @name RULE-22-15: Thread synchronization objects and thread-specific storage pointers shall not be disposed unsafely
+ * @description Thread synchronization objects and thread-specific storage pointers shall not be
+ *              destroyed until after all threads accessing them have terminated.
+ * @kind problem
+ * @precision medium
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-15
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.SubObjects
+import codingstandards.cpp.Concurrency
+
+newtype TThreadKind =
+  TSpawned(C11ThreadCreateCall tcc) or
+  TMainThread()
+
+TThreadKind getThreadKind(FunctionCall operation) {
+  if
+    not exists(C11ThreadCreateCall tcc |
+      getAThreadContextAwareSuccessor(tcc.getFunction().getEntryPoint()) = operation
+    )
+  then result = TMainThread()
+  else
+    exists(C11ThreadCreateCall tcc |
+      getAThreadContextAwareSuccessor(tcc.getFunction().getEntryPoint()) = operation and
+      result = TSpawned(tcc)
+    )
+}
+
+bindingset[tcc, thread]
+predicate followsMainThreadTcc(C11ThreadCreateCall tcc, TThreadKind thread) {
+  thread = TMainThread()
+  or
+  exists(C11ThreadCreateCall tcc2 |
+    getAThreadContextAwareSuccessor(tcc) = tcc2 and
+    thread = TSpawned(tcc2)
+  )
+}
+
+string describeThread(TThreadKind thread) {
+  thread = TMainThread() and
+  result = "main thread"
+  or
+  exists(C11ThreadCreateCall tcc2 |
+    thread = TSpawned(tcc2) and
+    result = tcc2.getFunction().getName()
+  )
+}
+
+bindingset[alternative]
+Element elementOr(TThreadKind thread, Element alternative) {
+  thread = TMainThread() and
+  result = alternative
+  or
+  exists(C11ThreadCreateCall tcc2 |
+    thread = TSpawned(tcc2) and
+    result = tcc2
+  )
+}
+
+from
+  FunctionCall dispose, FunctionCall use, C11ThreadCreateCall tcc, TThreadKind disposeThread,
+  TThreadKind useThread, SubObject usedAndDestroyed
+where
+  not isExcluded(dispose, Concurrency9Package::threadResourceDisposedBeforeThreadsJoinedQuery()) and
+  // `tcc` may be the thread that uses the resource, or the thread that disposes it. What matters
+  // for the query is that `tcc` is before the use and the dispose.
+  dispose = getAThreadContextAwareSuccessor(tcc) and
+  (
+    // Lock and dispose of mtx_t:
+    exists(CMutexFunctionCall mfc, C11MutexDestroyer md | dispose = md and use = mfc |
+      mfc = getAThreadContextAwareSuccessor(tcc) and
+      mfc.getLockExpr() = usedAndDestroyed.getAnAddressOfExpr() and
+      md.getMutexExpr() = usedAndDestroyed.getAnAddressOfExpr()
+    )
+    or
+    // Read/store and dispose of tss_t:
+    exists(ThreadSpecificStorageFunctionCall tssfc, TSSDeleteFunctionCall td |
+      dispose = td and use = tssfc
+    |
+      tssfc = getAThreadContextAwareSuccessor(tcc) and
+      tssfc.getKey() = usedAndDestroyed.getAnAddressOfExpr() and
+      td.getKey() = usedAndDestroyed.getAnAddressOfExpr()
+    )
+    or
+    // Wait and dispose of cnd_t:
+    exists(CConditionOperation cndop, C11ConditionDestroyer cd | dispose = cd and use = cndop |
+      cndop = getAThreadContextAwareSuccessor(tcc) and
+      cndop.getConditionExpr() = usedAndDestroyed.getAnAddressOfExpr() and
+      cd.getConditionExpr() = usedAndDestroyed.getAnAddressOfExpr()
+    )
+  ) and
+  // Dispose could be in the main thread or in a spawned thread.
+  disposeThread = getThreadKind(dispose) and
+  // Dispose could be in the main thread or in a spawned thread.
+  useThread = getThreadKind(use) and
+  // Exclude a thread that does not concurrently share the resource it disposed (unlikely).
+  not useThread = disposeThread and
+  followsMainThreadTcc(tcc, useThread) and
+  followsMainThreadTcc(tcc, disposeThread) and
+  // If there is a join between the use and the dispose, the code is compliant.
+  not getAThreadContextAwarePredecessor(elementOr(useThread, use), dispose) instanceof C11ThreadWait
+select dispose, "Thread resource $@ disposed before joining thread $@ which uses it.",
+  usedAndDestroyed.getRootIdentity(), usedAndDestroyed.toString(), elementOr(useThread, use),
+  describeThread(useThread)
diff --git a/c/misra/src/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.ql b/c/misra/src/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.ql
new file mode 100644
index 0000000000..c86c9b9d9d
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.ql
@@ -0,0 +1,52 @@
+/**
+ * @id c/misra/mutex-objects-not-always-unlocked
+ * @name RULE-22-16: All mutex objects locked by a thread shall be explicitly unlocked by the same thread
+ * @description Mutex not unlocked by thread on all execution paths in current thread after being
+ *              locked.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-16
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.resources.ResourceLeakAnalysis
+
+module MutexLeakConfig implements ResourceLeakConfigSig {
+  predicate isAllocate(ControlFlowNode allocPoint, DataFlow::Node node) {
+    exists(MutexFunctionCall lock |
+      allocPoint = lock and
+      lock.isLock() and
+      node.asDefiningArgument() = lock.getLockExpr()
+    )
+  }
+
+  predicate isFree(ControlFlowNode node, DataFlow::Node resource) {
+    exists(MutexFunctionCall mfc |
+      node = mfc and
+      mfc.isUnlock() and
+      mfc.getLockExpr() = resource.asExpr()
+    )
+  }
+}
+
+string describeMutex(Expr mutexExpr) {
+  if mutexExpr instanceof AddressOfExpr
+  then result = mutexExpr.(AddressOfExpr).getOperand().toString()
+  else result = mutexExpr.toString()
+}
+
+from MutexFunctionCall lockCall, string mutexDescription
+where
+  not isExcluded(lockCall, Concurrency8Package::mutexObjectsNotAlwaysUnlockedQuery()) and
+  //lockCall.getLockExpr() = mutexNode.asDefiningArgument() and
+  exists(ResourceLeak<MutexLeakConfig>::getALeak(lockCall)) and
+  mutexDescription = describeMutex(lockCall.getLockExpr())
+select lockCall,
+  "Mutex '" + mutexDescription + "' is locked here and may not always be subsequently unlocked."
diff --git a/c/misra/src/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.ql b/c/misra/src/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.ql
new file mode 100644
index 0000000000..d85183a831
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.ql
@@ -0,0 +1,67 @@
+/**
+ * @id c/misra/invalid-operation-on-unlocked-mutex
+ * @name RULE-22-17: No thread shall unlock a mutex or call cnd_wait() or cnd_timedwait() for a mutex it has not locked
+ * @description No thread shall unlock a mutex or call cnd_wait() or cnd_timedwait() for a mutex it
+ *              has not locked before.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-17
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.SubObjects
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.dominance.BehavioralSet
+
+/* A call to mtx_unlock() or cnd_wait() or cnd_timedwait(), which require a locked mutex */
+class RequiresLockOperation extends FunctionCall {
+  SubObject mutex;
+
+  RequiresLockOperation() {
+    exists(CMutexFunctionCall mutexCall | this = mutexCall |
+      mutexCall.isUnlock() and
+      mutex.getAnAddressOfExpr() = mutexCall.getLockExpr()
+    )
+    or
+    exists(CConditionOperation condOp | this = condOp |
+      mutex.getAnAddressOfExpr() = condOp.getMutexExpr()
+    )
+  }
+
+  SubObject getMutex() { result = mutex }
+}
+
+/* A config to search for a dominating set that locks the mutex before the operation */
+module LockDominatingSetConfig implements DominatingSetConfigSig<RequiresLockOperation> {
+  predicate isTargetBehavior(ControlFlowNode node, RequiresLockOperation op) {
+    exists(CMutexFunctionCall mutexCall | node = mutexCall |
+      mutexCall.isLock() and
+      mutexCall.getLockExpr() = op.getMutex().getAnAddressOfExpr()
+    )
+  }
+
+  predicate isBlockingBehavior(ControlFlowNode node, RequiresLockOperation op) {
+    // If we find a branch that explicitly unlocks the mutex, we should not look for an earlier
+    // call to lock that mutex.
+    exists(CMutexFunctionCall mutexCall | node = mutexCall |
+      mutexCall.isUnlock() and
+      mutexCall.getLockExpr() = op.getMutex().getAnAddressOfExpr()
+    )
+  }
+}
+
+import DominatingBehavioralSet<RequiresLockOperation, LockDominatingSetConfig> as DominatingSet
+
+from RequiresLockOperation operation, SubObject mutex
+where
+  not isExcluded(operation, Concurrency9Package::invalidOperationOnUnlockedMutexQuery()) and
+  mutex = operation.getMutex() and
+  not DominatingSet::isDominatedByBehavior(operation)
+select operation, "Invalid operation on mutex '$@' not locked by the current thread.",
+  mutex.getRootIdentity(), mutex.toString()
diff --git a/c/misra/src/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.ql b/c/misra/src/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.ql
new file mode 100644
index 0000000000..17762b3eee
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.ql
@@ -0,0 +1,37 @@
+/**
+ * @id c/misra/non-recursive-mutex-recursively-locked
+ * @name RULE-22-18: Non-recursive mutexes shall not be recursively locked
+ * @description Mutexes initialized with mtx_init() without mtx_recursive shall not be locked by a
+ *              thread that has previously locked it.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-18
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.SubObjects
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.Type
+
+from
+  LockProtectedControlFlowNode n, CMutexFunctionCall lockCall, SubObject mutex,
+  CMutexFunctionCall coveredByLock
+where
+  not isExcluded(n, Concurrency9Package::nonRecursiveMutexRecursivelyLockedQuery()) and
+  lockCall = n and
+  coveredByLock = n.coveredByLock() and
+  not coveredByLock = lockCall and
+  mutex.isPrecise() and
+  coveredByLock.getLockExpr() = mutex.getAnAddressOfExpr() and
+  lockCall.getLockExpr() = mutex.getAnAddressOfExpr() and
+  forex(C11MutexSource init | init.getMutexExpr() = mutex.getAnAddressOfExpr() |
+    not init.isRecursive()
+  )
+select n, "Non-recursive mutex " + mutex.toString() + " locked after it is $@.", coveredByLock,
+  "already locked"
diff --git a/c/misra/src/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.ql b/c/misra/src/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.ql
new file mode 100644
index 0000000000..7e002585b6
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.ql
@@ -0,0 +1,60 @@
+/**
+ * @id c/misra/non-recursive-mutex-recursively-locked-audit
+ * @name RULE-22-18: (Audit) Non-recursive mutexes shall not be recursively locked
+ * @description Mutexes that may be initialized without mtx_recursive shall not be locked by a
+ *              thread that may have previously locked it.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-18
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/audit
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codeql.util.Boolean
+import codingstandards.c.misra
+import codingstandards.c.SubObjects
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.Type
+
+predicate isTrackableMutex(CMutexFunctionCall lockCall, Boolean recursive) {
+  exists(SubObject mutex |
+    lockCall.getLockExpr() = mutex.getAnAddressOfExpr() and
+    mutex.isPrecise() and
+    forex(C11MutexSource init | init.getMutexExpr() = mutex.getAnAddressOfExpr() |
+      if init.isRecursive() then recursive = true else recursive = false
+    )
+  )
+}
+
+predicate definitelyDifferentMutexes(CMutexFunctionCall lockCall, CMutexFunctionCall coveredByLock) {
+  exists(SubObject a, SubObject b |
+    lockCall.getLockExpr() = a.getAnAddressOfExpr() and
+    coveredByLock.getLockExpr() = b.getAnAddressOfExpr() and
+    not a = b
+  )
+}
+
+from LockProtectedControlFlowNode n, CMutexFunctionCall lockCall, CMutexFunctionCall coveredByLock
+where
+  not isExcluded(n, Concurrency9Package::nonRecursiveMutexRecursivelyLockedAuditQuery()) and
+  lockCall = n and
+  coveredByLock = n.coveredByLock() and
+  not coveredByLock = lockCall and
+  // If mutexes are provably different objects, they do not need to be audited
+  not definitelyDifferentMutexes(lockCall, coveredByLock) and
+  (
+    // If either mutex is not trackable, it should be audited
+    not isTrackableMutex(lockCall, _) or
+    not isTrackableMutex(coveredByLock, _)
+  ) and
+  not (
+    // If either mutex is definitely recursive, it does not need to be audited
+    isTrackableMutex(lockCall, true) or
+    isTrackableMutex(coveredByLock, true)
+  )
+select n, "Mutex locked after it was already $@.", coveredByLock, "previously locked"
diff --git a/c/misra/src/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.ql b/c/misra/src/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.ql
new file mode 100644
index 0000000000..0d5aa5399f
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.ql
@@ -0,0 +1,69 @@
+/**
+ * @id c/misra/condition-variable-used-with-multiple-mutexes
+ * @name RULE-22-19: A condition variable shall be associated with at most one mutex object
+ * @description Standard library functions cnd_wait() and cnd_timedwait() shall specify the same
+ *              mutex object for each condition object in all calls.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-19
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.SubObjects
+import codingstandards.cpp.Concurrency
+
+bindingset[cond, mutex]
+int countMutexesForConditionVariable(SubObject cond, SubObject mutex) {
+  result =
+    count(CConditionOperation call |
+      call.getConditionExpr() = cond.getAnAddressOfExpr() and
+      call.getMutexExpr() = mutex.getAnAddressOfExpr()
+    )
+}
+
+bindingset[cond, mutex]
+predicate conditionVariableUsesMutex(SubObject cond, SubObject mutex) {
+  countMutexesForConditionVariable(cond, mutex) > 0
+}
+
+bindingset[cond, n]
+SubObject nthMutexForConditionVariable(SubObject cond, int n) {
+  result =
+    rank[n](SubObject mutex |
+      conditionVariableUsesMutex(cond, mutex)
+    |
+      mutex order by countMutexesForConditionVariable(cond, mutex), mutex.toString()
+    )
+}
+
+bindingset[cond, mutex]
+CConditionOperation firstCallForConditionMutex(SubObject cond, SubObject mutex) {
+  result =
+    rank[1](CConditionOperation call |
+      call.getConditionExpr() = cond.getAnAddressOfExpr() and
+      call.getMutexExpr() = mutex.getAnAddressOfExpr()
+    |
+      call order by call.getFile().getAbsolutePath(), call.getLocation().getStartLine()
+    )
+}
+
+from
+  SubObject cond, CConditionOperation useOne, SubObject mutexOne, CConditionOperation useTwo,
+  SubObject mutexTwo
+where
+  not isExcluded(cond.getRootIdentity(),
+    Concurrency9Package::conditionVariableUsedWithMultipleMutexesQuery()) and
+  mutexOne = nthMutexForConditionVariable(cond, 1) and
+  mutexTwo = nthMutexForConditionVariable(cond, 2) and
+  useOne = firstCallForConditionMutex(cond, mutexOne) and
+  useTwo = firstCallForConditionMutex(cond, mutexOne)
+select useOne,
+  "Condition variable $@ associated with multiple mutexes, operation uses mutex $@ while $@ uses other mutex $@.",
+  cond.getRootIdentity(), cond.toString(), mutexOne.getRootIdentity(), mutexOne.toString(), useTwo,
+  "another operation", mutexTwo.getRootIdentity(), mutexTwo.toString()
diff --git a/c/misra/src/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.ql b/c/misra/src/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.ql
new file mode 100644
index 0000000000..1edf4aa9c3
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.ql
@@ -0,0 +1,44 @@
+/**
+ * @id c/misra/thread-storage-not-initialized-before-use
+ * @name RULE-22-20: Thread-specific storage pointers shall be created before being accessed
+ * @description Thread specific storage pointers shall be initialized with the standard library
+ *              functions before using them.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-22-20
+ *       correctness
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Objects
+import codingstandards.cpp.Concurrency
+import codingstandards.cpp.Type
+import codingstandards.c.initialization.GlobalInitializationAnalysis
+
+module ThreadStoreInitializationConfig implements GlobalInitializationAnalysisConfigSig {
+  ObjectIdentity getAnInitializedObject(Expr e) {
+    e.(TSSCreateFunctionCall).getKey() = result.getASubobjectAddressExpr()
+  }
+
+  ObjectIdentity getAUsedObject(Expr e) {
+    result.getASubobjectAddressExpr() = e and
+    exists(ThreadSpecificStorageFunctionCall use |
+      not use instanceof TSSCreateFunctionCall and e = use.getKey()
+    )
+  }
+}
+
+import GlobalInitalizationAnalysis<ThreadStoreInitializationConfig> as InitAnalysis
+
+from Expr objUse, ObjectIdentity obj, Function callRoot
+where
+  not isExcluded(objUse, Concurrency9Package::threadStorageNotInitializedBeforeUseQuery()) and
+  InitAnalysis::uninitializedFrom(objUse, obj, callRoot)
+select objUse,
+  "Thread specific storage pointer '$@' used before initialization from entry point function '$@'.",
+  obj, obj.toString(), callRoot, callRoot.getName()
diff --git a/c/misra/src/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.ql b/c/misra/src/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.ql
new file mode 100644
index 0000000000..3c40ea7116
--- /dev/null
+++ b/c/misra/src/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.ql
@@ -0,0 +1,27 @@
+/**
+ * @id c/misra/thread-storage-pointer-initialized-inside-thread
+ * @name RULE-22-20: Thread specific storage pointers shall be initialized deterministically
+ * @description Thread specific storage pointers initialized inside of threads may result in
+ *              indeterministic state.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity recommendation
+ * @tags external/misra/id/rule-22-20
+ *       readability
+ *       maintainability
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.Concurrency
+
+from TSSCreateFunctionCall tssCreate, ThreadedFunction thread
+where
+  not isExcluded(tssCreate, Concurrency8Package::mutexInitializedInsideThreadQuery()) and
+  thread.calls*(tssCreate.getEnclosingFunction())
+select tssCreate,
+  "Thread specific storage object initialization reachable from threaded function '$@'.", thread,
+  thread.getName()
diff --git a/c/misra/src/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.ql b/c/misra/src/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.ql
index ee103ca6dc..642813bbab 100644
--- a/c/misra/src/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.ql
+++ b/c/misra/src/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.ql
@@ -15,7 +15,7 @@
 import cpp
 import codingstandards.c.misra
 import codingstandards.cpp.standardlibrary.FileAccess
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import semmle.code.cpp.controlflow.SubBasicBlocks
 
diff --git a/c/misra/src/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.ql b/c/misra/src/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.ql
index 19bad99baa..2439d4ca47 100644
--- a/c/misra/src/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.ql
+++ b/c/misra/src/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.ql
@@ -14,7 +14,7 @@
 import cpp
 import codingstandards.c.misra
 import codingstandards.cpp.standardlibrary.FileAccess
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 module FileDFConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) {
diff --git a/c/misra/src/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.ql b/c/misra/src/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.ql
index a29ee7c898..1da495ca28 100644
--- a/c/misra/src/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.ql
+++ b/c/misra/src/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.ql
@@ -15,6 +15,7 @@
 import cpp
 import codingstandards.c.misra
 import codingstandards.cpp.ReadErrorsAndEOF
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * The getchar() return value propagates directly to a check against EOF macro
diff --git a/c/misra/src/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.ql b/c/misra/src/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.ql
new file mode 100644
index 0000000000..1a76339f50
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.ql
@@ -0,0 +1,27 @@
+/**
+ * @id c/misra/generic-selection-doesnt-depend-on-macro-argument
+ * @name RULE-23-1: A generic selection should depend on the type of a macro argument
+ * @description A generic selection should depend on the type of a macro argument.
+ * @kind problem
+ * @precision high
+ * @problem.severity warning
+ * @tags external/misra/id/rule-23-1
+ *       correctness
+ *       maintainability
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Generic
+
+from ParsedGenericMacro macro, string ctrlExpr
+where
+  not isExcluded(macro, GenericsPackage::genericSelectionDoesntDependOnMacroArgumentQuery()) and
+  ctrlExpr = macro.getControllingExprString() and
+  // No parameter exists that is expanded in the controlling expression one or more times
+  not exists(string parameter | macro.expansionsInsideControllingExpr(parameter) > 0)
+select macro,
+  "Generic macro " + macro.getName() + " doesn't refer to a macro parameter in controlling expr '" +
+    ctrlExpr + "'."
diff --git a/c/misra/src/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.ql b/c/misra/src/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.ql
new file mode 100644
index 0000000000..603c44e8e1
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.ql
@@ -0,0 +1,23 @@
+/**
+ * @id c/misra/generic-selection-not-expanded-from-a-macro
+ * @name RULE-23-1: A generic selection should only be expanded from a macro
+ * @description A generic selection should only be expanded from a macro.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity warning
+ * @tags external/misra/id/rule-23-1
+ *       maintainability
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.c.misra
+
+from C11GenericExpr generic, Expr ctrlExpr
+where
+  not isExcluded(generic, GenericsPackage::genericSelectionNotExpandedFromAMacroQuery()) and
+  ctrlExpr = generic.getControllingExpr() and
+  not exists(MacroInvocation mi | mi.getAGeneratedElement() = generic.getExpr())
+select generic, "$@ in generic expression does not expand a macro parameter.", ctrlExpr,
+  "Controlling expression"
diff --git a/c/misra/src/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.ql b/c/misra/src/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.ql
new file mode 100644
index 0000000000..d7fcb13d76
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.ql
@@ -0,0 +1,88 @@
+/**
+ * @id c/misra/generic-selection-not-from-macro-with-side-effects
+ * @name RULE-23-2: A generic selection shall not contain side-effects if it is not expanded from a macro
+ * @description A generic selection that is not expanded from a macro shall not contain potential
+ *              side effects in the controlling expression.
+ * @kind problem
+ * @precision high
+ * @problem.severity warning
+ * @tags external/misra/id/rule-23-2
+ *       maintainability
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Generic
+import codingstandards.cpp.SideEffect
+import codingstandards.cpp.sideeffect.DefaultEffects
+import codingstandards.cpp.alertreporting.DeduplicateMacroResults
+
+class GenericWithNonMacroSideEffect extends C11GenericExpr {
+  SideEffect sideEffect;
+
+  GenericWithNonMacroSideEffect() {
+    not exists(MacroInvocation mi |
+      mi.getAGeneratedElement() = getExpr() and
+      mi.getMacro().(GenericMacro).hasControllingExprFromMacroParameter()
+    ) and
+    sideEffect = getASideEffect(getControllingExpr())
+  }
+
+  SideEffect getASideEffect() { result = sideEffect }
+}
+
+module GenericSideEffectConfig implements DeduplicateMacroConfigSig<GenericWithNonMacroSideEffect> {
+  string describe(GenericWithNonMacroSideEffect e) {
+    result = "side effect '" + e.getASideEffect() + "'"
+  }
+}
+
+module GenericSideEffectReportConfig implements MacroReportConfigSig<GenericWithNonMacroSideEffect> {
+  /* Create a message to describe this macro, with a string describing its `ResultElement`. */
+  bindingset[description]
+  string getMessageSameResultInAllExpansions(Macro m, string description) {
+    result =
+      "Generic selection macro " + m.getName() + " contains a " + description +
+        ", which is not from macro invocation arguments."
+  }
+
+  /* Create a message to describe this macro, using '$@' to describe an example `ResultElement`. */
+  string getMessageVariedResultInAllExpansions(Macro m) {
+    result =
+      "Generic selection in macro " + m.getName() +
+        " contains an invocation-dependent side effect which is not from macro invocation arguments, for example $@."
+  }
+
+  /**
+   * Create a message to describe this macro expansion which produces a `ResultElement`, using '$@'
+   * to describe the relevant macro.
+   */
+  string getMessageResultInIsolatedExpansion(GenericWithNonMacroSideEffect element) {
+    // A result in an isolated expansion indicates that the side effect is not always present when
+    // macro is expanded, and therefore the side-effect is not in the macro definition but rather
+    // originates in one of the macro arguments.
+    none()
+  }
+
+  /**
+   * Create a message to describe a `ResultElement` which is not generated by a macro expansion.
+   */
+  string getMessageNotInMacro(
+    GenericWithNonMacroSideEffect element, Locatable optLoc1, string optStr1
+  ) {
+    // Generics which are not expanded from a macro aren't applicable to this rule.
+    none()
+  }
+}
+
+import DeduplicateMacroResults<GenericWithNonMacroSideEffect, GenericSideEffectConfig> as Deduplicate
+import Deduplicate::Report<GenericSideEffectReportConfig> as Report
+
+from Report::ReportResult res
+where
+  not isExcluded(res.getPrimaryElement(),
+    GenericsPackage::genericSelectionNotFromMacroWithSideEffectsQuery())
+select res.getPrimaryElement(), res.getMessage(), res.getOptionalPlaceholderLocatable(),
+  res.getOptionalPlaceholderMessage()
diff --git a/c/misra/src/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.ql b/c/misra/src/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.ql
new file mode 100644
index 0000000000..dc4ab081d3
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.ql
@@ -0,0 +1,36 @@
+/**
+ * @id c/misra/generic-without-non-default-association
+ * @name RULE-23-3: A generic selection should contain at least one non-default association
+ * @description A generic selection should contain at least one non-default association.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity warning
+ * @tags external/misra/id/rule-23-3
+ *       correctness
+ *       maintainability
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.AlertReporting
+
+class InvalidGeneric extends C11GenericExpr {
+  InvalidGeneric() {
+    not exists(Type t |
+      t = getAnAssociationType() and
+      not t instanceof VoidType
+    )
+  }
+}
+
+from InvalidGeneric generic, Element primaryElement
+where
+  not isExcluded(primaryElement, GenericsPackage::genericWithoutNonDefaultAssociationQuery()) and
+  not exists(Type t |
+    t = generic.getAnAssociationType() and
+    not t instanceof VoidType
+  ) and
+  primaryElement = MacroUnwrapper<InvalidGeneric>::unwrapElement(generic)
+select primaryElement, "Generic selection contains no non-default association."
diff --git a/c/misra/src/rules/RULE-23-4/GenericAssociationWithUnselectableType.ql b/c/misra/src/rules/RULE-23-4/GenericAssociationWithUnselectableType.ql
new file mode 100644
index 0000000000..2d707548fa
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-4/GenericAssociationWithUnselectableType.ql
@@ -0,0 +1,111 @@
+/**
+ * @id c/misra/generic-association-with-unselectable-type
+ * @name RULE-23-4: A generic association shall list an appropriate type
+ * @description Generic selections undergo lvalue conversion before type comparison, leading to
+ *              certain types being impossible to select.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity error
+ * @tags external/misra/id/rule-23-4
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.types.LvalueConversion
+import codingstandards.cpp.types.Graph
+import codingstandards.cpp.alertreporting.DeduplicateMacroResults
+
+/**
+ * Check if a type contains an unmatchable anonymous struct or union.
+ *
+ * Anonymous structs and unions are only equal to themselves. So any anonymous struct, or compound
+ * type containing an anonymous struct, is unmatchable.
+ *
+ * However, there is an exception if the anonymous struct is behind a typedef. All uses of that
+ * typedef will resolve to the same anonymous struct, and so the typedef is matchable.
+ */
+predicate containsAnonymousType(Type t) {
+  t.(Struct).isAnonymous()
+  or
+  not t instanceof TypedefType and
+  exists(Type next | typeGraph(t, next) | containsAnonymousType(next))
+}
+
+predicate invalidType(Type t, string reason) {
+  containsAnonymousType(t) and
+  reason = "containing an anonymous struct or union type"
+  or
+  exists(performLvalueConversion(t, reason))
+}
+
+class InvalidSelection extends Expr {
+  Type selectionType;
+  int idx;
+  C11GenericExpr generic;
+  string reason;
+
+  InvalidSelection() {
+    this = generic.getAssociationExpr(idx) and
+    selectionType = generic.getAssociationType(idx) and
+    invalidType(selectionType, reason)
+  }
+
+  Type getSelectionType() { result = selectionType }
+
+  string getReason() { result = reason }
+}
+
+module InvalidSelectionConfig implements DeduplicateMacroConfigSig<InvalidSelection> {
+  string describe(InvalidSelection e) {
+    result = "'" + e.getSelectionType().toString() + "', due to " + e.getReason()
+  }
+}
+
+import InvalidSelectionConfig
+
+module InvalidSelectionReportConfig implements MacroReportConfigSig<InvalidSelection> {
+  /* Create a message to describe this macro, with a string describing its `ResultElement`. */
+  bindingset[description]
+  string getMessageSameResultInAllExpansions(Macro m, string description) {
+    result = "Generic in macro " + m.getName() + " has unselectable type " + description + "."
+  }
+
+  /* Create a message to describe this macro, using '$@' to describe an example `ResultElement`. */
+  string getMessageVariedResultInAllExpansions(Macro m) {
+    result =
+      "Generic in macro " + m.getName() +
+        " has an invocation-dependent unselectable type, for example $@."
+  }
+
+  /**
+   * Create a message to describe this macro expansion which produces a `ResultElement`, using '$@'
+   * to describe the relevant macro.
+   */
+  string getMessageResultInIsolatedExpansion(InvalidSelection element) {
+    result =
+      "Generic resulting from invocation of macro $@ contains an unselectable type " +
+        describe(element) + "."
+  }
+
+  /**
+   * Create a message to describe a `ResultElement` which is not generated by a macro expansion.
+   */
+  string getMessageNotInMacro(InvalidSelection element, Locatable optLoc1, string optStr1) {
+    result = "Generic selection uses unselectable type " + describe(element) + "'." and
+    optLoc1 = element and
+    optStr1 = "side effect"
+  }
+}
+
+import DeduplicateMacroResults<InvalidSelection, InvalidSelectionConfig> as Deduplicate
+import Deduplicate::Report<InvalidSelectionReportConfig> as Report
+
+from Report::ReportResult res
+where
+  not isExcluded(res.getPrimaryElement(),
+    GenericsPackage::genericSelectionNotFromMacroWithSideEffectsQuery())
+select res.getPrimaryElement(), res.getMessage(), res.getOptionalPlaceholderLocatable(),
+  res.getOptionalPlaceholderMessage()
diff --git a/c/misra/src/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.ql b/c/misra/src/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.ql
new file mode 100644
index 0000000000..f2961e2638
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.ql
@@ -0,0 +1,74 @@
+/**
+ * @id c/misra/dangerous-default-selection-for-pointer-in-generic
+ * @name RULE-23-5: A generic selection should not depend on implicit pointer type conversion
+ * @description Pointer types in a generic selection do not undergo pointer conversions and should
+ *              not counterintuitively fall through to the default association.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity warning
+ * @tags external/misra/id/rule-23-5
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.AlertReporting
+import codingstandards.cpp.types.Compatible
+import codingstandards.cpp.types.LvalueConversion
+import codingstandards.cpp.types.SimpleAssignment
+
+predicate typesCompatible(Type t1, Type t2) {
+  TypeEquivalence<TypesCompatibleConfig, relevantTypes/2>::equalTypes(t1, t2)
+}
+
+predicate relevantTypes(Type a, Type b) {
+  exists(C11GenericExpr g |
+    a = g.getAnAssociationType() and
+    b = getLvalueConverted(g.getControllingExpr().getFullyConverted().getType())
+  )
+}
+
+predicate missesOnPointerConversion(Type provided, Type expected) {
+  // The provided type is not compatible with the expected type:
+  not typesCompatible(provided, expected) and
+  // But 6.5.16.1 simple assignment constraints would have been satisfied:
+  (
+    // Check as if the controlling expr is assigned to the expected type:
+    SimpleAssignment<relevantTypes/2>::satisfiesSimplePointerAssignment(expected, provided)
+    or
+    // Since developers typically rely on the compiler to catch const/non-const assignment
+    // errors, don't assume a const-to-non-const generic selection miss was intentional.
+    SimpleAssignment<relevantTypes/2>::satisfiesSimplePointerAssignment(provided, expected)
+  )
+}
+
+from
+  C11GenericExpr generic, Expr controllingExpr, Type providedType, Type missedType,
+  Type lvalueConverted, Element extraElement, string extraString, string extraElementName
+where
+  not isExcluded(generic, GenericsPackage::dangerousDefaultSelectionForPointerInGenericQuery()) and
+  controllingExpr = generic.getControllingExpr() and
+  providedType = generic.getControllingExpr().getFullyConverted().getType() and
+  // The controlling expression undergoes lvalue conversion:
+  lvalueConverted = getLvalueConverted(providedType) and
+  // There is no perfect match
+  not typesCompatible(lvalueConverted, generic.getAnAssociationType()) and
+  // There is a default selector.
+  exists(VoidType default | default = generic.getAnAssociationType()) and
+  missedType = generic.getAnAssociationType() and
+  missesOnPointerConversion(lvalueConverted, missedType) and
+  extraElement = MacroUnwrapper<C11GenericExpr>::unwrapElement(generic) and
+  (
+    if extraElement instanceof Macro
+    then (
+      extraString = " in generic macro $@" and extraElementName = extraElement.(Macro).getName()
+    ) else (
+      extraString = "" and extraElementName = ""
+    )
+  )
+select generic,
+  "Generic matched default selection, as controlling argument type " + lvalueConverted.toString() +
+    " does not undergo pointer conversion to " + missedType.toString() + extraString + ".",
+  extraElement, extraElementName
diff --git a/c/misra/src/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.ql b/c/misra/src/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.ql
new file mode 100644
index 0000000000..f02f92b45a
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.ql
@@ -0,0 +1,64 @@
+/**
+ * @id c/misra/generic-expression-with-incorrect-essential-type
+ * @name RULE-23-6: The controlling expression of a generic selection shall have an essential type that matches its standard type
+ * @description The controlling expression of a generic selection shall have an essential type that
+ *              matches its standard type.
+ * @kind problem
+ * @precision high
+ * @problem.severity error
+ * @tags external/misra/id/rule-23-6
+ *       correctness
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.misra.EssentialTypes
+import codingstandards.cpp.Cpp14Literal
+import codingstandards.cpp.AlertReporting
+
+predicate allowedByException(Expr expr, Type essentialType) {
+  // Constant expressions
+  exists(expr.getValue()) and
+  (
+    // with essentially signed or unsigned type
+    getEssentialTypeCategory(essentialType) = EssentiallySignedType()
+    or
+    getEssentialTypeCategory(essentialType) = EssentiallyUnsignedType()
+  ) and
+  // with lower rank than `int`
+  essentialType.getSize() < any(IntType t).getSize() and
+  // and not a character constant
+  not expr instanceof Cpp14Literal::CharLiteral
+}
+
+from
+  C11GenericExpr generic, Expr ctrlExpr, Type ctrlType, Type ctrlEssentialType,
+  Element extraElement, string extraString, string extraMessage
+where
+  not isExcluded(ctrlExpr, GenericsPackage::genericExpressionWithIncorrectEssentialTypeQuery()) and
+  ctrlExpr = generic.getControllingExpr() and
+  ctrlType = ctrlExpr.getFullyConverted().getType() and
+  ctrlEssentialType = getEssentialType(ctrlExpr) and
+  // Exclude lvalue conversion on const structs
+  exists(getEssentialTypeCategory(ctrlEssentialType)) and
+  (
+    not ctrlEssentialType = ctrlType
+    or
+    getEssentialTypeCategory(ctrlEssentialType) = EssentiallyEnumType()
+  ) and
+  not allowedByException(ctrlExpr, ctrlEssentialType) and
+  extraElement = MacroUnwrapper<C11GenericExpr>::unwrapElement(generic) and
+  (
+    if extraElement instanceof Macro
+    then (
+      extraMessage = "macro $@ " and extraString = extraElement.(Macro).getName()
+    ) else (
+      extraMessage = "" and extraString = ""
+    )
+  )
+select generic,
+  "Controlling expression in generic " + extraMessage + "has standard type " + ctrlType.toString() +
+    ", which doesn't match its essential type " + ctrlEssentialType.toString() + ".", extraElement,
+  extraString
diff --git a/c/misra/src/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.ql b/c/misra/src/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.ql
new file mode 100644
index 0000000000..04952ae960
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.ql
@@ -0,0 +1,60 @@
+/**
+ * @id c/misra/invalid-generic-macro-argument-evaluation
+ * @name RULE-23-7: A generic selection that is expanded from a macro should evaluate its argument only once
+ * @description A generic selection that is expanded from a macro should evaluate its argument only
+ *              once.
+ * @kind problem
+ * @precision medium
+ * @problem.severity warning
+ * @tags external/misra/id/rule-23-7
+ *       correctness
+ *       maintainability
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.c.Generic
+
+predicate allowedByException(string parameter, ParsedGenericMacro genericMacro) {
+  genericMacro.expansionsOutsideExpr(parameter) = 0 and
+  not genericMacro.expansionsInsideAssociation(parameter, _) > 0 and
+  forall(MacroInvocation mi, C11GenericExpr expr |
+    mi.getMacro() = genericMacro and
+    mi.getAGeneratedElement() = expr
+  |
+    forall(Expr assoc | assoc = expr.getAnAssociationExpr() | exists(assoc.getValue()))
+  )
+}
+
+from ParsedGenericMacro genericMacro, string parameter, string reason
+where
+  not isExcluded(genericMacro, GenericsPackage::invalidGenericMacroArgumentEvaluationQuery()) and
+  parameter = genericMacro.getAParameter() and
+  genericMacro.expansionsInsideControllingExpr(parameter) > 0 and
+  (
+    genericMacro.expansionsOutsideExpr(parameter) > 1 and
+    reason = "expanded multiple times outside the generic selection"
+    or
+    genericMacro.expansionsOutsideExpr(parameter) = 1 and
+    genericMacro.expansionsInsideAssociation(parameter, _) > 0 and
+    reason = "expanded outside the generic selection and inside the generic selection"
+    or
+    genericMacro.expansionsOutsideExpr(parameter) = 0 and
+    exists(int i |
+      genericMacro.expansionsInsideAssociation(parameter, i) > 1 and
+      reason = "expanded in generic selection " + i.toString() + " more than once"
+    )
+    or
+    genericMacro.expansionsOutsideExpr(parameter) = 0 and
+    exists(int i |
+      genericMacro.expansionsInsideAssociation(parameter, i) = 0 and
+      reason = "not expanded in generic selection " + i.toString()
+    ) and
+    not allowedByException(parameter, genericMacro)
+  ) and
+  not genericMacro.getBody().matches(["%sizeof%", "%__alignof%", "%typeof%", "%offsetof%"])
+select genericMacro,
+  "Generic macro " + genericMacro.getName() + " may have unexpected behavior from side effects " +
+    "in parameter " + parameter + ", as it is " + reason + "."
diff --git a/c/misra/src/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.ql b/c/misra/src/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.ql
new file mode 100644
index 0000000000..6e443bd162
--- /dev/null
+++ b/c/misra/src/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.ql
@@ -0,0 +1,96 @@
+/**
+ * @id c/misra/default-generic-selection-not-first-or-last
+ * @name RULE-23-8: A default association shall appear as either the first or the last association of a generic
+ * @description A default association shall appear as either the first or the last association of a
+ *              generic selection.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity warning
+ * @tags external/misra/id/rule-23-8
+ *       maintainability
+ *       external/misra/c/2012/amendment3
+ *       external/misra/obligation/required
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.alertreporting.DeduplicateMacroResults
+
+class GenericWithMisplacedDefault extends C11GenericExpr {
+  int defaultIdx;
+
+  GenericWithMisplacedDefault() {
+    getAssociationType(defaultIdx) instanceof VoidType and
+    not defaultIdx = 0 and
+    not defaultIdx = max(int i | exists(getAssociationType(i)))
+  }
+
+  int getDefaultIdx() { result = defaultIdx }
+}
+
+module GenericWithMisplacedDefaultConfig implements
+  DeduplicateMacroConfigSig<GenericWithMisplacedDefault>
+{
+  string describe(GenericWithMisplacedDefault e) {
+    exists(int i | i = e.getDefaultIdx() + 1 |
+      i = 1 and result = "1st"
+      or
+      i = 2 and result = "2nd"
+      or
+      i = 3 and result = "3rd"
+      or
+      i > 3 and result = i.toString() + "th"
+    )
+  }
+}
+
+import GenericWithMisplacedDefaultConfig
+
+module GenericMisplacedDefaultReportConfig implements
+  MacroReportConfigSig<GenericWithMisplacedDefault>
+{
+  /* Create a message to describe this macro, with a string describing its `ResultElement`. */
+  bindingset[description]
+  string getMessageSameResultInAllExpansions(Macro m, string description) {
+    result =
+      "Generic macro " + m.getName() + " has default as " + description +
+        " association, which is not first or last."
+  }
+
+  /* Create a message to describe this macro, using '$@' to describe an example `ResultElement`. */
+  string getMessageVariedResultInAllExpansions(Macro m) {
+    result =
+      "Generic macro " + m.getName() +
+        " has a default association which is not first or last, for example $@."
+  }
+
+  /**
+   * Create a message to describe this macro expansion which produces a `ResultElement`, using '$@'
+   * to describe the relevant macro.
+   */
+  string getMessageResultInIsolatedExpansion(GenericWithMisplacedDefault element) {
+    result =
+      "Generic macro $@, in this expansion, has default as " + describe(element) +
+        " association, which is not first or last."
+  }
+
+  /**
+   * Create a message to describe a `ResultElement` which is not generated by a macro expansion.
+   */
+  string getMessageNotInMacro(GenericWithMisplacedDefault element, Locatable optLoc1, string optStr1) {
+    result =
+      "Generic has default as " + describe(element) + " association, which is not first or last." and
+    optLoc1 = element and
+    optStr1 = ""
+  }
+}
+
+import DeduplicateMacroResults<GenericWithMisplacedDefault, GenericWithMisplacedDefaultConfig> as Deduplicate
+import Deduplicate::Report<GenericMisplacedDefaultReportConfig> as Report
+
+from Report::ReportResult res
+where
+  not isExcluded(res.getPrimaryElement(),
+    GenericsPackage::defaultGenericSelectionNotFirstOrLastQuery())
+select res.getPrimaryElement(), res.getMessage(), res.getOptionalPlaceholderLocatable(),
+  res.getOptionalPlaceholderMessage()
diff --git a/c/misra/src/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.ql b/c/misra/src/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.ql
index 6eb605dbd9..af05bfe4bc 100644
--- a/c/misra/src/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.ql
+++ b/c/misra/src/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.ql
@@ -16,27 +16,38 @@
 import cpp
 import codingstandards.c.misra
 
-class IllegalCCommentCharacter extends string {
-  IllegalCCommentCharacter() {
-    this = "/*" or
-    this = "//"
-  }
+/* Character sequence is banned from all comment types */
+class IllegalCommentSequence extends string {
+  IllegalCommentSequence() { this = "/*" }
 }
 
-class IllegalCPPCommentCharacter extends string {
-  IllegalCPPCommentCharacter() { this = "/*" }
+/* A regexp to check for illegal C-style comments */
+class IllegalCCommentRegexp extends string {
+  IllegalCCommentRegexp() {
+    // Regexp to match "//" in C-style comments, which do not appear to be URLs. General format
+    // uses negative lookahead/lookbehind to match like `.*(?<!HTTP:)//(?!GITHUB.).*`. Broken down
+    // into parts:
+    //  - `.*PATTERN.*` - look for the pattern anywhere in the comment.
+    //  - `(?<![a-zA-Z]:)` - negative lookbehind, exclude "http://github.com" by seeing "p:".
+    //  - `//` - the actual illegal sequence.
+    //  - `(?!(pattern))` - negative lookahead, exclude "http://github.com" by seeing "github.".
+    //  - `[a-zA-Z0-9\\-]+\\\\.` - Assume alphanumeric/hyphen followed by '.' is a domain name.
+    this = ".*(?<![a-zA-Z]:)//(?![a-zA-Z0-9\\-]+\\\\.).*"
+  }
+
+  string getDescription() { result = "//" }
 }
 
 from Comment comment, string illegalSequence
 where
   not isExcluded(comment, SyntaxPackage::characterSequencesAndUsedWithinACommentQuery()) and
   (
-    exists(IllegalCCommentCharacter c | illegalSequence = c |
-      comment.(CStyleComment).getContents().indexOf(illegalSequence) > 0
+    exists(IllegalCommentSequence c | illegalSequence = c |
+      comment.getContents().indexOf(illegalSequence) > 1
     )
     or
-    exists(IllegalCPPCommentCharacter c | illegalSequence = c |
-      comment.(CppStyleComment).getContents().indexOf(illegalSequence) > 0
+    exists(IllegalCCommentRegexp c | illegalSequence = c.getDescription() |
+      comment.(CStyleComment).getContents().regexpMatch(c)
     )
   )
 select comment, "Comment contains an illegal sequence '" + illegalSequence + "'"
diff --git a/c/misra/src/rules/RULE-7-5/IncorrectlySizedIntegerConstantMacroArgument.ql b/c/misra/src/rules/RULE-7-5/IncorrectlySizedIntegerConstantMacroArgument.ql
index 87c945d6b6..1fe052aaae 100644
--- a/c/misra/src/rules/RULE-7-5/IncorrectlySizedIntegerConstantMacroArgument.ql
+++ b/c/misra/src/rules/RULE-7-5/IncorrectlySizedIntegerConstantMacroArgument.ql
@@ -20,6 +20,7 @@ predicate matchesSign(IntegerConstantMacro macro, PossiblyNegativeLiteral litera
   literal.isNegative() implies macro.isSigned()
 }
 
+bindingset[literal]
 predicate matchesSize(IntegerConstantMacro macro, PossiblyNegativeLiteral literal) {
   literal.getRawValue() <= macro.maxValue() and
   literal.getRawValue() >= macro.minValue()
diff --git a/c/misra/src/rules/RULE-8-13/PointerShouldPointToConstTypeWhenPossible.ql b/c/misra/src/rules/RULE-8-13/PointerShouldPointToConstTypeWhenPossible.ql
index ddb8cbcdcc..6a2c123907 100644
--- a/c/misra/src/rules/RULE-8-13/PointerShouldPointToConstTypeWhenPossible.ql
+++ b/c/misra/src/rules/RULE-8-13/PointerShouldPointToConstTypeWhenPossible.ql
@@ -16,7 +16,7 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 import codingstandards.cpp.SideEffect
 import codingstandards.cpp.alertreporting.HoldsForAllCopies
 
diff --git a/c/misra/src/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.ql b/c/misra/src/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.ql
index 8c80c64a40..fe0ae81ab1 100644
--- a/c/misra/src/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.ql
+++ b/c/misra/src/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.ql
@@ -14,9 +14,14 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Compatible
+import codingstandards.cpp.types.Compatible
 
-from FunctionDeclarationEntry f1, FunctionDeclarationEntry f2, string case
+predicate interestedInFunctions(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
+  not f1 = f2 and
+  f1.getDeclaration() = f2.getDeclaration()
+}
+
+from FunctionDeclarationEntry f1, FunctionDeclarationEntry f2, string case, string pluralDo
 where
   not isExcluded(f1, Declarations4Package::declarationsOfAFunctionSameNameAndTypeQuery()) and
   not isExcluded(f2, Declarations4Package::declarationsOfAFunctionSameNameAndTypeQuery()) and
@@ -24,16 +29,22 @@ where
   f1.getDeclaration() = f2.getDeclaration() and
   //return type check
   (
-    not typesCompatible(f1.getType(), f2.getType()) and
-    case = "return type"
+    not FunctionDeclarationTypeEquivalence<TypeNamesMatchConfig, interestedInFunctions/2>::equalReturnTypes(f1,
+      f2) and
+    case = "return type" and
+    pluralDo = "does"
     or
     //parameter type check
-    parameterTypesIncompatible(f1, f2) and
-    case = "parameter types"
+    not FunctionDeclarationTypeEquivalence<TypeNamesMatchConfig, interestedInFunctions/2>::equalParameterTypes(f1,
+      f2) and
+    case = "parameter types" and
+    pluralDo = "do"
     or
     //parameter name check
-    parameterNamesIncompatible(f1, f2) and
-    case = "parameter names"
+    parameterNamesUnmatched(f1, f2) and
+    case = "parameter names" and
+    pluralDo = "do"
   )
-select f1, "The " + case + " of re-declaration of $@ is not compatible with declaration $@", f1,
-  f1.getName(), f2, f2.getName()
+select f1,
+  "The " + case + " of re-declaration of $@ " + pluralDo +
+    " not use the same type names as declaration $@", f1, f1.getName(), f2, f2.getName()
diff --git a/c/misra/src/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.ql b/c/misra/src/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.ql
index 421998c582..36a84b3b9c 100644
--- a/c/misra/src/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.ql
+++ b/c/misra/src/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.ql
@@ -14,12 +14,9 @@
 
 import cpp
 import codingstandards.c.misra
-import codingstandards.cpp.Compatible
+import codingstandards.cpp.types.Compatible
 
-from VariableDeclarationEntry decl1, VariableDeclarationEntry decl2
-where
-  not isExcluded(decl1, Declarations4Package::declarationsOfAnObjectSameNameAndTypeQuery()) and
-  not isExcluded(decl2, Declarations4Package::declarationsOfAnObjectSameNameAndTypeQuery()) and
+predicate relevantPair(VariableDeclarationEntry decl1, VariableDeclarationEntry decl2) {
   not decl1 = decl2 and
   not decl1.getVariable().getDeclaringType().isAnonymous() and
   // Declarations are for the same qualified name
@@ -34,9 +31,25 @@ where
     or
     decl1.getVariable().(Field).getDeclaringType().(Class).getALinkTarget() =
       decl2.getVariable().(Field).getDeclaringType().(Class).getALinkTarget()
-  ) and
-  not typesCompatible(decl1.getType(), decl2.getType())
+  )
+}
+
+predicate relevantTypes(Type a, Type b) {
+  exists(VariableDeclarationEntry varA, VariableDeclarationEntry varB |
+    a = varA.getType() and
+    b = varB.getType() and
+    relevantPair(varA, varB)
+  )
+}
+
+from VariableDeclarationEntry decl1, VariableDeclarationEntry decl2
+where
+  not isExcluded(decl1, Declarations4Package::declarationsOfAnObjectSameNameAndTypeQuery()) and
+  not isExcluded(decl2, Declarations4Package::declarationsOfAnObjectSameNameAndTypeQuery()) and
+  relevantPair(decl1, decl2) and
+  not TypeEquivalence<TypeNamesMatchConfig, relevantTypes/2>::equalTypes(decl1.getType(),
+    decl2.getType())
 select decl1,
   "The object $@ of type " + decl1.getType().toString() +
-    " is not compatible with re-declaration $@ of type " + decl2.getType().toString(), decl1,
-  decl1.getName(), decl2, decl2.getName()
+    " does not use the same type names as re-declaration $@ of type " + decl2.getType().toString(),
+  decl1, decl1.getName(), decl2, decl2.getName()
diff --git a/c/misra/src/rules/RULE-8-4/CompatibleDeclarationFunctionDefined.ql b/c/misra/src/rules/RULE-8-4/CompatibleDeclarationFunctionDefined.ql
index 63f70d3541..e7eba7e42a 100644
--- a/c/misra/src/rules/RULE-8-4/CompatibleDeclarationFunctionDefined.ql
+++ b/c/misra/src/rules/RULE-8-4/CompatibleDeclarationFunctionDefined.ql
@@ -17,7 +17,19 @@
 import cpp
 import codingstandards.c.misra
 import codingstandards.cpp.Identifiers
-import codingstandards.cpp.Compatible
+import codingstandards.cpp.types.Compatible
+
+predicate interestedInFunctions(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
+  f1.getDeclaration() instanceof ExternalIdentifiers and
+  f1.isDefinition() and
+  f1.getDeclaration() = f2.getDeclaration() and
+  not f2.isDefinition() and
+  not f1.isFromTemplateInstantiation(_) and
+  not f2.isFromTemplateInstantiation(_)
+}
+
+module FunDeclEquiv =
+  FunctionDeclarationTypeEquivalence<TypesCompatibleConfig, interestedInFunctions/2>;
 
 from FunctionDeclarationEntry f1
 where
@@ -33,18 +45,16 @@ where
     or
     //or one exists that is close but incompatible in some way
     exists(FunctionDeclarationEntry f2 |
-      f1.getName() = f2.getName() and
-      not f2.isDefinition() and
-      f2.getDeclaration() = f1.getDeclaration() and
-      //return types differ
+      interestedInFunctions(f1, f2) and
       (
-        not typesCompatible(f1.getType(), f2.getType())
+        //return types differ
+        not FunDeclEquiv::equalReturnTypes(f1, f2)
         or
         //parameter types differ
-        parameterTypesIncompatible(f1, f2)
+        not FunDeclEquiv::equalParameterTypes(f1, f2)
         or
         //parameter names differ
-        parameterNamesIncompatible(f1, f2)
+        parameterNamesUnmatched(f1, f2)
       )
     )
   )
diff --git a/c/misra/src/rules/RULE-8-4/CompatibleDeclarationObjectDefined.ql b/c/misra/src/rules/RULE-8-4/CompatibleDeclarationObjectDefined.ql
index 7e5baacd9a..bed30d673c 100644
--- a/c/misra/src/rules/RULE-8-4/CompatibleDeclarationObjectDefined.ql
+++ b/c/misra/src/rules/RULE-8-4/CompatibleDeclarationObjectDefined.ql
@@ -17,7 +17,16 @@
 import cpp
 import codingstandards.c.misra
 import codingstandards.cpp.Identifiers
-import codingstandards.cpp.Compatible
+import codingstandards.cpp.types.Compatible
+
+predicate relevantTypes(Type a, Type b) {
+  exists(VariableDeclarationEntry varA, VariableDeclarationEntry varB |
+    not varA = varB and
+    varA.getDeclaration() = varB.getDeclaration() and
+    a = varA.getType() and
+    b = varB.getType()
+  )
+}
 
 from VariableDeclarationEntry decl1
 where
@@ -28,6 +37,7 @@ where
   not exists(VariableDeclarationEntry decl2 |
     not decl2.isDefinition() and
     decl1.getDeclaration() = decl2.getDeclaration() and
-    typesCompatible(decl1.getType(), decl2.getType())
+    TypeEquivalence<TypesCompatibleConfig, relevantTypes/2>::equalTypes(decl1.getType(),
+      decl2.getType())
   )
 select decl1, "No separate compatible declaration found for this definition."
diff --git a/c/misra/src/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.ql b/c/misra/src/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.ql
index faa915fdd5..9cdd6532a9 100644
--- a/c/misra/src/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.ql
+++ b/c/misra/src/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.ql
@@ -40,17 +40,22 @@ predicate isReferencedInTranslationUnit(
   ExternalIdentifiers e, ExternalIdentifierReference r, TranslationUnit t
 ) {
   r.getExternalIdentifierTarget() = e and
-  r.getFile() = t
+  // Used within the translation unit or an included header
+  r.getFile() = t.getAUserFile()
 }
 
 from ExternalIdentifiers e, ExternalIdentifierReference a1, TranslationUnit t1
 where
   not isExcluded(e, Declarations6Package::shouldNotBeDefinedWithExternalLinkageQuery()) and
+  // Only report external identifiers where we see the definition
+  e.hasDefinition() and
   isReferencedInTranslationUnit(e, a1, t1) and
   // Not referenced in any other translation unit
   not exists(TranslationUnit t2 |
     isReferencedInTranslationUnit(e, _, t2) and
     not t1 = t2
-  )
+  ) and
+  // Definition is also in the same translation unit
+  e.getDefinition().getFile() = t1.getAUserFile()
 select e, "Declaration with external linkage is accessed in only one translation unit $@.", a1,
   a1.toString()
diff --git a/c/misra/src/rules/RULE-9-7/UninitializedAtomicObject.ql b/c/misra/src/rules/RULE-9-7/UninitializedAtomicObject.ql
new file mode 100644
index 0000000000..5f7fb803d6
--- /dev/null
+++ b/c/misra/src/rules/RULE-9-7/UninitializedAtomicObject.ql
@@ -0,0 +1,76 @@
+/**
+ * @id c/misra/uninitialized-atomic-object
+ * @name RULE-9-7: Atomic objects shall be appropriately initialized before being accessed
+ * @description Atomic objects that do not have static storage duration shall be initialized with a
+ *              value or by using 'atomic_init()'.
+ * @kind problem
+ * @precision high
+ * @problem.severity warning
+ * @tags external/misra/id/rule-9-7
+ *       concurrency
+ *       external/misra/c/2012/amendment4
+ *       external/misra/obligation/mandatory
+ */
+
+import cpp
+import codingstandards.c.misra
+import codingstandards.cpp.StdFunctionOrMacro
+import semmle.code.cpp.controlflow.Dominance
+
+class ThreadSpawningFunction extends Function {
+  ThreadSpawningFunction() {
+    this.hasName("pthread_create")
+    or
+    this.hasName("thrd_create")
+    or
+    exists(FunctionCall fc |
+      fc.getTarget() instanceof ThreadSpawningFunction and
+      fc.getEnclosingFunction() = this
+    )
+  }
+}
+
+class AtomicInitAddressOfExpr extends AddressOfExpr {
+  AtomicInitAddressOfExpr() {
+    // StdFunctionOrMacro arguments are not necessarily reliable, so we look for any AddressOfExpr
+    // that is an argument to a call to `atomic_init`.
+    exists(AtomicInitCall c | this = c.getAnArgument())
+  }
+}
+
+ControlFlowNode getARequiredInitializationPoint(LocalScopeVariable v) {
+  result = v.getParentScope().(BlockStmt).getFollowingStmt()
+  or
+  exists(DeclStmt decl |
+    decl.getADeclaration() = v and
+    result =
+      any(FunctionCall fc |
+        fc.getTarget() instanceof ThreadSpawningFunction and
+        fc.getEnclosingBlock().getEnclosingBlock*() = v.getParentScope() and
+        fc.getAPredecessor*() = decl
+      )
+  )
+}
+
+from VariableDeclarationEntry decl, Variable v
+where
+  not isExcluded(decl, Concurrency7Package::uninitializedAtomicObjectQuery()) and
+  v = decl.getVariable() and
+  v.getUnderlyingType().hasSpecifier("atomic") and
+  not v.isTopLevel() and
+  not exists(v.getInitializer()) and
+  exists(ControlFlowNode missingInitPoint |
+    missingInitPoint = getARequiredInitializationPoint(v) and
+    // Check for `atomic_init(&v)`
+    not exists(AtomicInitAddressOfExpr initialization |
+      initialization.getOperand().(VariableAccess).getTarget() = v and
+      dominates(initialization, missingInitPoint)
+    ) and
+    // Check for `unknown_func(&v)` which may call `atomic_init` on `v`.
+    not exists(FunctionCall fc |
+      fc.getAnArgument().(AddressOfExpr).getOperand().(VariableAccess).getTarget() = v and
+      dominates(fc, missingInitPoint)
+    )
+  )
+select decl,
+  "Atomic object '" + v.getName() + "' has no initializer or corresponding use of 'atomic_init()'."
diff --git a/c/misra/test/c/misra/EssentialTypes.expected b/c/misra/test/c/misra/EssentialTypes.expected
index c0e010b8e4..95976fe2ab 100644
--- a/c/misra/test/c/misra/EssentialTypes.expected
+++ b/c/misra/test/c/misra/EssentialTypes.expected
@@ -90,3 +90,351 @@
 | test.c:79:3:79:5 | 97 | char | char | essentially Character type |
 | test.c:80:3:80:6 | 10 | char | char | essentially Character type |
 | test.c:81:3:81:6 | 0 | char | char | essentially Character type |
+| test.c:87:16:87:16 | 0 | signed char | signed char | essentially Signed type |
+| test.c:87:16:87:16 | (uint8_t)... | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:88:18:88:18 | 0 | signed char | signed char | essentially Signed type |
+| test.c:88:18:88:18 | (uint16_t)... | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:89:18:89:18 | 0 | signed char | signed char | essentially Signed type |
+| test.c:89:18:89:18 | (uint32_t)... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:90:15:90:15 | 0 | signed char | signed char | essentially Signed type |
+| test.c:90:15:90:15 | (int8_t)... | int8_t | int8_t | essentially Signed type |
+| test.c:91:17:91:17 | 0 | signed char | signed char | essentially Signed type |
+| test.c:91:17:91:17 | (int16_t)... | int16_t | int16_t | essentially Signed type |
+| test.c:92:16:92:17 | 0 | signed char | signed char | essentially Signed type |
+| test.c:94:3:94:4 | (int)... | int | int | essentially Signed type |
+| test.c:94:3:94:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:94:3:94:9 | ... & ... | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:94:8:94:9 | (int)... | int | int | essentially Signed type |
+| test.c:94:8:94:9 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:95:3:95:5 | (int)... | int | int | essentially Signed type |
+| test.c:95:3:95:5 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:95:3:95:10 | ... & ... | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:95:9:95:10 | (int)... | int | int | essentially Signed type |
+| test.c:95:9:95:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:96:3:96:4 | (int)... | int | int | essentially Signed type |
+| test.c:96:3:96:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:96:3:96:10 | ... & ... | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:96:8:96:10 | (int)... | int | int | essentially Signed type |
+| test.c:96:8:96:10 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:97:3:97:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:97:3:97:10 | ... & ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:97:9:97:10 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:97:9:97:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:98:3:98:4 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:98:3:98:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:98:3:98:10 | ... & ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:98:8:98:10 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:99:3:99:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:99:3:99:11 | ... & ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:99:9:99:11 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:99:9:99:11 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:100:3:100:5 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:100:3:100:5 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:100:3:100:11 | ... & ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:100:9:100:11 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:102:3:102:4 | (int)... | int | int | essentially Signed type |
+| test.c:102:3:102:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:102:3:102:9 | ... \| ... | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:102:8:102:9 | (int)... | int | int | essentially Signed type |
+| test.c:102:8:102:9 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:103:3:103:5 | (int)... | int | int | essentially Signed type |
+| test.c:103:3:103:5 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:103:3:103:10 | ... \| ... | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:103:9:103:10 | (int)... | int | int | essentially Signed type |
+| test.c:103:9:103:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:104:3:104:4 | (int)... | int | int | essentially Signed type |
+| test.c:104:3:104:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:104:3:104:10 | ... \| ... | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:104:8:104:10 | (int)... | int | int | essentially Signed type |
+| test.c:104:8:104:10 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:105:3:105:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:105:3:105:10 | ... \| ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:105:9:105:10 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:105:9:105:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:106:3:106:4 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:106:3:106:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:106:3:106:10 | ... \| ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:106:8:106:10 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:107:3:107:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:107:3:107:11 | ... \| ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:107:9:107:11 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:107:9:107:11 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:108:3:108:5 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:108:3:108:5 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:108:3:108:11 | ... \| ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:108:9:108:11 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:110:3:110:4 | (int)... | int | int | essentially Signed type |
+| test.c:110:3:110:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:110:3:110:9 | ... ^ ... | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:110:8:110:9 | (int)... | int | int | essentially Signed type |
+| test.c:110:8:110:9 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:111:3:111:5 | (int)... | int | int | essentially Signed type |
+| test.c:111:3:111:5 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:111:3:111:10 | ... ^ ... | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:111:9:111:10 | (int)... | int | int | essentially Signed type |
+| test.c:111:9:111:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:112:3:112:4 | (int)... | int | int | essentially Signed type |
+| test.c:112:3:112:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:112:3:112:10 | ... ^ ... | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:112:8:112:10 | (int)... | int | int | essentially Signed type |
+| test.c:112:8:112:10 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:113:3:113:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:113:3:113:10 | ... ^ ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:113:9:113:10 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:113:9:113:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:114:3:114:4 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:114:3:114:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:114:3:114:10 | ... ^ ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:114:8:114:10 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:115:3:115:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:115:3:115:11 | ... ^ ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:115:9:115:11 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:115:9:115:11 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:116:3:116:5 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:116:3:116:5 | u16 | uint16_t | uint16_t | essentially Unsigned type |
+| test.c:116:3:116:11 | ... ^ ... | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:116:9:116:11 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:118:3:118:4 | (int)... | int | int | essentially Signed type |
+| test.c:118:3:118:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:118:3:118:9 | ... & ... | int8_t | int8_t | essentially Signed type |
+| test.c:118:8:118:9 | (int)... | int | int | essentially Signed type |
+| test.c:118:8:118:9 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:119:3:119:5 | (int)... | int | int | essentially Signed type |
+| test.c:119:3:119:5 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:119:3:119:10 | ... & ... | int16_t | int16_t | essentially Signed type |
+| test.c:119:9:119:10 | (int)... | int | int | essentially Signed type |
+| test.c:119:9:119:10 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:120:3:120:4 | (int)... | int | int | essentially Signed type |
+| test.c:120:3:120:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:120:3:120:10 | ... & ... | int16_t | int16_t | essentially Signed type |
+| test.c:120:8:120:10 | (int)... | int | int | essentially Signed type |
+| test.c:120:8:120:10 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:121:3:121:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:121:3:121:10 | ... & ... | int32_t | int32_t | essentially Signed type |
+| test.c:121:9:121:10 | (int)... | int | int | essentially Signed type |
+| test.c:121:9:121:10 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:122:3:122:4 | (int)... | int | int | essentially Signed type |
+| test.c:122:3:122:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:122:3:122:10 | ... & ... | int32_t | int32_t | essentially Signed type |
+| test.c:122:8:122:10 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:123:3:123:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:123:3:123:11 | ... & ... | int32_t | int32_t | essentially Signed type |
+| test.c:123:9:123:11 | (int)... | int | int | essentially Signed type |
+| test.c:123:9:123:11 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:124:3:124:5 | (int)... | int | int | essentially Signed type |
+| test.c:124:3:124:5 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:124:3:124:11 | ... & ... | int32_t | int32_t | essentially Signed type |
+| test.c:124:9:124:11 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:126:3:126:4 | (int)... | int | int | essentially Signed type |
+| test.c:126:3:126:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:126:3:126:9 | ... \| ... | int8_t | int8_t | essentially Signed type |
+| test.c:126:8:126:9 | (int)... | int | int | essentially Signed type |
+| test.c:126:8:126:9 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:127:3:127:5 | (int)... | int | int | essentially Signed type |
+| test.c:127:3:127:5 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:127:3:127:10 | ... \| ... | int16_t | int16_t | essentially Signed type |
+| test.c:127:9:127:10 | (int)... | int | int | essentially Signed type |
+| test.c:127:9:127:10 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:128:3:128:4 | (int)... | int | int | essentially Signed type |
+| test.c:128:3:128:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:128:3:128:10 | ... \| ... | int16_t | int16_t | essentially Signed type |
+| test.c:128:8:128:10 | (int)... | int | int | essentially Signed type |
+| test.c:128:8:128:10 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:129:3:129:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:129:3:129:10 | ... \| ... | int32_t | int32_t | essentially Signed type |
+| test.c:129:9:129:10 | (int)... | int | int | essentially Signed type |
+| test.c:129:9:129:10 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:130:3:130:4 | (int)... | int | int | essentially Signed type |
+| test.c:130:3:130:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:130:3:130:10 | ... \| ... | int32_t | int32_t | essentially Signed type |
+| test.c:130:8:130:10 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:131:3:131:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:131:3:131:11 | ... \| ... | int32_t | int32_t | essentially Signed type |
+| test.c:131:9:131:11 | (int)... | int | int | essentially Signed type |
+| test.c:131:9:131:11 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:132:3:132:5 | (int)... | int | int | essentially Signed type |
+| test.c:132:3:132:5 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:132:3:132:11 | ... \| ... | int32_t | int32_t | essentially Signed type |
+| test.c:132:9:132:11 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:134:3:134:4 | (int)... | int | int | essentially Signed type |
+| test.c:134:3:134:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:134:3:134:9 | ... ^ ... | int8_t | int8_t | essentially Signed type |
+| test.c:134:8:134:9 | (int)... | int | int | essentially Signed type |
+| test.c:134:8:134:9 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:135:3:135:5 | (int)... | int | int | essentially Signed type |
+| test.c:135:3:135:5 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:135:3:135:10 | ... ^ ... | int16_t | int16_t | essentially Signed type |
+| test.c:135:9:135:10 | (int)... | int | int | essentially Signed type |
+| test.c:135:9:135:10 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:136:3:136:4 | (int)... | int | int | essentially Signed type |
+| test.c:136:3:136:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:136:3:136:10 | ... ^ ... | int16_t | int16_t | essentially Signed type |
+| test.c:136:8:136:10 | (int)... | int | int | essentially Signed type |
+| test.c:136:8:136:10 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:137:3:137:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:137:3:137:10 | ... ^ ... | int32_t | int32_t | essentially Signed type |
+| test.c:137:9:137:10 | (int)... | int | int | essentially Signed type |
+| test.c:137:9:137:10 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:138:3:138:4 | (int)... | int | int | essentially Signed type |
+| test.c:138:3:138:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:138:3:138:10 | ... ^ ... | int32_t | int32_t | essentially Signed type |
+| test.c:138:8:138:10 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:139:3:139:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:139:3:139:11 | ... ^ ... | int32_t | int32_t | essentially Signed type |
+| test.c:139:9:139:11 | (int)... | int | int | essentially Signed type |
+| test.c:139:9:139:11 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:140:3:140:5 | (int)... | int | int | essentially Signed type |
+| test.c:140:3:140:5 | s16 | int16_t | int16_t | essentially Signed type |
+| test.c:140:3:140:11 | ... ^ ... | int32_t | int32_t | essentially Signed type |
+| test.c:140:9:140:11 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:142:3:142:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:142:3:142:11 | ... & ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:142:9:142:11 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:142:9:142:11 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:143:3:143:5 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:143:3:143:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:143:3:143:11 | ... & ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:143:9:143:11 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:144:3:144:4 | (int)... | int | int | essentially Signed type |
+| test.c:144:3:144:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:144:3:144:10 | ... & ... | int | int | essentially Signed type |
+| test.c:144:8:144:10 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:145:3:145:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:145:3:145:10 | ... & ... | int | int | essentially Signed type |
+| test.c:145:9:145:10 | (int)... | int | int | essentially Signed type |
+| test.c:145:9:145:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:146:3:146:4 | (int)... | int | int | essentially Signed type |
+| test.c:146:3:146:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:146:3:146:9 | ... & ... | int | int | essentially Signed type |
+| test.c:146:8:146:9 | (int)... | int | int | essentially Signed type |
+| test.c:146:8:146:9 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:147:3:147:4 | (int)... | int | int | essentially Signed type |
+| test.c:147:3:147:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:147:3:147:9 | ... & ... | int | int | essentially Signed type |
+| test.c:147:8:147:9 | (int)... | int | int | essentially Signed type |
+| test.c:147:8:147:9 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:149:3:149:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:149:3:149:11 | ... \| ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:149:9:149:11 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:149:9:149:11 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:150:3:150:5 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:150:3:150:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:150:3:150:11 | ... \| ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:150:9:150:11 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:151:3:151:4 | (int)... | int | int | essentially Signed type |
+| test.c:151:3:151:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:151:3:151:10 | ... \| ... | int | int | essentially Signed type |
+| test.c:151:8:151:10 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:152:3:152:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:152:3:152:10 | ... \| ... | int | int | essentially Signed type |
+| test.c:152:9:152:10 | (int)... | int | int | essentially Signed type |
+| test.c:152:9:152:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:153:3:153:4 | (int)... | int | int | essentially Signed type |
+| test.c:153:3:153:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:153:3:153:9 | ... \| ... | int | int | essentially Signed type |
+| test.c:153:8:153:9 | (int)... | int | int | essentially Signed type |
+| test.c:153:8:153:9 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:154:3:154:4 | (int)... | int | int | essentially Signed type |
+| test.c:154:3:154:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:154:3:154:9 | ... \| ... | int | int | essentially Signed type |
+| test.c:154:8:154:9 | (int)... | int | int | essentially Signed type |
+| test.c:154:8:154:9 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:156:3:156:5 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:156:3:156:11 | ... ^ ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:156:9:156:11 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:156:9:156:11 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:157:3:157:5 | (unsigned int)... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:157:3:157:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:157:3:157:11 | ... ^ ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:157:9:157:11 | u32 | uint32_t | uint32_t | essentially Unsigned type |
+| test.c:158:3:158:4 | (int)... | int | int | essentially Signed type |
+| test.c:158:3:158:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:158:3:158:10 | ... ^ ... | int | int | essentially Signed type |
+| test.c:158:8:158:10 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:159:3:159:5 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:159:3:159:10 | ... ^ ... | int | int | essentially Signed type |
+| test.c:159:9:159:10 | (int)... | int | int | essentially Signed type |
+| test.c:159:9:159:10 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:160:3:160:4 | (int)... | int | int | essentially Signed type |
+| test.c:160:3:160:4 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:160:3:160:9 | ... ^ ... | int | int | essentially Signed type |
+| test.c:160:8:160:9 | (int)... | int | int | essentially Signed type |
+| test.c:160:8:160:9 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:161:3:161:4 | (int)... | int | int | essentially Signed type |
+| test.c:161:3:161:4 | s8 | int8_t | int8_t | essentially Signed type |
+| test.c:161:3:161:9 | ... ^ ... | int | int | essentially Signed type |
+| test.c:161:8:161:9 | (int)... | int | int | essentially Signed type |
+| test.c:161:8:161:9 | u8 | uint8_t | uint8_t | essentially Unsigned type |
+| test.c:165:16:165:17 | 1 | signed char | signed char | essentially Signed type |
+| test.c:170:3:170:4 | 1 | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:170:3:170:9 | ... << ... | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:170:9:170:9 | 1 | signed char | signed char | essentially Signed type |
+| test.c:171:3:171:6 | 256 | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:171:3:171:11 | ... << ... | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:171:11:171:11 | 1 | signed char | signed char | essentially Signed type |
+| test.c:172:3:172:8 | 65536 | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:172:3:172:13 | ... << ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:172:13:172:13 | 1 | signed char | signed char | essentially Signed type |
+| test.c:173:3:173:4 | 2 | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:173:3:173:9 | ... >> ... | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:173:9:173:9 | 1 | signed char | signed char | essentially Signed type |
+| test.c:174:3:174:8 | 32768 | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:174:3:174:13 | ... >> ... | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:174:13:174:13 | 1 | signed char | signed char | essentially Signed type |
+| test.c:175:3:175:13 | 2147483648 | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:175:3:175:18 | ... >> ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:175:18:175:18 | 1 | signed char | signed char | essentially Signed type |
+| test.c:176:3:176:14 | 4294967295 | unsigned long | unsigned long | essentially Unsigned type |
+| test.c:176:3:176:19 | ... << ... | unsigned long | unsigned long | essentially Unsigned type |
+| test.c:176:3:176:19 | ... << ... | unsigned long | unsigned long long | essentially Unsigned type |
+| test.c:176:3:176:19 | ... << ... | unsigned long long | unsigned long | essentially Unsigned type |
+| test.c:176:3:176:19 | ... << ... | unsigned long long | unsigned long long | essentially Unsigned type |
+| test.c:176:19:176:19 | 1 | signed char | signed char | essentially Signed type |
+| test.c:181:3:181:6 | 256 | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:181:3:181:11 | ... >> ... | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:181:11:181:11 | 1 | signed char | signed char | essentially Signed type |
+| test.c:182:3:182:8 | 65536 | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:182:3:182:13 | ... >> ... | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:182:13:182:13 | 1 | signed char | signed char | essentially Signed type |
+| test.c:183:3:183:13 | 4294967296 | unsigned long | unsigned long | essentially Unsigned type |
+| test.c:183:3:183:18 | ... >> ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:183:18:183:18 | 1 | signed char | signed char | essentially Signed type |
+| test.c:184:3:184:6 | 255 | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:184:3:184:11 | ... << ... | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:184:11:184:11 | 1 | signed char | signed char | essentially Signed type |
+| test.c:185:3:185:8 | 65535 | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:185:3:185:13 | ... << ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:185:13:185:13 | 1 | signed char | signed char | essentially Signed type |
+| test.c:189:3:189:6 | 255 | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:189:3:189:13 | ... >> ... | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:189:11:189:13 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:190:3:190:8 | 65535 | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:190:3:190:15 | ... >> ... | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:190:13:190:15 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:191:3:191:13 | 4294967295 | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:191:3:191:20 | ... >> ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:191:18:191:20 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:192:3:192:6 | 255 | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:192:3:192:13 | ... << ... | unsigned char | unsigned char | essentially Unsigned type |
+| test.c:192:11:192:13 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:193:3:193:8 | 65535 | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:193:3:193:15 | ... << ... | unsigned short | unsigned short | essentially Unsigned type |
+| test.c:193:13:193:15 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:194:3:194:13 | 4294967295 | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:194:3:194:20 | ... << ... | unsigned int | unsigned int | essentially Unsigned type |
+| test.c:194:18:194:20 | s32 | int32_t | int32_t | essentially Signed type |
+| test.c:197:3:197:5 | 257 | short | short | essentially Signed type |
+| test.c:197:3:197:5 | 257 | short | signed short | essentially Signed type |
+| test.c:197:3:197:5 | 257 | signed short | short | essentially Signed type |
+| test.c:197:3:197:5 | 257 | signed short | signed short | essentially Signed type |
+| test.c:197:3:197:10 | ... >> ... | int | int | essentially Signed type |
+| test.c:197:10:197:10 | 1 | signed char | signed char | essentially Signed type |
+| test.c:198:3:198:7 | 65537 | int | int | essentially Signed type |
+| test.c:198:3:198:7 | 65537 | int | signed int | essentially Signed type |
+| test.c:198:3:198:7 | 65537 | signed int | int | essentially Signed type |
+| test.c:198:3:198:7 | 65537 | signed int | signed int | essentially Signed type |
+| test.c:198:3:198:12 | ... >> ... | int | int | essentially Signed type |
+| test.c:198:12:198:12 | 1 | signed char | signed char | essentially Signed type |
+| test.c:199:3:199:12 | 4294967297 | long | long | essentially Signed type |
+| test.c:199:3:199:17 | ... >> ... | long | long | essentially Signed type |
+| test.c:199:17:199:17 | 1 | signed char | signed char | essentially Signed type |
diff --git a/c/misra/test/c/misra/test.c b/c/misra/test/c/misra/test.c
index b3fdddd591..36a3eb0b10 100644
--- a/c/misra/test/c/misra/test.c
+++ b/c/misra/test/c/misra/test.c
@@ -79,4 +79,122 @@ void testControlChar() {
   'a';  // Essentially char
   '\n'; // Essentially char
   '\0'; // Essentially char
+}
+
+#include <stdint.h>
+// clang-format off
+void testBitwise() { // Clang format disabled to avoid confusion with variable declarations
+  uint8_t u8 = 0;
+  uint16_t u16 = 0;
+  uint32_t u32 = 0;
+  int8_t s8 = 0;
+  int16_t s16 = 0;
+  int32_t s32 = 0;
+
+  u8 & u8;   // Essentially unsigned, char
+  u16 & u8;  // Essentially unsigned, short
+  u8 & u16;  // Essentially unsigned, short
+  u32 & u8;  // Essentially unsigned, int
+  u8 & u32;  // Essentially unsigned, int
+  u32 & u16; // Essentially unsigned, int
+  u16 & u32; // Essentially unsigned, int
+
+  u8 | u8;   // Essentially unsigned, char
+  u16 | u8;  // Essentially unsigned, short
+  u8 | u16;  // Essentially unsigned, short
+  u32 | u8;  // Essentially unsigned, int
+  u8 | u32;  // Essentially unsigned, int
+  u32 | u16; // Essentially unsigned, int
+  u16 | u32; // Essentially unsigned, int
+
+  u8 ^ u8;   // Essentially unsigned, char
+  u16 ^ u8;  // Essentially unsigned, short
+  u8 ^ u16;  // Essentially unsigned, short
+  u32 ^ u8;  // Essentially unsigned, int
+  u8 ^ u32;  // Essentially unsigned, int
+  u32 ^ u16; // Essentially unsigned, int
+  u16 ^ u32; // Essentially unsigned, int
+
+  s8 & s8;   // Essentially signed, char
+  s16 & s8;  // Essentially signed, short
+  s8 & s16;  // Essentially signed, short
+  s32 & s8;  // Essentially signed, int
+  s8 & s32;  // Essentially signed, int
+  s32 & s16; // Essentially signed, int
+  s16 & s32; // Essentially signed, int
+
+  s8 | s8;   // Essentially signed, char
+  s16 | s8;  // Essentially signed, short
+  s8 | s16;  // Essentially signed, short
+  s32 | s8;  // Essentially signed, int
+  s8 | s32;  // Essentially signed, int
+  s32 | s16; // Essentially signed, int
+  s16 | s32; // Essentially signed, int
+
+  s8 ^ s8;   // Essentially signed, char
+  s16 ^ s8;  // Essentially signed, short
+  s8 ^ s16;  // Essentially signed, short
+  s32 ^ s8;  // Essentially signed, int
+  s8 ^ s32;  // Essentially signed, int
+  s32 ^ s16; // Essentially signed, int
+  s16 ^ s32; // Essentially signed, int
+
+  u32 & s32; // Essentially unsigned, int
+  s32 & u32; // Essentially unsigned, int
+  u8 & s32;  // Essentially signed, int
+  s32 & u8;  // Essentially signed, int
+  u8 & s8;   // Essentially signed, int
+  s8 & u8;   // Essentially signed, int
+
+  u32 | s32; // Essentially signed, int
+  s32 | u32; // Essentially signed, int
+  u8 | s32;  // Essentially signed, int
+  s32 | u8;  // Essentially signed, int
+  u8 | s8;   // Essentially signed, int
+  s8 | u8;   // Essentially signed, int
+
+  u32 ^ s32; // Essentially signed, int
+  s32 ^ u32; // Essentially signed, int
+  u8 ^ s32;  // Essentially signed, int
+  s32 ^ u8;  // Essentially signed, int
+  u8 ^ s8;   // Essentially signed, int
+  s8 ^ u8;   // Essentially signed, int
+}
+// clang-format on
+void testShifts() {
+  int32_t s32 = 1;
+
+  // Left hand is unsigned and both are constants, so UTLR
+  // In these cases the UTLR is the same as the essential type of
+  // the left operand
+  1U << 1;           // Essentially unsigned char
+  256U << 1;         // Essentially unsigned short
+  65536U << 1;       // Essentially unsigned int
+  2U >> 1;           // Essentially unsigned char
+  32768U >> 1;       // Essentially unsigned short - 2^15 >> 1 = 2^14
+  2147483648U >> 1;  // Essentially unsigned int - 2^31 >> 1 = 2^30
+  4294967295LU << 1; // Essentially unsigned long
+
+  // Left hand is unsigned and both are constants, so UTLR
+  // In these cases the UTLR is not the same as the essential type of
+  // the left operand
+  256U >> 1;        // Essentially unsigned char
+  65536U >> 1;      // Essentially unsigned short
+  4294967296U >> 1; // Essentially unsigned int
+  255U << 1;        // Essentially unsigned short
+  65535U << 1;      // Essentially unsigned int
+
+  // Left hand is unsigned, but left isn't a constant, so essential type of left
+  // operand
+  255U >> s32;        // Essentially unsigned char
+  65535U >> s32;      // Essentially unsigned short
+  4294967295U >> s32; // Essentially unsigned int
+  255U << s32;        // Essentially unsigned char
+  65535U << s32;      // Essentially unsigned short
+  4294967295U << s32; // Essentially unsigned int
+
+  // Left hand operand signed int, so result is standard type
+  257 >> 1;        // Essentially signed int
+  65537 >> 1;      // Essentially signed int
+  4294967297 >> 1; // Essentially signed long
 }
\ No newline at end of file
diff --git a/c/misra/test/codeql-pack.lock.yml b/c/misra/test/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/c/misra/test/codeql-pack.lock.yml
+++ b/c/misra/test/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/c/misra/test/qlpack.yml b/c/misra/test/qlpack.yml
index 3acb8455b1..08e5f579a3 100644
--- a/c/misra/test/qlpack.yml
+++ b/c/misra/test/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/misra-c-coding-standards-tests
-version: 2.39.0-dev
+version: 2.49.0-dev
 extractor: cpp
 license: MIT
 dependencies:
diff --git a/c/misra/test/rules/DIR-4-11/CheckMathLibraryFunctionParameters.testref b/c/misra/test/rules/DIR-4-11/CheckMathLibraryFunctionParameters.testref
new file mode 100644
index 0000000000..50cf3fcb51
--- /dev/null
+++ b/c/misra/test/rules/DIR-4-11/CheckMathLibraryFunctionParameters.testref
@@ -0,0 +1 @@
+c/common/test/rules/uncheckedrangedomainpoleerrors/UncheckedRangeDomainPoleErrors.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.expected b/c/misra/test/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.expected
new file mode 100644
index 0000000000..d5d5892975
--- /dev/null
+++ b/c/misra/test/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.expected
@@ -0,0 +1,18 @@
+| test.c:32:5:32:7 | call to sin | Call to periodic trigonometric function sin with maximum argument absolute value of 31.4, which exceeds the recommended maximum of pi. |
+| test.c:33:5:33:7 | call to cos | Call to periodic trigonometric function cos with maximum argument absolute value of 31.4, which exceeds the recommended maximum of pi. |
+| test.c:34:5:34:7 | call to tan | Call to periodic trigonometric function tan with maximum argument absolute value of 31.4, which exceeds the recommended maximum of pi. |
+| test.c:38:5:38:7 | call to sin | Call to periodic trigonometric function sin with maximum argument absolute value of 31.4, which exceeds the recommended maximum of pi. |
+| test.c:39:5:39:7 | call to cos | Call to periodic trigonometric function cos with maximum argument absolute value of 31.4, which exceeds the recommended maximum of pi. |
+| test.c:40:5:40:7 | call to tan | Call to periodic trigonometric function tan with maximum argument absolute value of 31.4, which exceeds the recommended maximum of pi. |
+| test.c:49:5:49:7 | call to sin | Call to periodic trigonometric function sin with maximum argument absolute value of 314, which exceeds the recommended maximum of pi. |
+| test.c:50:5:50:7 | call to cos | Call to periodic trigonometric function cos with maximum argument absolute value of 314, which exceeds the recommended maximum of pi. |
+| test.c:51:5:51:7 | call to tan | Call to periodic trigonometric function tan with maximum argument absolute value of 314, which exceeds the recommended maximum of pi. |
+| test.c:52:5:52:7 | call to sin | Call to periodic trigonometric function sin with maximum argument absolute value of 314, which exceeds the recommended maximum of 10 * pi. |
+| test.c:53:5:53:7 | call to cos | Call to periodic trigonometric function cos with maximum argument absolute value of 314, which exceeds the recommended maximum of 10 * pi. |
+| test.c:54:5:54:7 | call to tan | Call to periodic trigonometric function tan with maximum argument absolute value of 314, which exceeds the recommended maximum of 10 * pi. |
+| test.c:55:5:55:7 | call to sin | Call to periodic trigonometric function sin with maximum argument absolute value of 314, which exceeds the recommended maximum of pi. |
+| test.c:56:5:56:7 | call to cos | Call to periodic trigonometric function cos with maximum argument absolute value of 314, which exceeds the recommended maximum of pi. |
+| test.c:57:5:57:7 | call to tan | Call to periodic trigonometric function tan with maximum argument absolute value of 314, which exceeds the recommended maximum of pi. |
+| test.c:58:5:58:7 | call to sin | Call to periodic trigonometric function sin with maximum argument absolute value of 314, which exceeds the recommended maximum of 10 * pi. |
+| test.c:59:5:59:7 | call to cos | Call to periodic trigonometric function cos with maximum argument absolute value of 314, which exceeds the recommended maximum of 10 * pi. |
+| test.c:60:5:60:7 | call to tan | Call to periodic trigonometric function tan with maximum argument absolute value of 314, which exceeds the recommended maximum of 10 * pi. |
diff --git a/c/misra/test/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.qlref b/c/misra/test/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.qlref
new file mode 100644
index 0000000000..f7bd11b44d
--- /dev/null
+++ b/c/misra/test/rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.qlref
@@ -0,0 +1 @@
+rules/DIR-4-11/LowPrecisionPeriodicTrigonometricFunctionCall.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-4-11/test.c b/c/misra/test/rules/DIR-4-11/test.c
new file mode 100644
index 0000000000..dac34860ff
--- /dev/null
+++ b/c/misra/test/rules/DIR-4-11/test.c
@@ -0,0 +1,62 @@
+#include <math.h>
+void f(int x) {
+  float f1 = 0.0f;
+  double d1 = 0.0f;
+  sin(f1); // COMPLIANT
+  cos(f1); // COMPLIANT
+  tan(f1); // COMPLIANT
+  sin(d1); // COMPLIANT
+  cos(d1); // COMPLIANT
+  tan(d1); // COMPLIANT
+
+  if (x < 10) {
+    f1 += 3.14;
+    d1 += 3.14;
+    sin(f1);  // COMPLIANT
+    cos(f1);  // COMPLIANT
+    tan(f1);  // COMPLIANT
+    sin(d1);  // COMPLIANT
+    cos(d1);  // COMPLIANT
+    tan(d1);  // COMPLIANT
+    sin(-f1); // COMPLIANT
+    cos(-f1); // COMPLIANT
+    tan(-f1); // COMPLIANT
+    sin(-d1); // COMPLIANT
+    cos(-d1); // COMPLIANT
+    tan(-d1); // COMPLIANT
+  }
+
+  if (x < 20) {
+    f1 = 3.14 * 10;
+    d1 = 3.14 * 10;
+    sin(f1);  // NON-COMPLIANT
+    cos(f1);  // NON-COMPLIANT
+    tan(f1);  // NON-COMPLIANT
+    sin(d1);  // COMPLIANT
+    cos(d1);  // COMPLIANT
+    tan(d1);  // COMPLIANT
+    sin(-f1); // NON-COMPLIANT
+    cos(-f1); // NON-COMPLIANT
+    tan(-f1); // NON-COMPLIANT
+    sin(-d1); // COMPLIANT
+    cos(-d1); // COMPLIANT
+    tan(-d1); // COMPLIANT
+  }
+
+  if (x < 30) {
+    f1 = 3.14 * 100;
+    d1 = 3.14 * 100;
+    sin(f1);  // NON-COMPLIANT
+    cos(f1);  // NON-COMPLIANT
+    tan(f1);  // NON-COMPLIANT
+    sin(d1);  // NON-COMPLIANT
+    cos(d1);  // NON-COMPLIANT
+    tan(d1);  // NON-COMPLIANT
+    sin(-f1); // NON-COMPLIANT
+    cos(-f1); // NON-COMPLIANT
+    tan(-f1); // NON-COMPLIANT
+    sin(-d1); // NON-COMPLIANT
+    cos(-d1); // NON-COMPLIANT
+    tan(-d1); // NON-COMPLIANT
+  }
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-4-15/PossibleMisuseOfUndetectedInfinity.testref b/c/misra/test/rules/DIR-4-15/PossibleMisuseOfUndetectedInfinity.testref
new file mode 100644
index 0000000000..176855a83d
--- /dev/null
+++ b/c/misra/test/rules/DIR-4-15/PossibleMisuseOfUndetectedInfinity.testref
@@ -0,0 +1 @@
+c/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-4-15/PossibleMisuseOfUndetectedNaN.testref b/c/misra/test/rules/DIR-4-15/PossibleMisuseOfUndetectedNaN.testref
new file mode 100644
index 0000000000..7cd2a4d431
--- /dev/null
+++ b/c/misra/test/rules/DIR-4-15/PossibleMisuseOfUndetectedNaN.testref
@@ -0,0 +1 @@
+c/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.expected b/c/misra/test/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.expected
index c7f1cba77a..49e0b1c34c 100644
--- a/c/misra/test/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.expected
+++ b/c/misra/test/rules/DIR-4-6/PlainNumericalTypeUsedOverExplicitTypedef.expected
@@ -1,20 +1,24 @@
 | test.c:14:5:14:10 | int4_t | The typedef type int4_t does not have its indicated size. |
 | test.c:16:5:16:11 | uint4_t | The typedef type uint4_t does not have its indicated size. |
-| test.c:27:5:27:26 | _astronomical_number_t | The type _astronomical_number_t is not an alias to a fixed-width numeric type. |
-| test.c:34:15:34:16 | c2 | The type signed char is not a fixed-width numeric type. |
-| test.c:35:17:35:18 | c3 | The type unsigned char is not a fixed-width numeric type. |
-| test.c:38:9:38:10 | s1 | The type short is not a fixed-width numeric type. |
-| test.c:39:16:39:17 | s2 | The type signed short is not a fixed-width numeric type. |
-| test.c:40:18:40:19 | s3 | The type unsigned short is not a fixed-width numeric type. |
-| test.c:43:7:43:8 | i1 | The type int is not a fixed-width numeric type. |
-| test.c:44:14:44:15 | i2 | The type signed int is not a fixed-width numeric type. |
-| test.c:45:16:45:17 | i3 | The type unsigned int is not a fixed-width numeric type. |
-| test.c:48:8:48:9 | l1 | The type long is not a fixed-width numeric type. |
-| test.c:49:15:49:16 | l2 | The type signed long is not a fixed-width numeric type. |
-| test.c:50:17:50:18 | l3 | The type unsigned long is not a fixed-width numeric type. |
-| test.c:53:13:53:15 | ll1 | The type long long is not a fixed-width numeric type. |
-| test.c:54:20:54:22 | ll2 | The type signed long long is not a fixed-width numeric type. |
-| test.c:55:22:55:24 | ll3 | The type unsigned long long is not a fixed-width numeric type. |
-| test.c:58:9:58:10 | f1 | The type float is not a fixed-width numeric type. |
-| test.c:61:10:61:11 | d1 | The type double is not a fixed-width numeric type. |
-| test.c:64:15:64:17 | ld1 | The type long double is not a fixed-width numeric type. |
+| test.c:19:25:19:33 | float64_t | The typedef name float64_t does not indicate a complex type. |
+| test.c:22:15:22:24 | cfloat32_t | The typedef type cfloat32_t is not a complex type. |
+| test.c:24:25:24:35 | cfloat128_t | The typedef type cfloat128_t does not have its indicated real size. |
+| test.c:31:5:31:26 | _astronomical_number_t | The type _astronomical_number_t is not an alias to a fixed-width numeric type. |
+| test.c:38:15:38:16 | c2 | The type signed char is not a fixed-width numeric type. |
+| test.c:39:17:39:18 | c3 | The type unsigned char is not a fixed-width numeric type. |
+| test.c:42:9:42:10 | s1 | The type short is not a fixed-width numeric type. |
+| test.c:43:16:43:17 | s2 | The type signed short is not a fixed-width numeric type. |
+| test.c:44:18:44:19 | s3 | The type unsigned short is not a fixed-width numeric type. |
+| test.c:47:7:47:8 | i1 | The type int is not a fixed-width numeric type. |
+| test.c:48:14:48:15 | i2 | The type signed int is not a fixed-width numeric type. |
+| test.c:49:16:49:17 | i3 | The type unsigned int is not a fixed-width numeric type. |
+| test.c:52:8:52:9 | l1 | The type long is not a fixed-width numeric type. |
+| test.c:53:15:53:16 | l2 | The type signed long is not a fixed-width numeric type. |
+| test.c:54:17:54:18 | l3 | The type unsigned long is not a fixed-width numeric type. |
+| test.c:57:13:57:15 | ll1 | The type long long is not a fixed-width numeric type. |
+| test.c:58:20:58:22 | ll2 | The type signed long long is not a fixed-width numeric type. |
+| test.c:59:22:59:24 | ll3 | The type unsigned long long is not a fixed-width numeric type. |
+| test.c:62:9:62:10 | f1 | The type float is not a fixed-width numeric type. |
+| test.c:65:10:65:11 | d1 | The type double is not a fixed-width numeric type. |
+| test.c:68:15:68:17 | ld1 | The type long double is not a fixed-width numeric type. |
+| test.c:71:18:71:20 | cf1 | The type _Complex float is not a fixed-width numeric type. |
diff --git a/c/misra/test/rules/DIR-4-6/test.c b/c/misra/test/rules/DIR-4-6/test.c
index db0842c4f6..0fc79faa2e 100644
--- a/c/misra/test/rules/DIR-4-6/test.c
+++ b/c/misra/test/rules/DIR-4-6/test.c
@@ -15,10 +15,14 @@ typedef signed long long
 typedef unsigned long long
     uint4_t; // NON_COMPLIANT: typedef does not have its indicated size
 
-typedef float float32_t;        // COMPLIANT: exception, typedefs are permitted
-typedef double float64_t;       // COMPLIANT: exception, typedefs are permitted
+typedef float float32_t; // COMPLIANT: exception, typedefs are permitted
+typedef double _Complex float64_t; // NON-COMPLIANT: not complex floating type
 typedef long double float128_t; // COMPLIANT: exception, typedefs are permitted
 
+typedef float cfloat32_t; // NON-COMPLIANT: not a complex floating type
+typedef double _Complex cfloat64_t;  // COMPLIANT: correct complex floating type
+typedef double _Complex cfloat128_t; // NON-COMPLIANT: incorrect complex size
+
 typedef int8_t
     astronomical_number_t; // COMPLIANT: aliasing a fixed-width numeric typedef
 typedef uint8_t u_astronomical_number_t; // COMPLIANT: aliasing a fixed-width
@@ -63,4 +67,7 @@ main(int argc, // COMPLIANT: exception, argc's type can be plain int
 
   long double ld1 = 1; // NON_COMPLIANT: int is a basic numeric type
   float128_t ld2 = 1;  // COMPLIANT: typedef used instead
+
+  float _Complex cf1 = 1; // NON_COMPLIANT: complex basic numeric type
+  cfloat64_t cf2 = 1;     // COMPLIANT: typedef used instead
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-4-7/FunctionErrorInformationUntested.testref b/c/misra/test/rules/DIR-4-7/FunctionErrorInformationUntested.testref
new file mode 100644
index 0000000000..51bd5fbefb
--- /dev/null
+++ b/c/misra/test/rules/DIR-4-7/FunctionErrorInformationUntested.testref
@@ -0,0 +1 @@
+c/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-4-9/test.c b/c/misra/test/rules/DIR-4-9/test.c
index 50e6bdb042..304c4bd004 100644
--- a/c/misra/test/rules/DIR-4-9/test.c
+++ b/c/misra/test/rules/DIR-4-9/test.c
@@ -10,6 +10,7 @@
 #define MACRO8(x) "NOP"                                 // COMPLIANT
 #define MACRO9() printf_custom("output = %d", 7)        // NON_COMPLIANT
 #define MACRO10(x)                                      // COMPLIANT
+#define MACRO11(x) _Generic((x), int : 1, default : 0)  // COMPLIANT
 #define MY_ASSERT(X) assert(X) // NON_COMPLIANT[FALSE_NEGATIVE]
 
 const char a1[MACRO2(1, 1) + 6];
diff --git a/c/misra/test/rules/DIR-5-1/PossibleDataRaceBetweenThreads.expected b/c/misra/test/rules/DIR-5-1/PossibleDataRaceBetweenThreads.expected
new file mode 100644
index 0000000000..e1c0e9389d
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-1/PossibleDataRaceBetweenThreads.expected
@@ -0,0 +1,24 @@
+| test.c:31:3:31:8 | ... = ... | Threaded write to object $@ from thread function $@ is not synchronized with $@ from thread function $@. | test.c:11:5:11:6 | g2 | g2 | test.c:30:6:30:29 | single_thread4_writes_g2 | single_thread4_writes_g2 | test.c:27:3:27:4 | g2 | concurrent read operation | test.c:26:6:26:28 | single_thread3_reads_g2 | single_thread3_reads_g2 |
+| test.c:35:3:35:8 | ... = ... | Threaded write to object $@ not synchronized from thread function $@ spawned from a loop. | test.c:12:5:12:6 | g3 | g3 | test.c:34:6:34:27 | many_thread5_writes_g3 | many_thread5_writes_g3 | test.c:35:3:35:4 | g3 | concurrent read operation | test.c:34:6:34:27 | many_thread5_writes_g3 | many_thread5_writes_g3 |
+| test.c:71:3:71:11 | ... = ... | Threaded write to object $@ from thread function $@ is not synchronized with $@ from thread function $@. | test.c:68:3:68:4 | g7 | g7.m1 | test.c:70:6:70:33 | single_thread11_writes_g7_m1 | single_thread11_writes_g7_m1 | test.c:75:6:75:7 | m1 | concurrent read operation | test.c:74:6:74:33 | single_thread12_writes_g7_m1 | single_thread12_writes_g7_m1 |
+| test.c:75:3:75:11 | ... = ... | Threaded write to object $@ from thread function $@ is not synchronized with $@ from thread function $@. | test.c:68:3:68:4 | g7 | g7.m1 | test.c:74:6:74:33 | single_thread12_writes_g7_m1 | single_thread12_writes_g7_m1 | test.c:71:6:71:7 | m1 | concurrent read operation | test.c:70:6:70:33 | single_thread11_writes_g7_m1 | single_thread11_writes_g7_m1 |
+| test.c:79:3:79:11 | call to setlocale | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:79:3:79:11 | call to setlocale | setlocale | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:79:3:79:11 | call to setlocale | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:80:3:80:8 | call to tmpnam | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:80:3:80:8 | call to tmpnam | tmpnam | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:80:3:80:8 | call to tmpnam | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:81:3:81:6 | call to rand | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:81:3:81:6 | call to rand | rand | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:81:3:81:6 | call to rand | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:82:3:82:7 | call to srand | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:82:3:82:7 | call to srand | srand | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:82:3:82:7 | call to srand | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:83:3:83:8 | call to getenv | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:83:3:83:8 | call to getenv | getenv | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:83:3:83:8 | call to getenv | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:84:3:84:10 | call to getenv_s | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:84:3:84:10 | call to getenv_s | getenv_s | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:84:3:84:10 | call to getenv_s | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:86:3:86:10 | call to strerror | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:86:3:86:10 | call to strerror | strerror | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:86:3:86:10 | call to strerror | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:87:3:87:9 | call to asctime | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:87:3:87:9 | call to asctime | asctime | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:87:3:87:9 | call to asctime | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:88:3:88:7 | call to ctime | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:88:3:88:7 | call to ctime | ctime | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:88:3:88:7 | call to ctime | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:89:3:89:8 | call to gmtime | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:89:3:89:8 | call to gmtime | gmtime | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:89:3:89:8 | call to gmtime | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:90:3:90:11 | call to localtime | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:90:3:90:11 | call to localtime | localtime | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:90:3:90:11 | call to localtime | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:91:3:91:10 | call to mbrtoc16 | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:91:3:91:10 | call to mbrtoc16 | mbrtoc16 | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:91:3:91:10 | call to mbrtoc16 | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:92:3:92:10 | call to mbrtoc32 | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:92:3:92:10 | call to mbrtoc32 | mbrtoc32 | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:92:3:92:10 | call to mbrtoc32 | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:93:3:93:10 | call to c16rtomb | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:93:3:93:10 | call to c16rtomb | c16rtomb | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:93:3:93:10 | call to c16rtomb | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:94:3:94:10 | call to c32rtomb | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:94:3:94:10 | call to c32rtomb | c32rtomb | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:94:3:94:10 | call to c32rtomb | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:95:3:95:8 | call to mbrlen | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:95:3:95:8 | call to mbrlen | mbrlen | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:95:3:95:8 | call to mbrlen | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:96:3:96:9 | call to mbrtowc | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:96:3:96:9 | call to mbrtowc | mbrtowc | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:96:3:96:9 | call to mbrtowc | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:97:3:97:9 | call to wcrtomb | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:97:3:97:9 | call to wcrtomb | wcrtomb | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:97:3:97:9 | call to wcrtomb | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:98:3:98:11 | call to mbsrtowcs | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:98:3:98:11 | call to mbsrtowcs | mbsrtowcs | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:98:3:98:11 | call to mbsrtowcs | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
+| test.c:99:3:99:11 | call to wcsrtombs | Threaded call to non-reentrant function $@ not synchronized from thread function $@ spawned from a loop. | test.c:99:3:99:11 | call to wcsrtombs | wcsrtombs | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs | test.c:99:3:99:11 | call to wcsrtombs | concurrent call to non-reentrant function | test.c:78:6:78:43 | many_thread13_calls_nonreentrant_funcs | many_thread13_calls_nonreentrant_funcs |
diff --git a/c/misra/test/rules/DIR-5-1/PossibleDataRaceBetweenThreads.qlref b/c/misra/test/rules/DIR-5-1/PossibleDataRaceBetweenThreads.qlref
new file mode 100644
index 0000000000..737cf79505
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-1/PossibleDataRaceBetweenThreads.qlref
@@ -0,0 +1 @@
+rules/DIR-5-1/PossibleDataRaceBetweenThreads.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-5-1/test.c b/c/misra/test/rules/DIR-5-1/test.c
new file mode 100644
index 0000000000..5f392105e6
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-1/test.c
@@ -0,0 +1,132 @@
+#include "locale.h"
+#include "stdio.h"
+#include "stdlib.h"
+#include "string.h"
+#include "threads.h"
+#include "time.h"
+#include "uchar.h"
+#include "wchar.h"
+
+int g1;
+int g2;
+int g3;
+int g4;
+mtx_t g4_lock;
+int g5;
+mtx_t g5_lock;
+
+void single_thread1_reads_g1(void *p) {
+  g1; // COMPLIANT
+}
+
+void many_thread2_reads_g1(void *p) {
+  g1; // COMPLIANT
+}
+
+void single_thread3_reads_g2(void *p) {
+  g2; // COMPLIANT
+}
+
+void single_thread4_writes_g2(void *p) {
+  g2 = 1; // NON-COMPLIANT
+}
+
+void many_thread5_writes_g3(void *p) {
+  g3 = 1; // NON-COMPLIANT
+}
+
+void single_thread6_reads_g4_locked(void *p) {
+  mtx_lock(&g4_lock);
+  g4; // COMPLIANT
+}
+
+void single_thread7_writes_g4_locked(void *p) {
+  mtx_lock(&g4_lock);
+  g4 = 1; // COMPLIANT
+}
+
+void many_thread8_writes_g5_locked(void *p) {
+  mtx_lock(&g5_lock);
+  g5 = 1; // COMPLIANT
+}
+
+struct {
+  int m1;
+  int m2;
+} g6;
+
+void single_thread9_writes_g6_m1(void *p) {
+  g6.m1 = 1; // COMPLIANT
+}
+
+void single_thread10_writes_g6_m2(void *p) {
+  g6.m2 = 1; // COMPLIANT
+}
+
+struct {
+  int m1;
+} g7;
+
+void single_thread11_writes_g7_m1(void *p) {
+  g7.m1 = 1; // NON-COMPLIANT
+}
+
+void single_thread12_writes_g7_m1(void *p) {
+  g7.m1 = 1; // NON-COMPLIANT
+}
+
+void many_thread13_calls_nonreentrant_funcs(void *p) {
+  setlocale(LC_ALL, "C");         // NON-COMPLIANT
+  tmpnam("");                     // NON-COMPLIANT
+  rand();                         // NON-COMPLIANT
+  srand(0);                       // NON-COMPLIANT
+  getenv("PATH");                 // NON-COMPLIANT
+  getenv_s(NULL, NULL, 0, NULL);  // NON-COMPLIANT
+  strtok("a", "b");               // NON-COMPLIANT
+  strerror(0);                    // NON-COMPLIANT
+  asctime(NULL);                  // NON-COMPLIANT
+  ctime(NULL);                    // NON-COMPLIANT
+  gmtime(NULL);                   // NON-COMPLIANT
+  localtime(NULL);                // NON-COMPLIANT
+  mbrtoc16(NULL, NULL, 0, NULL);  // NON-COMPLIANT
+  mbrtoc32(NULL, NULL, 0, NULL);  // NON-COMPLIANT
+  c16rtomb(NULL, 0, NULL);        // NON-COMPLIANT
+  c32rtomb(NULL, 0, NULL);        // NON-COMPLIANT
+  mbrlen(NULL, 0, NULL);          // NON-COMPLIANT
+  mbrtowc(NULL, NULL, 0, NULL);   // NON-COMPLIANT
+  wcrtomb(NULL, 0, NULL);         // NON-COMPLIANT
+  mbsrtowcs(NULL, NULL, 0, NULL); // NON-COMPLIANT
+  wcsrtombs(NULL, NULL, 0, NULL); // NON-COMPLIANT
+}
+
+int main(int argc, char *argv[]) {
+  thrd_t single_thread1;
+  thrd_t many_thread2;
+  thrd_t single_thread3;
+  thrd_t single_thread4;
+  thrd_t many_thread5;
+  thrd_t single_thread6;
+  thrd_t single_thread7;
+  thrd_t many_thread8;
+  thrd_t single_thread9;
+  thrd_t single_thread10;
+  thrd_t single_thread11;
+  thrd_t single_thread12;
+  thrd_t many_thread13;
+
+  thrd_create(&single_thread1, single_thread1_reads_g1, NULL);
+  thrd_create(&single_thread3, single_thread3_reads_g2, NULL);
+  thrd_create(&single_thread4, single_thread4_writes_g2, NULL);
+  thrd_create(&single_thread6, single_thread6_reads_g4_locked, NULL);
+  thrd_create(&single_thread7, single_thread7_writes_g4_locked, NULL);
+  thrd_create(&single_thread9, single_thread9_writes_g6_m1, NULL);
+  thrd_create(&single_thread10, single_thread10_writes_g6_m2, NULL);
+  thrd_create(&single_thread11, single_thread11_writes_g7_m1, NULL);
+  thrd_create(&single_thread12, single_thread12_writes_g7_m1, NULL);
+  for (;;) {
+    thrd_create(&many_thread2, many_thread2_reads_g1, NULL);
+    thrd_create(&many_thread5, many_thread5_writes_g3, NULL);
+    thrd_create(&many_thread8, many_thread8_writes_g5_locked, NULL);
+    thrd_create(&many_thread13, many_thread13_calls_nonreentrant_funcs, NULL);
+  }
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-5-2/NotNoDeadlocksBetweenThreads.testref b/c/misra/test/rules/DIR-5-2/NotNoDeadlocksBetweenThreads.testref
new file mode 100644
index 0000000000..4625d1a24d
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-2/NotNoDeadlocksBetweenThreads.testref
@@ -0,0 +1 @@
+c/common/test/rules/preventdeadlockbylockinginpredefinedorder/PreventDeadlockByLockingInPredefinedOrder.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-5-3/BannedDynamicThreadCreation.expected b/c/misra/test/rules/DIR-5-3/BannedDynamicThreadCreation.expected
new file mode 100644
index 0000000000..3bc3ab579a
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-3/BannedDynamicThreadCreation.expected
@@ -0,0 +1,16 @@
+| test.c:30:3:30:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:29:6:29:34 | make_threads_called_from_main | make_threads_called_from_main |
+| test.c:31:3:31:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:29:6:29:34 | make_threads_called_from_main | make_threads_called_from_main |
+| test.c:39:3:39:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:38:6:38:51 | make_threads_called_from_func_called_from_main | make_threads_called_from_func_called_from_main |
+| test.c:40:3:40:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:38:6:38:51 | make_threads_called_from_func_called_from_main | make_threads_called_from_func_called_from_main |
+| test.c:49:3:49:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:48:7:48:18 | pthread_func | pthread_func |
+| test.c:50:3:50:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:48:7:48:18 | pthread_func | pthread_func |
+| test.c:58:3:58:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:57:5:57:13 | thrd_func | thrd_func |
+| test.c:59:3:59:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:57:5:57:13 | thrd_func | thrd_func |
+| test.c:67:3:67:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:66:6:66:39 | make_threads_called_from_thrd_func | make_threads_called_from_thrd_func |
+| test.c:68:3:68:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:66:6:66:39 | make_threads_called_from_thrd_func | make_threads_called_from_thrd_func |
+| test.c:76:3:76:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:75:6:75:59 | make_threads_called_from_func_called_from_pthread_thrd | make_threads_called_from_func_called_from_pthread_thrd |
+| test.c:77:3:77:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:75:6:75:59 | make_threads_called_from_func_called_from_pthread_thrd | make_threads_called_from_func_called_from_pthread_thrd |
+| test.c:81:3:81:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:80:6:80:47 | make_threads_called_from_main_pthread_thrd | make_threads_called_from_main_pthread_thrd |
+| test.c:82:3:82:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:80:6:80:47 | make_threads_called_from_main_pthread_thrd | make_threads_called_from_main_pthread_thrd |
+| test.c:86:3:86:13 | call to thrd_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:85:6:85:38 | make_threads_not_called_by_anyone | make_threads_not_called_by_anyone |
+| test.c:87:3:87:16 | call to pthread_create | Possible dynamic creation of thread outside initialization in function '$@'. | test.c:85:6:85:38 | make_threads_not_called_by_anyone | make_threads_not_called_by_anyone |
diff --git a/c/misra/test/rules/DIR-5-3/BannedDynamicThreadCreation.qlref b/c/misra/test/rules/DIR-5-3/BannedDynamicThreadCreation.qlref
new file mode 100644
index 0000000000..16c9614cec
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-3/BannedDynamicThreadCreation.qlref
@@ -0,0 +1 @@
+rules/DIR-5-3/BannedDynamicThreadCreation.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-5-3/ThreadCreatedByThread.expected b/c/misra/test/rules/DIR-5-3/ThreadCreatedByThread.expected
new file mode 100644
index 0000000000..b8dc2bfe4b
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-3/ThreadCreatedByThread.expected
@@ -0,0 +1,14 @@
+| test.c:49:3:49:13 | call to thrd_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:48:7:48:18 | pthread_func | pthread_func | test.c:19:3:19:16 | call to pthread_create | started as a thread |
+| test.c:50:3:50:16 | call to pthread_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:48:7:48:18 | pthread_func | pthread_func | test.c:19:3:19:16 | call to pthread_create | started as a thread |
+| test.c:58:3:58:13 | call to thrd_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
+| test.c:59:3:59:16 | call to pthread_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
+| test.c:67:3:67:13 | call to thrd_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
+| test.c:68:3:68:16 | call to pthread_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
+| test.c:76:3:76:13 | call to thrd_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:48:7:48:18 | pthread_func | pthread_func | test.c:19:3:19:16 | call to pthread_create | started as a thread |
+| test.c:76:3:76:13 | call to thrd_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
+| test.c:77:3:77:16 | call to pthread_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:48:7:48:18 | pthread_func | pthread_func | test.c:19:3:19:16 | call to pthread_create | started as a thread |
+| test.c:77:3:77:16 | call to pthread_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
+| test.c:81:3:81:13 | call to thrd_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:48:7:48:18 | pthread_func | pthread_func | test.c:19:3:19:16 | call to pthread_create | started as a thread |
+| test.c:81:3:81:13 | call to thrd_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
+| test.c:82:3:82:16 | call to pthread_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:48:7:48:18 | pthread_func | pthread_func | test.c:19:3:19:16 | call to pthread_create | started as a thread |
+| test.c:82:3:82:16 | call to pthread_create | Thread creation call reachable from function '$@', which may also be $@. | test.c:57:5:57:13 | thrd_func | thrd_func | test.c:18:3:18:13 | call to thrd_create | started as a thread |
diff --git a/c/misra/test/rules/DIR-5-3/ThreadCreatedByThread.qlref b/c/misra/test/rules/DIR-5-3/ThreadCreatedByThread.qlref
new file mode 100644
index 0000000000..99cecb8311
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-3/ThreadCreatedByThread.qlref
@@ -0,0 +1 @@
+rules/DIR-5-3/ThreadCreatedByThread.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/DIR-5-3/test.c b/c/misra/test/rules/DIR-5-3/test.c
new file mode 100644
index 0000000000..16eb580276
--- /dev/null
+++ b/c/misra/test/rules/DIR-5-3/test.c
@@ -0,0 +1,88 @@
+#include "pthread.h"
+#include "threads.h"
+
+thrd_t g1;    // COMPLIANT
+pthread_t g2; // COMPLIANT
+
+void *pthread_func(void *arg);
+void *pthread_func_inner(void *arg);
+int thrd_func(void *arg);
+int thrd_func_inner(void *arg);
+
+void make_threads_called_from_main(void);
+void func_called_from_main(void);
+void make_threads_called_from_func_called_from_main(void);
+void make_threads_called_from_main_pthread_thrd(void);
+
+int main(int argc, char *argv[]) {
+  thrd_create(&g1, &thrd_func, NULL);             // COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func, NULL); // COMPLIANT
+
+  thrd_create(&g1, &thrd_func_inner, NULL);             // COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // COMPLIANT
+
+  make_threads_called_from_main();
+  func_called_from_main();
+  make_threads_called_from_main_pthread_thrd();
+}
+
+void make_threads_called_from_main() {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // COMPLIANT
+}
+
+void func_called_from_main() {
+  make_threads_called_from_func_called_from_main();
+}
+
+void make_threads_called_from_func_called_from_main() {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // COMPLIANT
+}
+
+void make_threads_called_from_pthread_func(void);
+void make_threads_called_from_thrd_func(void);
+void func_called_from_pthread_thrd(void);
+void make_threads_called_from_func_called_from_pthread_thrd(void);
+
+void *pthread_func(void *arg) {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // NON-COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // NON-COMPLIANT
+
+  make_threads_called_from_pthread_func();
+  func_called_from_pthread_thrd();
+  make_threads_called_from_main_pthread_thrd();
+}
+
+int thrd_func(void *arg) {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // NON-COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // NON-COMPLIANT
+
+  make_threads_called_from_thrd_func();
+  func_called_from_pthread_thrd();
+  make_threads_called_from_main_pthread_thrd();
+}
+
+void make_threads_called_from_thrd_func(void) {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // NON-COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // NON-COMPLIANT
+}
+
+void func_called_from_pthread_thrd(void) {
+  make_threads_called_from_func_called_from_pthread_thrd();
+}
+
+void make_threads_called_from_func_called_from_pthread_thrd(void) {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // NON-COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // NON-COMPLIANT
+}
+
+void make_threads_called_from_main_pthread_thrd() {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // NON-COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // NON-COMPLIANT
+}
+
+void make_threads_not_called_by_anyone() {
+  thrd_create(&g1, &thrd_func_inner, NULL);             // COMPLIANT
+  pthread_create(&g2, NULL, &pthread_func_inner, NULL); // COMPLIANT
+}
diff --git a/c/misra/test/rules/RULE-1-4/EmergentLanguageFeaturesUsed.expected b/c/misra/test/rules/RULE-1-4/EmergentLanguageFeaturesUsed.expected
index 2745223358..3f63a6c26c 100644
--- a/c/misra/test/rules/RULE-1-4/EmergentLanguageFeaturesUsed.expected
+++ b/c/misra/test/rules/RULE-1-4/EmergentLanguageFeaturesUsed.expected
@@ -1,15 +1 @@
-| test.c:1:1:1:21 | #include <stdalign.h> | Usage of emergent language feature. |
-| test.c:2:1:2:22 | #include <stdatomic.h> | Usage of emergent language feature. |
-| test.c:3:1:3:24 | #include <stdnoreturn.h> | Usage of emergent language feature. |
-| test.c:4:1:4:20 | #include <threads.h> | Usage of emergent language feature. |
-| test.c:6:1:6:49 | #define MACRO(x) _Generic((x), int : 0, long : 1) | Usage of emergent language feature. |
 | test.c:7:1:7:32 | #define __STDC_WANT_LIB_EXT1__ 1 | Usage of emergent language feature. |
-| test.c:9:16:9:17 | f0 | Usage of emergent language feature. |
-| test.c:12:26:12:40 | atomic_new_type | Usage of emergent language feature. |
-| test.c:17:15:17:15 | i | Usage of emergent language feature. |
-| test.c:19:3:19:10 | alignas(...) | Usage of emergent language feature. |
-| test.c:20:3:20:9 | alignas(...) | Usage of emergent language feature. |
-| test.c:21:11:21:23 | alignof(int) | Usage of emergent language feature. |
-| test.c:22:12:22:23 | alignof(int) | Usage of emergent language feature. |
-| test.c:24:27:24:28 | i3 | Usage of emergent language feature. |
-| test.c:25:28:25:29 | i4 | Usage of emergent language feature. |
diff --git a/c/misra/test/rules/RULE-1-4/test.c b/c/misra/test/rules/RULE-1-4/test.c
index 153c722c94..5bea219b54 100644
--- a/c/misra/test/rules/RULE-1-4/test.c
+++ b/c/misra/test/rules/RULE-1-4/test.c
@@ -1,26 +1,26 @@
-#include <stdalign.h>    //NON_COMPLIANT
-#include <stdatomic.h>   //NON_COMPLIANT
-#include <stdnoreturn.h> //NON_COMPLIANT
-#include <threads.h>     //NON_COMPLIANT
+#include <stdalign.h>    //COMPLIANT
+#include <stdatomic.h>   //COMPLIANT
+#include <stdnoreturn.h> //COMPLIANT
+#include <threads.h>     //COMPLIANT
 
-#define MACRO(x) _Generic((x), int : 0, long : 1) // NON_COMPLIANT
+#define MACRO(x) _Generic((x), int : 0, long : 1) // COMPLIANT
 #define __STDC_WANT_LIB_EXT1__ 1                  // NON_COMPLIANT
 
-_Noreturn void f0(); // NON_COMPLIANT
+_Noreturn void f0(); // COMPLIANT
 
 typedef int new_type;                     // COMPLIANT
-typedef _Atomic new_type atomic_new_type; // NON_COMPLIANT
+typedef _Atomic new_type atomic_new_type; // COMPLIANT
 
 void f(int p) {
-  int i0 = _Generic(p, int : 0, long : 1); // NON_COMPLIANT[FALSE_NEGATIVE]
+  int i0 = _Generic(p, int : 0, long : 1); // COMPLIANT
 
-  _Atomic int i; // NON_COMPLIANT
+  _Atomic int i; // NON-COMPLIANT
 
-  _Alignas(4) int i1;    // NON_COMPLIANT
-  alignas(4) int i2;     // NON_COMPLIANT
-  int a = _Alignof(int); // NON_COMPLIANT
-  int a1 = alignof(int); // NON_COMPLIANT
+  _Alignas(4) int i1;    // COMPLIANT
+  alignas(4) int i2;     // COMPLIANT
+  int a = _Alignof(int); // COMPLIANT
+  int a1 = alignof(int); // COMPLIANT
 
-  static thread_local int i3;  // NON_COMPLIANT
-  static _Thread_local int i4; // NON_COMPLIANT
+  static thread_local int i3;  // COMPLIANT
+  static _Thread_local int i4; // COMPLIANT
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-1-5/UngetcCallOnStreamPositionZero.expected b/c/misra/test/rules/RULE-1-5/UngetcCallOnStreamPositionZero.expected
index ff25a58e3c..fb8d44ea19 100644
--- a/c/misra/test/rules/RULE-1-5/UngetcCallOnStreamPositionZero.expected
+++ b/c/misra/test/rules/RULE-1-5/UngetcCallOnStreamPositionZero.expected
@@ -1,7 +1,9 @@
 edges
+| test.c:39:16:39:20 | *call to fopen | test.c:39:16:39:20 | *call to fopen | provenance |  |
 | test.c:39:16:39:20 | *call to fopen | test.c:41:15:41:18 | *file | provenance |  |
 nodes
 | test.c:39:16:39:20 | *call to fopen | semmle.label | *call to fopen |
+| test.c:39:16:39:20 | *call to fopen | semmle.label | *call to fopen |
 | test.c:41:15:41:18 | *file | semmle.label | *file |
 subpaths
 #select
diff --git a/c/misra/test/rules/RULE-1-5/UseOfObsoleteMacroAtomicVarInit.expected.gcc b/c/misra/test/rules/RULE-1-5/UseOfObsoleteMacroAtomicVarInit.expected.gcc
new file mode 100644
index 0000000000..cb8e72ff0f
--- /dev/null
+++ b/c/misra/test/rules/RULE-1-5/UseOfObsoleteMacroAtomicVarInit.expected.gcc
@@ -0,0 +1 @@
+| test.c:29:18:29:36 | ATOMIC_VAR_INIT(VALUE) | Usage of macro ATOMIC_VAR_INIT() is declared obscelescent in C18, and discouraged in earlier C versions. |
diff --git a/c/misra/test/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.expected b/c/misra/test/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.expected
index 8d1b1d8d1b..7a8fd1e07c 100644
--- a/c/misra/test/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.expected
+++ b/c/misra/test/rules/RULE-10-1/OperandsOfAnInappropriateEssentialType.expected
@@ -1,191 +1,209 @@
-| test.c:13:5:13:5 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:14:5:14:5 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:20:4:20:4 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:21:4:21:4 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:22:4:22:5 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:27:4:27:4 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:28:4:28:4 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:29:4:29:5 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:31:4:31:4 | u | Operand of essentially Unsigned type will be converted to a signed type with the signedness dependent on the implemented size of int. |
-| test.c:34:7:34:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:36:7:36:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:41:7:41:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:43:7:43:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:48:3:48:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:50:3:50:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:15:5:15:5 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:16:5:16:5 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:23:4:23:4 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:24:4:24:4 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:25:4:25:5 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:31:4:31:4 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:32:4:32:4 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:33:4:33:5 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:35:4:35:4 | u | Operand of essentially Unsigned type will be converted to a signed type with the signedness dependent on the implemented size of int. |
+| test.c:39:7:39:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:41:7:41:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:47:7:47:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:49:7:49:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
 | test.c:55:3:55:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
 | test.c:57:3:57:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:62:3:62:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:64:3:64:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:69:3:69:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:71:3:71:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:76:5:76:5 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:78:5:78:6 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:83:5:83:5 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:85:5:85:6 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:90:7:90:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:91:7:91:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:92:7:92:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:97:7:97:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:98:7:98:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:99:7:99:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:104:3:104:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:105:3:105:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:106:3:106:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:111:3:111:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:112:3:112:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:113:3:113:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:118:3:118:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:119:3:119:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:120:3:120:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:125:7:125:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:126:7:126:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:127:7:127:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:132:7:132:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:139:7:139:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:146:8:146:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:153:8:153:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:160:3:160:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:167:3:167:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:174:3:174:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:181:3:181:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:217:4:217:4 | c | Operand of essentially Character type type interpreted as a Boolean value. |
-| test.c:218:4:218:5 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
-| test.c:219:4:219:4 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
-| test.c:220:4:220:4 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
-| test.c:221:4:221:4 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
-| test.c:224:3:224:3 | c | Operand of essentially Character type type interpreted as a Boolean value. |
-| test.c:225:3:225:4 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
-| test.c:226:3:226:3 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
-| test.c:227:3:227:3 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
-| test.c:228:3:228:3 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
-| test.c:231:3:231:3 | c | Operand of essentially Character type type interpreted as a Boolean value. |
-| test.c:232:3:232:4 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
-| test.c:233:3:233:3 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
-| test.c:234:3:234:3 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
-| test.c:235:3:235:3 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
-| test.c:238:11:238:11 | c | Operand of essentially Character type type interpreted as a Boolean value. |
-| test.c:239:11:239:12 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
-| test.c:240:11:240:11 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
-| test.c:241:11:241:11 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
-| test.c:242:11:242:11 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
-| test.c:245:12:245:12 | c | Operand of essentially Character type type interpreted as a Boolean value. |
-| test.c:246:12:246:13 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
-| test.c:247:12:247:12 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
-| test.c:248:12:248:12 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
-| test.c:249:12:249:12 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
-| test.c:251:3:251:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:252:3:252:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:253:3:253:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:254:3:254:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:258:3:258:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:259:3:259:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:260:3:260:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:261:3:261:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:265:8:265:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:266:8:266:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:267:8:267:9 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
-| test.c:268:8:268:8 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
-| test.c:272:8:272:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:273:8:273:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:274:8:274:9 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
-| test.c:275:8:275:8 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
-| test.c:279:3:279:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:280:3:280:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:281:3:281:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:282:3:282:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:286:3:286:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:287:3:287:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:288:3:288:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:289:3:289:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:293:3:293:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:294:3:294:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:295:3:295:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:296:3:296:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:300:6:300:6 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:301:6:301:6 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:302:6:302:7 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:303:6:303:6 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:307:7:307:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:308:7:308:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:309:7:309:8 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:310:7:310:7 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:314:7:314:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:315:7:315:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:316:7:316:8 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:317:7:317:7 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:321:4:321:4 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:322:4:322:4 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:323:4:323:5 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:324:4:324:4 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:329:3:329:3 | c | Operand of essentially Character type type interpreted as a Boolean value. |
-| test.c:330:3:330:4 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
-| test.c:331:3:331:3 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
-| test.c:332:3:332:3 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
-| test.c:333:3:333:3 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
-| test.c:342:3:342:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:344:3:344:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:349:3:349:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:351:3:351:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:356:8:356:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:358:8:358:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:363:8:363:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:365:8:365:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:370:3:370:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:371:3:371:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:372:3:372:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:377:3:377:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:378:3:378:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:379:3:379:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:384:8:384:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:385:8:385:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:386:8:386:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:391:8:391:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:392:8:392:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:393:8:393:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:398:3:398:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:399:3:399:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:400:3:400:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:405:8:405:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:406:8:406:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:407:8:407:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
-| test.c:412:3:412:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:413:3:413:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:414:3:414:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:415:3:415:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:419:3:419:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:420:3:420:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:421:3:421:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:422:3:422:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:426:9:426:9 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:427:9:427:9 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:428:9:428:10 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
-| test.c:429:9:429:9 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
-| test.c:433:9:433:9 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:434:9:434:9 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:435:9:435:10 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
-| test.c:436:9:436:9 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
-| test.c:440:3:440:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:441:3:441:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:442:3:442:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:443:3:443:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:63:3:63:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:65:3:65:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:71:3:71:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:73:3:73:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:77:3:77:4 | cf | Use of essentially Complex type in this way is a constraint violation. |
+| test.c:79:3:79:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:81:3:81:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:85:3:85:4 | cf | Use of essentially Complex type in this way is a constraint violation. |
+| test.c:87:5:87:5 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:89:5:89:6 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:93:5:93:6 | cf | Use of essentially Complex type in this way is a constraint violation. |
+| test.c:95:5:95:5 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:97:5:97:6 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:101:5:101:6 | cf | Use of essentially Complex type in this way is a constraint violation. |
+| test.c:103:7:103:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:104:7:104:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:105:7:105:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:111:7:111:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:112:7:112:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:113:7:113:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:119:3:119:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:120:3:120:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:121:3:121:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:127:3:127:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:128:3:128:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:129:3:129:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:135:3:135:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:136:3:136:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:137:3:137:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:143:7:143:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:144:7:144:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:145:7:145:8 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:151:7:151:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:159:7:159:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:167:8:167:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:175:8:175:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:183:3:183:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:191:3:191:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:199:3:199:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:207:3:207:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:220:3:220:3 | f | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:221:3:221:4 | cf | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:234:3:234:3 | f | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:235:3:235:4 | cf | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:248:8:248:8 | f | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:249:8:249:9 | cf | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:262:8:262:8 | f | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:263:8:263:9 | cf | Floating point numbers have inherent error such that comparisons should consider precision and not exact equality. |
+| test.c:272:4:272:4 | c | Operand of essentially Character type type interpreted as a Boolean value. |
+| test.c:273:4:273:5 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
+| test.c:274:4:274:4 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
+| test.c:275:4:275:4 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
+| test.c:276:4:276:4 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
+| test.c:277:4:277:5 | cf | Operand of essentially Complex Floating type type interpreted as a Boolean value. |
+| test.c:280:3:280:3 | c | Operand of essentially Character type type interpreted as a Boolean value. |
+| test.c:281:3:281:4 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
+| test.c:282:3:282:3 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
+| test.c:283:3:283:3 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
+| test.c:284:3:284:3 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
+| test.c:285:3:285:4 | cf | Operand of essentially Complex Floating type type interpreted as a Boolean value. |
+| test.c:288:3:288:3 | c | Operand of essentially Character type type interpreted as a Boolean value. |
+| test.c:289:3:289:4 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
+| test.c:290:3:290:3 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
+| test.c:291:3:291:3 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
+| test.c:292:3:292:3 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
+| test.c:293:3:293:4 | cf | Operand of essentially Complex Floating type type interpreted as a Boolean value. |
+| test.c:296:11:296:11 | c | Operand of essentially Character type type interpreted as a Boolean value. |
+| test.c:297:11:297:12 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
+| test.c:298:11:298:11 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
+| test.c:299:11:299:11 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
+| test.c:300:11:300:11 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
+| test.c:301:11:301:12 | cf | Operand of essentially Complex Floating type type interpreted as a Boolean value. |
+| test.c:304:12:304:12 | c | Operand of essentially Character type type interpreted as a Boolean value. |
+| test.c:305:12:305:13 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
+| test.c:306:12:306:12 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
+| test.c:307:12:307:12 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
+| test.c:308:12:308:12 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
+| test.c:309:12:309:13 | cf | Operand of essentially Complex Floating type type interpreted as a Boolean value. |
+| test.c:311:3:311:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:312:3:312:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:313:3:313:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:314:3:314:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:319:3:319:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:320:3:320:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:321:3:321:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:322:3:322:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:327:8:327:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:328:8:328:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:329:8:329:9 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
+| test.c:330:8:330:8 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
+| test.c:335:8:335:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:336:8:336:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:337:8:337:9 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
+| test.c:338:8:338:8 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
+| test.c:343:3:343:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:344:3:344:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:345:3:345:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:346:3:346:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:351:3:351:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:352:3:352:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:353:3:353:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:354:3:354:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:359:3:359:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:360:3:360:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:361:3:361:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:362:3:362:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:367:6:367:6 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:368:6:368:6 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:369:6:369:7 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:370:6:370:6 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:375:7:375:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:376:7:376:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:377:7:377:8 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:378:7:378:7 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:383:7:383:7 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:384:7:384:7 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:385:7:385:8 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:386:7:386:7 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:391:4:391:4 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:392:4:392:4 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:393:4:393:5 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:394:4:394:4 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:400:3:400:3 | c | Operand of essentially Character type type interpreted as a Boolean value. |
+| test.c:401:3:401:4 | e1 | Operand of essentially Enum Type type interpreted as a Boolean value. |
+| test.c:402:3:402:3 | s | Operand of essentially Signed type type interpreted as a Boolean value. |
+| test.c:403:3:403:3 | u | Operand of essentially Unsigned type type interpreted as a Boolean value. |
+| test.c:404:3:404:3 | f | Operand of essentially Floating type type interpreted as a Boolean value. |
+| test.c:405:3:405:4 | cf | Operand of essentially Complex Floating type type interpreted as a Boolean value. |
+| test.c:415:3:415:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:417:3:417:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:423:3:423:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:425:3:425:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:431:8:431:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:433:8:433:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:439:8:439:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:441:8:441:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
 | test.c:447:3:447:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
 | test.c:448:3:448:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:449:3:449:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:450:3:450:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:454:3:454:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:455:3:455:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:456:3:456:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:457:3:457:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:461:8:461:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:462:8:462:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:463:8:463:9 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:464:8:464:8 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:468:8:468:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:469:8:469:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:470:8:470:9 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:471:8:471:8 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
-| test.c:475:8:475:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
-| test.c:476:8:476:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
-| test.c:477:8:477:9 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
-| test.c:478:8:478:8 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:449:3:449:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:455:3:455:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:456:3:456:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:457:3:457:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:463:8:463:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:464:8:464:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:465:8:465:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:471:8:471:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:472:8:472:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:473:8:473:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:479:3:479:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:480:3:480:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:481:3:481:4 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:487:8:487:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:488:8:488:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:489:8:489:9 | e1 | Operand of essentially Enum type used in arithmetic operation, but has an implementation defined integer type. |
+| test.c:495:3:495:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:496:3:496:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:497:3:497:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:498:3:498:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:503:3:503:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:504:3:504:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:505:3:505:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:506:3:506:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:511:9:511:9 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:512:9:512:9 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:513:9:513:10 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
+| test.c:514:9:514:9 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
+| test.c:519:9:519:9 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:520:9:520:9 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:521:9:521:10 | e1 | Right hand operand of shift operator is essentially Enum Type and not not essentially unsigned. |
+| test.c:522:9:522:9 | s | Right hand operand of shift operator is essentially Signed type and not not essentially unsigned. |
+| test.c:527:3:527:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:528:3:528:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:529:3:529:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:530:3:530:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:535:3:535:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:536:3:536:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:537:3:537:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:538:3:538:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:543:3:543:3 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:544:3:544:3 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:545:3:545:4 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:546:3:546:3 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:551:8:551:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:552:8:552:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:553:8:553:9 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:554:8:554:8 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:559:8:559:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:560:8:560:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:561:8:561:9 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:562:8:562:8 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
+| test.c:567:8:567:8 | b | Operand of essentially Boolean type interpreted as a numeric value. |
+| test.c:568:8:568:8 | c | Operand of essentially Charater type interpreted as a numeric value. |
+| test.c:569:8:569:9 | e1 | Bitwise operator applied to operand of essentially Enum Type and not essentially unsigned. |
+| test.c:570:8:570:8 | s | Bitwise operator applied to operand of essentially Signed type and not essentially unsigned. |
diff --git a/c/misra/test/rules/RULE-10-1/PointerTypeOnLogicalOperator.expected b/c/misra/test/rules/RULE-10-1/PointerTypeOnLogicalOperator.expected
index 35a55919fd..34d2993389 100644
--- a/c/misra/test/rules/RULE-10-1/PointerTypeOnLogicalOperator.expected
+++ b/c/misra/test/rules/RULE-10-1/PointerTypeOnLogicalOperator.expected
@@ -1,5 +1,5 @@
-| test.c:488:4:488:4 | p | Logical operators should not be used with pointer types. |
-| test.c:490:3:490:3 | p | Logical operators should not be used with pointer types. |
-| test.c:491:7:491:7 | p | Logical operators should not be used with pointer types. |
-| test.c:493:3:493:3 | p | Logical operators should not be used with pointer types. |
-| test.c:494:8:494:8 | p | Logical operators should not be used with pointer types. |
+| test.c:581:4:581:4 | p | Logical operators should not be used with pointer types. |
+| test.c:583:3:583:3 | p | Logical operators should not be used with pointer types. |
+| test.c:584:7:584:7 | p | Logical operators should not be used with pointer types. |
+| test.c:586:3:586:3 | p | Logical operators should not be used with pointer types. |
+| test.c:587:8:587:8 | p | Logical operators should not be used with pointer types. |
diff --git a/c/misra/test/rules/RULE-10-1/test.c b/c/misra/test/rules/RULE-10-1/test.c
index 19b7d2e3e8..3b96c7151d 100644
--- a/c/misra/test/rules/RULE-10-1/test.c
+++ b/c/misra/test/rules/RULE-10-1/test.c
@@ -1,3 +1,4 @@
+#include "math.h"
 #include "stdbool.h"
 
 void testInappropriateOperands() {
@@ -7,6 +8,7 @@ void testInappropriateOperands() {
   signed int s = 100;
   unsigned int u = 1;
   float f = 1.0;
+  float _Complex cf = 1.0 + 1.0i;
 
   int a[20];
 
@@ -16,6 +18,7 @@ void testInappropriateOperands() {
   a[s];  // COMPLIANT
   a[u];  // COMPLIANT
   // a[f];  // NON_COMPILABLE
+  // a[cf]; // NON_COMPILABLE
 
   +b;  // NON_COMPLIANT
   +c;  // NON_COMPLIANT
@@ -23,6 +26,7 @@ void testInappropriateOperands() {
   +s;  // COMPLIANT
   +u;  // COMPLIANT
   +f;  // COMPLIANT
+  +cf; // COMPLIANT
 
   -b;  // NON_COMPLIANT
   -c;  // NON_COMPLIANT
@@ -30,6 +34,7 @@ void testInappropriateOperands() {
   -s;  // COMPLIANT
   -u;  // NON_COMPLIANT
   -f;  // COMPLIANT
+  -cf; // COMPLIANT
 
   1 + b;  // NON_COMPLIANT
   1 + c;  // COMPLIANT
@@ -37,6 +42,7 @@ void testInappropriateOperands() {
   1 + s;  // COMPLIANT
   1 + u;  // COMPLIANT
   1 + f;  // COMPLIANT
+  1 + cf; // COMPLIANT
 
   1 - b;  // NON_COMPLIANT
   1 - c;  // COMPLIANT
@@ -44,6 +50,7 @@ void testInappropriateOperands() {
   1 - s;  // COMPLIANT
   1 - u;  // COMPLIANT
   1 - f;  // COMPLIANT
+  1 - cf; // COMPLIANT
 
   b + 1;  // NON_COMPLIANT
   c + 1;  // COMPLIANT
@@ -51,6 +58,7 @@ void testInappropriateOperands() {
   s + 1;  // COMPLIANT
   u + 1;  // COMPLIANT
   f + 1;  // COMPLIANT
+  cf + 1; // COMPLIANT
 
   b - 1;  // NON_COMPLIANT
   c - 1;  // COMPLIANT
@@ -58,6 +66,7 @@ void testInappropriateOperands() {
   s - 1;  // COMPLIANT
   u - 1;  // COMPLIANT
   f - 1;  // COMPLIANT
+  cf - 1; // COMPLIANT
 
   b++;  // NON_COMPLIANT
   c++;  // COMPLIANT
@@ -65,6 +74,7 @@ void testInappropriateOperands() {
   s++;  // COMPLIANT
   u++;  // COMPLIANT
   f++;  // COMPLIANT
+  cf++; // NON_COMPLIANT
 
   b--;  // NON_COMPLIANT
   c--;  // COMPLIANT
@@ -72,6 +82,7 @@ void testInappropriateOperands() {
   s--;  // COMPLIANT
   u--;  // COMPLIANT
   f--;  // COMPLIANT
+  cf--; // NON_COMPLIANT
 
   ++b;  // NON_COMPLIANT
   ++c;  // COMPLIANT
@@ -79,6 +90,7 @@ void testInappropriateOperands() {
   ++s;  // COMPLIANT
   ++u;  // COMPLIANT
   ++f;  // COMPLIANT
+  ++cf; // NON_COMPLIANT
 
   --b;  // NON_COMPLIANT
   --c;  // COMPLIANT
@@ -86,6 +98,7 @@ void testInappropriateOperands() {
   --s;  // COMPLIANT
   --u;  // COMPLIANT
   --f;  // COMPLIANT
+  --cf; // NON_COMPLIANT
 
   1 * b;  // NON_COMPLIANT
   1 * c;  // NON_COMPLIANT
@@ -93,6 +106,7 @@ void testInappropriateOperands() {
   1 * s;  // COMPLIANT
   1 * u;  // COMPLIANT
   1 * f;  // COMPLIANT
+  1 * cf; // COMPLIANT
 
   1 / b;  // NON_COMPLIANT
   1 / c;  // NON_COMPLIANT
@@ -100,6 +114,7 @@ void testInappropriateOperands() {
   1 / s;  // COMPLIANT
   1 / u;  // COMPLIANT
   1 / f;  // COMPLIANT
+  1 / cf; // COMPLIANT
 
   b * 1;  // NON_COMPLIANT
   c * 1;  // NON_COMPLIANT
@@ -107,6 +122,7 @@ void testInappropriateOperands() {
   s * 1;  // COMPLIANT
   u * 1;  // COMPLIANT
   f * 1;  // COMPLIANT
+  cf * 1; // COMPLIANT
 
   b / 1;  // NON_COMPLIANT
   c / 1;  // NON_COMPLIANT
@@ -114,6 +130,7 @@ void testInappropriateOperands() {
   s / 1;  // COMPLIANT
   u / 1;  // COMPLIANT
   f / 1;  // COMPLIANT
+  cf / 1; // COMPLIANT
 
   b % 1;  // NON_COMPLIANT
   c % 1;  // NON_COMPLIANT
@@ -121,6 +138,7 @@ void testInappropriateOperands() {
   s % 1;  // COMPLIANT
   u % 1;  // COMPLIANT
   // f % 1;  // NON_COMPILABLE
+  // cf % 1;  // NON_COMPILABLE
 
   1 % b;  // NON_COMPLIANT
   1 % c;  // NON_COMPLIANT
@@ -128,6 +146,7 @@ void testInappropriateOperands() {
   1 % s;  // COMPLIANT
   1 % u;  // COMPLIANT
   // 1 % f;  // NON_COMPILABLE
+  // 1 % cf;  // NON_COMPILABLE
 
   1 < b;  // NON_COMPLIANT
   1 < c;  // COMPLIANT
@@ -135,6 +154,7 @@ void testInappropriateOperands() {
   1 < s;  // COMPLIANT
   1 < u;  // COMPLIANT
   1 < f;  // COMPLIANT
+  // 1 < cf;  // NON_COMPILABLE
 
   1 > b;  // NON_COMPLIANT
   1 > c;  // COMPLIANT
@@ -142,6 +162,7 @@ void testInappropriateOperands() {
   1 > s;  // COMPLIANT
   1 > u;  // COMPLIANT
   1 > f;  // COMPLIANT
+  // 1 > cf;  // NON_COMPILABLE
 
   1 <= b;  // NON_COMPLIANT
   1 <= c;  // COMPLIANT
@@ -149,6 +170,7 @@ void testInappropriateOperands() {
   1 <= s;  // COMPLIANT
   1 <= u;  // COMPLIANT
   1 <= f;  // COMPLIANT
+  // 1 <= cf;  // NON_COMPILABLE
 
   1 >= b;  // NON_COMPLIANT
   1 >= c;  // COMPLIANT
@@ -156,6 +178,7 @@ void testInappropriateOperands() {
   1 >= s;  // COMPLIANT
   1 >= u;  // COMPLIANT
   1 >= f;  // COMPLIANT
+  // 1 >= cf;  // NON_COMPILABLE
 
   b < 1;  // NON_COMPLIANT
   c < 1;  // COMPLIANT
@@ -163,6 +186,7 @@ void testInappropriateOperands() {
   s < 1;  // COMPLIANT
   u < 1;  // COMPLIANT
   f < 1;  // COMPLIANT
+  // cf < 1;  // NON_COMPILABLE
 
   b > 1;  // NON_COMPLIANT
   c > 1;  // COMPLIANT
@@ -170,6 +194,7 @@ void testInappropriateOperands() {
   s > 1;  // COMPLIANT
   u > 1;  // COMPLIANT
   f > 1;  // COMPLIANT
+  // cf > 1;  // NON_COMPILABLE
 
   b <= 1;  // NON_COMPLIANT
   c <= 1;  // COMPLIANT
@@ -177,6 +202,7 @@ void testInappropriateOperands() {
   s <= 1;  // COMPLIANT
   u <= 1;  // COMPLIANT
   f <= 1;  // COMPLIANT
+  // cf <= 1;  // NON_COMPILABLE
 
   b >= 1;  // NON_COMPLIANT
   c >= 1;  // COMPLIANT
@@ -184,34 +210,63 @@ void testInappropriateOperands() {
   s >= 1;  // COMPLIANT
   u >= 1;  // COMPLIANT
   f >= 1;  // COMPLIANT
-
-  b == 1;  // COMPLIANT
-  c == 1;  // COMPLIANT
-  e1 == 1; // COMPLIANT
-  s == 1;  // COMPLIANT
-  u == 1;  // COMPLIANT
-  f == 1;  // COMPLIANT
-
-  b != 1;  // COMPLIANT
-  c != 1;  // COMPLIANT
-  e1 != 1; // COMPLIANT
-  s != 1;  // COMPLIANT
-  u != 1;  // COMPLIANT
-  f != 1;  // COMPLIANT
-
-  1 == b;  // COMPLIANT
-  1 == c;  // COMPLIANT
-  1 == e1; // COMPLIANT
-  1 == s;  // COMPLIANT
-  1 == u;  // COMPLIANT
-  1 == f;  // COMPLIANT
-
-  1 != b;  // COMPLIANT
-  1 != c;  // COMPLIANT
-  1 != e1; // COMPLIANT
-  1 != s;  // COMPLIANT
-  1 != u;  // COMPLIANT
-  1 != f;  // COMPLIANT
+  // cf >= 1;  // NON_COMPILABLE
+
+  b == 1;          // COMPLIANT
+  c == 1;          // COMPLIANT
+  e1 == 1;         // COMPLIANT
+  s == 1;          // COMPLIANT
+  u == 1;          // COMPLIANT
+  f == 1;          // NON_COMPLIANT
+  cf == 1;         // NON_COMPLIANT
+  f == 0;          // COMPLIANT
+  f == INFINITY;   // COMPLIANT
+  f == -INFINITY;  // COMPLIANT
+  cf == 0;         // COMPLIANT
+  cf == INFINITY;  // COMPLIANT
+  cf == -INFINITY; // COMPLIANT
+
+  b != 1;          // COMPLIANT
+  c != 1;          // COMPLIANT
+  e1 != 1;         // COMPLIANT
+  s != 1;          // COMPLIANT
+  u != 1;          // COMPLIANT
+  f != 1;          // NON_COMPLIANT
+  cf != 1;         // NON_COMPLIANT
+  f != 0;          // COMPLIANT
+  f != INFINITY;   // COMPLIANT
+  f != -INFINITY;  // COMPLIANT
+  cf != 0;         // COMPLIANT
+  cf != INFINITY;  // COMPLIANT
+  cf != -INFINITY; // COMPLIANT
+
+  1 == b;          // COMPLIANT
+  1 == c;          // COMPLIANT
+  1 == e1;         // COMPLIANT
+  1 == s;          // COMPLIANT
+  1 == u;          // COMPLIANT
+  1 == f;          // NON_COMPLIANT
+  1 == cf;         // NON_COMPLIANT
+  0 == f;          // COMPLIANT
+  INFINITY == f;   // COMPLIANT
+  -INFINITY == f;  // COMPLIANT
+  0 == cf;         // COMPLIANT
+  INFINITY == cf;  // COMPLIANT
+  -INFINITY == cf; // COMPLIANT
+
+  1 != b;          // COMPLIANT
+  1 != c;          // COMPLIANT
+  1 != e1;         // COMPLIANT
+  1 != s;          // COMPLIANT
+  1 != u;          // COMPLIANT
+  1 != f;          // NON_COMPLIANT
+  1 != cf;         // NON_COMPLIANT
+  0 != f;          // COMPLIANT
+  INFINITY != f;   // COMPLIANT
+  -INFINITY != f;  // COMPLIANT
+  0 != cf;         // COMPLIANT
+  INFINITY != cf;  // COMPLIANT
+  -INFINITY != cf; // COMPLIANT
 
   !b;  // COMPLIANT
   !c;  // NON_COMPLIANT
@@ -219,6 +274,7 @@ void testInappropriateOperands() {
   !s;  // NON_COMPLIANT
   !u;  // NON_COMPLIANT
   !f;  // NON_COMPLIANT
+  !cf; // NON_COMPLIANT
 
   b && true;  // COMPLIANT
   c && true;  // NON_COMPLIANT
@@ -226,6 +282,7 @@ void testInappropriateOperands() {
   s && true;  // NON_COMPLIANT
   u && true;  // NON_COMPLIANT
   f && true;  // NON_COMPLIANT
+  cf && true; // NON_COMPLIANT
 
   b || false;  // COMPLIANT
   c || false;  // NON_COMPLIANT
@@ -233,6 +290,7 @@ void testInappropriateOperands() {
   s || false;  // NON_COMPLIANT
   u || false;  // NON_COMPLIANT
   f || false;  // NON_COMPLIANT
+  cf || false; // NON_COMPLIANT
 
   true && b;  // COMPLIANT
   true && c;  // NON_COMPLIANT
@@ -240,6 +298,7 @@ void testInappropriateOperands() {
   true && s;  // NON_COMPLIANT
   true && u;  // NON_COMPLIANT
   true && f;  // NON_COMPLIANT
+  true && cf; // NON_COMPLIANT
 
   false || b;  // COMPLIANT
   false || c;  // NON_COMPLIANT
@@ -247,6 +306,7 @@ void testInappropriateOperands() {
   false || s;  // NON_COMPLIANT
   false || u;  // NON_COMPLIANT
   false || f;  // NON_COMPLIANT
+  false || cf; // NON_COMPLIANT
 
   b << u;  // NON_COMPLIANT
   c << u;  // NON_COMPLIANT
@@ -254,6 +314,7 @@ void testInappropriateOperands() {
   s << u;  // NON_COMPLIANT
   u << u;  // COMPLIANT
   // f << u;  // NON_COMPILABLE
+  // cf << u;  // NON_COMPILABLE
 
   b >> u;  // NON_COMPLIANT
   c >> u;  // NON_COMPLIANT
@@ -261,6 +322,7 @@ void testInappropriateOperands() {
   s >> u;  // NON_COMPLIANT
   u >> u;  // COMPLIANT
   // f >> u;  // NON_COMPILABLE
+  // cf >> u;  // NON_COMPILABLE
 
   u << b;  // NON_COMPLIANT
   u << c;  // NON_COMPLIANT
@@ -268,6 +330,7 @@ void testInappropriateOperands() {
   u << s;  // NON_COMPLIANT
   u << u;  // COMPLIANT
   // u << f;  // NON_COMPILABLE
+  // u << cf;  // NON_COMPILABLE
 
   u >> b;  // NON_COMPLIANT
   u >> c;  // NON_COMPLIANT
@@ -275,6 +338,7 @@ void testInappropriateOperands() {
   u >> s;  // NON_COMPLIANT
   u >> u;  // COMPLIANT
   // u >> f;  // NON_COMPILABLE
+  // u >> cf;  // NON_COMPILABLE
 
   b &u;  // NON_COMPLIANT
   c &u;  // NON_COMPLIANT
@@ -282,6 +346,7 @@ void testInappropriateOperands() {
   s &u;  // NON_COMPLIANT
   u &u;  // COMPLIANT
   // f &u;  // NON_COMPILABLE
+  // cf &u;  // NON_COMPILABLE
 
   b | u;  // NON_COMPLIANT
   c | u;  // NON_COMPLIANT
@@ -289,6 +354,7 @@ void testInappropriateOperands() {
   s | u;  // NON_COMPLIANT
   u | u;  // COMPLIANT
   // f | u;  // NON_COMPILABLE
+  // cf | u;  // NON_COMPILABLE
 
   b ^ u;  // NON_COMPLIANT
   c ^ u;  // NON_COMPLIANT
@@ -296,6 +362,7 @@ void testInappropriateOperands() {
   s ^ u;  // NON_COMPLIANT
   u ^ u;  // COMPLIANT
   // f ^ u;  // NON_COMPILABLE
+  // cf ^ u;  // NON_COMPILABLE
 
   u &b;  // NON_COMPLIANT
   u &c;  // NON_COMPLIANT
@@ -303,6 +370,7 @@ void testInappropriateOperands() {
   u &s;  // NON_COMPLIANT
   u &u;  // COMPLIANT
   // u &f;  // NON_COMPILABLE
+  // u &cf;  // NON_COMPILABLE
 
   u | b;  // NON_COMPLIANT
   u | c;  // NON_COMPLIANT
@@ -310,6 +378,7 @@ void testInappropriateOperands() {
   u | s;  // NON_COMPLIANT
   u | u;  // COMPLIANT
   // u | f;  // NON_COMPILABLE
+  // u | cf;  // NON_COMPILABLE
 
   u ^ b;  // NON_COMPLIANT
   u ^ c;  // NON_COMPLIANT
@@ -317,6 +386,7 @@ void testInappropriateOperands() {
   u ^ s;  // NON_COMPLIANT
   u ^ u;  // COMPLIANT
   // u ^ f;  // NON_COMPILABLE
+  // u ^ cf;  // NON_COMPILABLE
 
   ~b;  // NON_COMPLIANT
   ~c;  // NON_COMPLIANT
@@ -324,6 +394,7 @@ void testInappropriateOperands() {
   ~s;  // NON_COMPLIANT
   ~u;  // COMPLIANT
   //~f;  // NON_COMPILABLE
+  ~cf; // NON_COMPLIANT
 
   b ? 1 : 2;  // COMPLIANT
   c ? 1 : 2;  // NON_COMPLIANT
@@ -331,6 +402,7 @@ void testInappropriateOperands() {
   s ? 1 : 2;  // NON_COMPLIANT
   u ? 1 : 2;  // NON_COMPLIANT
   f ? 1 : 2;  // NON_COMPLIANT
+  cf ? 1 : 2; // NON_COMPLIANT
 
   b ? b : b;   // COMPLIANT
   b ? c : c;   // COMPLIANT
@@ -338,6 +410,7 @@ void testInappropriateOperands() {
   b ? s : s;   // COMPLIANT
   b ? u : u;   // COMPLIANT
   b ? f : f;   // COMPLIANT
+  b ? cf : cf; // COMPLIANT
 
   b += 1;  // NON_COMPLIANT
   c += 1;  // COMPLIANT
@@ -345,6 +418,7 @@ void testInappropriateOperands() {
   s += 1;  // COMPLIANT
   u += 1;  // COMPLIANT
   f += 1;  // COMPLIANT
+  cf += 1; // COMPLIANT
 
   b -= 1;  // NON_COMPLIANT
   c -= 1;  // COMPLIANT
@@ -352,6 +426,7 @@ void testInappropriateOperands() {
   s -= 1;  // COMPLIANT
   u -= 1;  // COMPLIANT
   f -= 1;  // COMPLIANT
+  cf -= 1; // COMPLIANT
 
   u += b;  // NON_COMPLIANT
   u += c;  // COMPLIANT
@@ -359,6 +434,7 @@ void testInappropriateOperands() {
   u += s;  // COMPLIANT
   u += u;  // COMPLIANT
   u += f;  // COMPLIANT
+  u += cf; // COMPLIANT
 
   u -= b;  // NON_COMPLIANT
   u -= c;  // COMPLIANT
@@ -366,6 +442,7 @@ void testInappropriateOperands() {
   u -= s;  // COMPLIANT
   u -= u;  // COMPLIANT
   u -= f;  // COMPLIANT
+  u -= cf; // COMPLIANT
 
   b *= 1;  // NON_COMPLIANT
   c *= 1;  // NON_COMPLIANT
@@ -373,6 +450,7 @@ void testInappropriateOperands() {
   s *= 1;  // COMPLIANT
   u *= 1;  // COMPLIANT
   f *= 1;  // COMPLIANT
+  cf *= 1; // COMPLIANT
 
   b /= 1;  // NON_COMPLIANT
   c /= 1;  // NON_COMPLIANT
@@ -380,6 +458,7 @@ void testInappropriateOperands() {
   s /= 1;  // COMPLIANT
   u /= 1;  // COMPLIANT
   f /= 1;  // COMPLIANT
+  cf /= 1; // COMPLIANT
 
   u *= b;  // NON_COMPLIANT
   u *= c;  // NON_COMPLIANT
@@ -387,6 +466,7 @@ void testInappropriateOperands() {
   u *= s;  // COMPLIANT
   u *= u;  // COMPLIANT
   u *= f;  // COMPLIANT
+  u *= cf; // COMPLIANT
 
   u /= b;  // NON_COMPLIANT
   u /= c;  // NON_COMPLIANT
@@ -394,6 +474,7 @@ void testInappropriateOperands() {
   u /= s;  // COMPLIANT
   u /= u;  // COMPLIANT
   u /= f;  // COMPLIANT
+  u /= cf; // COMPLIANT
 
   b %= 1;  // NON_COMPLIANT
   c %= 1;  // NON_COMPLIANT
@@ -401,6 +482,7 @@ void testInappropriateOperands() {
   s %= 1;  // COMPLIANT
   u %= 1;  // COMPLIANT
   // f %= 1;  // NON_COMPILABLE
+  // cf %= 1;  // NON_COMPILABLE
 
   u %= b;  // NON_COMPLIANT
   u %= c;  // NON_COMPLIANT
@@ -408,6 +490,7 @@ void testInappropriateOperands() {
   u %= s;  // COMPLIANT
   u %= u;  // COMPLIANT
   // u %= f;  // NON_COMPILABLE
+  // u %= cf;  // NON_COMPILABLE
 
   b <<= u;  // NON_COMPLIANT
   c <<= u;  // NON_COMPLIANT
@@ -415,6 +498,7 @@ void testInappropriateOperands() {
   s <<= u;  // NON_COMPLIANT
   u <<= u;  // COMPLIANT
   // f <<= u;  // NON_COMPILABLE
+  // cf <<= u;  // NON_COMPILABLE
 
   b >>= u;  // NON_COMPLIANT
   c >>= u;  // NON_COMPLIANT
@@ -422,6 +506,7 @@ void testInappropriateOperands() {
   s >>= u;  // NON_COMPLIANT
   u >>= u;  // COMPLIANT
   // f >>= u;  // NON_COMPILABLE
+  // cf >>= u;  // NON_COMPILABLE
 
   u <<= b;  // NON_COMPLIANT
   u <<= c;  // NON_COMPLIANT
@@ -429,6 +514,7 @@ void testInappropriateOperands() {
   u <<= s;  // NON_COMPLIANT
   u <<= u;  // COMPLIANT
   // u <<= f;  // NON_COMPILABLE
+  // u <<= cf;  // NON_COMPILABLE
 
   u >>= b;  // NON_COMPLIANT
   u >>= c;  // NON_COMPLIANT
@@ -436,6 +522,7 @@ void testInappropriateOperands() {
   u >>= s;  // NON_COMPLIANT
   u >>= u;  // COMPLIANT
   // u >>= f;  // NON_COMPILABLE
+  // u >>= cf;  // NON_COMPILABLE
 
   b &= u;  // NON_COMPLIANT
   c &= u;  // NON_COMPLIANT
@@ -443,6 +530,7 @@ void testInappropriateOperands() {
   s &= u;  // NON_COMPLIANT
   u &= u;  // COMPLIANT
   // f &= u;  // NON_COMPILABLE
+  // cf &= u;  // NON_COMPILABLE
 
   b ^= u;  // NON_COMPLIANT
   c ^= u;  // NON_COMPLIANT
@@ -450,6 +538,7 @@ void testInappropriateOperands() {
   s ^= u;  // NON_COMPLIANT
   u ^= u;  // COMPLIANT
   // f ^= u;  // NON_COMPILABLE
+  // cf ^= u;  // NON_COMPILABLE
 
   b |= u;  // NON_COMPLIANT
   c |= u;  // NON_COMPLIANT
@@ -457,6 +546,7 @@ void testInappropriateOperands() {
   s |= u;  // NON_COMPLIANT
   u |= u;  // COMPLIANT
   // f |= u;  // NON_COMPILABLE
+  // cf |= u;  // NON_COMPILABLE
 
   u &= b;  // NON_COMPLIANT
   u &= c;  // NON_COMPLIANT
@@ -464,6 +554,7 @@ void testInappropriateOperands() {
   u &= s;  // NON_COMPLIANT
   u &= u;  // COMPLIANT
   // u &= f;  // NON_COMPILABLE
+  // u &= cf;  // NON_COMPILABLE
 
   u ^= b;  // NON_COMPLIANT
   u ^= c;  // NON_COMPLIANT
@@ -471,6 +562,7 @@ void testInappropriateOperands() {
   u ^= s;  // NON_COMPLIANT
   u ^= u;  // COMPLIANT
   // u ^= f;  // NON_COMPILABLE
+  // u ^= cf;  // NON_COMPILABLE
 
   u |= b;  // NON_COMPLIANT
   u |= c;  // NON_COMPLIANT
@@ -478,6 +570,7 @@ void testInappropriateOperands() {
   u |= s;  // NON_COMPLIANT
   u |= u;  // COMPLIANT
   // u |= f;  // NON_COMPILABLE
+  // u |= cf;  // NON_COMPILABLE
 }
 
 void pointerType() {
diff --git a/c/misra/test/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.expected b/c/misra/test/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.expected
index 0a5c7ae0bb..a1d3657a1e 100644
--- a/c/misra/test/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.expected
+++ b/c/misra/test/rules/RULE-10-2/AdditionSubtractionOnEssentiallyCharType.expected
@@ -1,15 +1,19 @@
-| test.c:15:3:15:11 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:16:3:16:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:17:3:17:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:18:3:18:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:19:3:19:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:20:3:20:10 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:21:3:21:10 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:27:3:27:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:28:3:28:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:29:3:29:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:30:3:30:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:31:3:31:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:32:3:32:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:33:3:33:10 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
-| test.c:34:3:34:10 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:19:3:19:11 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:20:3:20:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:21:3:21:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:22:3:22:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:23:3:23:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:24:3:24:10 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:25:3:25:10 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:28:3:28:9 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:29:3:29:10 | ... + ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:35:3:35:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:36:3:36:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:37:3:37:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:38:3:38:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:39:3:39:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:40:3:40:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:41:3:41:10 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:42:3:42:10 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:45:3:45:9 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
+| test.c:46:3:46:10 | ... - ... | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
diff --git a/c/misra/test/rules/RULE-10-2/test.c b/c/misra/test/rules/RULE-10-2/test.c
index 186c49226e..1d86013c07 100644
--- a/c/misra/test/rules/RULE-10-2/test.c
+++ b/c/misra/test/rules/RULE-10-2/test.c
@@ -5,6 +5,10 @@ void testRules() {
   enum E1 { A, B, C } e1 = A;
   signed int i = 100;
   unsigned int u = 100;
+  signed short s = 100;
+  unsigned short us = 100;
+  signed long l = 100L;
+  unsigned long ul = 100UL;
   float f = 10.0f;
 
   // Addition cases
@@ -19,8 +23,12 @@ void testRules() {
   b + 'a';   // NON_COMPLIANT
   'a' + e1;  // NON_COMPLIANT
   e1 + 'a';  // NON_COMPLIANT
+  'a' + s;   // COMPLIANT
+  'a' + us;  // COMPLIANT
+  'a' + l;   // NON_COMPLIANT
+  'a' + ul;  // NON_COMPLIANT
 
-  // Subtration cases
+  // Subtraction cases
   'a' - i;   // COMPLIANT
   'a' - u;   // COMPLIANT
   'a' - 'a'; // COMPLIANT
@@ -32,4 +40,8 @@ void testRules() {
   'a' - b;   // NON_COMPLIANT
   e1 - 'a';  // NON_COMPLIANT
   'a' - e1;  // NON_COMPLIANT
+  'a' - s;   // COMPLIANT
+  'a' - us;  // COMPLIANT
+  'a' - l;   // NON_COMPLIANT
+  'a' - ul;  // NON_COMPLIANT
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.expected b/c/misra/test/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.expected
index 3867abd0ca..edfd93dc51 100644
--- a/c/misra/test/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.expected
+++ b/c/misra/test/rules/RULE-10-3/AssignmentOfIncompatibleEssentialType.expected
@@ -1,133 +1,194 @@
-| test.c:11:7:11:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
-| test.c:12:7:12:7 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
-| test.c:13:7:13:7 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
-| test.c:14:7:14:7 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
-| test.c:16:8:16:8 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
-| test.c:18:8:18:8 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
-| test.c:19:8:19:8 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
-| test.c:20:8:20:8 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
-| test.c:22:7:22:7 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
-| test.c:23:7:23:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
-| test.c:25:7:25:7 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
-| test.c:26:7:26:7 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
-| test.c:28:7:28:7 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
-| test.c:29:7:29:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
-| test.c:30:7:30:7 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:32:7:32:7 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
-| test.c:34:7:34:7 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
-| test.c:35:7:35:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
-| test.c:36:7:36:7 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
-| test.c:37:7:37:7 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
-| test.c:49:14:49:15 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
-| test.c:50:14:50:14 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
-| test.c:51:14:51:14 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
-| test.c:52:14:52:14 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
-| test.c:54:17:54:17 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
-| test.c:56:17:56:17 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
-| test.c:57:17:57:17 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
-| test.c:58:17:58:17 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
-| test.c:60:19:60:19 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
-| test.c:61:19:61:20 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
-| test.c:63:19:63:19 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
-| test.c:64:19:64:19 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
-| test.c:66:21:66:21 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
-| test.c:67:21:67:22 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
-| test.c:68:21:68:21 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:70:21:70:21 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
-| test.c:72:14:72:14 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
-| test.c:73:14:73:15 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
-| test.c:74:14:74:14 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
-| test.c:75:14:75:14 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
-| test.c:80:7:80:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
-| test.c:81:7:81:7 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
-| test.c:82:7:82:7 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
-| test.c:83:7:83:7 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
-| test.c:86:7:86:7 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
-| test.c:88:7:88:7 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
-| test.c:89:7:89:7 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
-| test.c:90:7:90:7 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
-| test.c:93:7:93:7 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
-| test.c:94:7:94:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
-| test.c:96:7:96:7 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
-| test.c:97:7:97:7 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
-| test.c:100:7:100:7 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
-| test.c:101:7:101:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
-| test.c:102:7:102:7 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:104:7:104:7 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
-| test.c:107:7:107:7 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
-| test.c:108:7:108:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
-| test.c:109:7:109:7 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
-| test.c:110:7:110:7 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
-| test.c:118:7:118:8 | - ... | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:119:7:119:16 | 4294967296 | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:131:8:131:8 | A | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
-| test.c:132:8:132:10 | 100 | Assignment of essentially Signed type value to an object of essentially Boolean type. |
-| test.c:133:23:133:25 | 200 | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
-| test.c:138:8:138:11 | 1 | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
-| test.c:140:8:140:10 | 100 | Assignment of essentially Signed type value to an object of essentially Enum Type. |
-| test.c:141:23:141:25 | 200 | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
-| test.c:146:8:146:11 | 1 | Assignment of essentially Boolean type value to an object of essentially Signed type. |
-| test.c:147:8:147:8 | A | Assignment of essentially Enum Type value to an object of essentially Signed type. |
-| test.c:149:23:149:25 | 200 | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
-| test.c:154:8:154:11 | 1 | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
-| test.c:155:8:155:8 | A | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
-| test.c:174:8:174:8 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
-| test.c:175:8:175:8 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
-| test.c:176:8:176:8 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
-| test.c:177:8:177:8 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
-| test.c:180:8:180:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
-| test.c:182:8:182:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
-| test.c:183:8:183:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
-| test.c:184:8:184:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
-| test.c:187:8:187:8 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
-| test.c:188:8:188:8 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
-| test.c:190:8:190:8 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:191:8:191:8 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
-| test.c:194:8:194:8 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
-| test.c:195:8:195:8 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
-| test.c:196:8:196:8 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
-| test.c:198:8:198:8 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
-| test.c:201:8:201:8 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
-| test.c:202:8:202:8 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
-| test.c:203:8:203:8 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
-| test.c:204:8:204:8 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
-| test.c:220:12:220:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
-| test.c:222:12:222:12 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
-| test.c:224:12:224:12 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
-| test.c:226:12:226:12 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
-| test.c:239:12:239:12 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
-| test.c:243:12:243:12 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
-| test.c:245:12:245:12 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
-| test.c:247:12:247:12 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
-| test.c:260:12:260:12 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
-| test.c:262:12:262:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
-| test.c:266:12:266:12 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
-| test.c:268:12:268:12 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
-| test.c:281:12:281:12 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
-| test.c:283:12:283:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
-| test.c:285:12:285:12 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:289:12:289:12 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
-| test.c:302:12:302:12 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
-| test.c:304:12:304:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
-| test.c:306:12:306:12 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
-| test.c:308:12:308:12 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
-| test.c:332:10:332:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
-| test.c:333:10:333:10 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
-| test.c:334:10:334:10 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
-| test.c:335:10:335:10 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
-| test.c:337:11:337:11 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
-| test.c:339:11:339:11 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
-| test.c:340:11:340:11 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
-| test.c:341:11:341:11 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
-| test.c:343:10:343:10 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
-| test.c:344:10:344:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
-| test.c:346:10:346:10 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
-| test.c:347:10:347:10 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
-| test.c:349:10:349:10 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
-| test.c:350:10:350:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
-| test.c:351:10:351:10 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
-| test.c:353:10:353:10 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
-| test.c:355:10:355:10 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
-| test.c:356:10:356:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
-| test.c:357:10:357:10 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
-| test.c:358:10:358:10 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
+| test.c:13:7:13:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
+| test.c:14:7:14:7 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
+| test.c:15:7:15:7 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
+| test.c:16:7:16:7 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
+| test.c:17:7:17:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Boolean type. |
+| test.c:19:8:19:8 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
+| test.c:21:8:21:8 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
+| test.c:22:8:22:8 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
+| test.c:23:8:23:8 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
+| test.c:24:8:24:9 | cf | Assignment of essentially Complex Floating type value to an object of essentially Enum Type. |
+| test.c:26:7:26:7 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
+| test.c:27:7:27:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
+| test.c:29:7:29:7 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:30:7:30:7 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
+| test.c:31:7:31:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Signed type. |
+| test.c:33:7:33:7 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
+| test.c:34:7:34:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
+| test.c:35:7:35:7 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:37:7:37:7 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
+| test.c:38:7:38:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Unsigned type. |
+| test.c:40:7:40:7 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
+| test.c:41:7:41:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
+| test.c:42:7:42:7 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
+| test.c:43:7:43:7 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
+| test.c:45:7:45:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Floating type. |
+| test.c:47:8:47:8 | b | Assignment of essentially Boolean type value to an object of essentially Complex Floating type. |
+| test.c:48:8:48:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Complex Floating type. |
+| test.c:49:8:49:8 | s | Assignment of essentially Signed type value to an object of essentially Complex Floating type. |
+| test.c:50:8:50:8 | u | Assignment of essentially Unsigned type value to an object of essentially Complex Floating type. |
+| test.c:64:14:64:15 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
+| test.c:65:14:65:14 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
+| test.c:66:14:66:14 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
+| test.c:67:14:67:14 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
+| test.c:68:15:68:16 | cf | Assignment of essentially Complex Floating type value to an object of essentially Boolean type. |
+| test.c:70:17:70:17 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
+| test.c:72:17:72:17 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
+| test.c:73:17:73:17 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
+| test.c:74:17:74:17 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
+| test.c:75:18:75:19 | cf | Assignment of essentially Complex Floating type value to an object of essentially Enum Type. |
+| test.c:77:19:77:19 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
+| test.c:78:19:78:20 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
+| test.c:80:19:80:19 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:81:19:81:19 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
+| test.c:82:20:82:21 | cf | Assignment of essentially Complex Floating type value to an object of essentially Signed type. |
+| test.c:84:21:84:21 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
+| test.c:85:21:85:22 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
+| test.c:86:21:86:21 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:88:21:88:21 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
+| test.c:89:22:89:23 | cf | Assignment of essentially Complex Floating type value to an object of essentially Unsigned type. |
+| test.c:91:14:91:14 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
+| test.c:92:14:92:15 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
+| test.c:93:14:93:14 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
+| test.c:94:14:94:14 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
+| test.c:96:15:96:16 | cf | Assignment of essentially Complex Floating type value to an object of essentially Floating type. |
+| test.c:98:24:98:24 | b | Assignment of essentially Boolean type value to an object of essentially Complex Floating type. |
+| test.c:99:24:99:25 | e1 | Assignment of essentially Enum Type value to an object of essentially Complex Floating type. |
+| test.c:100:24:100:24 | s | Assignment of essentially Signed type value to an object of essentially Complex Floating type. |
+| test.c:101:24:101:24 | u | Assignment of essentially Unsigned type value to an object of essentially Complex Floating type. |
+| test.c:107:7:107:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
+| test.c:108:7:108:7 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
+| test.c:109:7:109:7 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
+| test.c:110:7:110:7 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
+| test.c:111:7:111:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Boolean type. |
+| test.c:114:7:114:7 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
+| test.c:116:7:116:7 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
+| test.c:117:7:117:7 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
+| test.c:118:7:118:7 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
+| test.c:119:7:119:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Enum Type. |
+| test.c:122:7:122:7 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
+| test.c:123:7:123:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
+| test.c:125:7:125:7 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:126:7:126:7 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
+| test.c:127:7:127:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Signed type. |
+| test.c:130:7:130:7 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
+| test.c:131:7:131:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
+| test.c:132:7:132:7 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:134:7:134:7 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
+| test.c:135:7:135:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Unsigned type. |
+| test.c:138:7:138:7 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
+| test.c:139:7:139:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
+| test.c:140:7:140:7 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
+| test.c:141:7:141:7 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
+| test.c:143:7:143:8 | cf | Assignment of essentially Complex Floating type value to an object of essentially Floating type. |
+| test.c:146:7:146:7 | b | Assignment of essentially Boolean type value to an object of essentially Complex Floating type. |
+| test.c:147:7:147:8 | e1 | Assignment of essentially Enum Type value to an object of essentially Complex Floating type. |
+| test.c:148:7:148:7 | s | Assignment of essentially Signed type value to an object of essentially Complex Floating type. |
+| test.c:149:7:149:7 | u | Assignment of essentially Unsigned type value to an object of essentially Complex Floating type. |
+| test.c:158:7:158:8 | - ... | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:159:7:159:16 | 4294967296 | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:171:8:171:8 | A | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
+| test.c:172:8:172:10 | 100 | Assignment of essentially Signed type value to an object of essentially Boolean type. |
+| test.c:173:23:173:25 | 200 | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
+| test.c:178:8:178:11 | 1 | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
+| test.c:180:8:180:10 | 100 | Assignment of essentially Signed type value to an object of essentially Enum Type. |
+| test.c:181:23:181:25 | 200 | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
+| test.c:186:8:186:11 | 1 | Assignment of essentially Boolean type value to an object of essentially Signed type. |
+| test.c:187:8:187:8 | A | Assignment of essentially Enum Type value to an object of essentially Signed type. |
+| test.c:189:23:189:25 | 200 | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:194:8:194:11 | 1 | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
+| test.c:195:8:195:8 | A | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
+| test.c:216:8:216:8 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
+| test.c:217:8:217:8 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
+| test.c:218:8:218:8 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
+| test.c:219:8:219:8 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
+| test.c:220:8:220:8 | b | Assignment of essentially Boolean type value to an object of essentially Complex Floating type. |
+| test.c:223:8:223:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
+| test.c:225:8:225:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
+| test.c:226:8:226:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
+| test.c:227:8:227:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
+| test.c:228:8:228:9 | e1 | Assignment of essentially Enum Type value to an object of essentially Complex Floating type. |
+| test.c:231:8:231:8 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
+| test.c:232:8:232:8 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
+| test.c:234:8:234:8 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:235:8:235:8 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
+| test.c:236:8:236:8 | s | Assignment of essentially Signed type value to an object of essentially Complex Floating type. |
+| test.c:239:8:239:8 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
+| test.c:240:8:240:8 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
+| test.c:241:8:241:8 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:243:8:243:8 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
+| test.c:244:8:244:8 | u | Assignment of essentially Unsigned type value to an object of essentially Complex Floating type. |
+| test.c:247:8:247:8 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
+| test.c:248:8:248:8 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
+| test.c:249:8:249:8 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
+| test.c:250:8:250:8 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
+| test.c:255:8:255:9 | cf | Assignment of essentially Complex Floating type value to an object of essentially Boolean type. |
+| test.c:256:8:256:9 | cf | Assignment of essentially Complex Floating type value to an object of essentially Enum Type. |
+| test.c:257:8:257:9 | cf | Assignment of essentially Complex Floating type value to an object of essentially Signed type. |
+| test.c:258:8:258:9 | cf | Assignment of essentially Complex Floating type value to an object of essentially Unsigned type. |
+| test.c:259:8:259:9 | cf | Assignment of essentially Complex Floating type value to an object of essentially Floating type. |
+| test.c:275:12:275:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
+| test.c:277:12:277:12 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
+| test.c:279:12:279:12 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
+| test.c:281:12:281:12 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
+| test.c:283:12:283:13 | cf | Assignment of essentially Complex Floating type value to an object of essentially Boolean type. |
+| test.c:297:12:297:12 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
+| test.c:301:12:301:12 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
+| test.c:303:12:303:12 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
+| test.c:305:12:305:12 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
+| test.c:307:12:307:13 | cf | Assignment of essentially Complex Floating type value to an object of essentially Enum Type. |
+| test.c:321:12:321:12 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
+| test.c:323:12:323:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
+| test.c:327:12:327:12 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:329:12:329:12 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
+| test.c:331:12:331:13 | cf | Assignment of essentially Complex Floating type value to an object of essentially Signed type. |
+| test.c:345:12:345:12 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
+| test.c:347:12:347:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
+| test.c:349:12:349:12 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:353:12:353:12 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
+| test.c:355:12:355:13 | cf | Assignment of essentially Complex Floating type value to an object of essentially Unsigned type. |
+| test.c:369:12:369:12 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
+| test.c:371:12:371:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
+| test.c:373:12:373:12 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
+| test.c:375:12:375:12 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
+| test.c:379:12:379:13 | cf | Assignment of essentially Complex Floating type value to an object of essentially Floating type. |
+| test.c:393:12:393:12 | b | Assignment of essentially Boolean type value to an object of essentially Complex Floating type. |
+| test.c:395:12:395:13 | e1 | Assignment of essentially Enum Type value to an object of essentially Complex Floating type. |
+| test.c:397:12:397:12 | s | Assignment of essentially Signed type value to an object of essentially Complex Floating type. |
+| test.c:399:12:399:12 | u | Assignment of essentially Unsigned type value to an object of essentially Complex Floating type. |
+| test.c:427:10:427:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Boolean type. |
+| test.c:428:10:428:10 | s | Assignment of essentially Signed type value to an object of essentially Boolean type. |
+| test.c:429:10:429:10 | u | Assignment of essentially Unsigned type value to an object of essentially Boolean type. |
+| test.c:430:10:430:10 | f | Assignment of essentially Floating type value to an object of essentially Boolean type. |
+| test.c:431:10:431:11 | cf | Assignment of essentially Complex Floating type value to an object of essentially Boolean type. |
+| test.c:433:11:433:11 | b | Assignment of essentially Boolean type value to an object of essentially Enum Type. |
+| test.c:435:11:435:11 | s | Assignment of essentially Signed type value to an object of essentially Enum Type. |
+| test.c:436:11:436:11 | u | Assignment of essentially Unsigned type value to an object of essentially Enum Type. |
+| test.c:437:11:437:11 | f | Assignment of essentially Floating type value to an object of essentially Enum Type. |
+| test.c:438:11:438:12 | cf | Assignment of essentially Complex Floating type value to an object of essentially Enum Type. |
+| test.c:440:10:440:10 | b | Assignment of essentially Boolean type value to an object of essentially Signed type. |
+| test.c:441:10:441:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Signed type. |
+| test.c:443:10:443:10 | u | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:444:10:444:10 | f | Assignment of essentially Floating type value to an object of essentially Signed type. |
+| test.c:445:10:445:11 | cf | Assignment of essentially Complex Floating type value to an object of essentially Signed type. |
+| test.c:447:10:447:10 | b | Assignment of essentially Boolean type value to an object of essentially Unsigned type. |
+| test.c:448:10:448:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Unsigned type. |
+| test.c:449:10:449:10 | s | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
+| test.c:451:10:451:10 | f | Assignment of essentially Floating type value to an object of essentially Unsigned type. |
+| test.c:452:10:452:11 | cf | Assignment of essentially Complex Floating type value to an object of essentially Unsigned type. |
+| test.c:454:10:454:10 | b | Assignment of essentially Boolean type value to an object of essentially Floating type. |
+| test.c:455:10:455:11 | e1 | Assignment of essentially Enum Type value to an object of essentially Floating type. |
+| test.c:456:10:456:10 | s | Assignment of essentially Signed type value to an object of essentially Floating type. |
+| test.c:457:10:457:10 | u | Assignment of essentially Unsigned type value to an object of essentially Floating type. |
+| test.c:459:10:459:11 | cf | Assignment of essentially Complex Floating type value to an object of essentially Floating type. |
+| test.c:461:11:461:11 | b | Assignment of essentially Boolean type value to an object of essentially Complex Floating type. |
+| test.c:462:11:462:12 | e1 | Assignment of essentially Enum Type value to an object of essentially Complex Floating type. |
+| test.c:463:11:463:11 | s | Assignment of essentially Signed type value to an object of essentially Complex Floating type. |
+| test.c:464:11:464:11 | u | Assignment of essentially Unsigned type value to an object of essentially Complex Floating type. |
+| test.c:473:26:473:28 | f64 | Assignment of essentially Floating type value to an object of essentially Complex Floating type. |
+| test.c:490:12:490:20 | ... & ... | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:491:12:491:20 | ... \| ... | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:492:12:492:20 | ... ^ ... | Assignment of essentially Unsigned type value to an object of essentially Signed type. |
+| test.c:497:20:497:27 | ... & ... | Assignment of value of essentially Signed type of size 2 bytes to an object narrower essential type of size 1 bytes. |
+| test.c:502:23:502:30 | ... & ... | Assignment of value of essentially Unsigned type of size 2 bytes to an object narrower essential type of size 1 bytes. |
+| test.c:505:22:505:29 | ... & ... | Assignment of essentially Signed type value to an object of essentially Unsigned type. |
diff --git a/c/misra/test/rules/RULE-10-3/test.c b/c/misra/test/rules/RULE-10-3/test.c
index 30ab2985ae..a5bfd3beaf 100644
--- a/c/misra/test/rules/RULE-10-3/test.c
+++ b/c/misra/test/rules/RULE-10-3/test.c
@@ -1,3 +1,4 @@
+#include <complex.h>
 #include <stdbool.h>
 
 void testAssignment() {
@@ -6,36 +7,49 @@ void testAssignment() {
   signed int s = 100;         // COMPLIANT
   unsigned int u = 100;       // COMPLIANT - by exception 1
   float f = 10.0f;            // COMPLIANT
+  float _Complex cf = 10.0f;  // COMPLIANT
 
   b = false; // COMPLIANT
   b = e1;    // NON_COMPLIANT
   b = s;     // NON_COMPLIANT
   b = u;     // NON_COMPLIANT
   b = f;     // NON_COMPLIANT
+  b = cf;    // NON_COMPLIANT
 
   e1 = b;  // NON_COMPLIANT
   e1 = e1; // COMPLIANT
   e1 = s;  // NON_COMPLIANT
   e1 = u;  // NON_COMPLIANT
   e1 = f;  // NON_COMPLIANT
+  e1 = cf; // NON_COMPLIANT
 
   s = b;  // NON_COMPLIANT
   s = e1; // NON_COMPLIANT
   s = s;  // COMPLIANT
   s = u;  // NON_COMPLIANT
   s = f;  // NON_COMPLIANT
+  s = cf; // NON_COMPLIANT
 
   u = b;  // NON_COMPLIANT
   u = e1; // NON_COMPLIANT
   u = s;  // NON_COMPLIANT
   u = u;  // COMPLIANT
   u = f;  // NON_COMPLIANT
+  u = cf; // NON_COMPLIANT
 
   f = b;  // NON_COMPLIANT
   f = e1; // NON_COMPLIANT
   f = s;  // NON_COMPLIANT
   f = u;  // NON_COMPLIANT
   f = f;  // COMPLIANT
+  f = cf; // NON-COMPLIANT
+
+  cf = b;  // NON_COMPLIANT
+  cf = e1; // NON_COMPLIANT
+  cf = s;  // NON_COMPLIANT
+  cf = u;  // NON_COMPLIANT
+  cf = f;  // COMPLIANT
+  cf = cf; // COMPLIANT
 }
 
 void testInitializers() {
@@ -44,71 +58,97 @@ void testInitializers() {
   signed int s = 100;         // COMPLIANT
   unsigned int u = 100;       // COMPLIANT - by exception 1
   float f = 10.0f;            // COMPLIANT
-
-  _Bool bb = b;  // COMPLIANT
-  _Bool be = e1; // NON_COMPLIANT
-  _Bool bs = s;  // NON_COMPLIANT
-  _Bool bu = u;  // NON_COMPLIANT
-  _Bool bf = f;  // NON_COMPLIANT
-
-  enum E1 e1b = b;  // NON_COMPLIANT
-  enum E1 e1e = e1; // COMPLIANT
-  enum E1 e1s = s;  // NON_COMPLIANT
-  enum E1 e1u = u;  // NON_COMPLIANT
-  enum E1 e1f = f;  // NON_COMPLIANT
-
-  signed int sb = b;  // NON_COMPLIANT
-  signed int se = e1; // NON_COMPLIANT
-  signed int ss = s;  // COMPLIANT
-  signed int su = u;  // NON_COMPLIANT
-  signed int sf = f;  // NON_COMPLIANT
-
-  unsigned int ub = b;  // NON_COMPLIANT
-  unsigned int ue = e1; // NON_COMPLIANT
-  unsigned int us = s;  // NON_COMPLIANT
-  unsigned int uu = u;  // COMPLIANT
-  unsigned int uf = f;  // NON_COMPLIANT
-
-  float fb = b;  // NON_COMPLIANT
-  float fe = e1; // NON_COMPLIANT
-  float fs = s;  // NON_COMPLIANT
-  float fu = u;  // NON_COMPLIANT
-  float ff = f;  // COMPLIANT
-
-  _Bool ba[5] = {
+  float _Complex cf = 10.0f;  // COMPLIANT
+
+  _Bool bb = b;   // COMPLIANT
+  _Bool be = e1;  // NON_COMPLIANT
+  _Bool bs = s;   // NON_COMPLIANT
+  _Bool bu = u;   // NON_COMPLIANT
+  _Bool bf = f;   // NON_COMPLIANT
+  _Bool bcf = cf; // NON_COMPLIANT
+
+  enum E1 e1b = b;   // NON_COMPLIANT
+  enum E1 e1e = e1;  // COMPLIANT
+  enum E1 e1s = s;   // NON_COMPLIANT
+  enum E1 e1u = u;   // NON_COMPLIANT
+  enum E1 e1f = f;   // NON_COMPLIANT
+  enum E1 e1cf = cf; // NON_COMPLIANT
+
+  signed int sb = b;   // NON_COMPLIANT
+  signed int se = e1;  // NON_COMPLIANT
+  signed int ss = s;   // COMPLIANT
+  signed int su = u;   // NON_COMPLIANT
+  signed int sf = f;   // NON_COMPLIANT
+  signed int scf = cf; // NON_COMPLIANT
+
+  unsigned int ub = b;   // NON_COMPLIANT
+  unsigned int ue = e1;  // NON_COMPLIANT
+  unsigned int us = s;   // NON_COMPLIANT
+  unsigned int uu = u;   // COMPLIANT
+  unsigned int uf = f;   // NON_COMPLIANT
+  unsigned int ucf = cf; // NON_COMPLIANT
+
+  float fb = b;   // NON_COMPLIANT
+  float fe = e1;  // NON_COMPLIANT
+  float fs = s;   // NON_COMPLIANT
+  float fu = u;   // NON_COMPLIANT
+  float ff = f;   // COMPLIANT
+  float fcf = cf; // NON-COMPLIANT
+
+  float _Complex cfb = b;   // NON_COMPLIANT
+  float _Complex cfe = e1;  // NON_COMPLIANT
+  float _Complex cfs = s;   // NON_COMPLIANT
+  float _Complex cfu = u;   // NON_COMPLIANT
+  float _Complex cff = f;   // COMPLIANT
+  float _Complex cfcf = cf; // COMPLIANT
+
+  _Bool ba[6] = {
       b,  // COMPLIANT
       e1, // NON_COMPLIANT
       s,  // NON_COMPLIANT
       u,  // NON_COMPLIANT
-      f   // NON_COMPLIANT
+      f,  // NON_COMPLIANT
+      cf  // NON_COMPLIANT
   };
-  enum E1 ea[5] = {
+  enum E1 ea[6] = {
       b,  // NON_COMPLIANT
       e1, // COMPLIANT
       s,  // NON_COMPLIANT
       u,  // NON_COMPLIANT
-      f   // NON_COMPLIANT
+      f,  // NON_COMPLIANT
+      cf  // NON_COMPLIANT
   };
-  signed int sa[5] = {
+  signed int sa[6] = {
       b,  // NON_COMPLIANT
       e1, // NON_COMPLIANT
       s,  // COMPLIANT
       u,  // NON_COMPLIANT
-      f   // NON_COMPLIANT
+      f,  // NON_COMPLIANT
+      cf  // NON_COMPLIANT
   };
-  unsigned int ua[5] = {
+  unsigned int ua[6] = {
       b,  // NON_COMPLIANT
       e1, // NON_COMPLIANT
       s,  // NON_COMPLIANT
       u,  // COMPLIANT
-      f   // NON_COMPLIANT
+      f,  // NON_COMPLIANT
+      cf  // NON_COMPLIANT
+  };
+  float fa[6] = {
+      b,  // NON_COMPLIANT
+      e1, // NON_COMPLIANT
+      s,  // NON_COMPLIANT
+      u,  // NON_COMPLIANT
+      f,  // COMPLIANT
+      cf  // NON_COMPLIANT
   };
-  float fa[5] = {
+  float _Complex cfa[6] = {
       b,  // NON_COMPLIANT
       e1, // NON_COMPLIANT
       s,  // NON_COMPLIANT
       u,  // NON_COMPLIANT
-      f   // COMPLIANT
+      f,  // COMPLIANT
+      cf  // COMPLIANT
   };
 }
 
@@ -161,19 +201,22 @@ void testSwitchCase() {
 
 enum EG { EGA, EGB, EGC };
 
-void func(_Bool b, enum EG eg, signed int i, unsigned int u, float f);
+void func(_Bool b, enum EG eg, signed int i, unsigned int u, float f,
+          float _Complex cf);
 
 void testFunctionCall() {
-  _Bool b = true;       // COMPLIANT
-  enum EG e1 = EGA;     // COMPLIANT
-  signed int s = 100;   // COMPLIANT
-  unsigned int u = 100; // COMPLIANT - by exception 1
-  float f = 10.0f;      // COMPLIANT
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
 
   func(b, // COMPLIANT
        b, // NON_COMPLIANT
        b, // NON_COMPLIANT
        b, // NON_COMPLIANT
+       b, // NON_COMPLIANT
        b  // NON_COMPLIANT
   );
 
@@ -181,6 +224,7 @@ void testFunctionCall() {
        e1, // COMPLIANT
        e1, // NON_COMPLIANT
        e1, // NON_COMPLIANT
+       e1, // NON_COMPLIANT
        e1  // NON_COMPLIANT
   );
 
@@ -188,6 +232,7 @@ void testFunctionCall() {
        s, // NON_COMPLIANT
        s, // COMPLIANT
        s, // NON_COMPLIANT
+       s, // NON_COMPLIANT
        s  // NON_COMPLIANT
   );
 
@@ -195,6 +240,7 @@ void testFunctionCall() {
        u, // NON_COMPLIANT
        u, // NON_COMPLIANT
        u, // COMPLIANT
+       u, // NON_COMPLIANT
        u  // NON_COMPLIANT
   );
 
@@ -202,16 +248,25 @@ void testFunctionCall() {
        f, // NON_COMPLIANT
        f, // NON_COMPLIANT
        f, // NON_COMPLIANT
+       f, // COMPLIANT
        f  // COMPLIANT
   );
+
+  func(cf, // NON_COMPLIANT
+       cf, // NON_COMPLIANT
+       cf, // NON_COMPLIANT
+       cf, // NON_COMPLIANT
+       cf, // NON_COMPLIANT
+       cf);
 }
 
 _Bool testBoolFunctionReturn(int x) {
-  _Bool b = true;       // COMPLIANT
-  enum EG e1 = EGA;     // COMPLIANT
-  signed int s = 100;   // COMPLIANT
-  unsigned int u = 100; // COMPLIANT - by exception 1
-  float f = 10.0f;      // COMPLIANT
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
 
   switch (x) {
   case 0:
@@ -222,17 +277,20 @@ _Bool testBoolFunctionReturn(int x) {
     return s; // NON_COMPLIANT
   case 3:
     return u; // NON_COMPLIANT
-  default:
+  case 4:
     return f; // NON_COMPLIANT
+  default:
+    return cf; // NON_COMPLIANT
   }
 }
 
 enum EG testEnumFunctionReturn(int x) {
-  _Bool b = true;       // COMPLIANT
-  enum EG e1 = EGA;     // COMPLIANT
-  signed int s = 100;   // COMPLIANT
-  unsigned int u = 100; // COMPLIANT - by exception 1
-  float f = 10.0f;      // COMPLIANT
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
 
   switch (x) {
   case 0:
@@ -243,17 +301,20 @@ enum EG testEnumFunctionReturn(int x) {
     return s; // NON_COMPLIANT
   case 3:
     return u; // NON_COMPLIANT
-  default:
+  case 4:
     return f; // NON_COMPLIANT
+  default:
+    return cf; // NON_COMPLIANT
   }
 }
 
 signed int testSignedIntFunctionReturn(int x) {
-  _Bool b = true;       // COMPLIANT
-  enum EG e1 = EGA;     // COMPLIANT
-  signed int s = 100;   // COMPLIANT
-  unsigned int u = 100; // COMPLIANT - by exception 1
-  float f = 10.0f;      // COMPLIANT
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
 
   switch (x) {
   case 0:
@@ -264,17 +325,20 @@ signed int testSignedIntFunctionReturn(int x) {
     return s; // COMPLIANT
   case 3:
     return u; // NON_COMPLIANT
-  default:
+  case 4:
     return f; // NON_COMPLIANT
+  default:
+    return cf; // NON_COMPLIANT
   }
 }
 
 unsigned int testUnsignedIntFunctionReturn(int x) {
-  _Bool b = true;       // COMPLIANT
-  enum EG e1 = EGA;     // COMPLIANT
-  signed int s = 100;   // COMPLIANT
-  unsigned int u = 100; // COMPLIANT - by exception 1
-  float f = 10.0f;      // COMPLIANT
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
 
   switch (x) {
   case 0:
@@ -285,17 +349,20 @@ unsigned int testUnsignedIntFunctionReturn(int x) {
     return s; // NON_COMPLIANT
   case 3:
     return u; // COMPLIANT
-  default:
+  case 4:
     return f; // NON_COMPLIANT
+  default:
+    return cf; // NON_COMPLIANT
   }
 }
 
 float testFloatFunctionReturn(int x) {
-  _Bool b = true;       // COMPLIANT
-  enum EG e1 = EGA;     // COMPLIANT
-  signed int s = 100;   // COMPLIANT
-  unsigned int u = 100; // COMPLIANT - by exception 1
-  float f = 10.0f;      // COMPLIANT
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
 
   switch (x) {
   case 0:
@@ -306,8 +373,34 @@ float testFloatFunctionReturn(int x) {
     return s; // NON_COMPLIANT
   case 3:
     return u; // NON_COMPLIANT
+  case 4:
+    return f; // COMPLIANT
   default:
+    return cf; // NON_COMPLIANT
+  }
+}
+
+float _Complex testComplexFunctionReturn(int x) {
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
+
+  switch (x) {
+  case 0:
+    return b; // NON_COMPLIANT
+  case 1:
+    return e1; // NON_COMPLIANT
+  case 2:
+    return s; // NON_COMPLIANT
+  case 3:
+    return u; // NON_COMPLIANT
+  case 4:
     return f; // COMPLIANT
+  default:
+    return cf; // COMPLIANT
   }
 }
 
@@ -317,14 +410,16 @@ struct S1 {
   signed int s;
   unsigned int u;
   float f;
+  float _Complex cf;
 };
 
 void testStructAssignment() {
-  _Bool b = true;       // COMPLIANT
-  enum EG e1 = EGA;     // COMPLIANT
-  signed int s = 100;   // COMPLIANT
-  unsigned int u = 100; // COMPLIANT - by exception 1
-  float f = 10.0f;      // COMPLIANT
+  _Bool b = true;            // COMPLIANT
+  enum EG e1 = EGA;          // COMPLIANT
+  signed int s = 100;        // COMPLIANT
+  unsigned int u = 100;      // COMPLIANT - by exception 1
+  float f = 10.0f;           // COMPLIANT
+  float _Complex cf = 10.0f; // COMPLIANT
 
   struct S1 s1;
 
@@ -333,28 +428,79 @@ void testStructAssignment() {
   s1.b = s;  // NON_COMPLIANT
   s1.b = u;  // NON_COMPLIANT
   s1.b = f;  // NON_COMPLIANT
+  s1.b = cf; // NON_COMPLIANT
 
   s1.e1 = b;  // NON_COMPLIANT
   s1.e1 = e1; // COMPLIANT
   s1.e1 = s;  // NON_COMPLIANT
   s1.e1 = u;  // NON_COMPLIANT
   s1.e1 = f;  // NON_COMPLIANT
+  s1.e1 = cf; // NON_COMPLIANT
 
   s1.s = b;  // NON_COMPLIANT
   s1.s = e1; // NON_COMPLIANT
   s1.s = s;  // COMPLIANT
   s1.s = u;  // NON_COMPLIANT
   s1.s = f;  // NON_COMPLIANT
+  s1.s = cf; // NON_COMPLIANT
 
   s1.u = b;  // NON_COMPLIANT
   s1.u = e1; // NON_COMPLIANT
   s1.u = s;  // NON_COMPLIANT
   s1.u = u;  // COMPLIANT
   s1.u = f;  // NON_COMPLIANT
+  s1.u = cf; // NON_COMPLIANT
 
   s1.f = b;  // NON_COMPLIANT
   s1.f = e1; // NON_COMPLIANT
   s1.f = s;  // NON_COMPLIANT
   s1.f = u;  // NON_COMPLIANT
   s1.f = f;  // COMPLIANT
+  s1.f = cf; // NON_COMPLIANT
+
+  s1.cf = b;  // NON_COMPLIANT
+  s1.cf = e1; // NON_COMPLIANT
+  s1.cf = s;  // NON_COMPLIANT
+  s1.cf = u;  // NON_COMPLIANT
+  s1.cf = f;  // COMPLIANT
+  s1.cf = cf; // COMPLIANT
+}
+
+void testException4() {
+  float f32 = 10.0f;           // COMPLIANT
+  double f64 = 10.0f;          // COMPLIANT
+  float _Complex cf32a = f32;  // COMPLIANT
+  float _Complex cf32b = f64;  // NON_COMPLIANT
+  double _Complex cf64a = f32; // COMPLIANT
+  double _Complex cf64b = f64; // COMPLIANT
+
+  double _Complex f64byparts_a = 10.0i;             // COMPLIANT
+  double _Complex f64byparts_b = 10.0 * I;          // COMPLIANT
+  double _Complex f64byparts_c = 10.0f + 10.0i;     // COMPLIANT
+  double _Complex f64byparts_d = 10.0f + 10.0f * I; // COMPLIANT
+}
+
+void testBinaryBitwise() {
+  signed int s32 = 100;          // COMPLIANT - wider
+  signed short s16 = 0;          // COMPLIANT - wider
+  signed char s8 = 0;            // COMPLIANT - wider
+  unsigned int u32 = 100;        // COMPLIANT - by exception 1
+  unsigned char u8 = 0;          // COMPLIANT - by exception 1
+  unsigned short u16 = 0;        // COMPLIANT - by exception 1
+  int x1 = s32 & u32;            // NON_COMPLIANT - integer promotion to u32
+  int x2 = s32 | u32;            // NON_COMPLIANT - integer promotion to u32
+  int x3 = s32 ^ u32;            // NON_COMPLIANT - integer promotion to u32
+  int x4 = s16 & s32;            // COMPLIANT
+  int x5 = s16 & u16;            // COMPLIANT
+  int x6 = s16 & s8;             // COMPLIANT
+  signed short x7 = s16 & s8;    // COMPLIANT
+  signed char x8 = s16 & s8;     // NON_COMPLIANT
+  signed char x9 = s8 & s8;      // COMPLIANT
+  signed short x10 = s8 & s8;    // COMPLIANT
+  unsigned int x11 = u16 & u8;   // COMPLIANT
+  unsigned short x12 = u16 & u8; // COMPLIANT
+  unsigned char x13 = u16 & u8;  // NON_COMPLIANT
+  unsigned char x14 = u8 & u8;   // COMPLIANT
+  unsigned short x15 = u8 & u8;  // COMPLIANT
+  unsigned int x16 = s16 & s8;   // NON_COMPLIANT
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.expected b/c/misra/test/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.expected
index 333c3ad581..c85f2a447e 100644
--- a/c/misra/test/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.expected
+++ b/c/misra/test/rules/RULE-10-4/OperandsWithMismatchedEssentialTypeCategory.expected
@@ -1,10 +1,13 @@
-| test.c:14:3:14:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Unsigned type, right operand: essentially Signed type). |
-| test.c:15:3:15:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Unsigned type). |
-| test.c:16:3:16:10 | ... += ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Unsigned type). |
-| test.c:17:3:17:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Floating type, right operand: essentially Signed type). |
-| test.c:18:3:18:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Floating type). |
-| test.c:19:3:19:10 | ... += ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Floating type). |
-| test.c:27:3:27:9 | ... - ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Character type). |
-| test.c:28:3:28:10 | ... -= ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Character type). |
-| test.c:34:3:34:11 | ... < ... | The operands of this operator with usual arithmetic conversions have mismatched essentially Enum types (left operand: E1, right operand: E2). |
-| test.c:35:3:35:7 | ... < ... | The operands of this operator with usual arithmetic conversions have mismatched essentially Enum types (left operand: E1, right operand: E2). |
+| test.c:15:3:15:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Unsigned type, right operand: essentially Signed type). |
+| test.c:16:3:16:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Unsigned type). |
+| test.c:17:3:17:10 | ... += ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Unsigned type). |
+| test.c:18:3:18:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Floating type, right operand: essentially Signed type). |
+| test.c:19:3:19:9 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Floating type). |
+| test.c:20:3:20:10 | ... += ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Floating type). |
+| test.c:21:3:21:10 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Complex Floating type, right operand: essentially Signed type). |
+| test.c:22:3:22:10 | ... + ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Complex Floating type). |
+| test.c:23:3:23:11 | ... += ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Complex Floating type). |
+| test.c:31:3:31:9 | ... - ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Character type). |
+| test.c:32:3:32:10 | ... -= ... | The operands of this operator with usual arithmetic conversions have mismatched essential types (left operand: essentially Signed type, right operand: essentially Character type). |
+| test.c:43:3:43:11 | ... < ... | The operands of this operator with usual arithmetic conversions have mismatched essentially Enum types (left operand: E1, right operand: E2). |
+| test.c:44:3:44:7 | ... < ... | The operands of this operator with usual arithmetic conversions have mismatched essentially Enum types (left operand: E1, right operand: E2). |
diff --git a/c/misra/test/rules/RULE-10-4/test.c b/c/misra/test/rules/RULE-10-4/test.c
index cbcb7191f6..223aacbdad 100644
--- a/c/misra/test/rules/RULE-10-4/test.c
+++ b/c/misra/test/rules/RULE-10-4/test.c
@@ -3,6 +3,7 @@ void testOps() {
   signed long long s64 = 100;
   unsigned int u = 100;
   float f = 10.0f;
+  float _Complex cf = 10.0f;
   char c = 'A';
 
   s32 + s32;  // COMPLIANT
@@ -17,6 +18,9 @@ void testOps() {
   f + s32;    // NON_COMPLIANT
   s32 + f;    // NON_COMPLIANT
   s32 += f;   // NON_COMPLIANT
+  cf + s32;   // NON_COMPLIANT
+  s32 + cf;   // NON_COMPLIANT
+  s32 += cf;  // NON_COMPLIANT
 
   c + s32;  // COMPLIANT - by exception
   c += s32; // COMPLIANT - by exception
@@ -27,6 +31,11 @@ void testOps() {
   s32 - c;  // NON_COMPLIANT
   s32 -= c; // NON_COMPLIANT
 
+  cf + f; // COMPLIANT - by exception
+  f + cf; // COMPLIANT - by exception
+  cf *f;  // COMPLIANT - by exception
+  f *cf;  // COMPLIANT - by exception
+
   enum E1 { A, B, C } e1a;
   enum E2 { D, E, F } e2a;
   e1a < e1a; // COMPLIANT
diff --git a/c/misra/test/rules/RULE-10-5/InappropriateEssentialTypeCast.expected b/c/misra/test/rules/RULE-10-5/InappropriateEssentialTypeCast.expected
index 731ad9f312..2f4c38eb95 100644
--- a/c/misra/test/rules/RULE-10-5/InappropriateEssentialTypeCast.expected
+++ b/c/misra/test/rules/RULE-10-5/InappropriateEssentialTypeCast.expected
@@ -1,20 +1,25 @@
-| test.c:9:3:9:9 | (char)... | Incompatible cast from essentially Boolean type to essentially Character type. |
-| test.c:10:3:10:13 | (E1)... | Incompatible cast from essentially Boolean type to essentially Enum Type. |
-| test.c:11:3:11:15 | (signed int)... | Incompatible cast from essentially Boolean type to essentially Signed type. |
-| test.c:12:3:12:17 | (unsigned int)... | Incompatible cast from essentially Boolean type to essentially Unsigned type. |
-| test.c:13:3:13:10 | (float)... | Incompatible cast from essentially Boolean type to essentially Floating type. |
-| test.c:16:3:16:11 | (bool)... | Incompatible cast from essentially Character type to essentially Boolean type. |
-| test.c:18:3:18:13 | (E1)... | Incompatible cast from essentially Character type to essentially Enum Type. |
-| test.c:21:3:21:10 | (float)... | Incompatible cast from essentially Character type to essentially Floating type. |
-| test.c:24:3:24:11 | (bool)... | Incompatible cast from essentially Enum Type to essentially Boolean type. |
-| test.c:26:3:26:13 | (E1)... | Incompatible cast from E2 to E1. |
-| test.c:33:3:33:11 | (bool)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
-| test.c:35:3:35:13 | (E1)... | Incompatible cast from essentially Signed type to essentially Enum Type. |
-| test.c:41:3:41:11 | (bool)... | Incompatible cast from essentially Unsigned type to essentially Boolean type. |
-| test.c:43:3:43:13 | (E1)... | Incompatible cast from essentially Unsigned type to essentially Enum Type. |
-| test.c:49:3:49:11 | (bool)... | Incompatible cast from essentially Floating type to essentially Boolean type. |
-| test.c:50:3:50:9 | (char)... | Incompatible cast from essentially Floating type to essentially Character type. |
-| test.c:51:3:51:13 | (E1)... | Incompatible cast from essentially Floating type to essentially Enum Type. |
-| test.c:68:3:68:10 | (bool)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
-| test.c:72:3:72:16 | (MyBool)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
-| test.c:76:3:76:12 | (boolean)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
+| test.c:10:3:10:9 | (char)... | Incompatible cast from essentially Boolean type to essentially Character type. |
+| test.c:11:3:11:13 | (E1)... | Incompatible cast from essentially Boolean type to essentially Enum Type. |
+| test.c:12:3:12:15 | (signed int)... | Incompatible cast from essentially Boolean type to essentially Signed type. |
+| test.c:13:3:13:17 | (unsigned int)... | Incompatible cast from essentially Boolean type to essentially Unsigned type. |
+| test.c:14:3:14:10 | (float)... | Incompatible cast from essentially Boolean type to essentially Floating type. |
+| test.c:15:3:15:20 | (_Complex float)... | Incompatible cast from essentially Boolean type to essentially Complex Floating type. |
+| test.c:18:3:18:11 | (bool)... | Incompatible cast from essentially Character type to essentially Boolean type. |
+| test.c:20:3:20:13 | (E1)... | Incompatible cast from essentially Character type to essentially Enum Type. |
+| test.c:23:3:23:10 | (float)... | Incompatible cast from essentially Character type to essentially Floating type. |
+| test.c:24:3:24:20 | (_Complex float)... | Incompatible cast from essentially Character type to essentially Complex Floating type. |
+| test.c:27:3:27:11 | (bool)... | Incompatible cast from essentially Enum Type to essentially Boolean type. |
+| test.c:29:3:29:13 | (E1)... | Incompatible cast from E2 to E1. |
+| test.c:37:3:37:11 | (bool)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
+| test.c:39:3:39:13 | (E1)... | Incompatible cast from essentially Signed type to essentially Enum Type. |
+| test.c:46:3:46:11 | (bool)... | Incompatible cast from essentially Unsigned type to essentially Boolean type. |
+| test.c:48:3:48:13 | (E1)... | Incompatible cast from essentially Unsigned type to essentially Enum Type. |
+| test.c:55:3:55:11 | (bool)... | Incompatible cast from essentially Floating type to essentially Boolean type. |
+| test.c:56:3:56:9 | (char)... | Incompatible cast from essentially Floating type to essentially Character type. |
+| test.c:57:3:57:13 | (E1)... | Incompatible cast from essentially Floating type to essentially Enum Type. |
+| test.c:64:3:64:12 | (bool)... | Incompatible cast from essentially Complex Floating type to essentially Boolean type. |
+| test.c:65:3:65:10 | (char)... | Incompatible cast from essentially Complex Floating type to essentially Character type. |
+| test.c:66:3:66:14 | (E1)... | Incompatible cast from essentially Complex Floating type to essentially Enum Type. |
+| test.c:84:3:84:10 | (bool)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
+| test.c:88:3:88:16 | (MyBool)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
+| test.c:92:3:92:12 | (boolean)... | Incompatible cast from essentially Signed type to essentially Boolean type. |
diff --git a/c/misra/test/rules/RULE-10-5/test.c b/c/misra/test/rules/RULE-10-5/test.c
index dbc5939f0f..d7a6d878f1 100644
--- a/c/misra/test/rules/RULE-10-5/test.c
+++ b/c/misra/test/rules/RULE-10-5/test.c
@@ -1,3 +1,4 @@
+#include <math.h>
 #include <stdbool.h>
 
 void testIncompatibleCasts() {
@@ -5,53 +6,68 @@ void testIncompatibleCasts() {
 
   _Bool b = true;
 
-  (_Bool) b;       // COMPLIANT
-  (char)b;         // NON_COMPLIANT
-  (enum E1) b;     // NON_COMPLIANT
-  (signed int)b;   // NON_COMPLIANT
-  (unsigned int)b; // NON_COMPLIANT
-  (float)b;        // NON_COMPLIANT
+  (_Bool) b;          // COMPLIANT
+  (char)b;            // NON_COMPLIANT
+  (enum E1) b;        // NON_COMPLIANT
+  (signed int)b;      // NON_COMPLIANT
+  (unsigned int)b;    // NON_COMPLIANT
+  (float)b;           // NON_COMPLIANT
+  (float _Complex) b; // NON_COMPLIANT
 
   char c = 100;
-  (_Bool) c;       // NON_COMPLIANT
-  (char)c;         // COMPLIANT
-  (enum E1) c;     // NON_COMPLIANT
-  (signed int)c;   // COMPLIANT
-  (unsigned int)c; // COMPLIANT
-  (float)c;        // NON_COMPLIANT
+  (_Bool) c;          // NON_COMPLIANT
+  (char)c;            // COMPLIANT
+  (enum E1) c;        // NON_COMPLIANT
+  (signed int)c;      // COMPLIANT
+  (unsigned int)c;    // COMPLIANT
+  (float)c;           // NON_COMPLIANT
+  (float _Complex) c; // NON_COMPLIANT
 
   enum E2 { C, D } e = C;
-  (_Bool) e;       // NON_COMPLIANT
-  (char)e;         // COMPLIANT
-  (enum E1) e;     // NON_COMPLIANT
-  (enum E2) e;     // COMPLIANT
-  (signed int)e;   // COMPLIANT
-  (unsigned int)e; // COMPLIANT
-  (float)e;        // COMPLIANT
+  (_Bool) e;          // NON_COMPLIANT
+  (char)e;            // COMPLIANT
+  (enum E1) e;        // NON_COMPLIANT
+  (enum E2) e;        // COMPLIANT
+  (signed int)e;      // COMPLIANT
+  (unsigned int)e;    // COMPLIANT
+  (float)e;           // COMPLIANT
+  (float _Complex) e; // COMPLIANT
 
   signed int i = 100;
-  (_Bool) i;       // NON_COMPLIANT
-  (char)i;         // COMPLIANT
-  (enum E1) i;     // NON_COMPLIANT
-  (signed int)i;   // COMPLIANT
-  (unsigned int)i; // COMPLIANT
-  (float)i;        // COMPLIANT
+  (_Bool) i;          // NON_COMPLIANT
+  (char)i;            // COMPLIANT
+  (enum E1) i;        // NON_COMPLIANT
+  (signed int)i;      // COMPLIANT
+  (unsigned int)i;    // COMPLIANT
+  (float)i;           // COMPLIANT
+  (float _Complex) i; // COMPLIANT
 
   unsigned int u = 100;
-  (_Bool) u;       // NON_COMPLIANT
-  (char)u;         // COMPLIANT
-  (enum E1) u;     // NON_COMPLIANT
-  (signed int)u;   // COMPLIANT
-  (unsigned int)u; // COMPLIANT
-  (float)u;        // COMPLIANT
+  (_Bool) u;          // NON_COMPLIANT
+  (char)u;            // COMPLIANT
+  (enum E1) u;        // NON_COMPLIANT
+  (signed int)u;      // COMPLIANT
+  (unsigned int)u;    // COMPLIANT
+  (float)u;           // COMPLIANT
+  (float _Complex) u; // COMPLIANT
 
   float f = 100.0;
-  (_Bool) f;       // NON_COMPLIANT
-  (char)f;         // NON_COMPLIANT
-  (enum E1) f;     // NON_COMPLIANT
-  (signed int)f;   // COMPLIANT
-  (unsigned int)f; // COMPLIANT
-  (float)f;        // COMPLIANT
+  (_Bool) f;          // NON_COMPLIANT
+  (char)f;            // NON_COMPLIANT
+  (enum E1) f;        // NON_COMPLIANT
+  (signed int)f;      // COMPLIANT
+  (unsigned int)f;    // COMPLIANT
+  (float)f;           // COMPLIANT
+  (float _Complex) f; // COMPLIANT
+
+  float _Complex cf = 100.0;
+  (_Bool) cf;          // NON_COMPLIANT
+  (char)cf;            // NON_COMPLIANT
+  (enum E1) cf;        // NON_COMPLIANT
+  (signed int)cf;      // COMPLIANT
+  (unsigned int)cf;    // COMPLIANT
+  (float)cf;           // COMPLIANT
+  (float _Complex) cf; // COMPLIANT
 }
 
 void testImplicit() {
diff --git a/c/misra/test/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.expected b/c/misra/test/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.expected
index 30b5e1efb7..ea8fc433b1 100644
--- a/c/misra/test/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.expected
+++ b/c/misra/test/rules/RULE-10-7/ImplicitConversionOfCompositeExpression.expected
@@ -1,3 +1,7 @@
 | test.c:5:3:5:16 | ... + ... | Implicit conversion of $@ from unsigned short to unsigned int | test.c:5:9:5:16 | ... * ... | composite op |
 | test.c:6:3:6:18 | ... * ... | Implicit conversion of $@ from unsigned short to unsigned int | test.c:6:9:6:17 | ... + ... | composite op |
 | test.c:9:3:9:20 | ... += ... | Implicit conversion of $@ from unsigned short to unsigned int | test.c:9:11:9:19 | ... + ... | composite op |
+| test.c:24:3:24:19 | ... + ... | Implicit conversion of $@ from float to double | test.c:24:10:24:18 | ... + ... | composite op |
+| test.c:25:3:25:21 | ... + ... | Implicit conversion of $@ from _Complex float to double | test.c:25:10:25:20 | ... + ... | composite op |
+| test.c:26:3:26:20 | ... + ... | Implicit conversion of $@ from float to _Complex double | test.c:26:11:26:19 | ... + ... | composite op |
+| test.c:27:3:27:22 | ... + ... | Implicit conversion of $@ from _Complex float to _Complex double | test.c:27:11:27:21 | ... + ... | composite op |
diff --git a/c/misra/test/rules/RULE-10-7/test.c b/c/misra/test/rules/RULE-10-7/test.c
index 59d0ed1437..7aaa1847e4 100644
--- a/c/misra/test/rules/RULE-10-7/test.c
+++ b/c/misra/test/rules/RULE-10-7/test.c
@@ -11,4 +11,18 @@ void testComposite() {
 
   signed int s32 = 100;
   s32 += (u16 + u16); // // ignored - prohibited by Rule 10.4
+
+  float f32 = 10.0f;
+  double f64 = 10.0f;
+  float _Complex cf32 = 10.0f;
+  double _Complex cf64 = 10.0f;
+
+  f32 + (f32 + f32);    // COMPLIANT
+  cf32 + (cf32 + cf32); // COMPLIANT
+  f32 + (cf32 + cf32);  // COMPLIANT
+  cf32 + (f32 + f32);   // COMPLIANT
+  f64 + (f32 + f32);    // NON_COMPLIANT
+  f64 + (cf32 + cf32);  // NON_COMPLIANT
+  cf64 + (f32 + f32);   // NON_COMPLIANT
+  cf64 + (cf32 + cf32); // NON_COMPLIANT
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-10-8/InappropriateCastOfCompositeExpression.expected b/c/misra/test/rules/RULE-10-8/InappropriateCastOfCompositeExpression.expected
index 85e2471a41..659b41199d 100644
--- a/c/misra/test/rules/RULE-10-8/InappropriateCastOfCompositeExpression.expected
+++ b/c/misra/test/rules/RULE-10-8/InappropriateCastOfCompositeExpression.expected
@@ -1,4 +1,10 @@
 | test.c:4:16:4:20 | ... + ... | Cast from essentially Unsigned type to essentially Signed type changes type category. |
 | test.c:5:18:5:22 | ... + ... | Cast from essentially Signed type to essentially Unsigned type changes type category. |
-| test.c:14:18:14:24 | ... + ... | Cast from essentially Unsigned type to essentially Unsigned type widens type. |
-| test.c:20:16:20:22 | ... + ... | Cast from essentially Signed type to essentially Signed type widens type. |
+| test.c:11:11:11:15 | ... + ... | Cast from essentially Unsigned type to essentially Floating type changes type category. |
+| test.c:12:20:12:24 | ... + ... | Cast from essentially Unsigned type to essentially Complex Floating type changes type category. |
+| test.c:13:18:13:22 | ... + ... | Cast from essentially Floating type to essentially Unsigned type changes type category. |
+| test.c:14:18:14:24 | ... + ... | Cast from essentially Complex Floating type to essentially Unsigned type changes type category. |
+| test.c:25:18:25:24 | ... + ... | Cast from essentially Unsigned type to essentially Unsigned type widens type. |
+| test.c:31:16:31:22 | ... + ... | Cast from essentially Signed type to essentially Signed type widens type. |
+| test.c:43:12:43:20 | ... + ... | Cast from essentially Floating type to essentially Floating type widens type. |
+| test.c:44:12:44:22 | ... + ... | Cast from essentially Complex Floating type to essentially Floating type widens type. |
diff --git a/c/misra/test/rules/RULE-10-8/test.c b/c/misra/test/rules/RULE-10-8/test.c
index 41efb6b8d8..31294ed550 100644
--- a/c/misra/test/rules/RULE-10-8/test.c
+++ b/c/misra/test/rules/RULE-10-8/test.c
@@ -5,6 +5,17 @@ void testDifferentEssentialType() {
   (unsigned int)(s + s); // NON_COMPLIANT
   (signed int)(s + s);   // COMPLIANT
   (unsigned int)(u + u); // COMPLIANT
+
+  float f = 1.0;
+  float _Complex cf = 1.0;
+  (float)(u + u);            // NON_COMPLIANT
+  (float _Complex)(u + u);   // NON_COMPLIANT
+  (unsigned int)(f + f);     // NON_COMPLIANT
+  (unsigned int)(cf + cf);   // NON_COMPLIANT
+  (float)(f + f);            // COMPLIANT
+  (float)(cf + cf);          // COMPLIANT
+  (float _Complex)(f + f);   // COMPLIANT
+  (float _Complex)(cf + cf); // COMPLIANT
 }
 
 void testWiderType() {
@@ -19,4 +30,18 @@ void testWiderType() {
 
   (signed int)(ss + ss); // NON_COMPLIANT
   (signed short)(s + s); // COMPLIANT
+
+  float f32 = 1.0;
+  double f64 = 1.0;
+  float _Complex cf32 = 1.0;
+  double _Complex cf64 = 1.0;
+
+  (float)(f32 + f32);             // COMPLIANT
+  (float)(cf32 + cf32);           // COMPLIANT
+  (float _Complex)(f32 + f32);    // COMPLIANT
+  (float _Complex)(cf32 + cf32);  // COMPLIANT
+  (double)(f32 + f32);            // NON_COMPLIANT
+  (double)(cf32 + cf32);          // NON_COMPLIANT
+  (double _Complex)(f64 + f64);   // COMPLIANT
+  (double _Complex)(cf64 + cf64); // COMPLIANT
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.expected b/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.expected
new file mode 100644
index 0000000000..d38aac6455
--- /dev/null
+++ b/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.expected
@@ -0,0 +1,8 @@
+| test.c:3:15:3:16 | definition of g3 | g3 declared with an atomic void type. |
+| test.c:10:17:10:18 | definition of m3 | m3 declared with an atomic void type. |
+| test.c:15:22:15:23 | definition of p2 | p2 declared with an atomic void type. |
+| test.c:20:23:20:24 | declaration of f2 | f2 declared with an atomic void type. |
+| test.c:21:25:21:26 | declaration of f3 | f3 declared with an atomic void type. |
+| test.c:22:14:22:15 | declaration of f4 | f4 declared with an atomic void type. |
+| test.c:23:16:23:17 | declaration of f5 | f5 declared with an atomic void type. |
+| test.c:27:3:27:19 | (_Atomic(void) *)... | Cast declared with an atomic void type. |
diff --git a/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.expected.clang b/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.expected.clang
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.qlref b/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.qlref
new file mode 100644
index 0000000000..2046575237
--- /dev/null
+++ b/c/misra/test/rules/RULE-11-10/AtomicQualifierAppliedToVoid.qlref
@@ -0,0 +1 @@
+rules/RULE-11-10/AtomicQualifierAppliedToVoid.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-11-10/test.c b/c/misra/test/rules/RULE-11-10/test.c
new file mode 100644
index 0000000000..8f8e837b66
--- /dev/null
+++ b/c/misra/test/rules/RULE-11-10/test.c
@@ -0,0 +1,28 @@
+// _Atomic void g1;  // doesn't compile
+_Atomic int g2;   // COMPLIANT
+_Atomic void *g3; // NON_COMPLIANT
+// _Atomic void g4[]; // doesn't compile
+void *_Atomic g5; // COMPLIANT
+
+struct {
+  _Atomic int m1; // COMPLIANT
+  // _Atomic void m2; // doesn't compile
+  _Atomic void *m3; // NON_COMPLIANT
+  void *_Atomic m4; // COMPLIANT
+} s1;
+
+void f(_Atomic int p1,  // COMPLIANT
+       _Atomic void *p2 // NON_COMPLIANT
+       // _Atomic void p3[] // doesn't compile, even though it perhaps should as
+       // it is adjusted to void*.
+) {}
+
+typedef _Atomic void *f2(void);     // NON_COMPLIANT
+typedef _Atomic void *(*f3)(void);  // NON_COMPLIANT
+typedef void f4(_Atomic void *);    // NON_COMPLIANT
+typedef void (*f5)(_Atomic void *); // NON_COMPLIANT
+
+void f6() {
+  (void *)0;         // COMPLIANT
+  (_Atomic void *)0; // NON_COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-11-10/test.c.clang b/c/misra/test/rules/RULE-11-10/test.c.clang
new file mode 100644
index 0000000000..c30368a48d
--- /dev/null
+++ b/c/misra/test/rules/RULE-11-10/test.c.clang
@@ -0,0 +1,28 @@
+// _Atomic void g1;  // doesn't compile
+_Atomic int g2;   // COMPLIANT
+// _Atomic void *g3; // NON_COMPLIANT
+// _Atomic void g4[]; // doesn't compile
+void *_Atomic g5; // COMPLIANT
+
+struct {
+  _Atomic int m1; // COMPLIANT
+  // _Atomic void m2; // doesn't compile
+  // _Atomic void *m3; // NON_COMPLIANT
+  void *_Atomic m4; // COMPLIANT
+} s1;
+
+void f(_Atomic int p1  // COMPLIANT
+       // _Atomic void *p2 // NON_COMPLIANT
+       // _Atomic void p3[] // doesn't compile, even though it perhaps should as
+       // it is adjusted to void*.
+) {}
+
+// typedef _Atomic void *f2(void);     // NON_COMPLIANT
+// typedef _Atomic void *(*f3)(void);  // NON_COMPLIANT
+// typedef void f4(_Atomic void *);    // NON_COMPLIANT
+// typedef void (*f5)(_Atomic void *); // NON_COMPLIANT
+
+void f6() {
+  (void *)0;         // COMPLIANT
+  // (_Atomic void *)0; // NON_COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.expected b/c/misra/test/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.expected
index 94cf6ee635..24e6c4d5af 100644
--- a/c/misra/test/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.expected
+++ b/c/misra/test/rules/RULE-11-3/CastBetweenObjectPointerAndDifferentObjectType.expected
@@ -6,3 +6,7 @@
 | test.c:21:3:21:16 | (int *)... | Cast performed between a pointer to object type (char) and a pointer to a different object type (int). |
 | test.c:22:20:22:21 | (int *)... | Cast performed between a pointer to object type (char) and a pointer to a different object type (int). |
 | test.c:23:3:23:18 | (long long *)... | Cast performed between a pointer to object type (int) and a pointer to a different object type (long long). |
+| test.c:26:3:26:13 | (char *)... | Cast performed between a pointer to object type (_Atomic(int)) and a pointer to a different object type (char). |
+| test.c:27:8:27:10 | (char *)... | Cast performed between a pointer to object type (_Atomic(int)) and a pointer to a different object type (char). |
+| test.c:28:3:28:21 | (_Atomic(char) *)... | Cast performed between a pointer to object type (_Atomic(int)) and a pointer to a different object type (_Atomic(char)). |
+| test.c:29:23:29:25 | (_Atomic(char) *)... | Cast performed between a pointer to object type (_Atomic(int)) and a pointer to a different object type (_Atomic(char)). |
diff --git a/c/misra/test/rules/RULE-11-3/test.c b/c/misra/test/rules/RULE-11-3/test.c
index 4730aeac03..0d91740438 100644
--- a/c/misra/test/rules/RULE-11-3/test.c
+++ b/c/misra/test/rules/RULE-11-3/test.c
@@ -21,4 +21,10 @@ void f1(void) {
   (int *const)v2;             // NON_COMPLIANT
   int *const v10 = v2;        // NON_COMPLIANT
   (long long *)v10;           // NON_COMPLIANT
+
+  _Atomic int *v11 = 0;
+  (char *)v11;             // NON_COMPLIANT
+  v2 = v11;                // NON_COMPLIANT
+  (_Atomic char *)v11;     // NON_COMPLIANT
+  _Atomic char *v12 = v11; // NON_COMPLIANT
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.expected b/c/misra/test/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.expected
index 48658e2176..aa7752d28a 100644
--- a/c/misra/test/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.expected
+++ b/c/misra/test/rules/RULE-11-8/CastRemovesConstOrVolatileQualification.expected
@@ -1,2 +1,6 @@
 | test.c:4:19:4:33 | (const char *)... | Cast of pointer removes volatile qualification from its base type. |
 | test.c:6:13:6:21 | (char *)... | Cast of pointer removes const qualification from its base type. |
+| test.c:9:3:9:11 | (char *)... | Cast of pointer removes atomic qualification from its base type. |
+| test.c:10:7:10:7 | (char *)... | Cast of pointer removes atomic qualification from its base type. |
+| test.c:11:3:11:17 | (const char *)... | Cast of pointer removes atomic qualification from its base type. |
+| test.c:12:7:12:7 | (const char *)... | Cast of pointer removes atomic qualification from its base type. |
diff --git a/c/misra/test/rules/RULE-11-8/test.c b/c/misra/test/rules/RULE-11-8/test.c
index 75c7fc189a..e0e3b3a2fb 100644
--- a/c/misra/test/rules/RULE-11-8/test.c
+++ b/c/misra/test/rules/RULE-11-8/test.c
@@ -5,5 +5,12 @@ int f1(void) {
   const char *c2 = (const char *)c;                  // COMPLIANT
   char *d = (char *)c;                               // NON_COMPLIANT
   const char *e = (const char *)d;                   // COMPLIANT
+  _Atomic char *f = 0;
+  (char *)f;               // NON_COMPLIANT
+  d = f;                   // NON_COMPLIANT
+  (const char *)f;         // NON_COMPLIANT
+  e = f;                   // NON_COMPLIANT
+  (const _Atomic char *)f; // COMPLIANT
+  (const _Atomic char *)f; // COMPLIANT
   return 0;
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.expected b/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.expected
new file mode 100644
index 0000000000..5a92fc72fd
--- /dev/null
+++ b/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.expected
@@ -0,0 +1,13 @@
+| test.c:43:13:43:13 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:44:18:44:18 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:45:13:45:13 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:46:18:46:18 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:65:6:65:6 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:71:9:71:9 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:82:18:82:18 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:83:3:83:31 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:84:3:84:39 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:85:3:85:19 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:86:3:86:23 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:87:3:87:19 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
+| test.c:88:3:88:23 | x | Invalid access to member '$@' on atomic struct or union. | test.c:5:7:5:7 | x | x |
diff --git a/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.expected.clang b/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.expected.clang
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.qlref b/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.qlref
new file mode 100644
index 0000000000..2196eeace1
--- /dev/null
+++ b/c/misra/test/rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.qlref
@@ -0,0 +1 @@
+rules/RULE-12-6/AtomicAggregateObjectDirectlyAccessed.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-12-6/test.c b/c/misra/test/rules/RULE-12-6/test.c
new file mode 100644
index 0000000000..74d9de2fca
--- /dev/null
+++ b/c/misra/test/rules/RULE-12-6/test.c
@@ -0,0 +1,89 @@
+#include "stdatomic.h"
+#include "string.h"
+
+typedef struct s1 {
+  int x;
+} s1;
+
+_Atomic s1 atomic_s1;
+// A non-atomic pointer to an atomic s1
+_Atomic s1 *ptr_atomic_s1;
+// An atomic pointer to a non-atomic s1
+s1 *_Atomic s1_atomic_ptr;
+
+_Atomic int g3;
+
+void takeCopy(s1 p1);
+
+void f1() {
+  s1 l1;
+  s1 *l2;
+  l1 = atomic_load(&atomic_s1);     // COMPLIANT
+  l1 = atomic_load(ptr_atomic_s1);  // COMPLIANT
+  l2 = atomic_load(&s1_atomic_ptr); // COMPLIANT
+  l1.x = 4;                         // COMPLIANT
+  l2->x = 4;                        // COMPLIANT
+  atomic_store(&atomic_s1, l1);     // COMPLIANT
+  atomic_store(ptr_atomic_s1, l1);  // COMPLIANT
+  atomic_store(&s1_atomic_ptr, l2); // COMPLIANT
+
+  // Undefined behavior, but not banned by this rule.
+  memset(&atomic_s1, 0, sizeof(atomic_s1));         // COMPLIANT
+  memset(ptr_atomic_s1, 0, sizeof(*ptr_atomic_s1)); // COMPLIANT
+
+  // OK: whole loads and stores are protected from data-races.
+  takeCopy(atomic_s1);      // COMPLIANT
+  takeCopy(*ptr_atomic_s1); // COMPLIANT
+  atomic_s1 = (s1){0};      // COMPLIANT
+  *ptr_atomic_s1 = (s1){0}; // COMPLIANT
+  atomic_s1 = *l2;          // COMPLIANT
+  ptr_atomic_s1 = l2;       // COMPLIANT
+
+  // Banned: circumvents data-race protection, results in UB.
+  atomic_s1.x;          // NON-COMPLIANT
+  ptr_atomic_s1->x;     // NON-COMPLIANT
+  atomic_s1.x = 0;      // NON-COMPLIANT
+  ptr_atomic_s1->x = 0; // NON-COMPLIANT
+
+  // OK: not evaluated.
+  sizeof(atomic_s1);        // COMPLIANT
+  sizeof(ptr_atomic_s1);    // COMPLIANT
+  sizeof(atomic_s1.x);      // COMPLIANT
+  sizeof(ptr_atomic_s1->x); // COMPLIANT
+
+  // All OK: not an atomic struct, but rather an atomic pointer to non-atomic
+  // struct.
+  memset(s1_atomic_ptr, 0, sizeof(*s1_atomic_ptr)); // COMPLIANT
+  takeCopy(*s1_atomic_ptr);                         // COMPLIANT
+  *s1_atomic_ptr = (s1){0};                         // COMPLIANT
+  s1_atomic_ptr = l2;                               // COMPLIANT
+  s1_atomic_ptr->x;                                 // COMPLIANT
+
+  // Atomic specifier hidden behind a typedef, still atomic:
+  typedef _Atomic s1 atomic_s1;
+  atomic_s1 l3;
+  l3.x; // NON_COMPLIANT
+
+  // Worst case scenario: a typedef of a volatile const pointer to an atomic
+  // typedef type.
+  typedef atomic_s1 *volatile const atomic_s1_specified_ptr;
+  atomic_s1_specified_ptr l4;
+  (l4)->x; // NON_COMPLIANT
+}
+
+#define NOOP(x) (x)
+#define DOT_FIELD_ACCESS_X(v) (v).x
+#define POINTER_FIELD_ACCESS_X(v) (v)->x
+#define GET_X_ATOMIC_S1() atomic_s1.x
+#define GET_X_PTR_ATOMIC_S1() atomic_s1.x
+
+void f2() {
+  // Banned UB with user macros:
+  NOOP(atomic_s1.x);                     // NON-COMPLIANT
+  DOT_FIELD_ACCESS_X(atomic_s1);         // NON-COMPLIANT
+  POINTER_FIELD_ACCESS_X(ptr_atomic_s1); // NON-COMPLIANT
+  GET_X_ATOMIC_S1();                     // NON-COMPLIANT
+  GET_X_PTR_ATOMIC_S1();                 // NON-COMPLIANT
+  GET_X_ATOMIC_S1() = 0;                 // NON-COMPLIANT
+  GET_X_PTR_ATOMIC_S1() = 0;             // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-12-6/test.c.clang b/c/misra/test/rules/RULE-12-6/test.c.clang
new file mode 100644
index 0000000000..83ad24cdb5
--- /dev/null
+++ b/c/misra/test/rules/RULE-12-6/test.c.clang
@@ -0,0 +1,89 @@
+#include "stdatomic.h"
+#include "string.h"
+
+typedef struct s1 {
+  int x;
+} s1;
+
+_Atomic s1 atomic_s1;
+// A non-atomic pointer to an atomic s1
+_Atomic s1 *ptr_atomic_s1;
+// An atomic pointer to a non-atomic s1
+s1 *_Atomic s1_atomic_ptr;
+
+_Atomic int g3;
+
+void takeCopy(s1 p1);
+
+void f1() {
+  s1 l1;
+  s1 *l2;
+  l1 = atomic_load(&atomic_s1);     // COMPLIANT
+  l1 = atomic_load(ptr_atomic_s1);  // COMPLIANT
+  l2 = atomic_load(&s1_atomic_ptr); // COMPLIANT
+  l1.x = 4;                         // COMPLIANT
+  l2->x = 4;                        // COMPLIANT
+  atomic_store(&atomic_s1, l1);     // COMPLIANT
+  atomic_store(ptr_atomic_s1, l1);  // COMPLIANT
+  atomic_store(&s1_atomic_ptr, l2); // COMPLIANT
+
+  // Undefined behavior, but not banned by this rule.
+  memset(&atomic_s1, 0, sizeof(atomic_s1));         // COMPLIANT
+  memset(ptr_atomic_s1, 0, sizeof(*ptr_atomic_s1)); // COMPLIANT
+
+  // OK: whole loads and stores are protected from data-races.
+  takeCopy(atomic_s1);      // COMPLIANT
+  takeCopy(*ptr_atomic_s1); // COMPLIANT
+  atomic_s1 = (s1){0};      // COMPLIANT
+  *ptr_atomic_s1 = (s1){0}; // COMPLIANT
+  atomic_s1 = *l2;          // COMPLIANT
+  ptr_atomic_s1 = l2;       // COMPLIANT
+
+  // Banned: circumvents data-race protection, results in UB.
+  // atomic_s1.x;          // NON-COMPLIANT
+  // ptr_atomic_s1->x;     // NON-COMPLIANT
+  // atomic_s1.x = 0;      // NON-COMPLIANT
+  // ptr_atomic_s1->x = 0; // NON-COMPLIANT
+
+  // OK: not evaluated.
+  sizeof(atomic_s1);        // COMPLIANT
+  sizeof(ptr_atomic_s1);    // COMPLIANT
+  // sizeof(atomic_s1.x);      // COMPLIANT
+  // sizeof(ptr_atomic_s1->x); // COMPLIANT
+
+  // All OK: not an atomic struct, but rather an atomic pointer to non-atomic
+  // struct.
+  memset(s1_atomic_ptr, 0, sizeof(*s1_atomic_ptr)); // COMPLIANT
+  takeCopy(*s1_atomic_ptr);                         // COMPLIANT
+  *s1_atomic_ptr = (s1){0};                         // COMPLIANT
+  s1_atomic_ptr = l2;                               // COMPLIANT
+  s1_atomic_ptr->x;                                 // COMPLIANT
+
+  // Atomic specifier hidden behind a typedef, still atomic:
+  typedef _Atomic s1 atomic_s1;
+  atomic_s1 l3;
+  // l3.x; // NON_COMPLIANT
+
+  // Worst case scenario: a typedef of a volatile const pointer to an atomic
+  // typedef type.
+  typedef atomic_s1 *volatile const atomic_s1_specified_ptr;
+  atomic_s1_specified_ptr l4;
+  // (l4)->x; // NON_COMPLIANT
+}
+
+#define NOOP(x) (x)
+#define DOT_FIELD_ACCESS_X(v) (v).x
+#define POINTER_FIELD_ACCESS_X(v) (v)->x
+#define GET_X_ATOMIC_S1() atomic_s1.x
+#define GET_X_PTR_ATOMIC_S1() atomic_s1.x
+
+void f2() {
+  // Banned UB with user macros:
+  // NOOP(atomic_s1.x);                     // NON-COMPLIANT
+  // DOT_FIELD_ACCESS_X(atomic_s1);         // NON-COMPLIANT
+  // POINTER_FIELD_ACCESS_X(ptr_atomic_s1); // NON-COMPLIANT
+  // GET_X_ATOMIC_S1();                     // NON-COMPLIANT
+  // GET_X_PTR_ATOMIC_S1();                 // NON-COMPLIANT
+  // GET_X_ATOMIC_S1() = 0;                 // NON-COMPLIANT
+  // GET_X_PTR_ATOMIC_S1() = 0;             // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.expected b/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.expected
new file mode 100644
index 0000000000..4fa06eb069
--- /dev/null
+++ b/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.expected
@@ -0,0 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnsequencedAtomicReads.ql:112,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnsequencedAtomicReads.ql:112,67-75)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (UnsequencedAtomicReads.ql:112,5-18)
+| test.c:44:12:44:18 | ... + ... | Atomic variable $@ has a $@ that is unsequenced with $@. | test.c:42:15:42:16 | a1 | a1 | test.c:44:12:44:13 | a1 | previous read | test.c:44:17:44:18 | a1 | another read |
+| test.c:46:3:46:37 | ... + ... | Atomic variable $@ has a $@ that is unsequenced with $@. | test.c:42:15:42:16 | a1 | a1 | test.c:46:16:46:17 | a1 | previous read | test.c:46:35:46:36 | a1 | another read |
diff --git a/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.expected.gcc b/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.expected.gcc
new file mode 100644
index 0000000000..ccfb4e6a7b
--- /dev/null
+++ b/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.expected.gcc
@@ -0,0 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnsequencedAtomicReads.ql:112,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnsequencedAtomicReads.ql:112,67-75)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (UnsequencedAtomicReads.ql:112,5-18)
+| test.c:44:12:44:18 | ... + ... | Atomic variable $@ has a $@ that is unsequenced with $@. | test.c:42:15:42:16 | a1 | a1 | test.c:44:12:44:13 | a1 | previous read | test.c:44:17:44:18 | a1 | another read |
+| test.c:46:15:46:17 | & ... | Atomic variable $@ has a $@ that is unsequenced with $@. | test.c:42:15:42:16 | a1 | a1 | test.c:46:16:46:17 | a1 | previous read | test.c:46:35:46:36 | a1 | another read |
diff --git a/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.qlref b/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.qlref
new file mode 100644
index 0000000000..46242df1b0
--- /dev/null
+++ b/c/misra/test/rules/RULE-13-2/UnsequencedAtomicReads.qlref
@@ -0,0 +1 @@
+rules/RULE-13-2/UnsequencedAtomicReads.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-13-2/UnsequencedSideEffects.expected b/c/misra/test/rules/RULE-13-2/UnsequencedSideEffects.expected
index 75bd8169ba..b6c704322c 100644
--- a/c/misra/test/rules/RULE-13-2/UnsequencedSideEffects.expected
+++ b/c/misra/test/rules/RULE-13-2/UnsequencedSideEffects.expected
@@ -1,6 +1,6 @@
-| test.c:6:12:6:18 | ... + ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:6:12:6:13 | l1 | side effect | test.c:6:12:6:13 | l1 | l1 | test.c:6:17:6:18 | l1 | side effect | test.c:6:17:6:18 | l1 | l1 |
-| test.c:7:12:7:18 | ... + ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:7:12:7:13 | l1 | side effect | test.c:7:12:7:13 | l1 | l1 | test.c:7:17:7:18 | l2 | side effect | test.c:7:17:7:18 | l2 | l2 |
-| test.c:17:3:17:21 | ... = ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:17:8:17:9 | l1 | side effect | test.c:17:8:17:9 | l1 | l1 | test.c:17:13:17:14 | l1 | side effect | test.c:17:13:17:14 | l1 | l1 |
-| test.c:19:3:19:5 | call to foo | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:19:7:19:8 | l1 | side effect | test.c:19:7:19:8 | l1 | l1 | test.c:19:11:19:12 | l2 | side effect | test.c:19:11:19:12 | l2 | l2 |
-| test.c:25:3:25:5 | call to foo | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:25:7:25:10 | ... ++ | side effect | test.c:25:7:25:8 | l8 | l8 | test.c:25:13:25:14 | l8 | read | test.c:25:13:25:14 | l8 | l8 |
-| test.c:35:5:35:13 | ... = ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:35:10:35:12 | ... ++ | side effect | test.c:35:10:35:10 | i | i | test.c:35:10:35:12 | ... ++ | side effect | test.c:35:10:35:10 | i | i |
\ No newline at end of file
+| test.c:8:12:8:18 | ... + ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:8:12:8:13 | l1 | side effect | test.c:8:12:8:13 | l1 | l1 | test.c:8:17:8:18 | l1 | side effect | test.c:8:17:8:18 | l1 | l1 |
+| test.c:9:12:9:18 | ... + ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:9:12:9:13 | l1 | side effect | test.c:9:12:9:13 | l1 | l1 | test.c:9:17:9:18 | l2 | side effect | test.c:9:17:9:18 | l2 | l2 |
+| test.c:19:3:19:21 | ... = ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:19:8:19:9 | l1 | side effect | test.c:19:8:19:9 | l1 | l1 | test.c:19:13:19:14 | l1 | side effect | test.c:19:13:19:14 | l1 | l1 |
+| test.c:21:3:21:5 | call to foo | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:21:7:21:8 | l1 | side effect | test.c:21:7:21:8 | l1 | l1 | test.c:21:11:21:12 | l2 | side effect | test.c:21:11:21:12 | l2 | l2 |
+| test.c:27:3:27:5 | call to foo | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:27:7:27:10 | ... ++ | side effect | test.c:27:7:27:8 | l8 | l8 | test.c:27:13:27:14 | l8 | read | test.c:27:13:27:14 | l8 | l8 |
+| test.c:37:5:37:13 | ... = ... | The expression contains unsequenced $@ to $@ and $@ to $@. | test.c:37:10:37:12 | ... ++ | side effect | test.c:37:10:37:10 | i | i | test.c:37:10:37:12 | ... ++ | side effect | test.c:37:10:37:10 | i | i |
diff --git a/c/misra/test/rules/RULE-13-2/test.c b/c/misra/test/rules/RULE-13-2/test.c
index 1bebec3775..e1be53a037 100644
--- a/c/misra/test/rules/RULE-13-2/test.c
+++ b/c/misra/test/rules/RULE-13-2/test.c
@@ -1,3 +1,5 @@
+#include <stdatomic.h>
+
 void foo(int, int);
 
 void unsequenced_sideeffects1() {
@@ -34,4 +36,15 @@ void unsequenced_sideeffects2() {
   for (i = 0; i < 10; i++) {
     test(i++); // NON_COMPLIANT
   }
+}
+
+void atomics() {
+  _Atomic int a1, a2;
+  int l3 = a1 + a2;                    // COMPLIANT
+  int l4 = a1 + a1;                    // NON_COMPLIANT
+  a1 = a1 + 1;                         // COMPLIANT
+  atomic_load(&a1) + atomic_load(&a1); // NON_COMPLIANT
+  atomic_load(&a1) + atomic_load(&a2); // COMPLIANT
+  atomic_store(&a1, atomic_load(&a1)); // COMPLIANT
+  atomic_store(&a1, a1);               // COMPLIANT
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected b/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected
index c03c04d6cc..3beb834f84 100644
--- a/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected
+++ b/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected
@@ -5,3 +5,4 @@
 | test.c:27:10:27:14 | ... < ... | Controlling expression in loop statement has an invariant value. |
 | test.c:37:3:37:6 | 1 | Controlling expression in conditional statement has an invariant value. |
 | test.c:38:3:38:3 | 1 | Controlling expression in conditional statement has an invariant value. |
+| test.c:45:10:45:26 | ... && ... | Controlling expression in loop statement has an invariant value. |
diff --git a/c/misra/test/rules/RULE-14-3/test.c b/c/misra/test/rules/RULE-14-3/test.c
index 38db3e1286..ed8854afd2 100644
--- a/c/misra/test/rules/RULE-14-3/test.c
+++ b/c/misra/test/rules/RULE-14-3/test.c
@@ -37,4 +37,11 @@ void f5(bool b1) {
   true ? 1 : 2; // NON_COMPLIANT
   1 ? 1 : 2;    // NON_COMPLIANT
   b1 ? 1 : 2;   // COMPLIANT
+}
+
+void f6(int p1) {
+  while (p1 < 10 && p1 > 12) { // NON_COMPLIANT[FALSE_NEGATIVE]
+  }
+  while (1 == 0 && p1 > 12) { // NON_COMPLIANT
+  }
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-17-11/test.c b/c/misra/test/rules/RULE-17-11/test.c
index 7baaea5821..73227accb9 100644
--- a/c/misra/test/rules/RULE-17-11/test.c
+++ b/c/misra/test/rules/RULE-17-11/test.c
@@ -86,7 +86,7 @@ __attribute__((noreturn)) void test_noreturn_f13(int i) { // COMPLIANT
 
 // Allowed by exception. It is undefined behavior for main() to be declared with
 // noreturn.
-int main(char **argv, int argc) { // COMPLIANT
+int main(int argc, char *argv[]) { // COMPLIANT
   abort();
 }
 
diff --git a/c/misra/test/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.expected b/c/misra/test/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.expected
index 913f6f1c34..174c6aa40f 100644
--- a/c/misra/test/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.expected
+++ b/c/misra/test/rules/RULE-17-5/ArrayFunctionArgumentNumberOfElements.expected
@@ -1,3 +1,9 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArrayFunctionArgumentNumberOfElements.ql:48,36-44)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArrayFunctionArgumentNumberOfElements.ql:49,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArrayFunctionArgumentNumberOfElements.ql:51,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArrayFunctionArgumentNumberOfElements.ql:56,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArrayFunctionArgumentNumberOfElements.ql:72,28-36)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArrayFunctionArgumentNumberOfElements.ql:72,51-59)
 | test.c:18:6:18:6 | 0 | The function argument does not have a sufficient number or elements declared in the $@. | test.c:1:13:1:14 | ar | parameter |
 | test.c:19:6:19:7 | ar | The function argument does not have a sufficient number or elements declared in the $@. | test.c:1:13:1:14 | ar | parameter |
 | test.c:21:6:21:9 | ar2p | The function argument does not have a sufficient number or elements declared in the $@. | test.c:1:13:1:14 | ar | parameter |
diff --git a/c/misra/test/rules/RULE-18-10/test.c b/c/misra/test/rules/RULE-18-10/test.c
index 645943733d..565b51e8de 100644
--- a/c/misra/test/rules/RULE-18-10/test.c
+++ b/c/misra/test/rules/RULE-18-10/test.c
@@ -57,10 +57,10 @@ void f1(
     } p20,
 
     // Unknown array length types:
-    int p21[],       // COMPLIANT
-    int p22[][],     // COMPLIANT
-    int (*p23)[],    // COMPLIANT
-    int (*p24)[2][], // COMPLIANT
+    int p21[],    // COMPLIANT
+    int p22[][2], // COMPLIANT
+    int (*p23)[], // COMPLIANT
+    // int (*p24)[2][], // doesn't compile
     int (*p25)[][2], // COMPLIANT
 
     // VLA types that are rewritten as pointers:
@@ -73,7 +73,7 @@ void f1(
   int(*l2)[3];  // COMPLIANT
   int(*l3)[p0]; // NON-COMPLIANT
 
-  int l6[10] = p23;
+  int l6[10];
 
   // A pointer to a VMT may be declared `static`.
   static int(*l4)[p0]; // NON-COMPLIANT
diff --git a/c/misra/test/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.expected b/c/misra/test/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.expected
new file mode 100644
index 0000000000..99c5a91645
--- /dev/null
+++ b/c/misra/test/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.expected
@@ -0,0 +1,4 @@
+| test.c:29:3:29:10 | ... = ... | Thread local object $@ address copied to static object $@. | test.c:8:19:8:20 | test.c:8:19:8:20 | t1 | test.c:12:6:12:7 | test.c:12:6:12:7 | g2 |
+| test.c:55:3:55:14 | ... = ... | Thread local object $@ address copied to static object $@. | test.c:10:17:10:18 | test.c:10:17:10:18 | t3 | test.c:13:3:13:4 | test.c:13:3:13:4 | g3 |
+| test.c:152:3:152:21 | ... = ... | Thread local object $@ address copied to static object $@. | test.c:152:16:152:20 | test.c:152:16:152:20 | & ... | test.c:12:6:12:7 | test.c:12:6:12:7 | g2 |
+| test.c:155:3:155:23 | ... = ... | Thread local object $@ address copied to static object $@. | test.c:155:18:155:22 | test.c:155:18:155:22 | & ... | test.c:13:3:13:4 | test.c:13:3:13:4 | g3 |
diff --git a/c/misra/test/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.qlref b/c/misra/test/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.qlref
new file mode 100644
index 0000000000..90cdd7a43f
--- /dev/null
+++ b/c/misra/test/rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.qlref
@@ -0,0 +1 @@
+rules/RULE-18-6/ThreadLocalObjectAddressCopiedToGlobalObject.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-18-6/test.c b/c/misra/test/rules/RULE-18-6/test.c
new file mode 100644
index 0000000000..13b1070397
--- /dev/null
+++ b/c/misra/test/rules/RULE-18-6/test.c
@@ -0,0 +1,169 @@
+#include <threads.h>
+
+typedef struct {
+  int *p;
+  int m
+} s;
+
+_Thread_local int t1;
+_Thread_local int *t2;
+_Thread_local s t3;
+int g1;
+int *g2;
+s g3;
+
+void f1() {
+  // Regular object accesses
+  t1 = t1;   // COMPLIANT
+  t1 = *t2;  // COMPLIANT
+  t1 = g1;   // COMPLIANT
+  t1 = *g2;  // COMPLIANT
+  g1 = t1;   // COMPLIANT
+  g1 = *t2;  // COMPLIANT
+  g1 = g1;   // COMPLIANT
+  g1 = *g2;  // COMPLIANT
+  t2 = &t1;  // COMPLIANT
+  t2 = t2;   // COMPLIANT
+  t2 = &g1;  // COMPLIANT
+  t2 = g2;   // COMPLIANT
+  g2 = &t1;  // NON-COMPLIANT
+  g2 = t2;   // COMPLIANT
+  g2 = &g1;  // COMPLIANT
+  g2 = g2;   // COMPLIANT
+  *t2 = t1;  // COMPLIANT
+  *t2 = *t2; // COMPLIANT
+  *t2 = g1;  // COMPLIANT
+  *t2 = *g2; // COMPLIANT
+  *g2 = t1;  // COMPLIANT
+  *g2 = *t2; // COMPLIANT
+  *g2 = g1;  // COMPLIANT
+  *g2 = *g2; // COMPLIANT
+
+  // Subobject accesses
+  t3.m = t3.m;   // COMPLIANT
+  t3.m = *t3.p;  // COMPLIANT
+  t3.m = g3.m;   // COMPLIANT
+  t3.m = *g3.p;  // COMPLIANT
+  g3.m = t3.m;   // COMPLIANT
+  g3.m = *t3.p;  // COMPLIANT
+  g3.m = g3.m;   // COMPLIANT
+  g3.m = *g3.p;  // COMPLIANT
+  t3.p = &t3.m;  // COMPLIANT
+  t3.p = t3.p;   // COMPLIANT
+  t3.p = &g3.m;  // COMPLIANT
+  t3.p = g3.p;   // COMPLIANT
+  g3.p = &t3.m;  // NON-COMPLIANT
+  g3.p = t3.p;   // COMPLIANT
+  g3.p = &g3.m;  // COMPLIANT
+  g3.p = g3.p;   // COMPLIANT
+  *t3.p = t3.m;  // COMPLIANT
+  *t3.p = *t3.p; // COMPLIANT
+  *t3.p = g3.m;  // COMPLIANT
+  *t3.p = *g3.p; // COMPLIANT
+  *g3.p = t3.m;  // COMPLIANT
+  *g3.p = *t3.p; // COMPLIANT
+  *g3.p = g3.m;  // COMPLIANT
+  *g3.p = *g3.p; // COMPLIANT
+
+  // Storing values in locals (automatic storage duration)
+  int l1;
+  int *l2;
+  s l3;
+
+  l1 = l1;       // COMPLIANT
+  l1 = *l2;      // COMPLIANT
+  l1 = l3.m;     // COMPLIANT
+  l1 = *l3.p;    // COMPLIANT
+  l1 = t1;       // COMPLIANT
+  l1 = *t2;      // COMPLIANT
+  l1 = t3.m;     // COMPLIANT
+  l1 = *t3.p;    // COMPLIANT
+  l1 = g1;       // COMPLIANT
+  l1 = *g2;      // COMPLIANT
+  l1 = g3.m;     // COMPLIANT
+  l1 = *g3.p;    // COMPLIANT
+  l2 = &l1;      // COMPLIANT
+  l2 = l2;       // COMPLIANT
+  l2 = &l3.m;    // COMPLIANT
+  l2 = l3.p;     // COMPLIANT
+  l2 = &t1;      // COMPLIANT
+  l2 = t2;       // COMPLIANT
+  l2 = &t3.m;    // COMPLIANT
+  l2 = t3.p;     // COMPLIANT
+  l2 = &g1;      // COMPLIANT
+  l2 = g2;       // COMPLIANT
+  l2 = &g3.m;    // COMPLIANT
+  l2 = g3.p;     // COMPLIANT
+  *l2 = l1;      // COMPLIANT
+  *l2 = *l2;     // COMPLIANT
+  *l2 = l3.m;    // COMPLIANT
+  *l2 = *l3.p;   // COMPLIANT
+  *l2 = t1;      // COMPLIANT
+  *l2 = *t2;     // COMPLIANT
+  *l2 = t3.m;    // COMPLIANT
+  *l2 = *t3.p;   // COMPLIANT
+  *l2 = g1;      // COMPLIANT
+  *l2 = *g2;     // COMPLIANT
+  *l2 = g3.m;    // COMPLIANT
+  *l2 = *g3.p;   // COMPLIANT
+  l3.m = l1;     // COMPLIANT
+  l3.m = *l2;    // COMPLIANT
+  l3.m = l3.m;   // COMPLIANT
+  l3.m = *l3.p;  // COMPLIANT
+  l3.m = t1;     // COMPLIANT
+  l3.m = *t2;    // COMPLIANT
+  l3.m = t3.m;   // COMPLIANT
+  l3.m = *t3.p;  // COMPLIANT
+  l3.m = g1;     // COMPLIANT
+  l3.m = *g2;    // COMPLIANT
+  l3.m = g3.m;   // COMPLIANT
+  l3.m = *g3.p;  // COMPLIANT
+  l3.p = &l1;    // COMPLIANT
+  l3.p = l2;     // COMPLIANT
+  l3.p = &l3.m;  // COMPLIANT
+  l3.p = l3.p;   // COMPLIANT
+  l3.p = &t1;    // COMPLIANT
+  l3.p = t2;     // COMPLIANT
+  l3.p = &t3.m;  // COMPLIANT
+  l3.p = t3.p;   // COMPLIANT
+  l3.p = &g1;    // COMPLIANT
+  l3.p = g2;     // COMPLIANT
+  l3.p = &g3.m;  // COMPLIANT
+  l3.p = g3.p;   // COMPLIANT
+  *l3.p = l1;    // COMPLIANT
+  *l3.p = *l2;   // COMPLIANT
+  *l3.p = l3.m;  // COMPLIANT
+  *l3.p = *l3.p; // COMPLIANT
+  *l3.p = t1;    // COMPLIANT
+  *l3.p = *t2;   // COMPLIANT
+  *l3.p = t3.m;  // COMPLIANT
+  *l3.p = *t3.p; // COMPLIANT
+  *l3.p = g1;    // COMPLIANT
+  *l3.p = *g2;   // COMPLIANT
+  *l3.p = g3.m;  // COMPLIANT
+  *l3.p = *g3.p; // COMPLIANT
+
+  // Storing local values in globals is covered by the shared query.
+}
+
+tss_t tss1;
+void f2() {
+  g1 = *(int *)tss_get(&tss1);       // COMPLIANT
+  g2 = tss_get(&tss1);               // NON-COMPLIANT
+  *g2 = *(int *)tss_get(&tss1);      // COMPLIANT
+  g3.m = *(int *)tss_get(&tss1);     // COMPLIANT
+  g3.p = tss_get(&tss1);             // NON-COMPLIANT
+  *g3.p = *(int *)tss_get(&tss1);    // COMPLIANT
+  g1 = ((s *)tss_get(&tss1))->m;     // COMPLIANT
+  g1 = *((s *)tss_get(&tss1))->p;    // COMPLIANT
+  g2 = &((s *)tss_get(&tss1))->m;    // NON-COMPLIANT[false negative]
+  g2 = *((s *)tss_get(&tss1))->p;    // COMPLIANT
+  *g2 = ((s *)tss_get(&tss1))->m;    // COMPLIANT
+  *g2 = *((s *)tss_get(&tss1))->p;   // COMPLIANT
+  g3.m = ((s *)tss_get(&tss1))->m;   // COMPLIANT
+  g3.m = *((s *)tss_get(&tss1))->p;  // COMPLIANT
+  g3.p = &((s *)tss_get(&tss1))->m;  // NON-COMPLIANT[false negative]
+  g3.p = *((s *)tss_get(&tss1))->p;  // COMPLIANT
+  *g3.p = ((s *)tss_get(&tss1))->m;  // COMPLIANT
+  *g3.p = *((s *)tss_get(&tss1))->p; // COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-18-8/test.c b/c/misra/test/rules/RULE-18-8/test.c
index e6e038049c..ea639de271 100644
--- a/c/misra/test/rules/RULE-18-8/test.c
+++ b/c/misra/test/rules/RULE-18-8/test.c
@@ -28,8 +28,8 @@ void f1(int n,
         int p1[n], // COMPLIANT
         // Pointers to variably-modified types are not VLAs.
         int p2[n][n],
-        int p3[],  // array of unknown length is converted to pointer
-        int p4[][] // array of unknown length are not VLAs.
+        int p3[],   // array of unknown length is converted to pointer
+        int p4[][n] // array of unknown length are not VLAs.
 ) {}
 
 struct s {
diff --git a/c/misra/test/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.expected b/c/misra/test/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.expected
index 688dde4650..cf741ed16c 100644
--- a/c/misra/test/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.expected
+++ b/c/misra/test/rules/RULE-18-9/ArrayToPointerConversionOfTemporaryObject.expected
@@ -21,10 +21,10 @@
 | test.c:65:15:65:32 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:65:15:65:20 | call to get_s1 | call to get_s1 |
 | test.c:66:16:66:33 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:66:16:66:21 | call to get_s1 | call to get_s1 |
 | test.c:67:23:67:40 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:67:23:67:28 | call to get_s1 | call to get_s1 |
-| test.c:89:3:89:30 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:89:12:89:20 | member_s1 | member_s1 |
-| test.c:90:3:90:36 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:90:3:90:26 | access to array | access to array |
-| test.c:91:15:91:42 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:91:24:91:32 | member_s1 | member_s1 |
-| test.c:92:15:92:48 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:92:15:92:38 | access to array | access to array |
-| test.c:111:15:111:33 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:111:16:111:22 | ... = ... | ... = ... |
-| test.c:113:15:113:37 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:113:16:113:26 | ... ? ... : ... | ... ? ... : ... |
-| test.c:114:15:114:31 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:114:16:114:20 | ... , ... | ... , ... |
+| test.c:89:3:89:30 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:89:3:89:8 | call to get_s2 | call to get_s2 |
+| test.c:90:3:90:36 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:90:3:90:8 | call to get_s2 | call to get_s2 |
+| test.c:91:15:91:42 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:91:15:91:20 | call to get_s2 | call to get_s2 |
+| test.c:92:15:92:48 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:92:15:92:20 | call to get_s2 | call to get_s2 |
+| test.c:114:15:114:27 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:112:9:112:11 | arr | arr | test.c:114:16:114:22 | ... = ... | ... = ... |
+| test.c:116:15:116:37 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:116:16:116:26 | ... ? ... : ... | ... ? ... : ... |
+| test.c:117:15:117:31 | array to pointer conversion | Array to pointer conversion of array $@ from temporary object $@. | test.c:3:13:3:21 | const_arr | const_arr | test.c:117:16:117:20 | ... , ... | ... , ... |
diff --git a/c/misra/test/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.expected b/c/misra/test/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.expected
index ae140dcd59..4c961ee994 100644
--- a/c/misra/test/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.expected
+++ b/c/misra/test/rules/RULE-18-9/ModifiableLValueSubscriptedWithTemporaryLifetime.expected
@@ -3,13 +3,13 @@
 | test.c:82:3:82:17 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:82:12:82:14 | arr | arr | test.c:82:3:82:8 | call to get_s1 | call to get_s1 |
 | test.c:83:3:83:17 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:83:12:83:14 | arr | arr | test.c:83:3:83:8 | call to get_s1 | call to get_s1 |
 | test.c:84:5:84:19 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:84:14:84:16 | arr | arr | test.c:84:5:84:10 | call to get_s1 | call to get_s1 |
-| test.c:93:3:93:27 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:93:22:93:24 | arr | arr | test.c:93:12:93:20 | member_s1 | member_s1 |
-| test.c:94:3:94:27 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:94:22:94:24 | arr | arr | test.c:94:3:94:20 | access to array | access to array |
-| test.c:137:3:137:23 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:137:12:137:20 | arr_union | arr_union | test.c:137:3:137:8 | call to get_s3 | call to get_s3 |
-| test.c:138:3:138:24 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:138:12:138:21 | arr_struct | arr_struct | test.c:138:3:138:8 | call to get_s3 | call to get_s3 |
-| test.c:139:3:139:24 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:139:12:139:21 | arr_struct | arr_struct | test.c:139:3:139:8 | call to get_s3 | call to get_s3 |
-| test.c:140:3:140:24 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:140:12:140:21 | arr_struct | arr_struct | test.c:140:3:140:8 | call to get_s3 | call to get_s3 |
+| test.c:93:3:93:27 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:93:22:93:24 | arr | arr | test.c:93:3:93:8 | call to get_s2 | call to get_s2 |
+| test.c:94:3:94:27 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:94:22:94:24 | arr | arr | test.c:94:3:94:8 | call to get_s2 | call to get_s2 |
+| test.c:140:3:140:23 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:140:12:140:20 | arr_union | arr_union | test.c:140:3:140:8 | call to get_s3 | call to get_s3 |
 | test.c:141:3:141:24 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:141:12:141:21 | arr_struct | arr_struct | test.c:141:3:141:8 | call to get_s3 | call to get_s3 |
-| test.c:142:4:142:25 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:142:13:142:22 | arr_struct | arr_struct | test.c:142:4:142:9 | call to get_s3 | call to get_s3 |
-| test.c:146:3:146:22 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:146:12:146:16 | arr2d | arr2d | test.c:146:3:146:8 | call to get_s3 | call to get_s3 |
-| test.c:147:4:147:20 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:147:13:147:17 | arr2d | arr2d | test.c:147:4:147:9 | call to get_s3 | call to get_s3 |
+| test.c:142:3:142:24 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:142:12:142:21 | arr_struct | arr_struct | test.c:142:3:142:8 | call to get_s3 | call to get_s3 |
+| test.c:143:3:143:24 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:143:12:143:21 | arr_struct | arr_struct | test.c:143:3:143:8 | call to get_s3 | call to get_s3 |
+| test.c:144:3:144:24 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:144:12:144:21 | arr_struct | arr_struct | test.c:144:3:144:8 | call to get_s3 | call to get_s3 |
+| test.c:145:4:145:25 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:145:13:145:22 | arr_struct | arr_struct | test.c:145:4:145:9 | call to get_s3 | call to get_s3 |
+| test.c:149:3:149:19 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:149:12:149:16 | arr2d | arr2d | test.c:149:3:149:8 | call to get_s3 | call to get_s3 |
+| test.c:150:4:150:20 | access to array | Modifiable lvalue produced by subscripting array member $@ of temporary lifetime object $@  | test.c:150:13:150:17 | arr2d | arr2d | test.c:150:4:150:9 | call to get_s3 | call to get_s3 |
diff --git a/c/misra/test/rules/RULE-18-9/test.c b/c/misra/test/rules/RULE-18-9/test.c
index f2fb44fdc9..d5eb5ec35e 100644
--- a/c/misra/test/rules/RULE-18-9/test.c
+++ b/c/misra/test/rules/RULE-18-9/test.c
@@ -108,7 +108,10 @@ void f(void) {
   get_s2_ptr()->member_s1.arr[0] = 1;     // COMPLIANT
 
   // Other types of non-lvalue types
-  use_int_ptr((l1 = l1).const_arr);       // NON-COMPLIANT
+  struct {
+    int arr[10];
+  } l3;
+  use_int_ptr((l3 = l3).arr);             // NON-COMPLIANT
   use_int_ptr(((struct s1)l1).const_arr); // NON-COMPLIANT[FALSE_NEGATIVE]
   use_int_ptr((1 ? l1 : l1).const_arr);   // NON-COMPLIANT
   use_int_ptr((0, l1).const_arr);         // NON-COMPLIANT
diff --git a/c/misra/test/rules/RULE-2-8/UnusedObjectDefinition.expected b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinition.expected
new file mode 100644
index 0000000000..9a373a644c
--- /dev/null
+++ b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinition.expected
@@ -0,0 +1,12 @@
+| test.c:6:5:6:6 | definition of g2 | Unused object 'g2'. | test.c:6:5:6:6 | definition of g2 | (ignored) |
+| test.c:9:5:9:6 | definition of g3 | Unused object 'g3'. | test.c:9:5:9:6 | definition of g3 | (ignored) |
+| test.c:20:7:20:8 | definition of l2 | Unused object 'l2'. | test.c:20:7:20:8 | definition of l2 | (ignored) |
+| test.c:27:7:27:8 | definition of l5 | Unused object 'l5'. | test.c:27:7:27:8 | definition of l5 | (ignored) |
+| test.c:37:10:37:11 | definition of g5 | Unused object 'g5'. | test.c:37:10:37:11 | definition of g5 | (ignored) |
+| test.c:45:9:45:10 | definition of g6 | Unused object 'g6'. | test.c:45:9:45:10 | definition of g6 | (ignored) |
+| test.c:51:5:51:6 | definition of g7 | Unused object 'g7'. | test.c:51:5:51:6 | definition of g7 | (ignored) |
+| test.c:64:3:64:18 | ONLY_DEF_VAR(x) | Invocation of macro '$@' defines unused object 'l2'. | test.c:60:1:60:34 | #define ONLY_DEF_VAR(x) int x = 0; | ONLY_DEF_VAR |
+| test.c:68:1:71:5 | #define ALSO_DEF_VAR(x) int x = 0; while (1) ; | Macro 'ALSO_DEF_VAR' defines unused object with an invocation-dependent name, for example, '$@'. | test.c:73:16:73:17 | definition of l1 | l1 |
+| test.c:77:1:82:3 | #define DEF_UNUSED_INNER_VAR() { int _v = 0; while (1) ; } | Macro 'DEF_UNUSED_INNER_VAR' defines unused object '_v'. | test.c:77:1:82:3 | #define DEF_UNUSED_INNER_VAR() { int _v = 0; while (1) ; } | (ignored) |
+| test.c:119:11:119:13 | definition of g10 | Unused object 'g10'. | test.c:119:11:119:13 | definition of g10 | (ignored) |
+| test.c:124:13:124:14 | definition of l2 | Unused object 'l2'. | test.c:124:13:124:14 | definition of l2 | (ignored) |
diff --git a/c/misra/test/rules/RULE-2-8/UnusedObjectDefinition.qlref b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinition.qlref
new file mode 100644
index 0000000000..096c4c64f1
--- /dev/null
+++ b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinition.qlref
@@ -0,0 +1 @@
+rules/RULE-2-8/UnusedObjectDefinition.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-2-8/UnusedObjectDefinitionStrict.expected b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinitionStrict.expected
new file mode 100644
index 0000000000..fa191e5d68
--- /dev/null
+++ b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinitionStrict.expected
@@ -0,0 +1,4 @@
+| test.c:87:29:87:30 | definition of g8 | Unused object 'g8'. | test.c:87:29:87:30 | definition of g8 | (ignored) |
+| test.c:92:3:92:30 | ONLY_DEF_ATTR_UNUSED_VAR(x) | Invocation of macro '$@' defines unused object 'l2'. | test.c:88:1:88:70 | #define ONLY_DEF_ATTR_UNUSED_VAR(x) __attribute__((unused)) int x = 0; | ONLY_DEF_ATTR_UNUSED_VAR |
+| test.c:96:1:99:5 | #define ALSO_DEF_ATTR_UNUSED_VAR(x) __attribute__((unused)) int x = 0; while (1) ; | Macro 'ALSO_DEF_ATTR_UNUSED_VAR' defines unused object with an invocation-dependent name, for example, '$@'. | test.c:101:28:101:29 | definition of l1 | l1 |
+| test.c:106:1:111:3 | #define DEF_ATTR_UNUSED_INNER_VAR() { __attribute__((unused)) int _v = 0; while (1) ; } | Macro 'DEF_ATTR_UNUSED_INNER_VAR' defines unused object '_v'. | test.c:106:1:111:3 | #define DEF_ATTR_UNUSED_INNER_VAR() { __attribute__((unused)) int _v = 0; while (1) ; } | (ignored) |
diff --git a/c/misra/test/rules/RULE-2-8/UnusedObjectDefinitionStrict.qlref b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinitionStrict.qlref
new file mode 100644
index 0000000000..4aa7269881
--- /dev/null
+++ b/c/misra/test/rules/RULE-2-8/UnusedObjectDefinitionStrict.qlref
@@ -0,0 +1 @@
+rules/RULE-2-8/UnusedObjectDefinitionStrict.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-2-8/test.c b/c/misra/test/rules/RULE-2-8/test.c
new file mode 100644
index 0000000000..e35bf15567
--- /dev/null
+++ b/c/misra/test/rules/RULE-2-8/test.c
@@ -0,0 +1,133 @@
+// Not a definition, only a declaration:
+extern int g1; // COMPLIANT
+
+// Both declared + defined:
+extern int g2; // COMPLIANT
+int g2 = 1;    // NON_COMPLIANT
+
+// Definition is only declaration:
+int g3 = 1; // NON_COMPLIANT
+
+// Definition, but value is required for program to compile:
+int g4 = 1; // COMPLIANT
+void f1() { g4; }
+
+// Local variables:
+void f2() {
+  int l1; // COMPLIANT
+  l1;
+
+  int l2; // NON-COMPLIANT
+
+  // Value is required for the program to compile:
+  int l3; // COMPLIANT
+  sizeof(l3);
+
+  int l4, // COMPLIANT
+      l5; // NON-COMPLIANT
+  l4;
+}
+
+// Struct fields are not objects:
+struct s {
+  int x; // COMPLIANT
+};
+
+// Declaration of type struct is an object:
+struct s g5; // NON-COMPLIANT
+
+// Struct fields are not objects:
+union u {
+  int x; // COMPLIANT
+};
+
+// Declaration of type union is an object:
+union u g6; // NON-COMPLIANT
+
+// Typedefs are not objects:
+typedef int td1; // COMPLIANT
+
+// Declaration of typedef type object:
+td1 g7; // NON-COMPLIANT
+
+// Function parameters are not objects:
+void f3(int p) {} // COMPLIANT
+
+// Function type parameters are not objects:
+typedef int td2(int x); // COMPLIANT
+
+// Macros that define unused vars tests:
+#define ONLY_DEF_VAR(x) int x = 0;
+void f4() {
+  ONLY_DEF_VAR(l1); // COMPLIANT
+  l1;
+  ONLY_DEF_VAR(l2); // NON-COMPLIANT
+}
+
+// NON-COMPLIANT
+#define ALSO_DEF_VAR(x)                                                        \
+  int x = 0;                                                                   \
+  while (1)                                                                    \
+    ;
+void f5() {
+  ALSO_DEF_VAR(l1); // COMPLIANT
+  ALSO_DEF_VAR(l2); // COMPLIANT
+}
+
+#define DEF_UNUSED_INNER_VAR()                                                 \
+  {                                                                            \
+    int _v = 0;                                                                \
+    while (1)                                                                  \
+      ;                                                                        \
+  } // NON-COMPLIANT
+void f6() {
+  DEF_UNUSED_INNER_VAR(); // COMPLIANT
+}
+
+__attribute__((unused)) int g8 = 1; // NON-COMPLIANT
+#define ONLY_DEF_ATTR_UNUSED_VAR(x) __attribute__((unused)) int x = 0;
+void f7() {
+  ONLY_DEF_ATTR_UNUSED_VAR(l1); // COMPLIANT
+  l1;
+  ONLY_DEF_ATTR_UNUSED_VAR(l2); // NON-COMPLIANT
+}
+
+// NON-COMPLIANT
+#define ALSO_DEF_ATTR_UNUSED_VAR(x)                                            \
+  __attribute__((unused)) int x = 0;                                           \
+  while (1)                                                                    \
+    ;
+void f8() {
+  ALSO_DEF_ATTR_UNUSED_VAR(l1); // COMPLIANT
+  ALSO_DEF_ATTR_UNUSED_VAR(l2); // COMPLIANT
+}
+
+// NON-COMPLIANT
+#define DEF_ATTR_UNUSED_INNER_VAR()                                            \
+  {                                                                            \
+    __attribute__((unused)) int _v = 0;                                        \
+    while (1)                                                                  \
+      ;                                                                        \
+  }
+
+void f9() {
+  DEF_ATTR_UNUSED_INNER_VAR(); // COMPLIANT
+}
+
+// Const variable tests:
+const int g9 = 1;  // COMPLIANT
+const int g10 = 1; // NON-COMPLIANT
+
+void f10() {
+  g9;
+  const int l1 = 1; // COMPLIANT
+  const int l2 = 1; // NON-COMPLIANT
+  l1;
+}
+
+// Side effects should not disable this rule:
+void f11() {
+  int l1 = 1;    // COMPLIANT
+  int l2 = l1++; // COMPLIANT
+  l2;
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.expected b/c/misra/test/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.expected
index 747b25a2c1..8032bf38cc 100644
--- a/c/misra/test/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.expected
+++ b/c/misra/test/rules/RULE-21-12/ExceptionHandlingFeaturesOfFenvhUsed.expected
@@ -1,12 +1,16 @@
-| test.c:4:11:4:23 | call to feclearexcept | Call to banned function feclearexcept. |
-| test.c:4:25:4:34 | FE_INVALID | Call to banned macro FE_INVALID. |
-| test.c:6:3:6:17 | call to fegetexceptflag | Call to banned function fegetexceptflag. |
-| test.c:6:24:6:36 | FE_ALL_EXCEPT | Call to banned macro FE_ALL_EXCEPT. |
-| test.c:7:3:7:15 | call to feraiseexcept | Call to banned function feraiseexcept. |
-| test.c:7:17:7:28 | FE_DIVBYZERO | Call to banned macro FE_DIVBYZERO. |
-| test.c:8:3:8:15 | call to feraiseexcept | Call to banned function feraiseexcept. |
-| test.c:8:17:8:27 | FE_OVERFLOW | Call to banned macro FE_OVERFLOW. |
-| test.c:9:3:9:17 | call to fesetexceptflag | Call to banned function fesetexceptflag. |
-| test.c:9:24:9:36 | FE_ALL_EXCEPT | Call to banned macro FE_ALL_EXCEPT. |
-| test.c:10:3:10:14 | call to fetestexcept | Call to banned function fetestexcept. |
-| test.c:10:16:10:27 | FE_UNDERFLOW | Call to banned macro FE_UNDERFLOW. |
+| test.c:2:1:2:17 | #include <fenv.h> | Include of banned header 'fenv.h'. |
+| test.c:6:11:6:23 | call to feclearexcept | Call to banned function 'feclearexcept'. |
+| test.c:6:25:6:34 | FE_INVALID | Expansion of banned macro 'FE_INVALID'. |
+| test.c:8:3:8:17 | call to fegetexceptflag | Call to banned function 'fegetexceptflag'. |
+| test.c:8:24:8:36 | FE_ALL_EXCEPT | Expansion of banned macro 'FE_ALL_EXCEPT'. |
+| test.c:9:3:9:15 | call to feraiseexcept | Call to banned function 'feraiseexcept'. |
+| test.c:9:17:9:28 | FE_DIVBYZERO | Expansion of banned macro 'FE_DIVBYZERO'. |
+| test.c:10:3:10:15 | call to feraiseexcept | Call to banned function 'feraiseexcept'. |
+| test.c:10:17:10:27 | FE_OVERFLOW | Expansion of banned macro 'FE_OVERFLOW'. |
+| test.c:11:3:11:17 | call to fesetexceptflag | Call to banned function 'fesetexceptflag'. |
+| test.c:11:24:11:36 | FE_ALL_EXCEPT | Expansion of banned macro 'FE_ALL_EXCEPT'. |
+| test.c:12:3:12:14 | call to fetestexcept | Call to banned function 'fetestexcept'. |
+| test.c:12:16:12:27 | FE_UNDERFLOW | Expansion of banned macro 'FE_UNDERFLOW'. |
+| test.c:15:3:15:10 | call to fesetenv | Call to banned function 'fesetenv'. |
+| test.c:16:3:16:13 | call to feupdateenv | Call to banned function 'feupdateenv'. |
+| test.c:17:3:17:12 | call to fesetround | Call to banned function 'fesetround'. |
diff --git a/c/misra/test/rules/RULE-21-12/test.c b/c/misra/test/rules/RULE-21-12/test.c
index ae4d90a402..9a049c9ed8 100644
--- a/c/misra/test/rules/RULE-21-12/test.c
+++ b/c/misra/test/rules/RULE-21-12/test.c
@@ -1,4 +1,6 @@
+// NON_COMPLIANT: Cannot #include fenv.h.
 #include <fenv.h>
+
 void f2();
 void f1() {
   int i = feclearexcept(FE_INVALID); // NON_COMPLIANT
@@ -8,5 +10,10 @@ void f1() {
   feraiseexcept(FE_OVERFLOW);          // NON_COMPLIANT
   fesetexceptflag(&i2, FE_ALL_EXCEPT); // NON_COMPLIANT
   fetestexcept(FE_UNDERFLOW);          // NON_COMPLIANT
-  f2();                                // COMPLIANT
+  fenv_t env;
+  fegetenv(&env);
+  fesetenv(&env);    // NON_COMPLIANT
+  feupdateenv(&env); // NON_COMPLIANT
+  fesetround(0);     // NON_COMPLIANT
+  f2();              // COMPLIANT
 }
diff --git a/c/misra/test/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.expected b/c/misra/test/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.expected
index cded1a0a89..5ae49919a9 100644
--- a/c/misra/test/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.expected
+++ b/c/misra/test/rules/RULE-21-14/MemcmpUsedToCompareNullTerminatedStrings.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (MemcmpUsedToCompareNullTerminatedStrings.ql:23,54-62)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (MemcmpUsedToCompareNullTerminatedStrings.ql:24,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (MemcmpUsedToCompareNullTerminatedStrings.ql:50,20-28)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (MemcmpUsedToCompareNullTerminatedStrings.ql:58,43-56)
 edges
 | test.c:12:13:12:15 | a | test.c:14:10:14:10 | a | provenance |  |
 | test.c:12:13:12:15 | a | test.c:23:13:23:13 | a | provenance |  |
diff --git a/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected
new file mode 100644
index 0000000000..03dddb8dfe
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected
@@ -0,0 +1,134 @@
+| test.c:29:7:29:7 | c | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:40:7:40:7 | e | Argument 1 provided to type-generic macro 'cos' has essentially enum type, which is not essentially signed, unsigned, or floating type. |
+| test.c:41:7:41:7 | b | Argument 1 provided to type-generic macro 'cos' has essentially boolean type, which is not essentially signed, unsigned, or floating type. |
+| test.c:156:8:156:8 | c | Argument 1 provided to type-generic macro 'acos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:157:9:157:9 | c | Argument 1 provided to type-generic macro 'acosh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:158:8:158:8 | c | Argument 1 provided to type-generic macro 'asin' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:159:9:159:9 | c | Argument 1 provided to type-generic macro 'asinh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:160:9:160:9 | c | Argument 1 provided to type-generic macro 'atan2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:161:12:161:12 | c | Argument 2 provided to type-generic macro 'atan2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:162:9:162:9 | c | Argument 1 provided to type-generic macro 'atanh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:163:8:163:8 | c | Argument 1 provided to type-generic macro 'carg' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:164:8:164:8 | c | Argument 1 provided to type-generic macro 'ceil' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:165:9:165:9 | c | Argument 1 provided to type-generic macro 'cimag' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:166:8:166:8 | c | Argument 1 provided to type-generic macro 'conj' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:167:15:167:15 | c | Argument 2 provided to type-generic macro 'copysign' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:168:12:168:12 | c | Argument 1 provided to type-generic macro 'copysign' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:169:8:169:8 | c | Argument 1 provided to type-generic macro 'cosh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:170:9:170:9 | c | Argument 1 provided to type-generic macro 'cproj' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:171:9:171:9 | c | Argument 1 provided to type-generic macro 'creal' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:172:7:172:7 | c | Argument 1 provided to type-generic macro 'erf' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:173:8:173:8 | c | Argument 1 provided to type-generic macro 'erfc' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:174:7:174:7 | c | Argument 1 provided to type-generic macro 'exp' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:175:8:175:8 | c | Argument 1 provided to type-generic macro 'exp2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:176:9:176:9 | c | Argument 1 provided to type-generic macro 'expm1' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:177:8:177:8 | c | Argument 1 provided to type-generic macro 'fabs' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:178:8:178:8 | c | Argument 1 provided to type-generic macro 'fdim' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:179:11:179:11 | c | Argument 2 provided to type-generic macro 'fdim' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:180:9:180:9 | c | Argument 1 provided to type-generic macro 'floor' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:181:7:181:7 | c | Argument 1 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:182:10:182:10 | c | Argument 2 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:183:13:183:13 | c | Argument 3 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:184:8:184:8 | c | Argument 1 provided to type-generic macro 'fmax' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:185:11:185:11 | c | Argument 2 provided to type-generic macro 'fmax' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:186:8:186:8 | c | Argument 1 provided to type-generic macro 'fmin' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:187:11:187:11 | c | Argument 2 provided to type-generic macro 'fmin' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:188:8:188:8 | c | Argument 1 provided to type-generic macro 'fmod' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:189:11:189:11 | c | Argument 2 provided to type-generic macro 'fmod' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:190:9:190:9 | c | Argument 1 provided to type-generic macro 'frexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:191:9:191:9 | c | Argument 1 provided to type-generic macro 'hypot' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:192:12:192:12 | c | Argument 2 provided to type-generic macro 'hypot' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:193:9:193:9 | c | Argument 1 provided to type-generic macro 'ilogb' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:194:9:194:9 | c | Argument 1 provided to type-generic macro 'ldexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:195:12:195:12 | c | Argument 2 provided to type-generic macro 'ldexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:196:10:196:10 | c | Argument 1 provided to type-generic macro 'lgamma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:197:10:197:10 | c | Argument 1 provided to type-generic macro 'llrint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:198:11:198:11 | c | Argument 1 provided to type-generic macro 'llround' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:199:7:199:7 | c | Argument 1 provided to type-generic macro 'log' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:200:9:200:9 | c | Argument 1 provided to type-generic macro 'log10' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:201:9:201:9 | c | Argument 1 provided to type-generic macro 'log1p' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:202:8:202:8 | c | Argument 1 provided to type-generic macro 'log2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:203:8:203:8 | c | Argument 1 provided to type-generic macro 'logb' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:204:9:204:9 | c | Argument 1 provided to type-generic macro 'lrint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:205:10:205:10 | c | Argument 1 provided to type-generic macro 'lround' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:206:13:206:13 | c | Argument 1 provided to type-generic macro 'nearbyint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:207:13:207:13 | c | Argument 1 provided to type-generic macro 'nextafter' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:208:16:208:16 | c | Argument 2 provided to type-generic macro 'nextafter' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:209:14:209:14 | c | Argument 1 provided to type-generic macro 'nexttoward' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:210:17:210:17 | c | Argument 2 provided to type-generic macro 'nexttoward' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:211:7:211:7 | c | Argument 1 provided to type-generic macro 'pow' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:212:10:212:10 | c | Argument 2 provided to type-generic macro 'pow' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:213:13:213:13 | c | Argument 1 provided to type-generic macro 'remainder' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:214:16:214:16 | c | Argument 2 provided to type-generic macro 'remainder' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:215:10:215:10 | c | Argument 1 provided to type-generic macro 'remquo' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:216:13:216:13 | c | Argument 2 provided to type-generic macro 'remquo' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:217:8:217:8 | c | Argument 1 provided to type-generic macro 'rint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:218:9:218:9 | c | Argument 1 provided to type-generic macro 'round' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:219:10:219:10 | c | Argument 1 provided to type-generic macro 'scalbn' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:220:13:220:13 | c | Argument 2 provided to type-generic macro 'scalbn' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:221:11:221:11 | c | Argument 1 provided to type-generic macro 'scalbln' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:222:14:222:14 | c | Argument 2 provided to type-generic macro 'scalbln' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:223:7:223:7 | c | Argument 1 provided to type-generic macro 'sin' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:224:8:224:8 | c | Argument 1 provided to type-generic macro 'sinh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:225:8:225:8 | c | Argument 1 provided to type-generic macro 'sqrt' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:226:7:226:7 | c | Argument 1 provided to type-generic macro 'tan' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:227:8:227:8 | c | Argument 1 provided to type-generic macro 'tanh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:228:10:228:10 | c | Argument 1 provided to type-generic macro 'tgamma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:229:9:229:9 | c | Argument 1 provided to type-generic macro 'trunc' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:239:9:239:10 | cf | Argument 1 provided to type-generic macro 'atan2' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:240:12:240:13 | cf | Argument 2 provided to type-generic macro 'atan2' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:243:8:243:9 | cf | Argument 1 provided to type-generic macro 'cbrt' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:244:8:244:9 | cf | Argument 1 provided to type-generic macro 'ceil' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:247:15:247:16 | cf | Argument 2 provided to type-generic macro 'copysign' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:248:12:248:13 | cf | Argument 1 provided to type-generic macro 'copysign' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:249:15:249:16 | cf | Argument 2 provided to type-generic macro 'copysign' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:254:7:254:8 | cf | Argument 1 provided to type-generic macro 'erf' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:255:8:255:9 | cf | Argument 1 provided to type-generic macro 'erfc' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:257:8:257:9 | cf | Argument 1 provided to type-generic macro 'exp2' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:258:9:258:10 | cf | Argument 1 provided to type-generic macro 'expm1' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:260:8:260:9 | cf | Argument 1 provided to type-generic macro 'fdim' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:261:11:261:12 | cf | Argument 2 provided to type-generic macro 'fdim' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:262:9:262:10 | cf | Argument 1 provided to type-generic macro 'floor' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:263:7:263:8 | cf | Argument 1 provided to type-generic macro 'fma' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:264:10:264:11 | cf | Argument 2 provided to type-generic macro 'fma' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:265:13:265:14 | cf | Argument 3 provided to type-generic macro 'fma' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:266:8:266:9 | cf | Argument 1 provided to type-generic macro 'fmax' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:267:11:267:12 | cf | Argument 2 provided to type-generic macro 'fmax' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:268:8:268:9 | cf | Argument 1 provided to type-generic macro 'fmin' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:269:11:269:12 | cf | Argument 2 provided to type-generic macro 'fmin' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:270:8:270:9 | cf | Argument 1 provided to type-generic macro 'fmod' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:271:11:271:12 | cf | Argument 2 provided to type-generic macro 'fmod' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:272:9:272:10 | cf | Argument 1 provided to type-generic macro 'frexp' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:273:9:273:10 | cf | Argument 1 provided to type-generic macro 'hypot' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:274:12:274:13 | cf | Argument 2 provided to type-generic macro 'hypot' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:275:9:275:10 | cf | Argument 1 provided to type-generic macro 'ilogb' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:276:9:276:10 | cf | Argument 1 provided to type-generic macro 'ldexp' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:277:12:277:13 | cf | Argument 2 provided to type-generic macro 'ldexp' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:278:10:278:11 | cf | Argument 1 provided to type-generic macro 'lgamma' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:279:10:279:11 | cf | Argument 1 provided to type-generic macro 'llrint' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:280:11:280:12 | cf | Argument 1 provided to type-generic macro 'llround' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:282:9:282:10 | cf | Argument 1 provided to type-generic macro 'log10' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:283:9:283:10 | cf | Argument 1 provided to type-generic macro 'log1p' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:284:8:284:9 | cf | Argument 1 provided to type-generic macro 'log2' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:285:8:285:9 | cf | Argument 1 provided to type-generic macro 'logb' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:286:9:286:10 | cf | Argument 1 provided to type-generic macro 'lrint' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:287:10:287:11 | cf | Argument 1 provided to type-generic macro 'lround' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:288:13:288:14 | cf | Argument 1 provided to type-generic macro 'nearbyint' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:289:13:289:14 | cf | Argument 1 provided to type-generic macro 'nextafter' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:290:16:290:17 | cf | Argument 2 provided to type-generic macro 'nextafter' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:291:14:291:15 | cf | Argument 1 provided to type-generic macro 'nexttoward' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:292:17:292:18 | cf | Argument 2 provided to type-generic macro 'nexttoward' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:294:13:294:14 | cf | Argument 1 provided to type-generic macro 'remainder' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:295:16:295:17 | cf | Argument 2 provided to type-generic macro 'remainder' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:296:10:296:11 | cf | Argument 1 provided to type-generic macro 'remquo' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:297:13:297:14 | cf | Argument 2 provided to type-generic macro 'remquo' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:298:8:298:9 | cf | Argument 1 provided to type-generic macro 'rint' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:299:9:299:10 | cf | Argument 1 provided to type-generic macro 'round' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:300:10:300:11 | cf | Argument 1 provided to type-generic macro 'scalbn' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:301:13:301:14 | cf | Argument 2 provided to type-generic macro 'scalbn' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:302:11:302:12 | cf | Argument 1 provided to type-generic macro 'scalbln' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:303:14:303:15 | cf | Argument 2 provided to type-generic macro 'scalbln' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:309:10:309:11 | cf | Argument 1 provided to type-generic macro 'tgamma' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:310:9:310:10 | cf | Argument 1 provided to type-generic macro 'trunc' has essentially complex floating type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:325:13:325:13 | i | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:328:18:328:18 | c | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
diff --git a/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected.clang b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected.clang
new file mode 100644
index 0000000000..313438ea6c
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected.clang
@@ -0,0 +1,76 @@
+| test.c:29:7:29:7 | c | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:40:7:40:7 | e | Argument 1 provided to type-generic macro 'cos' has essentially enum type, which is not essentially signed, unsigned, or floating type. |
+| test.c:41:7:41:7 | b | Argument 1 provided to type-generic macro 'cos' has essentially boolean type, which is not essentially signed, unsigned, or floating type. |
+| test.c:156:8:156:8 | c | Argument 1 provided to type-generic macro 'acos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:157:9:157:9 | c | Argument 1 provided to type-generic macro 'acosh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:158:8:158:8 | c | Argument 1 provided to type-generic macro 'asin' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:159:9:159:9 | c | Argument 1 provided to type-generic macro 'asinh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:160:9:160:9 | c | Argument 1 provided to type-generic macro 'atan2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:161:12:161:12 | c | Argument 2 provided to type-generic macro 'atan2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:162:9:162:9 | c | Argument 1 provided to type-generic macro 'atanh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:163:8:163:8 | c | Argument 1 provided to type-generic macro 'carg' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:164:8:164:8 | c | Argument 1 provided to type-generic macro 'ceil' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:165:9:165:9 | c | Argument 1 provided to type-generic macro 'cimag' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:166:8:166:8 | c | Argument 1 provided to type-generic macro 'conj' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:167:15:167:15 | c | Argument 2 provided to type-generic macro 'copysign' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:168:12:168:12 | c | Argument 1 provided to type-generic macro 'copysign' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:169:8:169:8 | c | Argument 1 provided to type-generic macro 'cosh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:170:9:170:9 | c | Argument 1 provided to type-generic macro 'cproj' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:171:9:171:9 | c | Argument 1 provided to type-generic macro 'creal' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:172:7:172:7 | c | Argument 1 provided to type-generic macro 'erf' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:173:8:173:8 | c | Argument 1 provided to type-generic macro 'erfc' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:174:7:174:7 | c | Argument 1 provided to type-generic macro 'exp' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:175:8:175:8 | c | Argument 1 provided to type-generic macro 'exp2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:176:9:176:9 | c | Argument 1 provided to type-generic macro 'expm1' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:177:8:177:8 | c | Argument 1 provided to type-generic macro 'fabs' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:178:8:178:8 | c | Argument 1 provided to type-generic macro 'fdim' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:179:11:179:11 | c | Argument 2 provided to type-generic macro 'fdim' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:180:9:180:9 | c | Argument 1 provided to type-generic macro 'floor' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:181:7:181:7 | c | Argument 1 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:182:10:182:10 | c | Argument 2 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:183:13:183:13 | c | Argument 3 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:184:8:184:8 | c | Argument 1 provided to type-generic macro 'fmax' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:185:11:185:11 | c | Argument 2 provided to type-generic macro 'fmax' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:186:8:186:8 | c | Argument 1 provided to type-generic macro 'fmin' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:187:11:187:11 | c | Argument 2 provided to type-generic macro 'fmin' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:188:8:188:8 | c | Argument 1 provided to type-generic macro 'fmod' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:189:11:189:11 | c | Argument 2 provided to type-generic macro 'fmod' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:191:9:191:9 | c | Argument 1 provided to type-generic macro 'hypot' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:192:12:192:12 | c | Argument 2 provided to type-generic macro 'hypot' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:193:9:193:9 | c | Argument 1 provided to type-generic macro 'ilogb' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:194:9:194:9 | c | Argument 1 provided to type-generic macro 'ldexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:195:12:195:12 | c | Argument 2 provided to type-generic macro 'ldexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:196:10:196:10 | c | Argument 1 provided to type-generic macro 'lgamma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:197:10:197:10 | c | Argument 1 provided to type-generic macro 'llrint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:198:11:198:11 | c | Argument 1 provided to type-generic macro 'llround' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:199:7:199:7 | c | Argument 1 provided to type-generic macro 'log' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:200:9:200:9 | c | Argument 1 provided to type-generic macro 'log10' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:201:9:201:9 | c | Argument 1 provided to type-generic macro 'log1p' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:202:8:202:8 | c | Argument 1 provided to type-generic macro 'log2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:203:8:203:8 | c | Argument 1 provided to type-generic macro 'logb' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:204:9:204:9 | c | Argument 1 provided to type-generic macro 'lrint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:205:10:205:10 | c | Argument 1 provided to type-generic macro 'lround' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:206:13:206:13 | c | Argument 1 provided to type-generic macro 'nearbyint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:207:13:207:13 | c | Argument 1 provided to type-generic macro 'nextafter' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:208:16:208:16 | c | Argument 2 provided to type-generic macro 'nextafter' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:209:14:209:14 | c | Argument 1 provided to type-generic macro 'nexttoward' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:210:17:210:17 | c | Argument 2 provided to type-generic macro 'nexttoward' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:211:7:211:7 | c | Argument 1 provided to type-generic macro 'pow' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:212:10:212:10 | c | Argument 2 provided to type-generic macro 'pow' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:213:13:213:13 | c | Argument 1 provided to type-generic macro 'remainder' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:214:16:214:16 | c | Argument 2 provided to type-generic macro 'remainder' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:217:8:217:8 | c | Argument 1 provided to type-generic macro 'rint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:218:9:218:9 | c | Argument 1 provided to type-generic macro 'round' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:219:10:219:10 | c | Argument 1 provided to type-generic macro 'scalbn' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:220:13:220:13 | c | Argument 2 provided to type-generic macro 'scalbn' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:221:11:221:11 | c | Argument 1 provided to type-generic macro 'scalbln' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:222:14:222:14 | c | Argument 2 provided to type-generic macro 'scalbln' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:223:7:223:7 | c | Argument 1 provided to type-generic macro 'sin' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:224:8:224:8 | c | Argument 1 provided to type-generic macro 'sinh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:225:8:225:8 | c | Argument 1 provided to type-generic macro 'sqrt' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:226:7:226:7 | c | Argument 1 provided to type-generic macro 'tan' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:227:8:227:8 | c | Argument 1 provided to type-generic macro 'tanh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:228:10:228:10 | c | Argument 1 provided to type-generic macro 'tgamma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:229:9:229:9 | c | Argument 1 provided to type-generic macro 'trunc' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:325:14:325:14 | i | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:328:20:328:20 | c | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
diff --git a/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected.gcc b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected.gcc
new file mode 100644
index 0000000000..79b070ae84
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.expected.gcc
@@ -0,0 +1,79 @@
+| test.c:29:7:29:7 | c | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:40:7:40:7 | e | Argument 1 provided to type-generic macro 'cos' has essentially enum type, which is not essentially signed, unsigned, or floating type. |
+| test.c:41:7:41:7 | b | Argument 1 provided to type-generic macro 'cos' has essentially boolean type, which is not essentially signed, unsigned, or floating type. |
+| test.c:156:8:156:8 | c | Argument 1 provided to type-generic macro 'acos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:157:9:157:9 | c | Argument 1 provided to type-generic macro 'acosh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:158:8:158:8 | c | Argument 1 provided to type-generic macro 'asin' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:159:9:159:9 | c | Argument 1 provided to type-generic macro 'asinh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:160:9:160:9 | c | Argument 1 provided to type-generic macro 'atan2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:161:12:161:12 | c | Argument 2 provided to type-generic macro 'atan2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:162:9:162:9 | c | Argument 1 provided to type-generic macro 'atanh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:163:8:163:8 | c | Argument 1 provided to type-generic macro 'carg' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:164:8:164:8 | c | Argument 1 provided to type-generic macro 'ceil' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:165:9:165:9 | c | Argument 1 provided to type-generic macro 'cimag' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:166:8:166:8 | c | Argument 1 provided to type-generic macro 'conj' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:167:15:167:15 | c | Argument 2 provided to type-generic macro 'copysign' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:168:12:168:12 | c | Argument 1 provided to type-generic macro 'copysign' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:169:8:169:8 | c | Argument 1 provided to type-generic macro 'cosh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:170:9:170:9 | c | Argument 1 provided to type-generic macro 'cproj' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:171:9:171:9 | c | Argument 1 provided to type-generic macro 'creal' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:172:7:172:7 | c | Argument 1 provided to type-generic macro 'erf' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:173:8:173:8 | c | Argument 1 provided to type-generic macro 'erfc' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:174:7:174:7 | c | Argument 1 provided to type-generic macro 'exp' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:175:8:175:8 | c | Argument 1 provided to type-generic macro 'exp2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:176:9:176:9 | c | Argument 1 provided to type-generic macro 'expm1' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:177:8:177:8 | c | Argument 1 provided to type-generic macro 'fabs' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:178:8:178:8 | c | Argument 1 provided to type-generic macro 'fdim' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:179:11:179:11 | c | Argument 2 provided to type-generic macro 'fdim' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:180:9:180:9 | c | Argument 1 provided to type-generic macro 'floor' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:181:7:181:7 | c | Argument 1 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:182:10:182:10 | c | Argument 2 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:183:13:183:13 | c | Argument 3 provided to type-generic macro 'fma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:184:8:184:8 | c | Argument 1 provided to type-generic macro 'fmax' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:185:11:185:11 | c | Argument 2 provided to type-generic macro 'fmax' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:186:8:186:8 | c | Argument 1 provided to type-generic macro 'fmin' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:187:11:187:11 | c | Argument 2 provided to type-generic macro 'fmin' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:188:8:188:8 | c | Argument 1 provided to type-generic macro 'fmod' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:189:11:189:11 | c | Argument 2 provided to type-generic macro 'fmod' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:190:9:190:9 | c | Argument 1 provided to type-generic macro 'frexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:191:9:191:9 | c | Argument 1 provided to type-generic macro 'hypot' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:192:12:192:12 | c | Argument 2 provided to type-generic macro 'hypot' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:193:9:193:9 | c | Argument 1 provided to type-generic macro 'ilogb' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:194:9:194:9 | c | Argument 1 provided to type-generic macro 'ldexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:195:12:195:12 | c | Argument 2 provided to type-generic macro 'ldexp' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:196:10:196:10 | c | Argument 1 provided to type-generic macro 'lgamma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:197:10:197:10 | c | Argument 1 provided to type-generic macro 'llrint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:198:11:198:11 | c | Argument 1 provided to type-generic macro 'llround' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:199:7:199:7 | c | Argument 1 provided to type-generic macro 'log' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:200:9:200:9 | c | Argument 1 provided to type-generic macro 'log10' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:201:9:201:9 | c | Argument 1 provided to type-generic macro 'log1p' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:202:8:202:8 | c | Argument 1 provided to type-generic macro 'log2' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:203:8:203:8 | c | Argument 1 provided to type-generic macro 'logb' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:204:9:204:9 | c | Argument 1 provided to type-generic macro 'lrint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:205:10:205:10 | c | Argument 1 provided to type-generic macro 'lround' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:206:13:206:13 | c | Argument 1 provided to type-generic macro 'nearbyint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:207:13:207:13 | c | Argument 1 provided to type-generic macro 'nextafter' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:208:16:208:16 | c | Argument 2 provided to type-generic macro 'nextafter' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:209:14:209:14 | c | Argument 1 provided to type-generic macro 'nexttoward' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:210:17:210:17 | c | Argument 2 provided to type-generic macro 'nexttoward' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:211:7:211:7 | c | Argument 1 provided to type-generic macro 'pow' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:212:10:212:10 | c | Argument 2 provided to type-generic macro 'pow' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:213:13:213:13 | c | Argument 1 provided to type-generic macro 'remainder' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:214:16:214:16 | c | Argument 2 provided to type-generic macro 'remainder' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:215:10:215:10 | c | Argument 1 provided to type-generic macro 'remquo' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:216:13:216:13 | c | Argument 2 provided to type-generic macro 'remquo' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:217:8:217:8 | c | Argument 1 provided to type-generic macro 'rint' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:218:9:218:9 | c | Argument 1 provided to type-generic macro 'round' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:219:10:219:10 | c | Argument 1 provided to type-generic macro 'scalbn' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:220:13:220:13 | c | Argument 2 provided to type-generic macro 'scalbn' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:221:11:221:11 | c | Argument 1 provided to type-generic macro 'scalbln' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:222:14:222:14 | c | Argument 2 provided to type-generic macro 'scalbln' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:223:7:223:7 | c | Argument 1 provided to type-generic macro 'sin' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:224:8:224:8 | c | Argument 1 provided to type-generic macro 'sinh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:225:8:225:8 | c | Argument 1 provided to type-generic macro 'sqrt' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:226:7:226:7 | c | Argument 1 provided to type-generic macro 'tan' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:227:8:227:8 | c | Argument 1 provided to type-generic macro 'tanh' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:228:10:228:10 | c | Argument 1 provided to type-generic macro 'tgamma' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:229:9:229:9 | c | Argument 1 provided to type-generic macro 'trunc' has essentially character type, which is not essentially signed, unsigned, or real floating type. |
+| test.c:325:14:325:14 | i | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
+| test.c:328:20:328:20 | c | Argument 1 provided to type-generic macro 'cos' has essentially character type, which is not essentially signed, unsigned, or floating type. |
diff --git a/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.qlref b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.qlref
new file mode 100644
index 0000000000..cb7206db11
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.qlref
@@ -0,0 +1 @@
+rules/RULE-21-22/TgMathArgumentWithInvalidEssentialType.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-22/test.c b/c/misra/test/rules/RULE-21-22/test.c
new file mode 100644
index 0000000000..970df4fd56
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-22/test.c
@@ -0,0 +1,329 @@
+#include <complex.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <tgmath.h>
+
+void f1() {
+  int i = 0;
+  unsigned int ui = 0;
+  short s = 0;
+  unsigned short us = 0;
+  char c = 0;
+  unsigned char uc = 0;
+  signed char sc = 0;
+  long l = 0;
+  unsigned long ul = 0;
+  float f = 0.0f;
+  float _Complex cf = 0.0f + 0.0f * I;
+  double d = 0.0;
+  char *p = 0;
+  void *vp = 0;
+  uintptr_t uip = p;
+  enum { e1 } e = e1;
+  bool b = true;
+
+  cos(i);  // COMPLIANT
+  cos(ui); // COMPLIANT
+  cos(s);  // COMPLIANT
+  cos(us); // COMPLIANT
+  cos(c);  // NON-COMPLIANT
+  cos(uc); // COMPLIANT
+  cos(sc); // COMPLIANT
+  cos(l);  // COMPLIANT
+  cos(ul); // COMPLIANT
+  cos(f);  // COMPLIANT
+  cos(cf); // COMPLIANT
+  cos(d);  // COMPLIANT
+  // cos(p); // Doesn't compile
+  // cos(vp); // Doesn't compile
+  cos(uip);  // COMPLIANT
+  cos(e);    // NON-COMPLIANT
+  cos(b);    // NON-COMPLIANT
+  cos(1);    // COMPLIANT
+  cos(1.1f); // COMPLIANT
+  cos('a');  // NON-COMPLIANT[false negative]
+
+  /**
+   * Int, float, and complex allowed:
+   */
+  acos(i);          // COMPLIANT
+  acos(f);          // COMPLIANT
+  acosh(i);         // COMPLIANT
+  acosh(f);         // COMPLIANT
+  asin(i);          // COMPLIANT
+  asin(f);          // COMPLIANT
+  asinh(i);         // COMPLIANT
+  asinh(f);         // COMPLIANT
+  atan(i);          // COMPLIANT
+  atan(f);          // COMPLIANT
+  atan2(i, i);      // COMPLIANT
+  atan2(f, f);      // COMPLIANT
+  atanh(i);         // COMPLIANT
+  atanh(f);         // COMPLIANT
+  carg(i);          // COMPLIANT
+  carg(f);          // COMPLIANT
+  cbrt(i);          // COMPLIANT
+  cbrt(f);          // COMPLIANT
+  ceil(i);          // COMPLIANT
+  ceil(f);          // COMPLIANT
+  cimag(i);         // COMPLIANT
+  cimag(f);         // COMPLIANT
+  conj(i);          // COMPLIANT
+  conj(f);          // COMPLIANT
+  copysign(i, i);   // COMPLIANT
+  copysign(f, f);   // COMPLIANT
+  cos(i);           // COMPLIANT
+  cos(f);           // COMPLIANT
+  cosh(i);          // COMPLIANT
+  cosh(f);          // COMPLIANT
+  cproj(i);         // COMPLIANT
+  cproj(f);         // COMPLIANT
+  creal(i);         // COMPLIANT
+  creal(f);         // COMPLIANT
+  erf(i);           // COMPLIANT
+  erf(f);           // COMPLIANT
+  erfc(i);          // COMPLIANT
+  erfc(f);          // COMPLIANT
+  exp(i);           // COMPLIANT
+  exp(f);           // COMPLIANT
+  exp2(i);          // COMPLIANT
+  exp2(f);          // COMPLIANT
+  expm1(i);         // COMPLIANT
+  expm1(f);         // COMPLIANT
+  fabs(i);          // COMPLIANT
+  fabs(f);          // COMPLIANT
+  fdim(i, i);       // COMPLIANT
+  fdim(f, f);       // COMPLIANT
+  floor(i);         // COMPLIANT
+  floor(f);         // COMPLIANT
+  fma(i, i, i);     // COMPLIANT
+  fma(f, f, f);     // COMPLIANT
+  fmax(i, i);       // COMPLIANT
+  fmax(f, f);       // COMPLIANT
+  fmin(i, i);       // COMPLIANT
+  fmin(f, f);       // COMPLIANT
+  fmod(i, i);       // COMPLIANT
+  fmod(f, f);       // COMPLIANT
+  frexp(i, &i);     // COMPLIANT
+  frexp(f, &p);     // COMPLIANT
+  hypot(i, i);      // COMPLIANT
+  hypot(f, f);      // COMPLIANT
+  ilogb(i);         // COMPLIANT
+  ilogb(f);         // COMPLIANT
+  llrint(i);        // COMPLIANT
+  llrint(f);        // COMPLIANT
+  ldexp(i, i);      // COMPLIANT
+  ldexp(f, f);      // COMPLIANT
+  lgamma(i);        // COMPLIANT
+  lgamma(f);        // COMPLIANT
+  llround(i);       // COMPLIANT
+  llround(f);       // COMPLIANT
+  log(i);           // COMPLIANT
+  log(f);           // COMPLIANT
+  pow(i, i);        // COMPLIANT
+  pow(f, f);        // COMPLIANT
+  remainder(i, i);  // COMPLIANT
+  remainder(f, f);  // COMPLIANT
+  remquo(i, i, &i); // COMPLIANT
+  remquo(f, f, &f); // COMPLIANT
+  rint(i);          // COMPLIANT
+  rint(f);          // COMPLIANT
+  round(i);         // COMPLIANT
+  round(f);         // COMPLIANT
+  scalbn(i, i);     // COMPLIANT
+  scalbn(f, f);     // COMPLIANT
+  scalbln(i, i);    // COMPLIANT
+  scalbln(f, f);    // COMPLIANT
+  sin(i);           // COMPLIANT
+  sin(f);           // COMPLIANT
+  sin(cf);          // COMPLIANT
+  sinh(i);          // COMPLIANT
+  sinh(f);          // COMPLIANT
+  sqrt(i);          // COMPLIANT
+  sqrt(f);          // COMPLIANT
+  tan(i);           // COMPLIANT
+  tan(f);           // COMPLIANT
+  tanh(i);          // COMPLIANT
+  tanh(f);          // COMPLIANT
+  tgamma(i);        // COMPLIANT
+  tgamma(f);        // COMPLIANT
+  trunc(i);         // COMPLIANT
+  trunc(f);         // COMPLIANT
+
+  /**
+   * Char not allowed:
+   */
+  acos(c);          // NON-COMPLIANT
+  acosh(c);         // NON-COMPLIANT
+  asin(c);          // NON-COMPLIANT
+  asinh(c);         // NON-COMPLIANT
+  atan2(c, i);      // NON-COMPLIANT
+  atan2(i, c);      // NON-COMPLIANT
+  atanh(c);         // NON-COMPLIANT
+  carg(c);          // NON-COMPLIANT
+  ceil(c);          // NON-COMPLIANT
+  cimag(c);         // NON-COMPLIANT
+  conj(c);          // NON-COMPLIANT
+  copysign(i, c);   // NON-COMPLIANT
+  copysign(c, i);   // NON-COMPLIANT
+  cosh(c);          // NON-COMPLIANT
+  cproj(c);         // NON-COMPLIANT
+  creal(c);         // NON-COMPLIANT
+  erf(c);           // NON-COMPLIANT
+  erfc(c);          // NON-COMPLIANT
+  exp(c);           // NON-COMPLIANT
+  exp2(c);          // NON-COMPLIANT
+  expm1(c);         // NON-COMPLIANT
+  fabs(c);          // NON-COMPLIANT
+  fdim(c, i);       // NON-COMPLIANT
+  fdim(i, c);       // NON-COMPLIANT
+  floor(c);         // NON-COMPLIANT
+  fma(c, i, i);     // NON-COMPLIANT
+  fma(i, c, i);     // NON-COMPLIANT
+  fma(i, i, c);     // NON-COMPLIANT
+  fmax(c, i);       // NON-COMPLIANT
+  fmax(i, c);       // NON-COMPLIANT
+  fmin(c, i);       // NON-COMPLIANT
+  fmin(i, c);       // NON-COMPLIANT
+  fmod(c, i);       // NON-COMPLIANT
+  fmod(i, c);       // NON-COMPLIANT
+  frexp(c, i);      // NON-COMPLIANT
+  hypot(c, i);      // NON-COMPLIANT
+  hypot(i, c);      // NON-COMPLIANT
+  ilogb(c);         // NON-COMPLIANT
+  ldexp(c, i);      // NON-COMPLIANT
+  ldexp(i, c);      // NON-COMPLIANT
+  lgamma(c);        // NON-COMPLIANT
+  llrint(c);        // NON-COMPLIANT
+  llround(c);       // NON-COMPLIANT
+  log(c);           // NON-COMPLIANT
+  log10(c);         // NON-COMPLIANT
+  log1p(c);         // NON-COMPLIANT
+  log2(c);          // NON-COMPLIANT
+  logb(c);          // NON-COMPLIANT
+  lrint(c);         // NON-COMPLIANT
+  lround(c);        // NON-COMPLIANT
+  nearbyint(c);     // NON-COMPLIANT
+  nextafter(c, i);  // NON-COMPLIANT
+  nextafter(i, c);  // NON-COMPLIANT
+  nexttoward(c, i); // NON-COMPLIANT
+  nexttoward(i, c); // NON-COMPLIANT
+  pow(c, i);        // NON-COMPLIANT
+  pow(i, c);        // NON-COMPLIANT
+  remainder(c, i);  // NON-COMPLIANT
+  remainder(i, c);  // NON-COMPLIANT
+  remquo(c, i, i);  // NON-COMPLIANT
+  remquo(i, c, i);  // NON-COMPLIANT
+  rint(c);          // NON-COMPLIANT
+  round(c);         // NON-COMPLIANT
+  scalbn(c, i);     // NON-COMPLIANT
+  scalbn(i, c);     // NON-COMPLIANT
+  scalbln(c, i);    // NON-COMPLIANT
+  scalbln(i, c);    // NON-COMPLIANT
+  sin(c);           // NON-COMPLIANT
+  sinh(c);          // NON-COMPLIANT
+  sqrt(c);          // NON-COMPLIANT
+  tan(c);           // NON-COMPLIANT
+  tanh(c);          // NON-COMPLIANT
+  tgamma(c);        // NON-COMPLIANT
+  trunc(c);         // NON-COMPLIANT
+
+  /**
+   * Complex types allowed in some calls, not others:
+   */
+  acos(cf);          // COMPLIANT
+  acosh(cf);         // COMPLIANT
+  asin(cf);          // COMPLIANT
+  asinh(cf);         // COMPLIANT
+  atan(cf);          // COMPLIANT
+  atan2(cf, i);      // NON-COMPLIANT
+  atan2(i, cf);      // NON-COMPLIANT
+  atanh(cf);         // COMPLIANT
+  carg(cf);          // COMPLIANT
+  cbrt(cf);          // NON-COMPLIANT
+  ceil(cf);          // NON-COMPLIANT
+  cimag(cf);         // COMPLIANT
+  conj(cf);          // COMPLIANT
+  copysign(i, cf);   // NON-COMPLIANT
+  copysign(cf, i);   // NON-COMPLIANT
+  copysign(i, cf);   // NON-COMPLIANT
+  cos(cf);           // COMPLIANT
+  cosh(cf);          // COMPLIANT
+  cproj(cf);         // COMPLIANT
+  creal(cf);         // COMPLIANT
+  erf(cf);           // NON-COMPLIANT
+  erfc(cf);          // NON-COMPLIANT
+  exp(cf);           // COMPLIANT
+  exp2(cf);          // NON-COMPLIANT
+  expm1(cf);         // NON-COMPLIANT
+  fabs(cf);          // COMPLIANT
+  fdim(cf, i);       // NON-COMPLIANT
+  fdim(i, cf);       // NON-COMPLIANT
+  floor(cf);         // NON-COMPLIANT
+  fma(cf, i, i);     // NON-COMPLIANT
+  fma(i, cf, i);     // NON-COMPLIANT
+  fma(i, i, cf);     // NON-COMPLIANT
+  fmax(cf, i);       // NON-COMPLIANT
+  fmax(i, cf);       // NON-COMPLIANT
+  fmin(cf, i);       // NON-COMPLIANT
+  fmin(i, cf);       // NON-COMPLIANT
+  fmod(cf, i);       // NON-COMPLIANT
+  fmod(i, cf);       // NON-COMPLIANT
+  frexp(cf, i);      // NON-COMPLIANT
+  hypot(cf, i);      // NON-COMPLIANT
+  hypot(i, cf);      // NON-COMPLIANT
+  ilogb(cf);         // NON-COMPLIANT
+  ldexp(cf, i);      // NON-COMPLIANT
+  ldexp(i, cf);      // NON-COMPLIANT
+  lgamma(cf);        // NON-COMPLIANT
+  llrint(cf);        // NON-COMPLIANT
+  llround(cf);       // NON-COMPLIANT
+  log(cf);           // COMPLIANT
+  log10(cf);         // NON-COMPLIANT
+  log1p(cf);         // NON-COMPLIANT
+  log2(cf);          // NON-COMPLIANT
+  logb(cf);          // NON-COMPLIANT
+  lrint(cf);         // NON-COMPLIANT
+  lround(cf);        // NON-COMPLIANT
+  nearbyint(cf);     // NON-COMPLIANT
+  nextafter(cf, i);  // NON-COMPLIANT
+  nextafter(i, cf);  // NON-COMPLIANT
+  nexttoward(cf, i); // NON-COMPLIANT
+  nexttoward(i, cf); // NON-COMPLIANT
+  pow(cf, cf);       // COMPLIANT
+  remainder(cf, i);  // NON-COMPLIANT
+  remainder(i, cf);  // NON-COMPLIANT
+  remquo(cf, i, i);  // NON-COMPLIANT
+  remquo(i, cf, i);  // NON-COMPLIANT
+  rint(cf);          // NON-COMPLIANT
+  round(cf);         // NON-COMPLIANT
+  scalbn(cf, i);     // NON-COMPLIANT
+  scalbn(i, cf);     // NON-COMPLIANT
+  scalbln(cf, i);    // NON-COMPLIANT
+  scalbln(i, cf);    // NON-COMPLIANT
+  sin(cf);           // COMPLIANT
+  sinh(cf);          // COMPLIANT
+  sqrt(cf);          // COMPLIANT
+  tan(cf);           // COMPLIANT
+  tanh(cf);          // COMPLIANT
+  tgamma(cf);        // NON-COMPLIANT
+  trunc(cf);         // NON-COMPLIANT
+
+  /* Test output arguments thoroughly */
+  frexp(i, &i);            // COMPLIANT
+  frexp(i, vp);            // COMPLIANT
+  frexp(i, 0);             // COMPLIANT
+  frexp(i, 'c' - 'c');     // COMPLIANT
+  frexp(i, c);             // COMPLIANT
+  remquo(i, i, &i);        // COMPLIANT
+  remquo(i, i, vp);        // COMPLIANT
+  remquo(i, i, 0);         // COMPLIANT
+  remquo(i, i, 'c' - 'c'); // COMPLIANT
+  remquo(i, i, c);         // COMPLIANT
+
+  /* Test casts */
+  cos((char)i);      // NON-COMPLIANT
+  cos((int)c);       // COMPLIANT
+  cos((int)(char)i); // COMPLIANT
+  cos((char)(int)c); // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-22/test.c.clang b/c/misra/test/rules/RULE-21-22/test.c.clang
new file mode 100644
index 0000000000..d28576e058
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-22/test.c.clang
@@ -0,0 +1,329 @@
+#include <complex.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <tgmath.h>
+
+void f1() {
+  int i = 0;
+  unsigned int ui = 0;
+  short s = 0;
+  unsigned short us = 0;
+  char c = 0;
+  unsigned char uc = 0;
+  signed char sc = 0;
+  long l = 0;
+  unsigned long ul = 0;
+  float f = 0.0f;
+  float _Complex cf = 0.0f + 0.0f * I;
+  double d = 0.0;
+  char *p = 0;
+  void *vp = 0;
+  uintptr_t uip = p;
+  enum { e1 } e = e1;
+  bool b = true;
+
+  cos(i);  // COMPLIANT
+  cos(ui); // COMPLIANT
+  cos(s);  // COMPLIANT
+  cos(us); // COMPLIANT
+  cos(c);  // NON-COMPLIANT
+  cos(uc); // COMPLIANT
+  cos(sc); // COMPLIANT
+  cos(l);  // COMPLIANT
+  cos(ul); // COMPLIANT
+  cos(f);  // COMPLIANT
+  cos(cf); // COMPLIANT
+  cos(d);  // COMPLIANT
+  // cos(p); // Doesn't compile
+  // cos(vp); // Doesn't compile
+  cos(uip);  // COMPLIANT
+  cos(e);    // NON-COMPLIANT
+  cos(b);    // NON-COMPLIANT
+  cos(1);    // COMPLIANT
+  cos(1.1f); // COMPLIANT
+  cos('a');  // NON-COMPLIANT[false negative]
+
+  /**
+   * Int, float, and complex allowed:
+   */
+  acos(i);          // COMPLIANT
+  acos(f);          // COMPLIANT
+  acosh(i);         // COMPLIANT
+  acosh(f);         // COMPLIANT
+  asin(i);          // COMPLIANT
+  asin(f);          // COMPLIANT
+  asinh(i);         // COMPLIANT
+  asinh(f);         // COMPLIANT
+  atan(i);          // COMPLIANT
+  atan(f);          // COMPLIANT
+  atan2(i, i);      // COMPLIANT
+  atan2(f, f);      // COMPLIANT
+  atanh(i);         // COMPLIANT
+  atanh(f);         // COMPLIANT
+  carg(i);          // COMPLIANT
+  carg(f);          // COMPLIANT
+  cbrt(i);          // COMPLIANT
+  cbrt(f);          // COMPLIANT
+  ceil(i);          // COMPLIANT
+  ceil(f);          // COMPLIANT
+  cimag(i);         // COMPLIANT
+  cimag(f);         // COMPLIANT
+  conj(i);          // COMPLIANT
+  conj(f);          // COMPLIANT
+  copysign(i, i);   // COMPLIANT
+  copysign(f, f);   // COMPLIANT
+  cos(i);           // COMPLIANT
+  cos(f);           // COMPLIANT
+  cosh(i);          // COMPLIANT
+  cosh(f);          // COMPLIANT
+  cproj(i);         // COMPLIANT
+  cproj(f);         // COMPLIANT
+  creal(i);         // COMPLIANT
+  creal(f);         // COMPLIANT
+  erf(i);           // COMPLIANT
+  erf(f);           // COMPLIANT
+  erfc(i);          // COMPLIANT
+  erfc(f);          // COMPLIANT
+  exp(i);           // COMPLIANT
+  exp(f);           // COMPLIANT
+  exp2(i);          // COMPLIANT
+  exp2(f);          // COMPLIANT
+  expm1(i);         // COMPLIANT
+  expm1(f);         // COMPLIANT
+  fabs(i);          // COMPLIANT
+  fabs(f);          // COMPLIANT
+  fdim(i, i);       // COMPLIANT
+  fdim(f, f);       // COMPLIANT
+  floor(i);         // COMPLIANT
+  floor(f);         // COMPLIANT
+  fma(i, i, i);     // COMPLIANT
+  fma(f, f, f);     // COMPLIANT
+  fmax(i, i);       // COMPLIANT
+  fmax(f, f);       // COMPLIANT
+  fmin(i, i);       // COMPLIANT
+  fmin(f, f);       // COMPLIANT
+  fmod(i, i);       // COMPLIANT
+  fmod(f, f);       // COMPLIANT
+  frexp(i, &i);     // COMPLIANT
+  frexp(f, &p);     // COMPLIANT
+  hypot(i, i);      // COMPLIANT
+  hypot(f, f);      // COMPLIANT
+  ilogb(i);         // COMPLIANT
+  ilogb(f);         // COMPLIANT
+  llrint(i);        // COMPLIANT
+  llrint(f);        // COMPLIANT
+  ldexp(i, i);      // COMPLIANT
+  ldexp(f, f);      // COMPLIANT
+  lgamma(i);        // COMPLIANT
+  lgamma(f);        // COMPLIANT
+  llround(i);       // COMPLIANT
+  llround(f);       // COMPLIANT
+  log(i);           // COMPLIANT
+  log(f);           // COMPLIANT
+  pow(i, i);        // COMPLIANT
+  pow(f, f);        // COMPLIANT
+  remainder(i, i);  // COMPLIANT
+  remainder(f, f);  // COMPLIANT
+  remquo(i, i, &i); // COMPLIANT
+  remquo(f, f, &f); // COMPLIANT
+  rint(i);          // COMPLIANT
+  rint(f);          // COMPLIANT
+  round(i);         // COMPLIANT
+  round(f);         // COMPLIANT
+  scalbn(i, i);     // COMPLIANT
+  scalbn(f, f);     // COMPLIANT
+  scalbln(i, i);    // COMPLIANT
+  scalbln(f, f);    // COMPLIANT
+  sin(i);           // COMPLIANT
+  sin(f);           // COMPLIANT
+  sin(cf);          // COMPLIANT
+  sinh(i);          // COMPLIANT
+  sinh(f);          // COMPLIANT
+  sqrt(i);          // COMPLIANT
+  sqrt(f);          // COMPLIANT
+  tan(i);           // COMPLIANT
+  tan(f);           // COMPLIANT
+  tanh(i);          // COMPLIANT
+  tanh(f);          // COMPLIANT
+  tgamma(i);        // COMPLIANT
+  tgamma(f);        // COMPLIANT
+  trunc(i);         // COMPLIANT
+  trunc(f);         // COMPLIANT
+
+  /**
+   * Char not allowed:
+   */
+  acos(c);          // NON-COMPLIANT
+  acosh(c);         // NON-COMPLIANT
+  asin(c);          // NON-COMPLIANT
+  asinh(c);         // NON-COMPLIANT
+  atan2(c, i);      // NON-COMPLIANT
+  atan2(i, c);      // NON-COMPLIANT
+  atanh(c);         // NON-COMPLIANT
+  carg(c);          // NON-COMPLIANT
+  ceil(c);          // NON-COMPLIANT
+  cimag(c);         // NON-COMPLIANT
+  conj(c);          // NON-COMPLIANT
+  copysign(i, c);   // NON-COMPLIANT
+  copysign(c, i);   // NON-COMPLIANT
+  cosh(c);          // NON-COMPLIANT
+  cproj(c);         // NON-COMPLIANT
+  creal(c);         // NON-COMPLIANT
+  erf(c);           // NON-COMPLIANT
+  erfc(c);          // NON-COMPLIANT
+  exp(c);           // NON-COMPLIANT
+  exp2(c);          // NON-COMPLIANT
+  expm1(c);         // NON-COMPLIANT
+  fabs(c);          // NON-COMPLIANT
+  fdim(c, i);       // NON-COMPLIANT
+  fdim(i, c);       // NON-COMPLIANT
+  floor(c);         // NON-COMPLIANT
+  fma(c, i, i);     // NON-COMPLIANT
+  fma(i, c, i);     // NON-COMPLIANT
+  fma(i, i, c);     // NON-COMPLIANT
+  fmax(c, i);       // NON-COMPLIANT
+  fmax(i, c);       // NON-COMPLIANT
+  fmin(c, i);       // NON-COMPLIANT
+  fmin(i, c);       // NON-COMPLIANT
+  fmod(c, i);       // NON-COMPLIANT
+  fmod(i, c);       // NON-COMPLIANT
+  //frexp(c, i);      // NON-COMPLIANT
+  hypot(c, i);      // NON-COMPLIANT
+  hypot(i, c);      // NON-COMPLIANT
+  ilogb(c);         // NON-COMPLIANT
+  ldexp(c, i);      // NON-COMPLIANT
+  ldexp(i, c);      // NON-COMPLIANT
+  lgamma(c);        // NON-COMPLIANT
+  llrint(c);        // NON-COMPLIANT
+  llround(c);       // NON-COMPLIANT
+  log(c);           // NON-COMPLIANT
+  log10(c);         // NON-COMPLIANT
+  log1p(c);         // NON-COMPLIANT
+  log2(c);          // NON-COMPLIANT
+  logb(c);          // NON-COMPLIANT
+  lrint(c);         // NON-COMPLIANT
+  lround(c);        // NON-COMPLIANT
+  nearbyint(c);     // NON-COMPLIANT
+  nextafter(c, i);  // NON-COMPLIANT
+  nextafter(i, c);  // NON-COMPLIANT
+  nexttoward(c, i); // NON-COMPLIANT
+  nexttoward(i, c); // NON-COMPLIANT
+  pow(c, i);        // NON-COMPLIANT
+  pow(i, c);        // NON-COMPLIANT
+  remainder(c, i);  // NON-COMPLIANT
+  remainder(i, c);  // NON-COMPLIANT
+  //remquo(c, i, i);  // NON-COMPLIANT
+  //remquo(i, c, i);  // NON-COMPLIANT
+  rint(c);          // NON-COMPLIANT
+  round(c);         // NON-COMPLIANT
+  scalbn(c, i);     // NON-COMPLIANT
+  scalbn(i, c);     // NON-COMPLIANT
+  scalbln(c, i);    // NON-COMPLIANT
+  scalbln(i, c);    // NON-COMPLIANT
+  sin(c);           // NON-COMPLIANT
+  sinh(c);          // NON-COMPLIANT
+  sqrt(c);          // NON-COMPLIANT
+  tan(c);           // NON-COMPLIANT
+  tanh(c);          // NON-COMPLIANT
+  tgamma(c);        // NON-COMPLIANT
+  trunc(c);         // NON-COMPLIANT
+
+  /**
+   * Complex types allowed in some calls, not others:
+   */
+  acos(cf);          // COMPLIANT
+  acosh(cf);         // COMPLIANT
+  asin(cf);          // COMPLIANT
+  asinh(cf);         // COMPLIANT
+  atan(cf);          // COMPLIANT
+  //atan2(cf, i);      // NON-COMPLIANT
+  //atan2(i, cf);      // NON-COMPLIANT
+  atanh(cf);         // COMPLIANT
+  carg(cf);          // COMPLIANT
+  //cbrt(cf);          // NON-COMPLIANT
+  //ceil(cf);          // NON-COMPLIANT
+  cimag(cf);         // COMPLIANT
+  conj(cf);          // COMPLIANT
+  //copysign(i, cf);   // NON-COMPLIANT
+  //copysign(cf, i);   // NON-COMPLIANT
+  //copysign(i, cf);   // NON-COMPLIANT
+  cos(cf);           // COMPLIANT
+  cosh(cf);          // COMPLIANT
+  cproj(cf);         // COMPLIANT
+  creal(cf);         // COMPLIANT
+  //erf(cf);           // NON-COMPLIANT
+  //erfc(cf);          // NON-COMPLIANT
+  exp(cf);           // COMPLIANT
+  //exp2(cf);          // NON-COMPLIANT
+  //expm1(cf);         // NON-COMPLIANT
+  fabs(cf);          // COMPLIANT
+  //fdim(cf, i);       // NON-COMPLIANT
+  //fdim(i, cf);       // NON-COMPLIANT
+  //floor(cf);         // NON-COMPLIANT
+  //fma(cf, i, i);     // NON-COMPLIANT
+  //fma(i, cf, i);     // NON-COMPLIANT
+  //fma(i, i, cf);     // NON-COMPLIANT
+  //fmax(cf, i);       // NON-COMPLIANT
+  //fmax(i, cf);       // NON-COMPLIANT
+  //fmin(cf, i);       // NON-COMPLIANT
+  //fmin(i, cf);       // NON-COMPLIANT
+  //fmod(cf, i);       // NON-COMPLIANT
+  //fmod(i, cf);       // NON-COMPLIANT
+  //frexp(cf, i);      // NON-COMPLIANT
+  //hypot(cf, i);      // NON-COMPLIANT
+  //hypot(i, cf);      // NON-COMPLIANT
+  //ilogb(cf);         // NON-COMPLIANT
+  //ldexp(cf, i);      // NON-COMPLIANT
+  //ldexp(i, cf);      // NON-COMPLIANT
+  //lgamma(cf);        // NON-COMPLIANT
+  //llrint(cf);        // NON-COMPLIANT
+  //llround(cf);       // NON-COMPLIANT
+  log(cf);           // COMPLIANT
+  //log10(cf);         // NON-COMPLIANT
+  //log1p(cf);         // NON-COMPLIANT
+  //log2(cf);          // NON-COMPLIANT
+  //logb(cf);          // NON-COMPLIANT
+  //lrint(cf);         // NON-COMPLIANT
+  //lround(cf);        // NON-COMPLIANT
+  //nearbyint(cf);     // NON-COMPLIANT
+  //nextafter(cf, i);  // NON-COMPLIANT
+  //nextafter(i, cf);  // NON-COMPLIANT
+  //nexttoward(cf, i); // NON-COMPLIANT
+  //nexttoward(i, cf); // NON-COMPLIANT
+  pow(cf, cf);       // COMPLIANT
+  //remainder(cf, i);  // NON-COMPLIANT
+  //remainder(i, cf);  // NON-COMPLIANT
+  //remquo(cf, i, i);  // NON-COMPLIANT
+  //remquo(i, cf, i);  // NON-COMPLIANT
+  //rint(cf);          // NON-COMPLIANT
+  //round(cf);         // NON-COMPLIANT
+  //scalbn(cf, i);     // NON-COMPLIANT
+  //scalbn(i, cf);     // NON-COMPLIANT
+  //scalbln(cf, i);    // NON-COMPLIANT
+  //scalbln(i, cf);    // NON-COMPLIANT
+  sin(cf);           // COMPLIANT
+  sinh(cf);          // COMPLIANT
+  sqrt(cf);          // COMPLIANT
+  tan(cf);           // COMPLIANT
+  tanh(cf);          // COMPLIANT
+  //tgamma(cf);        // NON-COMPLIANT
+  //trunc(cf);         // NON-COMPLIANT
+
+  /* Test output arguments thoroughly */
+  frexp(i, &i);            // COMPLIANT
+  frexp(i, vp);            // COMPLIANT
+  frexp(i, 0);             // COMPLIANT
+  frexp(i, 'c' - 'c');     // COMPLIANT
+  //frexp(i, c);             // COMPLIANT
+  remquo(i, i, &i);        // COMPLIANT
+  remquo(i, i, vp);        // COMPLIANT
+  remquo(i, i, 0);         // COMPLIANT
+  remquo(i, i, 'c' - 'c'); // COMPLIANT
+  //remquo(i, i, c);         // COMPLIANT
+
+  /* Test casts */
+  cos((char) i);  // NON-COMPLIANT
+  cos((int) c);  // COMPLIANT
+  cos((int) (char) i);  // COMPLIANT
+  cos((char) (int) c);  // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-22/test.c.gcc b/c/misra/test/rules/RULE-21-22/test.c.gcc
new file mode 100644
index 0000000000..4661a0b4f7
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-22/test.c.gcc
@@ -0,0 +1,329 @@
+#include <complex.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <tgmath.h>
+
+void f1() {
+  int i = 0;
+  unsigned int ui = 0;
+  short s = 0;
+  unsigned short us = 0;
+  char c = 0;
+  unsigned char uc = 0;
+  signed char sc = 0;
+  long l = 0;
+  unsigned long ul = 0;
+  float f = 0.0f;
+  float _Complex cf = 0.0f + 0.0f * I;
+  double d = 0.0;
+  char *p = 0;
+  void *vp = 0;
+  uintptr_t uip = p;
+  enum { e1 } e = e1;
+  bool b = true;
+
+  cos(i);  // COMPLIANT
+  cos(ui); // COMPLIANT
+  cos(s);  // COMPLIANT
+  cos(us); // COMPLIANT
+  cos(c);  // NON-COMPLIANT
+  cos(uc); // COMPLIANT
+  cos(sc); // COMPLIANT
+  cos(l);  // COMPLIANT
+  cos(ul); // COMPLIANT
+  cos(f);  // COMPLIANT
+  cos(cf); // COMPLIANT
+  cos(d);  // COMPLIANT
+  // cos(p); // Doesn't compile
+  // cos(vp); // Doesn't compile
+  cos(uip);  // COMPLIANT
+  cos(e);    // NON-COMPLIANT
+  cos(b);    // NON-COMPLIANT
+  cos(1);    // COMPLIANT
+  cos(1.1f); // COMPLIANT
+  cos('a');  // NON-COMPLIANT[false negative]
+
+  /**
+   * Int, float, and complex allowed:
+   */
+  acos(i);          // COMPLIANT
+  acos(f);          // COMPLIANT
+  acosh(i);         // COMPLIANT
+  acosh(f);         // COMPLIANT
+  asin(i);          // COMPLIANT
+  asin(f);          // COMPLIANT
+  asinh(i);         // COMPLIANT
+  asinh(f);         // COMPLIANT
+  atan(i);          // COMPLIANT
+  atan(f);          // COMPLIANT
+  atan2(i, i);      // COMPLIANT
+  atan2(f, f);      // COMPLIANT
+  atanh(i);         // COMPLIANT
+  atanh(f);         // COMPLIANT
+  carg(i);          // COMPLIANT
+  carg(f);          // COMPLIANT
+  cbrt(i);          // COMPLIANT
+  cbrt(f);          // COMPLIANT
+  ceil(i);          // COMPLIANT
+  ceil(f);          // COMPLIANT
+  cimag(i);         // COMPLIANT
+  cimag(f);         // COMPLIANT
+  conj(i);          // COMPLIANT
+  conj(f);          // COMPLIANT
+  copysign(i, i);   // COMPLIANT
+  copysign(f, f);   // COMPLIANT
+  cos(i);           // COMPLIANT
+  cos(f);           // COMPLIANT
+  cosh(i);          // COMPLIANT
+  cosh(f);          // COMPLIANT
+  cproj(i);         // COMPLIANT
+  cproj(f);         // COMPLIANT
+  creal(i);         // COMPLIANT
+  creal(f);         // COMPLIANT
+  erf(i);           // COMPLIANT
+  erf(f);           // COMPLIANT
+  erfc(i);          // COMPLIANT
+  erfc(f);          // COMPLIANT
+  exp(i);           // COMPLIANT
+  exp(f);           // COMPLIANT
+  exp2(i);          // COMPLIANT
+  exp2(f);          // COMPLIANT
+  expm1(i);         // COMPLIANT
+  expm1(f);         // COMPLIANT
+  fabs(i);          // COMPLIANT
+  fabs(f);          // COMPLIANT
+  fdim(i, i);       // COMPLIANT
+  fdim(f, f);       // COMPLIANT
+  floor(i);         // COMPLIANT
+  floor(f);         // COMPLIANT
+  fma(i, i, i);     // COMPLIANT
+  fma(f, f, f);     // COMPLIANT
+  fmax(i, i);       // COMPLIANT
+  fmax(f, f);       // COMPLIANT
+  fmin(i, i);       // COMPLIANT
+  fmin(f, f);       // COMPLIANT
+  fmod(i, i);       // COMPLIANT
+  fmod(f, f);       // COMPLIANT
+  frexp(i, &i);     // COMPLIANT
+  frexp(f, &p);     // COMPLIANT
+  hypot(i, i);      // COMPLIANT
+  hypot(f, f);      // COMPLIANT
+  ilogb(i);         // COMPLIANT
+  ilogb(f);         // COMPLIANT
+  llrint(i);        // COMPLIANT
+  llrint(f);        // COMPLIANT
+  ldexp(i, i);      // COMPLIANT
+  ldexp(f, f);      // COMPLIANT
+  lgamma(i);        // COMPLIANT
+  lgamma(f);        // COMPLIANT
+  llround(i);       // COMPLIANT
+  llround(f);       // COMPLIANT
+  log(i);           // COMPLIANT
+  log(f);           // COMPLIANT
+  pow(i, i);        // COMPLIANT
+  pow(f, f);        // COMPLIANT
+  remainder(i, i);  // COMPLIANT
+  remainder(f, f);  // COMPLIANT
+  remquo(i, i, &i); // COMPLIANT
+  remquo(f, f, &f); // COMPLIANT
+  rint(i);          // COMPLIANT
+  rint(f);          // COMPLIANT
+  round(i);         // COMPLIANT
+  round(f);         // COMPLIANT
+  scalbn(i, i);     // COMPLIANT
+  scalbn(f, f);     // COMPLIANT
+  scalbln(i, i);    // COMPLIANT
+  scalbln(f, f);    // COMPLIANT
+  sin(i);           // COMPLIANT
+  sin(f);           // COMPLIANT
+  sin(cf);          // COMPLIANT
+  sinh(i);          // COMPLIANT
+  sinh(f);          // COMPLIANT
+  sqrt(i);          // COMPLIANT
+  sqrt(f);          // COMPLIANT
+  tan(i);           // COMPLIANT
+  tan(f);           // COMPLIANT
+  tanh(i);          // COMPLIANT
+  tanh(f);          // COMPLIANT
+  tgamma(i);        // COMPLIANT
+  tgamma(f);        // COMPLIANT
+  trunc(i);         // COMPLIANT
+  trunc(f);         // COMPLIANT
+
+  /**
+   * Char not allowed:
+   */
+  acos(c);          // NON-COMPLIANT
+  acosh(c);         // NON-COMPLIANT
+  asin(c);          // NON-COMPLIANT
+  asinh(c);         // NON-COMPLIANT
+  atan2(c, i);      // NON-COMPLIANT
+  atan2(i, c);      // NON-COMPLIANT
+  atanh(c);         // NON-COMPLIANT
+  carg(c);          // NON-COMPLIANT
+  ceil(c);          // NON-COMPLIANT
+  cimag(c);         // NON-COMPLIANT
+  conj(c);          // NON-COMPLIANT
+  copysign(i, c);   // NON-COMPLIANT
+  copysign(c, i);   // NON-COMPLIANT
+  cosh(c);          // NON-COMPLIANT
+  cproj(c);         // NON-COMPLIANT
+  creal(c);         // NON-COMPLIANT
+  erf(c);           // NON-COMPLIANT
+  erfc(c);          // NON-COMPLIANT
+  exp(c);           // NON-COMPLIANT
+  exp2(c);          // NON-COMPLIANT
+  expm1(c);         // NON-COMPLIANT
+  fabs(c);          // NON-COMPLIANT
+  fdim(c, i);       // NON-COMPLIANT
+  fdim(i, c);       // NON-COMPLIANT
+  floor(c);         // NON-COMPLIANT
+  fma(c, i, i);     // NON-COMPLIANT
+  fma(i, c, i);     // NON-COMPLIANT
+  fma(i, i, c);     // NON-COMPLIANT
+  fmax(c, i);       // NON-COMPLIANT
+  fmax(i, c);       // NON-COMPLIANT
+  fmin(c, i);       // NON-COMPLIANT
+  fmin(i, c);       // NON-COMPLIANT
+  fmod(c, i);       // NON-COMPLIANT
+  fmod(i, c);       // NON-COMPLIANT
+  frexp(c, i);      // NON-COMPLIANT
+  hypot(c, i);      // NON-COMPLIANT
+  hypot(i, c);      // NON-COMPLIANT
+  ilogb(c);         // NON-COMPLIANT
+  ldexp(c, i);      // NON-COMPLIANT
+  ldexp(i, c);      // NON-COMPLIANT
+  lgamma(c);        // NON-COMPLIANT
+  llrint(c);        // NON-COMPLIANT
+  llround(c);       // NON-COMPLIANT
+  log(c);           // NON-COMPLIANT
+  log10(c);         // NON-COMPLIANT
+  log1p(c);         // NON-COMPLIANT
+  log2(c);          // NON-COMPLIANT
+  logb(c);          // NON-COMPLIANT
+  lrint(c);         // NON-COMPLIANT
+  lround(c);        // NON-COMPLIANT
+  nearbyint(c);     // NON-COMPLIANT
+  nextafter(c, i);  // NON-COMPLIANT
+  nextafter(i, c);  // NON-COMPLIANT
+  nexttoward(c, i); // NON-COMPLIANT
+  nexttoward(i, c); // NON-COMPLIANT
+  pow(c, i);        // NON-COMPLIANT
+  pow(i, c);        // NON-COMPLIANT
+  remainder(c, i);  // NON-COMPLIANT
+  remainder(i, c);  // NON-COMPLIANT
+  remquo(c, i, i);  // NON-COMPLIANT
+  remquo(i, c, i);  // NON-COMPLIANT
+  rint(c);          // NON-COMPLIANT
+  round(c);         // NON-COMPLIANT
+  scalbn(c, i);     // NON-COMPLIANT
+  scalbn(i, c);     // NON-COMPLIANT
+  scalbln(c, i);    // NON-COMPLIANT
+  scalbln(i, c);    // NON-COMPLIANT
+  sin(c);           // NON-COMPLIANT
+  sinh(c);          // NON-COMPLIANT
+  sqrt(c);          // NON-COMPLIANT
+  tan(c);           // NON-COMPLIANT
+  tanh(c);          // NON-COMPLIANT
+  tgamma(c);        // NON-COMPLIANT
+  trunc(c);         // NON-COMPLIANT
+
+  /**
+   * Complex types allowed in some calls, not others:
+   */
+  acos(cf);          // COMPLIANT
+  acosh(cf);         // COMPLIANT
+  asin(cf);          // COMPLIANT
+  asinh(cf);         // COMPLIANT
+  atan(cf);          // COMPLIANT
+  //atan2(cf, i);      // NON-COMPLIANT
+  //atan2(i, cf);      // NON-COMPLIANT
+  atanh(cf);         // COMPLIANT
+  carg(cf);          // COMPLIANT
+  //cbrt(cf);          // NON-COMPLIANT
+  //ceil(cf);          // NON-COMPLIANT
+  cimag(cf);         // COMPLIANT
+  conj(cf);          // COMPLIANT
+  //copysign(i, cf);   // NON-COMPLIANT
+  //copysign(cf, i);   // NON-COMPLIANT
+  //copysign(i, cf);   // NON-COMPLIANT
+  cos(cf);           // COMPLIANT
+  cosh(cf);          // COMPLIANT
+  cproj(cf);         // COMPLIANT
+  creal(cf);         // COMPLIANT
+  //erf(cf);           // NON-COMPLIANT
+  //erfc(cf);          // NON-COMPLIANT
+  exp(cf);           // COMPLIANT
+  //exp2(cf);          // NON-COMPLIANT
+  //expm1(cf);         // NON-COMPLIANT
+  fabs(cf);          // COMPLIANT
+  //fdim(cf, i);       // NON-COMPLIANT
+  //fdim(i, cf);       // NON-COMPLIANT
+  //floor(cf);         // NON-COMPLIANT
+  //fma(cf, i, i);     // NON-COMPLIANT
+  //fma(i, cf, i);     // NON-COMPLIANT
+  //fma(i, i, cf);     // NON-COMPLIANT
+  //fmax(cf, i);       // NON-COMPLIANT
+  //fmax(i, cf);       // NON-COMPLIANT
+  //fmin(cf, i);       // NON-COMPLIANT
+  //fmin(i, cf);       // NON-COMPLIANT
+  //fmod(cf, i);       // NON-COMPLIANT
+  //fmod(i, cf);       // NON-COMPLIANT
+  //frexp(cf, i);      // NON-COMPLIANT
+  //hypot(cf, i);      // NON-COMPLIANT
+  //hypot(i, cf);      // NON-COMPLIANT
+  //ilogb(cf);         // NON-COMPLIANT
+  //ldexp(cf, i);      // NON-COMPLIANT
+  //ldexp(i, cf);      // NON-COMPLIANT
+  //lgamma(cf);        // NON-COMPLIANT
+  //llrint(cf);        // NON-COMPLIANT
+  //llround(cf);       // NON-COMPLIANT
+  log(cf);           // COMPLIANT
+  //log10(cf);         // NON-COMPLIANT
+  //log1p(cf);         // NON-COMPLIANT
+  //log2(cf);          // NON-COMPLIANT
+  //logb(cf);          // NON-COMPLIANT
+  //lrint(cf);         // NON-COMPLIANT
+  //lround(cf);        // NON-COMPLIANT
+  //nearbyint(cf);     // NON-COMPLIANT
+  //nextafter(cf, i);  // NON-COMPLIANT
+  //nextafter(i, cf);  // NON-COMPLIANT
+  //nexttoward(cf, i); // NON-COMPLIANT
+  //nexttoward(i, cf); // NON-COMPLIANT
+  pow(cf, cf);       // COMPLIANT
+  //remainder(cf, i);  // NON-COMPLIANT
+  //remainder(i, cf);  // NON-COMPLIANT
+  //remquo(cf, i, i);  // NON-COMPLIANT
+  //remquo(i, cf, i);  // NON-COMPLIANT
+  //rint(cf);          // NON-COMPLIANT
+  //round(cf);         // NON-COMPLIANT
+  //scalbn(cf, i);     // NON-COMPLIANT
+  //scalbn(i, cf);     // NON-COMPLIANT
+  //scalbln(cf, i);    // NON-COMPLIANT
+  //scalbln(i, cf);    // NON-COMPLIANT
+  sin(cf);           // COMPLIANT
+  sinh(cf);          // COMPLIANT
+  sqrt(cf);          // COMPLIANT
+  tan(cf);           // COMPLIANT
+  tanh(cf);          // COMPLIANT
+  //tgamma(cf);        // NON-COMPLIANT
+  //trunc(cf);         // NON-COMPLIANT
+
+  /* Test output arguments thoroughly */
+  frexp(i, &i);            // COMPLIANT
+  frexp(i, vp);            // COMPLIANT
+  frexp(i, 0);             // COMPLIANT
+  frexp(i, 'c' - 'c');     // COMPLIANT
+  frexp(i, c);             // COMPLIANT
+  remquo(i, i, &i);        // COMPLIANT
+  remquo(i, i, vp);        // COMPLIANT
+  remquo(i, i, 0);         // COMPLIANT
+  remquo(i, i, 'c' - 'c'); // COMPLIANT
+  remquo(i, i, c);         // COMPLIANT
+
+  /* Test casts */
+  cos((char) i);  // NON-COMPLIANT
+  cos((int) c);  // COMPLIANT
+  cos((int) (char) i);  // COMPLIANT
+  cos((char) (int) c);  // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected
new file mode 100644
index 0000000000..6136aa4314
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected
@@ -0,0 +1,139 @@
+| test.c:95:3:95:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:96:3:96:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:97:3:97:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:98:3:98:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:99:3:99:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:100:3:100:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:101:3:101:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:102:3:102:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:103:3:103:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:104:3:104:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:105:3:105:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:106:3:106:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:107:3:107:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:108:3:108:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:109:3:109:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:110:3:110:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:111:3:111:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:112:3:112:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:113:3:113:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:114:3:114:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:121:3:121:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:122:3:122:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:123:3:123:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:124:3:124:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:125:3:125:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:126:3:126:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:127:3:127:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:128:3:128:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:131:3:131:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:132:3:132:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:133:3:133:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:134:3:134:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:135:3:135:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:136:3:136:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:137:3:137:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:138:3:138:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:139:3:139:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:140:3:140:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:141:3:141:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:142:3:142:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:143:3:143:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:144:3:144:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:145:3:145:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:146:3:146:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:147:3:147:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:148:3:148:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:149:3:149:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:150:3:150:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:151:3:151:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:152:3:152:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:153:3:153:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:154:3:154:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:155:3:155:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:156:3:156:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:157:3:157:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:158:3:158:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:159:3:159:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:160:3:160:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:161:3:161:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:162:3:162:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:165:3:165:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:166:3:166:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:167:3:167:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:168:3:168:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:169:3:169:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:170:3:170:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:171:3:171:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:172:3:172:17 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:175:3:175:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (float, double). |
+| test.c:176:3:176:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (float, long double). |
+| test.c:177:3:177:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (double, float). |
+| test.c:178:3:178:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (double, long double). |
+| test.c:179:3:179:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long double, float). |
+| test.c:180:3:180:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long double, double). |
+| test.c:183:3:183:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:184:3:184:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:185:3:185:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:186:3:186:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:187:3:187:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:188:3:188:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:189:3:189:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:190:3:190:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:191:3:191:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:192:3:192:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:193:3:193:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:194:3:194:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:195:3:195:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:196:3:196:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:197:3:197:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:198:3:198:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:199:3:199:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:200:3:200:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:201:3:201:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:202:3:202:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:203:3:203:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:204:3:204:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:205:3:205:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:206:3:206:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:207:3:207:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:208:3:208:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:209:3:209:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:210:3:210:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:211:3:211:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:212:3:212:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:213:3:213:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, float). |
+| test.c:214:3:214:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, double). |
+| test.c:215:3:215:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long double). |
+| test.c:216:3:216:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, float). |
+| test.c:217:3:217:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, double). |
+| test.c:218:3:218:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long double). |
+| test.c:219:3:219:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, float). |
+| test.c:220:3:220:13 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, double). |
+| test.c:221:3:221:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, long double). |
+| test.c:222:3:222:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, float). |
+| test.c:223:3:223:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, double). |
+| test.c:224:3:224:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, long double). |
+| test.c:225:3:225:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, float). |
+| test.c:226:3:226:14 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, double). |
+| test.c:227:3:227:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long double). |
+| test.c:228:3:228:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, float). |
+| test.c:229:3:229:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, double). |
+| test.c:230:3:230:16 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long double). |
+| test.c:235:3:235:15 | atan2(x,y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:242:3:242:16 | copysign(x,y) | Call to type-generic macro 'copysign' has arguments with differing standard types (int, float). |
+| test.c:245:3:245:12 | fdim(x,y) | Call to type-generic macro 'fdim' has arguments with differing standard types (int, float). |
+| test.c:248:3:248:14 | fma(x,y,z) | Call to type-generic macro 'fma' has arguments with differing standard types (float, int, int). |
+| test.c:249:3:249:14 | fma(x,y,z) | Call to type-generic macro 'fma' has arguments with differing standard types (int, float, int). |
+| test.c:250:3:250:14 | fma(x,y,z) | Call to type-generic macro 'fma' has arguments with differing standard types (int, int, float). |
+| test.c:253:3:253:12 | fmax(x,y) | Call to type-generic macro 'fmax' has arguments with differing standard types (int, float). |
+| test.c:256:3:256:12 | fmin(x,y) | Call to type-generic macro 'fmin' has arguments with differing standard types (int, float). |
+| test.c:259:3:259:12 | fmod(x,y) | Call to type-generic macro 'fmod' has arguments with differing standard types (int, float). |
+| test.c:262:3:262:13 | hypot(x,y) | Call to type-generic macro 'hypot' has arguments with differing standard types (int, float). |
+| test.c:265:3:265:13 | ldexp(x,y) | Call to type-generic macro 'ldexp' has arguments with differing standard types (int, float). |
+| test.c:268:3:268:17 | nextafter(x,y) | Call to type-generic macro 'nextafter' has arguments with differing standard types (int, float). |
+| test.c:271:3:271:18 | nexttoward(x,y) | Call to type-generic macro 'nexttoward' has arguments with differing standard types (int, float). |
+| test.c:274:3:274:17 | remainder(x,y) | Call to type-generic macro 'remainder' has arguments with differing standard types (int, float). |
+| test.c:277:3:277:17 | remquo(x,y,z) | Call to type-generic macro 'remquo' has arguments with differing standard types (int, float). |
+| test.c:280:3:280:15 | scalbln(x,y) | Call to type-generic macro 'scalbln' has arguments with differing standard types (int, float). |
+| test.c:283:3:283:14 | scalbn(x,y) | Call to type-generic macro 'scalbn' has arguments with differing standard types (int, float). |
diff --git a/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected.clang b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected.clang
new file mode 100644
index 0000000000..e6ad5c62e4
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected.clang
@@ -0,0 +1,139 @@
+| test.c:95:3:95:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:96:3:96:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:97:3:97:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:98:3:98:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:99:3:99:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:100:3:100:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:101:3:101:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:102:3:102:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:103:3:103:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:104:3:104:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:105:3:105:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:106:3:106:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:107:3:107:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:108:3:108:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:109:3:109:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:110:3:110:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:111:3:111:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:112:3:112:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:113:3:113:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:114:3:114:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:121:3:121:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:122:3:122:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:123:3:123:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:124:3:124:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:125:3:125:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:126:3:126:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:127:3:127:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:128:3:128:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:131:3:131:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:132:3:132:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:133:3:133:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:134:3:134:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:135:3:135:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:136:3:136:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:137:3:137:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:138:3:138:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:139:3:139:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:140:3:140:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:141:3:141:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:142:3:142:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:143:3:143:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:144:3:144:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:145:3:145:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:146:3:146:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:147:3:147:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:148:3:148:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:149:3:149:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:150:3:150:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:151:3:151:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:152:3:152:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:153:3:153:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:154:3:154:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:155:3:155:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:156:3:156:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:157:3:157:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:158:3:158:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:159:3:159:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:160:3:160:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:161:3:161:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:162:3:162:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:165:3:165:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:166:3:166:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:167:3:167:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:168:3:168:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:169:3:169:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:170:3:170:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:171:3:171:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:172:3:172:17 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:175:3:175:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (float, double). |
+| test.c:176:3:176:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (float, long double). |
+| test.c:177:3:177:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (double, float). |
+| test.c:178:3:178:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (double, long double). |
+| test.c:179:3:179:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long double, float). |
+| test.c:180:3:180:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long double, double). |
+| test.c:183:3:183:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:184:3:184:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:185:3:185:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:186:3:186:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:187:3:187:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:188:3:188:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:189:3:189:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:190:3:190:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:191:3:191:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:192:3:192:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:193:3:193:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:194:3:194:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:195:3:195:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:196:3:196:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:197:3:197:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:198:3:198:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:199:3:199:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:200:3:200:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:201:3:201:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:202:3:202:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:203:3:203:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:204:3:204:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:205:3:205:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:206:3:206:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:207:3:207:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:208:3:208:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:209:3:209:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:210:3:210:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:211:3:211:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:212:3:212:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:213:3:213:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, float). |
+| test.c:214:3:214:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, double). |
+| test.c:215:3:215:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long double). |
+| test.c:216:3:216:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, float). |
+| test.c:217:3:217:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, double). |
+| test.c:218:3:218:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long double). |
+| test.c:219:3:219:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, float). |
+| test.c:220:3:220:13 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, double). |
+| test.c:221:3:221:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, long double). |
+| test.c:222:3:222:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, float). |
+| test.c:223:3:223:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, double). |
+| test.c:224:3:224:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, long double). |
+| test.c:225:3:225:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, float). |
+| test.c:226:3:226:14 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, double). |
+| test.c:227:3:227:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long double). |
+| test.c:228:3:228:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, float). |
+| test.c:229:3:229:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, double). |
+| test.c:230:3:230:16 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long double). |
+| test.c:235:3:235:15 | atan2(__x,__y) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:242:3:242:16 | copysign(__x,__y) | Call to type-generic macro 'copysign' has arguments with differing standard types (int, float). |
+| test.c:245:3:245:12 | fdim(__x,__y) | Call to type-generic macro 'fdim' has arguments with differing standard types (int, float). |
+| test.c:248:3:248:14 | fma(__x,__y,__z) | Call to type-generic macro 'fma' has arguments with differing standard types (float, int, int). |
+| test.c:249:3:249:14 | fma(__x,__y,__z) | Call to type-generic macro 'fma' has arguments with differing standard types (int, float, int). |
+| test.c:250:3:250:14 | fma(__x,__y,__z) | Call to type-generic macro 'fma' has arguments with differing standard types (int, int, float). |
+| test.c:253:3:253:12 | fmax(__x,__y) | Call to type-generic macro 'fmax' has arguments with differing standard types (int, float). |
+| test.c:256:3:256:12 | fmin(__x,__y) | Call to type-generic macro 'fmin' has arguments with differing standard types (int, float). |
+| test.c:259:3:259:12 | fmod(__x,__y) | Call to type-generic macro 'fmod' has arguments with differing standard types (int, float). |
+| test.c:262:3:262:13 | hypot(__x,__y) | Call to type-generic macro 'hypot' has arguments with differing standard types (int, float). |
+| test.c:265:3:265:13 | ldexp(__x,__y) | Call to type-generic macro 'ldexp' has arguments with differing standard types (int, float). |
+| test.c:268:3:268:17 | nextafter(__x,__y) | Call to type-generic macro 'nextafter' has arguments with differing standard types (int, float). |
+| test.c:271:3:271:18 | nexttoward(__x,__y) | Call to type-generic macro 'nexttoward' has arguments with differing standard types (int, float). |
+| test.c:274:3:274:17 | remainder(__x,__y) | Call to type-generic macro 'remainder' has arguments with differing standard types (int, float). |
+| test.c:277:3:277:17 | remquo(__x,__y,__z) | Call to type-generic macro 'remquo' has arguments with differing standard types (int, float). |
+| test.c:280:3:280:15 | scalbln(__x,__y) | Call to type-generic macro 'scalbln' has arguments with differing standard types (int, float). |
+| test.c:283:3:283:14 | scalbn(__x,__y) | Call to type-generic macro 'scalbn' has arguments with differing standard types (int, float). |
diff --git a/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected.gcc b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected.gcc
new file mode 100644
index 0000000000..f8c610f8c2
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.expected.gcc
@@ -0,0 +1,139 @@
+| test.c:95:3:95:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:96:3:96:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:97:3:97:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:98:3:98:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:99:3:99:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:100:3:100:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:101:3:101:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:102:3:102:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:103:3:103:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:104:3:104:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:105:3:105:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:106:3:106:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:107:3:107:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:108:3:108:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:109:3:109:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:110:3:110:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:111:3:111:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:112:3:112:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:113:3:113:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:114:3:114:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned int). |
+| test.c:121:3:121:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:122:3:122:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:123:3:123:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:124:3:124:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:125:3:125:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:126:3:126:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:127:3:127:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:128:3:128:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:131:3:131:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:132:3:132:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:133:3:133:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:134:3:134:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:135:3:135:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:136:3:136:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:137:3:137:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:138:3:138:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:139:3:139:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:140:3:140:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:141:3:141:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:142:3:142:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:143:3:143:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:144:3:144:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:145:3:145:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:146:3:146:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:147:3:147:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:148:3:148:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long). |
+| test.c:149:3:149:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:150:3:150:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long). |
+| test.c:151:3:151:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:152:3:152:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:153:3:153:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, int). |
+| test.c:154:3:154:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned int). |
+| test.c:155:3:155:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:156:3:156:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, unsigned long). |
+| test.c:157:3:157:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:158:3:158:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, unsigned long). |
+| test.c:159:3:159:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:160:3:160:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:161:3:161:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, int). |
+| test.c:162:3:162:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, unsigned int). |
+| test.c:165:3:165:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:166:3:166:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:167:3:167:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:168:3:168:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, unsigned long). |
+| test.c:169:3:169:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:170:3:170:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:171:3:171:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:172:3:172:17 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long). |
+| test.c:175:3:175:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (float, double). |
+| test.c:176:3:176:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (float, long double). |
+| test.c:177:3:177:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (double, float). |
+| test.c:178:3:178:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (double, long double). |
+| test.c:179:3:179:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long double, float). |
+| test.c:180:3:180:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long double, double). |
+| test.c:183:3:183:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:184:3:184:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:185:3:185:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:186:3:186:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:187:3:187:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:188:3:188:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:189:3:189:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:190:3:190:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:191:3:191:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:192:3:192:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:193:3:193:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:194:3:194:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:195:3:195:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:196:3:196:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:197:3:197:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:198:3:198:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:199:3:199:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:200:3:200:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:201:3:201:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:202:3:202:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:203:3:203:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:204:3:204:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:205:3:205:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:206:3:206:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:207:3:207:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:208:3:208:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:209:3:209:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:210:3:210:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:211:3:211:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, double). |
+| test.c:212:3:212:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, long double). |
+| test.c:213:3:213:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, float). |
+| test.c:214:3:214:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, double). |
+| test.c:215:3:215:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long double). |
+| test.c:216:3:216:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, float). |
+| test.c:217:3:217:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, double). |
+| test.c:218:3:218:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned int, long double). |
+| test.c:219:3:219:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, float). |
+| test.c:220:3:220:13 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, double). |
+| test.c:221:3:221:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, long double). |
+| test.c:222:3:222:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, float). |
+| test.c:223:3:223:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, double). |
+| test.c:224:3:224:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (long, long double). |
+| test.c:225:3:225:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, float). |
+| test.c:226:3:226:14 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, double). |
+| test.c:227:3:227:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long double). |
+| test.c:228:3:228:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, float). |
+| test.c:229:3:229:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, double). |
+| test.c:230:3:230:16 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (unsigned long, long double). |
+| test.c:235:3:235:15 | atan2(Val1,Val2) | Call to type-generic macro 'atan2' has arguments with differing standard types (int, float). |
+| test.c:242:3:242:16 | copysign(Val1,Val2) | Call to type-generic macro 'copysign' has arguments with differing standard types (int, float). |
+| test.c:245:3:245:12 | fdim(Val1,Val2) | Call to type-generic macro 'fdim' has arguments with differing standard types (int, float). |
+| test.c:248:3:248:14 | fma(Val1,Val2,Val3) | Call to type-generic macro 'fma' has arguments with differing standard types (float, int, int). |
+| test.c:249:3:249:14 | fma(Val1,Val2,Val3) | Call to type-generic macro 'fma' has arguments with differing standard types (int, float, int). |
+| test.c:250:3:250:14 | fma(Val1,Val2,Val3) | Call to type-generic macro 'fma' has arguments with differing standard types (int, int, float). |
+| test.c:253:3:253:12 | fmax(Val1,Val2) | Call to type-generic macro 'fmax' has arguments with differing standard types (int, float). |
+| test.c:256:3:256:12 | fmin(Val1,Val2) | Call to type-generic macro 'fmin' has arguments with differing standard types (int, float). |
+| test.c:259:3:259:12 | fmod(Val1,Val2) | Call to type-generic macro 'fmod' has arguments with differing standard types (int, float). |
+| test.c:262:3:262:13 | hypot(Val1,Val2) | Call to type-generic macro 'hypot' has arguments with differing standard types (int, float). |
+| test.c:265:3:265:13 | ldexp(Val1,Val2) | Call to type-generic macro 'ldexp' has arguments with differing standard types (int, float). |
+| test.c:268:3:268:17 | nextafter(Val1,Val2) | Call to type-generic macro 'nextafter' has arguments with differing standard types (int, float). |
+| test.c:271:3:271:18 | nexttoward(Val1,Val2) | Call to type-generic macro 'nexttoward' has arguments with differing standard types (int, float). |
+| test.c:274:3:274:17 | remainder(Val1,Val2) | Call to type-generic macro 'remainder' has arguments with differing standard types (int, float). |
+| test.c:277:3:277:17 | remquo(Val1,Val2,Val3) | Call to type-generic macro 'remquo' has arguments with differing standard types (int, float). |
+| test.c:280:3:280:15 | scalbln(Val1,Val2) | Call to type-generic macro 'scalbln' has arguments with differing standard types (int, float). |
+| test.c:283:3:283:14 | scalbn(Val1,Val2) | Call to type-generic macro 'scalbn' has arguments with differing standard types (int, float). |
diff --git a/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.qlref b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.qlref
new file mode 100644
index 0000000000..550893822f
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.qlref
@@ -0,0 +1 @@
+rules/RULE-21-23/TgMathArgumentsWithDifferingStandardType.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-23/test.c b/c/misra/test/rules/RULE-21-23/test.c
new file mode 100644
index 0000000000..08df1184a7
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-23/test.c
@@ -0,0 +1,288 @@
+#include <stdint.h>
+#include <tgmath.h>
+
+void f1() {
+  signed char c = 0;
+  unsigned char uc = 0;
+  short s = 0;
+  unsigned short us = 0;
+  int i = 0;
+  unsigned int ui = 0;
+  long l = 0;
+  unsigned long ul = 0;
+  float f = 0.0f;
+  double d = 0.0;
+  long double ld = 0.0;
+  uint8_t u8 = 0;
+  int8_t i8 = 0;
+  uint16_t u16 = 0;
+  int16_t i16 = 0;
+  uint32_t u32 = 0;
+  int32_t i32 = 0;
+  uint64_t u64 = 0;
+  int64_t i64 = 0;
+
+  /**
+   * Test exact types
+   */
+  atan2(c, c);     // COMPLIANT
+  atan2(uc, uc);   // COMPLIANT
+  atan2(s, s);     // COMPLIANT
+  atan2(us, us);   // COMPLIANT
+  atan2(i, i);     // COMPLIANT
+  atan2(ui, ui);   // COMPLIANT
+  atan2(ui, ui);   // COMPLIANT
+  atan2(l, l);     // COMPLIANT
+  atan2(ul, ul);   // COMPLIANT
+  atan2(f, f);     // COMPLIANT
+  atan2(d, d);     // COMPLIANT
+  atan2(ld, ld);   // COMPLIANT
+  atan2(u8, u8);   // COMPLIANT
+  atan2(i8, i8);   // COMPLIANT
+  atan2(u16, u16); // COMPLIANT
+  atan2(i16, i16); // COMPLIANT
+  atan2(u32, u32); // COMPLIANT
+  atan2(i32, i32); // COMPLIANT
+  atan2(u64, u64); // COMPLIANT
+  atan2(i64, i64); // COMPLIANT
+
+  /** Test equivalent types */
+  atan2(c, i8);   // COMPLIANT
+  atan2(i8, c);   // COMPLIANT
+  atan2(uc, u8);  // COMPLIANT
+  atan2(u8, uc);  // COMPLIANT
+  atan2(s, i16);  // COMPLIANT
+  atan2(i16, s);  // COMPLIANT
+  atan2(us, u16); // COMPLIANT
+  atan2(u16, us); // COMPLIANT
+  atan2(i, i32);  // COMPLIANT
+  atan2(i32, i);  // COMPLIANT
+  atan2(ui, u32); // COMPLIANT
+  atan2(u32, ui); // COMPLIANT
+  atan2(l, i64);  // COMPLIANT
+  atan2(i64, l);  // COMPLIANT
+  atan2(ul, u64); // COMPLIANT
+  atan2(u64, ul); // COMPLIANT
+
+  /** Types are the same after integer promotion */
+  atan2(c, i8);   // COMPLIANT
+  atan2(c, u8);   // COMPLIANT
+  atan2(c, i16);  // COMPLIANT
+  atan2(c, u16);  // COMPLIANT
+  atan2(c, i32);  // COMPLIANT
+  atan2(uc, i8);  // COMPLIANT
+  atan2(uc, u8);  // COMPLIANT
+  atan2(uc, i16); // COMPLIANT
+  atan2(uc, u16); // COMPLIANT
+  atan2(uc, i32); // COMPLIANT
+  atan2(s, i8);   // COMPLIANT
+  atan2(s, u8);   // COMPLIANT
+  atan2(s, i16);  // COMPLIANT
+  atan2(s, u16);  // COMPLIANT
+  atan2(s, i32);  // COMPLIANT
+  atan2(us, i8);  // COMPLIANT
+  atan2(us, u8);  // COMPLIANT
+  atan2(us, i16); // COMPLIANT
+  atan2(us, u16); // COMPLIANT
+  atan2(us, i32); // COMPLIANT
+  atan2(i, i8);   // COMPLIANT
+  atan2(i, u8);   // COMPLIANT
+  atan2(i, i16);  // COMPLIANT
+  atan2(i, u16);  // COMPLIANT
+  atan2(i, i32);  // COMPLIANT
+
+  /** Integer promotion makes a signed int, not an unsigned int */
+  atan2(c, ui);    // NON-COMPLIANT
+  atan2(c, u32);   // NON-COMPLIANT
+  atan2(i8, ui);   // NON-COMPLIANT
+  atan2(i8, u32);  // NON-COMPLIANT
+  atan2(uc, ui);   // NON-COMPLIANT
+  atan2(uc, u32);  // NON-COMPLIANT
+  atan2(u8, ui);   // NON-COMPLIANT
+  atan2(u8, u32);  // NON-COMPLIANT
+  atan2(s, ui);    // NON-COMPLIANT
+  atan2(s, u32);   // NON-COMPLIANT
+  atan2(i16, ui);  // NON-COMPLIANT
+  atan2(i16, u32); // NON-COMPLIANT
+  atan2(us, ui);   // NON-COMPLIANT
+  atan2(us, u32);  // NON-COMPLIANT
+  atan2(u16, ui);  // NON-COMPLIANT
+  atan2(u16, u32); // NON-COMPLIANT
+  atan2(i, ui);    // NON-COMPLIANT
+  atan2(i, u32);   // NON-COMPLIANT
+  atan2(i32, ui);  // NON-COMPLIANT
+  atan2(i32, u32); // NON-COMPLIANT
+  atan2(ui, ui);   // COMPLIANT
+  atan2(ui, u32);  // COMPLIANT
+  atan2(u32, ui);  // COMPLIANT
+  atan2(u32, u32); // COMPLIANT
+
+  /** Integer promotion makes int, not long */
+  atan2(c, l);   // NON-COMPLIANT
+  atan2(i8, l);  // NON-COMPLIANT
+  atan2(uc, l);  // NON-COMPLIANT
+  atan2(u8, l);  // NON-COMPLIANT
+  atan2(s, l);   // NON-COMPLIANT
+  atan2(i16, l); // NON-COMPLIANT
+  atan2(us, l);  // NON-COMPLIANT
+  atan2(u16, l); // NON-COMPLIANT
+
+  /** Integer vs long */
+  atan2(i, l);     // NON-COMPLIANT
+  atan2(i32, l);   // NON-COMPLIANT
+  atan2(ui, l);    // NON-COMPLIANT
+  atan2(u32, l);   // NON-COMPLIANT
+  atan2(l, i);     // NON-COMPLIANT
+  atan2(l, ui);    // NON-COMPLIANT
+  atan2(l, i32);   // NON-COMPLIANT
+  atan2(l, u32);   // NON-COMPLIANT
+  atan2(i, ul);    // NON-COMPLIANT
+  atan2(i32, ul);  // NON-COMPLIANT
+  atan2(ui, ul);   // NON-COMPLIANT
+  atan2(u32, ul);  // NON-COMPLIANT
+  atan2(ul, i);    // NON-COMPLIANT
+  atan2(ul, ui);   // NON-COMPLIANT
+  atan2(ul, i32);  // NON-COMPLIANT
+  atan2(ul, u32);  // NON-COMPLIANT
+  atan2(i, i64);   // NON-COMPLIANT
+  atan2(i32, i64); // NON-COMPLIANT
+  atan2(ui, i64);  // NON-COMPLIANT
+  atan2(u32, i64); // NON-COMPLIANT
+  atan2(i64, i);   // NON-COMPLIANT
+  atan2(i64, ui);  // NON-COMPLIANT
+  atan2(i64, i32); // NON-COMPLIANT
+  atan2(i64, u32); // NON-COMPLIANT
+  atan2(i, u64);   // NON-COMPLIANT
+  atan2(i32, u64); // NON-COMPLIANT
+  atan2(ui, u64);  // NON-COMPLIANT
+  atan2(u32, u64); // NON-COMPLIANT
+  atan2(u64, i);   // NON-COMPLIANT
+  atan2(u64, ui);  // NON-COMPLIANT
+  atan2(u64, i32); // NON-COMPLIANT
+  atan2(u64, u32); // NON-COMPLIANT
+
+  /** Signed vs unsigned long, since those don't promote */
+  atan2(l, ul);    // NON-COMPLIANT
+  atan2(l, u64);   // NON-COMPLIANT
+  atan2(i64, ul);  // NON-COMPLIANT
+  atan2(i64, u64); // NON-COMPLIANT
+  atan2(ul, l);    // NON-COMPLIANT
+  atan2(ul, i64);  // NON-COMPLIANT
+  atan2(u64, l);   // NON-COMPLIANT
+  atan2(u64, i64); // NON-COMPLIANT
+
+  /** Mismatched float sizes */
+  atan2(f, d);  // NON-COMPLIANT
+  atan2(f, ld); // NON-COMPLIANT
+  atan2(d, f);  // NON-COMPLIANT
+  atan2(d, ld); // NON-COMPLIANT
+  atan2(ld, f); // NON-COMPLIANT
+  atan2(ld, d); // NON-COMPLIANT
+
+  /** Float vs int */
+  atan2(c, f);    // NON-COMPLIANT
+  atan2(c, d);    // NON-COMPLIANT
+  atan2(c, ld);   // NON-COMPLIANT
+  atan2(i8, f);   // NON-COMPLIANT
+  atan2(i8, d);   // NON-COMPLIANT
+  atan2(i8, ld);  // NON-COMPLIANT
+  atan2(uc, f);   // NON-COMPLIANT
+  atan2(uc, d);   // NON-COMPLIANT
+  atan2(uc, ld);  // NON-COMPLIANT
+  atan2(u8, f);   // NON-COMPLIANT
+  atan2(u8, d);   // NON-COMPLIANT
+  atan2(u8, ld);  // NON-COMPLIANT
+  atan2(s, f);    // NON-COMPLIANT
+  atan2(s, d);    // NON-COMPLIANT
+  atan2(s, ld);   // NON-COMPLIANT
+  atan2(i16, f);  // NON-COMPLIANT
+  atan2(i16, d);  // NON-COMPLIANT
+  atan2(i16, ld); // NON-COMPLIANT
+  atan2(us, f);   // NON-COMPLIANT
+  atan2(us, d);   // NON-COMPLIANT
+  atan2(us, ld);  // NON-COMPLIANT
+  atan2(u16, f);  // NON-COMPLIANT
+  atan2(u16, d);  // NON-COMPLIANT
+  atan2(u16, ld); // NON-COMPLIANT
+  atan2(i, f);    // NON-COMPLIANT
+  atan2(i, d);    // NON-COMPLIANT
+  atan2(i, ld);   // NON-COMPLIANT
+  atan2(i32, f);  // NON-COMPLIANT
+  atan2(i32, d);  // NON-COMPLIANT
+  atan2(i32, ld); // NON-COMPLIANT
+  atan2(ui, f);   // NON-COMPLIANT
+  atan2(ui, d);   // NON-COMPLIANT
+  atan2(ui, ld);  // NON-COMPLIANT
+  atan2(u32, f);  // NON-COMPLIANT
+  atan2(u32, d);  // NON-COMPLIANT
+  atan2(u32, ld); // NON-COMPLIANT
+  atan2(l, f);    // NON-COMPLIANT
+  atan2(l, d);    // NON-COMPLIANT
+  atan2(l, ld);   // NON-COMPLIANT
+  atan2(i64, f);  // NON-COMPLIANT
+  atan2(i64, d);  // NON-COMPLIANT
+  atan2(i64, ld); // NON-COMPLIANT
+  atan2(ul, f);   // NON-COMPLIANT
+  atan2(ul, d);   // NON-COMPLIANT
+  atan2(ul, ld);  // NON-COMPLIANT
+  atan2(u64, f);  // NON-COMPLIANT
+  atan2(u64, d);  // NON-COMPLIANT
+  atan2(u64, ld); // NON-COMPLIANT
+
+  /** Casts and conversions */
+  atan2((float)i, f);        // COMPLIANT
+  atan2(i, (int)f);          // COMPLIANT
+  atan2((i), f);             // NON-COMPLIANT
+  atan2(((float)i), f);      // COMPLIANT
+  atan2((float)((int)l), f); // COMPLIANT
+
+  /** Other functions */
+  copysign(f, f);   // COMPLIANT
+  copysign(i, i);   // COMPLIANT
+  copysign(i, f);   // NON-COMPLIANT
+  fdim(f, f);       // COMPLIANT
+  fdim(i, i);       // COMPLIANT
+  fdim(i, f);       // NON-COMPLIANT
+  fma(f, f, f);     // COMPLIANT
+  fma(i, i, i);     // COMPLIANT
+  fma(f, i, i);     // NON-COMPLIANT
+  fma(i, f, i);     // NON-COMPLIANT
+  fma(i, i, f);     // NON-COMPLIANT
+  fmax(f, f);       // COMPLIANT
+  fmax(i, i);       // COMPLIANT
+  fmax(i, f);       // NON-COMPLIANT
+  fmin(f, f);       // COMPLIANT
+  fmin(i, i);       // COMPLIANT
+  fmin(i, f);       // NON-COMPLIANT
+  fmod(f, f);       // COMPLIANT
+  fmod(i, i);       // COMPLIANT
+  fmod(i, f);       // NON-COMPLIANT
+  hypot(f, f);      // COMPLIANT
+  hypot(i, i);      // COMPLIANT
+  hypot(i, f);      // NON-COMPLIANT
+  ldexp(f, f);      // COMPLIANT
+  ldexp(i, i);      // COMPLIANT
+  ldexp(i, f);      // NON-COMPLIANT
+  nextafter(f, f);  // COMPLIANT
+  nextafter(i, i);  // COMPLIANT
+  nextafter(i, f);  // NON-COMPLIANT
+  nexttoward(f, f); // COMPLIANT
+  nexttoward(i, i); // COMPLIANT
+  nexttoward(i, f); // NON-COMPLIANT
+  remainder(f, f);  // COMPLIANT
+  remainder(i, i);  // COMPLIANT
+  remainder(i, f);  // NON-COMPLIANT
+  remquo(f, f, 0);  // COMPLIANT
+  remquo(i, i, 0);  // COMPLIANT
+  remquo(i, f, 0);  // NON-COMPLIANT
+  scalbln(f, f);    // COMPLIANT
+  scalbln(i, i);    // COMPLIANT
+  scalbln(i, f);    // NON-COMPLIANT
+  scalbn(f, f);     // COMPLIANT
+  scalbn(i, i);     // COMPLIANT
+  scalbn(i, f);     // NON-COMPLIANT
+
+  // `frexp` has two parameters, but the second is an output parameter, and
+  // should not be covered by this rule.
+  frexp(f, 0); // COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.expected b/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.expected
new file mode 100644
index 0000000000..0b17405a0e
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.expected
@@ -0,0 +1,106 @@
+edges
+| test.c:4:5:4:6 | *g2 | test.c:54:33:54:34 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:55:29:55:30 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:56:42:56:43 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:57:35:57:36 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:58:36:58:37 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:59:56:59:57 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:60:60:60:61 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:61:54:61:55 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:62:58:62:59 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:63:37:63:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:64:37:64:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:65:36:65:37 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:66:37:66:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:67:37:67:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:68:23:68:24 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:69:23:69:24 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:72:23:72:24 | g2 | provenance |  |
+| test.c:4:10:4:29 | memory_order_relaxed | test.c:4:5:4:6 | *g2 | provenance |  |
+| test.c:4:10:4:29 | memory_order_relaxed | test.c:4:10:4:29 | memory_order_relaxed | provenance |  |
+| test.c:5:5:5:6 | *g3 | test.c:73:23:73:24 | g3 | provenance |  |
+| test.c:5:10:5:29 | memory_order_acquire | test.c:5:5:5:6 | *g3 | provenance |  |
+| test.c:5:10:5:29 | memory_order_acquire | test.c:5:10:5:29 | memory_order_acquire | provenance |  |
+| test.c:6:5:6:6 | *g4 | test.c:74:23:74:24 | g4 | provenance |  |
+| test.c:6:10:6:29 | memory_order_consume | test.c:6:5:6:6 | *g4 | provenance |  |
+| test.c:6:10:6:29 | memory_order_consume | test.c:6:10:6:29 | memory_order_consume | provenance |  |
+| test.c:7:5:7:6 | *g5 | test.c:75:23:75:24 | g5 | provenance |  |
+| test.c:7:10:7:29 | memory_order_acq_rel | test.c:7:5:7:6 | *g5 | provenance |  |
+| test.c:7:10:7:29 | memory_order_acq_rel | test.c:7:10:7:29 | memory_order_acq_rel | provenance |  |
+| test.c:8:5:8:6 | *g6 | test.c:76:23:76:24 | g6 | provenance |  |
+| test.c:8:10:8:29 | memory_order_release | test.c:8:5:8:6 | *g6 | provenance |  |
+| test.c:8:10:8:29 | memory_order_release | test.c:8:10:8:29 | memory_order_release | provenance |  |
+nodes
+| test.c:4:5:4:6 | *g2 | semmle.label | *g2 |
+| test.c:4:10:4:29 | memory_order_relaxed | semmle.label | memory_order_relaxed |
+| test.c:4:10:4:29 | memory_order_relaxed | semmle.label | memory_order_relaxed |
+| test.c:5:5:5:6 | *g3 | semmle.label | *g3 |
+| test.c:5:10:5:29 | memory_order_acquire | semmle.label | memory_order_acquire |
+| test.c:5:10:5:29 | memory_order_acquire | semmle.label | memory_order_acquire |
+| test.c:6:5:6:6 | *g4 | semmle.label | *g4 |
+| test.c:6:10:6:29 | memory_order_consume | semmle.label | memory_order_consume |
+| test.c:6:10:6:29 | memory_order_consume | semmle.label | memory_order_consume |
+| test.c:7:5:7:6 | *g5 | semmle.label | *g5 |
+| test.c:7:10:7:29 | memory_order_acq_rel | semmle.label | memory_order_acq_rel |
+| test.c:7:10:7:29 | memory_order_acq_rel | semmle.label | memory_order_acq_rel |
+| test.c:8:5:8:6 | *g6 | semmle.label | *g6 |
+| test.c:8:10:8:29 | memory_order_release | semmle.label | memory_order_release |
+| test.c:8:10:8:29 | memory_order_release | semmle.label | memory_order_release |
+| test.c:17:29:17:48 | memory_order_relaxed | semmle.label | memory_order_relaxed |
+| test.c:18:29:18:48 | memory_order_acquire | semmle.label | memory_order_acquire |
+| test.c:19:29:19:48 | memory_order_consume | semmle.label | memory_order_consume |
+| test.c:20:29:20:48 | memory_order_acq_rel | semmle.label | memory_order_acq_rel |
+| test.c:21:29:21:48 | memory_order_release | semmle.label | memory_order_release |
+| test.c:54:33:54:34 | g2 | semmle.label | g2 |
+| test.c:55:29:55:30 | g2 | semmle.label | g2 |
+| test.c:56:42:56:43 | g2 | semmle.label | g2 |
+| test.c:57:35:57:36 | g2 | semmle.label | g2 |
+| test.c:58:36:58:37 | g2 | semmle.label | g2 |
+| test.c:59:56:59:57 | g2 | semmle.label | g2 |
+| test.c:60:60:60:61 | g2 | semmle.label | g2 |
+| test.c:61:54:61:55 | g2 | semmle.label | g2 |
+| test.c:62:58:62:59 | g2 | semmle.label | g2 |
+| test.c:63:37:63:38 | g2 | semmle.label | g2 |
+| test.c:64:37:64:38 | g2 | semmle.label | g2 |
+| test.c:65:36:65:37 | g2 | semmle.label | g2 |
+| test.c:66:37:66:38 | g2 | semmle.label | g2 |
+| test.c:67:37:67:38 | g2 | semmle.label | g2 |
+| test.c:68:23:68:24 | g2 | semmle.label | g2 |
+| test.c:69:23:69:24 | g2 | semmle.label | g2 |
+| test.c:72:23:72:24 | g2 | semmle.label | g2 |
+| test.c:73:23:73:24 | g3 | semmle.label | g3 |
+| test.c:74:23:74:24 | g4 | semmle.label | g4 |
+| test.c:75:23:75:24 | g5 | semmle.label | g5 |
+| test.c:76:23:76:24 | g6 | semmle.label | g6 |
+| test.c:80:23:80:23 | 1 | semmle.label | 1 |
+| test.c:81:23:81:25 | 100 | semmle.label | 100 |
+subpaths
+#select
+| test.c:17:29:17:48 | memory_order_relaxed | test.c:17:29:17:48 | memory_order_relaxed | test.c:17:29:17:48 | memory_order_relaxed | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:18:29:18:48 | memory_order_acquire | test.c:18:29:18:48 | memory_order_acquire | test.c:18:29:18:48 | memory_order_acquire | Invalid memory order '$@' in call to function '$@'. | memory_order_acquire | memory_order_acquire | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:19:29:19:48 | memory_order_consume | test.c:19:29:19:48 | memory_order_consume | test.c:19:29:19:48 | memory_order_consume | Invalid memory order '$@' in call to function '$@'. | memory_order_consume | memory_order_consume | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:20:29:20:48 | memory_order_acq_rel | test.c:20:29:20:48 | memory_order_acq_rel | test.c:20:29:20:48 | memory_order_acq_rel | Invalid memory order '$@' in call to function '$@'. | memory_order_acq_rel | memory_order_acq_rel | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:21:29:21:48 | memory_order_release | test.c:21:29:21:48 | memory_order_release | test.c:21:29:21:48 | memory_order_release | Invalid memory order '$@' in call to function '$@'. | memory_order_release | memory_order_release | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:54:33:54:34 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:54:33:54:34 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_store_explicit |
+| test.c:55:29:55:30 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:55:29:55:30 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:56:42:56:43 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:56:42:56:43 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_flag_test_and_set_explicit |
+| test.c:57:35:57:36 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:57:35:57:36 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_flag_clear_explicit |
+| test.c:58:36:58:37 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:58:36:58:37 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_exchange_explicit |
+| test.c:59:56:59:57 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:59:56:59:57 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_strong_explicit |
+| test.c:60:60:60:61 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:60:60:60:61 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_strong_explicit |
+| test.c:61:54:61:55 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:61:54:61:55 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_weak_explicit |
+| test.c:62:58:62:59 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:62:58:62:59 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_weak_explicit |
+| test.c:63:37:63:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:63:37:63:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_add_explicit |
+| test.c:64:37:64:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:64:37:64:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_sub_explicit |
+| test.c:65:36:65:37 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:65:36:65:37 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_or_explicit |
+| test.c:66:37:66:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:66:37:66:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_xor_explicit |
+| test.c:67:37:67:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:67:37:67:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_and_explicit |
+| test.c:68:23:68:24 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:68:23:68:24 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:69:23:69:24 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:69:23:69:24 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_signal_fence |
+| test.c:72:23:72:24 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:72:23:72:24 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:73:23:73:24 | g3 | test.c:5:10:5:29 | memory_order_acquire | test.c:73:23:73:24 | g3 | Invalid memory order '$@' in call to function '$@'. | memory_order_acquire | memory_order_acquire | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:74:23:74:24 | g4 | test.c:6:10:6:29 | memory_order_consume | test.c:74:23:74:24 | g4 | Invalid memory order '$@' in call to function '$@'. | memory_order_consume | memory_order_consume | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:75:23:75:24 | g5 | test.c:7:10:7:29 | memory_order_acq_rel | test.c:75:23:75:24 | g5 | Invalid memory order '$@' in call to function '$@'. | memory_order_acq_rel | memory_order_acq_rel | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:76:23:76:24 | g6 | test.c:8:10:8:29 | memory_order_release | test.c:76:23:76:24 | g6 | Invalid memory order '$@' in call to function '$@'. | memory_order_release | memory_order_release | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:80:23:80:23 | 1 | test.c:80:23:80:23 | 1 | test.c:80:23:80:23 | 1 | Invalid memory order '$@' in call to function '$@'. | memory_order_consume | memory_order_consume | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:81:23:81:25 | 100 | test.c:81:23:81:25 | 100 | test.c:81:23:81:25 | 100 | Invalid memory order '$@' in call to function '$@'. | 100 | 100 | Invocation of a standard function implemented as a macro | atomic_thread_fence |
diff --git a/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.expected.gcc b/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.expected.gcc
new file mode 100644
index 0000000000..db07e0aa33
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.expected.gcc
@@ -0,0 +1,106 @@
+edges
+| test.c:4:5:4:6 | *g2 | test.c:54:33:54:34 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:55:29:55:30 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:56:42:56:43 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:57:35:57:36 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:58:36:58:37 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:59:56:59:57 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:60:60:60:61 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:61:54:61:55 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:62:58:62:59 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:63:37:63:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:64:37:64:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:65:36:65:37 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:66:37:66:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:67:37:67:38 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:68:23:68:24 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:69:23:69:24 | g2 | provenance |  |
+| test.c:4:5:4:6 | *g2 | test.c:72:23:72:24 | g2 | provenance |  |
+| test.c:4:10:4:29 | memory_order_relaxed | test.c:4:5:4:6 | *g2 | provenance |  |
+| test.c:4:10:4:29 | memory_order_relaxed | test.c:4:10:4:29 | memory_order_relaxed | provenance |  |
+| test.c:5:5:5:6 | *g3 | test.c:73:23:73:24 | g3 | provenance |  |
+| test.c:5:10:5:29 | memory_order_acquire | test.c:5:5:5:6 | *g3 | provenance |  |
+| test.c:5:10:5:29 | memory_order_acquire | test.c:5:10:5:29 | memory_order_acquire | provenance |  |
+| test.c:6:5:6:6 | *g4 | test.c:74:23:74:24 | g4 | provenance |  |
+| test.c:6:10:6:29 | memory_order_consume | test.c:6:5:6:6 | *g4 | provenance |  |
+| test.c:6:10:6:29 | memory_order_consume | test.c:6:10:6:29 | memory_order_consume | provenance |  |
+| test.c:7:5:7:6 | *g5 | test.c:75:23:75:24 | g5 | provenance |  |
+| test.c:7:10:7:29 | memory_order_acq_rel | test.c:7:5:7:6 | *g5 | provenance |  |
+| test.c:7:10:7:29 | memory_order_acq_rel | test.c:7:10:7:29 | memory_order_acq_rel | provenance |  |
+| test.c:8:5:8:6 | *g6 | test.c:76:23:76:24 | g6 | provenance |  |
+| test.c:8:10:8:29 | memory_order_release | test.c:8:5:8:6 | *g6 | provenance |  |
+| test.c:8:10:8:29 | memory_order_release | test.c:8:10:8:29 | memory_order_release | provenance |  |
+nodes
+| test.c:4:5:4:6 | *g2 | semmle.label | *g2 |
+| test.c:4:10:4:29 | memory_order_relaxed | semmle.label | memory_order_relaxed |
+| test.c:4:10:4:29 | memory_order_relaxed | semmle.label | memory_order_relaxed |
+| test.c:5:5:5:6 | *g3 | semmle.label | *g3 |
+| test.c:5:10:5:29 | memory_order_acquire | semmle.label | memory_order_acquire |
+| test.c:5:10:5:29 | memory_order_acquire | semmle.label | memory_order_acquire |
+| test.c:6:5:6:6 | *g4 | semmle.label | *g4 |
+| test.c:6:10:6:29 | memory_order_consume | semmle.label | memory_order_consume |
+| test.c:6:10:6:29 | memory_order_consume | semmle.label | memory_order_consume |
+| test.c:7:5:7:6 | *g5 | semmle.label | *g5 |
+| test.c:7:10:7:29 | memory_order_acq_rel | semmle.label | memory_order_acq_rel |
+| test.c:7:10:7:29 | memory_order_acq_rel | semmle.label | memory_order_acq_rel |
+| test.c:8:5:8:6 | *g6 | semmle.label | *g6 |
+| test.c:8:10:8:29 | memory_order_release | semmle.label | memory_order_release |
+| test.c:8:10:8:29 | memory_order_release | semmle.label | memory_order_release |
+| test.c:17:3:17:49 | memory_order_relaxed | semmle.label | memory_order_relaxed |
+| test.c:18:3:18:49 | memory_order_acquire | semmle.label | memory_order_acquire |
+| test.c:19:3:19:49 | memory_order_consume | semmle.label | memory_order_consume |
+| test.c:20:3:20:49 | memory_order_acq_rel | semmle.label | memory_order_acq_rel |
+| test.c:21:3:21:49 | memory_order_release | semmle.label | memory_order_release |
+| test.c:54:33:54:34 | g2 | semmle.label | g2 |
+| test.c:55:29:55:30 | g2 | semmle.label | g2 |
+| test.c:56:42:56:43 | g2 | semmle.label | g2 |
+| test.c:57:35:57:36 | g2 | semmle.label | g2 |
+| test.c:58:36:58:37 | g2 | semmle.label | g2 |
+| test.c:59:56:59:57 | g2 | semmle.label | g2 |
+| test.c:60:60:60:61 | g2 | semmle.label | g2 |
+| test.c:61:54:61:55 | g2 | semmle.label | g2 |
+| test.c:62:58:62:59 | g2 | semmle.label | g2 |
+| test.c:63:37:63:38 | g2 | semmle.label | g2 |
+| test.c:64:37:64:38 | g2 | semmle.label | g2 |
+| test.c:65:36:65:37 | g2 | semmle.label | g2 |
+| test.c:66:37:66:38 | g2 | semmle.label | g2 |
+| test.c:67:37:67:38 | g2 | semmle.label | g2 |
+| test.c:68:23:68:24 | g2 | semmle.label | g2 |
+| test.c:69:23:69:24 | g2 | semmle.label | g2 |
+| test.c:72:23:72:24 | g2 | semmle.label | g2 |
+| test.c:73:23:73:24 | g3 | semmle.label | g3 |
+| test.c:74:23:74:24 | g4 | semmle.label | g4 |
+| test.c:75:23:75:24 | g5 | semmle.label | g5 |
+| test.c:76:23:76:24 | g6 | semmle.label | g6 |
+| test.c:80:23:80:23 | 1 | semmle.label | 1 |
+| test.c:81:23:81:25 | 100 | semmle.label | 100 |
+subpaths
+#select
+| test.c:17:3:17:49 | memory_order_relaxed | test.c:17:3:17:49 | memory_order_relaxed | test.c:17:3:17:49 | memory_order_relaxed | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:18:3:18:49 | memory_order_acquire | test.c:18:3:18:49 | memory_order_acquire | test.c:18:3:18:49 | memory_order_acquire | Invalid memory order '$@' in call to function '$@'. | memory_order_acquire | memory_order_acquire | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:19:3:19:49 | memory_order_consume | test.c:19:3:19:49 | memory_order_consume | test.c:19:3:19:49 | memory_order_consume | Invalid memory order '$@' in call to function '$@'. | memory_order_consume | memory_order_consume | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:20:3:20:49 | memory_order_acq_rel | test.c:20:3:20:49 | memory_order_acq_rel | test.c:20:3:20:49 | memory_order_acq_rel | Invalid memory order '$@' in call to function '$@'. | memory_order_acq_rel | memory_order_acq_rel | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:21:3:21:49 | memory_order_release | test.c:21:3:21:49 | memory_order_release | test.c:21:3:21:49 | memory_order_release | Invalid memory order '$@' in call to function '$@'. | memory_order_release | memory_order_release | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:54:33:54:34 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:54:33:54:34 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_store_explicit |
+| test.c:55:29:55:30 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:55:29:55:30 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_load_explicit |
+| test.c:56:42:56:43 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:56:42:56:43 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_flag_test_and_set_explicit |
+| test.c:57:35:57:36 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:57:35:57:36 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_flag_clear_explicit |
+| test.c:58:36:58:37 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:58:36:58:37 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_exchange_explicit |
+| test.c:59:56:59:57 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:59:56:59:57 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_strong_explicit |
+| test.c:60:60:60:61 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:60:60:60:61 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_strong_explicit |
+| test.c:61:54:61:55 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:61:54:61:55 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_weak_explicit |
+| test.c:62:58:62:59 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:62:58:62:59 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_compare_exchange_weak_explicit |
+| test.c:63:37:63:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:63:37:63:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_add_explicit |
+| test.c:64:37:64:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:64:37:64:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_sub_explicit |
+| test.c:65:36:65:37 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:65:36:65:37 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_or_explicit |
+| test.c:66:37:66:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:66:37:66:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_xor_explicit |
+| test.c:67:37:67:38 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:67:37:67:38 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_fetch_and_explicit |
+| test.c:68:23:68:24 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:68:23:68:24 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:69:23:69:24 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:69:23:69:24 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_signal_fence |
+| test.c:72:23:72:24 | g2 | test.c:4:10:4:29 | memory_order_relaxed | test.c:72:23:72:24 | g2 | Invalid memory order '$@' in call to function '$@'. | memory_order_relaxed | memory_order_relaxed | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:73:23:73:24 | g3 | test.c:5:10:5:29 | memory_order_acquire | test.c:73:23:73:24 | g3 | Invalid memory order '$@' in call to function '$@'. | memory_order_acquire | memory_order_acquire | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:74:23:74:24 | g4 | test.c:6:10:6:29 | memory_order_consume | test.c:74:23:74:24 | g4 | Invalid memory order '$@' in call to function '$@'. | memory_order_consume | memory_order_consume | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:75:23:75:24 | g5 | test.c:7:10:7:29 | memory_order_acq_rel | test.c:75:23:75:24 | g5 | Invalid memory order '$@' in call to function '$@'. | memory_order_acq_rel | memory_order_acq_rel | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:76:23:76:24 | g6 | test.c:8:10:8:29 | memory_order_release | test.c:76:23:76:24 | g6 | Invalid memory order '$@' in call to function '$@'. | memory_order_release | memory_order_release | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:80:23:80:23 | 1 | test.c:80:23:80:23 | 1 | test.c:80:23:80:23 | 1 | Invalid memory order '$@' in call to function '$@'. | memory_order_consume | memory_order_consume | Invocation of a standard function implemented as a macro | atomic_thread_fence |
+| test.c:81:23:81:25 | 100 | test.c:81:23:81:25 | 100 | test.c:81:23:81:25 | 100 | Invalid memory order '$@' in call to function '$@'. | 100 | 100 | Invocation of a standard function implemented as a macro | atomic_thread_fence |
diff --git a/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.qlref b/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.qlref
new file mode 100644
index 0000000000..5c205adc24
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-25/InvalidMemoryOrderArgument.qlref
@@ -0,0 +1 @@
+rules/RULE-21-25/InvalidMemoryOrderArgument.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-25/test.c b/c/misra/test/rules/RULE-21-25/test.c
new file mode 100644
index 0000000000..d096634d30
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-25/test.c
@@ -0,0 +1,86 @@
+#include <stdatomic.h>
+
+int g1 = memory_order_seq_cst;
+int g2 = memory_order_relaxed;
+int g3 = memory_order_acquire;
+int g4 = memory_order_consume;
+int g5 = memory_order_acq_rel;
+int g6 = memory_order_release;
+int *ptr;
+
+void f(int p) {
+  _Atomic int l1;
+  atomic_flag l2;
+
+  // Directly specified values:
+  atomic_load_explicit(&l1, memory_order_seq_cst); // COMPLIANT
+  atomic_load_explicit(&l1, memory_order_relaxed); // NON-COMPLIANT
+  atomic_load_explicit(&l1, memory_order_acquire); // NON-COMPLIANT
+  atomic_load_explicit(&l1, memory_order_consume); // NON-COMPLIANT
+  atomic_load_explicit(&l1, memory_order_acq_rel); // NON-COMPLIANT
+  atomic_load_explicit(&l1, memory_order_release); // NON-COMPLIANT
+
+  // Implicit values:
+  atomic_store(&l1, 0);                        // COMPLIANT
+  atomic_load(&l1);                            // COMPLIANT
+  atomic_flag_test_and_set(&l2);               // COMPLIANT
+  atomic_flag_clear(&l2);                      // COMPLIANT
+  atomic_exchange(&l1, 0);                     // COMPLIANT
+  atomic_compare_exchange_strong(&l1, ptr, 1); // COMPLIANT
+  atomic_compare_exchange_weak(&l1, ptr, 1);   // COMPLIANT
+  atomic_fetch_add(&l1, 0);                    // COMPLIANT
+  atomic_fetch_sub(&l1, 0);                    // COMPLIANT
+  atomic_fetch_or(&l1, 0);                     // COMPLIANT
+  atomic_fetch_xor(&l1, 0);                    // COMPLIANT
+  atomic_fetch_and(&l1, 0);                    // COMPLIANT
+
+  // Compliant flowed values (one test per sink):
+  atomic_store_explicit(&l1, 0, g1);                            // COMPLIANT
+  atomic_load_explicit(&l1, g1);                                // COMPLIANT
+  atomic_flag_test_and_set_explicit(&l2, g1);                   // COMPLIANT
+  atomic_flag_clear_explicit(&l2, g1);                          // COMPLIANT
+  atomic_exchange_explicit(&l1, 0, g1);                         // COMPLIANT
+  atomic_compare_exchange_strong_explicit(&l1, ptr, 1, g1, g1); // COMPLIANT
+  atomic_compare_exchange_weak_explicit(&l1, ptr, 1, g1, g1);   // COMPLIANT
+  atomic_fetch_add_explicit(&l1, 0, g1);                        // COMPLIANT
+  atomic_fetch_sub_explicit(&l1, 0, g1);                        // COMPLIANT
+  atomic_fetch_or_explicit(&l1, 0, g1);                         // COMPLIANT
+  atomic_fetch_xor_explicit(&l1, 0, g1);                        // COMPLIANT
+  atomic_fetch_and_explicit(&l1, 0, g1);                        // COMPLIANT
+  atomic_thread_fence(g1);                                      // COMPLIANT
+  atomic_signal_fence(g1);                                      // COMPLIANT
+
+  // Non-compliant flowed values (one test per sink):
+  atomic_store_explicit(&l1, 0, g2);                            // NON-COMPLIANT
+  atomic_load_explicit(&l1, g2);                                // NON-COMPLIANT
+  atomic_flag_test_and_set_explicit(&l2, g2);                   // NON-COMPLIANT
+  atomic_flag_clear_explicit(&l2, g2);                          // NON-COMPLIANT
+  atomic_exchange_explicit(&l1, 0, g2);                         // NON-COMPLIANT
+  atomic_compare_exchange_strong_explicit(&l1, ptr, 1, g2, g1); // NON-COMPLIANT
+  atomic_compare_exchange_strong_explicit(&l1, ptr, 1, g1, g2); // NON-COMPLIANT
+  atomic_compare_exchange_weak_explicit(&l1, ptr, 1, g2, g1);   // NON-COMPLIANT
+  atomic_compare_exchange_weak_explicit(&l1, ptr, 1, g1, g2);   // NON-COMPLIANT
+  atomic_fetch_add_explicit(&l1, 0, g2);                        // NON-COMPLIANT
+  atomic_fetch_sub_explicit(&l1, 0, g2);                        // NON-COMPLIANT
+  atomic_fetch_or_explicit(&l1, 0, g2);                         // NON-COMPLIANT
+  atomic_fetch_xor_explicit(&l1, 0, g2);                        // NON-COMPLIANT
+  atomic_fetch_and_explicit(&l1, 0, g2);                        // NON-COMPLIANT
+  atomic_thread_fence(g2);                                      // NON-COMPLIANT
+  atomic_signal_fence(g2);                                      // NON-COMPLIANT
+
+  // Non-compliant flowed values (one test per source):
+  atomic_thread_fence(g2); // NON-COMPLIANT
+  atomic_thread_fence(g3); // NON-COMPLIANT
+  atomic_thread_fence(g4); // NON-COMPLIANT
+  atomic_thread_fence(g5); // NON-COMPLIANT
+  atomic_thread_fence(g6); // NON-COMPLIANT
+
+  // Computed flow sources:
+  atomic_thread_fence(memory_order_seq_cst * 1); // COMPLIANT
+  atomic_thread_fence(1);                        // NON-COMPLIANT
+  atomic_thread_fence(100);                      // NON-COMPLIANT
+  atomic_thread_fence(g1 + 1); // NON_COMPLIANT[FALSE_NEGATIVE]
+
+  // No unsafe flow, currently accepted:
+  atomic_thread_fence(p); // COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-26/TimedlockOnInappropriateMutexType.expected b/c/misra/test/rules/RULE-21-26/TimedlockOnInappropriateMutexType.expected
new file mode 100644
index 0000000000..0a4c0a496a
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-26/TimedlockOnInappropriateMutexType.expected
@@ -0,0 +1,45 @@
+edges
+| test.c:10:24:10:24 | *m | test.c:10:43:10:43 | *m | provenance |  |
+| test.c:13:12:13:14 | mtx_init output argument | test.c:14:17:14:19 | *& ... | provenance |  |
+| test.c:13:12:13:14 | mtx_init output argument | test.c:15:14:15:16 | *& ... | provenance |  |
+| test.c:15:14:15:16 | *& ... | test.c:10:24:10:24 | *m | provenance |  |
+| test.c:17:12:17:14 | mtx_init output argument | test.c:18:17:18:19 | *& ... | provenance |  |
+| test.c:17:12:17:14 | mtx_init output argument | test.c:19:14:19:16 | *& ... | provenance |  |
+| test.c:19:14:19:16 | *& ... | test.c:10:24:10:24 | *m | provenance |  |
+| test.c:30:12:30:14 | mtx_init output argument | test.c:31:17:31:19 | *& ... | provenance |  |
+| test.c:30:12:30:14 | mtx_init output argument | test.c:32:14:32:16 | *& ... | provenance |  |
+| test.c:32:14:32:16 | *& ... | test.c:10:24:10:24 | *m | provenance |  |
+| test.c:42:12:42:16 | mtx_init output argument | test.c:42:13:42:14 | *l3 [post update] [m] | provenance |  |
+| test.c:42:13:42:14 | *l3 [post update] [m] | test.c:43:18:43:19 | *l3 [m] | provenance |  |
+| test.c:42:13:42:14 | *l3 [post update] [m] | test.c:44:15:44:16 | *l3 [m] | provenance |  |
+| test.c:43:18:43:19 | *l3 [m] | test.c:43:17:43:21 | *& ... | provenance |  |
+| test.c:44:14:44:18 | *& ... | test.c:10:24:10:24 | *m | provenance |  |
+| test.c:44:15:44:16 | *l3 [m] | test.c:44:14:44:18 | *& ... | provenance |  |
+nodes
+| test.c:10:24:10:24 | *m | semmle.label | *m |
+| test.c:10:43:10:43 | *m | semmle.label | *m |
+| test.c:13:12:13:14 | mtx_init output argument | semmle.label | mtx_init output argument |
+| test.c:14:17:14:19 | *& ... | semmle.label | *& ... |
+| test.c:15:14:15:16 | *& ... | semmle.label | *& ... |
+| test.c:17:12:17:14 | mtx_init output argument | semmle.label | mtx_init output argument |
+| test.c:18:17:18:19 | *& ... | semmle.label | *& ... |
+| test.c:19:14:19:16 | *& ... | semmle.label | *& ... |
+| test.c:30:12:30:14 | mtx_init output argument | semmle.label | mtx_init output argument |
+| test.c:31:17:31:19 | *& ... | semmle.label | *& ... |
+| test.c:32:14:32:16 | *& ... | semmle.label | *& ... |
+| test.c:42:12:42:16 | mtx_init output argument | semmle.label | mtx_init output argument |
+| test.c:42:13:42:14 | *l3 [post update] [m] | semmle.label | *l3 [post update] [m] |
+| test.c:43:17:43:21 | *& ... | semmle.label | *& ... |
+| test.c:43:18:43:19 | *l3 [m] | semmle.label | *l3 [m] |
+| test.c:44:14:44:18 | *& ... | semmle.label | *& ... |
+| test.c:44:15:44:16 | *l3 [m] | semmle.label | *l3 [m] |
+subpaths
+#select
+| test.c:10:43:10:43 | *m | test.c:13:12:13:14 | mtx_init output argument | test.c:10:43:10:43 | *m | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:13:12:13:14 | mtx_init output argument | initialized |
+| test.c:10:43:10:43 | *m | test.c:17:12:17:14 | mtx_init output argument | test.c:10:43:10:43 | *m | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:17:12:17:14 | mtx_init output argument | initialized |
+| test.c:10:43:10:43 | *m | test.c:30:12:30:14 | mtx_init output argument | test.c:10:43:10:43 | *m | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:30:12:30:14 | mtx_init output argument | initialized |
+| test.c:10:43:10:43 | *m | test.c:42:12:42:16 | mtx_init output argument | test.c:10:43:10:43 | *m | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:42:12:42:16 | mtx_init output argument | initialized |
+| test.c:14:17:14:19 | *& ... | test.c:13:12:13:14 | mtx_init output argument | test.c:14:17:14:19 | *& ... | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:13:12:13:14 | mtx_init output argument | initialized |
+| test.c:18:17:18:19 | *& ... | test.c:17:12:17:14 | mtx_init output argument | test.c:18:17:18:19 | *& ... | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:17:12:17:14 | mtx_init output argument | initialized |
+| test.c:31:17:31:19 | *& ... | test.c:30:12:30:14 | mtx_init output argument | test.c:31:17:31:19 | *& ... | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:30:12:30:14 | mtx_init output argument | initialized |
+| test.c:43:17:43:21 | *& ... | test.c:42:12:42:16 | mtx_init output argument | test.c:43:17:43:21 | *& ... | Call to mtx_timedlock with mutex which is $@ without flag 'mtx_timed'. | test.c:42:12:42:16 | mtx_init output argument | initialized |
diff --git a/c/misra/test/rules/RULE-21-26/TimedlockOnInappropriateMutexType.qlref b/c/misra/test/rules/RULE-21-26/TimedlockOnInappropriateMutexType.qlref
new file mode 100644
index 0000000000..9ffe7e7494
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-26/TimedlockOnInappropriateMutexType.qlref
@@ -0,0 +1 @@
+rules/RULE-21-26/TimedlockOnInappropriateMutexType.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-26/test.c b/c/misra/test/rules/RULE-21-26/test.c
new file mode 100644
index 0000000000..b08f7e54a1
--- /dev/null
+++ b/c/misra/test/rules/RULE-21-26/test.c
@@ -0,0 +1,45 @@
+#include "threads.h"
+
+mtx_t g1;
+mtx_t g2;
+mtx_t g3;
+mtx_t g4;
+
+struct timespec ts = {0, 0};
+
+void doTimeLock(mtx_t *m) { mtx_timedlock(m, &ts); }
+
+int main(int argc, char *argv[]) {
+  mtx_init(&g1, mtx_plain);
+  mtx_timedlock(&g1, &ts); // NON-COMPLIANT
+  doTimeLock(&g1);         // NON-COMPLIANT
+
+  mtx_init(&g2, mtx_plain | mtx_recursive);
+  mtx_timedlock(&g2, &ts); // NON-COMPLIANT
+  doTimeLock(&g2);         // NON-COMPLIANT
+
+  mtx_init(&g3, mtx_timed);
+  mtx_timedlock(&g3, &ts); // COMPLIANT
+  doTimeLock(&g3);         // COMPLIANT
+
+  mtx_init(&g4, mtx_timed | mtx_recursive);
+  mtx_timedlock(&g4, &ts); // COMPLIANT
+  doTimeLock(&g4);         // COMPLIANT
+
+  mtx_t l1;
+  mtx_init(&l1, mtx_plain);
+  mtx_timedlock(&l1, &ts); // NON-COMPLIANT
+  doTimeLock(&l1);         // NON-COMPLIANT
+
+  mtx_t l2;
+  mtx_init(&l2, mtx_timed);
+  mtx_timedlock(&l2, &ts); // COMPLIANT
+  doTimeLock(&l2);         // COMPLIANT
+
+  struct s {
+    mtx_t m;
+  } l3;
+  mtx_init(&l3.m, mtx_plain);
+  mtx_timedlock(&l3.m, &ts); // NON-COMPLIANT
+  doTimeLock(&l3.m);         // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-11/ThreadPreviouslyJoinedOrDetached.testref b/c/misra/test/rules/RULE-22-11/ThreadPreviouslyJoinedOrDetached.testref
new file mode 100644
index 0000000000..61fa88fd08
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-11/ThreadPreviouslyJoinedOrDetached.testref
@@ -0,0 +1 @@
+c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-11/ThreadWasPreviouslyJoinedOrDetached.testref b/c/misra/test/rules/RULE-22-11/ThreadWasPreviouslyJoinedOrDetached.testref
new file mode 100644
index 0000000000..61fa88fd08
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-11/ThreadWasPreviouslyJoinedOrDetached.testref
@@ -0,0 +1 @@
+c/common/test/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-12/NonstandardUseOfThreadingObject.expected b/c/misra/test/rules/RULE-22-12/NonstandardUseOfThreadingObject.expected
new file mode 100644
index 0000000000..62a740f960
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-12/NonstandardUseOfThreadingObject.expected
@@ -0,0 +1,27 @@
+| test.c:37:3:37:7 | mutex | Invalid usage of standard thread object type 'mtx_t'. |
+| test.c:37:11:37:21 | * ... | Invalid usage of standard thread object type 'mtx_t'. |
+| test.c:38:3:38:8 | thread | Invalid usage of standard thread object type 'thrd_t'. |
+| test.c:38:12:38:23 | * ... | Invalid usage of standard thread object type 'thrd_t'. |
+| test.c:39:3:39:13 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:39:17:39:27 | * ... | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:40:3:40:11 | condition | Invalid usage of standard thread object type 'cnd_t'. |
+| test.c:40:15:40:25 | * ... | Invalid usage of standard thread object type 'cnd_t'. |
+| test.c:43:10:43:15 | & ... | Invalid usage of standard thread object type 'mtx_t *'. |
+| test.c:44:10:44:16 | & ... | Invalid usage of standard thread object type 'thrd_t *'. |
+| test.c:45:10:45:21 | & ... | Invalid usage of standard thread object type 'tss_t *'. |
+| test.c:46:10:46:19 | & ... | Invalid usage of standard thread object type 'cnd_t *'. |
+| test.c:48:3:48:13 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:49:3:49:13 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:50:3:50:13 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:54:3:54:8 | thread | Invalid usage of standard thread object type 'thrd_t'. |
+| test.c:54:13:54:18 | thread | Invalid usage of standard thread object type 'thrd_t'. |
+| test.c:55:3:55:8 | thread | Invalid usage of standard thread object type 'thrd_t'. |
+| test.c:55:13:55:18 | thread | Invalid usage of standard thread object type 'thrd_t'. |
+| test.c:56:3:56:13 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:56:18:56:28 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:57:3:57:13 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:57:18:57:28 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:61:14:61:18 | mutex | Invalid usage of standard thread object type 'mtx_t'. |
+| test.c:62:15:62:20 | thread | Invalid usage of standard thread object type 'thrd_t'. |
+| test.c:63:20:63:30 | threadlocal | Invalid usage of standard thread object type 'tss_t'. |
+| test.c:64:18:64:26 | condition | Invalid usage of standard thread object type 'cnd_t'. |
diff --git a/c/misra/test/rules/RULE-22-12/NonstandardUseOfThreadingObject.qlref b/c/misra/test/rules/RULE-22-12/NonstandardUseOfThreadingObject.qlref
new file mode 100644
index 0000000000..d1d345420d
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-12/NonstandardUseOfThreadingObject.qlref
@@ -0,0 +1 @@
+rules/RULE-22-12/NonstandardUseOfThreadingObject.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-12/test.c b/c/misra/test/rules/RULE-22-12/test.c
new file mode 100644
index 0000000000..1c59c43d8c
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-12/test.c
@@ -0,0 +1,65 @@
+#include "string.h"
+#include "threads.h"
+
+mtx_t mutex;
+thrd_t thread;
+tss_t threadlocal;
+cnd_t condition;
+
+extern void use_mutex(mtx_t *m);
+extern void use_thread(thrd_t *t);
+extern void use_threadlocal(tss_t *t);
+extern void use_condition(cnd_t *c);
+
+void valid_usages(void) {
+  mtx_init(&mutex, mtx_plain);      // COMPLIANT
+  mtx_lock(&mutex);                 // COMPLIANT
+  mtx_unlock(&mutex);               // COMPLIANT
+  thrd_create(&thread, NULL, NULL); // COMPLIANT
+  tss_create(&threadlocal, NULL);   // COMPLIANT
+  tss_set(threadlocal, NULL);       // COMPLIANT
+  cnd_init(&condition);             // COMPLIANT
+  cnd_signal(&condition);           // COMPLIANT
+  cnd_wait(&condition, &mutex);     // COMPLIANT
+
+  use_mutex(&mutex);             // COMPLIANT
+  use_thread(&thread);           // COMPLIANT
+  use_threadlocal(&threadlocal); // COMPLIANT
+  use_condition(&condition);     // COMPLIANT
+}
+
+extern void copy_mutex(mtx_t m);
+extern void copy_thread(thrd_t t);
+extern void copy_threadlocal(tss_t t);
+extern void copy_condition(cnd_t t);
+
+void invalid_usages(void) {
+  mutex = *(mtx_t *)0;       // NON-COMPLIANT
+  thread = *(thrd_t *)0;     // NON-COMPLIANT
+  threadlocal = *(tss_t *)0; // NON-COMPLIANT
+  condition = *(cnd_t *)0;   // NON-COMPLIANT
+
+  int *buf;
+  memcpy(&mutex, buf, sizeof(mtx_t));       // NON-COMPLIANT
+  memcpy(&thread, buf, sizeof(thrd_t));     // NON-COMPLIANT
+  memcpy(&threadlocal, buf, sizeof(tss_t)); // NON-COMPLIANT
+  memcpy(&condition, buf, sizeof(cnd_t));   // NON-COMPLIANT
+
+  threadlocal++;    // NON-COMPLIANT
+  threadlocal += 1; // NON-COMPLIANT
+  threadlocal + 1;  // NON-COMPLIANT
+
+  // mutex == mutex; // NON-COMPLIANT
+  // mutex != mutex; // NON-COMPLIANT
+  thread == thread;           // NON-COMPLIANT
+  thread != thread;           // NON-COMPLIANT
+  threadlocal == threadlocal; // NON-COMPLIANT
+  threadlocal != threadlocal; // NON-COMPLIANT
+  // condition == condition;     // NON-COMPLIANT
+  // condition != condition;     // NON-COMPLIANT
+
+  copy_mutex(mutex);             // COMPLIANT
+  copy_thread(thread);           // COMPLIANT
+  copy_threadlocal(threadlocal); // COMPLIANT
+  copy_condition(condition);     // COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.expected b/c/misra/test/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.expected
new file mode 100644
index 0000000000..0fe033366d
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.expected
@@ -0,0 +1,13 @@
+| test.c:14:21:14:22 | g9 | Object of type 'mtx_t' has invalid storage duration type 'thread'. |
+| test.c:15:22:15:24 | g10 | Object of type 'thrd_t' has invalid storage duration type 'thread'. |
+| test.c:16:21:16:23 | g11 | Object of type 'tss_t' has invalid storage duration type 'thread'. |
+| test.c:17:21:17:23 | g12 | Object of type 'cnd_t' has invalid storage duration type 'thread'. |
+| test.c:34:9:34:10 | l1 | Object of type 'mtx_t' has invalid storage duration type 'automatic'. |
+| test.c:35:10:35:11 | l2 | Object of type 'thrd_t' has invalid storage duration type 'automatic'. |
+| test.c:36:9:36:10 | l3 | Object of type 'tss_t' has invalid storage duration type 'automatic'. |
+| test.c:37:9:37:10 | l4 | Object of type 'cnd_t' has invalid storage duration type 'automatic'. |
+| test.c:44:9:44:10 | l9 | Object of type 'mtx_t[10]' has invalid storage duration type 'automatic'. |
+| test.c:46:13:46:15 | l11 | Object of type 'has_mtx_t' has invalid storage duration type 'automatic'. |
+| test.c:48:13:48:15 | l13 | Object of type 'has_mtx_t[10]' has invalid storage duration type 'automatic'. |
+| test.c:51:9:51:14 | call to malloc | Object of type 'mtx_t' has invalid storage duration type 'allocated'. |
+| test.c:52:9:52:14 | call to malloc | Object of type 'mtx_t' has invalid storage duration type 'allocated'. |
diff --git a/c/misra/test/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.qlref b/c/misra/test/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.qlref
new file mode 100644
index 0000000000..9c054fc623
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.qlref
@@ -0,0 +1 @@
+rules/RULE-22-13/ThreadingObjectWithInvalidStorageDuration.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-13/test.c b/c/misra/test/rules/RULE-22-13/test.c
new file mode 100644
index 0000000000..193f4be471
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-13/test.c
@@ -0,0 +1,53 @@
+#include "stdlib.h"
+#include "threads.h"
+
+mtx_t g1;  // COMPLIANT
+thrd_t g2; // COMPLIANT
+tss_t g3;  // COMPLIANT
+cnd_t g4;  // COMPLIANT
+
+static mtx_t g5;  // COMPLIANT
+static thrd_t g6; // COMPLIANT
+static tss_t g7;  // COMPLIANT
+static cnd_t g8;  // COMPLIANT
+
+_Thread_local mtx_t g9;   // NON-COMPLIANT
+_Thread_local thrd_t g10; // NON-COMPLIANT
+_Thread_local tss_t g11;  // NON-COMPLIANT
+_Thread_local cnd_t g12;  // NON-COMPLIANT
+
+typedef struct {
+  mtx_t m;
+} has_mtx_t;
+
+typedef struct {
+  mtx_t *m;
+} has_ptr_mtx_t;
+
+mtx_t g13[10];     // COMPLIANT
+mtx_t *g14;        // COMPLIANT
+has_mtx_t g15;     // COMPLIANT
+has_ptr_mtx_t g16; // COMPLIANT
+has_mtx_t g17[10]; // COMPLIANT
+
+void f1(void) {
+  mtx_t l1;  // NON-COMPLIANT
+  thrd_t l2; // NON-COMPLIANT
+  tss_t l3;  // NON-COMPLIANT
+  cnd_t l4;  // NON-COMPLIANT
+
+  static mtx_t l5;  // COMPLIANT
+  static thrd_t l6; // COMPLIANT
+  static tss_t l7;  // COMPLIANT
+  static cnd_t l8;  // COMPLIANT
+
+  mtx_t l9[10];      // NON-COMPLIANT
+  mtx_t *l10;        // COMPLIANT
+  has_mtx_t l11;     // NON-COMPLIANT
+  has_ptr_mtx_t l12; // COMPLIANT
+  has_mtx_t l13[10]; // NON-COMPLIANT
+
+  l10 = &g1;                       // COMPLIANT
+  l10 = malloc(sizeof(mtx_t));     // NON-COMPLIANT
+  l10 = malloc(sizeof(mtx_t) * 4); // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-14/MutexInitWithInvalidMutexType.expected b/c/misra/test/rules/RULE-22-14/MutexInitWithInvalidMutexType.expected
new file mode 100644
index 0000000000..1ea39b6b1d
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-14/MutexInitWithInvalidMutexType.expected
@@ -0,0 +1,5 @@
+| test.c:140:3:140:10 | call to mtx_init | Mutex initialized with incorrect type expression. |
+| test.c:141:3:141:10 | call to mtx_init | Mutex initialized with incorrect type expression. |
+| test.c:142:3:142:10 | call to mtx_init | Mutex initialized with incorrect type expression. |
+| test.c:144:3:144:10 | call to mtx_init | Mutex initialized with incorrect type expression. |
+| test.c:145:3:145:10 | call to mtx_init | Mutex initialized with incorrect type expression. |
diff --git a/c/misra/test/rules/RULE-22-14/MutexInitWithInvalidMutexType.qlref b/c/misra/test/rules/RULE-22-14/MutexInitWithInvalidMutexType.qlref
new file mode 100644
index 0000000000..32b57cfd07
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-14/MutexInitWithInvalidMutexType.qlref
@@ -0,0 +1 @@
+rules/RULE-22-14/MutexInitWithInvalidMutexType.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-14/MutexInitializedInsideThread.expected b/c/misra/test/rules/RULE-22-14/MutexInitializedInsideThread.expected
new file mode 100644
index 0000000000..360c02f622
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-14/MutexInitializedInsideThread.expected
@@ -0,0 +1 @@
+| test.c:110:3:110:10 | call to mtx_init | Mutex initialization reachable from threaded function '$@'. | test.c:105:6:105:32 | from_root7_use_thread_local | from_root7_use_thread_local |
diff --git a/c/misra/test/rules/RULE-22-14/MutexInitializedInsideThread.qlref b/c/misra/test/rules/RULE-22-14/MutexInitializedInsideThread.qlref
new file mode 100644
index 0000000000..83ada06139
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-14/MutexInitializedInsideThread.qlref
@@ -0,0 +1 @@
+rules/RULE-22-14/MutexInitializedInsideThread.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-14/MutexNotInitializedBeforeUse.expected b/c/misra/test/rules/RULE-22-14/MutexNotInitializedBeforeUse.expected
new file mode 100644
index 0000000000..b9560165ce
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-14/MutexNotInitializedBeforeUse.expected
@@ -0,0 +1,14 @@
+| test.c:6:12:6:14 | & ... | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:5:9:5:10 | l1 | l1 | test.c:4:6:4:19 | use_local_mtxs | use_local_mtxs |
+| test.c:13:12:13:16 | & ... | Mutex in object '$@' possibly used before initialization, from entry point function '$@'. | test.c:12:5:12:6 | l2 | l2 | test.c:4:6:4:19 | use_local_mtxs | use_local_mtxs |
+| test.c:18:12:18:17 | & ... | Mutex in object '$@' possibly used before initialization, from entry point function '$@'. | test.c:17:9:17:10 | l3 | l3 | test.c:4:6:4:19 | use_local_mtxs | use_local_mtxs |
+| test.c:23:12:23:13 | l4 | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:22:15:22:20 | call to malloc | call to malloc | test.c:28:6:28:31 | root1_calls_use_local_mtxs | root1_calls_use_local_mtxs |
+| test.c:41:12:41:14 | & ... | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:34:7:34:8 | g1 | g1 | test.c:40:6:40:30 | root2_uses_global_mutexes | root2_uses_global_mutexes |
+| test.c:42:12:42:17 | & ... | Mutex in object '$@' possibly used before initialization, from entry point function '$@'. | test.c:37:3:37:4 | g2 | g2 | test.c:40:6:40:30 | root2_uses_global_mutexes | root2_uses_global_mutexes |
+| test.c:43:12:43:13 | g3 | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:56:8:56:13 | call to malloc | call to malloc | test.c:40:6:40:30 | root2_uses_global_mutexes | root2_uses_global_mutexes |
+| test.c:64:12:64:14 | & ... | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:34:7:34:8 | g1 | g1 | test.c:67:6:67:45 | root4_call_thread_without_initialization | root4_call_thread_without_initialization |
+| test.c:88:12:88:14 | & ... | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:87:9:87:10 | l1 | l1 | test.c:86:6:86:36 | island1_use_uninitialized_mutex | island1_use_uninitialized_mutex |
+| test.c:100:12:100:14 | & ... | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:98:21:98:22 | g5 | g5 | test.c:99:6:99:27 | root6_use_thread_local | root6_use_thread_local |
+| test.c:107:12:107:14 | & ... | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:98:21:98:22 | g5 | g5 | test.c:105:6:105:32 | from_root7_use_thread_local | from_root7_use_thread_local |
+| test.c:124:12:124:13 | & ... | Condition '$@' possibly used before initialization, from entry point function '$@'. | test.c:122:9:122:9 | c | c | test.c:121:6:121:28 | root8_uninitialized_cnd | root8_uninitialized_cnd |
+| test.c:124:16:124:17 | & ... | Mutex '$@' possibly used before initialization, from entry point function '$@'. | test.c:123:9:123:9 | m | m | test.c:121:6:121:28 | root8_uninitialized_cnd | root8_uninitialized_cnd |
+| test.c:127:12:127:13 | & ... | Condition '$@' possibly used before initialization, from entry point function '$@'. | test.c:122:9:122:9 | c | c | test.c:121:6:121:28 | root8_uninitialized_cnd | root8_uninitialized_cnd |
diff --git a/c/misra/test/rules/RULE-22-14/MutexNotInitializedBeforeUse.qlref b/c/misra/test/rules/RULE-22-14/MutexNotInitializedBeforeUse.qlref
new file mode 100644
index 0000000000..2827a9c571
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-14/MutexNotInitializedBeforeUse.qlref
@@ -0,0 +1 @@
+rules/RULE-22-14/MutexNotInitializedBeforeUse.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-14/test.c b/c/misra/test/rules/RULE-22-14/test.c
new file mode 100644
index 0000000000..c664a08dc3
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-14/test.c
@@ -0,0 +1,158 @@
+#include "stdlib.h"
+#include "threads.h"
+
+void use_local_mtxs(int x, int y) {
+  mtx_t l1;
+  mtx_lock(&l1); // NON-COMPLIANT
+  mtx_init(&l1, mtx_plain);
+  mtx_lock(&l1); // COMPLIANT
+
+  struct {
+    mtx_t m;
+  } l2;
+  mtx_lock(&l2.m); // NON-COMPLIANT
+  mtx_init(&l2.m, mtx_plain);
+  mtx_lock(&l2.m); // COMPLIANT
+
+  mtx_t l3[10];
+  mtx_lock(&l3[y]); // NON-COMPLIANT
+  mtx_init(&l3[x], mtx_plain);
+  mtx_lock(&l3[y]); // COMPLIANT
+
+  mtx_t *l4 = malloc(sizeof(mtx_t));
+  mtx_lock(l4); // NON-COMPLIANT
+  mtx_init(l4, mtx_plain);
+  mtx_lock(l4); // COMPLIANT
+}
+
+void root1_calls_use_local_mtxs() {
+  // Since a function exists which calls use_local_mtxs(), that function is not
+  // a root function. The query should still report unused locals in this case.
+  use_local_mtxs(1, 2);
+}
+
+mtx_t g1;
+struct {
+  mtx_t m1;
+} g2;
+mtx_t *g3;
+
+void root2_uses_global_mutexes() {
+  mtx_lock(&g1);    // NON-COMPLIANT
+  mtx_lock(&g2.m1); // NON-COMPLIANT
+  mtx_lock(g3);     // NON-COMPLIANT
+}
+
+void from_root3_use_global_mutexes() {
+  mtx_lock(&g1);    // COMPLIANT
+  mtx_lock(&g2.m1); // COMPLIANT
+  mtx_lock(g3);     // COMPLIANT
+}
+
+void root3_initializes_and_uses_global_mutexes() {
+  // Init global mutex with an allocated storage duration object. The existence
+  // of this malloc() is not checked by the query, but if its exists, the object
+  // and its uses should be trackable as a nice bonus.
+  g3 = malloc(sizeof(mtx_t));
+  mtx_init(&g1, mtx_plain);
+  mtx_init(&g2.m1, mtx_plain);
+  mtx_init(g3, mtx_plain);
+  from_root3_use_global_mutexes();
+}
+
+void from_root4_use_global_mutex(void *arg) {
+  mtx_lock(&g1); // NON-COMPLIANT
+}
+
+void root4_call_thread_without_initialization() {
+  thrd_t t;
+  thrd_create(&t, &from_root4_use_global_mutex, NULL);
+}
+
+void from_root5_use_global_mutex(void *arg) {
+  mtx_lock(&g1); // COMPLIANT
+}
+
+void root5_thread_with_initialization() {
+  mtx_init(&g1, mtx_plain);
+  thrd_t t;
+  thrd_create(&t, &from_root5_use_global_mutex, NULL);
+}
+
+// Set up two functions such that a calls b and b calls a. This means there is
+// no root function, but we should still report unused locals.
+void island2_call_island1();
+
+void island1_use_uninitialized_mutex() {
+  mtx_t l1;
+  mtx_lock(&l1); // NON-COMPLIANT
+
+  // Globals are hard to detect
+  mtx_lock(&g1); // NON-COMPLIANT[False negative]
+
+  island2_call_island1();
+}
+
+void island2_call_island1() { island1_use_uninitialized_mutex(); }
+
+_Thread_local mtx_t g5;
+void root6_use_thread_local() {
+  mtx_lock(&g5); // NON-COMPLIANT
+  mtx_init(&g5, mtx_plain);
+  mtx_lock(&g5); // COMPLIANT
+}
+
+void from_root7_use_thread_local() {
+  // Invalid, thread local g5 hasn't been initialized in this thread.
+  mtx_lock(&g5); // NON-COMPLIANT
+
+  // Violates recommendation, mutexes initialized within a thread.
+  mtx_init(&g5, mtx_plain); // NON-COMPLIANT
+
+  // Valid if we except the above initialization.
+  mtx_lock(&g5); // COMPLIANT
+}
+
+void root7_spawn_thread_uninitialized_thread_local() {
+  thrd_t t;
+  thrd_create(&t, &from_root7_use_thread_local, NULL);
+}
+
+void root8_uninitialized_cnd() {
+  cnd_t c;
+  mtx_t m;
+  cnd_wait(&c, &m); // NON-COMPLIANT
+
+  mtx_init(&m, mtx_plain);
+  cnd_wait(&c, &m); // NON-COMPLIANT
+
+  cnd_init(&c);
+  cnd_wait(&c, &m); // COMPLIANT
+}
+
+void invalid_mtx_init_types() {
+  mtx_t m;
+  mtx_init(&m, mtx_plain);                 // COMPLIANT
+  mtx_init(&m, mtx_plain | mtx_recursive); // COMPLIANT
+  mtx_init(&m, mtx_timed);                 // COMPLIANT
+  mtx_init(&m, mtx_timed | mtx_recursive); // COMPLIANT
+
+  mtx_init(&m, mtx_recursive);             // NON-COMPLIANT
+  mtx_init(&m, mtx_plain | mtx_timed);     // NON-COMPLIANT
+  mtx_init(&m, mtx_plain | mtx_plain);     // NON-COMPLIANT
+  mtx_init(&m, mtx_plain & mtx_recursive); // NON-COMPLIANT
+  mtx_init(&m, mtx_plain * mtx_recursive); // NON-COMPLIANT
+  mtx_init(&m, -1);                        // NON-COMPLIANT
+}
+
+void function_pointer_uses_global_mutexes() {
+  // If the function has been used as a function pointer, we don't attempt to
+  // analyze this.
+  mtx_lock(&g1);    // COMPLIANT
+  mtx_lock(&g2.m1); // COMPLIANT
+  mtx_lock(g3);     // COMPLIANT
+}
+
+void take_function_pointer() {
+  void (*f)(void) = function_pointer_uses_global_mutexes;
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.expected b/c/misra/test/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.expected
new file mode 100644
index 0000000000..49f1b74c15
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.expected
@@ -0,0 +1,12 @@
+| test.c:16:3:16:13 | call to mtx_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:3:7:3:8 | g1 | g1 | test.c:64:3:64:13 | call to thrd_create | t2_use_all |
+| test.c:16:3:16:13 | call to mtx_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:3:7:3:8 | g1 | g1 | test.c:72:3:72:13 | call to thrd_create | t2_use_all |
+| test.c:16:3:16:13 | call to mtx_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:3:7:3:8 | g1 | g1 | test.c:91:3:91:10 | call to mtx_lock | main thread |
+| test.c:17:3:17:12 | call to tss_delete | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:4:7:4:8 | g2 | g2 | test.c:64:3:64:13 | call to thrd_create | t2_use_all |
+| test.c:17:3:17:12 | call to tss_delete | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:4:7:4:8 | g2 | g2 | test.c:72:3:72:13 | call to thrd_create | t2_use_all |
+| test.c:17:3:17:12 | call to tss_delete | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:4:7:4:8 | g2 | g2 | test.c:92:3:92:9 | call to tss_get | main thread |
+| test.c:18:3:18:13 | call to cnd_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:5:7:5:8 | g3 | g3 | test.c:64:3:64:13 | call to thrd_create | t2_use_all |
+| test.c:18:3:18:13 | call to cnd_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:5:7:5:8 | g3 | g3 | test.c:72:3:72:13 | call to thrd_create | t2_use_all |
+| test.c:18:3:18:13 | call to cnd_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:5:7:5:8 | g3 | g3 | test.c:93:3:93:10 | call to cnd_wait | main thread |
+| test.c:42:3:42:13 | call to mtx_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:3:7:3:8 | g1 | g1 | test.c:41:3:41:13 | call to thrd_create | t2_use_all |
+| test.c:43:3:43:12 | call to tss_delete | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:4:7:4:8 | g2 | g2 | test.c:41:3:41:13 | call to thrd_create | t2_use_all |
+| test.c:44:3:44:13 | call to cnd_destroy | Thread resource $@ disposed before joining thread $@ which uses it. | test.c:5:7:5:8 | g3 | g3 | test.c:41:3:41:13 | call to thrd_create | t2_use_all |
diff --git a/c/misra/test/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.qlref b/c/misra/test/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.qlref
new file mode 100644
index 0000000000..809eae6faf
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.qlref
@@ -0,0 +1 @@
+rules/RULE-22-15/ThreadResourceDisposedBeforeThreadsJoined.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-15/test.c b/c/misra/test/rules/RULE-22-15/test.c
new file mode 100644
index 0000000000..7679730fc9
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-15/test.c
@@ -0,0 +1,113 @@
+#include "threads.h"
+
+mtx_t g1;
+tss_t g2;
+cnd_t g3;
+
+int t1_use_none(void *p) { return 0; }
+
+int t2_use_all(void *p) {
+  mtx_lock(&g1);
+  tss_get(&g2);
+  cnd_wait(&g3, &g1);
+}
+
+int t3_dispose_all(void *p) {
+  mtx_destroy(&g1);
+  tss_delete(&g2);
+  cnd_destroy(&g3);
+}
+
+int t4_use_then_dispose(void *p) {
+  mtx_lock(&g1);
+  tss_get(&g2);
+  cnd_wait(&g3, &g1);
+
+  mtx_destroy(&g1);
+  tss_delete(&g2);
+  cnd_destroy(&g3);
+}
+
+void f1() {
+  thrd_t t;
+  thrd_create(&t, t1_use_none, NULL);
+  mtx_destroy(&g1);
+  tss_delete(&g2);
+  cnd_destroy(&g3);
+}
+
+void f2() {
+  thrd_t t;
+  thrd_create(&t, t2_use_all, NULL);
+  mtx_destroy(&g1); // NON-COMPLIANT
+  tss_delete(&g2);  // NON-COMPLIANT
+  cnd_destroy(&g3); // NON-COMPLIANT
+}
+
+void f3() {
+  thrd_t t;
+  thrd_create(&t, t2_use_all, NULL); // COMPLIANT
+}
+
+void f4() {
+  thrd_t t;
+  thrd_create(&t, t2_use_all, NULL); // COMPLIANT
+  thrd_join(&t, NULL);
+  mtx_destroy(&g1); // COMPLIANT
+  tss_delete(&g2);  // COMPLIANT
+  cnd_destroy(&g3); // COMPLIANT
+}
+
+void f5() {
+  thrd_t t1;
+  thrd_t t2;
+  thrd_create(&t1, t2_use_all, NULL);     // COMPLIANT
+  thrd_create(&t2, t3_dispose_all, NULL); // NON-COMPLIANT
+}
+
+void f6() {
+  thrd_t t1;
+  thrd_t t2;
+  thrd_create(&t1, t3_dispose_all, NULL); // NON-COMPLIANT
+  thrd_create(&t2, t2_use_all, NULL);     // COMPLIANT
+}
+
+void f7() {
+  thrd_t t1;
+  thrd_t t2;
+  thrd_create(&t1, t2_use_all, NULL); // COMPLIANT
+  thrd_join(&t1, NULL);
+  thrd_create(&t2, t3_dispose_all, NULL); // COMPLIANT
+}
+
+void f8() {
+  thrd_t t;
+  thrd_create(&t, t4_use_then_dispose, NULL); // COMPLIANT
+}
+
+void f9() {
+  thrd_t t;
+  thrd_create(&t, t3_dispose_all, NULL); // NON-COMPLIANT
+  mtx_lock(&g1);
+  tss_get(&g2);
+  cnd_wait(&g3, &g1);
+}
+
+void f10() {
+  thrd_t t;
+  mtx_lock(&g1);
+  tss_get(&g2);
+  cnd_wait(&g3, &g1);
+  thrd_create(&t, t3_dispose_all, NULL); // COMPLIANT
+}
+
+void f11() {
+  thrd_t t;
+  thrd_create(&t, t1_use_none, NULL);
+  mtx_lock(&g1);
+  tss_get(&g2);
+  cnd_wait(&g3, &g1);
+  mtx_destroy(&g1); // COMPLIANT
+  tss_delete(&g2);  // COMPLIANT
+  cnd_destroy(&g3); // COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.expected b/c/misra/test/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.expected
new file mode 100644
index 0000000000..46a295d75f
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.expected
@@ -0,0 +1,10 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (MutexObjectsNotAlwaysUnlocked.ql:22,52-60)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (MutexObjectsNotAlwaysUnlocked.ql:30,42-50)
+| test.c:16:3:16:10 | call to mtx_lock | Mutex 'm' is locked here and may not always be subsequently unlocked. |
+| test.c:21:3:21:10 | call to mtx_lock | Mutex 'm' is locked here and may not always be subsequently unlocked. |
+| test.c:39:3:39:10 | call to mtx_lock | Mutex 'm' is locked here and may not always be subsequently unlocked. |
+| test.c:55:3:55:10 | call to mtx_lock | Mutex 'm' is locked here and may not always be subsequently unlocked. |
+| test.c:72:3:72:10 | call to mtx_lock | Mutex 'g1' is locked here and may not always be subsequently unlocked. |
+| test.c:79:3:79:10 | call to mtx_lock | Mutex 'm' is locked here and may not always be subsequently unlocked. |
+| test.c:101:5:101:12 | call to mtx_lock | Mutex 'm' is locked here and may not always be subsequently unlocked. |
+| test.c:113:3:113:10 | call to mtx_lock | Mutex 'ptr_m1' is locked here and may not always be subsequently unlocked. |
diff --git a/c/misra/test/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.qlref b/c/misra/test/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.qlref
new file mode 100644
index 0000000000..a1877f944d
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.qlref
@@ -0,0 +1 @@
+rules/RULE-22-16/MutexObjectsNotAlwaysUnlocked.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-16/test.c b/c/misra/test/rules/RULE-22-16/test.c
new file mode 100644
index 0000000000..723516509f
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-16/test.c
@@ -0,0 +1,115 @@
+#include "threads.h"
+
+void f1() {
+  mtx_t m;
+  mtx_lock(&m); // COMPLIANT
+  mtx_unlock(&m);
+}
+
+void f2() {
+  mtx_t m;
+  mtx_unlock(&m); // COMPLIANT
+}
+
+void f3() {
+  mtx_t m;
+  mtx_lock(&m); // NON-COMPLIANT
+}
+
+void f4(int p) {
+  mtx_t m;
+  mtx_lock(&m); // NON-COMPLIANT
+  if (p) {
+    mtx_unlock(&m);
+  }
+}
+
+void f5(int p) {
+  mtx_t m;
+  mtx_lock(&m); // COMPLIANT
+  if (p) {
+    mtx_unlock(&m);
+  } else {
+    mtx_unlock(&m);
+  }
+}
+
+void f6(int p) {
+  mtx_t m;
+  mtx_lock(&m); // NON-COMPLIANT
+  if (p) {
+    goto skipped;
+  }
+  mtx_unlock(&m);
+skipped:;
+}
+
+void f7(int p) {
+  mtx_t *m;
+  mtx_lock(m); // COMPLIANT
+  mtx_unlock(m);
+}
+
+void f8(int p) {
+  mtx_t *m;
+  mtx_lock(m); // NON-COMPLIANT
+}
+
+void f9(int p) {
+  mtx_t m;
+  mtx_lock(&m); // COMPLIANT
+  mtx_t *ptr_m = &m;
+  mtx_unlock(ptr_m);
+}
+
+mtx_t g1;
+void f10() {
+  mtx_lock(&g1); // COMPLIANT
+  mtx_unlock(&g1);
+}
+
+void f11() {
+  mtx_lock(&g1); // NON-COMPLIANT
+}
+
+void f12() {
+  struct {
+    mtx_t m;
+  } s;
+  mtx_lock(&s.m); // NON-COMPLIANT
+}
+
+void f13() {
+  struct {
+    mtx_t m;
+  } s;
+  mtx_lock(&s.m); // COMPLIANT
+  mtx_unlock(&s.m);
+}
+
+void f14() {
+  for (;;) {
+    mtx_t m;
+    mtx_lock(&m); // COMPLIANT
+    mtx_unlock(&m);
+  }
+}
+
+void f15(int p) {
+  for (;;) {
+    mtx_t m;
+    mtx_lock(&m); // NON-COMPLIANT
+    if (p) {
+      break;
+    }
+    mtx_unlock(&m);
+  }
+}
+
+void f16(int p) {
+  mtx_t *ptr;
+  mtx_t *ptr_m1 = ptr;
+  mtx_t *ptr_m2 = ptr;
+  mtx_lock(ptr_m1); // COMPLIANT[FALSE_POSITIVE]
+  mtx_unlock(ptr_m2);
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.expected b/c/misra/test/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.expected
new file mode 100644
index 0000000000..254d55adc2
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.expected
@@ -0,0 +1,16 @@
+| test.c:19:3:19:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:11:9:11:10 | l1 | l1 |
+| test.c:20:3:20:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:11:9:11:10 | l1 | l1 |
+| test.c:25:3:25:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:14:5:14:6 | l2 | l2.m1 |
+| test.c:26:3:26:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:14:5:14:6 | l2 | l2.m1 |
+| test.c:31:3:31:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:3:7:3:8 | g1 | g1 |
+| test.c:32:3:32:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:3:7:3:8 | g1 | g1 |
+| test.c:37:3:37:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:6:3:6:4 | g2 | g2.m1 |
+| test.c:38:3:38:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:6:3:6:4 | g2 | g2.m1 |
+| test.c:47:3:47:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:11:9:11:10 | l1 | l1 |
+| test.c:48:3:48:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:14:5:14:6 | l2 | l2.m1 |
+| test.c:49:3:49:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:3:7:3:8 | g1 | g1 |
+| test.c:50:3:50:10 | call to cnd_wait | Invalid operation on mutex '$@' not locked by the current thread. | test.c:6:3:6:4 | g2 | g2.m1 |
+| test.c:51:3:51:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:11:9:11:10 | l1 | l1 |
+| test.c:52:3:52:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:14:5:14:6 | l2 | l2.m1 |
+| test.c:53:3:53:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:3:7:3:8 | g1 | g1 |
+| test.c:54:3:54:12 | call to mtx_unlock | Invalid operation on mutex '$@' not locked by the current thread. | test.c:6:3:6:4 | g2 | g2.m1 |
diff --git a/c/misra/test/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.qlref b/c/misra/test/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.qlref
new file mode 100644
index 0000000000..4ac06f10ed
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-17/InvalidOperationOnUnlockedMutex.qlref
@@ -0,0 +1 @@
+rules/RULE-22-17/InvalidOperationOnUnlockedMutex.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-17/test.c b/c/misra/test/rules/RULE-22-17/test.c
new file mode 100644
index 0000000000..fc841bb3e1
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-17/test.c
@@ -0,0 +1,70 @@
+#include "threads.h"
+
+mtx_t g1;
+struct {
+  mtx_t m1;
+} g2;
+
+cnd_t cnd;
+
+void f1(int p) {
+  mtx_t l1;
+  struct {
+    mtx_t m1;
+  } l2;
+
+  mtx_lock(&l1);
+  cnd_wait(&cnd, &l1); // COMPLIANT
+  mtx_unlock(&l1);     // COMPLIANT
+  cnd_wait(&cnd, &l1); // NON-COMPLIANT
+  mtx_unlock(&l1);     // NON-COMPLIANT
+
+  mtx_lock(&l2.m1);
+  cnd_wait(&cnd, &l2.m1); // COMPLIANT
+  mtx_unlock(&l2.m1);     // COMPLIANT
+  cnd_wait(&cnd, &l2.m1); // NON-COMPLIANT
+  mtx_unlock(&l2.m1);     // NON-COMPLIANT
+
+  mtx_lock(&g1);
+  cnd_wait(&cnd, &g1); // COMPLIANT
+  mtx_unlock(&g1);     // COMPLIANT
+  cnd_wait(&cnd, &g1); // NON-COMPLIANT
+  mtx_unlock(&g1);     // NON-COMPLIANT
+
+  mtx_lock(&g2.m1);
+  cnd_wait(&cnd, &g2.m1); // COMPLIANT
+  mtx_unlock(&g2.m1);     // COMPLIANT
+  cnd_wait(&cnd, &g2.m1); // NON-COMPLIANT
+  mtx_unlock(&g2.m1);     // NON-COMPLIANT
+
+  // We should report when a mutex is unlocked in the wrong block:
+  if (p) {
+    mtx_lock(&l1);
+    mtx_lock(&l2.m1);
+    mtx_lock(&g1);
+    mtx_lock(&g2.m1);
+  }
+  cnd_wait(&cnd, &l1);    // NON-COMPLIANT
+  cnd_wait(&cnd, &l2.m1); // NON-COMPLIANT
+  cnd_wait(&cnd, &g1);    // NON-COMPLIANT
+  cnd_wait(&cnd, &g2.m1); // NON-COMPLIANT
+  mtx_unlock(&l1);        // NON-COMPLIANT
+  mtx_unlock(&l2.m1);     // NON-COMPLIANT
+  mtx_unlock(&g1);        // NON-COMPLIANT
+  mtx_unlock(&g2.m1);     // NON-COMPLIANT
+
+  // The above requires dominance analysis. Check dominator sets don't cause
+  // false positives:
+  if (p) {
+    mtx_lock(&l1);
+  } else {
+    mtx_lock(&l1);
+  }
+  mtx_unlock(&l1); // COMPLIANT
+
+  // Invalid but satisfies the rule:
+  mtx_lock(&l1);
+  if (p) {
+    mtx_unlock(&l1); // COMPLIANT
+  }
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.expected b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.expected
new file mode 100644
index 0000000000..fd947dee51
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.expected
@@ -0,0 +1,2 @@
+| test.c:19:3:19:10 | call to mtx_lock | Non-recursive mutex nonrec locked after it is $@. | test.c:18:3:18:10 | call to mtx_lock | already locked |
+| test.c:22:3:22:10 | call to mtx_lock | Non-recursive mutex s.m locked after it is $@. | test.c:21:3:21:10 | call to mtx_lock | already locked |
diff --git a/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.qlref b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.qlref
new file mode 100644
index 0000000000..131e0476bf
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.qlref
@@ -0,0 +1 @@
+rules/RULE-22-18/NonRecursiveMutexRecursivelyLocked.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.expected b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.expected
new file mode 100644
index 0000000000..e268f5367e
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.expected
@@ -0,0 +1,6 @@
+| test.c:44:3:44:10 | call to mtx_lock | Mutex locked after it was already $@. | test.c:43:3:43:10 | call to mtx_lock | previously locked |
+| test.c:49:3:49:10 | call to mtx_lock | Mutex locked after it was already $@. | test.c:48:3:48:10 | call to mtx_lock | previously locked |
+| test.c:54:3:54:10 | call to mtx_lock | Mutex locked after it was already $@. | test.c:53:3:53:10 | call to mtx_lock | previously locked |
+| test.c:59:3:59:10 | call to mtx_lock | Mutex locked after it was already $@. | test.c:58:3:58:10 | call to mtx_lock | previously locked |
+| test.c:76:3:76:10 | call to mtx_lock | Mutex locked after it was already $@. | test.c:75:3:75:10 | call to mtx_lock | previously locked |
+| test.c:81:3:81:10 | call to mtx_lock | Mutex locked after it was already $@. | test.c:80:3:80:10 | call to mtx_lock | previously locked |
diff --git a/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.qlref b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.qlref
new file mode 100644
index 0000000000..77a81deb69
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.qlref
@@ -0,0 +1 @@
+rules/RULE-22-18/NonRecursiveMutexRecursivelyLockedAudit.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-18/test.c b/c/misra/test/rules/RULE-22-18/test.c
new file mode 100644
index 0000000000..f71066b1bc
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-18/test.c
@@ -0,0 +1,122 @@
+#include "threads.h"
+
+mtx_t rec;
+mtx_t nonrec;
+mtx_t both;
+mtx_t unknown;
+
+struct {
+  mtx_t m;
+} s;
+
+mtx_t arr[2];
+
+int t1(void *arg) {
+  mtx_lock(&rec); // COMPLIANT
+  mtx_lock(&rec); // COMPLIANT
+
+  mtx_lock(&nonrec); // COMPLIANT
+  mtx_lock(&nonrec); // NON-COMPLIANT
+
+  mtx_lock(&s.m); // COMPLIANT
+  mtx_lock(&s.m); // NON-COMPLIANT
+}
+
+void f1() {
+  mtx_init(&rec, mtx_plain | mtx_recursive);
+  mtx_init(&nonrec, mtx_plain);
+  mtx_init(&both, mtx_plain);
+  mtx_init(&both, mtx_plain | mtx_recursive);
+  // Do not initialize `unknown`.
+  mtx_init(&s.m, mtx_plain);
+  mtx_init(&arr[0], mtx_plain);
+  mtx_init(&arr[1], mtx_plain);
+
+  thrd_t t;
+  thrd_create(t, t1, NULL);
+}
+
+mtx_t *p;
+
+// Results for the audit query:
+void t2(void *arg) {
+  mtx_lock(&arr[0]);
+  mtx_lock(&arr[(int)arg]); // NON-COMPLIANT
+}
+
+void t3(void *arg) {
+  mtx_lock(arg);
+  mtx_lock(p); // NON-COMPLIANT
+}
+
+void t4() {
+  mtx_lock(&both);
+  mtx_lock(&both); // NON-COMPLIANT
+}
+
+void t5() {
+  mtx_lock(&unknown);
+  mtx_lock(&unknown); // NON-COMPLIANT
+}
+
+void t6() {
+  // Cannot be locks of the same mutex:
+  mtx_lock(&nonrec);
+  mtx_lock(&unknown); // COMPLIANT
+}
+
+void t7() {
+  mtx_lock(p);
+  // Definitely a recursive mutex:
+  mtx_lock(&rec); // COMPLIANT
+}
+
+void t8() {
+  mtx_lock(p);
+  mtx_lock(&nonrec); // NON-COMPLIANT
+}
+
+void t9() {
+  mtx_lock(&nonrec);
+  mtx_lock(p); // NON-COMPLIANT
+}
+
+void f2() {
+  thrd_t t;
+  thrd_create(t, t2, NULL);
+}
+
+void f3() {
+  thrd_t t;
+  thrd_create(t, t3, &rec);
+}
+
+void f4() {
+  thrd_t t;
+  thrd_create(t, t4, NULL);
+}
+
+void f5() {
+  thrd_t t;
+  thrd_create(t, t5, NULL);
+}
+
+void f6() {
+  thrd_t t;
+  thrd_create(t, t6, NULL);
+}
+
+void f7() {
+  thrd_t t;
+  thrd_create(t, t7, NULL);
+}
+
+void f8() {
+  thrd_t t;
+  thrd_create(t, t8, NULL);
+}
+
+void f9() {
+  thrd_t t;
+  thrd_create(t, t9, NULL);
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.expected b/c/misra/test/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.expected
new file mode 100644
index 0000000000..c9785067c6
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.expected
@@ -0,0 +1,2 @@
+| test.c:19:3:19:10 | call to cnd_wait | Condition variable $@ associated with multiple mutexes, operation uses mutex $@ while $@ uses other mutex $@. | test.c:16:9:16:12 | cnd1 | cnd1 | test.c:17:9:17:12 | mtx1 | mtx1 | test.c:19:3:19:10 | call to cnd_wait | another operation | test.c:18:9:18:12 | mtx2 | mtx2 |
+| test.c:41:3:41:10 | call to cnd_wait | Condition variable $@ associated with multiple mutexes, operation uses mutex $@ while $@ uses other mutex $@. | test.c:37:7:37:11 | gcnd1 | gcnd1 | test.c:38:7:38:11 | gmtx1 | gmtx1 | test.c:41:3:41:10 | call to cnd_wait | another operation | test.c:39:7:39:11 | gmtx2 | gmtx2 |
diff --git a/c/misra/test/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.qlref b/c/misra/test/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.qlref
new file mode 100644
index 0000000000..d43a824ec8
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.qlref
@@ -0,0 +1 @@
+rules/RULE-22-19/ConditionVariableUsedWithMultipleMutexes.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-19/test.c b/c/misra/test/rules/RULE-22-19/test.c
new file mode 100644
index 0000000000..f4b46d4077
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-19/test.c
@@ -0,0 +1,46 @@
+#include "threads.h"
+
+void f1(void) {
+  cnd_t cnd1;
+  mtx_t mtx1;
+  cnd_wait(&cnd1, &mtx1); // COMPLIANT
+  cnd_wait(&cnd1, &mtx1); // COMPLIANT
+
+  cnd_t cnd2;
+  mtx_t mtx2;
+  cnd_wait(&cnd2, &mtx2); // COMPLIANT
+  cnd_wait(&cnd2, &mtx2); // COMPLIANT
+}
+
+void f2(void) {
+  cnd_t cnd1;
+  mtx_t mtx1;
+  mtx_t mtx2;
+  cnd_wait(&cnd1, &mtx1); // NON-COMPLIANT
+  cnd_wait(&cnd1, &mtx2); // NON-COMPLIANT
+}
+
+void f3(void) {
+  cnd_t cnd1;
+  cnd_t cnd2;
+  mtx_t mtx1;
+  cnd_wait(&cnd1, &mtx1); // COMPLIANT
+  cnd_wait(&cnd2, &mtx1); // COMPLIANT
+}
+
+void f4(cnd_t *cnd1, mtx_t *mtx1, mtx_t *mtx2) {
+  cnd_wait(cnd1, mtx1); // COMPLIANT
+  // Compliant, mtx1 and mtx2 may point to the same object
+  cnd_wait(cnd1, mtx2); // COMPLIANT
+}
+
+cnd_t gcnd1;
+mtx_t gmtx1;
+mtx_t gmtx2;
+void f5(void) {
+  cnd_wait(&gcnd1, &gmtx1); // NON-COMPLIANT
+}
+
+void f6(void) {
+  cnd_wait(&gcnd1, &gmtx2); // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.expected b/c/misra/test/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.expected
new file mode 100644
index 0000000000..301debd7e8
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.expected
@@ -0,0 +1,5 @@
+| test.c:6:11:6:13 | & ... | Thread specific storage pointer '$@' used before initialization from entry point function '$@'. | test.c:5:9:5:10 | l1 | l1 | test.c:4:6:4:19 | use_local_mtxs | use_local_mtxs |
+| test.c:11:11:11:12 | l4 | Thread specific storage pointer '$@' used before initialization from entry point function '$@'. | test.c:10:15:10:20 | call to malloc | call to malloc | test.c:16:6:16:31 | root1_calls_use_local_mtxs | root1_calls_use_local_mtxs |
+| test.c:25:11:25:13 | & ... | Thread specific storage pointer '$@' used before initialization from entry point function '$@'. | test.c:22:7:22:8 | g1 | g1 | test.c:24:6:24:28 | root2_uses_global_tss_t | root2_uses_global_tss_t |
+| test.c:38:11:38:13 | & ... | Thread specific storage pointer '$@' used before initialization from entry point function '$@'. | test.c:22:7:22:8 | g1 | g1 | test.c:41:6:41:45 | root4_call_thread_without_initialization | root4_call_thread_without_initialization |
+| test.c:58:11:58:13 | & ... | Thread specific storage pointer '$@' used before initialization from entry point function '$@'. | test.c:56:7:56:8 | g5 | g5 | test.c:67:6:67:50 | root6_spawn_thread_uninitialized_thread_local | root6_spawn_thread_uninitialized_thread_local |
diff --git a/c/misra/test/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.qlref b/c/misra/test/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.qlref
new file mode 100644
index 0000000000..10d9aadf1b
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.qlref
@@ -0,0 +1 @@
+rules/RULE-22-20/ThreadStorageNotInitializedBeforeUse.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.expected b/c/misra/test/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.expected
new file mode 100644
index 0000000000..75e9825074
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.expected
@@ -0,0 +1 @@
+| test.c:61:3:61:12 | call to tss_create | Thread specific storage object initialization reachable from threaded function '$@'. | test.c:57:6:57:41 | from_root6_init_and_use_thread_local | from_root6_init_and_use_thread_local |
diff --git a/c/misra/test/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.qlref b/c/misra/test/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.qlref
new file mode 100644
index 0000000000..d299808814
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.qlref
@@ -0,0 +1 @@
+rules/RULE-22-20/ThreadStoragePointerInitializedInsideThread.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-20/test.c b/c/misra/test/rules/RULE-22-20/test.c
new file mode 100644
index 0000000000..0fe58abdcd
--- /dev/null
+++ b/c/misra/test/rules/RULE-22-20/test.c
@@ -0,0 +1,70 @@
+#include "stdlib.h"
+#include "threads.h"
+
+void use_local_mtxs(int x, int y) {
+  tss_t l1;
+  tss_get(&l1); // NON-COMPLIANT
+  tss_create(&l1, NULL);
+  tss_get(&l1); // COMPLIANT
+
+  tss_t *l4 = malloc(sizeof(tss_t));
+  tss_get(l4); // NON-COMPLIANT
+  tss_create(l4, NULL);
+  tss_get(l4); // COMPLIANT
+}
+
+void root1_calls_use_local_mtxs() {
+  // Since a function exists which calls use_local_mtxs(), that function is not
+  // a root function. The query should still report unused locals in this case.
+  use_local_mtxs(1, 2);
+}
+
+tss_t g1;
+
+void root2_uses_global_tss_t() {
+  tss_get(&g1); // NON-COMPLIANT
+}
+
+void from_root3_use_global_tss_t() {
+  tss_get(&g1); // COMPLIANT
+}
+
+void root3_initializes_and_uses_global_tss_t() {
+  tss_create(&g1, NULL);
+  from_root3_use_global_tss_t();
+}
+
+void from_root4_use_global_tss_t(void *arg) {
+  tss_get(&g1); // NON-COMPLIANT
+}
+
+void root4_call_thread_without_initialization() {
+  thrd_t t;
+  thrd_create(&t, &from_root4_use_global_tss_t, NULL);
+}
+
+void from_root5_use_global_tss_t(void *arg) {
+  tss_get(&g1); // COMPLIANT
+}
+
+void root5_thread_with_initialization() {
+  tss_create(&g1, NULL);
+  thrd_t t;
+  thrd_create(&t, &from_root5_use_global_tss_t, NULL);
+}
+
+mtx_t g5;
+void from_root6_init_and_use_thread_local() {
+  tss_get(&g5); // NON-COMPLIANT
+
+  // Violates recommendation, tss_t initialized within a thread.
+  tss_create(&g5, NULL); // NON-COMPLIANT
+
+  // Valid if we except the above initialization.
+  tss_get(&g5); // COMPLIANT
+}
+
+void root6_spawn_thread_uninitialized_thread_local() {
+  thrd_t t;
+  thrd_create(&t, &from_root6_init_and_use_thread_local, NULL);
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.expected b/c/misra/test/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.expected
index 6111072ba8..0365f4980d 100644
--- a/c/misra/test/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.expected
+++ b/c/misra/test/rules/RULE-22-3/FileOpenForReadAndWriteOnDifferentStreams.expected
@@ -1,3 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (FileOpenForReadAndWriteOnDifferentStreams.ql:39,9-17)
 | test.c:6:14:6:18 | call to fopen | The same file was already opened $@. Files should not be read and written at the same time using different streams. | test.c:5:14:5:18 | call to fopen | here |
 | test.c:17:14:17:18 | call to fopen | The same file was already opened $@. Files should not be read and written at the same time using different streams. | test.c:16:14:16:18 | call to fopen | here |
 | test.c:33:14:33:18 | call to fopen | The same file was already opened $@. Files should not be read and written at the same time using different streams. | test.c:32:14:32:18 | call to fopen | here |
diff --git a/c/misra/test/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.expected b/c/misra/test/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.expected
index 0bfce133c5..dbf08e3d3d 100644
--- a/c/misra/test/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.expected
+++ b/c/misra/test/rules/RULE-22-4/AttemptToWriteToAReadOnlyStream.expected
@@ -1,2 +1,8 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AttemptToWriteToAReadOnlyStream.ql:19,32-40)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AttemptToWriteToAReadOnlyStream.ql:20,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AttemptToWriteToAReadOnlyStream.ql:25,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AttemptToWriteToAReadOnlyStream.ql:31,21-29)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AttemptToWriteToAReadOnlyStream.ql:33,6-14)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AttemptToWriteToAReadOnlyStream.ql:36,28-36)
 | test.c:10:3:10:9 | call to fprintf | Attempt to write to a $@ opened as read-only. | test.c:9:14:9:18 | call to fopen | stream |
 | test.c:15:3:15:9 | call to fprintf | Attempt to write to a $@ opened as read-only. | test.c:18:14:18:18 | call to fopen | stream |
diff --git a/c/misra/test/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.expected b/c/misra/test/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.expected
index 709d8b002c..210a3a9218 100644
--- a/c/misra/test/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.expected
+++ b/c/misra/test/rules/RULE-22-7/EofShallBeComparedWithUnmodifiedReturnValues.expected
@@ -1,2 +1,10 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:24,28-36)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:25,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:29,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:38,23-31)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:43,17-25)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:52,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:60,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (EofShallBeComparedWithUnmodifiedReturnValues.ql:60,46-54)
 | test.c:6:7:6:20 | ... != ... | The check is not reliable as the type of the return value of $@ is converted. | test.c:5:14:5:20 | call to getchar | call to getchar |
 | test.c:13:7:13:15 | ... != ... | The check is not reliable as the type of the return value of $@ is converted. | test.c:12:14:12:20 | call to getchar | call to getchar |
diff --git a/c/misra/test/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.expected b/c/misra/test/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.expected
new file mode 100644
index 0000000000..03852b7cf2
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.expected
@@ -0,0 +1,3 @@
+| test.c:2:1:2:31 | #define M1 _Generic(1, int : 1) | Generic macro M1 doesn't refer to a macro parameter in controlling expr '1'. |
+| test.c:4:1:4:34 | #define M2(X) _Generic(1, int : X) | Generic macro M2 doesn't refer to a macro parameter in controlling expr '1'. |
+| test.c:18:1:18:39 | #define M9(X) g(_Generic((Y), int : 1)) | Generic macro M9 doesn't refer to a macro parameter in controlling expr '(Y)'. |
diff --git a/c/misra/test/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.qlref b/c/misra/test/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.qlref
new file mode 100644
index 0000000000..1ca5f792fa
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.qlref
@@ -0,0 +1 @@
+rules/RULE-23-1/GenericSelectionDoesntDependOnMacroArgument.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.expected b/c/misra/test/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.expected
new file mode 100644
index 0000000000..edc4b9270c
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.expected
@@ -0,0 +1 @@
+| test.c:21:3:21:22 | _Generic | $@ in generic expression does not expand a macro parameter. | test.c:21:12:21:12 | 1 | Controlling expression |
diff --git a/c/misra/test/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.qlref b/c/misra/test/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.qlref
new file mode 100644
index 0000000000..59fae02b7f
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.qlref
@@ -0,0 +1 @@
+rules/RULE-23-1/GenericSelectionNotExpandedFromAMacro.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-1/test.c b/c/misra/test/rules/RULE-23-1/test.c
new file mode 100644
index 0000000000..c7d33b1a70
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-1/test.c
@@ -0,0 +1,25 @@
+// NON_COMPLIANT:
+#define M1 _Generic(1, int : 1)
+// NON_COMPLIANT:
+#define M2(X) _Generic(1, int : X)
+// COMPLIANT:
+#define M3(X) _Generic((X), int : 1)
+// COMPLIANT:
+#define M4(X) _Generic((X), int : 1)
+// COMPLIANT:
+#define M5(X) _Generic((X + X), int : 1)
+int f1(int a, int b);
+// COMPLIANT:
+#define M6(X) _Generic(f(1, (X)), int : 1)
+#define M7(X) 1 + _Generic((X), int : 1)
+// COMPLIANT:
+#define M8(X) g(_Generic((X), int : 1))
+// NON_COMPLIANT:
+#define M9(X) g(_Generic((Y), int : 1))
+
+void f2() {
+  _Generic(1, int : 1); // NON_COMPLIANT
+  M1;                   // NON_COMPLIANT
+  M2(1);                // NON_COMPLIANT
+  M3(1);                // COMPLIANT
+}
diff --git a/c/misra/test/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.expected b/c/misra/test/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.expected
new file mode 100644
index 0000000000..b0a970bbcf
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.expected
@@ -0,0 +1,3 @@
+| test.c:4:1:4:38 | #define M2(X) _Generic((X)++, int : 1) | Generic selection macro M2 contains a side effect '... ++', which is not from macro invocation arguments. | test.c:4:1:4:38 | #define M2(X) _Generic((X)++, int : 1) | (ignored) |
+| test.c:7:1:7:39 | #define M3(X) _Generic(l1++, int : (X)) | Generic selection macro M3 contains a side effect '... ++', which is not from macro invocation arguments. | test.c:7:1:7:39 | #define M3(X) _Generic(l1++, int : (X)) | (ignored) |
+| test.c:42:1:44:25 | #define M5(X) static volatile l ## X; _Generic(l ## X, int : 1) | Generic selection in macro M5 contains an invocation-dependent side effect which is not from macro invocation arguments, for example $@. | test.c:47:3:47:7 | _Generic | side effect 'la' |
diff --git a/c/misra/test/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.qlref b/c/misra/test/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.qlref
new file mode 100644
index 0000000000..bb3e39a58c
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.qlref
@@ -0,0 +1 @@
+rules/RULE-23-2/GenericSelectionNotFromMacroWithSideEffects.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-2/test.c b/c/misra/test/rules/RULE-23-2/test.c
new file mode 100644
index 0000000000..9e4c6ca6b2
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-2/test.c
@@ -0,0 +1,49 @@
+#define M1(X) _Generic((X), int : 1)
+
+// NON_COMPLIANT:
+#define M2(X) _Generic((X)++, int : 1)
+
+// NON_COMPLIANT:
+#define M3(X) _Generic(l1++, int : (X))
+
+// COMPLIANT:
+#define M3_WRAPPER(X) M3(X)
+
+#define M4(X) _Generic((X)(), int : 1)
+
+void f1() {
+  int l1;
+
+  _Generic(1, int : 1);  // COMPLIANT
+  M1(1);                 // COMPLIANT
+  _Generic(l1, int : 1); // COMPLIANT
+  M1(l1);                // COMPLIANT
+
+  _Generic(l1++,
+           int : 1); // COMPLIANT: side effect is not from a macro argument.
+  M1(l1++);          // COMPLIANT
+  M2(l1);            // NON-COMPLIANT: at macro definition
+  M3(1);             // NON-COMPLIANT: at macro definition
+  M3_WRAPPER(1);     // NON-COMPLIANT: at definition of M3
+}
+
+int g1;
+int pure() { return g1; }
+
+int impure() { return g1++; }
+
+void f2() {
+  M1(pure());   // COMPLIANT
+  M1(impure()); // COMPLIANT
+  M4(pure);     // COMPLIANT
+  M4(impure);   // NON_COMPLIANT[False negative]
+}
+
+#define M5(X)                                                                  \
+  static volatile l##X;                                                        \
+  _Generic(l##X, int : 1)
+
+void f3() {
+  M5(a); // NON-COMPLIANT
+  M5(b); // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.expected b/c/misra/test/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.expected
new file mode 100644
index 0000000000..6a56026947
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.expected
@@ -0,0 +1,2 @@
+| test.c:2:1:2:36 | #define M1 _Generic(1, default : 1); | Generic selection contains no non-default association. |
+| test.c:14:3:14:26 | _Generic | Generic selection contains no non-default association. |
diff --git a/c/misra/test/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.qlref b/c/misra/test/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.qlref
new file mode 100644
index 0000000000..b44de9083e
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-3/GenericWithoutNonDefaultAssociation.qlref
@@ -0,0 +1 @@
+rules/RULE-23-3/GenericWithoutNonDefaultAssociation.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-3/test.c b/c/misra/test/rules/RULE-23-3/test.c
new file mode 100644
index 0000000000..616c14bc80
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-3/test.c
@@ -0,0 +1,23 @@
+// NON-COMPLIANT
+#define M1 _Generic(1, default : 1);
+// COMPLIANT
+#define M2 _Generic(1, int : 1);
+// COMPLIANT
+#define M3 _Generic(1, int : 1, default : 1);
+// COMPLIANT
+#define M4 _Generic(1, int : 1, long : 1);
+
+void f() {
+  // Invalid generics:
+  // _Generic(1);
+  // _Generic(1, void: 1);
+  _Generic(1, default : 1);          // NON-COMPLIANT
+  _Generic(1, int : 1);              // COMPLIANT
+  _Generic(1, int : 1, default : 1); // COMPLIANT
+  _Generic(1, int : 1, long : 1);    // COMPLIANT
+
+  M1;
+  M2;
+  M3;
+  M4;
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-4/GenericAssociationWithUnselectableType.expected b/c/misra/test/rules/RULE-23-4/GenericAssociationWithUnselectableType.expected
new file mode 100644
index 0000000000..132bb82979
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-4/GenericAssociationWithUnselectableType.expected
@@ -0,0 +1,13 @@
+| test.c:11:24:11:24 | 1 | Generic selection uses unselectable type 'const int', due to qualifiers removed'. | test.c:11:24:11:24 | 1 | side effect |
+| test.c:12:27:12:27 | 1 | Generic selection uses unselectable type 'volatile int', due to qualifiers removed'. | test.c:12:27:12:27 | 1 | side effect |
+| test.c:13:26:13:26 | 1 | Generic selection uses unselectable type '_Atomic(int)', due to qualifiers removed'. | test.c:13:26:13:26 | 1 | side effect |
+| test.c:16:33:16:33 | 1 | Generic selection uses unselectable type 'const volatile int', due to qualifiers removed'. | test.c:16:33:16:33 | 1 | side effect |
+| test.c:18:24:18:24 | 1 | Generic selection uses unselectable type '(unnamed class/struct/union)', due to containing an anonymous struct or union type'. | test.c:18:24:18:24 | 1 | side effect |
+| test.c:19:26:19:26 | 1 | Generic selection uses unselectable type 'struct <unnamed> *', due to containing an anonymous struct or union type'. | test.c:19:26:19:26 | 1 | side effect |
+| test.c:24:23:24:23 | 1 | Generic selection uses unselectable type '(unnamed class/struct/union)', due to containing an anonymous struct or union type'. | test.c:24:23:24:23 | 1 | side effect |
+| test.c:25:25:25:25 | 1 | Generic selection uses unselectable type 'union <unnamed> *', due to containing an anonymous struct or union type'. | test.c:25:25:25:25 | 1 | side effect |
+| test.c:31:21:31:21 | 1 | Generic selection uses unselectable type 'int[3]', due to array-to-pointer decay'. | test.c:31:21:31:21 | 1 | side effect |
+| test.c:40:1:40:55 | #define M1(X) _Generic((X), const int : 1, default : 0) | Generic in macro M1 has unselectable type 'const int', due to qualifiers removed. | test.c:40:1:40:55 | #define M1(X) _Generic((X), const int : 1, default : 0) | (ignored) |
+| test.c:42:1:42:48 | #define M2(X) _Generic(1, X[3] : 1, default : 0) | Generic in macro M2 has an invocation-dependent unselectable type, for example $@. | test.c:49:3:49:10 | 1 | 'char[3]', due to array-to-pointer decay |
+| test.c:52:3:52:15 | M3(X) | Generic resulting from invocation of macro $@ contains an unselectable type 'const int', due to qualifiers removed. | test.c:44:1:44:45 | #define M3(X) _Generic(1, X : 1, default : 0) | M3 |
+| test.c:64:24:64:24 | 1 | Generic selection uses unselectable type 'const_int', due to qualifiers removed'. | test.c:64:24:64:24 | 1 | side effect |
diff --git a/c/misra/test/rules/RULE-23-4/GenericAssociationWithUnselectableType.qlref b/c/misra/test/rules/RULE-23-4/GenericAssociationWithUnselectableType.qlref
new file mode 100644
index 0000000000..1214be7ce2
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-4/GenericAssociationWithUnselectableType.qlref
@@ -0,0 +1 @@
+rules/RULE-23-4/GenericAssociationWithUnselectableType.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-4/test.c b/c/misra/test/rules/RULE-23-4/test.c
new file mode 100644
index 0000000000..cfef26318c
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-4/test.c
@@ -0,0 +1,73 @@
+typedef struct {
+} empty_struct_t;
+struct empty_struct {};
+typedef union {
+} empty_union_t;
+union empty_union {};
+
+void f() {
+  _Generic(1,
+           int : 1,                   // COMPLIANT
+           const int : 1,             // NON-COMPLIANT
+           volatile int : 1,          // NON-COMPLIANT
+           _Atomic int : 1,           // NON-COMPLIANT
+           int * : 1,                 // COMPLIANT
+           int const * : 1,           // COMPLIANT
+           const volatile int : 1,    // NON-COMPLIANT
+           int volatile const * : 1,  // COMPLIANT
+           struct {} : 1,             // NON-COMPLIANT
+           struct {} * : 1,           // NON-COMPLIANT
+           empty_struct_t : 1,        // COMPLIANT
+           struct empty_struct : 1,   // COMPLIANT
+           empty_struct_t * : 1,      // COMPLIANT
+           struct empty_struct * : 1, // COMPLIANT
+           union {} : 1,              // NON-COMPLIANT
+           union {} * : 1,            // NON-COMPLIANT
+           empty_union_t : 1,         // COMPLIANT
+           union empty_union : 1,     // COMPLIANT
+           empty_union_t * : 1,       // COMPLIANT
+           union empty_union * : 1,   // COMPLIANT
+           // int[]: 1,              // compile error
+           int[3] : 1,    // NON-COMPLIANT
+           int(*)[3] : 1, // COMPLIANT: pointer to array OK
+           // int (int*): 1,  // compile error
+           int (*)(int *) : 1, // COMPLIANT: function pointers OK
+           default : 1         // COMPLIANT
+  );
+}
+
+// NON-COMPLIANT
+#define M1(X) _Generic((X), const int : 1, default : 0)
+// NON-COMPLIANT
+#define M2(X) _Generic(1, X[3] : 1, default : 0)
+// COMPLIANT
+#define M3(X) _Generic(1, X : 1, default : 0)
+
+void f2() {
+  M1(1);
+  M2(int);
+  M2(char);
+
+  M3(int);       // COMPLIANT
+  M3(const int); // NON-COMPLIANT
+}
+
+typedef int int_t;
+typedef int *int_ptr;
+const typedef int const_int;
+const typedef int *const_int_ptr;
+typedef long const *long_const_ptr;
+
+void f3() {
+  _Generic(1,
+           int_t : 1,          // COMPLIANT
+           const_int : 1,      // NON-COMPLIANT
+           const_int_ptr : 1,  // COMPLIANT
+           long_const_ptr : 1, // COMPLIANT
+           const int_ptr : 1,  // COMPLIANT
+           default : 1         // COMPLIANT
+  );
+}
+
+// Type written here so it gets added to the database, see LvalueConversion.qll.
+char *g;
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.expected b/c/misra/test/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.expected
new file mode 100644
index 0000000000..3ed6b3f26b
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.expected
@@ -0,0 +1,84 @@
+| test.c:41:3:41:46 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const int *. | test.c:41:3:41:46 | _Generic |  |
+| test.c:42:3:42:49 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to volatile int *. | test.c:42:3:42:49 | _Generic |  |
+| test.c:43:3:43:55 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const volatile int *. | test.c:43:3:43:55 | _Generic |  |
+| test.c:44:3:44:41 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to void *. | test.c:44:3:44:41 | _Generic |  |
+| test.c:45:3:45:47 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const void *. | test.c:45:3:45:47 | _Generic |  |
+| test.c:46:3:46:56 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const volatile void *. | test.c:46:3:46:56 | _Generic |  |
+| test.c:48:3:48:40 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to int *. | test.c:48:3:48:40 | _Generic |  |
+| test.c:50:3:50:41 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to void *. | test.c:50:3:50:41 | _Generic |  |
+| test.c:51:3:51:47 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const void *. | test.c:51:3:51:47 | _Generic |  |
+| test.c:52:3:52:56 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const volatile void *. | test.c:52:3:52:56 | _Generic |  |
+| test.c:57:3:57:55 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const volatile int *. | test.c:57:3:57:55 | _Generic |  |
+| test.c:59:3:59:40 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to int *. | test.c:59:3:59:40 | _Generic |  |
+| test.c:61:3:61:55 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to const volatile int *. | test.c:61:3:61:55 | _Generic |  |
+| test.c:62:3:62:41 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to void *. | test.c:62:3:62:41 | _Generic |  |
+| test.c:63:3:63:56 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to const volatile void *. | test.c:63:3:63:56 | _Generic |  |
+| test.c:69:3:69:40 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to int *. | test.c:69:3:69:40 | _Generic |  |
+| test.c:70:3:70:46 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to const int *. | test.c:70:3:70:46 | _Generic |  |
+| test.c:71:3:71:49 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to volatile int *. | test.c:71:3:71:49 | _Generic |  |
+| test.c:73:3:73:41 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to void *. | test.c:73:3:73:41 | _Generic |  |
+| test.c:74:3:74:47 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to const void *. | test.c:74:3:74:47 | _Generic |  |
+| test.c:75:3:75:56 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to const volatile void *. | test.c:75:3:75:56 | _Generic |  |
+| test.c:77:3:77:40 | _Generic | Generic matched default selection, as controlling argument type void * does not undergo pointer conversion to int *. | test.c:77:3:77:40 | _Generic |  |
+| test.c:78:3:78:46 | _Generic | Generic matched default selection, as controlling argument type void * does not undergo pointer conversion to const int *. | test.c:78:3:78:46 | _Generic |  |
+| test.c:79:3:79:49 | _Generic | Generic matched default selection, as controlling argument type void * does not undergo pointer conversion to volatile int *. | test.c:79:3:79:49 | _Generic |  |
+| test.c:80:3:80:55 | _Generic | Generic matched default selection, as controlling argument type void * does not undergo pointer conversion to const volatile int *. | test.c:80:3:80:55 | _Generic |  |
+| test.c:82:3:82:47 | _Generic | Generic matched default selection, as controlling argument type void * does not undergo pointer conversion to const void *. | test.c:82:3:82:47 | _Generic |  |
+| test.c:83:3:83:56 | _Generic | Generic matched default selection, as controlling argument type void * does not undergo pointer conversion to const volatile void *. | test.c:83:3:83:56 | _Generic |  |
+| test.c:85:3:85:40 | _Generic | Generic matched default selection, as controlling argument type const void * does not undergo pointer conversion to int *. | test.c:85:3:85:40 | _Generic |  |
+| test.c:86:3:86:46 | _Generic | Generic matched default selection, as controlling argument type const void * does not undergo pointer conversion to const int *. | test.c:86:3:86:46 | _Generic |  |
+| test.c:87:3:87:55 | _Generic | Generic matched default selection, as controlling argument type const void * does not undergo pointer conversion to const volatile int *. | test.c:87:3:87:55 | _Generic |  |
+| test.c:88:3:88:41 | _Generic | Generic matched default selection, as controlling argument type const void * does not undergo pointer conversion to void *. | test.c:88:3:88:41 | _Generic |  |
+| test.c:90:3:90:56 | _Generic | Generic matched default selection, as controlling argument type const void * does not undergo pointer conversion to const volatile void *. | test.c:90:3:90:56 | _Generic |  |
+| test.c:94:3:94:40 | _Generic | Generic matched default selection, as controlling argument type const volatile void * does not undergo pointer conversion to int *. | test.c:94:3:94:40 | _Generic |  |
+| test.c:95:3:95:46 | _Generic | Generic matched default selection, as controlling argument type const volatile void * does not undergo pointer conversion to const int *. | test.c:95:3:95:46 | _Generic |  |
+| test.c:96:3:96:49 | _Generic | Generic matched default selection, as controlling argument type const volatile void * does not undergo pointer conversion to volatile int *. | test.c:96:3:96:49 | _Generic |  |
+| test.c:97:3:97:55 | _Generic | Generic matched default selection, as controlling argument type const volatile void * does not undergo pointer conversion to const volatile int *. | test.c:97:3:97:55 | _Generic |  |
+| test.c:98:3:98:41 | _Generic | Generic matched default selection, as controlling argument type const volatile void * does not undergo pointer conversion to void *. | test.c:98:3:98:41 | _Generic |  |
+| test.c:99:3:99:47 | _Generic | Generic matched default selection, as controlling argument type const volatile void * does not undergo pointer conversion to const void *. | test.c:99:3:99:47 | _Generic |  |
+| test.c:119:3:119:47 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const int *. | test.c:119:3:119:47 | _Generic |  |
+| test.c:120:3:120:50 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to volatile int *. | test.c:120:3:120:50 | _Generic |  |
+| test.c:121:3:121:56 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const volatile int *. | test.c:121:3:121:56 | _Generic |  |
+| test.c:122:3:122:42 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to void *. | test.c:122:3:122:42 | _Generic |  |
+| test.c:123:3:123:48 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const void *. | test.c:123:3:123:48 | _Generic |  |
+| test.c:124:3:124:57 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const volatile void *. | test.c:124:3:124:57 | _Generic |  |
+| test.c:126:3:126:41 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to int *. | test.c:126:3:126:41 | _Generic |  |
+| test.c:128:3:128:42 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to void *. | test.c:128:3:128:42 | _Generic |  |
+| test.c:129:3:129:48 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const void *. | test.c:129:3:129:48 | _Generic |  |
+| test.c:130:3:130:57 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const volatile void *. | test.c:130:3:130:57 | _Generic |  |
+| test.c:135:3:135:56 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const volatile int *. | test.c:135:3:135:56 | _Generic |  |
+| test.c:137:3:137:41 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to int *. | test.c:137:3:137:41 | _Generic |  |
+| test.c:139:3:139:56 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to const volatile int *. | test.c:139:3:139:56 | _Generic |  |
+| test.c:140:3:140:42 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to void *. | test.c:140:3:140:42 | _Generic |  |
+| test.c:141:3:141:57 | _Generic | Generic matched default selection, as controlling argument type volatile int * does not undergo pointer conversion to const volatile void *. | test.c:141:3:141:57 | _Generic |  |
+| test.c:147:3:147:41 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to int *. | test.c:147:3:147:41 | _Generic |  |
+| test.c:148:3:148:47 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to const int *. | test.c:148:3:148:47 | _Generic |  |
+| test.c:149:3:149:50 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to volatile int *. | test.c:149:3:149:50 | _Generic |  |
+| test.c:151:3:151:42 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to void *. | test.c:151:3:151:42 | _Generic |  |
+| test.c:152:3:152:48 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to const void *. | test.c:152:3:152:48 | _Generic |  |
+| test.c:153:3:153:57 | _Generic | Generic matched default selection, as controlling argument type const volatile int * does not undergo pointer conversion to const volatile void *. | test.c:153:3:153:57 | _Generic |  |
+| test.c:156:3:156:47 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const int *. | test.c:156:3:156:47 | _Generic |  |
+| test.c:157:3:157:50 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to volatile int *. | test.c:157:3:157:50 | _Generic |  |
+| test.c:158:3:158:56 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const volatile int *. | test.c:158:3:158:56 | _Generic |  |
+| test.c:159:3:159:42 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to void *. | test.c:159:3:159:42 | _Generic |  |
+| test.c:160:3:160:48 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const void *. | test.c:160:3:160:48 | _Generic |  |
+| test.c:161:3:161:57 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const volatile void *. | test.c:161:3:161:57 | _Generic |  |
+| test.c:163:3:163:41 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to int *. | test.c:163:3:163:41 | _Generic |  |
+| test.c:165:3:165:42 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to void *. | test.c:165:3:165:42 | _Generic |  |
+| test.c:166:3:166:48 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const void *. | test.c:166:3:166:48 | _Generic |  |
+| test.c:167:3:167:57 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const volatile void *. | test.c:167:3:167:57 | _Generic |  |
+| test.c:172:3:172:56 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to const volatile int *. | test.c:172:3:172:56 | _Generic |  |
+| test.c:180:3:180:50 | _Generic | Generic matched default selection, as controlling argument type int(*)[3] does not undergo pointer conversion to int(*const)[3]. | test.c:180:3:180:50 | _Generic |  |
+| test.c:188:3:192:16 | _Generic | Generic matched default selection, as controlling argument type int(*)[3] does not undergo pointer conversion to int(*const)[3]. | test.c:188:3:192:16 | _Generic |  |
+| test.c:201:3:201:49 | _Generic | Generic matched default selection, as controlling argument type void * does not undergo pointer conversion to int *. | test.c:201:3:201:49 | _Generic |  |
+| test.c:202:3:202:49 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to void *. | test.c:202:3:202:49 | _Generic |  |
+| test.c:216:3:216:46 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const int *. | test.c:216:3:216:46 | _Generic |  |
+| test.c:217:3:217:48 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to const int_t *. | test.c:217:3:217:48 | _Generic |  |
+| test.c:218:3:218:44 | _Generic | Generic matched default selection, as controlling argument type int * does not undergo pointer conversion to c_int_t *. | test.c:218:3:218:44 | _Generic |  |
+| test.c:222:3:222:47 | _Generic | Generic matched default selection, as controlling argument type int_t * does not undergo pointer conversion to const int *. | test.c:222:3:222:47 | _Generic |  |
+| test.c:223:3:223:49 | _Generic | Generic matched default selection, as controlling argument type int_t * does not undergo pointer conversion to const int_t *. | test.c:223:3:223:49 | _Generic |  |
+| test.c:224:3:224:45 | _Generic | Generic matched default selection, as controlling argument type int_t * does not undergo pointer conversion to c_int_t *. | test.c:224:3:224:45 | _Generic |  |
+| test.c:226:3:226:40 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to int *. | test.c:226:3:226:40 | _Generic |  |
+| test.c:227:3:227:42 | _Generic | Generic matched default selection, as controlling argument type const int * does not undergo pointer conversion to int_t *. | test.c:227:3:227:42 | _Generic |  |
+| test.c:232:3:232:41 | _Generic | Generic matched default selection, as controlling argument type c_int_t * does not undergo pointer conversion to int *. | test.c:232:3:232:41 | _Generic |  |
+| test.c:233:3:233:43 | _Generic | Generic matched default selection, as controlling argument type c_int_t * does not undergo pointer conversion to int_t *. | test.c:233:3:233:43 | _Generic |  |
diff --git a/c/misra/test/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.qlref b/c/misra/test/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.qlref
new file mode 100644
index 0000000000..c6b02b6273
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.qlref
@@ -0,0 +1 @@
+rules/RULE-23-5/DangerousDefaultSelectionForPointerInGeneric.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-5/test.c b/c/misra/test/rules/RULE-23-5/test.c
new file mode 100644
index 0000000000..5d48cc58bd
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-5/test.c
@@ -0,0 +1,237 @@
+void f1();
+
+void f2() {
+  int l1;
+  int *l2;
+  const int *l3;
+  volatile int *l4;
+  volatile const int *l5;
+  void *l6;
+  const void *l7;
+  volatile void *l8;
+  const volatile void *l9;
+
+  // No violation for missing pointer/integral conversions:
+  _Generic(l1, // COMPLIANT
+      int *: f1,
+      const int *: f1,
+      volatile int *: f1,
+      void *: f1,
+      const void *: f1,
+      default: f1);                   // COMPLIANT
+  _Generic(l2, int : f1, default : f1); // COMPLIANT
+  _Generic(l3, int : f1, default : f1); // COMPLIANT
+  _Generic(l4, int : f1, default : f1); // COMPLIANT
+  _Generic(l5, int : f1, default : f1); // COMPLIANT
+
+  // Compliant, default case is not matched
+  _Generic(l1, int : f1);                   // COMPLIANT
+  _Generic(l2, int * : f1);                 // COMPLIANT
+  _Generic(l3, const int * : f1);           // COMPLIANT
+  _Generic(l4, volatile int * : f1);        // COMPLIANT
+  _Generic(l5, volatile const int * : f1);  // COMPLIANT
+  _Generic(l6, void * : f1);                // COMPLIANT
+  _Generic(l7, const void * : f1);          // COMPLIANT
+  _Generic(l8, volatile void * : f1);       // COMPLIANT
+  _Generic(l9, const volatile void * : f1); // COMPLIANT
+
+  // Violation, match default case due to lack of pointer to pointer
+  // conversions:
+  _Generic(l2, int * : f1, default : f1);                 // COMPLIANT
+  _Generic(l2, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l2, volatile int * : f1, default : f1);        // NON-COMPLIANT
+  _Generic(l2, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l2, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l2, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l2, const volatile void * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l3, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l3, const int * : f1, default : f1);           // COMPLIANT
+  _Generic(l3, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l3, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l3, const volatile void * : f1, default : f1); // NON-COMPLIANT
+  // Obviously not volatile:
+  _Generic(l3, volatile int * : f1, default : f1); // COMPLIANT
+  // Debatable, but volatile const int* is assignable to const int* so its
+  // considered risky
+  _Generic(l3, const volatile int * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l4, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l4, volatile int * : f1, default : f1);        // COMPLIANT
+  _Generic(l4, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l4, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l4, const volatile void * : f1, default : f1); // NON-COMPLIANT
+  // Debatable, but volatile int* isn't assignable to const int* or vice versa.
+  _Generic(l4, const int * : f1, default : f1); // COMPLIANT
+  // Debatable, but volatile int* isn't assignable to const void* or vice versa.
+  _Generic(l4, const void * : f1, default : f1); // COMPLIANT
+
+  _Generic(l5, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l5, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l5, volatile int * : f1, default : f1);        // NON-COMPLIANT
+  _Generic(l5, const volatile int * : f1, default : f1);  // COMPLIANT
+  _Generic(l5, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l5, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l5, const volatile void * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l6, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l6, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l6, volatile int * : f1, default : f1);        // NON-COMPLIANT
+  _Generic(l6, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l6, void * : f1, default : f1);                // COMPLIANT
+  _Generic(l6, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l6, const volatile void * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l7, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l7, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l7, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l7, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l7, const void * : f1, default : f1);          // COMPLIANT
+  _Generic(l7, const volatile void * : f1, default : f1); // NON-COMPLIANT
+  // Debatable, but const void* isn't assignable to volatile int* or vice versa.
+  _Generic(l7, volatile int * : f1, default : f1); // COMPLIANT
+
+  _Generic(l9, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l9, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l9, volatile int * : f1, default : f1);        // NON-COMPLIANT
+  _Generic(l9, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l9, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l9, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l9, const volatile void * : f1, default : f1); // COMPLIANT
+
+  /**
+   * Edge case 1: The controlling expression undergoes lvalue conversion, so
+   * arrays become pointers and qualifiers on pointers are stripped.
+   */
+  int l10[3];
+  const int l11[3];
+  volatile int l12[3];
+  const volatile int l13[3];
+  int *const l14;
+  const int *const l15;
+
+  _Generic(l10, int * : f1, default : f1);                // COMPLIANT
+  _Generic(l11, const int * : f1, default : f1);          // COMPLIANT
+  _Generic(l12, volatile int * : f1, default : f1);       // COMPLIANT
+  _Generic(l13, const volatile int * : f1, default : f1); // COMPLIANT
+
+  _Generic(l10, int * : f1, default : f1);                 // COMPLIANT
+  _Generic(l10, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l10, volatile int * : f1, default : f1);        // NON-COMPLIANT
+  _Generic(l10, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l10, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l10, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l10, const volatile void * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l11, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l11, const int * : f1, default : f1);           // COMPLIANT
+  _Generic(l11, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l11, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l11, const volatile void * : f1, default : f1); // NON-COMPLIANT
+  // Obviously not volatile:
+  _Generic(l11, volatile int * : f1, default : f1); // COMPLIANT
+  // Debatable, but volatile const int* is assignable to const int* so its
+  // considered risky
+  _Generic(l11, const volatile int * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l12, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l12, volatile int * : f1, default : f1);        // COMPLIANT
+  _Generic(l12, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l12, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l12, const volatile void * : f1, default : f1); // NON-COMPLIANT
+  // Debatab12e, but volatile int* isn't assignable to const int* or vice versa.
+  _Generic(l12, const int * : f1, default : f1); // COMPLIANT
+  // Debatable, but volatile int* isn't assignable to const void* or vice versa.
+  _Generic(l12, const void * : f1, default : f1); // COMPLIANT
+
+  _Generic(l13, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l13, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l13, volatile int * : f1, default : f1);        // NON-COMPLIANT
+  _Generic(l13, const volatile int * : f1, default : f1);  // COMPLIANT
+  _Generic(l13, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l13, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l13, const volatile void * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l14, int * : f1, default : f1);                 // COMPLIANT
+  _Generic(l14, const int * : f1, default : f1);           // NON-COMPLIANT
+  _Generic(l14, volatile int * : f1, default : f1);        // NON-COMPLIANT
+  _Generic(l14, const volatile int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic(l14, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l14, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l14, const volatile void * : f1, default : f1); // NON-COMPLIANT
+
+  _Generic(l15, int * : f1, default : f1);                 // NON-COMPLIANT
+  _Generic(l15, const int * : f1, default : f1);           // COMPLIANT
+  _Generic(l15, void * : f1, default : f1);                // NON-COMPLIANT
+  _Generic(l15, const void * : f1, default : f1);          // NON-COMPLIANT
+  _Generic(l15, const volatile void * : f1, default : f1); // NON-COMPLIANT
+  // Obviously not volatile:
+  _Generic(l15, volatile int * : f1, default : f1); // COMPLIANT
+  // Debatable, but volatile const int* is assignable to const int* so its
+  // considered risky
+  _Generic(l15, const volatile int * : f1, default : f1); // NON-COMPLIANT
+
+  /**
+   * Edge case 2: Types don't have to be identical to be compatible.
+   */
+  int(*l16)[3];
+
+  // This is a risky conversion that should be reported:
+  _Generic(l16, int(*const)[3] : f1, default : f1); // NON-COMPLIANT
+  // However, in this one, there is a match on the second selector, because it
+  // it is an array type with a compatible element type, and sizes only have to
+  // match if both arrays have a constant size. Therefore, the default selector
+  // is not chosen and this is not a violation.
+  _Generic(l16, int(*const)[3] : f1, int(*)[] : f1, default : f1); // COMPLIANT
+  // In this case, the second selector is not a compatible type because the
+  // array has a constant size that doesn't match, and this should be reported.
+  _Generic(l16, int(*const)[3]
+           : f1, int(*)[4]
+           : f1,
+             default
+           : f1); // NON-COMPLIANT
+
+  /**
+   * Edge case 3: Conversion on _Generic, make sure we use the fully converted
+   * type when considering compliance.
+   */
+  int *l17;
+  void *l18;
+  _Generic((void *)l17, void * : f1, default : f1); // COMPLIANT
+  _Generic((void *)l17, int * : f1, default : f1);  // NON-COMPLIANT
+  _Generic((int *)l18, void * : f1, default : f1);  // NON-COMPLIANT
+  _Generic((int *)l18, int * : f1, default : f1);   // COMPLIANT
+
+  /**
+   * Edge case 4: Typedefs must be resolved properly.
+   */
+  typedef int int_t;
+  const typedef int c_int_t;
+  int_t *l19;
+  c_int_t *l20;
+  volatile c_int_t *l21;
+
+  _Generic(l2, int * : f1, default : f1);         // COMPLIANT
+  _Generic(l2, int_t * : f1, default : f1);       // COMPLIANT
+  _Generic(l2, const int * : f1, default : f1);   // NON-COMPLIANT
+  _Generic(l2, const int_t * : f1, default : f1); // NON-COMPLIANT
+  _Generic(l2, c_int_t * : f1, default : f1);     // NON-COMPLIANT
+
+  _Generic(l19, int * : f1, default : f1);         // COMPLIANT
+  _Generic(l19, int_t * : f1, default : f1);       // COMPLIANT
+  _Generic(l19, const int * : f1, default : f1);   // NON-COMPLIANT
+  _Generic(l19, const int_t * : f1, default : f1); // NON-COMPLIANT
+  _Generic(l19, c_int_t * : f1, default : f1);     // NON-COMPLIANT
+
+  _Generic(l3, int * : f1, default : f1);         // NON-COMPLIANT
+  _Generic(l3, int_t * : f1, default : f1);       // NON-COMPLIANT
+  _Generic(l3, const int * : f1, default : f1);   // COMPLIANT
+  _Generic(l3, const int_t * : f1, default : f1); // COMPLIANT
+  _Generic(l3, c_int_t * : f1, default : f1);     // COMPLIANT
+
+  _Generic(l20, int * : f1, default : f1);         // NON-COMPLIANT
+  _Generic(l20, int_t * : f1, default : f1);       // NON-COMPLIANT
+  _Generic(l20, const int * : f1, default : f1);   // COMPLIANT
+  _Generic(l20, const int_t * : f1, default : f1); // COMPLIANT
+  _Generic(l20, c_int_t * : f1, default : f1);     // COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.expected b/c/misra/test/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.expected
new file mode 100644
index 0000000000..4f02d039ce
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.expected
@@ -0,0 +1,4 @@
+| test.c:11:3:11:8 | _Generic | Controlling expression in generic macro $@ has standard type (unnamed enum), which doesn't match its essential type (unnamed enum). | test.c:6:1:6:75 | #define M1(X) _Generic((X), int : 1, unsigned int : 1, short : 2, long : 3) | M1 |
+| test.c:15:3:15:13 | _Generic | Controlling expression in generic macro $@ has standard type int, which doesn't match its essential type short. | test.c:6:1:6:75 | #define M1(X) _Generic((X), int : 1, unsigned int : 1, short : 2, long : 3) | M1 |
+| test.c:18:3:18:24 | _Generic | Controlling expression in generic has standard type int, which doesn't match its essential type char. | test.c:18:3:18:24 | _Generic |  |
+| test.c:19:3:19:55 | _Generic | Controlling expression in generic has standard type int, which doesn't match its essential type short. | test.c:19:3:19:55 | _Generic |  |
diff --git a/c/misra/test/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.qlref b/c/misra/test/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.qlref
new file mode 100644
index 0000000000..b91bbefec6
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.qlref
@@ -0,0 +1 @@
+rules/RULE-23-6/GenericExpressionWithIncorrectEssentialType.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-6/test.c b/c/misra/test/rules/RULE-23-6/test.c
new file mode 100644
index 0000000000..2b18f4cd2c
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-6/test.c
@@ -0,0 +1,33 @@
+short l1;
+int l2;
+long l3;
+enum { E1 } l4;
+
+#define M1(X) _Generic((X), int : 1, unsigned int : 1, short : 2, long : 3)
+void f1() {
+  M1(l1); // COMPLIANT
+  M1(l2); // COMPLIANT
+  M1(l3); // COMPLIANT
+  M1(l4); // NON-COMPLIANT
+
+  M1(1);                  // COMPLIANT
+  M1(1u);                 // COMPLIANT
+  M1(l1 + l1);            // NON-COMPLIANT
+  M1((int)(l1 + l1));     // COMPLIANT
+  M1('c');                // NON-COMPLIANT[false negative]
+  _Generic('c', int : 1); // NON-COMPLIANT
+  _Generic(_Generic(0, default : l1 + l1), default : 1); // NON-COMPLIANT
+  _Generic(((short)_Generic(0, default : (l1 + l1))), default : 1); // COMPLIANT
+}
+
+void f2() {
+  // Edge case: lvalue conversion of a const struct yields an implicit
+  // conversion to a non-const struct which is ignored by EssentialTypes.qll,
+  // meaning the essential type does not match the static type. However, we
+  // shouldn't report an issue here as the static/essential types are not one
+  // of the essential type categories.
+  struct S1 {
+    int m1;
+  };
+  _Generic((const struct S1){.m1 = 0}, default : 1);
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.expected b/c/misra/test/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.expected
new file mode 100644
index 0000000000..47a8acce92
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.expected
@@ -0,0 +1,12 @@
+| test.c:9:1:9:53 | #define M3(X) _Generic((X), int : f1(X), default : 0) | Generic macro M3 may have unexpected behavior from side effects in parameter X, as it is not expanded in generic selection 2. |
+| test.c:10:1:10:63 | #define M4(X) (X) + _Generic((X), int : f1(X), default : f1(X)) | Generic macro M4 may have unexpected behavior from side effects in parameter X, as it is expanded outside the generic selection and inside the generic selection. |
+| test.c:11:1:11:63 | #define M5(X) _Generic((X), int : f1(X), default : f1(X)) + (X) | Generic macro M5 may have unexpected behavior from side effects in parameter X, as it is expanded outside the generic selection and inside the generic selection. |
+| test.c:12:1:12:65 | #define M6(X) _Generic((X), int : f1((X) + (X)), default : f1(X)) | Generic macro M6 may have unexpected behavior from side effects in parameter X, as it is expanded in generic selection 1 more than once. |
+| test.c:21:1:21:37 | #define M9(X) _Generic((X), int : f1) | Generic macro M9 may have unexpected behavior from side effects in parameter X, as it is not expanded in generic selection 1. |
+| test.c:23:1:23:41 | #define M10(X) _Generic((X), int : f1(1)) | Generic macro M10 may have unexpected behavior from side effects in parameter X, as it is not expanded in generic selection 1. |
+| test.c:32:1:32:60 | #define M12(X) _Generic((X) + (X), int : f1(X), default : 1) | Generic macro M12 may have unexpected behavior from side effects in parameter X, as it is not expanded in generic selection 2. |
+| test.c:33:1:33:70 | #define M13(X) _Generic((X) + (X), int : f1(X), default : f1(X)) + (X) | Generic macro M13 may have unexpected behavior from side effects in parameter X, as it is expanded outside the generic selection and inside the generic selection. |
+| test.c:43:1:43:79 | #define M17(X,Y) _Generic((X) + (Y), int : f2((X), (Y)), default : f2((X), 1)) | Generic macro M17 may have unexpected behavior from side effects in parameter Y, as it is not expanded in generic selection 2. |
+| test.c:68:1:68:80 | #define M26(X) _Generic((X), int : IGNORE_2ND(X, X), default : IGNORE_2ND(X, X)) | Generic macro M26 may have unexpected behavior from side effects in parameter X, as it is expanded in generic selection 1 more than once. |
+| test.c:68:1:68:80 | #define M26(X) _Generic((X), int : IGNORE_2ND(X, X), default : IGNORE_2ND(X, X)) | Generic macro M26 may have unexpected behavior from side effects in parameter X, as it is expanded in generic selection 2 more than once. |
+| test.c:69:1:69:77 | #define M27(X) _Generic((X), int : f1(IGNORE(X)), default : f1(IGNORE(X)))(X) | Generic macro M27 may have unexpected behavior from side effects in parameter X, as it is expanded outside the generic selection and inside the generic selection. |
diff --git a/c/misra/test/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.qlref b/c/misra/test/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.qlref
new file mode 100644
index 0000000000..3156bdce91
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.qlref
@@ -0,0 +1 @@
+rules/RULE-23-7/InvalidGenericMacroArgumentEvaluation.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-7/test.c b/c/misra/test/rules/RULE-23-7/test.c
new file mode 100644
index 0000000000..e2f5e98ee5
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-7/test.c
@@ -0,0 +1,72 @@
+int f1(int p1);
+int f2(int p1, int p2);
+
+// COMPLIANT -- standard correct cases:
+#define M1(X) _Generic((X), int : f1, default : f1)(X)
+#define M2(X) _Generic((X), int : f1(X), default : f1(X))
+
+// NON-COMPLIANT -- standard incorrect cases:
+#define M3(X) _Generic((X), int : f1(X), default : 0)
+#define M4(X) (X) + _Generic((X), int : f1(X), default : f1(X))
+#define M5(X) _Generic((X), int : f1(X), default : f1(X)) + (X)
+#define M6(X) _Generic((X), int : f1((X) + (X)), default : f1(X))
+
+// Compliant by exception
+// COMPLIANT
+#define M7(X) _Generic((X), int : 1, default : 0)
+// NON-COMPLIANT[FALSE NEGATIVE] -- Without an expansion, we can't tell if this
+// macro has only constant expressions or not.
+#define M8(X) _Generic((X), int : f1(1))
+// NON-COMPLIANT -- If the macro is expanded we can detect constant expressions
+#define M9(X) _Generic((X), int : f1)
+// NON-COMPLIANT -- If the macro is expanded we can detect constant expressions
+#define M10(X) _Generic((X), int : f1(1))
+void f3() {
+  M9(1);
+  M10(1);
+}
+
+// COMPLIANT -- multiple uses in the controlling expression is OK:
+#define M11(X) _Generic((X) + (X), int : f1(X), default : f1(X))
+// NON-COMPLIANT -- the rule should still be enforced otherwise:
+#define M12(X) _Generic((X) + (X), int : f1(X), default : 1)
+#define M13(X) _Generic((X) + (X), int : f1(X), default : f1(X)) + (X)
+
+// COMPLIANT -- the argument is not used in the controlling expression:
+#define M14(X) _Generic(1, int : f1((X) + (X)), default : f1(X))
+#define M15(X) _Generic(1, int : f1(X), default : f1(X)) + (X)
+
+// Test cases with more than one argument:
+// COMPLIANT -- Y is not used in the controlling expression:
+#define M16(X, Y) _Generic((X), int : f2((X), (Y)), default : f2((X), 1))
+// NON-COMPLIANT -- Y is used in the controlling expression
+#define M17(X, Y) _Generic((X) + (Y), int : f2((X), (Y)), default : f2((X), 1))
+// COMPLIANT -- Y is used in the controlling expression correctly
+#define M18(X, Y)                                                              \
+  _Generic((X) + (Y), int : f2((X), (Y)), default : f2((X), (Y)))
+
+// Test unevaluated contexts:
+// COMPLIANT -- sizeof is not evaluated:
+#define M19(X) _Generic((X), int[sizeof(X)] : f1, default : f1)(X)
+#define M20(X) _Generic((X), int : f1(sizeof(X)), default : f1)(X)
+#define M21(X) _Generic((X), int : f1(X), default : f1(X)) + sizeof(X)
+// NON-COMPLIANT[FALSE NEGATIVE] -- sizeof plus evaluated context
+#define M22(X) _Generic((X), int : f1(sizeof(X) + X), default : f1(X))(X)
+// NON-COMPLIANT[FALSE NEGATIVE] -- array type sizes may be evaluated
+#define M23(X) _Generic((X), int[X] : f1, default : f1)(X)
+// COMPLIANT -- alignof, typeof are not evaluated:
+#define M24(X) _Generic((X), int[X] : f1, default : f1)(X)
+
+// Nested macros:
+#define ONCE(X) (X)
+#define TWICE(X) (X) + (X)
+#define IGNORE(X) (1)
+#define IGNORE_2ND(X, Y) (X)
+// COMPLIANT
+#define M25(X) _Generic((X), int: ONCE(f1(X)), default: ONCE(f1(X))
+// COMPLIANT[FALSE POSITIVE]
+#define M26(X) _Generic((X), int : IGNORE_2ND(X, X), default : IGNORE_2ND(X, X))
+#define M27(X) _Generic((X), int : f1(IGNORE(X)), default : f1(IGNORE(X)))(X)
+// NON-COMPLIANT[FASE NEGATIVE]
+#define M28(X) _Generic((X), int : f1(IGNORE(X)), default : f1(IGNORE(X)))
+#define M29(X) _Generic((X), int : TWICE(f1(X)), default : TWICE(f1(X)))
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.expected b/c/misra/test/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.expected
new file mode 100644
index 0000000000..fb407e2ff1
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.expected
@@ -0,0 +1,4 @@
+| test.c:11:1:11:67 | #define M4(X) _Generic((X), int : 1, default : 0, unsigned int : 2) | Generic macro M4 has default as 2nd association, which is not first or last. | test.c:11:1:11:67 | #define M4(X) _Generic((X), int : 1, default : 0, unsigned int : 2) | (ignored) |
+| test.c:17:1:17:62 | #define M5(__VA_ARGS__...) _Generic(0, __VA_ARGS__, default : 0, int : 1) | Generic macro M5 has a default association which is not first or last, for example $@. | test.c:30:3:30:22 | _Generic | 2nd |
+| test.c:37:3:37:27 | M6(__VA_ARGS__...) | Generic macro $@, in this expansion, has default as 2nd association, which is not first or last. | test.c:19:1:19:49 | #define M6(__VA_ARGS__...) _Generic(0, __VA_ARGS__, int : 1) | M6 |
+| test.c:48:3:48:53 | _Generic | Generic has default as 2nd association, which is not first or last. | test.c:48:3:48:53 | _Generic |  |
diff --git a/c/misra/test/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.qlref b/c/misra/test/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.qlref
new file mode 100644
index 0000000000..06fe786e7d
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.qlref
@@ -0,0 +1 @@
+rules/RULE-23-8/DefaultGenericSelectionNotFirstOrLast.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-23-8/test.c b/c/misra/test/rules/RULE-23-8/test.c
new file mode 100644
index 0000000000..340ddb16db
--- /dev/null
+++ b/c/misra/test/rules/RULE-23-8/test.c
@@ -0,0 +1,49 @@
+/**
+ * Cases where the macro itself is always compliant or non compliant:
+ */
+// COMPLIANT
+#define M1(X) _Generic((X), int : 1, unsigned int : 2)
+// COMPLIANT
+#define M2(X) _Generic((X), int : 1, unsigned int : 2, default : 0)
+// COMPLIANT
+#define M3(X) _Generic((X), default : 0, int : 1, unsigned int : 2)
+// NON-COMPLIANT
+#define M4(X) _Generic((X), int : 1, default : 0, unsigned int : 2)
+
+/**
+ * Macros that are compliant or not based on use:
+ */
+// NON-COMPLIANT: because every use is non compliant
+#define M5(...) _Generic(0, __VA_ARGS__, default : 0, int : 1)
+// COMPLIANT: because some uses are compliant
+#define M6(...) _Generic(0, __VA_ARGS__, int : 1)
+
+void f1() {
+  M1(0); // COMPLIANT
+  M2(0); // COMPLIANT
+  M3(0); // COMPLIANT
+  M4(0); // COMPLIANT: the macro invocation is compliant, the macro definition
+         // is not.
+
+  // COMPLIANT: all invocations of M5 are non compliant so the macro is reported
+  // instead.
+  M5(unsigned int : 1);
+  M5(unsigned int : 1, long : 2);
+
+  // Some invocations of M6() will be compliant, so we'll report the issue at
+  // each invocation.
+  M6(default : 0);           // COMPLIANT
+  M6(default : 0, long : 1); // COMPLIANT
+  M6(long : 1, default : 0); // NON-COMPLIANT
+}
+
+/**
+ * For completeness, non macro cases, though these are not likely and violate
+ * RULE-23-1.
+ */
+void f2() {
+  _Generic(0, int : 1, unsigned int : 2);              // COMPLIANT
+  _Generic(0, int : 1, unsigned int : 2, default : 0); // COMPLIANT
+  _Generic(0, default : 0, int : 1, unsigned int : 2); // COMPLIANT
+  _Generic(0, int : 1, default : 0, unsigned int : 2); // NON-COMPLIANT
+}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.expected b/c/misra/test/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.expected
index 5e876cecc3..3c4cab00b1 100644
--- a/c/misra/test/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.expected
+++ b/c/misra/test/rules/RULE-3-1/CharacterSequencesAndUsedWithinAComment.expected
@@ -1,3 +1,6 @@
 | test.c:9:1:9:8 | /* /* */ | Comment contains an illegal sequence '/*' |
 | test.c:12:1:12:8 | /* // */ | Comment contains an illegal sequence '//' |
 | test.c:21:1:21:7 | //  /*  | Comment contains an illegal sequence '/*' |
+| test.c:30:1:30:27 | /* https://github.com // */ | Comment contains an illegal sequence '//' |
+| test.c:33:1:33:60 | /* a://b, a://b., ://a.b, a://b., a://.b, ://, a://, ://b */ | Comment contains an illegal sequence '//' |
+| test.c:42:1:42:8 | ///* foo | Comment contains an illegal sequence '/*' |
diff --git a/c/misra/test/rules/RULE-3-1/test.c b/c/misra/test/rules/RULE-3-1/test.c
index c1a135f972..fd7a6574dd 100644
--- a/c/misra/test/rules/RULE-3-1/test.c
+++ b/c/misra/test/rules/RULE-3-1/test.c
@@ -20,4 +20,25 @@
 // NON_COMPLIANT
 //  /* 
 
+// COMPLIANT
+/* https://github.com */
+
+// COMPLIANT
+/* https://name-with-hyphen-and-num-12345.com */
+
+// NON_COMPLIANT
+/* https://github.com // */
+
+// NON_COMPLIANT
+/* a://b, a://b., ://a.b, a://b., a://.b, ://, a://, ://b */
+
+// COMPLIANT
+// https://github.com
+
+// COMPLIANT
+//* foo
+
+// NON_COMPLIANT
+///* foo
+
 void f(){}
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-5-4/MacroIdentifiersNotDistinct.expected b/c/misra/test/rules/RULE-5-4/MacroIdentifiersNotDistinct.expected
index d44164d116..b079b7e94d 100644
--- a/c/misra/test/rules/RULE-5-4/MacroIdentifiersNotDistinct.expected
+++ b/c/misra/test/rules/RULE-5-4/MacroIdentifiersNotDistinct.expected
@@ -1,4 +1,4 @@
-| header3.h:7:1:7:24 | #define MULTIPLE_INCLUDE | Definition of macro MULTIPLE_INCLUDE is not distinct from alternative definition of $@ in rules/RULE-5-4/header4.h. | header4.h:1:1:1:24 | #define MULTIPLE_INCLUDE | MULTIPLE_INCLUDE |
-| header3.h:14:1:14:21 | #define NOT_PROTECTED | Definition of macro NOT_PROTECTED is not distinct from alternative definition of $@ in rules/RULE-5-4/header4.h. | header4.h:12:1:12:23 | #define NOT_PROTECTED 1 | NOT_PROTECTED |
+| header3.h:7:1:7:24 | #define MULTIPLE_INCLUDE | Definition of macro MULTIPLE_INCLUDE is not distinct from alternative definition of $@ in header4.h. | header4.h:1:1:1:24 | #define MULTIPLE_INCLUDE | MULTIPLE_INCLUDE |
+| header3.h:14:1:14:21 | #define NOT_PROTECTED | Definition of macro NOT_PROTECTED is not distinct from alternative definition of $@ in header4.h. | header4.h:12:1:12:23 | #define NOT_PROTECTED 1 | NOT_PROTECTED |
 | test.c:2:1:2:72 | #define iltiqzxgfqsgigwfuyntzghvzltueatcxqnqofnnvjyszmcsylyohvqaosjbqyyB | Macro identifer iltiqzxgfqsgigwfuyntzghvzltueatcxqnqofnnvjyszmcsylyohvqaosjbqyyB is nondistinct in first 63 characters, compared to $@. | test.c:1:1:1:72 | #define iltiqzxgfqsgigwfuyntzghvzltueatcxqnqofnnvjyszmcsylyohvqaosjbqyyA | iltiqzxgfqsgigwfuyntzghvzltueatcxqnqofnnvjyszmcsylyohvqaosjbqyyA |
-| test.c:8:1:8:31 | #define FUNCTION_MACRO(X) X + 1 | Definition of macro FUNCTION_MACRO is not distinct from alternative definition of $@ in rules/RULE-5-4/test.c. | test.c:7:1:7:57 | #define FUNCTION_MACRO(FUNCTION_MACRO) FUNCTION_MACRO + 1 | FUNCTION_MACRO |
+| test.c:8:1:8:31 | #define FUNCTION_MACRO(X) X + 1 | Definition of macro FUNCTION_MACRO is not distinct from alternative definition of $@ in test.c. | test.c:7:1:7:57 | #define FUNCTION_MACRO(FUNCTION_MACRO) FUNCTION_MACRO + 1 | FUNCTION_MACRO |
diff --git a/c/misra/test/rules/RULE-7-4/StringLiteralAssignedToNonConstChar.expected b/c/misra/test/rules/RULE-7-4/StringLiteralAssignedToNonConstChar.expected
index 46b8e5a47b..208e98f632 100644
--- a/c/misra/test/rules/RULE-7-4/StringLiteralAssignedToNonConstChar.expected
+++ b/c/misra/test/rules/RULE-7-4/StringLiteralAssignedToNonConstChar.expected
@@ -6,3 +6,4 @@
 | test.c:58:5:58:22 | return ... | wchar_t * function w_sample3 is returning a string literal. |
 | test.c:69:3:69:9 | call to sample4 | char * parameter of sample4 is passed a string literal. |
 | test.c:78:3:78:11 | call to w_sample4 | wchar_t * parameter of w_sample4 is passed a string literal. |
+| test.c:91:3:91:11 | call to w_sample7 | char * parameter of w_sample7 is passed a string literal. |
diff --git a/c/misra/test/rules/RULE-7-4/test.c b/c/misra/test/rules/RULE-7-4/test.c
index c178915200..ab7ea21ce9 100644
--- a/c/misra/test/rules/RULE-7-4/test.c
+++ b/c/misra/test/rules/RULE-7-4/test.c
@@ -79,4 +79,16 @@ void w_call45() {
   w_sample5(L"string9"); // COMPLIANT: passing string literal to const char*
 }
 
+void w_sample6(int x, ...) {}
+
+void w_call6() {
+  w_sample6(1, "string10"); // COMPLIANT by first (and only) exception
+}
+
+void w_sample7(char *x, ...) {}
+
+void w_call7() {
+  w_sample7("string11", 1); // NON_COMPLIANT, does not fit exceptional case
+}
+
 int main() { return 0; }
diff --git a/c/misra/test/rules/RULE-8-15/RedeclarationOfObjectWithUnmatchedAlignment.expected.gcc b/c/misra/test/rules/RULE-8-15/RedeclarationOfObjectWithUnmatchedAlignment.expected.gcc
index f1054946a7..6f3d414214 100644
--- a/c/misra/test/rules/RULE-8-15/RedeclarationOfObjectWithUnmatchedAlignment.expected.gcc
+++ b/c/misra/test/rules/RULE-8-15/RedeclarationOfObjectWithUnmatchedAlignment.expected.gcc
@@ -1,10 +1,10 @@
-| test.c:11:8:11:15 | alignas(...) | Variable g4 declared with lexically different _Alignof() values '$@' and '$@' | test.c:11:8:11:15 | alignas(...) | 16 | test.c:12:8:12:15 | alignas(...) | 32 |
-| test.c:12:8:12:15 | alignas(...) | Variable g4 declared with lexically different _Alignof() values '$@' and '$@' | test.c:12:8:12:15 | alignas(...) | 32 | test.c:11:8:11:15 | alignas(...) | 16 |
-| test.c:18:8:18:15 | alignas(...) | Variable g6 declared with lexically different _Alignof() values '$@' and '$@' | test.c:18:8:18:15 | alignas(...) | int | test.c:19:8:19:15 | alignas(...) | 4 |
-| test.c:19:8:19:15 | alignas(...) | Variable g6 declared with lexically different _Alignof() values '$@' and '$@' | test.c:19:8:19:15 | alignas(...) | 4 | test.c:18:8:18:15 | alignas(...) | int |
-| test.c:22:8:22:15 | alignas(...) | Variable g7 declared with lexically different _Alignof() values '$@' and '$@' | test.c:22:8:22:15 | alignas(...) | ... * ... | test.c:23:8:23:15 | alignas(...) | 32 |
-| test.c:23:8:23:15 | alignas(...) | Variable g7 declared with lexically different _Alignof() values '$@' and '$@' | test.c:23:8:23:15 | alignas(...) | 32 | test.c:22:8:22:15 | alignas(...) | ... * ... |
-| test.c:28:8:28:15 | alignas(...) | Variable g9 declared with lexically different _Alignof() values '$@' and '$@' | test.c:28:8:28:15 | alignas(...) | ... * ... | test.c:29:8:29:15 | alignas(...) | ... * ... |
-| test.c:29:8:29:15 | alignas(...) | Variable g9 declared with lexically different _Alignof() values '$@' and '$@' | test.c:29:8:29:15 | alignas(...) | ... * ... | test.c:28:8:28:15 | alignas(...) | ... * ... |
-| test.c:34:8:34:15 | alignas(...) | Variable g11 declared with lexically different _Alignof() values '$@' and '$@' | test.c:34:8:34:15 | alignas(...) | signed int | test.c:35:8:35:15 | alignas(...) | unsigned int |
-| test.c:35:8:35:15 | alignas(...) | Variable g11 declared with lexically different _Alignof() values '$@' and '$@' | test.c:35:8:35:15 | alignas(...) | unsigned int | test.c:34:8:34:15 | alignas(...) | signed int |
+| test.c:11:8:11:15 | alignas(...) | Variable g4 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:11:8:11:15 | alignas(...) | 16 | test.c:12:8:12:15 | alignas(...) | 32 |
+| test.c:12:8:12:15 | alignas(...) | Variable g4 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:12:8:12:15 | alignas(...) | 32 | test.c:11:8:11:15 | alignas(...) | 16 |
+| test.c:18:8:18:15 | alignas(...) | Variable g6 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:18:8:18:15 | alignas(...) | int | test.c:19:8:19:15 | alignas(...) | 4 |
+| test.c:19:8:19:15 | alignas(...) | Variable g6 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:19:8:19:15 | alignas(...) | 4 | test.c:18:8:18:15 | alignas(...) | int |
+| test.c:22:8:22:15 | alignas(...) | Variable g7 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:22:8:22:15 | alignas(...) | ... * ... | test.c:23:8:23:15 | alignas(...) | 32 |
+| test.c:23:8:23:15 | alignas(...) | Variable g7 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:23:8:23:15 | alignas(...) | 32 | test.c:22:8:22:15 | alignas(...) | ... * ... |
+| test.c:28:8:28:15 | alignas(...) | Variable g9 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:28:8:28:15 | alignas(...) | ... * ... | test.c:29:8:29:15 | alignas(...) | ... * ... |
+| test.c:29:8:29:15 | alignas(...) | Variable g9 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:29:8:29:15 | alignas(...) | ... * ... | test.c:28:8:28:15 | alignas(...) | ... * ... |
+| test.c:34:8:34:15 | alignas(...) | Variable g11 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:34:8:34:15 | alignas(...) | signed int | test.c:35:8:35:15 | alignas(...) | unsigned int |
+| test.c:35:8:35:15 | alignas(...) | Variable g11 declared with lexically different _Alignof() values '$@' and '$@'. | test.c:35:8:35:15 | alignas(...) | unsigned int | test.c:34:8:34:15 | alignas(...) | signed int |
diff --git a/c/misra/test/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.expected b/c/misra/test/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.expected
index 08e419ef4f..f2b438aaf1 100644
--- a/c/misra/test/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.expected
+++ b/c/misra/test/rules/RULE-8-3/DeclarationsOfAFunctionSameNameAndType.expected
@@ -1,12 +1,14 @@
-| function1.c:6:6:6:7 | declaration of f3 | The return type of re-declaration of $@ is not compatible with declaration $@ | function1.c:6:6:6:7 | declaration of f3 | f3 | function1.c:8:4:8:5 | declaration of f3 | f3 |
-| function1.c:8:4:8:5 | declaration of f3 | The return type of re-declaration of $@ is not compatible with declaration $@ | function1.c:8:4:8:5 | declaration of f3 | f3 | function1.c:6:6:6:7 | declaration of f3 | f3 |
-| function1.c:8:4:8:5 | declaration of f3 | The return type of re-declaration of $@ is not compatible with declaration $@ | function1.c:8:4:8:5 | declaration of f3 | f3 | function2.c:4:6:4:7 | declaration of f3 | f3 |
-| function1.c:9:6:9:7 | declaration of f4 | The return type of re-declaration of $@ is not compatible with declaration $@ | function1.c:9:6:9:7 | declaration of f4 | f4 | function2.c:5:5:5:6 | declaration of f4 | f4 |
-| function1.c:13:5:13:6 | definition of f6 | The return type of re-declaration of $@ is not compatible with declaration $@ | function1.c:13:5:13:6 | definition of f6 | f6 | function2.c:9:6:9:7 | definition of f6 | f6 |
-| function1.c:21:3:21:5 | definition of f21 | The parameter types of re-declaration of $@ is not compatible with declaration $@ | function1.c:21:3:21:5 | definition of f21 | f21 | function2.c:17:10:17:12 | declaration of f21 | f21 |
-| function1.c:25:6:25:8 | definition of f22 | The parameter names of re-declaration of $@ is not compatible with declaration $@ | function1.c:25:6:25:8 | definition of f22 | f22 | function2.c:19:13:19:15 | declaration of f22 | f22 |
-| function2.c:4:6:4:7 | declaration of f3 | The return type of re-declaration of $@ is not compatible with declaration $@ | function2.c:4:6:4:7 | declaration of f3 | f3 | function1.c:8:4:8:5 | declaration of f3 | f3 |
-| function2.c:5:5:5:6 | declaration of f4 | The return type of re-declaration of $@ is not compatible with declaration $@ | function2.c:5:5:5:6 | declaration of f4 | f4 | function1.c:9:6:9:7 | declaration of f4 | f4 |
-| function2.c:9:6:9:7 | definition of f6 | The return type of re-declaration of $@ is not compatible with declaration $@ | function2.c:9:6:9:7 | definition of f6 | f6 | function1.c:13:5:13:6 | definition of f6 | f6 |
-| function2.c:17:10:17:12 | declaration of f21 | The parameter types of re-declaration of $@ is not compatible with declaration $@ | function2.c:17:10:17:12 | declaration of f21 | f21 | function1.c:21:3:21:5 | definition of f21 | f21 |
-| function2.c:19:13:19:15 | declaration of f22 | The parameter names of re-declaration of $@ is not compatible with declaration $@ | function2.c:19:13:19:15 | declaration of f22 | f22 | function1.c:25:6:25:8 | definition of f22 | f22 |
+| function1.c:6:6:6:7 | declaration of f3 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function1.c:6:6:6:7 | declaration of f3 | f3 | function1.c:8:4:8:5 | declaration of f3 | f3 |
+| function1.c:8:4:8:5 | declaration of f3 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function1.c:8:4:8:5 | declaration of f3 | f3 | function1.c:6:6:6:7 | declaration of f3 | f3 |
+| function1.c:8:4:8:5 | declaration of f3 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function1.c:8:4:8:5 | declaration of f3 | f3 | function2.c:4:6:4:7 | declaration of f3 | f3 |
+| function1.c:9:6:9:7 | declaration of f4 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function1.c:9:6:9:7 | declaration of f4 | f4 | function2.c:5:5:5:6 | declaration of f4 | f4 |
+| function1.c:13:5:13:6 | definition of f6 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function1.c:13:5:13:6 | definition of f6 | f6 | function2.c:9:6:9:7 | definition of f6 | f6 |
+| function1.c:15:5:15:7 | declaration of f20 | The parameter types of re-declaration of $@ do not use the same type names as declaration $@ | function1.c:15:5:15:7 | declaration of f20 | f20 | function2.c:11:5:11:7 | declaration of f20 | f20 |
+| function1.c:21:3:21:5 | definition of f21 | The parameter types of re-declaration of $@ do not use the same type names as declaration $@ | function1.c:21:3:21:5 | definition of f21 | f21 | function2.c:17:10:17:12 | declaration of f21 | f21 |
+| function1.c:25:6:25:8 | definition of f22 | The parameter names of re-declaration of $@ do not use the same type names as declaration $@ | function1.c:25:6:25:8 | definition of f22 | f22 | function2.c:19:13:19:15 | declaration of f22 | f22 |
+| function2.c:4:6:4:7 | declaration of f3 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function2.c:4:6:4:7 | declaration of f3 | f3 | function1.c:8:4:8:5 | declaration of f3 | f3 |
+| function2.c:5:5:5:6 | declaration of f4 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function2.c:5:5:5:6 | declaration of f4 | f4 | function1.c:9:6:9:7 | declaration of f4 | f4 |
+| function2.c:9:6:9:7 | definition of f6 | The return type of re-declaration of $@ does not use the same type names as declaration $@ | function2.c:9:6:9:7 | definition of f6 | f6 | function1.c:13:5:13:6 | definition of f6 | f6 |
+| function2.c:11:5:11:7 | declaration of f20 | The parameter types of re-declaration of $@ do not use the same type names as declaration $@ | function2.c:11:5:11:7 | declaration of f20 | f20 | function1.c:15:5:15:7 | declaration of f20 | f20 |
+| function2.c:17:10:17:12 | declaration of f21 | The parameter types of re-declaration of $@ do not use the same type names as declaration $@ | function2.c:17:10:17:12 | declaration of f21 | f21 | function1.c:21:3:21:5 | definition of f21 | f21 |
+| function2.c:19:13:19:15 | declaration of f22 | The parameter names of re-declaration of $@ do not use the same type names as declaration $@ | function2.c:19:13:19:15 | declaration of f22 | f22 | function1.c:25:6:25:8 | definition of f22 | f22 |
diff --git a/c/misra/test/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.expected b/c/misra/test/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.expected
index c63681c7be..8b8e7f8a48 100644
--- a/c/misra/test/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.expected
+++ b/c/misra/test/rules/RULE-8-3/DeclarationsOfAnObjectSameNameAndType.expected
@@ -1,22 +1,22 @@
-| object1.c:5:6:5:7 | definition of a3 | The object $@ of type long is not compatible with re-declaration $@ of type LL | object1.c:5:6:5:7 | definition of a3 | a3 | object2.c:11:11:11:12 | declaration of a3 | a3 |
-| object1.c:6:6:6:7 | definition of a4 | The object $@ of type long is not compatible with re-declaration $@ of type int | object1.c:6:6:6:7 | definition of a4 | a4 | object2.c:13:12:13:13 | declaration of a4 | a4 |
-| object1.c:7:5:7:6 | definition of a5 | The object $@ of type int is not compatible with re-declaration $@ of type long | object1.c:7:5:7:6 | definition of a5 | a5 | object2.c:15:13:15:14 | declaration of a5 | a5 |
-| object1.c:8:6:8:7 | definition of a6 | The object $@ of type long is not compatible with re-declaration $@ of type int | object1.c:8:6:8:7 | definition of a6 | a6 | object2.c:19:1:19:3 | declaration of a6 | a6 |
-| object1.c:9:5:9:6 | definition of a7 | The object $@ of type int is not compatible with re-declaration $@ of type LL | object1.c:9:5:9:6 | definition of a7 | a7 | object2.c:21:11:21:12 | declaration of a7 | a7 |
-| object1.c:15:5:15:7 | definition of a10 | The object $@ of type int[100] is not compatible with re-declaration $@ of type LI[100] | object1.c:15:5:15:7 | definition of a10 | a10 | object2.c:24:4:24:6 | definition of a10 | a10 |
-| object1.c:16:5:16:7 | definition of a11 | The object $@ of type int[100] is not compatible with re-declaration $@ of type int[101] | object1.c:16:5:16:7 | definition of a11 | a11 | object2.c:25:12:25:14 | declaration of a11 | a11 |
-| object1.c:19:12:19:14 | definition of a13 | The object $@ of type int *const is not compatible with re-declaration $@ of type int * | object1.c:19:12:19:14 | definition of a13 | a13 | object2.c:28:13:28:15 | declaration of a13 | a13 |
-| object1.c:23:10:23:13 | definition of size | The object $@ of type size_t is not compatible with re-declaration $@ of type unsigned char | object1.c:23:10:23:13 | definition of size | size | object2.c:32:17:32:20 | definition of size | size |
-| object1.c:24:3:24:4 | definition of s0 | The object $@ of type NamedStruct0 is not compatible with re-declaration $@ of type NamedStruct0 | object1.c:24:3:24:4 | definition of s0 | s0 | object2.c:33:3:33:4 | definition of s0 | s0 |
-| object1.c:29:3:29:4 | definition of s1 | The object $@ of type NamedStruct1 is not compatible with re-declaration $@ of type NamedStruct1 | object1.c:29:3:29:4 | definition of s1 | s1 | object2.c:38:3:38:4 | definition of s1 | s1 |
-| object2.c:11:11:11:12 | declaration of a3 | The object $@ of type LL is not compatible with re-declaration $@ of type long | object2.c:11:11:11:12 | declaration of a3 | a3 | object1.c:5:6:5:7 | definition of a3 | a3 |
-| object2.c:13:12:13:13 | declaration of a4 | The object $@ of type int is not compatible with re-declaration $@ of type long | object2.c:13:12:13:13 | declaration of a4 | a4 | object1.c:6:6:6:7 | definition of a4 | a4 |
-| object2.c:15:13:15:14 | declaration of a5 | The object $@ of type long is not compatible with re-declaration $@ of type int | object2.c:15:13:15:14 | declaration of a5 | a5 | object1.c:7:5:7:6 | definition of a5 | a5 |
-| object2.c:19:1:19:3 | declaration of a6 | The object $@ of type int is not compatible with re-declaration $@ of type long | object2.c:19:1:19:3 | declaration of a6 | a6 | object1.c:8:6:8:7 | definition of a6 | a6 |
-| object2.c:21:11:21:12 | declaration of a7 | The object $@ of type LL is not compatible with re-declaration $@ of type int | object2.c:21:11:21:12 | declaration of a7 | a7 | object1.c:9:5:9:6 | definition of a7 | a7 |
-| object2.c:24:4:24:6 | definition of a10 | The object $@ of type LI[100] is not compatible with re-declaration $@ of type int[100] | object2.c:24:4:24:6 | definition of a10 | a10 | object1.c:15:5:15:7 | definition of a10 | a10 |
-| object2.c:25:12:25:14 | declaration of a11 | The object $@ of type int[101] is not compatible with re-declaration $@ of type int[100] | object2.c:25:12:25:14 | declaration of a11 | a11 | object1.c:16:5:16:7 | definition of a11 | a11 |
-| object2.c:28:13:28:15 | declaration of a13 | The object $@ of type int * is not compatible with re-declaration $@ of type int *const | object2.c:28:13:28:15 | declaration of a13 | a13 | object1.c:19:12:19:14 | definition of a13 | a13 |
-| object2.c:32:17:32:20 | definition of size | The object $@ of type unsigned char is not compatible with re-declaration $@ of type size_t | object2.c:32:17:32:20 | definition of size | size | object1.c:23:10:23:13 | definition of size | size |
-| object2.c:33:3:33:4 | definition of s0 | The object $@ of type NamedStruct0 is not compatible with re-declaration $@ of type NamedStruct0 | object2.c:33:3:33:4 | definition of s0 | s0 | object1.c:24:3:24:4 | definition of s0 | s0 |
-| object2.c:38:3:38:4 | definition of s1 | The object $@ of type NamedStruct1 is not compatible with re-declaration $@ of type NamedStruct1 | object2.c:38:3:38:4 | definition of s1 | s1 | object1.c:29:3:29:4 | definition of s1 | s1 |
+| object1.c:5:6:5:7 | definition of a3 | The object $@ of type long does not use the same type names as re-declaration $@ of type LL | object1.c:5:6:5:7 | definition of a3 | a3 | object2.c:11:11:11:12 | declaration of a3 | a3 |
+| object1.c:6:6:6:7 | definition of a4 | The object $@ of type long does not use the same type names as re-declaration $@ of type int | object1.c:6:6:6:7 | definition of a4 | a4 | object2.c:13:12:13:13 | declaration of a4 | a4 |
+| object1.c:7:5:7:6 | definition of a5 | The object $@ of type int does not use the same type names as re-declaration $@ of type long | object1.c:7:5:7:6 | definition of a5 | a5 | object2.c:15:13:15:14 | declaration of a5 | a5 |
+| object1.c:8:6:8:7 | definition of a6 | The object $@ of type long does not use the same type names as re-declaration $@ of type int | object1.c:8:6:8:7 | definition of a6 | a6 | object2.c:19:1:19:3 | declaration of a6 | a6 |
+| object1.c:9:5:9:6 | definition of a7 | The object $@ of type int does not use the same type names as re-declaration $@ of type LL | object1.c:9:5:9:6 | definition of a7 | a7 | object2.c:21:11:21:12 | declaration of a7 | a7 |
+| object1.c:15:5:15:7 | definition of a10 | The object $@ of type int[100] does not use the same type names as re-declaration $@ of type LI[100] | object1.c:15:5:15:7 | definition of a10 | a10 | object2.c:24:4:24:6 | definition of a10 | a10 |
+| object1.c:16:5:16:7 | definition of a11 | The object $@ of type int[100] does not use the same type names as re-declaration $@ of type int[101] | object1.c:16:5:16:7 | definition of a11 | a11 | object2.c:25:12:25:14 | declaration of a11 | a11 |
+| object1.c:19:12:19:14 | definition of a13 | The object $@ of type int *const does not use the same type names as re-declaration $@ of type int * | object1.c:19:12:19:14 | definition of a13 | a13 | object2.c:28:13:28:15 | declaration of a13 | a13 |
+| object1.c:23:10:23:13 | definition of size | The object $@ of type size_t does not use the same type names as re-declaration $@ of type unsigned char | object1.c:23:10:23:13 | definition of size | size | object2.c:32:17:32:20 | definition of size | size |
+| object1.c:24:3:24:4 | definition of s0 | The object $@ of type NamedStruct0 does not use the same type names as re-declaration $@ of type NamedStruct0 | object1.c:24:3:24:4 | definition of s0 | s0 | object2.c:33:3:33:4 | definition of s0 | s0 |
+| object1.c:29:3:29:4 | definition of s1 | The object $@ of type NamedStruct1 does not use the same type names as re-declaration $@ of type NamedStruct1 | object1.c:29:3:29:4 | definition of s1 | s1 | object2.c:38:3:38:4 | definition of s1 | s1 |
+| object2.c:11:11:11:12 | declaration of a3 | The object $@ of type LL does not use the same type names as re-declaration $@ of type long | object2.c:11:11:11:12 | declaration of a3 | a3 | object1.c:5:6:5:7 | definition of a3 | a3 |
+| object2.c:13:12:13:13 | declaration of a4 | The object $@ of type int does not use the same type names as re-declaration $@ of type long | object2.c:13:12:13:13 | declaration of a4 | a4 | object1.c:6:6:6:7 | definition of a4 | a4 |
+| object2.c:15:13:15:14 | declaration of a5 | The object $@ of type long does not use the same type names as re-declaration $@ of type int | object2.c:15:13:15:14 | declaration of a5 | a5 | object1.c:7:5:7:6 | definition of a5 | a5 |
+| object2.c:19:1:19:3 | declaration of a6 | The object $@ of type int does not use the same type names as re-declaration $@ of type long | object2.c:19:1:19:3 | declaration of a6 | a6 | object1.c:8:6:8:7 | definition of a6 | a6 |
+| object2.c:21:11:21:12 | declaration of a7 | The object $@ of type LL does not use the same type names as re-declaration $@ of type int | object2.c:21:11:21:12 | declaration of a7 | a7 | object1.c:9:5:9:6 | definition of a7 | a7 |
+| object2.c:24:4:24:6 | definition of a10 | The object $@ of type LI[100] does not use the same type names as re-declaration $@ of type int[100] | object2.c:24:4:24:6 | definition of a10 | a10 | object1.c:15:5:15:7 | definition of a10 | a10 |
+| object2.c:25:12:25:14 | declaration of a11 | The object $@ of type int[101] does not use the same type names as re-declaration $@ of type int[100] | object2.c:25:12:25:14 | declaration of a11 | a11 | object1.c:16:5:16:7 | definition of a11 | a11 |
+| object2.c:28:13:28:15 | declaration of a13 | The object $@ of type int * does not use the same type names as re-declaration $@ of type int *const | object2.c:28:13:28:15 | declaration of a13 | a13 | object1.c:19:12:19:14 | definition of a13 | a13 |
+| object2.c:32:17:32:20 | definition of size | The object $@ of type unsigned char does not use the same type names as re-declaration $@ of type size_t | object2.c:32:17:32:20 | definition of size | size | object1.c:23:10:23:13 | definition of size | size |
+| object2.c:33:3:33:4 | definition of s0 | The object $@ of type NamedStruct0 does not use the same type names as re-declaration $@ of type NamedStruct0 | object2.c:33:3:33:4 | definition of s0 | s0 | object1.c:24:3:24:4 | definition of s0 | s0 |
+| object2.c:38:3:38:4 | definition of s1 | The object $@ of type NamedStruct1 does not use the same type names as re-declaration $@ of type NamedStruct1 | object2.c:38:3:38:4 | definition of s1 | s1 | object1.c:29:3:29:4 | definition of s1 | s1 |
diff --git a/c/misra/test/rules/RULE-8-3/function1.c b/c/misra/test/rules/RULE-8-3/function1.c
index 2072748047..f65c98c2ac 100644
--- a/c/misra/test/rules/RULE-8-3/function1.c
+++ b/c/misra/test/rules/RULE-8-3/function1.c
@@ -12,7 +12,7 @@ long f5(int f5a) { return 0; } // COMPLIANT
 
 int f6(int f6a) { return 0; } // NON_COMPLIANT
 
-int f20(int f20a); // COMPLIANT - overloaded function
+int f20(int f20a); // NON_COMPLIANT
 
 typedef int wi;
 typedef int hi;
@@ -24,4 +24,8 @@ a f21(wi w, wi h) { // NON_COMPLIANT
 
 void f22(int f22b, int f22a) { // NON_COMPLIANT
   return;
+}
+
+void f23(int f23a) { // COMPLIANT
+  return;
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-8-3/function2.c b/c/misra/test/rules/RULE-8-3/function2.c
index 979e002466..d31aaf17e5 100644
--- a/c/misra/test/rules/RULE-8-3/function2.c
+++ b/c/misra/test/rules/RULE-8-3/function2.c
@@ -8,7 +8,7 @@ long f5(int f5a) { return 0; } // COMPLIANT
 
 long f6(int f6a) { return 0; } // NON_COMPLIANT
 
-int f20(int f20a, int f20b); // COMPLIANT -- overloaded function
+int f20(int f20a, int f20b); // NON_COMPLIANT
 
 typedef int wi;
 typedef int hi;
@@ -16,4 +16,6 @@ typedef long a;
 
 extern a f21(wi w, hi h); // NON_COMPLIANT
 
-extern void f22(int f22a, int f22b); // NON_COMPLIANT
\ No newline at end of file
+extern void f22(int f22a, int f22b); // NON_COMPLIANT
+
+extern void f23(int); // COMPLIANT
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.expected b/c/misra/test/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.expected
index b6a53071d9..6610bf236e 100644
--- a/c/misra/test/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.expected
+++ b/c/misra/test/rules/RULE-8-7/ShouldNotBeDefinedWithExternalLinkage.expected
@@ -1,3 +1,4 @@
-| test.h:2:12:2:13 | i1 | Declaration with external linkage is accessed in only one translation unit $@. | test.c:4:3:4:4 | i1 | i1 |
-| test.h:3:5:3:6 | i2 | Declaration with external linkage is accessed in only one translation unit $@. | test.c:5:3:5:4 | i2 | i2 |
-| test.h:5:13:5:14 | f2 | Declaration with external linkage is accessed in only one translation unit $@. | test.c:7:3:7:4 | call to f2 | call to f2 |
+| test2.h:2:13:2:14 | f6 | Declaration with external linkage is accessed in only one translation unit $@. | test2.h:3:22:3:23 | call to f6 | call to f6 |
+| test.c:3:5:3:6 | i1 | Declaration with external linkage is accessed in only one translation unit $@. | test.c:11:3:11:4 | i1 | i1 |
+| test.c:4:5:4:6 | i2 | Declaration with external linkage is accessed in only one translation unit $@. | test.c:12:3:12:4 | i2 | i2 |
+| test.c:6:6:6:7 | f2 | Declaration with external linkage is accessed in only one translation unit $@. | test.c:14:3:14:4 | call to f2 | call to f2 |
diff --git a/c/misra/test/rules/RULE-8-7/test.c b/c/misra/test/rules/RULE-8-7/test.c
index b2cc2a0684..3789a1d269 100644
--- a/c/misra/test/rules/RULE-8-7/test.c
+++ b/c/misra/test/rules/RULE-8-7/test.c
@@ -1,4 +1,11 @@
 #include "test.h"
+int i = 0;
+int i1 = 0;
+int i2;             // NON_COMPLIANT - accessed one translation unit
+void f1() {}        // Definition
+void f2() {}        // Definition
+static void f3(){}; // COMPLIANT - internal linkage
+void f4() {}        // Definition
 void f() {
   i = 0;
   i1 = 0;
diff --git a/c/misra/test/rules/RULE-8-7/test.h b/c/misra/test/rules/RULE-8-7/test.h
index 692bb8e3db..782099de02 100644
--- a/c/misra/test/rules/RULE-8-7/test.h
+++ b/c/misra/test/rules/RULE-8-7/test.h
@@ -1,7 +1,6 @@
 extern int i;     // COMPLIANT - accessed multiple translation units
 extern int i1;    // NON_COMPLIANT - accessed one translation unit
-int i2;           // NON_COMPLIANT - accessed one translation unit
 extern void f1(); // COMPLIANT  - accessed multiple translation units
 extern void f2(); // NON_COMPLIANT - accessed one translation unit
-static void f3(); // COMPLIANT - internal linkage
-extern void f3(); // COMPLIANT - internal linkage
\ No newline at end of file
+extern void f4(); // COMPLIANT - accessed across translation units
+extern void f5(); // COMPLIANT - no definition
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-8-7/test1.c b/c/misra/test/rules/RULE-8-7/test1.c
index 77377e78df..5c3b3759c9 100644
--- a/c/misra/test/rules/RULE-8-7/test1.c
+++ b/c/misra/test/rules/RULE-8-7/test1.c
@@ -1,5 +1,7 @@
-#include "test.h"
+#include "test2.h"
 void f() {
   i = 0;
   f1();
+  f4();
+  f5();
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-8-7/test2.h b/c/misra/test/rules/RULE-8-7/test2.h
new file mode 100644
index 0000000000..d203c3259a
--- /dev/null
+++ b/c/misra/test/rules/RULE-8-7/test2.h
@@ -0,0 +1,3 @@
+#include "test.h"
+extern void f6() {} // NON_COMPLIANT
+static void test() { f6(); }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-9-7/UninitializedAtomicObject.expected b/c/misra/test/rules/RULE-9-7/UninitializedAtomicObject.expected
new file mode 100644
index 0000000000..f96fc6aa13
--- /dev/null
+++ b/c/misra/test/rules/RULE-9-7/UninitializedAtomicObject.expected
@@ -0,0 +1,4 @@
+| test.c:24:15:24:16 | definition of l3 | Atomic object 'l3' has no initializer or corresponding use of 'atomic_init()'. |
+| test.c:27:15:27:16 | definition of l4 | Atomic object 'l4' has no initializer or corresponding use of 'atomic_init()'. |
+| test.c:31:15:31:16 | definition of l5 | Atomic object 'l5' has no initializer or corresponding use of 'atomic_init()'. |
+| test.c:41:15:41:16 | definition of l7 | Atomic object 'l7' has no initializer or corresponding use of 'atomic_init()'. |
diff --git a/c/misra/test/rules/RULE-9-7/UninitializedAtomicObject.qlref b/c/misra/test/rules/RULE-9-7/UninitializedAtomicObject.qlref
new file mode 100644
index 0000000000..11219b0741
--- /dev/null
+++ b/c/misra/test/rules/RULE-9-7/UninitializedAtomicObject.qlref
@@ -0,0 +1 @@
+rules/RULE-9-7/UninitializedAtomicObject.ql
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-9-7/test.c b/c/misra/test/rules/RULE-9-7/test.c
new file mode 100644
index 0000000000..90645f6372
--- /dev/null
+++ b/c/misra/test/rules/RULE-9-7/test.c
@@ -0,0 +1,46 @@
+#include "stdatomic.h"
+#include "threads.h"
+
+_Atomic int g1;     // COMPLIANT
+_Atomic int g2 = 0; // COMPLIANT
+
+int f_thread(void *x);
+
+void f_starts_thread() {
+  thrd_t t;
+  thrd_create(&t, f_thread, 0);
+}
+
+void f_may_initialize_argument(void *p1) {}
+
+int main(int argc, char *argv[]) {
+  _Atomic int l1 = 1; // COMPLIANT
+  f_starts_thread();
+
+  _Atomic int l2; // COMPLIANT
+  atomic_init(&l2, 0);
+  f_starts_thread();
+
+  _Atomic int l3; // NON-COMPLIANT
+  f_starts_thread();
+
+  _Atomic int l4; // NON-COMPLIANT
+  f_starts_thread();
+  atomic_init(&l4, 0);
+
+  _Atomic int l5; // NON-COMPLIANT
+  if (g1 == 0) {
+    atomic_init(&l5, 0);
+  }
+  f_starts_thread();
+
+  _Atomic int l6; // COMPLIANT
+  f_may_initialize_argument(&l6);
+  f_starts_thread();
+
+  _Atomic int l7; // NON_COMPLIANT
+  if (g1 == 0) {
+    f_may_initialize_argument(&l7);
+  }
+  f_starts_thread();
+}
\ No newline at end of file
diff --git a/change_notes/2024-01-30-m0-3-2.md b/change_notes/2024-01-30-m0-3-2.md
new file mode 100644
index 0000000000..b074f6b2b1
--- /dev/null
+++ b/change_notes/2024-01-30-m0-3-2.md
@@ -0,0 +1 @@
+ * `M0-3-2` - the alert messages now include the name of the called function.
\ No newline at end of file
diff --git a/change_notes/2024-06-03-a3-1-5-trivial-defs.md b/change_notes/2024-06-03-a3-1-5-trivial-defs.md
new file mode 100644
index 0000000000..29a7f48eb5
--- /dev/null
+++ b/change_notes/2024-06-03-a3-1-5-trivial-defs.md
@@ -0,0 +1,4 @@
+ - `A3-1-5` - `TrivialOrTemplateFunctionDefinedOutsideClassDefinition.ql`:
+   - Query deleted - rule was never intended to cover this case (see https://forum.misra.org.uk/archive/index.php?thread-1588.html).
+ - `A3-1-5` - `NonTrivialNonTemplateFunctionDefinedInsideClassDefinition.ql`:
+   - Removed false positives caused by flagging member functions in template instantiations
diff --git a/change_notes/2024-07-05-fix-fp-576-STR34-C.md b/change_notes/2024-07-05-fix-fp-576-STR34-C.md
new file mode 100644
index 0000000000..340d8f4288
--- /dev/null
+++ b/change_notes/2024-07-05-fix-fp-576-STR34-C.md
@@ -0,0 +1,2 @@
+- `STR34-C` - `CastCharBeforeConvertingToLargerSizes.ql`:
+  - Fixes #576. Do not consider integer type aliases in templates.
\ No newline at end of file
diff --git a/change_notes/2024-10-23-cvalue-widening.md b/change_notes/2024-10-23-cvalue-widening.md
new file mode 100644
index 0000000000..1d7a0f876a
--- /dev/null
+++ b/change_notes/2024-10-23-cvalue-widening.md
@@ -0,0 +1,2 @@
+ - `M5-0-3`, `M5-0-7`, `M5-0-8`, `M5-0-9` - `CvalueExpressionConvertedToDifferentUnderlyingType.ql`, `ExplicitFloatingIntegralConversionOfACValueExpr.ql`, `ExplicitWideningConversionOfACValueExpr.ql`, `ExplicitSignedness.ql`:
+   - Reduce false positives from misidentifying an explicitly casted expression used as a function argument or return value as a `cvalue`.
diff --git a/change_notes/2024-10-28-essential-types-bitwise.md b/change_notes/2024-10-28-essential-types-bitwise.md
new file mode 100644
index 0000000000..a382290351
--- /dev/null
+++ b/change_notes/2024-10-28-essential-types-bitwise.md
@@ -0,0 +1,2 @@
+ - `RULE-10-1`, `RULE-10-3`, `RULE-10-4`, `RULE-10-5`, `RULE-10-6`, `RULE-10-7`, `RULE-10-8`, `RULE-12-2` - `OperandsOfAnInappropriateEssentialType.ql`, `AssignmentOfIncompatibleEssentialType.ql`, `OperandsWithMismatchedEssentialTypeCategory.ql`, `InappropriateEssentialTypeCast.ql`, `AssignmentToWiderEssentialType,ql`, `ImplicitConversionOfCompositeExpression.ql`, `InappropriateCastOfCompositeExpression.ql`:
+   - False positives and false negatives removed due to fixing incorrect essential type of the binary bitwise operations `^`, `|` and `&`. Previously the standard type was used, instead of applying the essential type rules which dictate that if both arguments have the same signedness, the essential type will have the same signedness and a rank equal to the larger of the two operands.
\ No newline at end of file
diff --git a/change_notes/2024-11-27-c-object-refactor.md b/change_notes/2024-11-27-c-object-refactor.md
new file mode 100644
index 0000000000..511ce1b7ce
--- /dev/null
+++ b/change_notes/2024-11-27-c-object-refactor.md
@@ -0,0 +1,21 @@
+- `CON34-C` - `AppropriateThreadObjectStorageDurations.ql`:
+  - Improved analysis for detecting objects with automatic storage duration
+  - New reports will include `a.x`, `a[x]` for object `a` with automatic storage duration
+- `DCL30-C` - `AppropriateStorageDurationsFunctionReturn.ql`:
+  - Improved analysis for detecting objects with automatic storage duration
+  - New reports will include `a.x`, `a[x]` for object `a` with automatic storage duration
+  - False positives related to returning copying pointer values 
+- `EXP35-C` - `DoNotModifyObjectsWithTemporaryLifetime.ql`:
+  - Improved analysis for detecting objects with temporary lifetime
+  - More non-lvalue expressions that produce temporary objects detected, for instance `(x = y).x`, previously only `f().x` discovered
+- `MEM33-C` - `AllocStructsWithAFlexibleArrayMemberDynamically.ql`:
+  - Improved analysis for detecting objects with automatic storage duration
+  - New reports will include struct literals with a flexible array member
+- `RULE-18-9` - `ModifiableLValueSubscriptedWithTemporaryLifetime.ql`:
+  - Problems will be reported at more obviously non-lvalue locations
+  - Implementation refactored to be shared with other libraries
+  - No other changes expected
+- `RULE-18-9` - `ArrayToPointerConversionOfTemporaryLifetime.ql`:
+  - Problems will be reported at more obviously non-lvalue locations
+  - Implementation refactored to be shared with other libraries
+  - No other changes expected
\ No newline at end of file
diff --git a/change_notes/2024-11-27-raii-concurrency-analysis-perf.md b/change_notes/2024-11-27-raii-concurrency-analysis-perf.md
new file mode 100644
index 0000000000..3a08427808
--- /dev/null
+++ b/change_notes/2024-11-27-raii-concurrency-analysis-perf.md
@@ -0,0 +1,2 @@
+ - `Concurrency` - for all queries related to RAII-style mutexes
+   - These types of locks have been refactored to improve performance in some queries. No change in query results expected.
\ No newline at end of file
diff --git a/change_notes/2024-11-27-resource-leak-analysis-refactor.md b/change_notes/2024-11-27-resource-leak-analysis-refactor.md
new file mode 100644
index 0000000000..8f2799b543
--- /dev/null
+++ b/change_notes/2024-11-27-resource-leak-analysis-refactor.md
@@ -0,0 +1,10 @@
+- `ERR57-CPP` - `DoNotLeakResourcesWhenHandlingExceptions.ql`:
+  - Resource leak detection code refactored for sharing across queries
+  - Control flow no longer uses "cut nodes." This could impact performance positively or negatively, however measurements have been taken that indicate no significant change
+  - Some false positives have been suppressed due to slightly different control flow approach
+  - Leaked mutex locks and open files are reported at slightly different location, reported at call site (e.g. `f.open(...)`, `m.lock()`) rather than on the variable itself (`f` and `m`).
+- `A15-1-4` - `ValidResourcesStateBeforeThrow.ql`:
+  - Resource leak detection code refactored for sharing across queries
+  - Control flow no longer uses "cut nodes." This could impact performance positively or negatively, however measurements have been taken that indicate no significant change
+  - Some false positives have been suppressed due to slightly different control flow approach
+  - Leaked mutex locks and open files are reported at slightly different location, reported at call site (e.g. `f.open(...)`, `m.lock()`) rather than on the variable itself (`f` and `m`).
\ No newline at end of file
diff --git a/change_notes/2024-12-05-upgrade-to-2.18.4.md b/change_notes/2024-12-05-upgrade-to-2.18.4.md
new file mode 100644
index 0000000000..6f3d4ba404
--- /dev/null
+++ b/change_notes/2024-12-05-upgrade-to-2.18.4.md
@@ -0,0 +1,3 @@
+- Updated the CodeQL version to `2.18.4`.
+- `A12-8-6` - `CopyAndMoveNotDeclaredProtected.ql`:
+  - Implicitly created copy and move constructors will no longer be flagged in tenplate instantiations when they are unused, or trivial (tracked at https://github.com/github/codeql-coding-standards/issues/811).
\ No newline at end of file
diff --git a/change_notes/2024-12-08-identifier-hiding.md b/change_notes/2024-12-08-identifier-hiding.md
new file mode 100644
index 0000000000..b769b16e57
--- /dev/null
+++ b/change_notes/2024-12-08-identifier-hiding.md
@@ -0,0 +1,7 @@
+ - `A2-10-1` - `IdentifierHiding.ql`:
+   - Improved evaluation performance.
+   - Addressed false negatives where nested loops used the same variable name.
+   - Exclude cases where a variable declared in a lambda expression shadowed a global or namespace variable that did not appear in the same translation unit.
+ - `RULE-5-3` - `IdentifierHidingC.ql`:
+   - Improved evaluation performance.
+   - Addressed false negatives where nested loops used the same variable name.
\ No newline at end of file
diff --git a/change_notes/2024-12-10-a15-4-4-deviations.md b/change_notes/2024-12-10-a15-4-4-deviations.md
new file mode 100644
index 0000000000..4a595e3e00
--- /dev/null
+++ b/change_notes/2024-12-10-a15-4-4-deviations.md
@@ -0,0 +1,2 @@
+ - `A15-4-4` - `MissingNoExcept.ql`:
+   - Enable deviations on either declarations or definitions.
\ No newline at end of file
diff --git a/change_notes/2024-12-10-refactor-concurrency-library.md b/change_notes/2024-12-10-refactor-concurrency-library.md
new file mode 100644
index 0000000000..ccefe85f19
--- /dev/null
+++ b/change_notes/2024-12-10-refactor-concurrency-library.md
@@ -0,0 +1,2 @@
+ - `Concurrency.qll` - for all queries using this library
+   - This has been refactored into a set of smaller utility files. No impact on query results or performance expected.
\ No newline at end of file
diff --git a/change_notes/2024-12-10-udpate-a7-1-1.md b/change_notes/2024-12-10-udpate-a7-1-1.md
new file mode 100644
index 0000000000..6efa1ae01f
--- /dev/null
+++ b/change_notes/2024-12-10-udpate-a7-1-1.md
@@ -0,0 +1,2 @@
+- `A7-1-1` - `DeclarationUnmodifiedObjectMissingConstSpecifier.ql`:
+  - Exclude rvalue references.
diff --git a/change_notes/2024-12-12-complex-floating-essential-types.md b/change_notes/2024-12-12-complex-floating-essential-types.md
new file mode 100644
index 0000000000..5f5b6b519f
--- /dev/null
+++ b/change_notes/2024-12-12-complex-floating-essential-types.md
@@ -0,0 +1,8 @@
+ - `EssentialType` - for all queries related to essential types:
+   - Complex floating types are now considered a different essential type than real floating types.
+ - `RULE-10-1` `RULE-10-3`, `RULE-10-4`, `RULE-10-5`, `RULE-10-7`, `RULE-10-8` - `OperandsOfAnInappropriateEssentialType.ql`, `AssignmentOfIncompatibleEssentialType.ql`, `OperandsWithMismatchedEssentialTypeCategory.ql`, `InappropriateEssentialTypeCast.ql`, `ImplicitConversionOfCompositeExpression.ql`, `InappropriateCastOfCompositeExpression.ql`:
+   - Updates to rules handling complex floating types in MISRA-C 2012 Amendment 3 have been implemented.
+- `RULE-14-1`, `LoopOverEssentiallyFloatType.ql`:
+   - Query updated to account for the existence of complex essentially floating point types. No change in query results or performance expected.
+ - `DIR-4-6` - `PlainNumericalTypeUsedOverExplicitTypedef.ql`:
+   - Updates from MISRA-C 2012 Amendment 3 specifying complex fixed width typedef support has been implemented.
\ No newline at end of file
diff --git a/change_notes/2024-12-12-lessen-emergent-language-feature-restrictions.md b/change_notes/2024-12-12-lessen-emergent-language-feature-restrictions.md
new file mode 100644
index 0000000000..2893ba620b
--- /dev/null
+++ b/change_notes/2024-12-12-lessen-emergent-language-feature-restrictions.md
@@ -0,0 +1,2 @@
+ - `RULE-1-4` -  `EmergentLanguageFeaturesUsed.ql`:
+   - Remove restrictions on `stdnoreturn.h`, `stdalign.h`.
\ No newline at end of file
diff --git a/change_notes/2024-12-13-implement-misra-c-amendment4-rule-amendments.md b/change_notes/2024-12-13-implement-misra-c-amendment4-rule-amendments.md
new file mode 100644
index 0000000000..b168ccaf78
--- /dev/null
+++ b/change_notes/2024-12-13-implement-misra-c-amendment4-rule-amendments.md
@@ -0,0 +1,11 @@
+ - `RULE-11-3` - `CastBetweenObjectPointerAndDifferentObjectType.ql`
+   - Constrain exception that pointer types to may be cast to char types, so that it does not apply to atomic pointer types, in compliance with MISRA-C 2012 Amendment 4.
+ - `RULE-11-8` - `CastRemovesConstOrVolatileQualification.ql`
+   - Query expanded to detect cases of removing `_Atomic` qualification, in compliance with MISRA-C 2012 Amendment 4.
+ - `EXP33-C`, `RULE-9-1`, `A8-5-0`, `EXP53-CPP` - `DoNotReadUninitializedMemory.ql`, `ObjectWithAutoStorageDurationReadBeforeInit.ql`, `MemoryNotInitializedBeforeItIsRead.ql`, `DoNotReadUninitializedMemory.ql`
+   - Atomic local variables excluded from query results, in compliance with MISRA-C 2012 Amendment 4, and to reduce false positives in the other standards.
+ - `RULE-13-2` - `UnsequencedAtomicReads.ql`
+   - New query to find expressions which read an atomic variable more than once between sequence points, to address new case from MISRA-C 2012 Amendment 4.
+ - `RULE-3-1` - `CharacterSequencesAndUsedWithinAComment.ql`
+   - Add exception allowing URLs inside of cpp-style `/* ... */` comments, in compliance with MISRA-C 2012 Amendment 4.
+   - No longer report cases of `//*some comment` in this rule.
\ No newline at end of file
diff --git a/change_notes/2024-12-17-fix-fp-824-a15-4-4 b/change_notes/2024-12-17-fix-fp-824-a15-4-4
new file mode 100644
index 0000000000..89ccf49815
--- /dev/null
+++ b/change_notes/2024-12-17-fix-fp-824-a15-4-4
@@ -0,0 +1,2 @@
+ - `A15-4-4` - `MissingNoExcept.ql`:
+   - Reduce false positives by not reporting on functions that have a noexcept specification with a complex expression or call other such functions.
diff --git a/change_notes/2024-12-18-fix-fp-540-a3-9-1.md b/change_notes/2024-12-18-fix-fp-540-a3-9-1.md
new file mode 100644
index 0000000000..fbd09ca840
--- /dev/null
+++ b/change_notes/2024-12-18-fix-fp-540-a3-9-1.md
@@ -0,0 +1,2 @@
+ - `A3-9-1` - `VariableWidthIntegerTypesUsed.ql`:
+   - Reduce false positives by not considering variables from template instantiations.
diff --git a/change_notes/2025-01-09-return-reference.md b/change_notes/2025-01-09-return-reference.md
new file mode 100644
index 0000000000..69480916c7
--- /dev/null
+++ b/change_notes/2025-01-09-return-reference.md
@@ -0,0 +1,2 @@
+ - `M7-5-1`, `RULE-6-8-2` - `FunctionReturnAutomaticVarCondition.ql`, `ReturnReferenceOrPointerToAutomaticLocalVariable.ql`:
+   - Remove false positives for member and global variables reported under this rule.
\ No newline at end of file
diff --git a/change_notes/2025-01-21-a7-1-2-remove-function-constexpr.md b/change_notes/2025-01-21-a7-1-2-remove-function-constexpr.md
new file mode 100644
index 0000000000..ac9964adc9
--- /dev/null
+++ b/change_notes/2025-01-21-a7-1-2-remove-function-constexpr.md
@@ -0,0 +1,2 @@
+ - `A7-1-2` - `FunctionMissingConstexpr.ql`
+   - Address false positives by removing the query - the rule is not intended to cover functions.
\ No newline at end of file
diff --git a/change_notes/2025-01-29-implement-misra-clarifications-change-categories.md b/change_notes/2025-01-29-implement-misra-clarifications-change-categories.md
new file mode 100644
index 0000000000..04ef636392
--- /dev/null
+++ b/change_notes/2025-01-29-implement-misra-clarifications-change-categories.md
@@ -0,0 +1,6 @@
+ - `RULE-13-6` - `SizeofOperandWithSideEffect.ql`:
+   - Changed from Mandatory to Required in implementation of Technical Corrigenda 2.
+ - `RULE-17-5` - `ArrayFunctionArgumentNumberOfElements.ql`:
+   - Changed from Advisory to Required in implementation of Technical Corrigenda 2.
+ - `RULE-21-11` - `StandardHeaderFileTgmathhUsed.ql`:
+   - Changed from Required to Advisory in implementation of Amendment 3.
\ No newline at end of file
diff --git a/change_notes/2025-02-06-a3-1-5-audit.md b/change_notes/2025-02-06-a3-1-5-audit.md
new file mode 100644
index 0000000000..1f56a25236
--- /dev/null
+++ b/change_notes/2025-02-06-a3-1-5-audit.md
@@ -0,0 +1,2 @@
+ - `A3-1-5` - `NonTrivialNonTemplateFunctionDefinedInsideClassDefinition.ql`:
+   - Mark this as an `audit` query. As a consequence, it will no longer be run as part of the default query suite for AUTOSAR. It can still be run as part of the `autosar-audit.qls` query suite. The query has been downgraded because the rule allows for functions to be declared in the class body if they were "intended" to be inlined, and that developer intention cannot be determined automatically from the code.
\ No newline at end of file
diff --git a/change_notes/2025-02-06-m5-3-1-exclude-unknown-type.md b/change_notes/2025-02-06-m5-3-1-exclude-unknown-type.md
new file mode 100644
index 0000000000..ba7f50af45
--- /dev/null
+++ b/change_notes/2025-02-06-m5-3-1-exclude-unknown-type.md
@@ -0,0 +1,2 @@
+ - `M5-3-1` - `EachOperandOfTheOperatorOfTheLogicalAndOrTheLogicalOperatorsShallHaveTypeBool.ql`:
+   - Consistently exclude results in unevaluated contexts associated with uninstantiated templates, for example `noexcept` specifiers and `static_assert`s.
\ No newline at end of file
diff --git a/change_notes/2025-02-10-improve-perf-a5-1-9.md b/change_notes/2025-02-10-improve-perf-a5-1-9.md
new file mode 100644
index 0000000000..5d355bab49
--- /dev/null
+++ b/change_notes/2025-02-10-improve-perf-a5-1-9.md
@@ -0,0 +1,3 @@
+ - `A5-1-9` - `IdenticalLambdaExpressions.ql`:
+   - Performance has been improved.
+   - False positives due to repeated invocation of macros containing lambdas have been excluded.
\ No newline at end of file
diff --git a/change_notes/2025-02-13-deviations.md b/change_notes/2025-02-13-deviations.md
new file mode 100644
index 0000000000..fb01cdf596
--- /dev/null
+++ b/change_notes/2025-02-13-deviations.md
@@ -0,0 +1,13 @@
+ - A new in code deviation format has been introduced, using the C/C++ attribute syntax:
+   ```
+   [[codeql::<standard>_deviation("<code-identifier>")]]
+   ```
+   This can be applied to functions, statements and variables to apply a deviation from the Coding Standards configuration file. The user manual has been updated to describe the new format.
+ - For those codebases that cannot use standard attributes, we have also introduced a comment based syntax
+   ```
+   // codeql::<standard>_deviation(<code-identifier>)
+   // codeql::<standard>_deviation_next_line(<code-identifier>)
+   // codeql::<standard>_deviation_begin(<code-identifier>)
+   // codeql::<standard>_deviation_end(<code-identifier>)
+   ```
+   Further information is available in the user manual.
\ No newline at end of file
diff --git a/change_notes/2025-02-13-fix-issue-718.md b/change_notes/2025-02-13-fix-issue-718.md
new file mode 100644
index 0000000000..39e499d583
--- /dev/null
+++ b/change_notes/2025-02-13-fix-issue-718.md
@@ -0,0 +1,2 @@
+- `A2-7-3` - `UndocumentedUserDefinedType.ql`
+  - Fixes #718. Include trailing characters after group comment endings with ///@{ ... ///@}.
diff --git a/change_notes/2025-02-17-iofstream-performance.md b/change_notes/2025-02-17-iofstream-performance.md
new file mode 100644
index 0000000000..8e566d3778
--- /dev/null
+++ b/change_notes/2025-02-17-iofstream-performance.md
@@ -0,0 +1,2 @@
+ - `A27-0-3`, `FIO309-C`, `FIO50-CPP`, `RULE-30-0-2` - `InterleavedInputOutputWithoutFlush.ql`, `DoNotAlternatelyIOFromStreamWithoutPositioning.ql`, `InterleavedInputOutputWithoutPosition.ql`, `ReadsAndWritesOnStreamNotSeparatedByPositioning.ql`:
+   - Reduce evaluation time on complex codebases.
\ No newline at end of file
diff --git a/change_notes/2025-02-20-rule-22-16-update-aliasing-for-performance.md b/change_notes/2025-02-20-rule-22-16-update-aliasing-for-performance.md
new file mode 100644
index 0000000000..80ff92748f
--- /dev/null
+++ b/change_notes/2025-02-20-rule-22-16-update-aliasing-for-performance.md
@@ -0,0 +1,3 @@
+ - `RULE-22-16`, `ERR57-CPP`, `A15-1-4` - `MutexObjectsNotAlwaysUnlocked.ql`, `DoNotLeakResourcesWhenHandlingExceptions.ql`, `ValidResourcesStateBeforeThrow.ql`:
+   - Shared module `ResourceLeakAnalysis.qll` changed to not get aliases recursively for simplicity and improved performance. The recent update to these queries had logic intending to handle the case where an allocation node is an alias of a parent node, and the free operation releases that parent node. However, the behavior was incorrectly defined and not working, and in the presence of performance issues this behavior has been removed.
+   - (`RULE-22-16` only) The alias behavior has been updated to compare expressions with `HashCons` instead of `GlobalValueNumbering` for higher performance. GVN is more expensive generally, seemed to introduce low performance joins secondarily, and is stricter than `HashCons` in a contravening position, meaning a stricter analysis introduces a higher likelihood of false positives.
\ No newline at end of file
diff --git a/change_notes/2025-02-25-move-type-related-libraries.md b/change_notes/2025-02-25-move-type-related-libraries.md
new file mode 100644
index 0000000000..9f4fbd0bf2
--- /dev/null
+++ b/change_notes/2025-02-25-move-type-related-libraries.md
@@ -0,0 +1,2 @@
+ - All rules using `Type.qll`, `TypeUses.qll`, `Pointers.qll`, `TrivialType.qll`, `VariablyModifiedTypes.qll`:
+   - Files moved into `cpp/common/types` directory. No external changes in behavior expected.
\ No newline at end of file
diff --git a/change_notes/2025-02-25-update-macro-deduplication-library.md b/change_notes/2025-02-25-update-macro-deduplication-library.md
new file mode 100644
index 0000000000..90b3ef51af
--- /dev/null
+++ b/change_notes/2025-02-25-update-macro-deduplication-library.md
@@ -0,0 +1,4 @@
+- `RULE-2-8` - `UnusedObjectDefinition.ql`, `UnusedObjectDefinitionStrict.ql`:
+  - Refactor to allow additional parameters in non-macro results for library `DeduplicateMacroResults.qll`.
+  - Refactor to replace `Location` with `Locatable` in API of library `DeduplicationMacroResults.qll`.
+  - No observable difference in behavior expected.
diff --git a/change_notes/2025-03-04-essential-types-with-explicit-conversions.md b/change_notes/2025-03-04-essential-types-with-explicit-conversions.md
new file mode 100644
index 0000000000..aa32044087
--- /dev/null
+++ b/change_notes/2025-03-04-essential-types-with-explicit-conversions.md
@@ -0,0 +1,2 @@
+ - `EssentialType` - for all queries related to essential types:
+   - Updated the way essential types of expressions with "conversions" (including explicit casts, parenthesis, and implicit conversions such as array-to-pointer conversions) are handled, to get proper essential types when parenthesis, casts, and generics interact.
\ No newline at end of file
diff --git a/change_notes/2025-03-04-more-accurate-type-comparisons.md b/change_notes/2025-03-04-more-accurate-type-comparisons.md
new file mode 100644
index 0000000000..942d76f7af
--- /dev/null
+++ b/change_notes/2025-03-04-more-accurate-type-comparisons.md
@@ -0,0 +1,6 @@
+ - `RULE-8-3` - `DeclarationsOfAFunctionSameNameAndType.ql`, `DeclarationsOfAnObjectSameNameAndType.ql`:
+   - New shared module used to fix false positives for compound types referring to the same basic integer types under a different name, e.g., query will not report for `signed[4]` used in place of `int[4]` as per MISRA spec.
+   - Now query will report incompatibilities for two functions of the same name with a different number of parameters.
+   - Query result string updated to not use the word "Compatible," which is confusing, as it may falsely appear that the query is testing for compatibility as defined by C17.
+ - `RULE-8-4`, `DCL-40C` - `CompatibleDeclarationFunctionDefined.ql`, `CompatibleDeclarationObjectDefined.ql`, `IncomptatibleFunctionDeclarations.ql`:
+   - New shared module used to fix false positives by updating "compatible" type checks to more closely match the C17 standard. For instance, `int[3]` and `int[]` are compatible declarations (while `int[3]` and `int[4]` are not), and typedefs are now resolved as well. Some false positives may still occur regarding structs from different compilation units.
\ No newline at end of file
diff --git a/change_notes/2025-03-09-rule-8-7.md b/change_notes/2025-03-09-rule-8-7.md
new file mode 100644
index 0000000000..3c3678ca6d
--- /dev/null
+++ b/change_notes/2025-03-09-rule-8-7.md
@@ -0,0 +1,4 @@
+ - `RULE-8-7` - `ShouldNotBeDefinedWithExternalLinkage.ql`:
+   - Remove false positives where the declaration is not defined in the database.
+   - Remove false positives where the definition and reference are in different translation units.
+   - Remove false positives where the reference occurs in a header file.
\ No newline at end of file
diff --git a/change_notes/2025-03-11-various-misra-amendments.md b/change_notes/2025-03-11-various-misra-amendments.md
new file mode 100644
index 0000000000..19783fe803
--- /dev/null
+++ b/change_notes/2025-03-11-various-misra-amendments.md
@@ -0,0 +1,9 @@
+ - `DIR-4-9` - `FunctionOverFunctionLikeMacro.ql`:
+   - Macros with `_Generic` now no longer reported.
+ - `RULE-1-4` - `EmergentLanguageFeaturesUsed.ql`:
+   - Ban on usage of `_Generics` removed.
+ - `RULE-18-6` - `ThreadLocalObjectAddressCopiedToGlobalObject.ql`:
+   - New query added to detect thread local objects assigned to static storage duration objects.
+ - `RULE-21-12` - `ExceptionHandlingFeaturesOfFenvhUsed.ql`:
+   - Added reports for `#include`ing "fenv.h", and for using `fesetenv`, `feupdatenv`, and `fesetround`.
+   - Report message altered to handle new cases.
\ No newline at end of file
diff --git a/change_notes/2025-03-26-deviations-suppression.md b/change_notes/2025-03-26-deviations-suppression.md
new file mode 100644
index 0000000000..5dcb5e8dba
--- /dev/null
+++ b/change_notes/2025-03-26-deviations-suppression.md
@@ -0,0 +1 @@
+ - The `DeviationsSuppression.ql` query has been restored after being incorrectly deleted in a previous release.
\ No newline at end of file
diff --git a/change_notes/2025-03-27-detect-precision-limit-in-trig-functions.md b/change_notes/2025-03-27-detect-precision-limit-in-trig-functions.md
new file mode 100644
index 0000000000..914b25a2a2
--- /dev/null
+++ b/change_notes/2025-03-27-detect-precision-limit-in-trig-functions.md
@@ -0,0 +1,2 @@
+ - `DIR-4-11` - `LowPrecisionPeriodicTrigonometricFunctionCall.ql`:
+   - New query within rule added to detect calls to periodic trigonometric functions with values outside of pi*k for k that depends on implementation and application precision goals, assuming k=1 for 32 bit floating types and k=10 for 64 bit floating types.
diff --git a/change_notes/2025-03-31-allow-atomics-threads-and-threadlocals-in-misra-c.md b/change_notes/2025-03-31-allow-atomics-threads-and-threadlocals-in-misra-c.md
new file mode 100644
index 0000000000..b59e04610f
--- /dev/null
+++ b/change_notes/2025-03-31-allow-atomics-threads-and-threadlocals-in-misra-c.md
@@ -0,0 +1,2 @@
+ - `RULE-1-4` - `EmergentLanguageFeaturesUsed.ql`:
+   - Allow usage of atomics, `thread.h`, and `_Thread_local` as per Misra C 2012 Amendment 4.
\ No newline at end of file
diff --git a/change_notes/2025-04-08-address-cross-compiler-compatibility-in-misra-2023.md b/change_notes/2025-04-08-address-cross-compiler-compatibility-in-misra-2023.md
new file mode 100644
index 0000000000..abe4c2bba8
--- /dev/null
+++ b/change_notes/2025-04-08-address-cross-compiler-compatibility-in-misra-2023.md
@@ -0,0 +1,12 @@
+ - `RULE-21-22`, `RULE-21-23` - `TgMathArgumentWithInvalidEssentialType.ql`, `TgMathArgumentsWithDifferingStandardType.ql`
+   - Change type-generic macro analysis for finding macro parameters to be compatible with gcc, by ignoring early arguments inserted by gcc.
+   - Change explicit conversion logic to ignore the explicit casts inserted in macro bodies by clang, which previously overruled the argument essential type.
+ - `RULE-13-2` - `UnsequencedAtomicReads.ql`:
+   - Handle statement expression implementation of atomic operations in gcc.
+ - `RULE-21-25` - `InvalidMemoryOrderArgument.ql`:
+   - Handle case of where the enum `memory_order` is declared via a typedef as an anonymous enum.
+   - Rewrite how atomically sequenced operations are found; no longer look for builtins or internal functions, instead look for macros with the exact expected name and analyze the macro bodies for the memory sequence parameter.
+ - `RULE-9-7` - `UninitializedAtomicArgument.ql`:
+   - Handle gcc case where `atomic_init` is defined is a call to `atomic_store`, and take a more flexible approach to finding the initialized atomic variable.
+ - `DIR-4-15` - `PossibleMisuseOfUndetectedInfinity.ql`, `PossibleMisuseOfUndetectedNaN.ql`:
+   - Fix issue when analyzing clang/gcc implementations of floating point classification macros, where analysis incorrectly determined that `x` in `isinf(x)` was guaranteed to be infinite at the call site itself, affecting later analysis involving `x`.
\ No newline at end of file
diff --git a/change_notes/2025-04-09-new-cert-c-recommendation-query-suite.md b/change_notes/2025-04-09-new-cert-c-recommendation-query-suite.md
new file mode 100644
index 0000000000..910433e351
--- /dev/null
+++ b/change_notes/2025-04-09-new-cert-c-recommendation-query-suite.md
@@ -0,0 +1,9 @@
+ - The following query suites have been added or modified for CERT C:
+   - A new query suite has been created `cert-c-default.qls` to avoid confusion with the CERT C++ query suites. The `cert-default.qls` suite has been deprecated, and will be removed in a future releases, and is replaced by the `cert-c-default.qls` suite.
+     - The `cert-c-default.qls` suite has been specified as the default for the pack, and will include our most up-to-date coverage for CERT C.
+   - One new query suite, `cert-c-recommended.qls` has been added to enable running CERT recommendations (as opposed to rules) that will be added in the future.
+   - The default query suite, `cert-c-default.qls` has been set to exclude CERT recommendations (as opposed to rules) that will be added in the future.
+ - The following query suites have been added or modified for CERT C++:
+   - A new query suite has been created `cert-cpp-default.qls` to avoid confusion with the CERT C query suites. The `cert-default.qls` suite has been deprecated, and will be removed in a future releases, and is replaced by the `cert-cpp-default.qls` suite.
+     - The `cert-cpp-default.qls` suite has been specified as the default for the pack, and will include our most up-to-date coverage for CERT C.
+   - A new query suite has been created `cert-cpp-single-translation-unit.qls` to avoid confusion with the CERT C query suites. The `cert-single-translation-unit.qls` suite has been deprecated, and will be removed in a future releases, and is replaced by the `cert-cpp-single-translation-unit.qls` suite.
\ No newline at end of file
diff --git a/change_notes/2025-04-14-update-infinity-nan-detection.md b/change_notes/2025-04-14-update-infinity-nan-detection.md
new file mode 100644
index 0000000000..fe484a37fe
--- /dev/null
+++ b/change_notes/2025-04-14-update-infinity-nan-detection.md
@@ -0,0 +1,4 @@
+ - `DIR-4-15` - `PossibleMisuseOfUndetectedInfinity.ql`, `PossibleMisuseOfUndetectedNaN.ql`:
+   - Add logic to suppress NaNs from the CodeQL extractor in the new restricted range analysis, which can have unexpected downstream effects.
+   - Alter the behavior of floating point class guards (such as `isinf`, `isfinite`, `isnan`) to more correctly reflect the branches that have been guarded.
+   - Query files have been moved/refactored to share logic across MISRA-C and MISRA-C++; no observable change in behavior from this is expected.
\ No newline at end of file
diff --git a/change_notes/2025-04-25-improve-type-comparison-performance.md b/change_notes/2025-04-25-improve-type-comparison-performance.md
new file mode 100644
index 0000000000..39c462fbf2
--- /dev/null
+++ b/change_notes/2025-04-25-improve-type-comparison-performance.md
@@ -0,0 +1,6 @@
+ - `RULE-8-3`, `RULE-8-4`, `DCL40-C`, `RULE-23-5`: `DeclarationsOfAFunctionSameNameAndType.ql`, `DeclarationsOfAnObjectSameNameAndType.ql`, `CompatibleDeclarationOfFunctionDefined.ql`, `CompatibleDeclarationObjectDefined.ql`, `IncompatibleFunctionDeclarations.ql`, `DangerousDefaultSelectionForPointerInGeneric.ql`:
+   - Added pragmas to alter join order on function parameter equivalence (names and types).
+   - Refactored expression which the optimizer was confused by, and compiled into a cartesian product. 
+   - Altered the module `Compatible.qll` to compute equality in two stages. Firstly, all pairs of possible type comparisons (including recursive comparisons) are found, then those pairwise comparisons are evaluated in a second stage. This greatly reduces the number of comparisons and greatly improves performance.
+ - `RULE-23-5`: `DangerousDefaultSelectionForPointerInGeneric.ql`:
+   - Altered the module `SimpleAssignment.qll` in accordance with the changes to `Compatible.qll`.
\ No newline at end of file
diff --git a/change_notes/2025-05-01-cert-extra-props.md b/change_notes/2025-05-01-cert-extra-props.md
new file mode 100644
index 0000000000..3244360703
--- /dev/null
+++ b/change_notes/2025-05-01-cert-extra-props.md
@@ -0,0 +1,2 @@
+ - All CERT rules now include additional tags to represent the [Risk Assessment](https://wiki.sei.cmu.edu/confluence/display/c/How+this+Coding+Standard+is+Organized#HowthisCodingStandardisOrganized-RiskAssessment) properties specified on CERT rules.
+   - In addition, new query suites are included which allow the selection of queries that represent CERT Rules (not Recommendations) for each of the Levels (1-3). These are called `cert-<lang>-<level>.qls` and can be used either directly in the CodeQL CLI, or via the CodeQL Action.
\ No newline at end of file
diff --git a/change_notes/2025-05-15-misra-c-2023.md b/change_notes/2025-05-15-misra-c-2023.md
new file mode 100644
index 0000000000..defd2ff823
--- /dev/null
+++ b/change_notes/2025-05-15-misra-c-2023.md
@@ -0,0 +1,4 @@
+ - Support for MISRA C 2023 is now completed.
+   - The default query suites for MISRA C now target MISRA C 2023.
+   - The user manual has been updated to list MISRA C 2023 as completed.
+   - The `misra-c-2012-third-edition-with-amendment-2.qls` query suite can be used to run the queries present in MISRA C 2012 (3rd Edition) and Amendment 2.
\ No newline at end of file
diff --git a/change_notes/2025-06-06-same-source-performance.md b/change_notes/2025-06-06-same-source-performance.md
new file mode 100644
index 0000000000..e0dfc36dea
--- /dev/null
+++ b/change_notes/2025-06-06-same-source-performance.md
@@ -0,0 +1,2 @@
+ - `FIO39-C`, `FIO50-CPP`, `A27-0-3`, `RULE-30-0-2`: `IOFstreamMissingPositioning.ql`, `InterleavedInputOutputWithoutPosition.ql`, `InterleavedInputOutputWithoutFlush.ql`, `ReadsAndWritesOnStreamNotSeparatedByPositioning.ql`.
+   - Improved performance for codebases with large numbers of stream or file accesses.
\ No newline at end of file
diff --git a/change_notes/2025-07-11-typo-in-alert-message..md b/change_notes/2025-07-11-typo-in-alert-message..md
new file mode 100644
index 0000000000..077f2efb66
--- /dev/null
+++ b/change_notes/2025-07-11-typo-in-alert-message..md
@@ -0,0 +1,2 @@
+- `SIG30-C`: `CallOnlyAsyncSafeFunctionsWithinSignalHandlers.ql`
+ - Fixed a misspelling of "asynchronous" in the alert message.
diff --git a/change_notes/2025-1-04-misra-c-technical-corrigenda-2.md b/change_notes/2025-1-04-misra-c-technical-corrigenda-2.md
new file mode 100644
index 0000000000..6849951810
--- /dev/null
+++ b/change_notes/2025-1-04-misra-c-technical-corrigenda-2.md
@@ -0,0 +1,12 @@
+ - `RULE-8-3` - `DeclarationsOfAFunctionSameNameAndType.ql`:
+   - Implement new exception, unnamed parameters are not covered by this rule.
+ - `RULE-10-2` - `AdditionSubtractionOnEssentiallyCharType.ql`:
+   - Disallow `+` and `-` operations with an essentially char type and other types larger than int type.
+   - Note, this change affects the essential type of such expressions, which may affect other essential types rules.
+ - `RULE-18-1`, `M5-0-16` - `PointerAndDerivedPointerMustAddressSameArray.ql`, `PointerAndDerivedPointerAccessDifferentArray.ql`:
+   - Treat casts to byte pointers as pointers to arrays of the size of the pointed-to type.
+   - Fix typo in report message, "passed" replaced with "past."
+   - Suppress results where range analysis appears potentially unreliable.
+ - `RULE-21-10`, `RULE-25-5-3`, `ENV34-C` - `CallToSetlocaleInvalidatesOldPointers.ql`, `CallToSetlocaleInvalidatesOldPointersMisra.ql`, `DoNotStorePointersReturnedByEnvFunctions.ql`:
+   - Report usage of returned pointers from `asctime`, `ctime`, during a call to either of the former.
+   - Report usage of returned pointers from `gmtime`, `localtime`, during a call to either of the former.
\ No newline at end of file
diff --git a/change_notes/2025-7-15-fix-performance-issues-in-2.20.7.md b/change_notes/2025-7-15-fix-performance-issues-in-2.20.7.md
new file mode 100644
index 0000000000..a936579a97
--- /dev/null
+++ b/change_notes/2025-7-15-fix-performance-issues-in-2.20.7.md
@@ -0,0 +1,4 @@
+ - `DCL40-C`, `RULE-8-4`: `IncompatibleFunctionDeclarations.ql`, `CompatibleDeclarationFunctionDefined.ql`.
+   - Fixed performance issues introduced when upgrading to CodeQL `2.20.7` by removing unnecessary check that matching function declarations have matching names.
+ - `RULE-7-5`: `IncorrectlySizedIntegerConstantMacroArgument.ql`.
+   - Added a `bindingset` to improve performance when checking if a literal matches the size of an integer constant macro.
\ No newline at end of file
diff --git a/cpp/autosar/src/codeql-pack.lock.yml b/cpp/autosar/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/autosar/src/codeql-pack.lock.yml
+++ b/cpp/autosar/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/autosar/src/codingstandards/cpp/HardwareOrProtocolInterface.qll b/cpp/autosar/src/codingstandards/cpp/HardwareOrProtocolInterface.qll
index d92a28e477..b0b20b82d9 100644
--- a/cpp/autosar/src/codingstandards/cpp/HardwareOrProtocolInterface.qll
+++ b/cpp/autosar/src/codingstandards/cpp/HardwareOrProtocolInterface.qll
@@ -3,14 +3,16 @@ import codingstandards.cpp.CommonTypes as CommonTypes
 
 abstract class HardwareOrProtocolInterfaceClass extends Class { }
 
+class HardwareOrProtocolInterfaceComment extends Comment {
+  HardwareOrProtocolInterfaceComment() {
+    exists(getContents().regexpFind("(?m)^\\s*(//|\\*)\\s*@HardwareOrProtocolInterface\\s*$", _, _))
+  }
+}
+
 class AnnotatedHardwareOrProtocolInterfaceClass extends HardwareOrProtocolInterfaceClass {
   AnnotatedHardwareOrProtocolInterfaceClass() {
-    exists(Comment c, string contents |
-      c.getCommentedElement() = this.getADeclarationEntry() and
-      contents =
-        c.getContents()
-            .splitAt("\n")
-            .regexpFind("^\\s*(//|\\*)\\s*@HardwareOrProtocolInterface\\s*$", _, _)
+    exists(HardwareOrProtocolInterfaceComment c |
+      c.getCommentedElement() = this.getADeclarationEntry()
     )
   }
 }
diff --git a/cpp/autosar/src/qlpack.yml b/cpp/autosar/src/qlpack.yml
index cd37cef87e..6c763ef633 100644
--- a/cpp/autosar/src/qlpack.yml
+++ b/cpp/autosar/src/qlpack.yml
@@ -1,8 +1,8 @@
 name: codeql/autosar-cpp-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 description: AUTOSAR C++14 Guidelines R22-11, R21-11, R20-11, R19-11 and R19-03
 suites: codeql-suites
 license: MIT
 dependencies:
   codeql/common-cpp-coding-standards: '*'
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
diff --git a/cpp/autosar/src/rules/A0-4-1/FloatingPointImplementationShallComplyWithIeeeStandard.ql b/cpp/autosar/src/rules/A0-4-1/FloatingPointImplementationShallComplyWithIeeeStandard.ql
index 9123e7de2f..0a59b423d0 100644
--- a/cpp/autosar/src/rules/A0-4-1/FloatingPointImplementationShallComplyWithIeeeStandard.ql
+++ b/cpp/autosar/src/rules/A0-4-1/FloatingPointImplementationShallComplyWithIeeeStandard.ql
@@ -18,7 +18,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.TypeUses
+import codingstandards.cpp.types.Uses
 
 class NumericLimits extends Class {
   NumericLimits() { this.hasQualifiedName("std", ["numeric_limits", "__libcpp_numeric_limits"]) }
diff --git a/cpp/autosar/src/rules/A12-8-4/MoveConstructorUsesCopySemantics.ql b/cpp/autosar/src/rules/A12-8-4/MoveConstructorUsesCopySemantics.ql
index 4996afd34e..a71d49d844 100644
--- a/cpp/autosar/src/rules/A12-8-4/MoveConstructorUsesCopySemantics.ql
+++ b/cpp/autosar/src/rules/A12-8-4/MoveConstructorUsesCopySemantics.ql
@@ -16,7 +16,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 
 /**
  * A literal with no values.
diff --git a/cpp/autosar/src/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.ql b/cpp/autosar/src/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.ql
index 840d7423fb..4593065e01 100644
--- a/cpp/autosar/src/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.ql
+++ b/cpp/autosar/src/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.ql
@@ -14,7 +14,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.autosar
 import codingstandards.cpp.UserDefinedLiteral as udl
 import codingstandards.cpp.SideEffect
diff --git a/cpp/autosar/src/rules/A13-2-1/AssignmentOperatorReturnThis.ql b/cpp/autosar/src/rules/A13-2-1/AssignmentOperatorReturnThis.ql
index ae0acc3bb5..4e6b7d6f0c 100644
--- a/cpp/autosar/src/rules/A13-2-1/AssignmentOperatorReturnThis.ql
+++ b/cpp/autosar/src/rules/A13-2-1/AssignmentOperatorReturnThis.ql
@@ -16,7 +16,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.Operator
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 predicate returnsThisPointer(UserAssignmentOperator o) {
   exists(PointerDereferenceExpr p, ThisExpr t, ReturnStmt r |
diff --git a/cpp/autosar/src/rules/A13-3-1/FunctionThatContainsForwardingReferenceAsItsArgumentOverloaded.ql b/cpp/autosar/src/rules/A13-3-1/FunctionThatContainsForwardingReferenceAsItsArgumentOverloaded.ql
index 1ae2bc87ab..7b31ae5d9e 100644
--- a/cpp/autosar/src/rules/A13-3-1/FunctionThatContainsForwardingReferenceAsItsArgumentOverloaded.ql
+++ b/cpp/autosar/src/rules/A13-3-1/FunctionThatContainsForwardingReferenceAsItsArgumentOverloaded.ql
@@ -18,7 +18,8 @@ import codingstandards.cpp.FunctionEquivalence
 
 class Candidate extends TemplateFunction {
   Candidate() {
-    this.getAParameter().getType().(RValueReferenceType).getBaseType() instanceof TemplateParameter
+    this.getAParameter().getType().(RValueReferenceType).getBaseType() instanceof
+      TypeTemplateParameter
   }
 }
 
diff --git a/cpp/autosar/src/rules/A14-5-2/NonTemplateMemberDefinedInTemplate.ql b/cpp/autosar/src/rules/A14-5-2/NonTemplateMemberDefinedInTemplate.ql
index 7f9ced9909..a8fb1ace66 100644
--- a/cpp/autosar/src/rules/A14-5-2/NonTemplateMemberDefinedInTemplate.ql
+++ b/cpp/autosar/src/rules/A14-5-2/NonTemplateMemberDefinedInTemplate.ql
@@ -15,10 +15,10 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.TypeUses
+import codingstandards.cpp.types.Uses
 import codingstandards.cpp.Operator
 
-predicate templateDefinitionMentionsTypeParameter(Declaration d, TemplateParameter tp) {
+predicate templateDefinitionMentionsTypeParameter(Declaration d, TypeTemplateParameter tp) {
   exists(Type t |
     (
       // direct reference, e.g., fields.
@@ -50,36 +50,36 @@ predicate templateDefinitionMentionsTypeParameter(Declaration d, TemplateParamet
 }
 
 /**
- * The set of `TemplateParameter` references within an `Enum`.
+ * The set of `TypeTemplateParameter` references within an `Enum`.
  */
-TemplateParameter enumTemplateReferences(Enum e) {
+TypeTemplateParameter enumTemplateReferences(Enum e) {
   templateDefinitionMentionsTypeParameter(e.getADeclaration(), result)
   or
   result = e.getExplicitUnderlyingType()
 }
 
 /**
- * The set of `TemplateParameter` references within an `Class`.
+ * The set of `TypeTemplateParameter` references within an `Class`.
  */
-TemplateParameter classTemplateReferences(Class c) {
+TypeTemplateParameter classTemplateReferences(Class c) {
   templateDefinitionMentionsTypeParameter(c.getAMember(), result)
   or
   c.getADerivation().getBaseType() = result
 }
 
 /**
- * The set of all of the `TemplateParameter`s referenced by a `EnumConstant`.
+ * The set of all of the `TypeTemplateParameter`s referenced by a `EnumConstant`.
  */
-TemplateParameter enumConstantTemplateReferences(EnumConstant ec) {
+TypeTemplateParameter enumConstantTemplateReferences(EnumConstant ec) {
   templateDefinitionMentionsTypeParameter(ec.getDeclaringType(), result)
 }
 
 /**
- * The set of all `TemplateParameter`s referenced by a `Function`.
+ * The set of all `TypeTemplateParameter`s referenced by a `Function`.
  */
-TemplateParameter functionTemplateReferences(Function mf) {
+TypeTemplateParameter functionTemplateReferences(Function mf) {
   // the type of the function
-  exists(TemplateParameter tp |
+  exists(TypeTemplateParameter tp |
     result = tp and
     (
       mf.getType().refersTo(result)
@@ -115,10 +115,10 @@ TemplateParameter functionTemplateReferences(Function mf) {
 }
 
 /**
- * The set of all `TemplateParameters` available as arguments to the declaring
+ * The set of all `TypeTemplateParameters` available as arguments to the declaring
  * element of some `Declarations`.
  */
-TemplateParameter templateParametersOfDeclaringTemplateClass(Declaration d) {
+TypeTemplateParameter templateParametersOfDeclaringTemplateClass(Declaration d) {
   result = d.getDeclaringType().getATemplateArgument()
 }
 
@@ -149,7 +149,7 @@ where
   not d instanceof UserNegationOperator and
   // for each declaration within a template class get the
   // template parameters of the declaring class
-  not exists(TemplateParameter t |
+  not exists(TypeTemplateParameter t |
     t = templateParametersOfDeclaringTemplateClass(d) and
     // and require that the declaration depends on at least
     // one of those template parameters.
@@ -170,7 +170,7 @@ where
   ) and
   // Omit using alias (cf. https://github.com/github/codeql-coding-standards/issues/739)
   // Exclude Using alias which refer directly to a TypeParameter
-  not d.(UsingAliasTypedefType).getBaseType() instanceof TemplateParameter
+  not d.(UsingAliasTypedefType).getBaseType() instanceof TypeTemplateParameter
 select d,
   "Member " + d.getName() + " template class does not use any of template arguments of its $@.",
   d.getDeclaringType(), "declaring type"
diff --git a/cpp/autosar/src/rules/A14-5-3/NonMemberGenericOperatorCondition.ql b/cpp/autosar/src/rules/A14-5-3/NonMemberGenericOperatorCondition.ql
index a2211368ed..c2d28d3ef9 100644
--- a/cpp/autosar/src/rules/A14-5-3/NonMemberGenericOperatorCondition.ql
+++ b/cpp/autosar/src/rules/A14-5-3/NonMemberGenericOperatorCondition.ql
@@ -18,7 +18,7 @@ import codingstandards.cpp.autosar
 class NonMemberGenericOperator extends TemplateFunction {
   NonMemberGenericOperator() {
     this instanceof Operator and
-    exists(TemplateParameter tp, Type pType |
+    exists(TypeTemplateParameter tp, Type pType |
       pType = getAParameter().getType().getUnspecifiedType() //Parameter Type
     |
       pType = tp or
diff --git a/cpp/autosar/src/rules/A15-1-3/ThrownExceptionsShouldBeUnique.ql b/cpp/autosar/src/rules/A15-1-3/ThrownExceptionsShouldBeUnique.ql
index 1459b79b43..97e9133a7a 100644
--- a/cpp/autosar/src/rules/A15-1-3/ThrownExceptionsShouldBeUnique.ql
+++ b/cpp/autosar/src/rules/A15-1-3/ThrownExceptionsShouldBeUnique.ql
@@ -16,7 +16,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.exceptions.ExceptionFlow
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.valuenumbering.HashCons
 
 /** Find a value which defines the exception thrown by the `DirectThrowExpr`, if any. */
diff --git a/cpp/autosar/src/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.ql b/cpp/autosar/src/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.ql
index 9fcd8fa609..1b3a3cfed2 100644
--- a/cpp/autosar/src/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.ql
+++ b/cpp/autosar/src/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.ql
@@ -15,7 +15,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.autosar
 import codingstandards.cpp.exceptions.ExceptionFlow
 import codingstandards.cpp.exceptions.ExceptionSpecifications
diff --git a/cpp/autosar/src/rules/A15-4-4/MissingNoExcept.ql b/cpp/autosar/src/rules/A15-4-4/MissingNoExcept.ql
index 7701a8a1ea..058a77175f 100644
--- a/cpp/autosar/src/rules/A15-4-4/MissingNoExcept.ql
+++ b/cpp/autosar/src/rules/A15-4-4/MissingNoExcept.ql
@@ -19,15 +19,51 @@ import codingstandards.cpp.autosar
 import codingstandards.cpp.exceptions.ExceptionSpecifications
 import codingstandards.cpp.exceptions.ExceptionFlow
 
+// These functions have a noexcept specification that could not be resolved
+// to noexcept(true). So either, they are noexcept(false) functions which
+// means, they can throw an exception OR they have an expression which
+// could not be resolved to "true" or "false". Even in this case, lets
+// be more conservative and assume they may thrown an exception.
+class FunctionWithUnknownNoExcept extends Function {
+  FunctionWithUnknownNoExcept() {
+    // Exists a noexcept specification but not noexcept(true)
+    exists(this.getADeclarationEntry().getNoExceptExpr()) and
+    not isNoExceptTrue(this)
+  }
+}
+
+// This predicate checks if a function can call to other functions
+// that may have a noexcept specification which cannot be resolved to
+// noexcept(true).
+predicate mayCallThrowingFunctions(Function f) {
+  // Exists a call in this function
+  exists(Call fc |
+    fc.getEnclosingFunction() = f and
+    (
+      // Either this call is to a function with an unknown noexcept OR
+      fc.getTarget() instanceof FunctionWithUnknownNoExcept
+      or
+      // That function can further have calls to unknown noexcept functions.
+      mayCallThrowingFunctions(fc.getTarget())
+    )
+  )
+}
+
 from Function f
 where
-  not isExcluded(f, Exceptions1Package::missingNoExceptQuery()) and
+  not isExcluded(f.getADeclarationEntry(), Exceptions1Package::missingNoExceptQuery()) and
   // No thrown exceptions
   not exists(getAFunctionThrownType(f, _)) and
   // But not marked noexcept(true)
   not isNoExceptTrue(f) and
   // Not explicitly marked noexcept(false)
   not isNoExceptExplicitlyFalse(f) and
+  // Not having a noexcept specification that
+  // could not be computed as true or false above.
+  not exists(f.getADeclarationEntry().getNoExceptExpr()) and
+  // Not calling function(s) which have a noexcept specification that
+  // could not be computed as true.
+  not mayCallThrowingFunctions(f) and
   // Not compiler generated
   not f.isCompilerGenerated() and
   // The function is defined in this database
diff --git a/cpp/autosar/src/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.ql b/cpp/autosar/src/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.ql
index 842dc14390..353c985137 100644
--- a/cpp/autosar/src/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.ql
+++ b/cpp/autosar/src/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.ql
@@ -16,7 +16,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.SmartPointers
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import SingleObjectSmartPointerArrayConstructionFlow::PathGraph
 
 class AutosarSmartPointerArraySpecialisation extends AutosarSmartPointer {
diff --git a/cpp/autosar/src/rules/A18-5-2/DoNotUseNonPlacementNew.ql b/cpp/autosar/src/rules/A18-5-2/DoNotUseNonPlacementNew.ql
index 082827f5bb..3cfccbf11e 100644
--- a/cpp/autosar/src/rules/A18-5-2/DoNotUseNonPlacementNew.ql
+++ b/cpp/autosar/src/rules/A18-5-2/DoNotUseNonPlacementNew.ql
@@ -15,7 +15,6 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
 
 from NewOrNewArrayExpr na
 where
diff --git a/cpp/autosar/src/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.ql b/cpp/autosar/src/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.ql
index 7b68030476..cf83f055bd 100644
--- a/cpp/autosar/src/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.ql
+++ b/cpp/autosar/src/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.ql
@@ -16,7 +16,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.standardlibrary.Utility
 
 /*
diff --git a/cpp/autosar/src/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.ql b/cpp/autosar/src/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.ql
index d87366c624..a3acf916ec 100644
--- a/cpp/autosar/src/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.ql
+++ b/cpp/autosar/src/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.ql
@@ -14,7 +14,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.standardlibrary.Utility
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 from StdForwardCall f, Access a
 where
diff --git a/cpp/autosar/src/rules/A2-10-4/IdentifierNameOfStaticNonMemberObjectReusedInNamespace.ql b/cpp/autosar/src/rules/A2-10-4/IdentifierNameOfStaticNonMemberObjectReusedInNamespace.ql
index e04bb89cfa..79e17305fb 100644
--- a/cpp/autosar/src/rules/A2-10-4/IdentifierNameOfStaticNonMemberObjectReusedInNamespace.ql
+++ b/cpp/autosar/src/rules/A2-10-4/IdentifierNameOfStaticNonMemberObjectReusedInNamespace.ql
@@ -22,7 +22,7 @@ class CandidateVariable extends Variable {
     isStatic() and
     not this instanceof MemberVariable and
     //exclude partially specialized template variables
-    not exists(TemplateVariable v | this = v.getAnInstantiation())
+    not this.isSpecialization()
   }
 }
 
diff --git a/cpp/autosar/src/rules/A2-3-1/InvalidCharacterInComment.ql b/cpp/autosar/src/rules/A2-3-1/InvalidCharacterInComment.ql
index a3090003d3..fdcc74b115 100644
--- a/cpp/autosar/src/rules/A2-3-1/InvalidCharacterInComment.ql
+++ b/cpp/autosar/src/rules/A2-3-1/InvalidCharacterInComment.ql
@@ -18,21 +18,23 @@
 import cpp
 import codingstandards.cpp.autosar
 
-bindingset[s]
-string getCharOutsideBasicSourceCharSet(string s) {
-  result = s.regexpFind("[\\u0000-\\u007f]", _, _) and
-  not result.regexpMatch("[\\p{Alnum}\\p{Space}_{}\\[\\]#()<>%:;.?*+-/^&|~!=,\\\\\"'@]")
-  or
-  result = s.regexpFind("[\\u00c0-\\u00df][\\u0080-\\u00bf]", _, _)
-  or
-  result = s.regexpFind("[\\u00e0-\\u00ef][\\u0080-\\u00bf]{2}", _, _)
-  or
-  result = s.regexpFind("[\\u00f0-\\u00f7][\\u0080-\\u00bf]{3}", _, _)
+string getCharOutsideBasicSourceCharSet(Comment c) {
+  exists(string s | s = c.getContents() |
+    result =
+      s.regexpFind("(?![\\p{Alnum}\\p{Space}_{}\\[\\]#()<>%:;.?*+-/^&|~!=,\\\\\"'@])[\\u0000-\\u007f]",
+        _, _)
+    or
+    result = s.regexpFind("[\\u00c0-\\u00df][\\u0080-\\u00bf]", _, _)
+    or
+    result = s.regexpFind("[\\u00e0-\\u00ef][\\u0080-\\u00bf]{2}", _, _)
+    or
+    result = s.regexpFind("[\\u00f0-\\u00f7][\\u0080-\\u00bf]{3}", _, _)
+  )
 }
 
 from Comment c, string ch
 where
   not isExcluded(c, NamingPackage::invalidCharacterInCommentQuery()) and
-  ch = getCharOutsideBasicSourceCharSet(c.getContents())
+  ch = getCharOutsideBasicSourceCharSet(c)
 select c,
   "Comment uses the character '" + ch + "' that is outside the language basic character set."
diff --git a/cpp/autosar/src/rules/A2-7-3/UndocumentedUserDefinedType.ql b/cpp/autosar/src/rules/A2-7-3/UndocumentedUserDefinedType.ql
index b38cf7d02c..020d1d4ee1 100644
--- a/cpp/autosar/src/rules/A2-7-3/UndocumentedUserDefinedType.ql
+++ b/cpp/autosar/src/rules/A2-7-3/UndocumentedUserDefinedType.ql
@@ -28,7 +28,7 @@ private predicate isInFunctionScope(Declaration d) {
 private string doxygenCommentGroupStrings(boolean opening) {
   opening = true and result = ["///@{", "/**@{*/"]
   or
-  opening = false and result = ["///@}", "/**@}*/"]
+  opening = false and result = ["///@}%", "/**@}*/"]
 }
 
 pragma[inline]
@@ -65,30 +65,46 @@ class DocumentableDeclaration extends Declaration {
   string declarationType;
 
   DocumentableDeclaration() {
-    this instanceof UserType and
-    declarationType = "user-defined type" and
-    // Exclude template parameter types.
-    not this.(UserType).involvesTemplateParameter()
-    or
-    this instanceof Function and
-    declarationType = "function" and
-    // Exclude compiler generated functions, which cannot reasonably be documented.
-    not this.(Function).isCompilerGenerated() and
-    // Exclude instantiated template functions, which cannot reasonably be documented.
-    not this.(Function).isFromTemplateInstantiation(_) and
-    // Exclude anonymous lambda functions.
-    not exists(LambdaExpression lc | lc.getLambdaFunction() = this) and
-    //Exclude friend functions (because they have 2 entries in the database), and only one shows documented truly
-    not exists(FriendDecl d |
-      d.getFriend().(Function).getDefinition() = this.getADeclarationEntry()
+    // Within the users codebase, not a system header
+    exists(this.getFile().getRelativePath()) and
+    // Not required to be documented, as used within same scope
+    not isInFunctionScope(this) and
+    (
+      this instanceof UserType and
+      declarationType = "user-defined type" and
+      // Exclude template parameter types.
+      not this.(UserType).involvesTemplateParameter()
+      or
+      this instanceof Function and
+      declarationType = "function" and
+      // Exclude compiler generated functions, which cannot reasonably be documented.
+      not this.(Function).isCompilerGenerated() and
+      // Exclude instantiated template functions, which cannot reasonably be documented.
+      not this.(Function).isFromTemplateInstantiation(_) and
+      // Exclude anonymous lambda functions.
+      not exists(LambdaExpression lc | lc.getLambdaFunction() = this) and
+      //Exclude friend functions (because they have 2 entries in the database), and only one shows documented truly
+      not exists(FriendDecl d |
+        d.getFriend().(Function).getDefinition() = this.getADeclarationEntry()
+      )
+      or
+      this instanceof MemberVariable and
+      declarationType = "member variable" and
+      // Exclude memeber variables in instantiated templates, which cannot reasonably be documented.
+      not this.(MemberVariable).isFromTemplateInstantiation(_) and
+      // Exclude compiler generated variables, such as those for anonymous lambda functions
+      not this.(MemberVariable).isCompilerGenerated()
     )
-    or
-    this instanceof MemberVariable and
-    declarationType = "member variable" and
-    // Exclude memeber variables in instantiated templates, which cannot reasonably be documented.
-    not this.(MemberVariable).isFromTemplateInstantiation(_) and
-    // Exclude compiler generated variables, such as those for anonymous lambda functions
-    not this.(MemberVariable).isCompilerGenerated()
+  }
+
+  private predicate hasDocumentedDefinition() {
+    // Check if the declaration has a documented definition
+    exists(DeclarationEntry de | de = getADeclarationEntry() and isDocumented(de))
+  }
+
+  private predicate hasOnlyDefinitions() {
+    // Check if the declaration has only definitions, i.e., no non-definition entries
+    not exists(DeclarationEntry de | de = getADeclarationEntry() and not de.isDefinition())
   }
 
   /** Gets a `DeclarationEntry` for this declaration that should be documented. */
@@ -96,20 +112,16 @@ class DocumentableDeclaration extends Declaration {
     // Find a declaration entry that is not documented
     result = getADeclarationEntry() and
     not isDocumented(result) and
-    (
-      // Report any non definition DeclarationEntry that is not documented
-      // as long as there is no corresponding documented definition (which must be for a forward declaration)
-      not result.isDefinition() and
-      not exists(DeclarationEntry de |
-        de = getADeclarationEntry() and de.isDefinition() and isDocumented(de)
-      )
-      or
+    if result.isDefinition()
+    then
       // Report the definition DeclarationEntry, only if there are no non-definition `DeclarationEntry`'s
       // The rationale here is that documenting both the non-definition and definition declaration entries
       // is redundant
-      result.isDefinition() and
-      not exists(DeclarationEntry de | de = getADeclarationEntry() and not de.isDefinition())
-    )
+      hasOnlyDefinitions()
+    else
+      // Report any non definition DeclarationEntry that is not documented
+      // as long as there is no corresponding documented definition (which must be for a forward declaration)
+      not hasDocumentedDefinition()
   }
 
   /** Gets a string describing the type of declaration. */
@@ -144,7 +156,6 @@ from DocumentableDeclaration d, DeclarationEntry de
 where
   not isExcluded(de, CommentsPackage::undocumentedUserDefinedTypeQuery()) and
   not isExcluded(d, CommentsPackage::undocumentedUserDefinedTypeQuery()) and
-  not isInFunctionScope(d) and
   d.getAnUndocumentedDeclarationEntry() = de
 select de,
   "Declaration entry for " + d.getDeclarationType() + " " + d.getName() +
diff --git a/cpp/autosar/src/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.ql b/cpp/autosar/src/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.ql
index c7ff6f6bf2..0294bfe2e6 100644
--- a/cpp/autosar/src/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.ql
+++ b/cpp/autosar/src/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.ql
@@ -16,7 +16,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.SmartPointers
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 /*
  * Finds `std::shared_ptr` local variables which are not copy or move initialized, and are not used in
diff --git a/cpp/autosar/src/rules/A27-0-4/CStyleStringsUsed.ql b/cpp/autosar/src/rules/A27-0-4/CStyleStringsUsed.ql
index b698ecf351..b24a4a96cf 100644
--- a/cpp/autosar/src/rules/A27-0-4/CStyleStringsUsed.ql
+++ b/cpp/autosar/src/rules/A27-0-4/CStyleStringsUsed.ql
@@ -14,7 +14,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 class InstanceOfCStyleString extends Expr {
   InstanceOfCStyleString() {
diff --git a/cpp/autosar/src/rules/A3-1-5/NonTrivialNonTemplateFunctionDefinedInsideClassDefinition.ql b/cpp/autosar/src/rules/A3-1-5/NonTrivialNonTemplateFunctionDefinedInsideClassDefinition.ql
index 251f94d6eb..9b250e487a 100644
--- a/cpp/autosar/src/rules/A3-1-5/NonTrivialNonTemplateFunctionDefinedInsideClassDefinition.ql
+++ b/cpp/autosar/src/rules/A3-1-5/NonTrivialNonTemplateFunctionDefinedInsideClassDefinition.ql
@@ -4,9 +4,10 @@
  * @description A function that is not either trivial, a template function, or a member of a
  *              template class may not be defined within a class body.
  * @kind problem
- * @precision very-high
+ * @precision low
  * @problem.severity recommendation
  * @tags external/autosar/id/a3-1-5
+ *       external/autosar/audit
  *       external/autosar/allocated-target/design
  *       external/autosar/enforcement/partially-automated
  *       external/autosar/obligation/required
diff --git a/cpp/autosar/src/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.ql b/cpp/autosar/src/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.ql
deleted file mode 100644
index 920875ca3b..0000000000
--- a/cpp/autosar/src/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.ql
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * @id cpp/autosar/trivial-or-template-function-defined-outside-class-definition
- * @name A3-1-5: A function shall be defined with a class body if and only if it is intended to be inlined
- * @description A function that is either trivial, a template function, or a member of a template
- *              class may not be defined outside of a class body.
- * @kind problem
- * @precision very-high
- * @problem.severity recommendation
- * @tags external/autosar/id/a3-1-5
- *       external/autosar/allocated-target/design
- *       external/autosar/enforcement/partially-automated
- *       external/autosar/obligation/required
- */
-
-import cpp
-import codingstandards.cpp.autosar
-import codingstandards.cpp.Class
-
-/*
- * Find instances of `MemberFunction` where the `MemberFunction` is trivial
- * and it is not inlined within the class.
- */
-
-from MemberFunction mf, string kind
-where
-  not isExcluded(mf, ClassesPackage::trivialOrTemplateFunctionDefinedOutsideClassDefinitionQuery()) and
-  // The member function `mf` is not defined in the class body.
-  exists(FunctionDeclarationEntry fde |
-    fde = mf.getClassBodyDeclarationEntry() and not fde.isDefinition()
-  ) and
-  //ignore destructors
-  not mf instanceof Destructor and
-  // Report functions that are NOT defined in the class body if they are either trivial or
-  // either a template member or part of a template class (i.e., they should
-  // be defined in the class body)
-  (
-    if
-      mf instanceof TemplateOrTemplateClassMemberFunction and
-      mf instanceof TrivialMemberFunction
-    then kind = "template"
-    else
-      if mf instanceof TrivialMemberFunction
-      then kind = "trivial"
-      else
-        if mf instanceof TemplateOrTemplateClassMemberFunction
-        then kind = "template"
-        else none()
-  )
-select mf,
-  "The " + kind + " member function " + mf.getName() + " is not defined in the class body of $@.",
-  mf.getDeclaringType(), mf.getDeclaringType().getName()
diff --git a/cpp/autosar/src/rules/A3-9-1/VariableWidthIntegerTypesUsed.ql b/cpp/autosar/src/rules/A3-9-1/VariableWidthIntegerTypesUsed.ql
index 84a38b0f6a..fa19ad998f 100644
--- a/cpp/autosar/src/rules/A3-9-1/VariableWidthIntegerTypesUsed.ql
+++ b/cpp/autosar/src/rules/A3-9-1/VariableWidthIntegerTypesUsed.ql
@@ -32,6 +32,10 @@ where
     typeStrippedOfSpecifiers instanceof SignedCharType
   ) and
   not v instanceof ExcludedVariable and
+  // Dont consider template instantiations because instantiations with
+  // Fixed Width Types are recorded after stripping their typedef'd type,
+  // thereby, causing false positives (#540).
+  not v.isFromTemplateInstantiation(_) and
   //post-increment/post-decrement operators are required by the standard to have a dummy int parameter
   not v.(Parameter).getFunction() instanceof PostIncrementOperator and
   not v.(Parameter).getFunction() instanceof PostDecrementOperator
diff --git a/cpp/autosar/src/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.ql b/cpp/autosar/src/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.ql
index 34b6660778..ac2375f6aa 100644
--- a/cpp/autosar/src/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.ql
+++ b/cpp/autosar/src/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.ql
@@ -17,7 +17,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.Type
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import NonFinalClassToPointerArithmeticExprFlow::PathGraph
 
 class ArrayAccessOrPointerArith extends Expr {
diff --git a/cpp/autosar/src/rules/A5-1-7/LambdaPassedToDecltype.ql b/cpp/autosar/src/rules/A5-1-7/LambdaPassedToDecltype.ql
index afbd809664..971d3b9259 100644
--- a/cpp/autosar/src/rules/A5-1-7/LambdaPassedToDecltype.ql
+++ b/cpp/autosar/src/rules/A5-1-7/LambdaPassedToDecltype.ql
@@ -15,7 +15,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 module LambdaExpressionToInitializerConfig implements DataFlow::ConfigSig {
   predicate isSource(DataFlow::Node source) { source.asExpr() instanceof LambdaExpression }
diff --git a/cpp/autosar/src/rules/A5-1-7/LambdaPassedToTypeid.ql b/cpp/autosar/src/rules/A5-1-7/LambdaPassedToTypeid.ql
index 08dbecc755..56952dace9 100644
--- a/cpp/autosar/src/rules/A5-1-7/LambdaPassedToTypeid.ql
+++ b/cpp/autosar/src/rules/A5-1-7/LambdaPassedToTypeid.ql
@@ -14,7 +14,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.autosar
 import LambdaExpressionToTypeidFlow::PathGraph
 
diff --git a/cpp/autosar/src/rules/A5-1-9/IdenticalLambdaExpressions.ql b/cpp/autosar/src/rules/A5-1-9/IdenticalLambdaExpressions.ql
index 8717fd000e..1520955716 100644
--- a/cpp/autosar/src/rules/A5-1-9/IdenticalLambdaExpressions.ql
+++ b/cpp/autosar/src/rules/A5-1-9/IdenticalLambdaExpressions.ql
@@ -24,6 +24,14 @@ where
   not lambdaExpression = otherLambdaExpression and
   not lambdaExpression.isFromTemplateInstantiation(_) and
   not otherLambdaExpression.isFromTemplateInstantiation(_) and
-  getLambdaHashCons(lambdaExpression) = getLambdaHashCons(otherLambdaExpression)
+  getLambdaHashCons(lambdaExpression) = getLambdaHashCons(otherLambdaExpression) and
+  // Do not report lambdas produced by the same macro in different invocations
+  not exists(Macro m, MacroInvocation m1, MacroInvocation m2 |
+    m1 = m.getAnInvocation() and
+    m2 = m.getAnInvocation() and
+    not m1 = m2 and // Lambdas in the same macro can be reported
+    m1.getAnExpandedElement() = lambdaExpression and
+    m2.getAnExpandedElement() = otherLambdaExpression
+  )
 select lambdaExpression, "Lambda expression is identical to $@ lambda expression.",
   otherLambdaExpression, "this"
diff --git a/cpp/autosar/src/rules/A5-1-9/LambdaEquivalence.qll b/cpp/autosar/src/rules/A5-1-9/LambdaEquivalence.qll
index 040777e321..cab93608c5 100644
--- a/cpp/autosar/src/rules/A5-1-9/LambdaEquivalence.qll
+++ b/cpp/autosar/src/rules/A5-1-9/LambdaEquivalence.qll
@@ -211,7 +211,7 @@ private module HashCons {
 
   private newtype HC_Params =
     HC_NoParams() or
-    HC_ParamCons(HashConsExpr hc, int i, HC_Params list) { mk_ParamCons(hc, i, list, _) }
+    HC_ParamCons(Type t, string name, int i, HC_Params list) { mk_ParamCons(t, name, i, list, _) }
 
   /**
    * HashConsExpr is the hash-cons of an expression. The relationship between `Expr`
@@ -624,11 +624,21 @@ private module HashCons {
     strictcount(access.getTarget()) = 1
   }
 
+  /**
+   * Gets the name of a variable.
+   *
+   * Extracted for performance reasons, to avoid magic, which was causing performance issues in getParameter(int i).
+   */
+  pragma[nomagic]
+  private string getVariableName(Variable v) { result = v.getName() }
+
   /* Note: This changed from the original HashCons module to be able to find structural equivalent expression. */
   private predicate mk_Variable(Type t, string name, VariableAccess access) {
     analyzableVariable(access) and
     exists(Variable v |
-      v = access.getTarget() and t = v.getUnspecifiedType() and name = v.getName()
+      v = access.getTarget() and
+      t = v.getUnspecifiedType() and
+      name = getVariableName(v)
     )
   }
 
@@ -1104,7 +1114,14 @@ private module HashCons {
     nee.getExpr().getFullyConverted() = child.getAnExpr()
   }
 
-  private predicate mk_StmtCons(HashConsStmt hc, int i, HC_Stmts list, BlockStmt block) {
+  private class LambdaBlockStmt extends BlockStmt {
+    LambdaBlockStmt() {
+      // Restricting to statements inside a lambda expressions.
+      this.getParentScope*() = any(LambdaExpression le).getLambdaFunction()
+    }
+  }
+
+  private predicate mk_StmtCons(HashConsStmt hc, int i, HC_Stmts list, LambdaBlockStmt block) {
     hc = hashConsStmt(block.getStmt(i)) and
     (
       exists(HashConsStmt head, HC_Stmts tail |
@@ -1118,13 +1135,13 @@ private module HashCons {
   }
 
   private predicate mk_StmtConsInner(
-    HashConsStmt head, HC_Stmts tail, int i, HC_Stmts list, BlockStmt block
+    HashConsStmt head, HC_Stmts tail, int i, HC_Stmts list, LambdaBlockStmt block
   ) {
     list = HC_StmtCons(head, i, tail) and
     mk_StmtCons(head, i, tail, block)
   }
 
-  private predicate mk_BlockStmtCons(HC_Stmts hc, BlockStmt s) {
+  private predicate mk_BlockStmtCons(HC_Stmts hc, LambdaBlockStmt s) {
     if s.getNumStmt() > 0
     then
       exists(HashConsStmt head, HC_Stmts tail |
@@ -1275,13 +1292,14 @@ private module HashCons {
     mk_DeclConsInner(_, _, s.getNumDeclarations() - 1, hc, s)
   }
 
-  private predicate mk_ParamCons(HashConsExpr hc, int i, HC_Params list, Function f) {
-    hc = hashConsExpr(f.getParameter(i).getAnAccess()) and
-    (
-      exists(HashConsExpr head, HC_Params tail |
-        mk_ParamConsInner(head, tail, i - 1, list, f) and
-        i > 0
-      )
+  private predicate mk_ParamCons(Type t, string name, int i, HC_Params list, Function f) {
+    exists(Parameter p |
+      p = f.getParameter(i) and
+      t = p.getType() and
+      name = p.getName()
+    |
+      mk_ParamConsInner(_, _, _, i - 1, list, f) and
+      i > 0
       or
       i = 0 and
       list = HC_NoParams()
@@ -1289,10 +1307,10 @@ private module HashCons {
   }
 
   private predicate mk_ParamConsInner(
-    HashConsExpr head, HC_Params tail, int i, HC_Params list, Function f
+    Type t, string name, HC_Params tail, int i, HC_Params list, Function f
   ) {
-    list = HC_ParamCons(head, i, tail) and
-    mk_ParamCons(head, i, tail, f)
+    list = HC_ParamCons(t, name, i, tail) and
+    mk_ParamCons(t, name, i, tail, f)
   }
 
   private predicate mk_FunctionCons(
@@ -1302,7 +1320,7 @@ private module HashCons {
     name = f.getName() and
     body = hashConsStmt(f.getBlock()) and
     if f.getNumberOfParameters() > 0
-    then mk_ParamConsInner(_, _, f.getNumberOfParameters() - 1, params, f)
+    then mk_ParamConsInner(_, _, _, f.getNumberOfParameters() - 1, params, f)
     else params = HC_NoParams()
   }
 
@@ -1486,8 +1504,6 @@ private module HashCons {
 
   cached
   HashConsStmt hashConsStmt(Stmt s) {
-    // Restricting to statements inside a lambda expressions.
-    s.getParentScope*() = any(LambdaExpression le).getLambdaFunction() and
     exists(HC_Stmts list |
       mk_BlockStmtCons(list, s) and
       result = HC_BlockStmt(list)
diff --git a/cpp/autosar/src/rules/A7-1-1/DeclarationUnmodifiedObjectMissingConstSpecifier.ql b/cpp/autosar/src/rules/A7-1-1/DeclarationUnmodifiedObjectMissingConstSpecifier.ql
index ff07bcbdb2..b961acce64 100644
--- a/cpp/autosar/src/rules/A7-1-1/DeclarationUnmodifiedObjectMissingConstSpecifier.ql
+++ b/cpp/autosar/src/rules/A7-1-1/DeclarationUnmodifiedObjectMissingConstSpecifier.ql
@@ -38,6 +38,7 @@ where
   not exists(LambdaExpression lc | lc.getACapture().getField() = v) and
   not v.isFromUninstantiatedTemplate(_) and
   not v.isCompilerGenerated() and
+  not v.getType() instanceof RValueReferenceType and
   //if the instantiation is not constexpr but the template is, still exclude it as a candidate
   not exists(TemplateVariable b | b.getAnInstantiation() = v and b.isConstexpr())
 select v, "Non-constant variable " + v.getName() + cond + " and is not modified."
diff --git a/cpp/autosar/src/rules/A7-1-2/FunctionMissingConstexpr.ql b/cpp/autosar/src/rules/A7-1-2/FunctionMissingConstexpr.ql
deleted file mode 100644
index 1cd68447fe..0000000000
--- a/cpp/autosar/src/rules/A7-1-2/FunctionMissingConstexpr.ql
+++ /dev/null
@@ -1,160 +0,0 @@
-/**
- * @id cpp/autosar/function-missing-constexpr
- * @name A7-1-2: The constexpr specifier shall be used for functions whose return value can be determined at compile time
- * @description Using 'constexpr' makes it clear that a function is intended to return a compile
- *              time constant.
- * @kind problem
- * @precision high
- * @problem.severity recommendation
- * @tags external/autosar/id/a7-1-2
- *       maintainability
- *       external/autosar/allocated-target/implementation
- *       external/autosar/enforcement/automated
- *       external/autosar/obligation/required
- */
-
-import cpp
-import codingstandards.cpp.autosar
-import codingstandards.cpp.TrivialType
-
-/** Gets a non-variant member field. */
-Field getANonVariantField(Class c) {
-  result = c.getAField() and
-  result.isInitializable() and
-  not result instanceof AnonymousUnionField
-}
-
-/**
- * A `Field` holding an "anonymous union" as described by `[class.union]`.
- *
- * For example, the union in this example:
- * ```
- * class C {
- *   union {
- *     int x;
- *     short y;
- *   };
- * }
- * ```
- */
-class AnonymousUnionField extends Field {
-  AnonymousUnionField() { hasName("(unknown field)") }
-
-  /**
-   * Get a direct or indirect union member.
-   *
-   * Indirect members can come from nested anonymous unions.
-   */
-  Field getAVariantMember() {
-    exists(Field f | f = getType().(Union).getAField() |
-      if f instanceof AnonymousUnionField
-      then result = f.(AnonymousUnionField).getAVariantMember()
-      else result = f
-    )
-  }
-
-  /**
-   * Holds if one variant member of this anonymous union field is initialized using NSDMI.
-   */
-  predicate isExplicitlyInitialized() { exists(getAVariantMember().getInitializer().getExpr()) }
-}
-
-/**
- * Get a union which is not initialized by NSDMI.
- */
-AnonymousUnionField getAnUninitializedAnonymousUnionField(Class c) {
-  result = c.getAField() and
-  not result.isExplicitlyInitialized()
-}
-
-/**
- * A function that can be `constexpr` specified according to the constraints for a `constexpr`
- * function as specified in `[dcl.constexpr]/3`.
- */
-class EffectivelyConstExprFunction extends Function {
-  EffectivelyConstExprFunction() {
-    // Not already marked as constexpr
-    not isDeclaredConstexpr() and
-    // Not virtual
-    not isVirtual() and
-    // Returns a literal type (which can be 'void')
-    (isLiteralType(getType()) or this instanceof Constructor) and
-    // Exclude cases that shouldn't be const or can't be const
-    not this instanceof Destructor and
-    not this instanceof CopyAssignmentOperator and
-    not this instanceof MoveAssignmentOperator and
-    not this.isCompilerGenerated() and
-    // All parameters are literal types
-    forall(Parameter p | p = getAParameter() | isLiteralType(p.getType())) and
-    // The function body is either deleted, defaulted or does not include one of the precluding
-    // statement kinds and is both side-effect free and created by the user
-    (
-      isDeleted()
-      or
-      isDefaulted()
-      or
-      not this = any(AsmStmt a).getEnclosingFunction() and
-      not this = any(GotoStmt g).getEnclosingFunction() and
-      not this = any(TryStmt t).getEnclosingFunction() and
-      not exists(LocalVariable lv | this = lv.getFunction() |
-        not isLiteralType(lv.getType())
-        or
-        lv instanceof StaticStorageDurationVariable
-        or
-        lv.isThreadLocal()
-        or
-        not exists(lv.getInitializer().getExpr())
-      ) and
-      // For `constexpr` functions, the compiler only checks the rules above - it doesn't check
-      // whether the function can be evaluated as a compile time constant until the function is used,
-      // and then only confirms that it evaluates to a compile-time constant for a specific set of
-      // arguments used in another constexpr calculation. We approximate this by identifying the set
-      // of functions that are (conservatively) side-effect free.
-      isSideEffectFree() and
-      // "User defined" in some way
-      hasDefinition() and
-      not isCompilerGenerated()
-    ) and
-    (
-      // A constructor should satisfy the constraints as specified in `[dcl.constexpr]/4`.
-      this instanceof Constructor
-      implies
-      (
-        // No virtual base class
-        not getDeclaringType().getDerivation(_).isVirtual() and
-        (
-          // All non-variant members initialized by this constructor
-          forall(Field f | f = getANonVariantField(getDeclaringType()) |
-            exists(ConstructorFieldInit cfi |
-              // Even if this field has a `getInitializer()` a `ConstructorFieldInit` will also be
-              // present on each constructor
-              cfi.getEnclosingFunction() = this and cfi.getTarget() = f
-            )
-          ) and
-          // At least one variant member is initialized for each `AnonymousUnionField` which is not
-          // initialized with a `Field.getInitializer()`. This is different to the non-variant
-          // member case above
-          forall(AnonymousUnionField f |
-            f = getAnUninitializedAnonymousUnionField(getDeclaringType())
-          |
-            exists(ConstructorFieldInit cfi |
-              cfi.getEnclosingFunction() = this and cfi.getTarget() = f.getAVariantMember()
-            )
-          )
-          or
-          // The function is deleted or defaulted, and every field has an NSDMI, and there are no
-          // uninitialized anonymous union fields
-          (isDeleted() or isDefaulted()) and
-          forall(Field f | f = getANonVariantField(getDeclaringType()) |
-            exists(f.getInitializer().getExpr())
-          ) and
-          not exists(getAnUninitializedAnonymousUnionField(getDeclaringType()))
-        )
-      )
-    )
-  }
-}
-
-from EffectivelyConstExprFunction ecef
-where not isExcluded(ecef, ConstPackage::functionMissingConstexprQuery())
-select ecef, ecef.getName() + " function could be marked as 'constexpr'."
diff --git a/cpp/autosar/src/rules/A7-1-2/VariableMissingConstexpr.ql b/cpp/autosar/src/rules/A7-1-2/VariableMissingConstexpr.ql
index a07dbd43f7..af3a00fadb 100644
--- a/cpp/autosar/src/rules/A7-1-2/VariableMissingConstexpr.ql
+++ b/cpp/autosar/src/rules/A7-1-2/VariableMissingConstexpr.ql
@@ -15,7 +15,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 import codingstandards.cpp.SideEffect
 import semmle.code.cpp.controlflow.SSA
 import codingstandards.cpp.Expr
diff --git a/cpp/autosar/src/rules/A7-1-7/IdentifierDeclarationAndInitializationNotOnSeparateLines.ql b/cpp/autosar/src/rules/A7-1-7/IdentifierDeclarationAndInitializationNotOnSeparateLines.ql
index 89aca8048e..addd8af697 100644
--- a/cpp/autosar/src/rules/A7-1-7/IdentifierDeclarationAndInitializationNotOnSeparateLines.ql
+++ b/cpp/autosar/src/rules/A7-1-7/IdentifierDeclarationAndInitializationNotOnSeparateLines.ql
@@ -23,7 +23,7 @@ class UniqueLineStmt extends Locatable {
       exists(Declaration d |
         this = d.getADeclarationEntry() and
         not d instanceof Parameter and
-        not d instanceof TemplateParameter and
+        not d instanceof TypeTemplateParameter and
         // TODO - Needs to be enhanced to solve issues with
         // templated inner classes.
         not d instanceof Function and
@@ -55,11 +55,9 @@ where
   //omit the cases where there is one struct identifier on a struct var line used with typedef
   not exists(Struct s | s.getADeclarationEntry() = e1 and e1 instanceof TypeDeclarationEntry) and
   not exists(Struct s | s.getATypeNameUse() = e1 and e1 instanceof TypeDeclarationEntry) and
-  exists(Location l1, Location l2 |
-    e1.getLocation() = l1 and
-    e2.getLocation() = l2 and
-    not l1 = l2 and
-    l1.getFile() = l2.getFile() and
-    l1.getStartLine() = l2.getStartLine()
+  exists(string file, int startline |
+    e1.getLocation().hasLocationInfo(file, startline, _, _, _) and
+    e2.getLocation().hasLocationInfo(file, startline, _, _, _) and
+    not e1.getLocation() = e2.getLocation()
   )
 select e1, "Expression statement and identifier are on the same line."
diff --git a/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql b/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql
index 6994ab028f..c36bda6cdd 100644
--- a/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql
+++ b/cpp/autosar/src/rules/A7-5-1/InvalidFunctionReturnType.ql
@@ -16,7 +16,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 from Parameter p, ReturnStmt ret
 where
diff --git a/cpp/autosar/src/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.ql b/cpp/autosar/src/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.ql
index 811d98eccb..0bf42ce4ca 100644
--- a/cpp/autosar/src/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.ql
+++ b/cpp/autosar/src/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.ql
@@ -16,7 +16,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.SmartPointers
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.standardlibrary.Utility
 
 Expr lifetimeAffectingSmartPointerExpr(Function f) {
diff --git a/cpp/autosar/src/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.ql b/cpp/autosar/src/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.ql
index 5dec96ed81..3cd310b59b 100644
--- a/cpp/autosar/src/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.ql
+++ b/cpp/autosar/src/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.ql
@@ -18,7 +18,7 @@ import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.SmartPointers
 import codingstandards.cpp.standardlibrary.Utility
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 Expr underlyingObjectAffectingUniquePointerExpr(Function f) {
   result =
diff --git a/cpp/autosar/src/rules/A8-4-4/FunctionReturnMultipleValueCondition.ql b/cpp/autosar/src/rules/A8-4-4/FunctionReturnMultipleValueCondition.ql
index fa38b1d3f6..03f0c3cea6 100644
--- a/cpp/autosar/src/rules/A8-4-4/FunctionReturnMultipleValueCondition.ql
+++ b/cpp/autosar/src/rules/A8-4-4/FunctionReturnMultipleValueCondition.ql
@@ -16,7 +16,6 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
 
 abstract class OutputValue extends Element {
   abstract string getOutputName();
diff --git a/cpp/autosar/src/rules/A8-4-7/TriviallyCopyableSmallType.qll b/cpp/autosar/src/rules/A8-4-7/TriviallyCopyableSmallType.qll
index be7cd76bd2..09c6cdae69 100644
--- a/cpp/autosar/src/rules/A8-4-7/TriviallyCopyableSmallType.qll
+++ b/cpp/autosar/src/rules/A8-4-7/TriviallyCopyableSmallType.qll
@@ -1,6 +1,6 @@
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 
 /**
  * Get the largest word size, in bytes. Some projects may have multiple different
diff --git a/cpp/autosar/src/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.ql b/cpp/autosar/src/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.ql
index 1509ee968a..3b30eb676a 100644
--- a/cpp/autosar/src/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.ql
+++ b/cpp/autosar/src/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.ql
@@ -21,6 +21,7 @@ import codingstandards.cpp.autosar
 import codingstandards.cpp.FunctionParameter
 import codingstandards.cpp.ConstHelpers
 import codingstandards.cpp.Operator
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * Non-const T& `Parameter`s to `Function`s
diff --git a/cpp/autosar/src/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.ql b/cpp/autosar/src/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.ql
index f40faad3dd..478f8dcdf0 100644
--- a/cpp/autosar/src/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.ql
+++ b/cpp/autosar/src/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.ql
@@ -15,7 +15,7 @@
 import cpp
 import codingstandards.cpp.autosar
 import codingstandards.cpp.CommonTypes as CommonTypes
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 class AccessAwareMemberFunction extends MemberFunction {
   Class c;
diff --git a/cpp/autosar/src/rules/M0-1-4/SingleUsePODVariable.qll b/cpp/autosar/src/rules/M0-1-4/SingleUsePODVariable.qll
index c0a32baba9..8985f7254e 100644
--- a/cpp/autosar/src/rules/M0-1-4/SingleUsePODVariable.qll
+++ b/cpp/autosar/src/rules/M0-1-4/SingleUsePODVariable.qll
@@ -1,7 +1,7 @@
 /** A module providing predicates that support identifying single use non volatile POD variables. */
 
 import cpp
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 import codingstandards.cpp.deadcode.UnusedVariables
 
 /**
diff --git a/cpp/autosar/src/rules/M0-3-2/FunctionErroneousReturnValueNotTested.ql b/cpp/autosar/src/rules/M0-3-2/FunctionErroneousReturnValueNotTested.ql
index aee4e40838..77e6278960 100644
--- a/cpp/autosar/src/rules/M0-3-2/FunctionErroneousReturnValueNotTested.ql
+++ b/cpp/autosar/src/rules/M0-3-2/FunctionErroneousReturnValueNotTested.ql
@@ -19,54 +19,11 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
-import semmle.code.cpp.controlflow.Guards
+import codingstandards.cpp.rules.functionerroneousreturnvaluenottested.FunctionErroneousReturnValueNotTested
 
-from FunctionCall fc
-where
-  not isExcluded(fc, ExpressionsPackage::functionErroneousReturnValueNotTestedQuery()) and
-  fc.getTarget()
-      .hasGlobalOrStdName([
-          // fcntl.h
-          "open", "openat", "fcntl", "creat",
-          // locale.h
-          "setlocale",
-          // stdlib.h
-          "system", "getenv", "getenv_s",
-          // signal.h
-          "signal", "raise",
-          // setjmp.h
-          "setjmp",
-          // stdio.h
-          "fopen", "fopen_s", "freopen", "freopen_s", "fclose", "fcloseall", "fflush", "setvbuf",
-          "fgetc", "getc", "fgets", "fputc", "getchar", "gets", "gets_s", "putchar", "puts",
-          "ungetc", "scanf", "fscanf", "sscanf", "scanf_s", "fscanf_s", "sscanf_s", "vscanf",
-          "vfscanf", "vsscanf", "vscanf_s", "vfscanf_s", "vsscanf_s", "printf", "fprintf",
-          "sprintf", "snprintf", "printf_s", "fprintf_s", "sprintf_s", "snprintf_s", "vprintf",
-          "vfprintf", "vsprintf", "vsnprintf", "vprintf_s", "vfprintf_s", "vsprintf_s",
-          "vsnprintf_s", "ftell", "fgetpos", "fseek", "fsetpos", "remove", "rename", "tmpfile",
-          "tmpfile_s", "tmpnam", "tmpnam_s",
-          // string.h
-          "strcpy_s", "strncpy_s", "strcat_s", "strncat_s", "memset_s", "memcpy_s", "memmove_s",
-          "strerror_s",
-          // threads.h
-          "thrd_create", "thrd_sleep", "thrd_detach", "thrd_join", "mtx_init", "mtx_lock",
-          "mtx_timedlock", "mtx_trylock", "mtx_unlock", "cnd_init", "cnd_signal", "cnd_broadcast",
-          "cnd_wait", "cnd_timedwait", "tss_create", "tss_get", "tss_set",
-          // time.h
-          "time", "clock", "timespec_get", "asctime_s", "ctime_s", "gmtime", "gmtime_s",
-          "localtime", "localtime_s",
-          // unistd.h
-          "write", "read", "close", "unlink",
-          // wchar.h
-          "fgetwc", "getwc", "fgetws", "fputwc", "putwc", "fputws", "getwchar", "putwchar",
-          "ungetwc", "wscanf", "fwscanf", "swscanf", "wscanf_s", "fwscanf_s", "swscanf_s",
-          "vwscanf", "vfwscanf", "vswscanf", "vwscanf_s", "vfwscanf_s", "vswscanf_s", "wprintf",
-          "fwprintf", "swprintf", "wprintf_s", "fwprintf_s", "swprintf_s", "snwprintf_s",
-          "vwprintf", "vfwprintf", "vswprintf", "vwprintf_s", "vfwprintf_s", "vswprintf_s",
-          "vsnwprintf_s"
-        ]) and
-  forall(GuardCondition gc |
-    not DataFlow::localFlow(DataFlow::exprNode(fc), DataFlow::exprNode(gc.getAChild*()))
-  )
-select fc, "Return value is not tested for errors."
+class FunctionErrorInformationUntestedQuery extends FunctionErroneousReturnValueNotTestedSharedQuery
+{
+  FunctionErrorInformationUntestedQuery() {
+    this = ExpressionsPackage::functionErroneousReturnValueNotTestedQuery()
+  }
+}
diff --git a/cpp/autosar/src/rules/M14-5-3/CopyAssignmentOperatorNotDeclared.ql b/cpp/autosar/src/rules/M14-5-3/CopyAssignmentOperatorNotDeclared.ql
index 05e99d6e66..1b41fe81bc 100644
--- a/cpp/autosar/src/rules/M14-5-3/CopyAssignmentOperatorNotDeclared.ql
+++ b/cpp/autosar/src/rules/M14-5-3/CopyAssignmentOperatorNotDeclared.ql
@@ -34,10 +34,10 @@ class TemplateAssignmentOperatorMember extends MemberFunction {
   }
 
   /**
-   * is a copy assigment operator candidate if it has only one param and form in [T, T&, const T&, volatile T&, const volatile T&]
+   * is a copy assignment operator candidate if it has only one param and form in [T, T&, const T&, volatile T&, const volatile T&]
    */
   predicate hasGenericCopyCompatibleParameter() {
-    exists(TemplateParameter tp, Type pType |
+    exists(TypeTemplateParameter tp, Type pType |
       pType = this.getAParameter().getType().getUnspecifiedType() and //Parameter Type
       (
         tp = pType //T
diff --git a/cpp/autosar/src/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.ql b/cpp/autosar/src/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.ql
index f7e6664269..279ad08f3c 100644
--- a/cpp/autosar/src/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.ql
+++ b/cpp/autosar/src/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.ql
@@ -14,7 +14,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 predicate pointeeIsModified(PointerDereferenceExpr e, Expr m) {
   exists(Assignment a | a.getLValue() = e and m = a)
diff --git a/cpp/autosar/src/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.ql b/cpp/autosar/src/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.ql
index 3b6e436c56..8e48c05ada 100644
--- a/cpp/autosar/src/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.ql
+++ b/cpp/autosar/src/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.ql
@@ -16,23 +16,19 @@
 import cpp
 import codingstandards.cpp.autosar
 
-from Variable v, Expr aexp
+from Conversion c
 where
-  not isExcluded(v,
+  not isExcluded(c,
     StringsPackage::signedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValuesQuery()) and
-  // We find cases where it is an explicitly signed char type with an assignment
-  // to a non-numeric type. NOTE: This rule addresses cases where the char type
-  // is used character data only, the rule does not explicitly cover this.
-  // Please see M5-0-11 for explicit handling of this case. Get types that are
-  // char, except for ones that are 'plain', meaning the sign is explicit.
+  /* 1. Focus on implicit conversions only (explicit conversions are acceptable). */
+  c.isImplicit() and
+  /* 2. The target type is explicitly signed or unsigned char. */
   (
-    v.getUnspecifiedType() instanceof SignedCharType or
-    v.getUnspecifiedType() instanceof UnsignedCharType
+    c.getUnspecifiedType() instanceof SignedCharType or
+    c.getUnspecifiedType() instanceof UnsignedCharType
   ) and
-  // Identify places where these explicitly signed types are being assigned to a
-  // non-numeric type.
-  aexp = v.getAnAssignedValue() and
-  aexp.getUnspecifiedType() instanceof CharType
-select aexp,
-  "Assignment of an non-integer type to variable $@ which is a variable with an explicitly signed char type",
-  v, v.getName()
+  /* 3. Check if the source expression is a plain char type, i.e. not explicitly signed / unsigned. */
+  c.getExpr().getUnspecifiedType() instanceof PlainCharType
+select c,
+  "This expression of plain char type is implicitly converted to '" +
+    c.getUnspecifiedType().getName() + "'."
diff --git a/cpp/autosar/src/rules/M5-0-17/PointerSubtractionOnDifferentArrays.ql b/cpp/autosar/src/rules/M5-0-17/PointerSubtractionOnDifferentArrays.ql
index ec432cea42..d6d4f6130a 100644
--- a/cpp/autosar/src/rules/M5-0-17/PointerSubtractionOnDifferentArrays.ql
+++ b/cpp/autosar/src/rules/M5-0-17/PointerSubtractionOnDifferentArrays.ql
@@ -15,7 +15,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import ArrayToPointerDiffOperandFlow::PathGraph
 
 module ArrayToPointerDiffOperandConfig implements DataFlow::ConfigSig {
diff --git a/cpp/autosar/src/rules/M5-2-2/PointerToAVirtualBaseClassCastToAPointer.ql b/cpp/autosar/src/rules/M5-2-2/PointerToAVirtualBaseClassCastToAPointer.ql
index 8f20bf808e..086aa40ae7 100644
--- a/cpp/autosar/src/rules/M5-2-2/PointerToAVirtualBaseClassCastToAPointer.ql
+++ b/cpp/autosar/src/rules/M5-2-2/PointerToAVirtualBaseClassCastToAPointer.ql
@@ -15,7 +15,6 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
 
 from Cast cast, VirtualBaseClass castFrom, Class castTo
 where
diff --git a/cpp/autosar/src/rules/M5-3-1/EachOperandOfTheOperatorTheLogicalAndOrTheLogicalOperatorsShallHaveTypeBool.ql b/cpp/autosar/src/rules/M5-3-1/EachOperandOfTheOperatorTheLogicalAndOrTheLogicalOperatorsShallHaveTypeBool.ql
index 03b4ae7f1c..e4589a364a 100644
--- a/cpp/autosar/src/rules/M5-3-1/EachOperandOfTheOperatorTheLogicalAndOrTheLogicalOperatorsShallHaveTypeBool.ql
+++ b/cpp/autosar/src/rules/M5-3-1/EachOperandOfTheOperatorTheLogicalAndOrTheLogicalOperatorsShallHaveTypeBool.ql
@@ -25,6 +25,11 @@ where
   ) and
   t = operand.getType() and
   not t.getUnderlyingType().getUnspecifiedType() instanceof BoolType and
+  // Ignore cases where the type is unknown - this will typically be in unevaluated contexts
+  // within uninstantiated templates. It's necessary to check for this explicitly because
+  // not all unevaluated contexts are considered to be `isFromUninstantiatedTemplate(_)`,
+  // e.g. `noexcept` specifiers
+  not t instanceof UnknownType and
   not exists(ReferenceType rt |
     rt = t.getUnderlyingType().getUnspecifiedType() and rt.getBaseType() instanceof BoolType
   ) and
diff --git a/cpp/autosar/src/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.ql b/cpp/autosar/src/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.ql
index 98207a62a3..559b41527c 100644
--- a/cpp/autosar/src/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.ql
+++ b/cpp/autosar/src/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.ql
@@ -18,7 +18,7 @@
 
 import cpp
 import codingstandards.cpp.autosar
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 class ReferenceTypeWithNonConstBaseType extends ReferenceType {
   ReferenceTypeWithNonConstBaseType() { not this.getBaseType().isConst() }
diff --git a/cpp/autosar/test/codeql-pack.lock.yml b/cpp/autosar/test/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/autosar/test/codeql-pack.lock.yml
+++ b/cpp/autosar/test/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/autosar/test/qlpack.yml b/cpp/autosar/test/qlpack.yml
index e7e8d3e2ce..46f06bed50 100644
--- a/cpp/autosar/test/qlpack.yml
+++ b/cpp/autosar/test/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/autosar-cpp-coding-standards-tests
-version: 2.39.0-dev
+version: 2.49.0-dev
 extractor: cpp
 license: MIT
 dependencies:
diff --git a/cpp/autosar/test/rules/A12-8-6/CopyAndMoveNotDeclaredProtected.expected b/cpp/autosar/test/rules/A12-8-6/CopyAndMoveNotDeclaredProtected.expected
index 9f85da12d6..74ed472a52 100644
--- a/cpp/autosar/test/rules/A12-8-6/CopyAndMoveNotDeclaredProtected.expected
+++ b/cpp/autosar/test/rules/A12-8-6/CopyAndMoveNotDeclaredProtected.expected
@@ -20,7 +20,3 @@
 | test.cpp:109:3:109:12 | declaration of BaseClass8 | Move constructor for base class 'BaseClass8' is not declared protected. |
 | test.cpp:110:15:110:23 | declaration of operator= | Copy assignment operator for base class 'BaseClass8' is not declared protected. |
 | test.cpp:111:15:111:23 | declaration of operator= | Move assignment operator for base class 'BaseClass8' is not declared protected. |
-| test.cpp:124:26:124:26 | declaration of BaseClass9 | Implicit copy constructor for base class 'BaseClass9<int>' is not declared deleted. |
-| test.cpp:124:26:124:26 | declaration of BaseClass9 | Implicit move constructor for base class 'BaseClass9<int>' is not declared deleted. |
-| test.cpp:124:26:124:26 | declaration of operator= | Implicit copy assignment operator for base class 'BaseClass9<int>' is not declared deleted. |
-| test.cpp:124:26:124:26 | declaration of operator= | Implicit move assignment operator for base class 'BaseClass9<int>' is not declared deleted. |
diff --git a/cpp/autosar/test/rules/A12-8-6/test.cpp b/cpp/autosar/test/rules/A12-8-6/test.cpp
index 6a31ca60ae..d197fc18fb 100644
--- a/cpp/autosar/test/rules/A12-8-6/test.cpp
+++ b/cpp/autosar/test/rules/A12-8-6/test.cpp
@@ -12,8 +12,8 @@ class DerivedClass1 // COMPLIANT - not a base class itself
 
 // Base class with compiler generated move/copy is not compliant, because they
 // are public by default
-class BaseClass2 {}; // NON_COMPLIANT - compiler generated move and assignment
-                     // are in contravention
+class BaseClass2 {}; // NON_COMPLIANT[FALSE_NEGATIVE] - compiler generated move
+                     // and assignment are in contravention
 class DerivedClass2  // COMPLIANT - not a base class itself
     : public BaseClass2 {};
 
@@ -87,7 +87,7 @@ template <class T1> class BaseClass7 {
   BaseClass7 &operator=(BaseClass7 const &) = default; // NON_COMPLIANT
   BaseClass7 &operator=(BaseClass7 &&) = default;      // NON_COMPLIANT
   int operator=(int i); // COMPLIANT - not an assignment operator
-};                      // COMPLIANT
+};
 
 template <class T>
 class DerivedClass7 // COMPLIANT - not a base class itself
@@ -121,7 +121,7 @@ class DerivedClass9 // COMPLIANT - not a base class itself
   T t;
 };
 
-template <class T> class BaseClass9 { // NON_COMPLIANT
+template <class T> class BaseClass9 { // NON_COMPLIANT[FALSE_NEGATIVE]
 
 public:
   BaseClass9() {}
diff --git a/cpp/autosar/test/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.expected b/cpp/autosar/test/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.expected
index 53dc884023..5d1d6022b5 100644
--- a/cpp/autosar/test/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.expected
+++ b/cpp/autosar/test/rules/A13-1-3/UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.expected
@@ -1 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.ql:27,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.ql:28,5-13)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (UserDefinedLiteralsOperatorsShallOnlyPerformConversionOfPassedParameters.ql:27,7-20)
 | test.cpp:47:8:47:23 | operator ""_uds5 | User defined literal operator returns $@, which is not converted from a passed parameter | test.cpp:48:10:48:12 | 0.0 | expression |
diff --git a/cpp/autosar/test/rules/A13-2-1/AssignmentOperatorReturnThis.expected b/cpp/autosar/test/rules/A13-2-1/AssignmentOperatorReturnThis.expected
index e9929173b0..9c0d50ca86 100644
--- a/cpp/autosar/test/rules/A13-2-1/AssignmentOperatorReturnThis.expected
+++ b/cpp/autosar/test/rules/A13-2-1/AssignmentOperatorReturnThis.expected
@@ -1,3 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (AssignmentOperatorReturnThis.ql:25,5-13)
 | test.cpp:10:12:10:20 | operator= | User-defined assignment operator $@ does not return *this | test.cpp:10:12:10:20 | operator= |  user defined assignment operator |
 | test.cpp:17:11:17:19 | operator= | User-defined assignment operator $@ does not return *this | test.cpp:17:11:17:19 | operator= |  user defined assignment operator |
 | test.cpp:24:12:24:20 | operator= | User-defined assignment operator $@ does not return *this | test.cpp:24:12:24:20 | operator= |  user defined assignment operator |
diff --git a/cpp/autosar/test/rules/A15-1-3/ThrownExceptionsShouldBeUnique.expected b/cpp/autosar/test/rules/A15-1-3/ThrownExceptionsShouldBeUnique.expected
index b085736659..5db0f83985 100644
--- a/cpp/autosar/test/rules/A15-1-3/ThrownExceptionsShouldBeUnique.expected
+++ b/cpp/autosar/test/rules/A15-1-3/ThrownExceptionsShouldBeUnique.expected
@@ -1,3 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ThrownExceptionsShouldBeUnique.ql:24,3-11)
 | test.cpp:6:5:6:26 | throw ... | The $@ thrown here is a possible duplicate of the $@ thrown $@. | test.cpp:6:5:6:26 | call to exception | std::exception exception | test.cpp:14:5:14:26 | call to exception | exception | test.cpp:14:5:14:26 | throw ... | here |
 | test.cpp:8:5:8:53 | throw ... | The $@ thrown here is a possible duplicate of the $@ thrown $@. | test.cpp:8:5:8:53 | call to runtime_error | std::runtime_error exception | test.cpp:16:5:16:53 | call to runtime_error | exception | test.cpp:16:5:16:53 | throw ... | here |
 | test.cpp:14:5:14:26 | throw ... | The $@ thrown here is a possible duplicate of the $@ thrown $@. | test.cpp:14:5:14:26 | call to exception | std::exception exception | test.cpp:6:5:6:26 | call to exception | exception | test.cpp:6:5:6:26 | throw ... | here |
diff --git a/cpp/autosar/test/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.expected b/cpp/autosar/test/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.expected
index 941771dada..529a7ccf99 100644
--- a/cpp/autosar/test/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.expected
+++ b/cpp/autosar/test/rules/A15-2-2/ConstructorErrorLeavesObjectInInvalidState.expected
@@ -1,3 +1,12 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:47,12-20)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:48,30-38)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:48,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:74,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:74,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:75,7-15)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:130,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:130,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstructorErrorLeavesObjectInInvalidState.ql:130,54-62)
 edges
 | test.cpp:12:16:12:27 | new [bad_alloc] | test.cpp:14:33:16:5 | { ... } [bad_alloc] |
 | test.cpp:13:7:13:28 | throw ... [exception] | test.cpp:14:33:16:5 | { ... } [exception] |
diff --git a/cpp/autosar/test/rules/A15-4-4/coding-standards.xml b/cpp/autosar/test/rules/A15-4-4/coding-standards.xml
new file mode 100644
index 0000000000..6ae9c299fa
--- /dev/null
+++ b/cpp/autosar/test/rules/A15-4-4/coding-standards.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" ?>
+<codingstandards>
+   <!--GENERATED: DO NOT MODIFY. Changes should be made to coding-standards.yml instead.-->
+   <deviations>
+      <deviations-entry>
+         <rule-id>A15-4-4</rule-id>
+         <justification>Suppress entry.</justification>
+         <code-identifier>a-15-4-4-deviation</code-identifier>
+      </deviations-entry>
+   </deviations>
+</codingstandards>
diff --git a/cpp/autosar/test/rules/A15-4-4/test.cpp b/cpp/autosar/test/rules/A15-4-4/test.cpp
index 1f9d0d5a85..faae76ca8e 100644
--- a/cpp/autosar/test/rules/A15-4-4/test.cpp
+++ b/cpp/autosar/test/rules/A15-4-4/test.cpp
@@ -56,4 +56,12 @@ std::string test_fp_reported_in_424(
   s3.append(s1.c_str(), s1.size());
   s3.append(s2.c_str(), s2.size());
   return s3;
-}
\ No newline at end of file
+}
+
+void test_no_except_deviated_decl(); // a-15-4-4-deviation
+
+void test_no_except_deviated_decl() {}
+
+void test_no_except_deviated_defn();
+
+void test_no_except_deviated_defn() {} // a-15-4-4-deviation
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.expected b/cpp/autosar/test/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.expected
index 5f752403dc..bd46224da6 100644
--- a/cpp/autosar/test/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.expected
+++ b/cpp/autosar/test/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.expected
@@ -1,9 +1,17 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:26,67-75)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:27,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:39,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:50,34-42)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:50,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:58,25-33)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:70,3-16)
 edges
 | test.cpp:3:36:3:45 | new[] | test.cpp:19:27:19:44 | call to allocate_int_array | provenance |  |
 | test.cpp:3:36:3:45 | new[] | test.cpp:23:12:23:29 | call to allocate_int_array | provenance |  |
 | test.cpp:3:36:3:45 | new[] | test.cpp:27:20:27:37 | call to allocate_int_array | provenance |  |
 | test.cpp:11:29:11:41 | call to unique_ptr | test.cpp:12:27:12:28 | v2 | provenance |  |
 | test.cpp:12:27:12:28 | v2 | test.cpp:12:30:12:36 | call to release | provenance |  |
+| test.cpp:12:27:12:28 | v2 | test.cpp:12:30:12:36 | call to release | provenance | Config |
 | test.cpp:27:20:27:37 | call to allocate_int_array | test.cpp:32:12:32:20 | int_array | provenance |  |
 nodes
 | test.cpp:3:36:3:45 | new[] | semmle.label | new[] |
diff --git a/cpp/autosar/test/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.expected b/cpp/autosar/test/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.expected
index d9dd02c054..68cab835fa 100644
--- a/cpp/autosar/test/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.expected
+++ b/cpp/autosar/test/rules/A18-5-8/UnnecessaryUseOfDynamicStorage.expected
@@ -1,3 +1,8 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnnecessaryUseOfDynamicStorage.ql:55,34-42)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnnecessaryUseOfDynamicStorage.ql:58,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnnecessaryUseOfDynamicStorage.ql:60,26-34)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (UnnecessaryUseOfDynamicStorage.ql:74,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (UnnecessaryUseOfDynamicStorage.ql:79,41-54)
 | test.cpp:17:17:17:29 | new | StructA object of size 8 bytes does not appear to outlive the function, but is created on the heap instead of the stack. |
 | test.cpp:21:17:21:32 | new[] | StructA[] object of size 800 bytes does not appear to outlive the function, but is created on the heap instead of the stack. |
 | test.cpp:35:20:35:44 | call to make_shared | StructA object of size 8 bytes does not appear to outlive the function, but is created on the heap instead of the stack. |
diff --git a/cpp/autosar/test/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.expected b/cpp/autosar/test/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.expected
index 1c72dd7bf3..9e1cf41d3d 100644
--- a/cpp/autosar/test/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.expected
+++ b/cpp/autosar/test/rules/A18-9-4/ArgumentToForwardSubsequentlyUsed.expected
@@ -1 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArgumentToForwardSubsequentlyUsed.ql:22,10-18)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArgumentToForwardSubsequentlyUsed.ql:24,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ArgumentToForwardSubsequentlyUsed.ql:24,30-38)
 | test.cpp:8:5:8:6 | t2 | The argument $@ of `std::forward` may be indeterminate when accessed at this location. | test.cpp:7:45:7:46 | t2 | t2 |
diff --git a/cpp/autosar/test/rules/A2-7-3/test.cpp b/cpp/autosar/test/rules/A2-7-3/test.cpp
index 01f7bad611..c062da4ee9 100644
--- a/cpp/autosar/test/rules/A2-7-3/test.cpp
+++ b/cpp/autosar/test/rules/A2-7-3/test.cpp
@@ -225,4 +225,14 @@ class ClassG2 { // COMPLIANT
 class ClassG3 { // COMPLIANT
 public:
   friend int foo3() { return 1; } // NON_COMPLIANT
+};
+
+/// @brief A Doxygen comment.
+class ClassH { // COMPLIANT
+public:
+  /// @brief Group with comment at the end.
+  ///@{
+  void m(); // COMPLIANT
+  void n(); // COMPLIANT
+  ///@} End of group
 };
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.expected b/cpp/autosar/test/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.expected
index f15f142b3b..5b770a1925 100644
--- a/cpp/autosar/test/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.expected
+++ b/cpp/autosar/test/rules/A20-8-4/SharedPointerUsedWithNoOwnershipSharing.expected
@@ -1,3 +1,4 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (SharedPointerUsedWithNoOwnershipSharing.ql:47,7-15)
 | test.cpp:14:24:14:26 | sp3 | The ownership of shared_ptr $@ is not shared within or passed out of the local scope of function $@. | test.cpp:14:24:14:26 | sp3 | sp3 | test.cpp:11:22:11:23 | f1 | f1 |
 | test.cpp:16:24:16:26 | sp5 | The ownership of shared_ptr $@ is not shared within or passed out of the local scope of function $@. | test.cpp:16:24:16:26 | sp5 | sp5 | test.cpp:11:22:11:23 | f1 | f1 |
 | test.cpp:17:24:17:26 | sp6 | The ownership of shared_ptr $@ is not shared within or passed out of the local scope of function $@. | test.cpp:17:24:17:26 | sp6 | sp6 | test.cpp:11:22:11:23 | f1 | f1 |
diff --git a/cpp/autosar/test/rules/A27-0-4/CStyleStringsUsed.expected b/cpp/autosar/test/rules/A27-0-4/CStyleStringsUsed.expected
index 6184aad74e..555cb412b8 100644
--- a/cpp/autosar/test/rules/A27-0-4/CStyleStringsUsed.expected
+++ b/cpp/autosar/test/rules/A27-0-4/CStyleStringsUsed.expected
@@ -1,3 +1,6 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CStyleStringsUsed.ql:39,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CStyleStringsUsed.ql:39,23-31)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (CStyleStringsUsed.ql:39,47-55)
 | test.cpp:7:20:7:27 | CodeQL | Usage of C-style string in $@. | test.cpp:7:20:7:27 | CodeQL | expression |
 | test.cpp:7:20:7:27 | CodeQL | Usage of C-style string in $@. | test.cpp:16:16:16:17 | a1 | expression |
 | test.cpp:8:22:8:26 | call to c_str | Usage of C-style string in $@. | test.cpp:8:22:8:26 | call to c_str | expression |
diff --git a/cpp/autosar/test/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.expected b/cpp/autosar/test/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.expected
deleted file mode 100644
index dc0e220a94..0000000000
--- a/cpp/autosar/test/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.expected
+++ /dev/null
@@ -1,7 +0,0 @@
-| test.cpp:65:5:65:11 | getB | The trivial member function getB is not defined in the class body of $@. | test.cpp:2:7:2:7 | A | A |
-| test.cpp:67:25:67:28 | d | The template member function d is not defined in the class body of $@. | test.cpp:2:7:2:7 | A | A |
-| test.cpp:69:5:69:8 | b | The trivial member function b is not defined in the class body of $@. | test.cpp:2:7:2:7 | A | A |
-| test.cpp:88:34:88:57 | complexCalculation | The template member function complexCalculation is not defined in the class body of $@. | test.cpp:71:29:71:29 | B<C> | B<C> |
-| test.cpp:104:47:104:53 | d | The template member function d is not defined in the class body of $@. | test.cpp:71:29:71:29 | B<C> | B<C> |
-| test.cpp:108:27:108:33 | b | The template member function b is not defined in the class body of $@. | test.cpp:71:29:71:29 | B<C> | B<C> |
-| test.cpp:113:27:113:36 | getB | The template member function getB is not defined in the class body of $@. | test.cpp:71:29:71:29 | B<C> | B<C> |
diff --git a/cpp/autosar/test/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.qlref b/cpp/autosar/test/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.qlref
deleted file mode 100644
index c644147bb4..0000000000
--- a/cpp/autosar/test/rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.qlref
+++ /dev/null
@@ -1 +0,0 @@
-rules/A3-1-5/TrivialOrTemplateFunctionDefinedOutsideClassDefinition.ql
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/A3-1-5/test.cpp b/cpp/autosar/test/rules/A3-1-5/test.cpp
index eb1de61b51..e6db0d1190 100644
--- a/cpp/autosar/test/rules/A3-1-5/test.cpp
+++ b/cpp/autosar/test/rules/A3-1-5/test.cpp
@@ -23,7 +23,7 @@ class A {
 
   int complexCalculation();
 
-  int gcd(int a, int b) {
+  int gcd(int a, int b) { // NON_COMPLIANT
     if (b == 0)
       return a;
     int result = gcd(b, (a % b));
@@ -62,11 +62,11 @@ inline int A::complexCalculation() { // COMPLIANT
   return 1;
 }
 
-int A::getB() { return 1; } // NON_COMPLIANT
+int A::getB() { return 1; } // COMPLIANT
 
-template <typename T> T A::d(T t) { return t; } // NON_COMPLIANT
+template <typename T> T A::d(T t) { return t; } // COMPLIANT
 
-int A::b() { return 3; } // NON_COMPLIANT
+int A::b() { return 3; } // COMPLIANT
 
 template <typename C> class B {
 public:
@@ -83,9 +83,30 @@ template <typename C> class B {
   template <typename T> T d(T t);
 
   int complexCalculation();
+
+  int complexCalculation2() { // COMPLIANT - template
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    return 1;
+  }
 };
 
-template <typename C> inline int B<C>::complexCalculation() { // NON_COMPLIANT
+void test_B() {
+  B<int> b;
+  b.complexCalculation2();
+}
+
+template <typename C> inline int B<C>::complexCalculation() { // COMPLIANT
   ;
   ;
   ;
@@ -101,16 +122,16 @@ template <typename C> inline int B<C>::complexCalculation() { // NON_COMPLIANT
   return 1;
 }
 
-template <typename C> template <typename T> T B<C>::d(T t) { // NON_COMPLIANT
+template <typename C> template <typename T> T B<C>::d(T t) { // COMPLIANT
   return t;
 }
 
-template <typename C> int B<C>::b() { // NON_COMPLIANT
+template <typename C> int B<C>::b() { // COMPLIANT
   C c;
   return 3;
 }
 
-template <typename C> int B<C>::getB() { return 3; } // NON_COMPLIANT
+template <typename C> int B<C>::getB() { return 3; } // COMPLIANT
 
 template <typename T> class Foo {
 public:
@@ -128,8 +149,29 @@ class FooBar {
 public:
   ~FooBar();
   int f1(int a, int b);
+
+  template <typename C> int complexCalculation() { // COMPLIANT - template
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    ;
+    return 1;
+  }
 };
 
+void test_FooBar() {
+  FooBar foobar;
+  foobar.complexCalculation<int>();
+}
+
 FooBar::~FooBar() {} // COMPLIANT want to ignore pImpl uses of destructors
 
 int FooBar::f1(int a, int b) { // COMPLIANT not a trivial function
@@ -146,4 +188,4 @@ int FooBar::f1(int a, int b) { // COMPLIANT not a trivial function
     ;
     ;
   }
-}
+}
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/A3-9-1/test.cpp b/cpp/autosar/test/rules/A3-9-1/test.cpp
index 882738eea1..7ffb87ca39 100644
--- a/cpp/autosar/test/rules/A3-9-1/test.cpp
+++ b/cpp/autosar/test/rules/A3-9-1/test.cpp
@@ -75,4 +75,15 @@ void test_variable_width_type_qualified_variables() {
 struct test_fix_fp_614 {
   test_fix_fp_614 operator++(int); // COMPLIANT
   test_fix_fp_614 operator--(int); // COMPLIANT
-};
\ No newline at end of file
+};
+
+// COMPLIANT - instantiated with Fixed Width Types.
+template <typename MyType> constexpr void test_fix_fp_540(MyType value) {
+  value++;
+}
+
+int call_test_fix_fp_540() {
+  test_fix_fp_540<std::uint8_t>(19);
+  test_fix_fp_540<std::int16_t>(20);
+  return 0;
+}
diff --git a/cpp/autosar/test/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.expected b/cpp/autosar/test/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.expected
index b47755725c..e2b51e5fb9 100644
--- a/cpp/autosar/test/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.expected
+++ b/cpp/autosar/test/rules/A5-0-4/PointerArithmeticUsedWithPointersToNonFinalClasses.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerArithmeticUsedWithPointersToNonFinalClasses.ql:45,62-70)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerArithmeticUsedWithPointersToNonFinalClasses.ql:46,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerArithmeticUsedWithPointersToNonFinalClasses.ql:55,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerArithmeticUsedWithPointersToNonFinalClasses.ql:61,3-11)
 edges
 | test.cpp:10:18:10:20 | foo | test.cpp:11:23:11:25 | foo | provenance |  |
 | test.cpp:10:18:10:20 | foo | test.cpp:11:50:11:52 | foo | provenance |  |
diff --git a/cpp/autosar/test/rules/A5-1-7/LambdaPassedToDecltype.expected b/cpp/autosar/test/rules/A5-1-7/LambdaPassedToDecltype.expected
index 8f6447a96b..56896d69fd 100644
--- a/cpp/autosar/test/rules/A5-1-7/LambdaPassedToDecltype.expected
+++ b/cpp/autosar/test/rules/A5-1-7/LambdaPassedToDecltype.expected
@@ -1 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToDecltype.ql:20,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToDecltype.ql:21,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToDecltype.ql:23,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToDecltype.ql:28,44-52)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToDecltype.ql:39,47-55)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToDecltype.ql:40,9-17)
 | test.cpp:14:23:14:24 | decltype(...) | Lambda $@ passed as operand to decltype. | test.cpp:5:13:5:30 | [...](...){...} | expression |
diff --git a/cpp/autosar/test/rules/A5-1-7/LambdaPassedToTypeid.expected b/cpp/autosar/test/rules/A5-1-7/LambdaPassedToTypeid.expected
index 6d65a7b5d5..8f86a87616 100644
--- a/cpp/autosar/test/rules/A5-1-7/LambdaPassedToTypeid.expected
+++ b/cpp/autosar/test/rules/A5-1-7/LambdaPassedToTypeid.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToTypeid.ql:21,50-58)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToTypeid.ql:22,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToTypeid.ql:24,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (LambdaPassedToTypeid.ql:27,39-47)
 edges
 | test.cpp:5:13:5:30 | [...](...){...} | test.cpp:8:38:8:39 | l1 | provenance |  |
 | test.cpp:6:13:6:30 | [...](...){...} | test.cpp:9:38:9:39 | l2 | provenance |  |
diff --git a/cpp/autosar/test/rules/A5-1-9/test.cpp b/cpp/autosar/test/rules/A5-1-9/test.cpp
index 466cf14dfa..511be302a0 100644
--- a/cpp/autosar/test/rules/A5-1-9/test.cpp
+++ b/cpp/autosar/test/rules/A5-1-9/test.cpp
@@ -104,4 +104,10 @@ class Test_issue468 {
     LogError("Error");
     LogFatal("Fatal");
   }
-};
\ No newline at end of file
+};
+
+#define MACRO() [](int i) -> int { return i + 3; }
+void test_macros() {
+  MACRO(); // COMPLIANT
+  MACRO(); // COMPLIANT - no duplication
+}
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/A7-1-1/test.cpp b/cpp/autosar/test/rules/A7-1-1/test.cpp
index 7895fd950f..1fdc0d66eb 100644
--- a/cpp/autosar/test/rules/A7-1-1/test.cpp
+++ b/cpp/autosar/test/rules/A7-1-1/test.cpp
@@ -83,4 +83,16 @@ template <bool... Args> extern constexpr bool recurse_var = true; // COMPLIANT
 template <bool B1, bool... Args>
 extern constexpr bool recurse_var<B1, Args...> = B1 &&recurse_var<Args...>;
 
-void fp_621() { recurse_var<true, true, true>; }
\ No newline at end of file
+void fp_621() { recurse_var<true, true, true>; }
+
+#include <utility>
+
+void variadic_forwarding() {}
+
+template <typename T, typename... Args>
+void variadic_forwarding(T &&first, Args &&...rest) {
+  first;
+  variadic_forwarding(std::forward<Args>(rest)...);
+}
+
+int test_variadic_forwarding() { variadic_forwarding(1, 1.1, "a"); }
diff --git a/cpp/autosar/test/rules/A7-1-2/FunctionMissingConstexpr.expected b/cpp/autosar/test/rules/A7-1-2/FunctionMissingConstexpr.expected
deleted file mode 100644
index a6de3fd724..0000000000
--- a/cpp/autosar/test/rules/A7-1-2/FunctionMissingConstexpr.expected
+++ /dev/null
@@ -1,16 +0,0 @@
-| test.cpp:30:3:30:17 | NonLiteralClass | NonLiteralClass function could be marked as 'constexpr'. |
-| test.cpp:59:5:59:6 | h1 | h1 function could be marked as 'constexpr'. |
-| test.cpp:67:5:67:6 | h2 | h2 function could be marked as 'constexpr'. |
-| test.cpp:100:5:100:6 | h8 | h8 function could be marked as 'constexpr'. |
-| test.cpp:117:7:117:9 | mf1 | mf1 function could be marked as 'constexpr'. |
-| test.cpp:126:3:126:23 | MissingConstexprClass | MissingConstexprClass function could be marked as 'constexpr'. |
-| test.cpp:127:3:127:23 | MissingConstexprClass | MissingConstexprClass function could be marked as 'constexpr'. |
-| test.cpp:128:3:128:23 | MissingConstexprClass | MissingConstexprClass function could be marked as 'constexpr'. |
-| test.cpp:161:3:161:26 | VariantMemberInitialized | VariantMemberInitialized function could be marked as 'constexpr'. |
-| test.cpp:162:3:162:26 | VariantMemberInitialized | VariantMemberInitialized function could be marked as 'constexpr'. |
-| test.cpp:163:3:163:26 | VariantMemberInitialized | VariantMemberInitialized function could be marked as 'constexpr'. |
-| test.cpp:190:3:190:22 | VariantMemberNotInit | VariantMemberNotInit function could be marked as 'constexpr'. |
-| test.cpp:269:26:269:26 | init | init function could be marked as 'constexpr'. |
-| test.cpp:269:26:269:29 | init | init function could be marked as 'constexpr'. |
-| test.cpp:271:26:271:26 | init | init function could be marked as 'constexpr'. |
-| test.cpp:277:6:277:32 | test_template_instantiation | test_template_instantiation function could be marked as 'constexpr'. |
diff --git a/cpp/autosar/test/rules/A7-1-2/FunctionMissingConstexpr.qlref b/cpp/autosar/test/rules/A7-1-2/FunctionMissingConstexpr.qlref
deleted file mode 100644
index 723a910948..0000000000
--- a/cpp/autosar/test/rules/A7-1-2/FunctionMissingConstexpr.qlref
+++ /dev/null
@@ -1 +0,0 @@
-rules/A7-1-2/FunctionMissingConstexpr.ql
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/A7-1-2/VariableMissingConstexpr.expected b/cpp/autosar/test/rules/A7-1-2/VariableMissingConstexpr.expected
index 31c26a11ff..5feec712b8 100644
--- a/cpp/autosar/test/rules/A7-1-2/VariableMissingConstexpr.expected
+++ b/cpp/autosar/test/rules/A7-1-2/VariableMissingConstexpr.expected
@@ -8,16 +8,17 @@
 | test.cpp:44:16:44:17 | lc | Variable 'lc' could be marked 'constexpr'. |
 | test.cpp:45:17:45:19 | lc2 | Variable 'lc2' could be marked 'constexpr'. |
 | test.cpp:55:7:55:8 | m2 | Variable 'm2' could be marked 'constexpr' and static. |
-| test.cpp:130:7:130:8 | m1 | Variable 'm1' could be marked 'constexpr' and static. |
-| test.cpp:141:7:141:8 | m1 | Variable 'm1' could be marked 'constexpr' and static. |
-| test.cpp:221:7:221:8 | l1 | Variable 'l1' could be marked 'constexpr'. |
-| test.cpp:235:7:235:8 | l6 | Variable 'l6' could be marked 'constexpr'. |
-| test.cpp:237:7:237:8 | l8 | Variable 'l8' could be marked 'constexpr'. |
-| test.cpp:240:7:240:9 | l10 | Variable 'l10' could be marked 'constexpr'. |
-| test.cpp:243:7:243:9 | l12 | Variable 'l12' could be marked 'constexpr'. |
-| test.cpp:248:7:248:9 | l15 | Variable 'l15' could be marked 'constexpr'. |
-| test.cpp:250:7:250:9 | l16 | Variable 'l16' could be marked 'constexpr'. |
-| test.cpp:251:7:251:9 | l17 | Variable 'l17' could be marked 'constexpr'. |
-| test.cpp:257:7:257:9 | l21 | Variable 'l21' could be marked 'constexpr'. |
-| test.cpp:262:7:262:9 | l24 | Variable 'l24' could be marked 'constexpr'. |
-| test.cpp:263:7:263:9 | l25 | Variable 'l25' could be marked 'constexpr'. |
+| test.cpp:65:7:65:8 | x2 | Variable 'x2' could be marked 'constexpr'. |
+| test.cpp:66:13:66:14 | x3 | Variable 'x3' could be marked 'constexpr'. |
+| test.cpp:76:7:76:8 | m1 | Variable 'm1' could be marked 'constexpr' and static. |
+| test.cpp:91:7:91:8 | l1 | Variable 'l1' could be marked 'constexpr'. |
+| test.cpp:105:7:105:8 | l6 | Variable 'l6' could be marked 'constexpr'. |
+| test.cpp:107:7:107:8 | l8 | Variable 'l8' could be marked 'constexpr'. |
+| test.cpp:110:7:110:9 | l10 | Variable 'l10' could be marked 'constexpr'. |
+| test.cpp:113:7:113:9 | l12 | Variable 'l12' could be marked 'constexpr'. |
+| test.cpp:118:7:118:9 | l15 | Variable 'l15' could be marked 'constexpr'. |
+| test.cpp:120:7:120:9 | l16 | Variable 'l16' could be marked 'constexpr'. |
+| test.cpp:121:7:121:9 | l17 | Variable 'l17' could be marked 'constexpr'. |
+| test.cpp:127:7:127:9 | l21 | Variable 'l21' could be marked 'constexpr'. |
+| test.cpp:132:7:132:9 | l24 | Variable 'l24' could be marked 'constexpr'. |
+| test.cpp:133:7:133:9 | l25 | Variable 'l25' could be marked 'constexpr'. |
diff --git a/cpp/autosar/test/rules/A7-1-2/test.cpp b/cpp/autosar/test/rules/A7-1-2/test.cpp
index 664a9cb8e7..5366a59f95 100644
--- a/cpp/autosar/test/rules/A7-1-2/test.cpp
+++ b/cpp/autosar/test/rules/A7-1-2/test.cpp
@@ -56,71 +56,17 @@ class MemberConstExpr {
   int m3 = 0; // COMPLIANT - can be set by constructor
 };
 
-int h1(int x, int y) { // NON_COMPLIANT
-  return x + y;
-}
-
-constexpr int h1_correct(int x, int y) { // COMPLIANT
-  return x + y;
-}
-
-int h2(int x) { return h1(x, 1) + 1; } // NON_COMPLIANT
-constexpr int h2_correct(int x) { return h1_correct(x, 1) + 1; } // COMPLIANT
-
-int h3(int x) { // COMPLIANT - uses goto, so can't be constexpr
-  if (x) {
-    goto l1;
-  } else {
-    return 10;
-  }
-l1:
-  return 1;
-}
-
-int h4(int x) { // COMPLIANT - uses try, so can't be constexpr
-  try {
-    return 1;
-  } catch (...) {
-  }
-}
-
-int h5(int x) { // COMPLIANT - declares non literal local var
-  NonLiteralClass nlc;
-}
-
-int h6(int x) { // COMPLIANT - declares static variable
-  static int i = x;
-  return x;
-}
-
-int h7(int x) { // COMPLIANT - declares no init variable
-  int i;
-}
+int h1(int x, int y) { return x + y; }
 
-int h8(int x) { // NON_COMPLIANT - could be constexpr
-  int i = x;
-  return i;
-}
+constexpr int h1_const(int x, int y) { return x + y; }
 
-constexpr int h8_correct(int x) { // COMPLIANT
-  int i = x;
-  return i;
+int h2() {
+  int x1 = h1(1, 1);                 // COMPLIANT
+  int x2 = h1_const(1, 1);           // NON_COMPLIANT
+  const int x3 = h1_const(1, 1);     // NON_COMPLIANT
+  constexpr int x4 = h1_const(1, 1); // COMPLIANT
 }
 
-int h9(int x) { // COMPLIANT - declares thread local variable
-  thread_local int i = x;
-  return x;
-}
-
-class ConstexprFunctionClass {
-public:
-  int mf1(int x) { return m1 + x; }                   // NON_COMPLIANT
-  constexpr int mf1_correct(int x) { return m1 + x; } // COMPLIANT
-
-private:
-  int m1;
-};
-
 class MissingConstexprClass {
 public:
   MissingConstexprClass() = default;               // NON_COMPLIANT
@@ -130,82 +76,6 @@ class MissingConstexprClass {
   int m1 = 0; // NON_COMPLIANT
 };
 
-class VirtualBaseClass {};
-
-class DerivedClass : public virtual VirtualBaseClass {
-public:
-  DerivedClass() = default;               // COMPLIANT
-  DerivedClass(int i) = delete;           // COMPLIANT
-  DerivedClass(int i, LiteralClass lc) {} // COMPLIANT
-private:
-  int m1 = 0; // NON_COMPLIANT
-};
-
-class NotAllMembersInitializedClass {
-public:
-  NotAllMembersInitializedClass() = default;               // COMPLIANT
-  NotAllMembersInitializedClass(int i) = delete;           // COMPLIANT
-  NotAllMembersInitializedClass(int i, LiteralClass lc) {} // COMPLIANT
-private:
-  int m1;
-};
-
-class NonLiteralParamsClass {
-public:
-  NonLiteralParamsClass(int i, NonLiteralClass lc) {} // COMPLIANT
-};
-
-// Variant members are always initialized, so this can be marked constexpr
-class VariantMemberInitialized {
-public:
-  VariantMemberInitialized() = default;               // NON_COMPLIANT
-  VariantMemberInitialized(int i) = delete;           // NON_COMPLIANT
-  VariantMemberInitialized(int i, LiteralClass lc) {} // NON_COMPLIANT
-private:
-  union {
-    int i = 0;
-    short s;
-  };
-};
-
-class VariantMemberInitConstexpr {
-public:
-  constexpr VariantMemberInitConstexpr() = default;               // COMPLIANT
-  constexpr VariantMemberInitConstexpr(int i) = delete;           // COMPLIANT
-  constexpr VariantMemberInitConstexpr(int i, LiteralClass lc) {} // COMPLIANT
-private:
-  union {
-    int i = 0;
-    short s;
-  };
-};
-
-// Variant members are not initialized at declaration, so we can only mark the
-// constructors as constexpr if we explicitly initialize the variant member
-class VariantMemberNotInit {
-public:
-  VariantMemberNotInit() = default;                         // COMPLIANT
-  VariantMemberNotInit(int pi) = delete;                    // COMPLIANT
-  VariantMemberNotInit(int pi, LiteralClass lc) {}          // COMPLIANT
-  VariantMemberNotInit(LiteralClass lc, int pi) : i(pi) {}  // NON_COMPLIANT
-  constexpr VariantMemberNotInit(LiteralClass lc, short pi) // COMPLIANT
-      : i(pi) {}
-
-private:
-  union {
-    int i;
-    short s;
-  };
-};
-
-class ExcludedCases {
-public:
-  ~ExcludedCases() {} // COMPLIANT
-
-  void operator=(ExcludedCases &) {}  // COMPLIANT
-  void operator=(ExcludedCases &&) {} // COMPLIANT
-};
-
 extern int random();
 constexpr int add(int x, int y) { return x + y; }
 // Example with compile time constant literal value as default argument
diff --git a/cpp/autosar/test/rules/A7-5-1/InvalidFunctionReturnType.expected b/cpp/autosar/test/rules/A7-5-1/InvalidFunctionReturnType.expected
index b6d9490803..3287ba88d1 100644
--- a/cpp/autosar/test/rules/A7-5-1/InvalidFunctionReturnType.expected
+++ b/cpp/autosar/test/rules/A7-5-1/InvalidFunctionReturnType.expected
@@ -1,2 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (InvalidFunctionReturnType.ql:27,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (InvalidFunctionReturnType.ql:27,23-31)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (InvalidFunctionReturnType.ql:27,51-59)
 | test.cpp:5:3:5:11 | return ... | Function test_refconst_return returns a reference or a pointer to $@ that is passed by reference to const. | test.cpp:4:44:4:44 | x | parameter |
 | test.cpp:8:3:8:14 | return ... | Function test_ptrconst_return returns a reference or a pointer to $@ that is passed by reference to const. | test.cpp:7:44:7:44 | x | parameter |
diff --git a/cpp/autosar/test/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.expected b/cpp/autosar/test/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.expected
index b751d81835..2ce56fdce9 100644
--- a/cpp/autosar/test/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.expected
+++ b/cpp/autosar/test/rules/A8-4-11/SmartPointerAsParameterWithoutLifetimeSemantics.expected
@@ -1,3 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (SmartPointerAsParameterWithoutLifetimeSemantics.ql:47,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (SmartPointerAsParameterWithoutLifetimeSemantics.ql:56,5-13)
 | test.cpp:7:41:7:43 | up1 | Function $@ takes smart pointer parameter 'up1' but does not implement any lifetime-affecting operations. | test.cpp:7:6:7:18 | smart_ptr_get | smart_ptr_get |
 | test.cpp:16:53:16:55 | sp1 | Function $@ takes smart pointer parameter 'sp1' but does not implement any lifetime-affecting operations. | test.cpp:16:6:16:29 | smart_ptr_ref_assign_ref | smart_ptr_ref_assign_ref |
 | test.cpp:28:55:28:57 | sp1 | Function $@ takes smart pointer parameter 'sp1' but does not implement any lifetime-affecting operations. | test.cpp:28:6:28:31 | smart_ptr_ref_noncompliant | smart_ptr_ref_noncompliant |
diff --git a/cpp/autosar/test/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.expected b/cpp/autosar/test/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.expected
index a01b93335d..0a8ead4af8 100644
--- a/cpp/autosar/test/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.expected
+++ b/cpp/autosar/test/rules/A8-4-12/UniquePtrPassedToFunctionWithImproperSemantics.expected
@@ -1,3 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UniquePtrPassedToFunctionWithImproperSemantics.ql:41,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UniquePtrPassedToFunctionWithImproperSemantics.ql:51,5-13)
 | test.cpp:13:55:13:56 | v1 | Parameter of type std::unique_ptr passed as lvalue reference but not used to modify underlying object. |
 | test.cpp:17:47:17:48 | v1 | Parameter of type std::unique_ptr passed as lvalue reference but not used to modify underlying object. |
 | test.cpp:22:27:22:28 | v1 | Parameter of type std::unique_ptr passed as lvalue reference but not used to modify underlying object. |
diff --git a/cpp/autosar/test/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.expected b/cpp/autosar/test/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.expected
index e3cfa71bb7..25fe77d9a5 100644
--- a/cpp/autosar/test/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.expected
+++ b/cpp/autosar/test/rules/A8-4-9/InOutParametersDeclaredAsTNotModified.expected
@@ -1,3 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (InOutParametersDeclaredAsTNotModified.ql:50,7-15)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (InOutParametersDeclaredAsTNotModified.ql:64,7-15)
 | test.cpp:4:13:4:13 | i | In-out parameter i that is not written to. |
 | test.cpp:7:22:7:24 | str | In-out parameter str that is not read from. |
 | test.cpp:18:14:18:14 | i | In-out parameter i that is not read from. |
diff --git a/cpp/autosar/test/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.expected b/cpp/autosar/test/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.expected
index 04c1f35a45..70892c12c8 100644
--- a/cpp/autosar/test/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.expected
+++ b/cpp/autosar/test/rules/A9-3-1/ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.expected
@@ -1,3 +1,6 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.ql:73,3-11)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.ql:73,23-31)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ReturnsNonConstRawPointersOrReferencesToPrivateOrProtectedData.ql:73,46-54)
 | test.cpp:20:8:20:12 | getB2 | Member function A::getB2 $@ a non-const raw pointer or reference to a private or protected $@. | test.cpp:20:25:20:25 | b | returns | test.cpp:54:7:54:7 | b | field |
 | test.cpp:22:8:22:12 | getB3 | Member function A::getB3 $@ a non-const raw pointer or reference to a private or protected $@. | test.cpp:22:25:22:26 | & ... | returns | test.cpp:54:7:54:7 | b | field |
 | test.cpp:24:8:24:13 | getB33 | Member function A::getB33 $@ a non-const raw pointer or reference to a private or protected $@. | test.cpp:26:12:26:13 | bb | returns | test.cpp:54:7:54:7 | b | field |
diff --git a/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.expected b/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.expected
deleted file mode 100644
index 76cbcebed0..0000000000
--- a/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.expected
+++ /dev/null
@@ -1 +0,0 @@
-| test.cpp:16:3:16:8 | call to remove | Return value is not tested for errors. |
diff --git a/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.qlref b/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.qlref
deleted file mode 100644
index 3cfea1dc31..0000000000
--- a/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.qlref
+++ /dev/null
@@ -1 +0,0 @@
-rules/M0-3-2/FunctionErroneousReturnValueNotTested.ql
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.testref b/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.testref
new file mode 100644
index 0000000000..50847523ce
--- /dev/null
+++ b/cpp/autosar/test/rules/M0-3-2/FunctionErroneousReturnValueNotTested.testref
@@ -0,0 +1 @@
+cpp/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.expected b/cpp/autosar/test/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.expected
index 9aec2314da..d0fe6416ca 100644
--- a/cpp/autosar/test/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.expected
+++ b/cpp/autosar/test/rules/M3-9-3/UnderlyingBitRepresentationsOfFloatingPointValuesUsed.expected
@@ -1,2 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnderlyingBitRepresentationsOfFloatingPointValuesUsed.ql:27,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnderlyingBitRepresentationsOfFloatingPointValuesUsed.ql:36,10-18)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UnderlyingBitRepresentationsOfFloatingPointValuesUsed.ql:37,5-13)
 | test.cpp:5:3:5:20 | ... &= ... | Modification of bit-representation of float originated at $@ | test.cpp:4:24:4:60 | reinterpret_cast<unsigned char *>... | cast |
 | test.cpp:12:3:12:14 | ... &= ... | Modification of bit-representation of float originated at $@ | test.cpp:11:18:11:30 | (uint8_t *)... | cast |
diff --git a/cpp/autosar/test/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.expected b/cpp/autosar/test/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.expected
index 1be5b7b9fc..b23be388c6 100644
--- a/cpp/autosar/test/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.expected
+++ b/cpp/autosar/test/rules/M5-0-12/SignedCharAndUnsignedCharTypeShallOnlyBeUsedForTheStorageAndUseOfNumericValues.expected
@@ -1,4 +1,16 @@
-| test.cpp:4:22:4:24 | 99 | Assignment of an non-integer type to variable $@ which is a variable with an explicitly signed char type | test.cpp:4:17:4:18 | a1 | a1 |
-| test.cpp:6:20:6:22 | 99 | Assignment of an non-integer type to variable $@ which is a variable with an explicitly signed char type | test.cpp:6:15:6:16 | a3 | a3 |
-| test.cpp:9:20:9:22 | 99 | Assignment of an non-integer type to variable $@ which is a variable with an explicitly signed char type | test.cpp:9:15:9:16 | a5 | a5 |
-| test.cpp:12:21:12:23 | 99 | Assignment of an non-integer type to variable $@ which is a variable with an explicitly signed char type | test.cpp:12:16:12:17 | a7 | a7 |
+| test.cpp:58:7:58:8 | (unsigned char)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:61:20:61:21 | (signed char)... | This expression of plain char type is implicitly converted to 'signed char'. |
+| test.cpp:71:21:71:22 | (uint8_t)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:74:20:74:21 | (int8_t)... | This expression of plain char type is implicitly converted to 'signed char'. |
+| test.cpp:84:9:84:11 | (unsigned char)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:87:9:87:11 | (signed char)... | This expression of plain char type is implicitly converted to 'signed char'. |
+| test.cpp:97:9:97:11 | (unsigned char)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:100:9:100:11 | (signed char)... | This expression of plain char type is implicitly converted to 'signed char'. |
+| test.cpp:117:7:117:10 | (unsigned char)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:122:7:122:10 | (signed char)... | This expression of plain char type is implicitly converted to 'signed char'. |
+| test.cpp:137:7:137:10 | (uint8_t)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:142:7:142:10 | (int8_t)... | This expression of plain char type is implicitly converted to 'signed char'. |
+| test.cpp:153:6:153:7 | (unsigned char)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:156:6:156:7 | (signed char)... | This expression of plain char type is implicitly converted to 'signed char'. |
+| test.cpp:166:6:166:7 | (uint8_t)... | This expression of plain char type is implicitly converted to 'unsigned char'. |
+| test.cpp:169:7:169:8 | (int8_t)... | This expression of plain char type is implicitly converted to 'signed char'. |
diff --git a/cpp/autosar/test/rules/M5-0-12/test.cpp b/cpp/autosar/test/rules/M5-0-12/test.cpp
index 453c37bf1e..036db12b04 100644
--- a/cpp/autosar/test/rules/M5-0-12/test.cpp
+++ b/cpp/autosar/test/rules/M5-0-12/test.cpp
@@ -1,16 +1,170 @@
 #include <cstdint>
 
-void f1() {
-  unsigned char a1 = 'c'; // NON_COMPLIANT
-  unsigned char a2 = 10;
-  signed char a3 = 'c'; // NON_COMPLIANT
-  signed char a4 = 10;
+class C1 {
+public:
+  C1(unsigned char y) : x(y) {}
 
-  std::int8_t a5 = 'c'; // NON_COMPLIANT
-  std::int8_t a6 = 10;
+private:
+  unsigned char x;
+};
 
-  std::uint8_t a7 = 'c'; // NON_COMPLIANT
-  std::uint8_t a8 = 10;
+class C2 {
+public:
+  C2(signed char y) : x(y) {}
 
-  char a9 = 'c';
-}
\ No newline at end of file
+private:
+  signed char x;
+};
+
+/* Twin classes for std::uint8_t and std::int8_t */
+class C5 {
+public:
+  C5(unsigned char y) : x(y) {}
+
+private:
+  std::uint8_t x;
+};
+
+class C6 {
+public:
+  C6(signed char y) : x(y) {}
+
+private:
+  std::int8_t x;
+};
+
+void f1(unsigned char x) {}
+void f2(signed char x) {}
+
+/* Twin functions for std::uint8_t and std::int8_t */
+void f9(std::uint8_t x) {}
+void f10(std::int8_t x) {}
+
+int main() {
+
+  /* ========== 1. Assigning a char to another char ========== */
+
+  /* ===== 1-1. Assigning a char to a char variable ===== */
+
+  unsigned char x1 = 1;
+  unsigned char y1 =
+      x1; // COMPLIANT: unsigned char assigned to an unsigned char
+
+  signed char x2 = 1;
+  signed char y2 = x2; // COMPLIANT: signed char assigned to a signed char
+
+  char x3 = 'x';
+  unsigned char y3 =
+      x3; // NON-COMPLIANT: plain char assigned to a unsigned char
+
+  char x4 = 'x';
+  signed char y4 = x4; // NON-COMPLIANT: plain char assigned to a signed char
+
+  /* Twin cases with std::uint8_t and std::int8_t */
+  std::uint8_t x5 = 1;
+  std::uint8_t y5 = x5; // COMPLIANT: std::uint8_t assigned to a std::uint8_t
+
+  std::int8_t x6 = 1;
+  std::int8_t y6 = x6; // COMPLIANT: std::int8_t assigned to a std::int8_t
+
+  char x7 = 'x';
+  std::uint8_t y7 = x7; // NON-COMPLIANT: plain char assigned to a std::uint8_t
+
+  char x8 = 'x';
+  std::int8_t y8 = x8; // NON-COMPLIANT: plain char assigned to a std::int8_t
+
+  /* ===== 1-2. Assigning a char to a char member ===== */
+
+  C1 c1(1); // COMPLIANT: unsigned char arg passed to an unsigned
+            // char member
+
+  C2 c2(1); // COMPLIANT: signed char arg passed to a signed char
+            // member
+
+  C1 c3('x'); // NON-COMPLIANT: plain char arg passed to an unsigned char
+              // member
+
+  C2 c4('x'); // NON-COMPLIANT: plain char arg passed to a signed char
+              // member
+
+  /* Twin cases with std::uint8_t and std::int8_t */
+  C5 c5(1); // COMPLIANT: std::uint8_t arg passed to a
+            // std::uint8_t member
+
+  C6 c6(1); // COMPLIANT: std::int8_t arg passed to a std::int8_t
+            // member
+
+  C5 c7('x'); // NON-COMPLIANT: plain char arg passed to a
+              // std::uint8_t member
+
+  C6 c8('x'); // NON-COMPLIANT: plain char arg passed to a std::int8_t
+              // member
+
+  /* ========== 1-3. Assigning a char to a char through a pointer ========== */
+
+  unsigned char x9 = 1;
+  unsigned char *y9 = &x9;
+  unsigned char z1 =
+      *y9; // COMPLIANT: unsigned char assigned to an *&unsigned char
+
+  signed char x10 = 1;
+  signed char *y10 = &x10;
+  signed char z2 = *y10; // COMPLIANT: signed char assigned to an *&signed char
+
+  char x11 = 1;
+  char *y11 = &x11;
+  unsigned char z3 =
+      *y11; // NON-COMPLIANT: plain char assigned to an *&unsigned char
+
+  char x12 = 1;
+  char *y12 = &x12;
+  signed char z4 =
+      *y12; // NON-COMPLIANT: plain char assigned to an *&signed char
+
+  /* Twin cases with std::uint8_t and std::int8_t */
+  std::uint8_t x13 = 1;
+  std::uint8_t *y13 = &x13;
+  std::uint8_t z5 =
+      *y13; // COMPLIANT: std::uint8_t assigned to a *&std::uint8_t
+
+  std::int8_t x14 = 1;
+  std::int8_t *y14 = &x14;
+  std::int8_t z6 = *y14; // COMPLIANT: std::int8_t assigned to an *&std::int8_t
+
+  char x15 = 1;
+  char *y15 = &x15;
+  std::uint8_t z7 =
+      *y15; // NON-COMPLIANT: plain char assigned to an *&std::uint8_t
+
+  char x16 = 1;
+  char *y16 = &x16;
+  std::int8_t z8 =
+      *y16; // NON-COMPLIANT: plain char assigned to an *&std::int8_t
+
+  /* ========== 2. Passing a char argument to a char parameter ========== */
+
+  unsigned char a1 = 1;
+  f1(a1); // COMPLIANT: unsigned char arg passed to an unsigned char parameter
+
+  signed char a2 = 1;
+  f2(a2); // COMPLIANT: signed char arg passed to a signed char parameter
+
+  char a3 = 'a';
+  f1(a3); // NON-COMPLIANT: plain char arg passed to an unsigned char parameter
+
+  char a4 = 'a';
+  f2(a4); // NON-COMPLIANT: plain char arg passed to a signed char parameter
+
+  /* Twin cases with std::uint8_t and std::int8_t */
+  std::uint8_t a5 = 1;
+  f9(a5); // COMPLIANT: std::uint8_t arg passed to a std::uint8_t parameter
+
+  std::int8_t a6 = 1;
+  f10(a6); // COMPLIANT: std::int8_t arg passed to a std::int8_t parameter
+
+  char a7 = 'a';
+  f9(a7); // NON-COMPLIANT: plain char arg passed to a std::uint8_t parameter
+
+  char a8 = 'a';
+  f10(a8); // NON-COMPLIANT: plain char arg passed to a std::int8_t parameter
+}
diff --git a/cpp/autosar/test/rules/M5-3-1/test.cpp b/cpp/autosar/test/rules/M5-3-1/test.cpp
index 9098e4e40e..4bda4c6682 100644
--- a/cpp/autosar/test/rules/M5-3-1/test.cpp
+++ b/cpp/autosar/test/rules/M5-3-1/test.cpp
@@ -25,4 +25,13 @@ template <typename T = int> class A {
 void f() {
   A<int> a;
   a.test1();
-}
\ No newline at end of file
+}
+
+template <typename T> constexpr bool some_variable_template_v = false;
+template <> constexpr bool some_variable_template_v<int> = true;
+
+template <typename S>
+void template_with_no_except() noexcept(some_variable_template_v<S> &&
+                                        true) { // COMPLIANT
+}
+void test_template() { template_with_no_except<int>(); }
\ No newline at end of file
diff --git a/cpp/autosar/test/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.expected b/cpp/autosar/test/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.expected
index ee9652f505..af7e9efc36 100644
--- a/cpp/autosar/test/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.expected
+++ b/cpp/autosar/test/rules/M9-3-1/ConstMemberFunctionReturnsNonConstPointer.expected
@@ -1,3 +1,5 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstMemberFunctionReturnsNonConstPointer.ql:53,7-15)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (ConstMemberFunctionReturnsNonConstPointer.ql:55,7-15)
 | test.cpp:8:8:8:11 | getA | Const member function returns a pointer to class data $@. | test.cpp:3:8:3:8 | a | a |
 | test.cpp:9:8:9:11 | getB | Const member function returns a pointer to class data $@. | test.cpp:4:8:4:8 | b | b |
 | test.cpp:11:6:11:12 | getThis | Const member function returns a pointer to class data $@. | test.cpp:11:36:11:39 | this | this |
diff --git a/cpp/cert/src/codeql-pack.lock.yml b/cpp/cert/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/cert/src/codeql-pack.lock.yml
+++ b/cpp/cert/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/cert/src/codeql-suites/cert-cpp-default.qls b/cpp/cert/src/codeql-suites/cert-cpp-default.qls
new file mode 100644
index 0000000000..e9211246b1
--- /dev/null
+++ b/cpp/cert/src/codeql-suites/cert-cpp-default.qls
@@ -0,0 +1,9 @@
+- description: CERT C++ 2016 (Default)
+- qlpack: codeql/cert-cpp-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
diff --git a/cpp/cert/src/codeql-suites/cert-cpp-l1.qls b/cpp/cert/src/codeql-suites/cert-cpp-l1.qls
new file mode 100644
index 0000000000..d96def2456
--- /dev/null
+++ b/cpp/cert/src/codeql-suites/cert-cpp-l1.qls
@@ -0,0 +1,12 @@
+- description: CERT C++ 2016 Level 1 Rules (Priority 12 - Priority 27)
+- qlpack: codeql/cert-cpp-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/rule
+    tags contain:
+    - external/cert/level/l1
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
\ No newline at end of file
diff --git a/cpp/cert/src/codeql-suites/cert-cpp-l2.qls b/cpp/cert/src/codeql-suites/cert-cpp-l2.qls
new file mode 100644
index 0000000000..b08cb07536
--- /dev/null
+++ b/cpp/cert/src/codeql-suites/cert-cpp-l2.qls
@@ -0,0 +1,12 @@
+- description: CERT C++ 2016 Level 2 Rules (Priority 6 - Priority 9)
+- qlpack: codeql/cert-cpp-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/rule
+    tags contain:
+    - external/cert/level/l2
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
\ No newline at end of file
diff --git a/cpp/cert/src/codeql-suites/cert-cpp-l3.qls b/cpp/cert/src/codeql-suites/cert-cpp-l3.qls
new file mode 100644
index 0000000000..ca621c96ab
--- /dev/null
+++ b/cpp/cert/src/codeql-suites/cert-cpp-l3.qls
@@ -0,0 +1,12 @@
+- description: CERT C++ 2016 Level 3 Rules (Priority 1 - Priority 4)
+- qlpack: codeql/cert-cpp-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    - external/cert/obligation/rule
+    tags contain:
+    - external/cert/level/l3
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
\ No newline at end of file
diff --git a/cpp/cert/src/codeql-suites/cert-cpp-single-translation-unit.qls b/cpp/cert/src/codeql-suites/cert-cpp-single-translation-unit.qls
new file mode 100644
index 0000000000..2f09815e0d
--- /dev/null
+++ b/cpp/cert/src/codeql-suites/cert-cpp-single-translation-unit.qls
@@ -0,0 +1,11 @@
+- description: CERT C++ 2016 (Single Translation Unit)
+- qlpack: codeql/cert-cpp-coding-standards
+- include:
+    kind:
+    - problem
+    - path-problem
+    tags contain:
+    - scope/single-translation-unit
+- exclude:
+    tags contain:
+    - external/cert/default-disabled
diff --git a/cpp/cert/src/codeql-suites/cert-default.qls b/cpp/cert/src/codeql-suites/cert-default.qls
index e9211246b1..66599b60fb 100644
--- a/cpp/cert/src/codeql-suites/cert-default.qls
+++ b/cpp/cert/src/codeql-suites/cert-default.qls
@@ -1,9 +1,2 @@
-- description: CERT C++ 2016 (Default)
-- qlpack: codeql/cert-cpp-coding-standards
-- include:
-    kind:
-    - problem
-    - path-problem
-- exclude:
-    tags contain:
-    - external/cert/default-disabled
+- description: "DEPRECATED - CERT C++ 2016 - use cert-cpp-default.qls instead"
+- import: codeql-suites/cert-cpp-default.qls
\ No newline at end of file
diff --git a/cpp/cert/src/codeql-suites/cert-single-translation-unit.qls b/cpp/cert/src/codeql-suites/cert-single-translation-unit.qls
index 2f09815e0d..4966648394 100644
--- a/cpp/cert/src/codeql-suites/cert-single-translation-unit.qls
+++ b/cpp/cert/src/codeql-suites/cert-single-translation-unit.qls
@@ -1,11 +1,2 @@
-- description: CERT C++ 2016 (Single Translation Unit)
-- qlpack: codeql/cert-cpp-coding-standards
-- include:
-    kind:
-    - problem
-    - path-problem
-    tags contain:
-    - scope/single-translation-unit
-- exclude:
-    tags contain:
-    - external/cert/default-disabled
+- description: "DEPRECATED - CERT C++ 2016 (Single Translation Unit) - use cert-cpp-single-translation-unit.qls instead"
+- import: codeql-suites/cert-cpp-single-translation-unit.qls
\ No newline at end of file
diff --git a/cpp/cert/src/qlpack.yml b/cpp/cert/src/qlpack.yml
index 464a5172fc..e842352f1c 100644
--- a/cpp/cert/src/qlpack.yml
+++ b/cpp/cert/src/qlpack.yml
@@ -1,8 +1,9 @@
 name: codeql/cert-cpp-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 description: CERT C++ 2016
 suites: codeql-suites
 license: MIT
+default-suite-file: codeql-suites/cert-cpp-default.qls
 dependencies:
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
   codeql/common-cpp-coding-standards: '*'
diff --git a/cpp/cert/src/rules/CON50-CPP/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql b/cpp/cert/src/rules/CON50-CPP/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql
index 88232118bb..53f362e275 100644
--- a/cpp/cert/src/rules/CON50-CPP/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql
+++ b/cpp/cert/src/rules/CON50-CPP/DoNotAllowAMutexToGoOutOfScopeWhileLocked.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con50-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON50-CPP/DoNotDestroyAMutexWhileItIsLocked.ql b/cpp/cert/src/rules/CON50-CPP/DoNotDestroyAMutexWhileItIsLocked.ql
index 2f2f5a6cdb..c15dfca5fc 100644
--- a/cpp/cert/src/rules/CON50-CPP/DoNotDestroyAMutexWhileItIsLocked.ql
+++ b/cpp/cert/src/rules/CON50-CPP/DoNotDestroyAMutexWhileItIsLocked.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/con50-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON51-CPP/EnsureActivelyHeldLocksAreReleasedOnExceptionalConditions.ql b/cpp/cert/src/rules/CON51-CPP/EnsureActivelyHeldLocksAreReleasedOnExceptionalConditions.ql
index df17ec9a27..ac09d41c42 100644
--- a/cpp/cert/src/rules/CON51-CPP/EnsureActivelyHeldLocksAreReleasedOnExceptionalConditions.ql
+++ b/cpp/cert/src/rules/CON51-CPP/EnsureActivelyHeldLocksAreReleasedOnExceptionalConditions.ql
@@ -10,6 +10,11 @@
  * @tags external/cert/id/con51-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON52-CPP/PreventBitFieldAccessFromMultipleThreads.ql b/cpp/cert/src/rules/CON52-CPP/PreventBitFieldAccessFromMultipleThreads.ql
index 49d5309113..9ca1a89525 100644
--- a/cpp/cert/src/rules/CON52-CPP/PreventBitFieldAccessFromMultipleThreads.ql
+++ b/cpp/cert/src/rules/CON52-CPP/PreventBitFieldAccessFromMultipleThreads.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con52-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON53-CPP/DeadlockByLockingInPredefinedOrder.ql b/cpp/cert/src/rules/CON53-CPP/DeadlockByLockingInPredefinedOrder.ql
index bbd075b930..d83b3d520b 100644
--- a/cpp/cert/src/rules/CON53-CPP/DeadlockByLockingInPredefinedOrder.ql
+++ b/cpp/cert/src/rules/CON53-CPP/DeadlockByLockingInPredefinedOrder.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con53-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON54-CPP/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql b/cpp/cert/src/rules/CON54-CPP/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql
index 5584b7bec2..84255dbfc7 100644
--- a/cpp/cert/src/rules/CON54-CPP/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql
+++ b/cpp/cert/src/rules/CON54-CPP/WrapFunctionsThatCanSpuriouslyWakeUpInLoop.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con54-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON55-CPP/PreserveSafetyWhenUsingConditionVariables.ql b/cpp/cert/src/rules/CON55-CPP/PreserveSafetyWhenUsingConditionVariables.ql
index 05d73a4d9f..d4f43c7d09 100644
--- a/cpp/cert/src/rules/CON55-CPP/PreserveSafetyWhenUsingConditionVariables.ql
+++ b/cpp/cert/src/rules/CON55-CPP/PreserveSafetyWhenUsingConditionVariables.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con55-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON56-CPP/DoNotSpeculativelyLockALockedNonRecursiveMutex.ql b/cpp/cert/src/rules/CON56-CPP/DoNotSpeculativelyLockALockedNonRecursiveMutex.ql
index 94d23c8664..67edf2fc22 100644
--- a/cpp/cert/src/rules/CON56-CPP/DoNotSpeculativelyLockALockedNonRecursiveMutex.ql
+++ b/cpp/cert/src/rules/CON56-CPP/DoNotSpeculativelyLockALockedNonRecursiveMutex.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con56-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p1
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CON56-CPP/LockedALockedNonRecursiveMutexAudit.ql b/cpp/cert/src/rules/CON56-CPP/LockedALockedNonRecursiveMutexAudit.ql
index 478a37af65..09ec2fa3d5 100644
--- a/cpp/cert/src/rules/CON56-CPP/LockedALockedNonRecursiveMutexAudit.ql
+++ b/cpp/cert/src/rules/CON56-CPP/LockedALockedNonRecursiveMutexAudit.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/con56-cpp
  *       correctness
  *       concurrency
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p1
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CTR50-CPP/ContainerAccessWithoutRangeCheckCert.ql b/cpp/cert/src/rules/CTR50-CPP/ContainerAccessWithoutRangeCheckCert.ql
index a64e8fca2c..e5565ccbbb 100644
--- a/cpp/cert/src/rules/CTR50-CPP/ContainerAccessWithoutRangeCheckCert.ql
+++ b/cpp/cert/src/rules/CTR50-CPP/ContainerAccessWithoutRangeCheckCert.ql
@@ -10,6 +10,11 @@
  * @tags external/cert/id/ctr50-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CTR51-CPP/UsesValidContainerElementAccess.ql b/cpp/cert/src/rules/CTR51-CPP/UsesValidContainerElementAccess.ql
index 2163412435..0652f065cb 100644
--- a/cpp/cert/src/rules/CTR51-CPP/UsesValidContainerElementAccess.ql
+++ b/cpp/cert/src/rules/CTR51-CPP/UsesValidContainerElementAccess.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/ctr51-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql b/cpp/cert/src/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql
index dc53b7a6d0..b022869136 100644
--- a/cpp/cert/src/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql
+++ b/cpp/cert/src/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/ctr52-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
@@ -16,7 +21,7 @@ import codingstandards.cpp.cert
 import codingstandards.cpp.Iterators
 import codingstandards.cpp.rules.containeraccesswithoutrangecheck.ContainerAccessWithoutRangeCheck as ContainerAccessWithoutRangeCheck
 import semmle.code.cpp.controlflow.Guards
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /**
diff --git a/cpp/cert/src/rules/CTR53-CPP/UseValidIteratorRanges.ql b/cpp/cert/src/rules/CTR53-CPP/UseValidIteratorRanges.ql
index d0afb7754c..1512a7fd99 100644
--- a/cpp/cert/src/rules/CTR53-CPP/UseValidIteratorRanges.ql
+++ b/cpp/cert/src/rules/CTR53-CPP/UseValidIteratorRanges.ql
@@ -8,12 +8,18 @@
  * @problem.severity error
  * @tags external/cert/id/ctr53-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
 import codingstandards.cpp.Iterators
+import semmle.code.cpp.dataflow.DataFlow
 
 predicate startEndArgumentsDoNotPointToTheSameContainer(
   IteratorRangeFunctionCall fc, Expr arg, string reason
diff --git a/cpp/cert/src/rules/CTR54-CPP/DoNotSubtractIteratorsForDifferentContainers.ql b/cpp/cert/src/rules/CTR54-CPP/DoNotSubtractIteratorsForDifferentContainers.ql
index f47f9db201..2401bcbf54 100644
--- a/cpp/cert/src/rules/CTR54-CPP/DoNotSubtractIteratorsForDifferentContainers.ql
+++ b/cpp/cert/src/rules/CTR54-CPP/DoNotSubtractIteratorsForDifferentContainers.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/ctr54-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.ql b/cpp/cert/src/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.ql
index ce1fb52667..c6ea2c4518 100644
--- a/cpp/cert/src/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.ql
+++ b/cpp/cert/src/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/ctr55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
@@ -15,6 +20,7 @@ import cpp
 import codingstandards.cpp.cert
 import codingstandards.cpp.Iterators
 import semmle.code.cpp.controlflow.Dominance
+import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * Models a call to an iterator's `operator+`
diff --git a/cpp/cert/src/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.ql b/cpp/cert/src/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.ql
index a7756b6a6a..b4ac267225 100644
--- a/cpp/cert/src/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.ql
+++ b/cpp/cert/src/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.ql
@@ -8,12 +8,17 @@
  * @problem.severity warning
  * @tags external/cert/id/ctr56-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import NonFinalClassToPointerArithmeticExprFlow::PathGraph
 
 class ArrayAccessOrPointerArith extends Expr {
diff --git a/cpp/cert/src/rules/CTR57-CPP/ProvideAValidOrderingPredicate.ql b/cpp/cert/src/rules/CTR57-CPP/ProvideAValidOrderingPredicate.ql
index f28409bfc9..950ecd0c46 100644
--- a/cpp/cert/src/rules/CTR57-CPP/ProvideAValidOrderingPredicate.ql
+++ b/cpp/cert/src/rules/CTR57-CPP/ProvideAValidOrderingPredicate.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/ctr57-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/CTR58-CPP/PredicateFunctionObjectsShouldNotBeMutable.ql b/cpp/cert/src/rules/CTR58-CPP/PredicateFunctionObjectsShouldNotBeMutable.ql
index be26725105..304b532b79 100644
--- a/cpp/cert/src/rules/CTR58-CPP/PredicateFunctionObjectsShouldNotBeMutable.ql
+++ b/cpp/cert/src/rules/CTR58-CPP/PredicateFunctionObjectsShouldNotBeMutable.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/ctr58-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL50-CPP/DoNotDefineACStyleVariadicFunction.ql b/cpp/cert/src/rules/DCL50-CPP/DoNotDefineACStyleVariadicFunction.ql
index 368f154e22..b24988823c 100644
--- a/cpp/cert/src/rules/DCL50-CPP/DoNotDefineACStyleVariadicFunction.ql
+++ b/cpp/cert/src/rules/DCL50-CPP/DoNotDefineACStyleVariadicFunction.ql
@@ -9,6 +9,11 @@
  *       correctness
  *       security
  *       scope/single-translation-unit
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/EnumeratorReusesReservedName.ql b/cpp/cert/src/rules/DCL51-CPP/EnumeratorReusesReservedName.ql
index 074ae6ebfc..3f8ea668dd 100644
--- a/cpp/cert/src/rules/DCL51-CPP/EnumeratorReusesReservedName.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/EnumeratorReusesReservedName.ql
@@ -10,6 +10,11 @@
  *       maintainability
  *       readability
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/FunctionReusesReservedName.ql b/cpp/cert/src/rules/DCL51-CPP/FunctionReusesReservedName.ql
index 8cae916a9a..74d683a0cb 100644
--- a/cpp/cert/src/rules/DCL51-CPP/FunctionReusesReservedName.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/FunctionReusesReservedName.ql
@@ -10,6 +10,11 @@
  *       maintainability
  *       readability
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/ObjectReusesReservedName.ql b/cpp/cert/src/rules/DCL51-CPP/ObjectReusesReservedName.ql
index 03e1ef7264..fabf036198 100644
--- a/cpp/cert/src/rules/DCL51-CPP/ObjectReusesReservedName.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/ObjectReusesReservedName.ql
@@ -10,6 +10,11 @@
  *       maintainability
  *       readability
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/RedefiningOfStandardLibraryName.ql b/cpp/cert/src/rules/DCL51-CPP/RedefiningOfStandardLibraryName.ql
index 974b231c26..3aaf5d37cb 100644
--- a/cpp/cert/src/rules/DCL51-CPP/RedefiningOfStandardLibraryName.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/RedefiningOfStandardLibraryName.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl51-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/ReuseOfReservedIdentifier.ql b/cpp/cert/src/rules/DCL51-CPP/ReuseOfReservedIdentifier.ql
index b32bdf70ba..583a768d22 100644
--- a/cpp/cert/src/rules/DCL51-CPP/ReuseOfReservedIdentifier.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/ReuseOfReservedIdentifier.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl51-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/UseOfDoubleUnderscoreReservedPrefix.ql b/cpp/cert/src/rules/DCL51-CPP/UseOfDoubleUnderscoreReservedPrefix.ql
index 472f0444ad..c85a7536e9 100644
--- a/cpp/cert/src/rules/DCL51-CPP/UseOfDoubleUnderscoreReservedPrefix.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/UseOfDoubleUnderscoreReservedPrefix.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/dcl51-cpp
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/UseOfReservedLiteralSuffixIdentifier.ql b/cpp/cert/src/rules/DCL51-CPP/UseOfReservedLiteralSuffixIdentifier.ql
index eb2163f667..81036f6f57 100644
--- a/cpp/cert/src/rules/DCL51-CPP/UseOfReservedLiteralSuffixIdentifier.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/UseOfReservedLiteralSuffixIdentifier.ql
@@ -10,6 +10,11 @@
  *       maintainability
  *       readability
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL51-CPP/UseOfSingleUnderscoreReservedPrefix.ql b/cpp/cert/src/rules/DCL51-CPP/UseOfSingleUnderscoreReservedPrefix.ql
index e2f7270f9c..ed57351d6a 100644
--- a/cpp/cert/src/rules/DCL51-CPP/UseOfSingleUnderscoreReservedPrefix.ql
+++ b/cpp/cert/src/rules/DCL51-CPP/UseOfSingleUnderscoreReservedPrefix.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/dcl51-cpp
  *       maintainability
  *       readability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL53-CPP/LocalConstructorInitializedObjectHidesIdentifier.ql b/cpp/cert/src/rules/DCL53-CPP/LocalConstructorInitializedObjectHidesIdentifier.ql
index 237ebbe985..f576144c46 100644
--- a/cpp/cert/src/rules/DCL53-CPP/LocalConstructorInitializedObjectHidesIdentifier.ql
+++ b/cpp/cert/src/rules/DCL53-CPP/LocalConstructorInitializedObjectHidesIdentifier.ql
@@ -9,6 +9,11 @@
  * @problem.severity warning
  * @tags external/cert/id/dcl53-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
@@ -20,6 +25,6 @@ from UserVariable v, UserVariable hidden
 where
   not isExcluded(v, ScopePackage::localConstructorInitializedObjectHidesIdentifierQuery()) and
   v.getInitializer().getExpr() instanceof ConstructorCall and
-  hides(hidden, v)
+  hidesStrict(hidden, v)
 select v, "The declaration declares variable " + v.getName() + " that hides $@", hidden,
   hidden.getName()
diff --git a/cpp/cert/src/rules/DCL53-CPP/LocalFunctionDeclaration.ql b/cpp/cert/src/rules/DCL53-CPP/LocalFunctionDeclaration.ql
index 3f91530c84..45aa70dc31 100644
--- a/cpp/cert/src/rules/DCL53-CPP/LocalFunctionDeclaration.ql
+++ b/cpp/cert/src/rules/DCL53-CPP/LocalFunctionDeclaration.ql
@@ -8,12 +8,16 @@
  * @problem.severity warning
  * @tags external/cert/id/dcl53-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.Scope
 
 class LocalUserFunctionDeclarationEntry extends FunctionDeclarationEntry {
   DeclStmt ds;
diff --git a/cpp/cert/src/rules/DCL54-CPP/SingularOverloadOfMemoryFunction.ql b/cpp/cert/src/rules/DCL54-CPP/SingularOverloadOfMemoryFunction.ql
index 7f419397ee..8f168e90c8 100644
--- a/cpp/cert/src/rules/DCL54-CPP/SingularOverloadOfMemoryFunction.ql
+++ b/cpp/cert/src/rules/DCL54-CPP/SingularOverloadOfMemoryFunction.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl54-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL55-CPP/InformationLeakageAcrossTrustBoundaries.ql b/cpp/cert/src/rules/DCL55-CPP/InformationLeakageAcrossTrustBoundaries.ql
index cf301dfb5f..85b72afaeb 100644
--- a/cpp/cert/src/rules/DCL55-CPP/InformationLeakageAcrossTrustBoundaries.ql
+++ b/cpp/cert/src/rules/DCL55-CPP/InformationLeakageAcrossTrustBoundaries.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl55-cpp
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p1
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL56-CPP/CyclesDuringStaticObjectInit.ql b/cpp/cert/src/rules/DCL56-CPP/CyclesDuringStaticObjectInit.ql
index 1ad411427f..4eb94f3d1d 100644
--- a/cpp/cert/src/rules/DCL56-CPP/CyclesDuringStaticObjectInit.ql
+++ b/cpp/cert/src/rules/DCL56-CPP/CyclesDuringStaticObjectInit.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/dcl56-cpp
  *       correctness
  *       maintainability
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL57-CPP/DoNotLetExceptionsEscapeFromDestructorsOrDeallocationFunctions.ql b/cpp/cert/src/rules/DCL57-CPP/DoNotLetExceptionsEscapeFromDestructorsOrDeallocationFunctions.ql
index 951169abe5..6f625fd308 100644
--- a/cpp/cert/src/rules/DCL57-CPP/DoNotLetExceptionsEscapeFromDestructorsOrDeallocationFunctions.ql
+++ b/cpp/cert/src/rules/DCL57-CPP/DoNotLetExceptionsEscapeFromDestructorsOrDeallocationFunctions.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl57-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL58-CPP/ModificationOfTheStandardNamespaces.ql b/cpp/cert/src/rules/DCL58-CPP/ModificationOfTheStandardNamespaces.ql
index a0e94d083c..81242bc0f4 100644
--- a/cpp/cert/src/rules/DCL58-CPP/ModificationOfTheStandardNamespaces.ql
+++ b/cpp/cert/src/rules/DCL58-CPP/ModificationOfTheStandardNamespaces.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl58-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL59-CPP/UnnamedNamespaceInHeaderFile.ql b/cpp/cert/src/rules/DCL59-CPP/UnnamedNamespaceInHeaderFile.ql
index 57dae96f09..2b8b364c7d 100644
--- a/cpp/cert/src/rules/DCL59-CPP/UnnamedNamespaceInHeaderFile.ql
+++ b/cpp/cert/src/rules/DCL59-CPP/UnnamedNamespaceInHeaderFile.ql
@@ -10,6 +10,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl59-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/DCL60-CPP/OneDefinitionRuleNotObeyed.ql b/cpp/cert/src/rules/DCL60-CPP/OneDefinitionRuleNotObeyed.ql
index 7908609cc6..84e63a9569 100644
--- a/cpp/cert/src/rules/DCL60-CPP/OneDefinitionRuleNotObeyed.ql
+++ b/cpp/cert/src/rules/DCL60-CPP/OneDefinitionRuleNotObeyed.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/dcl60-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR50-CPP/ConditionVariablePostConditionFailedCert.ql b/cpp/cert/src/rules/ERR50-CPP/ConditionVariablePostConditionFailedCert.ql
index 6c22010ef7..40a884fc5a 100644
--- a/cpp/cert/src/rules/ERR50-CPP/ConditionVariablePostConditionFailedCert.ql
+++ b/cpp/cert/src/rules/ERR50-CPP/ConditionVariablePostConditionFailedCert.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/err50-cpp
  *       correctness
  *       external/cert/audit
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR50-CPP/ExitHandlerThrowsExceptionCert.ql b/cpp/cert/src/rules/ERR50-CPP/ExitHandlerThrowsExceptionCert.ql
index 9c312672e7..548b7b4b94 100644
--- a/cpp/cert/src/rules/ERR50-CPP/ExitHandlerThrowsExceptionCert.ql
+++ b/cpp/cert/src/rules/ERR50-CPP/ExitHandlerThrowsExceptionCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err50-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR50-CPP/ExplicitAbruptTerminationCert.ql b/cpp/cert/src/rules/ERR50-CPP/ExplicitAbruptTerminationCert.ql
index ddee05aecf..4fe89c634d 100644
--- a/cpp/cert/src/rules/ERR50-CPP/ExplicitAbruptTerminationCert.ql
+++ b/cpp/cert/src/rules/ERR50-CPP/ExplicitAbruptTerminationCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err50-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR50-CPP/JoinableThreadCopiedOrDestroyedCert.ql b/cpp/cert/src/rules/ERR50-CPP/JoinableThreadCopiedOrDestroyedCert.ql
index 015a5ffede..2036ff2f46 100644
--- a/cpp/cert/src/rules/ERR50-CPP/JoinableThreadCopiedOrDestroyedCert.ql
+++ b/cpp/cert/src/rules/ERR50-CPP/JoinableThreadCopiedOrDestroyedCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err50-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR50-CPP/RethrowNestedWithoutCaptureCert.ql b/cpp/cert/src/rules/ERR50-CPP/RethrowNestedWithoutCaptureCert.ql
index 088cfe93b0..05d04de99e 100644
--- a/cpp/cert/src/rules/ERR50-CPP/RethrowNestedWithoutCaptureCert.ql
+++ b/cpp/cert/src/rules/ERR50-CPP/RethrowNestedWithoutCaptureCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err50-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR51-CPP/HandleAllExceptions.ql b/cpp/cert/src/rules/ERR51-CPP/HandleAllExceptions.ql
index 2811815821..f8447d4af5 100644
--- a/cpp/cert/src/rules/ERR51-CPP/HandleAllExceptions.ql
+++ b/cpp/cert/src/rules/ERR51-CPP/HandleAllExceptions.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err51-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR52-CPP/DoNotUseSetjmpOrLongjmp.ql b/cpp/cert/src/rules/ERR52-CPP/DoNotUseSetjmpOrLongjmp.ql
index 45e29d02ff..6c9cb2e436 100644
--- a/cpp/cert/src/rules/ERR52-CPP/DoNotUseSetjmpOrLongjmp.ql
+++ b/cpp/cert/src/rules/ERR52-CPP/DoNotUseSetjmpOrLongjmp.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/err52-cpp
  *       correctness
  *       scope/single-translation-unit
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR53-CPP/DestroyedValueReferencedInConstructorDestructorCatchBlock.ql b/cpp/cert/src/rules/ERR53-CPP/DestroyedValueReferencedInConstructorDestructorCatchBlock.ql
index c45c3785e6..8587a73c33 100644
--- a/cpp/cert/src/rules/ERR53-CPP/DestroyedValueReferencedInConstructorDestructorCatchBlock.ql
+++ b/cpp/cert/src/rules/ERR53-CPP/DestroyedValueReferencedInConstructorDestructorCatchBlock.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/err53-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR54-CPP/CatchBlockShadowingCert.ql b/cpp/cert/src/rules/ERR54-CPP/CatchBlockShadowingCert.ql
index 8c4c5b5f06..c3e0aeb2f5 100644
--- a/cpp/cert/src/rules/ERR54-CPP/CatchBlockShadowingCert.ql
+++ b/cpp/cert/src/rules/ERR54-CPP/CatchBlockShadowingCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err54-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR55-CPP/HonorExceptionSpecifications.ql b/cpp/cert/src/rules/ERR55-CPP/HonorExceptionSpecifications.ql
index 7d433e2480..4f35d3cd93 100644
--- a/cpp/cert/src/rules/ERR55-CPP/HonorExceptionSpecifications.ql
+++ b/cpp/cert/src/rules/ERR55-CPP/HonorExceptionSpecifications.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/err55-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR56-CPP/GuaranteeExceptionSafety.ql b/cpp/cert/src/rules/ERR56-CPP/GuaranteeExceptionSafety.ql
index b027d02e3f..5831a7f404 100644
--- a/cpp/cert/src/rules/ERR56-CPP/GuaranteeExceptionSafety.ql
+++ b/cpp/cert/src/rules/ERR56-CPP/GuaranteeExceptionSafety.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/err56-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR57-CPP/DoNotLeakResourcesWhenHandlingExceptions.ql b/cpp/cert/src/rules/ERR57-CPP/DoNotLeakResourcesWhenHandlingExceptions.ql
index e283ca8e95..6180bf2f83 100644
--- a/cpp/cert/src/rules/ERR57-CPP/DoNotLeakResourcesWhenHandlingExceptions.ql
+++ b/cpp/cert/src/rules/ERR57-CPP/DoNotLeakResourcesWhenHandlingExceptions.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/err57-cpp
  *       correctness
  *       security
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR58-CPP/HandleAllExceptionsThrownBeforeMainBeginsExecuting.ql b/cpp/cert/src/rules/ERR58-CPP/HandleAllExceptionsThrownBeforeMainBeginsExecuting.ql
index 843b1f0964..ca6b6ae83f 100644
--- a/cpp/cert/src/rules/ERR58-CPP/HandleAllExceptionsThrownBeforeMainBeginsExecuting.ql
+++ b/cpp/cert/src/rules/ERR58-CPP/HandleAllExceptionsThrownBeforeMainBeginsExecuting.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/err58-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR59-CPP/DoNotThrowAnExceptionAcrossExecutionBoundaries.ql b/cpp/cert/src/rules/ERR59-CPP/DoNotThrowAnExceptionAcrossExecutionBoundaries.ql
index 902d392c5f..e1c7af4030 100644
--- a/cpp/cert/src/rules/ERR59-CPP/DoNotThrowAnExceptionAcrossExecutionBoundaries.ql
+++ b/cpp/cert/src/rules/ERR59-CPP/DoNotThrowAnExceptionAcrossExecutionBoundaries.ql
@@ -11,6 +11,11 @@
  * @problem.severity error
  * @tags external/cert/id/err59-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR60-CPP/ExceptionObjectsMustBeNothrowCopyConstructible.ql b/cpp/cert/src/rules/ERR60-CPP/ExceptionObjectsMustBeNothrowCopyConstructible.ql
index 37a5fedd14..61a145c7a1 100644
--- a/cpp/cert/src/rules/ERR60-CPP/ExceptionObjectsMustBeNothrowCopyConstructible.ql
+++ b/cpp/cert/src/rules/ERR60-CPP/ExceptionObjectsMustBeNothrowCopyConstructible.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err60-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR61-CPP/CatchExceptionsByLvalueReference.ql b/cpp/cert/src/rules/ERR61-CPP/CatchExceptionsByLvalueReference.ql
index 29b879b5ea..8cc9c47854 100644
--- a/cpp/cert/src/rules/ERR61-CPP/CatchExceptionsByLvalueReference.ql
+++ b/cpp/cert/src/rules/ERR61-CPP/CatchExceptionsByLvalueReference.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err61-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/ERR62-CPP/DetectErrorsWhenConvertingAStringToANumber.ql b/cpp/cert/src/rules/ERR62-CPP/DetectErrorsWhenConvertingAStringToANumber.ql
index 9c6f8120c5..e5451a0fc4 100644
--- a/cpp/cert/src/rules/ERR62-CPP/DetectErrorsWhenConvertingAStringToANumber.ql
+++ b/cpp/cert/src/rules/ERR62-CPP/DetectErrorsWhenConvertingAStringToANumber.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/err62-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql b/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql
index a385ee1ffc..960d04449e 100644
--- a/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql
+++ b/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql
@@ -8,14 +8,19 @@
  * @problem.severity warning
  * @tags external/cert/id/exp50-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
 import codingstandards.cpp.SideEffect
-import codingstandards.cpp.dataflow.DataFlow
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /** Holds if the function's return value is derived from the `AliasParamter` p. */
diff --git a/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfScalarObjectEvaluationForSideEffects.ql b/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfScalarObjectEvaluationForSideEffects.ql
index 1ddb315506..4c268e9c7e 100644
--- a/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfScalarObjectEvaluationForSideEffects.ql
+++ b/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfScalarObjectEvaluationForSideEffects.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp50-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql b/cpp/cert/src/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql
index bdf6a7973e..d0935cc798 100644
--- a/cpp/cert/src/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql
+++ b/cpp/cert/src/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql
@@ -8,12 +8,17 @@
  * @problem.severity error
  * @tags external/cert/id/exp51-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import AllocationToDeleteFlow::PathGraph
 
 module AllocationToDeleteConfig implements DataFlow::ConfigSig {
diff --git a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclTypeOperand.ql b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclTypeOperand.ql
index 217be3db6a..59745c2cd0 100644
--- a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclTypeOperand.ql
+++ b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclTypeOperand.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp52-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclValExpression.ql b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclValExpression.ql
index 93bb653c11..c9ced6825c 100644
--- a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclValExpression.ql
+++ b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInDeclValExpression.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp52-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInNoExceptOperand.ql b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInNoExceptOperand.ql
index a32aa1eb14..d8ed036a06 100644
--- a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInNoExceptOperand.ql
+++ b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInNoExceptOperand.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp52-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInSizeOfOperand.ql b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInSizeOfOperand.ql
index 4cc602362e..aa0b8ff23a 100644
--- a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInSizeOfOperand.ql
+++ b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInSizeOfOperand.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp52-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInTypeIdOperand.ql b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInTypeIdOperand.ql
index cc43a008d9..dc65dddcd1 100644
--- a/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInTypeIdOperand.ql
+++ b/cpp/cert/src/rules/EXP52-CPP/DoNotRelyOnSideEffectsInTypeIdOperand.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp52-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p3
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP53-CPP/DoNotReadUninitializedMemory.ql b/cpp/cert/src/rules/EXP53-CPP/DoNotReadUninitializedMemory.ql
index 47ee746038..9839fae0fd 100644
--- a/cpp/cert/src/rules/EXP53-CPP/DoNotReadUninitializedMemory.ql
+++ b/cpp/cert/src/rules/EXP53-CPP/DoNotReadUninitializedMemory.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/exp53-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedAfterLifetimeCert.ql b/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedAfterLifetimeCert.ql
index 4f72fc725a..534bb83796 100644
--- a/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedAfterLifetimeCert.ql
+++ b/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedAfterLifetimeCert.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/exp54-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedBeforeLifetimeCert.ql b/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedBeforeLifetimeCert.ql
index d97c002dbd..ea2349194b 100644
--- a/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedBeforeLifetimeCert.ql
+++ b/cpp/cert/src/rules/EXP54-CPP/ObjectAccessedBeforeLifetimeCert.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/exp54-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP55-CPP/RemoveConstOrVolatileQualificationCert.ql b/cpp/cert/src/rules/EXP55-CPP/RemoveConstOrVolatileQualificationCert.ql
index 3c915191d4..68216f2e43 100644
--- a/cpp/cert/src/rules/EXP55-CPP/RemoveConstOrVolatileQualificationCert.ql
+++ b/cpp/cert/src/rules/EXP55-CPP/RemoveConstOrVolatileQualificationCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp55-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP56-CPP/FunctionWithMismatchedLanguageLinkage.ql b/cpp/cert/src/rules/EXP56-CPP/FunctionWithMismatchedLanguageLinkage.ql
index 23efb87e0b..d8460c58fa 100644
--- a/cpp/cert/src/rules/EXP56-CPP/FunctionWithMismatchedLanguageLinkage.ql
+++ b/cpp/cert/src/rules/EXP56-CPP/FunctionWithMismatchedLanguageLinkage.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp56-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP57-CPP/CastOfPointerToIncompleteClass.ql b/cpp/cert/src/rules/EXP57-CPP/CastOfPointerToIncompleteClass.ql
index 4358f11b34..2a8345c05d 100644
--- a/cpp/cert/src/rules/EXP57-CPP/CastOfPointerToIncompleteClass.ql
+++ b/cpp/cert/src/rules/EXP57-CPP/CastOfPointerToIncompleteClass.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp57-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP57-CPP/DeletingPointerToIncompleteClass.ql b/cpp/cert/src/rules/EXP57-CPP/DeletingPointerToIncompleteClass.ql
index 8534885c9e..935218f78e 100644
--- a/cpp/cert/src/rules/EXP57-CPP/DeletingPointerToIncompleteClass.ql
+++ b/cpp/cert/src/rules/EXP57-CPP/DeletingPointerToIncompleteClass.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp57-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP58-CPP/PassNonTrivialObjectToVaStart.ql b/cpp/cert/src/rules/EXP58-CPP/PassNonTrivialObjectToVaStart.ql
index 5c7ef31a6f..b537fa34c5 100644
--- a/cpp/cert/src/rules/EXP58-CPP/PassNonTrivialObjectToVaStart.ql
+++ b/cpp/cert/src/rules/EXP58-CPP/PassNonTrivialObjectToVaStart.ql
@@ -9,6 +9,11 @@
  * @problem.severity warning
  * @tags external/cert/id/exp58-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP58-CPP/PassPromotablePrimitiveTypeToVaStart.ql b/cpp/cert/src/rules/EXP58-CPP/PassPromotablePrimitiveTypeToVaStart.ql
index dab95c8303..1d34680261 100644
--- a/cpp/cert/src/rules/EXP58-CPP/PassPromotablePrimitiveTypeToVaStart.ql
+++ b/cpp/cert/src/rules/EXP58-CPP/PassPromotablePrimitiveTypeToVaStart.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp58-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP58-CPP/PassReferenceTypeToVaStart.ql b/cpp/cert/src/rules/EXP58-CPP/PassReferenceTypeToVaStart.ql
index 0b9e0a9f99..ce340d63c8 100644
--- a/cpp/cert/src/rules/EXP58-CPP/PassReferenceTypeToVaStart.ql
+++ b/cpp/cert/src/rules/EXP58-CPP/PassReferenceTypeToVaStart.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp58-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP59-CPP/OffsetUsedOnInvalidTypeOrMember.ql b/cpp/cert/src/rules/EXP59-CPP/OffsetUsedOnInvalidTypeOrMember.ql
index 8cda1c0851..7ece8faef6 100644
--- a/cpp/cert/src/rules/EXP59-CPP/OffsetUsedOnInvalidTypeOrMember.ql
+++ b/cpp/cert/src/rules/EXP59-CPP/OffsetUsedOnInvalidTypeOrMember.ql
@@ -7,6 +7,11 @@
  * @problem.severity recommendation
  * @tags external/cert/id/exp59-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP60-CPP/DoNotPassANonstandardObjectAcrossBoundaries.ql b/cpp/cert/src/rules/EXP60-CPP/DoNotPassANonstandardObjectAcrossBoundaries.ql
index 8442e5eda1..ddd6fa0efc 100644
--- a/cpp/cert/src/rules/EXP60-CPP/DoNotPassANonstandardObjectAcrossBoundaries.ql
+++ b/cpp/cert/src/rules/EXP60-CPP/DoNotPassANonstandardObjectAcrossBoundaries.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp60-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p12
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP61-CPP/EscapingLambdaObjectWithCaptureByReference.ql b/cpp/cert/src/rules/EXP61-CPP/EscapingLambdaObjectWithCaptureByReference.ql
index c57de9b2d1..1268d1c82b 100644
--- a/cpp/cert/src/rules/EXP61-CPP/EscapingLambdaObjectWithCaptureByReference.ql
+++ b/cpp/cert/src/rules/EXP61-CPP/EscapingLambdaObjectWithCaptureByReference.ql
@@ -10,6 +10,11 @@
  * @tags external/cert/id/exp61-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP61-CPP/ReturningLambdaObjectWithCaptureByReference.ql b/cpp/cert/src/rules/EXP61-CPP/ReturningLambdaObjectWithCaptureByReference.ql
index 8487c78039..eb76ba6187 100644
--- a/cpp/cert/src/rules/EXP61-CPP/ReturningLambdaObjectWithCaptureByReference.ql
+++ b/cpp/cert/src/rules/EXP61-CPP/ReturningLambdaObjectWithCaptureByReference.ql
@@ -10,6 +10,11 @@
  * @tags external/cert/id/exp61-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP62-CPP/MemcmpUsedToAccessObjectRepresentation.ql b/cpp/cert/src/rules/EXP62-CPP/MemcmpUsedToAccessObjectRepresentation.ql
index 4b8b67368f..64bfb4673b 100644
--- a/cpp/cert/src/rules/EXP62-CPP/MemcmpUsedToAccessObjectRepresentation.ql
+++ b/cpp/cert/src/rules/EXP62-CPP/MemcmpUsedToAccessObjectRepresentation.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp62-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP62-CPP/MemcpyUsedToAccessObjectRepresentation.ql b/cpp/cert/src/rules/EXP62-CPP/MemcpyUsedToAccessObjectRepresentation.ql
index 87f797bf25..0e8847257c 100644
--- a/cpp/cert/src/rules/EXP62-CPP/MemcpyUsedToAccessObjectRepresentation.ql
+++ b/cpp/cert/src/rules/EXP62-CPP/MemcpyUsedToAccessObjectRepresentation.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp62-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP62-CPP/MemsetUsedToAccessObjectRepresentation.ql b/cpp/cert/src/rules/EXP62-CPP/MemsetUsedToAccessObjectRepresentation.ql
index 302410def1..a4ae635289 100644
--- a/cpp/cert/src/rules/EXP62-CPP/MemsetUsedToAccessObjectRepresentation.ql
+++ b/cpp/cert/src/rules/EXP62-CPP/MemsetUsedToAccessObjectRepresentation.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp62-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/EXP63-CPP/DoNotRelyOnTheValueOfAMovedFromObject.ql b/cpp/cert/src/rules/EXP63-CPP/DoNotRelyOnTheValueOfAMovedFromObject.ql
index 785d4b8b2b..48e534bfbb 100644
--- a/cpp/cert/src/rules/EXP63-CPP/DoNotRelyOnTheValueOfAMovedFromObject.ql
+++ b/cpp/cert/src/rules/EXP63-CPP/DoNotRelyOnTheValueOfAMovedFromObject.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/exp63-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/FIO50-CPP/InterleavedInputOutputWithoutPosition.ql b/cpp/cert/src/rules/FIO50-CPP/InterleavedInputOutputWithoutPosition.ql
index e30168dc23..0333955f72 100644
--- a/cpp/cert/src/rules/FIO50-CPP/InterleavedInputOutputWithoutPosition.ql
+++ b/cpp/cert/src/rules/FIO50-CPP/InterleavedInputOutputWithoutPosition.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/fio50-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/FIO51-CPP/CloseFilesWhenTheyAreNoLongerNeeded.ql b/cpp/cert/src/rules/FIO51-CPP/CloseFilesWhenTheyAreNoLongerNeeded.ql
index 383fb9db1f..a444692594 100644
--- a/cpp/cert/src/rules/FIO51-CPP/CloseFilesWhenTheyAreNoLongerNeeded.ql
+++ b/cpp/cert/src/rules/FIO51-CPP/CloseFilesWhenTheyAreNoLongerNeeded.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/fio51-cpp
  *       correctness
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/INT50-CPP/DoNotCastToAnOutOfRangeEnumerationValue.ql b/cpp/cert/src/rules/INT50-CPP/DoNotCastToAnOutOfRangeEnumerationValue.ql
index f90d3a42ef..c7437073e9 100644
--- a/cpp/cert/src/rules/INT50-CPP/DoNotCastToAnOutOfRangeEnumerationValue.ql
+++ b/cpp/cert/src/rules/INT50-CPP/DoNotCastToAnOutOfRangeEnumerationValue.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/int50-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM50-CPP/UseAfterFree.ql b/cpp/cert/src/rules/MEM50-CPP/UseAfterFree.ql
index 59bf3e5bc7..8c31fc104c 100644
--- a/cpp/cert/src/rules/MEM50-CPP/UseAfterFree.ql
+++ b/cpp/cert/src/rules/MEM50-CPP/UseAfterFree.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/mem50-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM51-CPP/ProperlyDeallocateDynamicallyAllocatedResources.ql b/cpp/cert/src/rules/MEM51-CPP/ProperlyDeallocateDynamicallyAllocatedResources.ql
index 5854b169f2..70fd363c64 100644
--- a/cpp/cert/src/rules/MEM51-CPP/ProperlyDeallocateDynamicallyAllocatedResources.ql
+++ b/cpp/cert/src/rules/MEM51-CPP/ProperlyDeallocateDynamicallyAllocatedResources.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/mem51-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql b/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql
index c25e1aa0ad..90685f1c96 100644
--- a/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql
+++ b/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql
@@ -7,13 +7,18 @@
  * @problem.severity error
  * @tags external/cert/id/mem52-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
 import semmle.code.cpp.controlflow.Guards
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.exceptions.ExceptionSpecifications
 
 /**
diff --git a/cpp/cert/src/rules/MEM53-CPP/ManuallyManagedLifetime.qll b/cpp/cert/src/rules/MEM53-CPP/ManuallyManagedLifetime.qll
index 54fafc60d7..0eaf9f8dfa 100644
--- a/cpp/cert/src/rules/MEM53-CPP/ManuallyManagedLifetime.qll
+++ b/cpp/cert/src/rules/MEM53-CPP/ManuallyManagedLifetime.qll
@@ -1,9 +1,9 @@
 import codingstandards.cpp.cert
 import codingstandards.cpp.Conversion
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 import ManuallyManagedLifetime
 import semmle.code.cpp.controlflow.Dominance
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 
 /**
  * A taint-tracking configuration from allocation expressions to casts to a specific pointer type.
diff --git a/cpp/cert/src/rules/MEM53-CPP/MissingConstructorCallForManuallyManagedObject.ql b/cpp/cert/src/rules/MEM53-CPP/MissingConstructorCallForManuallyManagedObject.ql
index 30c5280482..a56fa18da8 100644
--- a/cpp/cert/src/rules/MEM53-CPP/MissingConstructorCallForManuallyManagedObject.ql
+++ b/cpp/cert/src/rules/MEM53-CPP/MissingConstructorCallForManuallyManagedObject.ql
@@ -7,14 +7,19 @@
  * @problem.severity error
  * @tags external/cert/id/mem53-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 import ManuallyManagedLifetime
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import AllocToStaticCastFlow::PathGraph
 
 /*
diff --git a/cpp/cert/src/rules/MEM53-CPP/MissingDestructorCallForManuallyManagedObject.ql b/cpp/cert/src/rules/MEM53-CPP/MissingDestructorCallForManuallyManagedObject.ql
index b498729d69..fe6fff2d4f 100644
--- a/cpp/cert/src/rules/MEM53-CPP/MissingDestructorCallForManuallyManagedObject.ql
+++ b/cpp/cert/src/rules/MEM53-CPP/MissingDestructorCallForManuallyManagedObject.ql
@@ -7,13 +7,18 @@
  * @problem.severity error
  * @tags external/cert/id/mem53-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
 import ManuallyManagedLifetime
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import FreeWithoutDestructorFlow::PathGraph
 
 from FreeWithoutDestructorFlow::PathNode source, FreeWithoutDestructorFlow::PathNode sink
diff --git a/cpp/cert/src/rules/MEM54-CPP/PlacementNewInsufficientStorageCert.ql b/cpp/cert/src/rules/MEM54-CPP/PlacementNewInsufficientStorageCert.ql
index 695d39de69..fca9190552 100644
--- a/cpp/cert/src/rules/MEM54-CPP/PlacementNewInsufficientStorageCert.ql
+++ b/cpp/cert/src/rules/MEM54-CPP/PlacementNewInsufficientStorageCert.ql
@@ -10,6 +10,11 @@
  * @tags external/cert/id/mem54-cpp
  *       security
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM54-CPP/PlacementNewNotProperlyAlignedCert.ql b/cpp/cert/src/rules/MEM54-CPP/PlacementNewNotProperlyAlignedCert.ql
index 4993de85ed..d623e85a50 100644
--- a/cpp/cert/src/rules/MEM54-CPP/PlacementNewNotProperlyAlignedCert.ql
+++ b/cpp/cert/src/rules/MEM54-CPP/PlacementNewNotProperlyAlignedCert.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/mem54-cpp
  *       security
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM55-CPP/OperatorDeleteMissingPartnerCert.ql b/cpp/cert/src/rules/MEM55-CPP/OperatorDeleteMissingPartnerCert.ql
index d3366f15fc..fd8f4f3a04 100644
--- a/cpp/cert/src/rules/MEM55-CPP/OperatorDeleteMissingPartnerCert.ql
+++ b/cpp/cert/src/rules/MEM55-CPP/OperatorDeleteMissingPartnerCert.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/mem55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM55-CPP/ThrowingNoThrowOperatorNewDeleteCert.ql b/cpp/cert/src/rules/MEM55-CPP/ThrowingNoThrowOperatorNewDeleteCert.ql
index 564d74c333..2740498eef 100644
--- a/cpp/cert/src/rules/MEM55-CPP/ThrowingNoThrowOperatorNewDeleteCert.ql
+++ b/cpp/cert/src/rules/MEM55-CPP/ThrowingNoThrowOperatorNewDeleteCert.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/mem55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewReturnsNullCert.ql b/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewReturnsNullCert.ql
index c07dbff76c..072c69201f 100644
--- a/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewReturnsNullCert.ql
+++ b/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewReturnsNullCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/mem55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewThrowsInvalidExceptionCert.ql b/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewThrowsInvalidExceptionCert.ql
index 0b02be8b3f..da4b63200b 100644
--- a/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewThrowsInvalidExceptionCert.ql
+++ b/cpp/cert/src/rules/MEM55-CPP/ThrowingOperatorNewThrowsInvalidExceptionCert.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/mem55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM56-CPP/OwnedPointerValueStoredInUnrelatedSmartPointerCert.ql b/cpp/cert/src/rules/MEM56-CPP/OwnedPointerValueStoredInUnrelatedSmartPointerCert.ql
index 7fa3209151..ba7a39272a 100644
--- a/cpp/cert/src/rules/MEM56-CPP/OwnedPointerValueStoredInUnrelatedSmartPointerCert.ql
+++ b/cpp/cert/src/rules/MEM56-CPP/OwnedPointerValueStoredInUnrelatedSmartPointerCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/mem56-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MEM57-CPP/UsingDefaultOperatorNewForOverAlignedTypes.ql b/cpp/cert/src/rules/MEM57-CPP/UsingDefaultOperatorNewForOverAlignedTypes.ql
index f8a5247ff1..6c3d18c27f 100644
--- a/cpp/cert/src/rules/MEM57-CPP/UsingDefaultOperatorNewForOverAlignedTypes.ql
+++ b/cpp/cert/src/rules/MEM57-CPP/UsingDefaultOperatorNewForOverAlignedTypes.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/mem57-cpp
  *       correctness
  *       security
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MSC50-CPP/DoNotUseRandForGeneratingPseudorandomNumbers.ql b/cpp/cert/src/rules/MSC50-CPP/DoNotUseRandForGeneratingPseudorandomNumbers.ql
index 8ab68974cb..b67cec99f3 100644
--- a/cpp/cert/src/rules/MSC50-CPP/DoNotUseRandForGeneratingPseudorandomNumbers.ql
+++ b/cpp/cert/src/rules/MSC50-CPP/DoNotUseRandForGeneratingPseudorandomNumbers.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/msc50-cpp
  *       security
  *       scope/single-translation-unit
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.ql b/cpp/cert/src/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.ql
index 52b14d9629..5322fbbde3 100644
--- a/cpp/cert/src/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.ql
+++ b/cpp/cert/src/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.ql
@@ -9,13 +9,18 @@
  * @tags external/cert/id/msc51-cpp
  *       security
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
 import cpp
 import codingstandards.cpp.cert
 import codingstandards.cpp.standardlibrary.Random
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 
 from RandomNumberEngineCreation createRandomNumberEngine, string seedSource
 where
diff --git a/cpp/cert/src/rules/MSC52-CPP/NonVoidFunctionDoesNotReturnCert.ql b/cpp/cert/src/rules/MSC52-CPP/NonVoidFunctionDoesNotReturnCert.ql
index 9634592715..dcf42a78f4 100644
--- a/cpp/cert/src/rules/MSC52-CPP/NonVoidFunctionDoesNotReturnCert.ql
+++ b/cpp/cert/src/rules/MSC52-CPP/NonVoidFunctionDoesNotReturnCert.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/msc52-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p8
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MSC53-CPP/FunctionNoReturnAttributeConditionCert.ql b/cpp/cert/src/rules/MSC53-CPP/FunctionNoReturnAttributeConditionCert.ql
index 511369e46c..5044b3b421 100644
--- a/cpp/cert/src/rules/MSC53-CPP/FunctionNoReturnAttributeConditionCert.ql
+++ b/cpp/cert/src/rules/MSC53-CPP/FunctionNoReturnAttributeConditionCert.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/msc53-cpp
  *       correctness
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/MSC54-CPP/SignalHandlerMustBeAPlainOldFunction.ql b/cpp/cert/src/rules/MSC54-CPP/SignalHandlerMustBeAPlainOldFunction.ql
index a537346630..885d8caa0a 100644
--- a/cpp/cert/src/rules/MSC54-CPP/SignalHandlerMustBeAPlainOldFunction.ql
+++ b/cpp/cert/src/rules/MSC54-CPP/SignalHandlerMustBeAPlainOldFunction.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/msc54-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP50-CPP/DoNotInvokeVirtualFunctionsFromConstructorsOrDestructors.ql b/cpp/cert/src/rules/OOP50-CPP/DoNotInvokeVirtualFunctionsFromConstructorsOrDestructors.ql
index 5cbcee6be9..1c3df97cfa 100644
--- a/cpp/cert/src/rules/OOP50-CPP/DoNotInvokeVirtualFunctionsFromConstructorsOrDestructors.ql
+++ b/cpp/cert/src/rules/OOP50-CPP/DoNotInvokeVirtualFunctionsFromConstructorsOrDestructors.ql
@@ -7,6 +7,11 @@
  * @precision very-high
  * @problem.severity error
  * @tags external/cert/id/oop50-cpp
+ *       external/cert/severity/low
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP51-CPP/DoNotSliceDerivedObjects.ql b/cpp/cert/src/rules/OOP51-CPP/DoNotSliceDerivedObjects.ql
index f0af256fb9..4cb654730b 100644
--- a/cpp/cert/src/rules/OOP51-CPP/DoNotSliceDerivedObjects.ql
+++ b/cpp/cert/src/rules/OOP51-CPP/DoNotSliceDerivedObjects.ql
@@ -7,6 +7,11 @@
  * @precision very-high
  * @problem.severity error
  * @tags external/cert/id/oop51-cpp
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP52-CPP/DoNotDeleteAPolymorphicObjectWithoutAVirtualDestructor.ql b/cpp/cert/src/rules/OOP52-CPP/DoNotDeleteAPolymorphicObjectWithoutAVirtualDestructor.ql
index 13bfdd5c0c..190c4d720d 100644
--- a/cpp/cert/src/rules/OOP52-CPP/DoNotDeleteAPolymorphicObjectWithoutAVirtualDestructor.ql
+++ b/cpp/cert/src/rules/OOP52-CPP/DoNotDeleteAPolymorphicObjectWithoutAVirtualDestructor.ql
@@ -7,6 +7,11 @@
  * @precision very-high
  * @problem.severity warning
  * @tags external/cert/id/oop52-cpp
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP53-CPP/UseCanonicalOrderForMemberInit.ql b/cpp/cert/src/rules/OOP53-CPP/UseCanonicalOrderForMemberInit.ql
index 96fd7812d7..b42b54ef6c 100644
--- a/cpp/cert/src/rules/OOP53-CPP/UseCanonicalOrderForMemberInit.ql
+++ b/cpp/cert/src/rules/OOP53-CPP/UseCanonicalOrderForMemberInit.ql
@@ -12,6 +12,11 @@
  *       security
  *       maintainability
  *       readability
+ *       external/cert/severity/medium
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p4
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP54-CPP/GracefullyHandleSelfCopyAssignment.ql b/cpp/cert/src/rules/OOP54-CPP/GracefullyHandleSelfCopyAssignment.ql
index 85940bf862..844d0f54bb 100644
--- a/cpp/cert/src/rules/OOP54-CPP/GracefullyHandleSelfCopyAssignment.ql
+++ b/cpp/cert/src/rules/OOP54-CPP/GracefullyHandleSelfCopyAssignment.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/oop54-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP55-CPP/MemberAccessWithUninitializedStaticPointerToMember.ql b/cpp/cert/src/rules/OOP55-CPP/MemberAccessWithUninitializedStaticPointerToMember.ql
index ead970ca71..27c63c2c16 100644
--- a/cpp/cert/src/rules/OOP55-CPP/MemberAccessWithUninitializedStaticPointerToMember.ql
+++ b/cpp/cert/src/rules/OOP55-CPP/MemberAccessWithUninitializedStaticPointerToMember.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/oop55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessNonexistentMember.ql b/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessNonexistentMember.ql
index 614d3fbaca..72d640f29b 100644
--- a/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessNonexistentMember.ql
+++ b/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessNonexistentMember.ql
@@ -9,6 +9,11 @@
  * @problem.severity error
  * @tags external/cert/id/oop55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessUndefinedMember.ql b/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessUndefinedMember.ql
index e6b8f10d9c..202123c11c 100644
--- a/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessUndefinedMember.ql
+++ b/cpp/cert/src/rules/OOP55-CPP/UseOfPointerToMemberToAccessUndefinedMember.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/oop55-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP56-CPP/HonorNewReplacementHandlerRequirements.ql b/cpp/cert/src/rules/OOP56-CPP/HonorNewReplacementHandlerRequirements.ql
index 18b259ef86..981bd1ce5b 100644
--- a/cpp/cert/src/rules/OOP56-CPP/HonorNewReplacementHandlerRequirements.ql
+++ b/cpp/cert/src/rules/OOP56-CPP/HonorNewReplacementHandlerRequirements.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/oop56-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP56-CPP/HonorTerminationReplacementHandlerRequirements.ql b/cpp/cert/src/rules/OOP56-CPP/HonorTerminationReplacementHandlerRequirements.ql
index ea499791ff..4d59b36b52 100644
--- a/cpp/cert/src/rules/OOP56-CPP/HonorTerminationReplacementHandlerRequirements.ql
+++ b/cpp/cert/src/rules/OOP56-CPP/HonorTerminationReplacementHandlerRequirements.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/oop56-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p2
+ *       external/cert/level/l3
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP57-CPP/PreferSpecialMemberFunctionsAndOverloadedOperatorsToCStandardLibraryFunctions.ql b/cpp/cert/src/rules/OOP57-CPP/PreferSpecialMemberFunctionsAndOverloadedOperatorsToCStandardLibraryFunctions.ql
index 19b14730bb..9ac17e84a0 100644
--- a/cpp/cert/src/rules/OOP57-CPP/PreferSpecialMemberFunctionsAndOverloadedOperatorsToCStandardLibraryFunctions.ql
+++ b/cpp/cert/src/rules/OOP57-CPP/PreferSpecialMemberFunctionsAndOverloadedOperatorsToCStandardLibraryFunctions.ql
@@ -8,6 +8,11 @@
  * @tags external/cert/id/oop57-cpp
  *       correctness
  *       scope/single-translation-unit
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/OOP58-CPP/CopyOperationsMustNotMutateTheSourceObject.ql b/cpp/cert/src/rules/OOP58-CPP/CopyOperationsMustNotMutateTheSourceObject.ql
index 97cfe0fa3c..9ad0593702 100644
--- a/cpp/cert/src/rules/OOP58-CPP/CopyOperationsMustNotMutateTheSourceObject.ql
+++ b/cpp/cert/src/rules/OOP58-CPP/CopyOperationsMustNotMutateTheSourceObject.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/oop58-cpp
  *       correctness
+ *       external/cert/severity/low
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/low
+ *       external/cert/priority/p9
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/STR50-CPP/BasicStringMayNotBeNullTerminatedCert.ql b/cpp/cert/src/rules/STR50-CPP/BasicStringMayNotBeNullTerminatedCert.ql
index 9ff12eca5c..2cd08be70a 100644
--- a/cpp/cert/src/rules/STR50-CPP/BasicStringMayNotBeNullTerminatedCert.ql
+++ b/cpp/cert/src/rules/STR50-CPP/BasicStringMayNotBeNullTerminatedCert.ql
@@ -7,6 +7,11 @@
  * @precision very-high
  * @problem.severity recommendation
  * @tags external/cert/id/str50-cpp
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/STR50-CPP/OperationMayNotNullTerminateCStyleStringCert.ql b/cpp/cert/src/rules/STR50-CPP/OperationMayNotNullTerminateCStyleStringCert.ql
index d79297a63b..59f56207cd 100644
--- a/cpp/cert/src/rules/STR50-CPP/OperationMayNotNullTerminateCStyleStringCert.ql
+++ b/cpp/cert/src/rules/STR50-CPP/OperationMayNotNullTerminateCStyleStringCert.ql
@@ -7,6 +7,11 @@
  * @precision very-high
  * @problem.severity recommendation
  * @tags external/cert/id/str50-cpp
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/STR51-CPP/DoNotAttemptToCreateAStringFromANullPointer.ql b/cpp/cert/src/rules/STR51-CPP/DoNotAttemptToCreateAStringFromANullPointer.ql
index e775dc205f..a6337e2fcf 100644
--- a/cpp/cert/src/rules/STR51-CPP/DoNotAttemptToCreateAStringFromANullPointer.ql
+++ b/cpp/cert/src/rules/STR51-CPP/DoNotAttemptToCreateAStringFromANullPointer.ql
@@ -7,6 +7,11 @@
  * @problem.severity error
  * @tags external/cert/id/str51-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/likely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p18
+ *       external/cert/level/l1
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/STR52-CPP/UseValidReferencesForElementsOfString.ql b/cpp/cert/src/rules/STR52-CPP/UseValidReferencesForElementsOfString.ql
index 211e490b33..21c29f54ef 100644
--- a/cpp/cert/src/rules/STR52-CPP/UseValidReferencesForElementsOfString.ql
+++ b/cpp/cert/src/rules/STR52-CPP/UseValidReferencesForElementsOfString.ql
@@ -8,6 +8,11 @@
  * @problem.severity error
  * @tags external/cert/id/str52-cpp
  *       correctness
+ *       external/cert/severity/high
+ *       external/cert/likelihood/probable
+ *       external/cert/remediation-cost/high
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/src/rules/STR53-CPP/RangeCheckStringElementAccess.ql b/cpp/cert/src/rules/STR53-CPP/RangeCheckStringElementAccess.ql
index 3300b77e18..c92f2b2316 100644
--- a/cpp/cert/src/rules/STR53-CPP/RangeCheckStringElementAccess.ql
+++ b/cpp/cert/src/rules/STR53-CPP/RangeCheckStringElementAccess.ql
@@ -9,6 +9,11 @@
  * @tags external/cert/id/str53-cpp
  *       correctness
  *       security
+ *       external/cert/severity/high
+ *       external/cert/likelihood/unlikely
+ *       external/cert/remediation-cost/medium
+ *       external/cert/priority/p6
+ *       external/cert/level/l2
  *       external/cert/obligation/rule
  */
 
diff --git a/cpp/cert/test/codeql-pack.lock.yml b/cpp/cert/test/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/cert/test/codeql-pack.lock.yml
+++ b/cpp/cert/test/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/cert/test/qlpack.yml b/cpp/cert/test/qlpack.yml
index ba7415c43e..8634569355 100644
--- a/cpp/cert/test/qlpack.yml
+++ b/cpp/cert/test/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cert-cpp-coding-standards-tests
-version: 2.39.0-dev
+version: 2.49.0-dev
 extractor: cpp
 license: MIT
 dependencies:
diff --git a/cpp/cert/test/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.expected b/cpp/cert/test/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.expected
index 4e87d1436c..6be9fd55cc 100644
--- a/cpp/cert/test/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.expected
+++ b/cpp/cert/test/rules/CTR52-CPP/GuaranteeGenericCppLibraryFunctionsDoNotOverflow.expected
@@ -1,3 +1,12 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:93,7-15)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:93,27-35)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:94,9-17)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:98,9-17)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:98,29-37)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:99,11-19)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:109,35-43)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:110,11-19)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (GuaranteeGenericCppLibraryFunctionsDoNotOverflow.ql:109,9-22)
 | test.cpp:8:42:8:46 | call to begin | Output iterator for $@ is not guaranteed to be large enough for the input iterator. | test.cpp:8:3:8:11 | call to copy | call to copy |
 | test.cpp:17:42:17:46 | call to begin | Output iterator for $@ is not guaranteed to be large enough for the input iterator. | test.cpp:17:3:17:11 | call to copy | call to copy |
 | test.cpp:55:42:55:46 | call to begin | Output iterator for $@ is not guaranteed to be large enough for the input iterator. | test.cpp:55:3:55:11 | call to copy | call to copy |
diff --git a/cpp/cert/test/rules/CTR53-CPP/UseValidIteratorRanges.expected b/cpp/cert/test/rules/CTR53-CPP/UseValidIteratorRanges.expected
index 61260a0579..d25d23185a 100644
--- a/cpp/cert/test/rules/CTR53-CPP/UseValidIteratorRanges.expected
+++ b/cpp/cert/test/rules/CTR53-CPP/UseValidIteratorRanges.expected
@@ -1,3 +1,9 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UseValidIteratorRanges.ql:29,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UseValidIteratorRanges.ql:29,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UseValidIteratorRanges.ql:30,7-15)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UseValidIteratorRanges.ql:36,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UseValidIteratorRanges.ql:36,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (UseValidIteratorRanges.ql:37,7-15)
 | test.cpp:7:3:7:15 | call to for_each | The $@ of iterator range function does not point to the end of an iterator. | test.cpp:7:28:7:32 | call to begin | argument |
 | test.cpp:7:3:7:15 | call to for_each | The $@ of iterator range function does not point to the start of an iterator. | test.cpp:7:19:7:21 | call to end | argument |
 | test.cpp:8:3:8:15 | call to for_each | The $@ of iterator range function does not point to the end of an iterator. | test.cpp:8:30:8:34 | call to begin | argument |
diff --git a/cpp/cert/test/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.expected b/cpp/cert/test/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.expected
index 0a06677b54..db3b7358d8 100644
--- a/cpp/cert/test/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.expected
+++ b/cpp/cert/test/rules/CTR55-CPP/DoNotUseAnAdditiveOperatorOnAnIterator.expected
@@ -1,3 +1,12 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:44,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:44,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:44,51-59)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:45,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:45,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:45,52-60)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:80,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:80,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUseAnAdditiveOperatorOnAnIterator.ql:81,7-15)
 | test.cpp:8:7:8:7 | i | Increment of iterator may overflow since its bounds are not checked. |
 | test.cpp:9:9:9:9 | i | Increment of iterator may overflow since its bounds are not checked. |
 | test.cpp:10:9:10:9 | i | Increment of iterator may overflow since its bounds are not checked. |
diff --git a/cpp/cert/test/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.expected b/cpp/cert/test/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.expected
index eabb6d7515..51ef13412c 100644
--- a/cpp/cert/test/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.expected
+++ b/cpp/cert/test/rules/CTR56-CPP/DoNotUsePointerArithmeticOnPolymorphicObjects.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnPolymorphicObjects.ql:46,62-70)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnPolymorphicObjects.ql:47,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnPolymorphicObjects.ql:56,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotUsePointerArithmeticOnPolymorphicObjects.ql:62,3-11)
 edges
 | test.cpp:15:19:15:21 | foo | test.cpp:16:24:16:26 | foo | provenance |  |
 | test.cpp:15:19:15:21 | foo | test.cpp:16:51:16:53 | foo | provenance |  |
diff --git a/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected b/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected
index b432856e8b..08d46a7bbd 100644
--- a/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected
+++ b/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected
@@ -1,3 +1,27 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:29,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:29,59-67)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:32,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:32,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:36,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:36,59-67)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:45,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:45,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:45,53-61)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:48,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:48,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:57,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:57,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:64,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:64,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:76,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:76,55-63)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:29,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:32,7-20)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:36,7-20)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:48,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:57,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:64,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:76,5-18)
 | test.cpp:82:3:82:4 | call to f2 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.cpp:82:6:82:7 | call to f5 | call to f5 | test.cpp:82:12:82:13 | call to f6 | call to f6 |
 | test.cpp:84:3:84:4 | call to f2 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.cpp:84:6:84:7 | call to f5 | call to f5 | test.cpp:84:12:84:13 | call to f7 | call to f7 |
 | test.cpp:87:3:87:4 | call to f2 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.cpp:87:9:87:10 | call to m1 | call to m1 | test.cpp:87:18:87:19 | call to m1 | call to m1 |
diff --git a/cpp/cert/test/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.expected b/cpp/cert/test/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.expected
index 9c6e6dd071..8b7a4902cc 100644
--- a/cpp/cert/test/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.expected
+++ b/cpp/cert/test/rules/EXP51-CPP/DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.expected
@@ -1,3 +1,7 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql:24,44-52)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql:25,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql:27,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType.ql:32,33-41)
 edges
 | test.cpp:6:19:6:37 | new[] | test.cpp:9:12:9:13 | l1 | provenance |  |
 | test.cpp:7:22:7:40 | new[] | test.cpp:10:12:10:13 | l2 | provenance |  |
diff --git a/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected b/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected
index b7452ec199..41fa58045f 100644
--- a/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected
+++ b/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected
@@ -1,2 +1,9 @@
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:64,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:66,36-44)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:82,46-54)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:83,22-30)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:87,20-28)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:90,35-43)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:95,38-46)
 | test.cpp:24:7:24:34 | new | nothrow new allocation of $@ returns here without a subsequent check to see whether the pointer is valid. | test.cpp:24:7:24:34 | new | StructA * |
 | test.cpp:40:17:40:38 | call to allocate_without_check | nothrow new allocation of $@ returns here without a subsequent check to see whether the pointer is valid. | test.cpp:35:17:35:44 | new | StructA * |
diff --git a/cpp/cert/test/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.expected b/cpp/cert/test/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.expected
index 0128221ffc..606ccbff2b 100644
--- a/cpp/cert/test/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.expected
+++ b/cpp/cert/test/rules/MSC51-CPP/BadlySeededRandomNumberGenerator.expected
@@ -1,3 +1,4 @@
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (BadlySeededRandomNumberGenerator.ql:42,7-20)
 | test.cpp:9:33:9:33 | call to linear_congruential_engine | Random number generator linear_congruential_engine is default-initialized and is therefore not properly seeded. |
 | test.cpp:10:30:10:31 | call to linear_congruential_engine | Random number generator linear_congruential_engine is default-initialized and is therefore not properly seeded. |
 | test.cpp:11:21:11:22 | call to linear_congruential_engine | Random number generator linear_congruential_engine is default-initialized and is therefore not properly seeded. |
diff --git a/cpp/common/src/codeql-pack.lock.yml b/cpp/common/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/common/src/codeql-pack.lock.yml
+++ b/cpp/common/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/common/src/codingstandards/cpp/AccessPath.qll b/cpp/common/src/codingstandards/cpp/AccessPath.qll
index 2393d25db4..3af462e1ec 100644
--- a/cpp/common/src/codingstandards/cpp/AccessPath.qll
+++ b/cpp/common/src/codingstandards/cpp/AccessPath.qll
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 
 newtype TFieldQualifier =
   ExplicitQualifier(VariableAccess v) or
diff --git a/cpp/common/src/codingstandards/cpp/AlertReporting.qll b/cpp/common/src/codingstandards/cpp/AlertReporting.qll
index 4259e1b67d..3ef5315906 100644
--- a/cpp/common/src/codingstandards/cpp/AlertReporting.qll
+++ b/cpp/common/src/codingstandards/cpp/AlertReporting.qll
@@ -18,19 +18,24 @@ module MacroUnwrapper<ResultType ResultElement> {
   }
 
   /**
-   * Gets the primary macro that generated the result element.
+   * Gets the primary macro invocation that generated the result element.
    */
-  Macro getPrimaryMacro(ResultElement re) {
+  MacroInvocation getPrimaryMacroInvocation(ResultElement re) {
     exists(MacroInvocation mi |
       mi = getAMacroInvocation(re) and
       // No other more specific macro that expands to element
       not exists(MacroInvocation otherMi |
         otherMi = getAMacroInvocation(re) and otherMi.getParentInvocation() = mi
       ) and
-      result = mi.getMacro()
+      result = mi
     )
   }
 
+  /**
+   * Gets the primary macro that generated the result element.
+   */
+  Macro getPrimaryMacro(ResultElement re) { result = getPrimaryMacroInvocation(re).getMacro() }
+
   /**
    * If a result element is expanded from a macro invocation, then return the "primary" macro that
    * generated the element, otherwise return the element itself.
@@ -38,4 +43,21 @@ module MacroUnwrapper<ResultType ResultElement> {
   Element unwrapElement(ResultElement re) {
     if exists(getPrimaryMacro(re)) then result = getPrimaryMacro(re) else result = re
   }
+
+  /* Final class so we can extend it */
+  final private class FinalMacroInvocation = MacroInvocation;
+
+  /* A macro invocation that expands to create a `ResultElement` */
+  class ResultMacroExpansion extends FinalMacroInvocation {
+    ResultElement re;
+
+    ResultMacroExpansion() { re = getAnExpandedElement() }
+
+    ResultElement getResultElement() { result = re }
+  }
+
+  /* The most specific macro invocation that expands to create this `ResultElement`. */
+  class PrimaryMacroExpansion extends ResultMacroExpansion {
+    PrimaryMacroExpansion() { this = getPrimaryMacroInvocation(re) }
+  }
 }
diff --git a/cpp/common/src/codingstandards/cpp/Allocations.qll b/cpp/common/src/codingstandards/cpp/Allocations.qll
index 5bc87221e2..decdfe9fc4 100644
--- a/cpp/common/src/codingstandards/cpp/Allocations.qll
+++ b/cpp/common/src/codingstandards/cpp/Allocations.qll
@@ -7,7 +7,7 @@
 
 import cpp
 import semmle.code.cpp.controlflow.SSA
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 
 /**
  * Holds if `alloc` is a use of `malloc` or `new`.  `kind` is
diff --git a/cpp/common/src/codingstandards/cpp/Class.qll b/cpp/common/src/codingstandards/cpp/Class.qll
index 418f027809..6f730736f9 100644
--- a/cpp/common/src/codingstandards/cpp/Class.qll
+++ b/cpp/common/src/codingstandards/cpp/Class.qll
@@ -191,7 +191,13 @@ class TrivialMemberFunction extends IntrospectedMemberFunction {
  * class.
  */
 class TemplateOrTemplateClassMemberFunction extends MemberFunction {
-  TemplateOrTemplateClassMemberFunction() { isFromUninstantiatedTemplate(_) }
+  TemplateOrTemplateClassMemberFunction() {
+    (
+      isFromUninstantiatedTemplate(_) or
+      isFromTemplateInstantiation(_)
+    ) and
+    not this.isCompilerGenerated()
+  }
 }
 
 /**
diff --git a/cpp/common/src/codingstandards/cpp/Clvalues.qll b/cpp/common/src/codingstandards/cpp/Clvalues.qll
index 73fcd65eb1..157041f13b 100644
--- a/cpp/common/src/codingstandards/cpp/Clvalues.qll
+++ b/cpp/common/src/codingstandards/cpp/Clvalues.qll
@@ -14,4 +14,7 @@ predicate isCLValue(Expr expr) {
   not expr instanceof AssignExpr and
   not expr instanceof CommaExpr and
   not exists(Cast c | c = expr.getConversion*())
+  or
+  // 6.5.2.5.4: Compound literals are always lvalues.
+  expr instanceof AggregateLiteral
 }
diff --git a/cpp/common/src/codingstandards/cpp/Compatible.qll b/cpp/common/src/codingstandards/cpp/Compatible.qll
deleted file mode 100644
index 0f6e2108ff..0000000000
--- a/cpp/common/src/codingstandards/cpp/Compatible.qll
+++ /dev/null
@@ -1,30 +0,0 @@
-import cpp
-
-pragma[noinline]
-pragma[nomagic]
-predicate typesCompatible(Type t1, Type t2) {
-  t1 = t2
-  or
-  //signed int is same as int ect
-  t1.(IntegralType).getCanonicalArithmeticType() = t2.(IntegralType).getCanonicalArithmeticType()
-}
-
-predicate parameterTypesIncompatible(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
-  f1.getDeclaration() = f2.getDeclaration() and
-  exists(ParameterDeclarationEntry p1, ParameterDeclarationEntry p2, int i |
-    p1 = f1.getParameterDeclarationEntry(i) and
-    p2 = f2.getParameterDeclarationEntry(i)
-  |
-    not typesCompatible(p1.getType(), p2.getType())
-  )
-}
-
-predicate parameterNamesIncompatible(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
-  f1.getDeclaration() = f2.getDeclaration() and
-  exists(ParameterDeclarationEntry p1, ParameterDeclarationEntry p2, int i |
-    p1 = f1.getParameterDeclarationEntry(i) and
-    p2 = f2.getParameterDeclarationEntry(i)
-  |
-    not p1.getName() = p2.getName()
-  )
-}
diff --git a/cpp/common/src/codingstandards/cpp/Concurrency.qll b/cpp/common/src/codingstandards/cpp/Concurrency.qll
index d856fa4515..3f7e5c1af9 100644
--- a/cpp/common/src/codingstandards/cpp/Concurrency.qll
+++ b/cpp/common/src/codingstandards/cpp/Concurrency.qll
@@ -1,938 +1,14 @@
 import cpp
-import codingstandards.cpp.dataflow.TaintTracking
-
-/**
- * Models CFG nodes which should be added to a thread context.
- */
-abstract class ThreadedCFGPathExtension extends ControlFlowNode {
-  /**
-   * Returns the next `ControlFlowNode` in this thread context.
-   */
-  abstract ControlFlowNode getNext();
-}
-
-/**
- * Models a `FunctionCall` invoked from a threaded context.
- */
-class ThreadContextFunctionCall extends FunctionCall, ThreadedCFGPathExtension {
-  override ControlFlowNode getNext() { getTarget().getEntryPoint() = result }
-}
-
-/**
- * Models a specialized `FunctionCall` that may create a thread.
- */
-abstract class ThreadCreationFunction extends FunctionCall, ThreadedCFGPathExtension {
-  /**
-   * Returns the function that will be invoked.
-   */
-  abstract Function getFunction();
-}
-
-/**
- * Models a call to a thread constructor via `std::thread`.
- */
-class ThreadConstructorCall extends ConstructorCall, ThreadCreationFunction {
-  Function f;
-
-  ThreadConstructorCall() {
-    getTarget().getDeclaringType().hasQualifiedName("std", "thread") and
-    f = getArgument(0).(FunctionAccess).getTarget()
-  }
-
-  /**
-   * Returns the function that will be invoked by this `std::thread`.
-   */
-  override Function getFunction() { result = f }
-
-  override ControlFlowNode getNext() { result = getFunction().getEntryPoint() }
-}
-
-/**
- * Models a call to a thread constructor via `thrd_create`.
- */
-class C11ThreadCreateCall extends ThreadCreationFunction {
-  Function f;
-
-  C11ThreadCreateCall() {
-    getTarget().getName() = "thrd_create" and
-    (
-      f = getArgument(1).(FunctionAccess).getTarget() or
-      f = getArgument(1).(AddressOfExpr).getOperand().(FunctionAccess).getTarget()
-    )
-  }
-
-  /**
-   * Returns the function that will be invoked by this thread.
-   */
-  override Function getFunction() { result = f }
-
-  override ControlFlowNode getNext() { result = getFunction().getEntryPoint() }
-}
-
-/**
- * Common base class providing an interface into function call
- * based mutex locks.
- */
-abstract class MutexFunctionCall extends LockingOperation {
-  abstract predicate isRecursive();
-
-  abstract predicate isSpeculativeLock();
-
-  abstract predicate unlocks(MutexFunctionCall fc);
-}
-
-/**
- *  Models calls to various mutex types found in CPP.
- */
-class CPPMutexFunctionCall extends MutexFunctionCall {
-  VariableAccess var;
-
-  CPPMutexFunctionCall() {
-    (
-      // the non recursive kinds
-      getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "mutex") or
-      getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "timed_mutex") or
-      getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "shared_timed_mutex") or
-      // the recursive ones
-      getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "recursive_mutex") or
-      getTarget()
-          .(MemberFunction)
-          .getDeclaringType()
-          .hasQualifiedName("std", "recursive_timed_mutex")
-    ) and
-    var = getQualifier()
-  }
-
-  /**
-   * Holds if this mutex is a recursive mutex.
-   */
-  override predicate isRecursive() {
-    getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "recursive_mutex") or
-    getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "recursive_timed_mutex")
-  }
-
-  /**
-   * Holds if this `CPPMutexFunctionCall` is a lock.
-   */
-  override predicate isLock() {
-    not isLockingOperationWithinLockingOperation(this) and
-    getTarget().getName() = "lock"
-  }
-
-  /**
-   * Holds if this `CPPMutexFunctionCall` is a speculative lock, defined as calling
-   * one of the speculative locking functions such as `try_lock`.
-   */
-  override predicate isSpeculativeLock() {
-    getTarget().getName() in [
-        "try_lock", "try_lock_for", "try_lock_until", "try_lock_shared_for", "try_lock_shared_until"
-      ]
-  }
-
-  /**
-   * Returns the lock to which this `CPPMutexFunctionCall` refers to.
-   */
-  override Variable getLock() { result = getQualifier().(VariableAccess).getTarget() }
-
-  /**
-   * Returns the qualifier for this `CPPMutexFunctionCall`.
-   */
-  override Expr getLockExpr() { result = var }
-
-  /**
-   * Holds if this is a `unlock` and *may* unlock the previously locked `MutexFunctionCall`.
-   * This predicate does not check that the mutex is currently locked.
-   */
-  override predicate unlocks(MutexFunctionCall fc) {
-    isUnlock() and
-    fc.getQualifier().(VariableAccess).getTarget() = getQualifier().(VariableAccess).getTarget()
-  }
-
-  /**
-   * Holds if this is an unlock call.
-   */
-  override predicate isUnlock() { getTarget().getName() = "unlock" }
-}
-
-/**
- *  Models calls to various mutex types specialized to C code.
- */
-class CMutexFunctionCall extends MutexFunctionCall {
-  Expr arg;
-
-  CMutexFunctionCall() {
-    // the non recursive kinds
-    getTarget().getName() = ["mtx_lock", "mtx_unlock", "mtx_timedlock", "mtx_trylock"] and
-    arg = getArgument(0)
-  }
-
-  /**
-   * Holds if this mutex is a recursive mutex.
-   */
-  override predicate isRecursive() { none() }
-
-  /**
-   * Holds if this `CMutexFunctionCall` is a lock.
-   */
-  override predicate isLock() {
-    not isLockingOperationWithinLockingOperation(this) and
-    getTarget().getName() = ["mtx_lock", "mtx_timedlock", "mtx_trylock"]
-  }
-
-  /**
-   * Holds if this `CMutexFunctionCall` is a speculative lock, defined as calling
-   * one of the speculative locking functions such as `try_lock`.
-   */
-  override predicate isSpeculativeLock() {
-    getTarget().getName() in ["mtx_timedlock", "mtx_trylock"]
-  }
-
-  /**
-   * Returns the `Variable` to which this `CMutexFunctionCall` refers to. For this
-   * style of lock it can reference a number of different variables.
-   */
-  override Variable getLock() {
-    exists(VariableAccess va |
-      TaintTracking::localTaint(DataFlow::exprNode(va), DataFlow::exprNode(getLockExpr())) and
-      result = va.getTarget()
-    )
-  }
-
-  /**
-   * Returns the expression for this `CMutexFunctionCall`.
-   */
-  override Expr getLockExpr() { result = arg }
-
-  /**
-   * Holds if this is a `unlock` and *may* unlock the previously locked `CMutexFunctionCall`.
-   * This predicate does not check that the mutex is currently locked.
-   */
-  override predicate unlocks(MutexFunctionCall fc) {
-    isUnlock() and
-    fc.getLock() = getLock()
-  }
-
-  /**
-   * Holds if this is an unlock call.
-   */
-  override predicate isUnlock() { getTarget().getName() = "mtx_unlock" }
-}
-
-/**
- * The thread-aware predecessor function is defined in terms of the thread aware
- * successor function. This is because it is simpler to construct the forward
- * paths of a thread's execution than the backwards paths. For this reason we
- * require a `start` and `end` node.
- *
- * The logic of this function is that a thread aware predecessor is one that
- * follows a `start` node, is not equal to the ending node, and does not follow
- * the `end` node. Such nodes can only be predecessors of `end`.
- *
- * For this reason this function requires a `start` node from which to start
- * considering something a predecessor of `end`.
- */
-pragma[inline]
-ControlFlowNode getAThreadContextAwarePredecessor(ControlFlowNode start, ControlFlowNode end) {
-  result = getAThreadContextAwareSuccessor(start) and
-  not result = getAThreadContextAwareSuccessor(end) and
-  not result = end
-}
-
-/**
- * A predicate for finding successors of `ControlFlowNode`s that are aware of
- * the objects that my flow into a thread's context. This is achieved by adding
- * additional edges to thread entry points and function calls.
- */
-ControlFlowNode getAThreadContextAwareSuccessorR(ControlFlowNode cfn) {
-  result = cfn.getASuccessor()
-  or
-  result = cfn.(ThreadedCFGPathExtension).getNext()
-}
-
-ControlFlowNode getAThreadContextAwareSuccessor(ControlFlowNode m) {
-  result = getAThreadContextAwareSuccessorR*(m) and
-  // for performance reasons we handle back edges by enforcing a lexical
-  // ordering restriction on these nodes if they are both in
-  // the same loop. One way of doing this is as follows:
-  //
-  // ````and (
-  //   exists(Loop loop |
-  //     loop.getAChild*() = m and
-  //     loop.getAChild*() = result
-  //   )
-  //   implies
-  //   not result.getLocation().isBefore(m.getLocation())
-  // )```
-  // In this implementation we opt for the more generic form below
-  // which seems to have reasonable performance.
-  (
-    m.getEnclosingStmt().getParentStmt*() = result.getEnclosingStmt().getParentStmt*()
-    implies
-    not exists(Location l1, Location l2 |
-      l1 = result.getLocation() and
-      l2 = m.getLocation()
-    |
-      l1.getEndLine() < l2.getStartLine()
-      or
-      l1.getStartLine() = l2.getEndLine() and
-      l1.getEndColumn() < l2.getStartColumn()
-    )
-  )
-}
-
-abstract class LockingOperation extends FunctionCall {
-  /**
-   * Returns the target of the lock underlying this RAII-style lock.
-   */
-  abstract Variable getLock();
-
-  /**
-   * Returns the lock underlying this RAII-style lock.
-   */
-  abstract Expr getLockExpr();
-
-  /**
-   * Holds if this is a lock operation
-   */
-  abstract predicate isLock();
-
-  /**
-   * Holds if this is an unlock operation
-   */
-  abstract predicate isUnlock();
-
-  /**
-   * Holds if this locking operation is really a locking operation within a
-   * designated locking operation. This library assumes the underlying locking
-   * operations are implemented correctly in that calling a `LockingOperation`
-   * results in the creation of a singular lock.
-   */
-  predicate isLockingOperationWithinLockingOperation(LockingOperation inner) {
-    exists(LockingOperation outer | outer.getTarget() = inner.getEnclosingFunction())
-  }
-}
-
-/**
- * Models a RAII-Style lock.
- */
-class RAIIStyleLock extends LockingOperation {
-  VariableAccess lock;
-  Element e;
-
-  RAIIStyleLock() {
-    (
-      getTarget().getDeclaringType().hasQualifiedName("std", "lock_guard") or
-      getTarget().getDeclaringType().hasQualifiedName("std", "unique_lock") or
-      getTarget().getDeclaringType().hasQualifiedName("std", "scoped_lock")
-    )
-  }
-
-  /**
-   * Holds if this is a lock operation
-   */
-  override predicate isLock() {
-    not isLockingOperationWithinLockingOperation(this) and
-    this instanceof ConstructorCall and
-    lock = getArgument(0).getAChild*() and
-    // defer_locks don't cause a lock
-    not exists(Expr exp |
-      exp = getArgument(1) and
-      exp.(VariableAccess)
-          .getTarget()
-          .getUnderlyingType()
-          .(Class)
-          .hasQualifiedName("std", "defer_lock_t")
-    )
-  }
-
-  /**
-   * Holds if this is an unlock operation
-   */
-  override predicate isUnlock() { this instanceof DestructorCall }
-
-  /**
-   * Returns the target of the lock underlying this RAII-style lock.
-   */
-  override Variable getLock() { result = lock.getTarget() }
-
-  /**
-   * Returns the lock underlying this RAII-style lock.
-   */
-  override Expr getLockExpr() { result = lock }
-}
-
-/**
- * Models a function that may be executed by some thread.
- */
-abstract class ThreadedFunction extends Function { }
-
-/**
- * Models a function that may be executed by some thread via
- * C++ standard classes.
- */
-class CPPThreadedFunction extends ThreadedFunction {
-  CPPThreadedFunction() { exists(ThreadConstructorCall tcc | tcc.getFunction() = this) }
-}
-
-/**
- * Models a function that may be executed by some thread via
- * C11 standard functions.
- */
-class C11ThreadedFunction extends ThreadedFunction {
-  C11ThreadedFunction() { exists(C11ThreadCreateCall cc | cc.getFunction() = this) }
-}
-
-/**
- * Models a control flow node within a function that may be executed by some
- * thread.
- */
-class ThreadedCFN extends ControlFlowNode {
-  ThreadedCFN() {
-    exists(ThreadedFunction tf | this = getAThreadContextAwareSuccessor(tf.getEntryPoint()))
-  }
-}
-
-/**
- * Models a `ControlFlowNode` that is protected by some sort of lock.
- */
-class LockProtectedControlFlowNode extends ThreadedCFN {
-  FunctionCall lockingFunction;
-
-  LockProtectedControlFlowNode() {
-    exists(LockingOperation lock |
-      // there is a node that is a lock
-      lockingFunction = lock and
-      lock.isLock() and
-      // this node should be a successor of this lock
-      this = getAThreadContextAwareSuccessor(lock) and
-      // and there should not exist a predecessor of this
-      // node that is an unlock. Since we are doing thread context
-      // aware tracking it is easier to go forwards than backwards
-      // in constructing the call graph. Thus we can define predecessor
-      // in terms of a node that is a successor of the lock but NOT a
-      // successor of the current node.
-      not exists(ControlFlowNode unlock |
-        // it's an unlock
-        unlock = getAThreadContextAwarePredecessor(lock, this) and
-        unlock.(MutexFunctionCall).isUnlock() and
-        // note that we don't check that it's the same lock -- this is left
-        // to the caller to enforce this condition.
-        // Because of the way that `getAThreadContextAwarePredecessor` works, it is possible
-        // for operations PAST it to be technically part of the predecessors.
-        // Thus, we need to make sure that this node is a
-        // successor of the unlock in the CFG
-        getAThreadContextAwareSuccessor(unlock) = this
-      ) and
-      (lock instanceof MutexFunctionCall implies not this.(MutexFunctionCall).isUnlock())
-    )
-  }
-
-  /**
-   * The `MutexFunctionCall` holding the lock that locks this node.
-   */
-  FunctionCall coveredByLock() { result = lockingFunction }
-
-  /**
-   * The lock underlying this `LockProtectedControlFlowNode`.
-   */
-  Variable getAProtectingLock() { result = lockingFunction.(LockingOperation).getLock() }
-}
-
-/**
- * Models a function that conditionally waits.
- */
-abstract class ConditionalWait extends FunctionCall { }
-
-/**
- * Models a function in CPP that will conditionally wait.
- */
-class CPPConditionalWait extends ConditionalWait {
-  CPPConditionalWait() {
-    exists(MemberFunction mf |
-      mf = getTarget() and
-      mf.getDeclaringType().hasQualifiedName("std", "condition_variable") and
-      mf.getName() in ["wait", "wait_for", "wait_until"]
-    )
-  }
-}
-
-/**
- * Models a function in C that will conditionally wait.
- */
-class CConditionalWait extends ConditionalWait {
-  CConditionalWait() { getTarget().getName() in ["cnd_wait"] }
-}
-
-/**
- * Models a call to a `std::thread` constructor that depends on a mutex.
- */
-class MutexDependentThreadConstructor extends ThreadConstructorCall {
-  Expr mutexExpr;
-
-  MutexDependentThreadConstructor() {
-    mutexExpr = getAnArgument() and
-    mutexExpr.getUnderlyingType().stripType() instanceof MutexType
-  }
-
-  Expr dependentMutex() { result = mutexExpr }
-}
-
-/**
- * Models thread waiting functions.
- */
-abstract class ThreadWait extends FunctionCall { }
-
-/**
- * Models a call to a `std::thread` join.
- */
-class CPPThreadWait extends ThreadWait {
-  VariableAccess var;
-
-  CPPThreadWait() {
-    getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "thread") and
-    getTarget().getName() = "join"
-  }
-}
-
-/**
- * Models a call to `thrd_join` in C11.
- */
-class C11ThreadWait extends ThreadWait {
-  VariableAccess var;
-
-  C11ThreadWait() { getTarget().getName() = "thrd_join" }
-}
-
-/**
- * Models thread detach functions.
- */
-abstract class ThreadDetach extends FunctionCall { }
-
-/**
- * Models a call to `thrd_detach` in C11.
- */
-class C11ThreadDetach extends ThreadWait {
-  VariableAccess var;
-
-  C11ThreadDetach() { getTarget().getName() = "thrd_detach" }
-}
-
-abstract class MutexSource extends FunctionCall { }
-
-/**
- * Models a C++ style mutex.
- */
-class CPPMutexSource extends MutexSource, ConstructorCall {
-  CPPMutexSource() { getTarget().getDeclaringType().hasQualifiedName("std", "mutex") }
-}
-
-/**
- * Models a C11 style mutex.
- */
-class C11MutexSource extends MutexSource, FunctionCall {
-  C11MutexSource() { getTarget().hasName("mtx_init") }
-}
-
-/**
- * Models a thread dependent mutex. A thread dependent mutex is a mutex
- * that is used by a thread. This dependency is established either by directly
- * passing in a mutex or by referencing a mutex that is in the local scope. The utility
- * of this class is it captures the `DataFlow::Node` source at which the mutex
- * came from. For example, if it is passed in from a local function to a thread.
- * This functionality is critical, since it allows one to inspect how the thread
- * behaves with respect to the owner of a resource.
- *
- * To model the myriad ways this can happen, the subclasses of this class are
- * responsible for implementing the various usage patterns.
- */
-abstract class ThreadDependentMutex extends DataFlow::Node {
-  DataFlow::Node sink;
-
-  DataFlow::Node getASource() {
-    // the source is either the thing that declared
-    // the mutex
-    result = this
-    or
-    // or the thread we are using it in
-    result = getAThreadSource()
-  }
-
-  /**
-   * Gets the dataflow nodes corresponding to thread local usages of the
-   * dependent mutex.
-   */
-  DataFlow::Node getAThreadSource() {
-    // here we line up the actual parameter at the thread creation
-    // site with the formal parameter in the target thread.
-    // Note that there are differences between the C and C++ versions
-    // of the argument ordering in the thread creation function. However,
-    // since the C version only takes one parameter (as opposed to multiple)
-    // we can simplify this search by considering only the first argument.
-    exists(FunctionCall fc, Function f, int n |
-      // Get the argument to which the mutex flowed.
-      fc.getArgument(n) = sink.asExpr() and
-      // Get the thread function we are calling.
-      f = fc.getArgument(0).(FunctionAccess).getTarget() and
-      // in C++, there is an extra argument to the `std::thread` call
-      // so we must subtract 1 since this is not passed to the thread.
-      (
-        result = DataFlow::exprNode(f.getParameter(n - 1).getAnAccess())
-        or
-        // In C, only one argument is allowed. Thus IF the flow predicate holds,
-        // it will be to the first argument
-        result = DataFlow::exprNode(f.getParameter(0).getAnAccess())
-      )
-    )
-  }
-
-  /**
-   * Produces the set of dataflow nodes to thread creation for threads
-   * that are dependent on this mutex.
-   */
-  DataFlow::Node getADependentThreadCreationExpr() {
-    exists(FunctionCall fc |
-      fc.getAnArgument() = sink.asExpr() and
-      result = DataFlow::exprNode(fc)
-    )
-  }
-
-  /**
-   * Gets a set of usages of this mutex in both the local and thread scope.
-   * In the case of scoped usage, this also captures typical accesses of variables.
-   */
-  DataFlow::Node getAUsage() { TaintTracking::localTaint(getASource(), result) }
-}
-
-/**
- * This class models the type of thread/mutex dependency that is established
- * through the typical parameter passing mechanisms found in C++.
- */
-class FlowBasedThreadDependentMutex extends ThreadDependentMutex {
-  FlowBasedThreadDependentMutex() {
-    // some sort of dataflow, likely through parameter passing.
-    ThreadDependentMutexFlow::flow(this, sink)
-  }
-}
-
-/**
- * This class models the type of thread/mutex dependency that is established by
- * either scope based accesses (e.g., global variables) or block scope differences.
- */
-class AccessBasedThreadDependentMutex extends ThreadDependentMutex {
-  Variable variableSource;
-
-  AccessBasedThreadDependentMutex() {
-    // encapsulates usages from outside scopes not directly expressed
-    // in dataflow.
-    exists(MutexSource mutexSrc, ThreadedFunction f |
-      DataFlow::exprNode(mutexSrc) = this and
-      // find a variable that was assigned the mutex
-      TaintTracking::localTaint(DataFlow::exprNode(mutexSrc),
-        DataFlow::exprNode(variableSource.getAnAssignedValue())) and
-      // find all subsequent accesses of that variable that are within a
-      // function and set those to the sink
-      exists(VariableAccess va |
-        va = variableSource.getAnAccess() and
-        va.getEnclosingFunction() = f and
-        sink = DataFlow::exprNode(va)
-      )
-    )
-  }
-
-  override DataFlow::Node getAUsage() { DataFlow::exprNode(variableSource.getAnAccess()) = result }
-}
-
-/**
- * In the typical C thread model, a mutex is a created by a function that is not responsible
- * for creating the variable. Thus this class encodes a slightly different semantics
- * wherein the usage pattern is that of variables that have been both initialized
- * and then subsequently passed into a thread directly.
- */
-class DeclarationInitBasedThreadDependentMutex extends ThreadDependentMutex {
-  Variable variableSource;
-
-  DeclarationInitBasedThreadDependentMutex() {
-    exists(MutexSource ms, ThreadCreationFunction tcf |
-      this = DataFlow::exprNode(ms) and
-      // accessed as a mutex source
-      TaintTracking::localTaint(DataFlow::exprNode(variableSource.getAnAccess()),
-        DataFlow::exprNode(ms.getAnArgument())) and
-      // subsequently passed to a thread creation function (order not strictly
-      // enforced for performance reasons)
-      sink = DataFlow::exprNode(tcf.getAnArgument()) and
-      TaintTracking::localTaint(DataFlow::exprNode(variableSource.getAnAccess()), sink)
-    )
-  }
-
-  override DataFlow::Node getAUsage() {
-    TaintTracking::localTaint(getASource(), result) or
-    DataFlow::exprNode(variableSource.getAnAccess()) = result
-  }
-
-  override DataFlow::Node getASource() {
-    // the source is either the thing that declared
-    // the mutex
-    result = this
-    or
-    // or the thread we are using it in
-    result = getAThreadSource()
-  }
-
-  DataFlow::Node getSink() { result = sink }
-
-  /**
-   * Gets the dataflow nodes corresponding to thread local usages of the
-   * dependent mutex.
-   */
-  override DataFlow::Node getAThreadSource() {
-    // here we line up the actual parameter at the thread creation
-    // site with the formal parameter in the target thread.
-    // Note that there are differences between the C and C++ versions
-    // of the argument ordering in the thread creation function. However,
-    // since the C version only takes one parameter (as opposed to multiple)
-    // we can simplify this search by considering only the first argument.
-    exists(
-      FunctionCall fc, Function f, int n // CPP Version
-    |
-      fc.getArgument(n) = sink.asExpr() and
-      f = fc.getArgument(0).(FunctionAccess).getTarget() and
-      // in C++, there is an extra argument to the `std::thread` call
-      // so we must subtract 1 since this is not passed to the thread.
-      result = DataFlow::exprNode(f.getParameter(n - 1).getAnAccess())
-    )
-    or
-    exists(
-      FunctionCall fc, Function f // C Version
-    |
-      fc.getAnArgument() = sink.asExpr() and
-      // in C, the second argument is the function
-      f = fc.getArgument(1).(FunctionAccess).getTarget() and
-      // in C, the passed argument is always the zeroth argument
-      result = DataFlow::exprNode(f.getParameter(0).getAnAccess())
-    )
-  }
-}
-
-/**
- * In the typical C model, another way to use mutexes is to work with global variables
- * that can be initialized at various points -- one of which must be inside a thread.
- * This class encapsulates this pattern.
- */
-class DeclarationInitAccessBasedThreadDependentMutex extends ThreadDependentMutex {
-  Variable variableSource;
-
-  DeclarationInitAccessBasedThreadDependentMutex() {
-    exists(MutexSource ms, ThreadedFunction tf, VariableAccess va |
-      this = DataFlow::exprNode(ms) and
-      // accessed as a mutex source
-      TaintTracking::localTaint(DataFlow::exprNode(variableSource.getAnAccess()),
-        DataFlow::exprNode(ms.getAnArgument())) and
-      // is accessed somewhere else
-      va = variableSource.getAnAccess() and
-      sink = DataFlow::exprNode(va) and
-      // one of which must be a thread
-      va.getEnclosingFunction() = tf
-    )
-  }
-
-  override DataFlow::Node getAUsage() { result = DataFlow::exprNode(variableSource.getAnAccess()) }
-}
-
-module ThreadDependentMutexConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node node) { node.asExpr() instanceof MutexSource }
-
-  predicate isSink(DataFlow::Node node) {
-    exists(ThreadCreationFunction f | f.getAnArgument() = node.asExpr())
-  }
-}
-
-module ThreadDependentMutexFlow = TaintTracking::Global<ThreadDependentMutexConfig>;
-
-/**
- * Models expressions that destroy mutexes.
- */
-abstract class MutexDestroyer extends StmtParent {
-  /**
-   * Gets the expression that references the mutex being destroyed.
-   */
-  abstract Expr getMutexExpr();
-}
-
-/**
- * Models C style mutex destruction via `mtx_destroy`.
- */
-class C11MutexDestroyer extends MutexDestroyer, FunctionCall {
-  C11MutexDestroyer() { getTarget().getName() = "mtx_destroy" }
-
-  /**
-   * Returns the `Expr` being destroyed.
-   */
-  override Expr getMutexExpr() { result = getArgument(0) }
-}
-
-/**
- * Models a delete expression -- note it is necessary to add this in
- * addition to destructors to handle certain implementations of the
- * standard library which obscure the destructors of mutexes.
- */
-class DeleteMutexDestroyer extends MutexDestroyer {
-  DeleteMutexDestroyer() { this instanceof DeleteExpr }
-
-  override Expr getMutexExpr() { this.(DeleteExpr).getExpr() = result }
-}
-
-/**
- * Models a possible mutex variable that if it goes
- * out of scope would destroy an underlying mutex.
- */
-class LocalMutexDestroyer extends MutexDestroyer {
-  Expr assignedValue;
-
-  LocalMutexDestroyer() {
-    exists(LocalVariable lv |
-      // static types aren't destroyers
-      not lv.isStatic() and
-      // neither are pointers
-      not lv.getType() instanceof PointerType and
-      lv.getAnAssignedValue() = assignedValue and
-      // map the location to the return statements of the
-      // enclosing function
-      exists(ReturnStmt rs |
-        rs.getEnclosingFunction() = assignedValue.getEnclosingFunction() and
-        rs = this
-      )
-    )
-  }
-
-  override Expr getMutexExpr() { result = assignedValue }
-}
-
-/**
- * Models implicit or explicit calls to the destructor of a mutex, either via
- * a `delete` statement or a variable going out of scope.
- */
-class DestructorMutexDestroyer extends MutexDestroyer, DestructorCall {
-  DestructorMutexDestroyer() { getTarget().getDeclaringType().hasQualifiedName("std", "mutex") }
-
-  /**
-   * Returns the `Expr` being deleted.
-   */
-  override Expr getMutexExpr() { getQualifier() = result }
-}
-
-/**
- * Models a conditional variable denoted by `std::condition_variable`.
- */
-class ConditionalVariable extends Variable {
-  ConditionalVariable() {
-    getUnderlyingType().(Class).hasQualifiedName("std", "condition_variable")
-  }
-}
-
-/**
- * Models a conditional function, which is a function that depends on the value
- * of a conditional variable.
- */
-class ConditionalFunction extends Function {
-  ConditionalFunction() {
-    exists(ConditionalVariable cv | cv.getAnAccess().getEnclosingFunction() = this)
-  }
-}
-
-/**
- * Models calls to thread specific storage function calls.
- */
-abstract class ThreadSpecificStorageFunctionCall extends FunctionCall {
-  /**
-   * Gets the key to which this call references.
-   */
-  Expr getKey() { getArgument(0) = result }
-}
-
-/**
- * Models calls to `tss_get`.
- */
-class TSSGetFunctionCall extends ThreadSpecificStorageFunctionCall {
-  TSSGetFunctionCall() { getTarget().getName() = "tss_get" }
-}
-
-/**
- * Models calls to `tss_set`.
- */
-class TSSSetFunctionCall extends ThreadSpecificStorageFunctionCall {
-  TSSSetFunctionCall() { getTarget().getName() = "tss_set" }
-}
-
-/**
- * Models calls to `tss_create`
- */
-class TSSCreateFunctionCall extends ThreadSpecificStorageFunctionCall {
-  TSSCreateFunctionCall() { getTarget().getName() = "tss_create" }
-
-  predicate hasDeallocator() {
-    not exists(MacroInvocation mi, NullMacro nm |
-      getArgument(1) = mi.getExpr() and
-      mi = nm.getAnInvocation()
-    )
-  }
-}
-
-/**
- * Models calls to `tss_delete`
- */
-class TSSDeleteFunctionCall extends ThreadSpecificStorageFunctionCall {
-  TSSDeleteFunctionCall() { getTarget().getName() = "tss_delete" }
-}
-
-/**
- * Gets a call to `DeallocationExpr` that deallocates memory owned by thread specific
- * storage.
- */
-predicate getAThreadSpecificStorageDeallocationCall(C11ThreadCreateCall tcc, DeallocationExpr dexp) {
-  exists(TSSGetFunctionCall tsg |
-    tcc.getFunction().getEntryPoint().getASuccessor*() = tsg and
-    DataFlow::localFlow(DataFlow::exprNode(tsg), DataFlow::exprNode(dexp.getFreedExpr()))
-  )
-}
-
-/**
- * Models calls to routines `atomic_compare_exchange_weak` and
- * `atomic_compare_exchange_weak_explicit` in the `stdatomic` library.
- * Note that these are typically implemented as macros within Clang and
- * GCC's standard libraries.
- */
-class AtomicCompareExchange extends MacroInvocation {
-  AtomicCompareExchange() {
-    getMacroName() = "atomic_compare_exchange_weak"
-    or
-    // some compilers model `atomic_compare_exchange_weak` as a macro that
-    // expands to `atomic_compare_exchange_weak_explicit` so this defeats that
-    // and other similar modeling.
-    getMacroName() = "atomic_compare_exchange_weak_explicit" and
-    not exists(MacroInvocation m |
-      m.getMacroName() = "atomic_compare_exchange_weak" and
-      m.getAnExpandedElement() = getAnExpandedElement()
-    )
-  }
-}
-
-/**
- * Models calls to routines `atomic_store` and
- * `atomic_store_explicit` in the `stdatomic` library.
- * Note that these are typically implemented as macros within Clang and
- * GCC's standard libraries.
- */
-class AtomicStore extends MacroInvocation {
-  AtomicStore() {
-    getMacroName() = "atomic_store"
-    or
-    // some compilers model `atomic_compare_exchange_weak` as a macro that
-    // expands to `atomic_compare_exchange_weak_explicit` so this defeats that
-    // and other similar modeling.
-    getMacroName() = "atomic_store_explicit" and
-    not exists(MacroInvocation m |
-      m.getMacroName() = "atomic_store" and
-      m.getAnExpandedElement() = getAnExpandedElement()
-    )
-  }
-}
+import codingstandards.cpp.concurrency.Atomic
+import codingstandards.cpp.concurrency.CConditionOperation
+import codingstandards.cpp.concurrency.ControlFlow
+import codingstandards.cpp.concurrency.ConditionalWait
+import codingstandards.cpp.concurrency.LockingOperation
+import codingstandards.cpp.concurrency.LockProtectedControlFlow
+import codingstandards.cpp.concurrency.MutexDestroyer
+import codingstandards.cpp.concurrency.ThreadCreation
+import codingstandards.cpp.concurrency.ThreadedFunction
+import codingstandards.cpp.concurrency.ThreadDependentMutex
+import codingstandards.cpp.concurrency.ThreadSpecificStorage
+import codingstandards.cpp.concurrency.ThreadWaitDetach
+import codingstandards.cpp.concurrency.Types
diff --git a/cpp/common/src/codingstandards/cpp/ConstHelpers.qll b/cpp/common/src/codingstandards/cpp/ConstHelpers.qll
index 8cba3efde4..a3d12fd127 100644
--- a/cpp/common/src/codingstandards/cpp/ConstHelpers.qll
+++ b/cpp/common/src/codingstandards/cpp/ConstHelpers.qll
@@ -4,7 +4,7 @@
 
 import cpp
 import codingstandards.cpp.SideEffect
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.FunctionParameter
 
 /** A variable that can be modified (both the pointer and object pointed to if pointer type) */
diff --git a/cpp/common/src/codingstandards/cpp/Emergent.qll b/cpp/common/src/codingstandards/cpp/Emergent.qll
index 9036c12bd7..30f1df58e4 100644
--- a/cpp/common/src/codingstandards/cpp/Emergent.qll
+++ b/cpp/common/src/codingstandards/cpp/Emergent.qll
@@ -6,44 +6,10 @@ import cpp
 module C11 {
   abstract class EmergentLanguageFeature extends Element { }
 
-  class AlignAsAttribute extends EmergentLanguageFeature, Attribute {
-    AlignAsAttribute() { getName() = "_Alignas" }
-  }
-
-  class AtomicVariableSpecifier extends EmergentLanguageFeature, Variable {
-    AtomicVariableSpecifier() {
-      getType().(DerivedType).getBaseType*().getASpecifier().getName() = "atomic"
-    }
-  }
-
-  class AtomicDeclaration extends EmergentLanguageFeature, Declaration {
-    AtomicDeclaration() { getASpecifier().getName() = "atomic" }
-  }
-
-  class ThreadLocalDeclaration extends EmergentLanguageFeature, Declaration {
-    ThreadLocalDeclaration() { getASpecifier().getName() = "is_thread_local" }
-  }
-
-  class EmergentHeader extends EmergentLanguageFeature, Include {
-    EmergentHeader() {
-      getIncludedFile().getBaseName() = ["stdalign.h", "stdatomic.h", "stdnoreturn.h", "threads.h"]
-    }
-  }
-
   class LibExt1Macro extends EmergentLanguageFeature, Macro {
     LibExt1Macro() {
       getName() = "__STDC_WANT_LIB_EXT1__" and
       getBody() = "1"
     }
   }
-
-  class GenericMacro extends EmergentLanguageFeature, Macro {
-    GenericMacro() { getBody().indexOf("_Generic") = 0 }
-  }
-
-  class NoReturnSpecificer extends EmergentLanguageFeature, Function {
-    NoReturnSpecificer() { getASpecifier().getName() = "noreturn" }
-  }
-
-  class AlignOf extends EmergentLanguageFeature, AlignofTypeOperator { }
 }
diff --git a/cpp/common/src/codingstandards/cpp/Exclusions.qll b/cpp/common/src/codingstandards/cpp/Exclusions.qll
index b718f6535d..e6a477b220 100644
--- a/cpp/common/src/codingstandards/cpp/Exclusions.qll
+++ b/cpp/common/src/codingstandards/cpp/Exclusions.qll
@@ -35,19 +35,14 @@ predicate isExcluded(Element e, Query query, string reason) {
     ) and
     reason = "Query has an associated deviation record for the element's file."
     or
-    // The element is on the same line as a suppression comment
-    exists(Comment c |
-      c = dr.getACodeIdentifierComment() and
-      query = dr.getQuery()
-    |
-      exists(string filepath, int endLine |
-        // Comment occurs on the same line as the end line of the element
-        e.getLocation().hasLocationInfo(filepath, _, _, endLine, _) and
-        c.getLocation().hasLocationInfo(filepath, endLine, _, _, _)
-      )
-    ) and
-    reason =
-      "Query has an associated deviation record with a code identifier that is applied to the element."
+    // The element is annotated by a code identifier that deviates this rule
+    exists(CodeIdentifierDeviation deviationInCode |
+      dr.getQuery() = query and
+      deviationInCode = dr.getACodeIdentifierDeviation() and
+      deviationInCode.isElementMatching(e) and
+      reason =
+        "Query has an associated deviation record with a code identifier that is applied to the element."
+    )
   )
   or
   // The effective category of the query is 'Disapplied'.
diff --git a/cpp/common/src/codingstandards/cpp/Expr.qll b/cpp/common/src/codingstandards/cpp/Expr.qll
index 0b650ae41b..54ba86c5b7 100644
--- a/cpp/common/src/codingstandards/cpp/Expr.qll
+++ b/cpp/common/src/codingstandards/cpp/Expr.qll
@@ -1,4 +1,5 @@
 import cpp
+private import semmle.code.cpp.dataflow.DataFlow
 private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import codingstandards.cpp.AccessPath
 
diff --git a/cpp/common/src/codingstandards/cpp/FgetsErrorManagement.qll b/cpp/common/src/codingstandards/cpp/FgetsErrorManagement.qll
index 7686714635..026fd93045 100644
--- a/cpp/common/src/codingstandards/cpp/FgetsErrorManagement.qll
+++ b/cpp/common/src/codingstandards/cpp/FgetsErrorManagement.qll
@@ -4,7 +4,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.controlflow.Guards
 
 /*
diff --git a/cpp/common/src/codingstandards/cpp/FloatingPoint.qll b/cpp/common/src/codingstandards/cpp/FloatingPoint.qll
new file mode 100644
index 0000000000..e2a13bd62e
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/FloatingPoint.qll
@@ -0,0 +1,413 @@
+import codeql.util.Boolean
+import codingstandards.cpp.RestrictedRangeAnalysis
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis as SimpleRangeAnalysis
+
+predicate exprMayEqualZero(Expr e) {
+  RestrictedRangeAnalysis::upperBound(e) >= 0 and
+  RestrictedRangeAnalysis::lowerBound(e) <= 0 and
+  not guardedNotEqualZero(e)
+}
+
+newtype TFPClassification =
+  TFinite() or
+  TNaN() or
+  TInfinite()
+
+class FPClassification extends TFPClassification {
+  string toString() {
+    this = TFinite() and
+    result = "finite"
+    or
+    this = TNaN() and
+    result = "NaN"
+    or
+    this = TInfinite() and
+    result = "infinite"
+  }
+}
+
+newtype TFPClassificationConstraint =
+  /* The value may be infinite, NaN, or finite. */
+  TUnclassified() or
+  /**
+   * The value must be one of: infinite, NaN, or finite.
+   *
+   * If strict is `true` then this inverts naively. For example, `!isfinite(x)` means `x` must not
+   * be finite. However, `!iszero(x)` is true for some finite values, and inverts to
+   * `TUnclassified`.
+   */
+  TExactFPClassification(TFPClassification cls, Boolean strict) or
+  /* The value must not be one of: infinite, NaN, or finite. */
+  TExcludeFPClassification(TFPClassification cls1)
+
+class FPClassificationConstraint extends TFPClassificationConstraint {
+  string toString() {
+    this = TUnclassified() and
+    result = "unclassified"
+    or
+    exists(FPClassification cls, Boolean strict |
+      this = TExactFPClassification(cls, strict) and
+      result = "must be " + cls.toString() + ", strict: " + strict.toString()
+      or
+      this = TExcludeFPClassification(cls) and
+      result = "must NOT be " + cls.toString()
+    )
+  }
+
+  /**
+   * Invert the constraint, for instance, "must be finite" becomes "must not be finite".
+   *
+   * Non-strict exact constraints are inverted to the unclassified constraint. For example,
+   * `iszero(x)` guarantees `x` to be finite, however, `!iszero(x)` can be true for all three
+   * classes of floating point values.
+   *
+   * The unclassified constraint inverts to itself.
+   */
+  FPClassificationConstraint invert() {
+    // Unclassified inverts to itself.
+    this = TUnclassified() and result = this
+    or
+    exists(FPClassification cls |
+      // `!isfinite()` implies is infinite or NaN.
+      this = TExactFPClassification(cls, true) and
+      result = TExcludeFPClassification(cls)
+      or
+      // `!iszero()` implies nothing.
+      this = TExactFPClassification(cls, false) and
+      result = TUnclassified()
+      or
+      // For completeness: `!isfinite(x) ? ... : x` would imply `isfinite(x)`.
+      this = TExcludeFPClassification(cls) and
+      result = TExactFPClassification(cls, true)
+    )
+  }
+
+  /**
+   * Naively invert the constraint, for instance, "must be finite" becomes "must not be finite".
+   *
+   * Word of caution: inverting a guard condition does not necessarily invert the constraint. For
+   * example, `iszero(x)` guarantees `x` to be finite, however, `isnotzero(x)` does not guarantee
+   * `x` not to be finite.
+   *
+   * The unclassified constraint is not inverted.
+   */
+  FPClassificationConstraint naiveInversion() {
+    this = TUnclassified() and result = this
+    or
+    exists(FPClassification cls |
+      this = TExactFPClassification(cls, _) and
+      result = TExcludeFPClassification(cls)
+      or
+      this = TExcludeFPClassification(cls) and
+      result = TExactFPClassification(cls, true)
+    )
+  }
+
+  predicate mustBe(FPClassification cls) { this = TExactFPClassification(cls, _) }
+
+  predicate mustNotBe(FPClassification cls) {
+    this = TExcludeFPClassification(cls)
+    or
+    this = TExactFPClassification(_, _) and
+    not this = TExactFPClassification(cls, _)
+  }
+
+  predicate mayBe(FPClassification cls) { not mustNotBe(cls) }
+}
+
+/**
+ * The names of the functions or macros that classify floating point values.
+ *
+ * These names reflect a check that a value is finite, or infinite, or NaN. Finite and NaN checks
+ * are either strict (return true for all values in the class) or not (return true for some
+ * values).
+ *
+ * The infinite check is always strict, and specially, returns 1 or -1 for positive or negative
+ * infinity.
+ */
+newtype TFPClassifierName =
+  TClassifiesFinite(string name, boolean strict) {
+    strict = true and
+    name = ["finite" + ["", "l", "f"], "isfinite"]
+    or
+    strict = false and
+    name = ["isnormal", "issubnormal", "iszero"]
+  } or
+  TClassifiesNaN(string name, boolean strict) {
+    strict = true and
+    name = "isnan" + ["", "f", "l"]
+    or
+    strict = false and
+    name = "issignaling"
+  } or
+  TClassifiesInfinite(string name) { name = "isinf" + ["", "f", "l"] }
+
+class FPClassifierName extends TFPClassifierName {
+  string name;
+  boolean strict;
+
+  FPClassifierName() {
+    this = TClassifiesFinite(name, strict)
+    or
+    this = TClassifiesInfinite(name) and
+    strict = true
+    or
+    this = TClassifiesNaN(name, strict)
+  }
+
+  string toString() { result = name }
+
+  /** The classification name, for instance, "isfinite". */
+  string getName() { result = name }
+
+  /**
+   * Whether the check holds for all values in the class, or only some.
+   *
+   * For instance, "isfinite" is strict because it returns true for all finite values, but
+   * "isnormal" is not as it returns false for some finite values.
+   */
+  predicate isStrict() { strict = true }
+
+  FPClassificationConstraint getConstraint() {
+    this = TClassifiesFinite(_, strict) and
+    result = TExactFPClassification(any(TFinite t), strict)
+    or
+    this = TClassifiesNaN(_, strict) and
+    result = TExactFPClassification(any(TNaN t), strict)
+    or
+    this = TClassifiesInfinite(_) and
+    // TODO: isinf() is special
+    result = TExactFPClassification(any(TInfinite t), false)
+  }
+}
+
+/**
+ * An invocation of a classification function, for instance, "isfinite(x)", implemented as a macro.
+ */
+class FPClassifierMacroInvocation extends MacroInvocation {
+  FPClassifierName classifier;
+
+  FPClassifierMacroInvocation() { getMacroName() = classifier.getName() }
+
+  Expr getCheckedExpr() {
+    // Getting the checked expr in a cross-platform way is extroardinarily difficult, as glibc has
+    // multiple conditional implementations of the same macro. Assume the checked expr is a
+    // variable access so we can search optimistically like so:
+    exists(VariableAccess va |
+      va.getTarget().getName() = getExpandedArgument(0) and
+      va = getAnExpandedElement() and
+      result = va
+    )
+  }
+
+  /**
+   * The classification name, for instance, "isfinite".
+   */
+  FPClassifierName getFPClassifierName() { result = classifier }
+}
+
+/**
+ * A classification function, for instance, "isfinite", when implemented as a function.
+ */
+class FPClassifierFunction extends Function {
+  FPClassifierName classifier;
+
+  FPClassifierFunction() { getName() = classifier.getName() }
+
+  FPClassifierName getFPClassifierName() { result = classifier }
+}
+
+class FPClassificationGuard instanceof GuardCondition {
+  Expr floatExpr;
+  Expr checkResultExpr;
+  FPClassifierName classifier;
+
+  FPClassificationGuard() {
+    super.comparesEq(checkResultExpr, _, _, _) and
+    (
+      exists(FPClassifierMacroInvocation m |
+        floatExpr = m.getCheckedExpr() and
+        checkResultExpr = m.getExpr() and
+        classifier = m.getFPClassifierName()
+      )
+      or
+      exists(FunctionCall fc, FPClassifierFunction f |
+        fc.getTarget() = f and
+        floatExpr = fc.getArgument(0) and
+        checkResultExpr = fc and
+        classifier = f.getFPClassifierName()
+      )
+    )
+  }
+
+  string toString() {
+    result =
+      classifier.toString() + " guard on " + floatExpr.toString() + " via " +
+        checkResultExpr.toString()
+  }
+
+  predicate constrainsFPClass(Expr e, FPClassificationConstraint constraint, Boolean testIsTrue) {
+    floatExpr = e and
+    exists(BooleanValue value, boolean areEqual, int testResult, FPClassificationConstraint base |
+      super.comparesEq(checkResultExpr, testResult, areEqual, value) and
+      base = getBaseConstraint(areEqual, testResult) and
+      if value.getValue() = testIsTrue then constraint = base else constraint = base.invert()
+    )
+  }
+
+  // Helper predicate, gets base constraint assuming `classifier() == value` or `classifier != value`.
+  private FPClassificationConstraint getBaseConstraint(Boolean areEqual, int testResult) {
+    exists(FPClassificationConstraint base |
+      testResult = 0 and
+      exists(Boolean strict |
+        // Handle isfinite() != 0:
+        classifier = TClassifiesFinite(_, strict) and
+        base = TExactFPClassification(TFinite(), strict)
+        or
+        // Handle isNaN() != 0:
+        classifier = TClassifiesNaN(_, strict) and
+        base = TExactFPClassification(TNaN(), strict)
+        or
+        // Handle isinf() != 0, which matches for +/- infinity:
+        classifier = TClassifiesInfinite(_) and
+        base = TExactFPClassification(TInfinite(), true)
+      ) and
+      // Invert the base constraint in the case of `classifier() == 0`
+      if areEqual = false then result = base else result = base.invert()
+      or
+      // Handle isinf() == 1 or isInf() == -1, which matches for one of +/- infinity:
+      testResult = 1 and
+      classifier = TClassifiesInfinite(_) and
+      base = TExactFPClassification(TInfinite(), false) and
+      // Invert the base constraint in the case of `classifier() != 1`
+      if areEqual = true then result = base else result = base.invert()
+      // TODO: handle fpclassify() == FP_INFINITE, FP_NAN, FP_NORMAL, FP_ZERO, etc.
+    )
+  }
+
+  predicate controls(Expr e, boolean testIsTrue) {
+    exists(IRGuardCondition irg, IRBlock irb, Instruction eir, BooleanValue bval |
+      irg.getUnconvertedResultExpression() = this and
+      bval.getValue() = testIsTrue and
+      irg.valueControls(irb, bval) and
+      eir.getAst().(ControlFlowNode).getBasicBlock() = e.getBasicBlock() and
+      eir.getBlock() = irb
+    )
+  }
+}
+
+predicate guardedNotEqualZero(Expr e) {
+  /* Note Boolean cmpEq, false means cmpNeq */
+  exists(Expr checked, GuardCondition guard, boolean cmpEq, BooleanValue value |
+    hashCons(checked) = hashCons(e) and
+    guard.controls(e.getBasicBlock(), cmpEq) and
+    value.getValue() = cmpEq and
+    guard.comparesEq(checked, 0, false, value)
+  )
+  or
+  exists(Expr checked, Expr val, int valVal, GuardCondition guard, boolean cmpEq |
+    hashCons(checked) = hashCons(e) and
+    forex(float v |
+      v = [RestrictedRangeAnalysis::lowerBound(val), RestrictedRangeAnalysis::upperBound(val)]
+    |
+      valVal = v
+    ) and
+    guard.controls(e.getBasicBlock(), cmpEq) and
+    guard.comparesEq(checked, val, -valVal, false, cmpEq)
+  )
+}
+
+predicate guardedNotFPClass(Expr e, FPClassification cls) {
+  /* Note Boolean cmpEq, false means cmpNeq */
+  exists(
+    Expr checked, FPClassificationGuard guard, FPClassificationConstraint constraint, boolean cmpEq
+  |
+    hashCons(checked) = hashCons(e) and
+    guard.controls(e, cmpEq) and
+    guard.constrainsFPClass(checked, constraint, cmpEq) and
+    constraint.mustNotBe(cls) and
+    not checked = e
+  )
+}
+
+predicate exprMayEqualInfinity(Expr e, Boolean positive) {
+  exists(float target |
+    positive = true and target = 1.0 / 0.0
+    or
+    positive = false and target = -1.0 / 0.0
+  |
+    RestrictedRangeAnalysis::upperBound(e.getUnconverted()) = target or
+    RestrictedRangeAnalysis::lowerBound(e.getUnconverted()) = target
+  ) and
+  not guardedNotFPClass(e, TInfinite()) and
+  not e.getType() instanceof IntegralType
+}
+
+signature float upperBoundPredicate(Expr e);
+
+signature float lowerBoundPredicate(Expr e);
+
+signature predicate exprMayEqualZeroPredicate(Expr e);
+
+predicate exprMayEqualZeroNaive(Expr e) { e.getValue().toFloat() = 0 }
+
+/**
+ * Get the math function name variants for the given name, e.g., "acos" has variants "acos",
+ * "acosf", and "acosl".
+ */
+Function getMathVariants(string name) { result.hasGlobalOrStdName([name, name + "f", name + "l"]) }
+
+module DomainError<
+  upperBoundPredicate/1 ub, lowerBoundPredicate/1 lb, exprMayEqualZeroPredicate/1 mayEqualZero>
+{
+  predicate hasDomainError(FunctionCall fc, string description) {
+    exists(Function functionWithDomainError | fc.getTarget() = functionWithDomainError |
+      functionWithDomainError = [getMathVariants(["acos", "asin", "atanh"])] and
+      not (
+        ub(fc.getArgument(0)) <= 1.0 and
+        lb(fc.getArgument(0)) >= -1.0
+      ) and
+      description =
+        "the argument has a range " + lb(fc.getArgument(0)) + "..." + ub(fc.getArgument(0)) +
+          " which is outside the domain of this function (-1.0...1.0)"
+      or
+      functionWithDomainError = getMathVariants(["atan2", "pow"]) and
+      (
+        mayEqualZero(fc.getArgument(0)) and
+        mayEqualZero(fc.getArgument(1)) and
+        description = "both arguments are equal to zero"
+      )
+      or
+      functionWithDomainError = getMathVariants("pow") and
+      (
+        ub(fc.getArgument(0)) < 0.0 and
+        ub(fc.getArgument(1)) < 0.0 and
+        description = "both arguments are less than zero"
+      )
+      or
+      functionWithDomainError = getMathVariants("acosh") and
+      ub(fc.getArgument(0)) < 1.0 and
+      description = "argument is less than 1"
+      or
+      //pole error is the same as domain for logb and tgamma (but not ilogb - no pole error exists)
+      functionWithDomainError = getMathVariants(["ilogb", "logb", "tgamma"]) and
+      fc.getArgument(0).getValue().toFloat() = 0 and
+      description = "argument is equal to zero"
+      or
+      functionWithDomainError = getMathVariants(["log", "log10", "log2", "sqrt"]) and
+      ub(fc.getArgument(0)) < 0.0 and
+      description = "argument is negative"
+      or
+      functionWithDomainError = getMathVariants("log1p") and
+      ub(fc.getArgument(0)) < -1.0 and
+      description = "argument is less than 1"
+      or
+      functionWithDomainError = getMathVariants("fmod") and
+      fc.getArgument(1).getValue().toFloat() = 0 and
+      description = "y is 0"
+    )
+  }
+}
+
+import DomainError<RestrictedRangeAnalysis::upperBound/1, RestrictedRangeAnalysis::lowerBound/1, exprMayEqualZero/1> as RestrictedDomainError
+import DomainError<SimpleRangeAnalysis::upperBound/1, SimpleRangeAnalysis::lowerBound/1, exprMayEqualZeroNaive/1> as SimpleDomainError
diff --git a/cpp/common/src/codingstandards/cpp/IrreplaceableFunctionLikeMacro.qll b/cpp/common/src/codingstandards/cpp/IrreplaceableFunctionLikeMacro.qll
index af62cacfd3..8daf129622 100644
--- a/cpp/common/src/codingstandards/cpp/IrreplaceableFunctionLikeMacro.qll
+++ b/cpp/common/src/codingstandards/cpp/IrreplaceableFunctionLikeMacro.qll
@@ -56,3 +56,7 @@ private class FunctionLikeMacroWithOperatorArgument extends IrreplaceableFunctio
     )
   }
 }
+
+private class GenericMacro extends IrreplaceableFunctionLikeMacro {
+  GenericMacro() { getBody().matches("%_Generic%") }
+}
diff --git a/cpp/common/src/codingstandards/cpp/Iterators.qll b/cpp/common/src/codingstandards/cpp/Iterators.qll
index 1b5199a806..c8c217aea4 100644
--- a/cpp/common/src/codingstandards/cpp/Iterators.qll
+++ b/cpp/common/src/codingstandards/cpp/Iterators.qll
@@ -3,8 +3,8 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
-import codingstandards.cpp.dataflow.TaintTracking
+private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.StdNamespace
 import codingstandards.cpp.rules.containeraccesswithoutrangecheck.ContainerAccessWithoutRangeCheck as ContainerAccessWithoutRangeCheck
 import semmle.code.cpp.controlflow.Guards
@@ -16,7 +16,9 @@ abstract class ContainerAccess extends VariableAccess {
 }
 
 pragma[noinline, nomagic]
-predicate localTaint(DataFlow::Node n1, DataFlow::Node n2) { TaintTracking::localTaint(n1, n2) }
+private predicate localTaint(DataFlow::Node n1, DataFlow::Node n2) {
+  TaintTracking::localTaint(n1, n2)
+}
 
 // define this as anything with dataflow FROM the vector
 class ContainerPointerOrReferenceAccess extends ContainerAccess {
@@ -37,7 +39,9 @@ class ContainerPointerOrReferenceAccess extends ContainerAccess {
       ) and
       localTaint(DataFlow::exprNode(fc), DataFlow::exprNode(this)) and
       (getUnderlyingType() instanceof ReferenceType or getUnderlyingType() instanceof PointerType) and
-      fc.getQualifier().(VariableAccess).getTarget() = owningContainer
+      fc.getQualifier().(VariableAccess).getTarget() = owningContainer and
+      // Exclude cases where we see taint into the owning container
+      not this = owningContainer.getAnAccess()
     )
   }
 
diff --git a/cpp/common/src/codingstandards/cpp/Locations.qll b/cpp/common/src/codingstandards/cpp/Locations.qll
new file mode 100644
index 0000000000..800f44d18a
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/Locations.qll
@@ -0,0 +1,30 @@
+import cpp
+
+/** Holds if `lineNumber` is an indexed line number in file `f`. */
+predicate isLineNumber(File f, int lineNumber) {
+  exists(Location l | l.getFile() = f |
+    l.getStartLine() = lineNumber
+    or
+    l.getEndLine() = lineNumber
+  )
+}
+
+/** Gets the last line number in `f`. */
+int getLastLineNumber(File f) { result = max(int lineNumber | isLineNumber(f, lineNumber)) }
+
+/** Gets the last column number on the last line of `f`. */
+int getLastColumnNumber(File f) {
+  result =
+    max(Location l |
+      l.getFile() = f and
+      l.getEndLine() = getLastLineNumber(f)
+    |
+      l.getEndColumn()
+    )
+}
+
+/** Gets the last column number on the given line of `filepath`. */
+bindingset[filepath, lineNumber]
+int getLastColumnNumber(string filepath, int lineNumber) {
+  result = max(Location l | l.hasLocationInfo(filepath, _, _, lineNumber, _) | l.getEndColumn())
+}
diff --git a/cpp/common/src/codingstandards/cpp/MatchingParenthesis.qll b/cpp/common/src/codingstandards/cpp/MatchingParenthesis.qll
new file mode 100644
index 0000000000..8a28bd0517
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/MatchingParenthesis.qll
@@ -0,0 +1,264 @@
+/**
+ * A library for parsing a string of parentheses and non-parentheses characters.
+ *
+ * Simply implement the signature class `InputString` for the set of strings that you wish to parse,
+ * and then use the `MatchingParenthesis<T>` module which exposes the following classes/predicates:
+ *  - `ParsedRoot`: The root of the parse tree.
+ *  - `ParsedGroup`: Parenthesis groups. The root is also a group, even if not parenthesized.
+ *  - `ParsedText`: All text that is not '(' or ')'.
+ *  - `Tokenized`: A linked list of the tokens in the input string.
+ *  - `textFrom(start, end)`: A function to get the text between two tokens.
+ *
+ * The parenthesis AST has functions `getChild(int i)` and `getParent()` to navigate the tree, as
+ * well as `getRoot()` and `getText()` for `ParsedText` nodes. They also have methods
+ * `getStartToken()`, `getEndToken()` which are especially useful with the method `textFrom(...)`.
+ *
+ * This module can allow for slightly more intelligent interpretation of macro strings, but it has
+ * limitations.
+ *  - It _only_ handles the parenthesis.
+ *  - It assumes parentheses are matched.
+ *  - It does not handle the case where a parenthesis is inside a string literal.
+ *  - It does not handle the case where a parenthesis is inside a comment.
+ *
+ * This module has been moderately optimized, but still it is best to be selective with the set of
+ * strings you attempt to parse with it.
+ */
+
+import codeql.util.Option
+
+signature class InputString extends string;
+
+module MatchingParenthesis<InputString Input> {
+  newtype TTokenType =
+    TOpenParen() or
+    TCloseParen() or
+    TNotParen()
+
+  bindingset[char]
+  private TTokenType tokenTypeOfChar(string char) {
+    result = TOpenParen() and char = "("
+    or
+    result = TCloseParen() and char = ")"
+  }
+
+  private int inputId(Input i) { rank[result](Input inp) = i }
+
+  private newtype TTokenized =
+    TTokenizerStart(int iid) { iid = inputId(_) } or
+    TToken(int iid, TTokenized prev, TTokenType token, int occurrence, int endPos) {
+      exists(string inputStr, int prevEndPos, int prevOccurrence, string char |
+        iid = inputId(inputStr) and
+        (
+          prev = TTokenizerStart(iid) and prevOccurrence = -1 and prevEndPos = 0
+          or
+          prev = TToken(iid, _, _, prevOccurrence, prevEndPos)
+        ) and
+        inputStr.charAt(prevEndPos) = char and
+        if char = ["(", ")"]
+        then (
+          endPos = prevEndPos + 1 and
+          token = tokenTypeOfChar(char) and
+          occurrence = prevOccurrence + 1
+        ) else (
+          token = TNotParen() and
+          exists(inputStr.regexpFind("\\(|\\)", prevOccurrence + 1, endPos)) and
+          occurrence = prevOccurrence
+        )
+      )
+    }
+
+  class Tokenized extends TTokenized {
+    string toString() {
+      getTokenType() = TOpenParen() and result = "("
+      or
+      getTokenType() = TCloseParen() and result = ")"
+      or
+      getTokenType() = TNotParen() and result = "non-parenthesis"
+    }
+
+    int getInputId() { this = TToken(result, _, _, _, _) }
+
+    TTokenType getTokenType() { this = TToken(_, _, result, _, _) }
+
+    Tokenized getPrevious() { this = TToken(_, result, _, _, _) }
+
+    string getInputString() {
+      this = TToken(inputId(result), _, _, _, _) or this = TTokenizerStart(inputId(result))
+    }
+
+    int getStartPos() {
+      if exists(getPrevious()) then result = getPrevious().getEndPos() else result = 0
+    }
+
+    int getEndPos() {
+      this = TToken(_, _, _, _, result)
+      or
+      this = TTokenizerStart(_) and result = 0
+    }
+
+    string getText() { result = textFrom(this, this) }
+
+    Tokenized getNext() { result.getPrevious() = this }
+
+    Tokenized getLast() {
+      if exists(getNext()) then result = getNext().getLast() else result = this
+    }
+  }
+
+  /**
+   * The root of the parse tree.
+   */
+  class ParsedRoot extends ParsedGroup {
+    ParsedRoot() { not exists(getParent()) }
+
+    override ParsedRoot getRoot() { result = this }
+
+    override string getDebugText() { result = this.(Tokenized).getInputString() }
+  }
+
+  /**
+   * A group of tokens that may be parenthesized.
+   *
+   * The `ParseRoot` is the only group that isn't parenthesized.
+   */
+  class ParsedGroup extends Parsed {
+    ParsedGroup() { isGroup() }
+
+    Parsed getChild(int i) {
+      result.getParent() = this and
+      result.getChildIdx() = i
+    }
+  }
+
+  /**
+   * Get the text from the `start` token to the `end` token (inclusive on both ends).
+   */
+  pragma[inline]
+  string textFrom(Tokenized start, Tokenized end) {
+    result = start.getInputString().substring(start.getStartPos(), end.getEndPos())
+  }
+
+  /**
+   * All text that is not '(' or ')'.
+   */
+  class ParsedText extends Parsed {
+    ParsedText() { not isGroup() }
+
+    string getText() { result = textFrom(getStartToken(), getEndToken()) }
+  }
+
+  /**
+   * The AST for the input string parsed with matching parenthesis.
+   */
+  class Parsed extends TTokenized {
+    Option<ParsedGroup>::Option parent;
+    int childIdx;
+    boolean isGroup;
+
+    Parsed() {
+      this.(Tokenized).getTokenType() = TNotParen() and
+      parseStepAppend(this, parent.asSome(), childIdx) and
+      isGroup = false
+      or
+      this.(Tokenized).getTokenType() = TOpenParen() and
+      parseStepOpen(this, parent.asSome(), childIdx) and
+      isGroup = true
+      or
+      this = TTokenizerStart(_) and
+      parent.isNone() and
+      childIdx = 0 and
+      isGroup = true
+    }
+
+    ParsedRoot getRoot() { result = getParent().getRoot() }
+
+    string getInputString() { result = this.(Tokenized).getInputString() }
+
+    /**
+     * The token that starts this group.
+     *
+     * For `ParsedText`, this is the same as the end token.
+     */
+    Tokenized getStartToken() { result = this }
+
+    /**
+     * The token that endns this group.
+     *
+     * For `ParsedText`, this is the same as the start token. If parentheses are not matched, this
+     * may not have a result.
+     */
+    Tokenized getEndToken() {
+      this.(Tokenized).getTokenType() = TNotParen() and
+      result = this
+      or
+      this.(Tokenized).getTokenType() = TOpenParen() and
+      parseStepClose(result, this)
+      or
+      this = TTokenizerStart(_) and
+      result = getStartToken().(Tokenized).getLast()
+    }
+
+    /**
+     * The index of this child in the parent group.
+     */
+    int getChildIdx() { result = childIdx }
+
+    ParsedGroup getParent() { result = parent.asSome() }
+
+    predicate isGroup() { isGroup = true }
+
+    string getDebugText() { result = textFrom(getStartToken(), getEndToken()) }
+
+    string toString() { result = this.(Tokenized).toString() }
+  }
+
+  /**
+   * Parse open parenthesis and add it to the open group or parse root. Parsing algorithm may not
+   * behave reliably for mismatched parenthesis.
+   */
+  private predicate parseStepOpen(Tokenized consumeToken, ParsedGroup parent, int childIdx) {
+    consumeToken.getTokenType() = TOpenParen() and
+    (
+      consumeToken.getPrevious() = parent.getStartToken() and
+      childIdx = 0
+      or
+      exists(Parsed prevSibling |
+        prevSibling.getEndToken() = consumeToken.getPrevious() and
+        childIdx = prevSibling.getChildIdx() + 1 and
+        parent = prevSibling.getParent()
+      )
+    )
+  }
+
+  /**
+   * Parse raw text that isn't '(' or ')' and add it to the open group or parse root.
+   */
+  private predicate parseStepAppend(Tokenized consumeToken, ParsedGroup parent, int childIdx) {
+    consumeToken.getTokenType() = TNotParen() and
+    (
+      consumeToken.getPrevious() = parent.getStartToken() and childIdx = 0
+      or
+      exists(Parsed prevSibling |
+        prevSibling.getEndToken() = consumeToken.getPrevious() and
+        childIdx = prevSibling.getChildIdx() + 1 and
+        parent = prevSibling.getParent()
+      )
+    )
+  }
+
+  /**
+   * Parse a close parenthesis to close the currently open group. Parsing algorithm may not behave
+   * properly for mismatched parenthesis.
+   */
+  private predicate parseStepClose(Tokenized consumeToken, ParsedGroup closed) {
+    consumeToken.getTokenType() = TCloseParen() and
+    (
+      closed.getStartToken() = consumeToken.getPrevious()
+      or
+      exists(Parsed finalChild |
+        consumeToken.getPrevious() = finalChild.getEndToken() and
+        finalChild.getParent() = closed
+      )
+    )
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/Nullness.qll b/cpp/common/src/codingstandards/cpp/Nullness.qll
index d76db4afad..8751c54d9b 100644
--- a/cpp/common/src/codingstandards/cpp/Nullness.qll
+++ b/cpp/common/src/codingstandards/cpp/Nullness.qll
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 private class PointerToMember extends Variable {
   PointerToMember() { this.getType() instanceof PointerToMemberType }
diff --git a/cpp/common/src/codingstandards/cpp/Overflow.qll b/cpp/common/src/codingstandards/cpp/Overflow.qll
index dca1386513..b81147d6bf 100644
--- a/cpp/common/src/codingstandards/cpp/Overflow.qll
+++ b/cpp/common/src/codingstandards/cpp/Overflow.qll
@@ -6,7 +6,7 @@ import cpp
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 import SimpleRangeAnalysisCustomizations
 import semmle.code.cpp.controlflow.Guards
-import codingstandards.cpp.dataflow.TaintTracking
+private import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import codingstandards.cpp.Expr
 import codingstandards.cpp.UndefinedBehavior
diff --git a/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll b/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll
index 7adb911c9f..94e7f89796 100644
--- a/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll
+++ b/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.standardlibrary.FileAccess
 
 /**
diff --git a/cpp/common/src/codingstandards/cpp/RestrictedRangeAnalysis.qll b/cpp/common/src/codingstandards/cpp/RestrictedRangeAnalysis.qll
new file mode 100644
index 0000000000..d92b46335d
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/RestrictedRangeAnalysis.qll
@@ -0,0 +1,2243 @@
+import semmle.code.cpp.controlflow.Guards
+import semmle.code.cpp.valuenumbering.HashCons
+
+/**
+ * A fork of SimpleRangeAnalysis.qll, which is intended to only give results
+ * with a conservative basis. Forked from codeql/cpp-all@1.4.2.
+ *
+ * For instance, since range analysis is local, a function call (e.g. `f()`) is
+ * given the widest possible range in the original library. In this fork, we do
+ * not provide any result.
+ *
+ * Original library level doc comment from SimpleRangeAnalysis.qll:
+ *
+ * > Simple range analysis library. Range analysis is usually done as an
+ * > abstract interpretation over the lattice of range values. (A range is a
+ * > pair, containing a lower and upper bound for the value.) The problem
+ * > with this approach is that the lattice is very tall, which means it can
+ * > take an extremely large number of iterations to find the least fixed
+ * > point. This example illustrates the problem:
+ *
+ * >    int count = 0;
+ * >    for (; p; p = p->next) {
+ * >      count = count+1;
+ * >    }
+ *
+ * > The range of 'count' is initially (0,0), then (0,1) on the second
+ * > iteration, (0,2) on the third iteration, and so on until we eventually
+ * > reach maxInt.
+ *
+ * > This library uses a crude solution to the problem described above: if
+ * > the upper (or lower) bound of an expression might depend recursively on
+ * > itself then we round it up (down for lower bounds) to one of a fixed set
+ * > of values, such as 0, 1, 2, 256, and +Inf. This limits the height of the
+ * > lattice which ensures that the analysis will terminate in a reasonable
+ * > amount of time. This solution is similar to the abstract interpretation
+ * > technique known as 'widening', but it is less precise because we are
+ * > unable to inspect the bounds from the previous iteration of the fixed
+ * > point computation. For example, widening might be able to deduce that
+ * > the lower bound is -11 but we would approximate it to -16.
+ *
+ * > QL does not allow us to compute an aggregate over a recursive
+ * > sub-expression, so we cannot compute the minimum lower bound and maximum
+ * > upper bound during the recursive phase of the query. Instead, the
+ * > recursive phase computes a set of lower bounds and a set of upper bounds
+ * > for each expression. We compute the minimum lower bound and maximum
+ * > upper bound after the recursion is finished. This is another reason why
+ * > we need to limit the number of bounds per expression, because they will
+ * > all be stored until the recursive phase is finished.
+ *
+ * > The ranges are represented using a pair of floating point numbers. This
+ * > is simpler than using integers because floating point numbers cannot
+ * > overflow and wrap. It is also convenient because we can detect overflow
+ * > and negative overflow by looking for bounds that are outside the range
+ * > of the type.
+ *
+ * The differences between this library and the original are:
+ *  - The `largeValue()` predicate, with a value of 1e15, used in place of
+ *    `exprMaxVal()` and `exprMinVal()` in most places.
+ *  - Support for range analysis extensions removed for simplicity.
+ *  - Additional predicates have been added to check for non-zero values, and guards
+ *    against values equalling zero.
+ *  - Division by a constant value has been added as a supported operations. Division
+ *    is always widened, as support for division introduces examples of significantly
+ *    longer chains of dependent expressions than merely addition and multiplication.
+ *    These long chains can introduce exponential growth in the number of candidate
+ *    bounds, even without recursive binary operations, so widening is always applied.
+ *  - Division operations where the range of the denominator includes zero (and its
+ *    not guarded to be non-zero) and produce infinite upper and/or lower bounds.
+ *  - Support for monotonically increasing and decreasing math functions has been
+ *    added, including `log`, `exp`, `asin`, `atan`, `sinh`, and `sqrt`. If a math
+ *    function increases or decreases monotonically, then the lower or upper bound of
+ *    its input can be used to compute the lower or upper bound of the function call.
+ *    Not all math functions increase or decrease monotonically.
+ */
+module RestrictedRangeAnalysis {
+  import cpp
+  private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils as Util
+  import semmle.code.cpp.rangeanalysis.RangeSSA
+  import SimpleRangeAnalysisCached
+  private import semmle.code.cpp.rangeanalysis.NanAnalysis
+
+  float largeValue() { result = 1000000000000000.0 }
+
+  /**
+   * This fixed set of lower bounds is used when the lower bounds of an
+   * expression are recursively defined. The inferred lower bound is rounded
+   * down to the nearest lower bound in the fixed set. This restricts the
+   * height of the lattice, which prevents the analysis from exploding.
+   *
+   * Note: these bounds were chosen fairly arbitrarily. Feel free to add more
+   * bounds to the set if it helps on specific examples and does not make
+   * performance dramatically worse on large codebases, such as libreoffice.
+   */
+  private float wideningLowerBounds(ArithmeticType t) {
+    result = 2.0 or
+    result = 1.0 or
+    result = 0.0 or
+    result = -1.0 or
+    result = -2.0 or
+    result = -8.0 or
+    result = -16.0 or
+    result = -128.0 or
+    result = -256.0 or
+    result = -32768.0 or
+    result = -65536.0 or
+    result = -largeValue() or
+    result = Util::typeLowerBound(t)
+    //result = max(float v | v = Util::typeLowerBound(t) or v = -largeValue())
+  }
+
+  /** See comment for `wideningLowerBounds`, above. */
+  private float wideningUpperBounds(ArithmeticType t) {
+    result = -2.0 or
+    result = -1.0 or
+    result = 0.0 or
+    result = 1.0 or
+    result = 2.0 or
+    result = 7.0 or
+    result = 15.0 or
+    result = 127.0 or
+    result = 255.0 or
+    result = 32767.0 or
+    result = 65535.0 or
+    result = largeValue() or
+    result = Util::typeUpperBound(t)
+    //result = min(float v | v = Util::typeLowerBound(t) or v = largeValue())
+  }
+
+  /**
+   * Gets the value of the expression `e`, if it is a constant.
+   * This predicate also handles the case of constant variables initialized in different
+   * compilation units, which doesn't necessarily have a getValue() result from the extractor.
+   */
+  private string getValue(Expr e) {
+    if exists(e.getValue())
+    then result = e.getValue()
+    else
+      /*
+       * It should be safe to propagate the initialization value to a variable if:
+       * The type of v is const, and
+       * The type of v is not volatile, and
+       * Either:
+       *   v is a local/global variable, or
+       *   v is a static member variable
+       */
+
+      exists(VariableAccess access, StaticStorageDurationVariable v |
+        not v.getUnderlyingType().isVolatile() and
+        v.getUnderlyingType().isConst() and
+        e = access and
+        v = access.getTarget() and
+        result = getValue(v.getAnAssignedValue())
+      )
+  }
+
+  private float varMaxVal(Variable v) {
+    result = min(float f | f = Util::varMaxVal(v) or f = largeValue())
+  }
+
+  private float varMinVal(Variable v) {
+    result = max(float f | f = Util::varMinVal(v) or f = -largeValue())
+  }
+
+  private float exprMaxVal(Expr e) {
+    result = min(float f | f = Util::exprMaxVal(e) or f = largeValue())
+  }
+
+  private float exprMinVal(Expr e) {
+    result = max(float f | f = Util::exprMinVal(e) or f = -largeValue())
+  }
+
+  /**
+   * A bitwise `&` expression in which both operands are unsigned, or are effectively
+   * unsigned due to being a non-negative constant.
+   */
+  private class UnsignedBitwiseAndExpr extends BitwiseAndExpr {
+    UnsignedBitwiseAndExpr() {
+      (
+        this.getLeftOperand()
+            .getFullyConverted()
+            .getType()
+            .getUnderlyingType()
+            .(IntegralType)
+            .isUnsigned() or
+        getValue(this.getLeftOperand().getFullyConverted()).toInt() >= 0
+      ) and
+      (
+        this.getRightOperand()
+            .getFullyConverted()
+            .getType()
+            .getUnderlyingType()
+            .(IntegralType)
+            .isUnsigned() or
+        getValue(this.getRightOperand().getFullyConverted()).toInt() >= 0
+      )
+    }
+  }
+
+  /**
+   * Gets the floor of `v`, with additional logic to work around issues with
+   * large numbers.
+   */
+  bindingset[v]
+  float safeFloor(float v) {
+    // return the floor of v
+    v.abs() < 2.pow(31) and
+    result = v.floor()
+    or
+    // `floor()` doesn't work correctly on large numbers (since it returns an integer),
+    // so fall back to unrounded numbers at this scale.
+    not v.abs() < 2.pow(31) and
+    result = v
+  }
+
+  /** A `MulExpr` where exactly one operand is constant. */
+  private class MulByConstantExpr extends MulExpr {
+    float constant;
+    Expr operand;
+
+    MulByConstantExpr() {
+      exists(Expr constantExpr |
+        this.hasOperands(constantExpr, operand) and
+        constant = getValue(constantExpr.getFullyConverted()).toFloat() and
+        not exists(getValue(operand.getFullyConverted()).toFloat())
+      )
+    }
+
+    /** Gets the value of the constant operand. */
+    float getConstant() { result = constant }
+
+    /** Gets the non-constant operand. */
+    Expr getOperand() { result = operand }
+  }
+
+  private class UnsignedMulExpr extends MulExpr {
+    UnsignedMulExpr() {
+      this.getType().(IntegralType).isUnsigned() and
+      // Avoid overlap. It should be slightly cheaper to analyze
+      // `MulByConstantExpr`.
+      not this instanceof MulByConstantExpr
+    }
+  }
+
+  /**
+   * Holds if `expr` is effectively a multiplication of `operand` with the
+   * positive constant `positive`.
+   */
+  private predicate effectivelyMultipliesByPositive(Expr expr, Expr operand, float positive) {
+    operand = expr.(MulByConstantExpr).getOperand() and
+    positive = expr.(MulByConstantExpr).getConstant() and
+    positive >= 0.0 // includes positive zero
+    or
+    operand = expr.(UnaryPlusExpr).getOperand() and
+    positive = 1.0
+    or
+    operand = expr.(CommaExpr).getRightOperand() and
+    positive = 1.0
+    or
+    operand = expr.(StmtExpr).getResultExpr() and
+    positive = 1.0
+  }
+
+  /**
+   * Holds if `expr` is effectively a multiplication of `operand` with the
+   * negative constant `negative`.
+   */
+  private predicate effectivelyMultipliesByNegative(Expr expr, Expr operand, float negative) {
+    operand = expr.(MulByConstantExpr).getOperand() and
+    negative = expr.(MulByConstantExpr).getConstant() and
+    negative < 0.0 // includes negative zero
+    or
+    operand = expr.(UnaryMinusExpr).getOperand() and
+    negative = -1.0
+  }
+
+  private class AssignMulByConstantExpr extends AssignMulExpr {
+    float constant;
+
+    AssignMulByConstantExpr() {
+      constant = getValue(this.getRValue().getFullyConverted()).toFloat()
+    }
+
+    float getConstant() { result = constant }
+  }
+
+  private class AssignMulByPositiveConstantExpr extends AssignMulByConstantExpr {
+    AssignMulByPositiveConstantExpr() { constant >= 0.0 }
+  }
+
+  private class AssignMulByNegativeConstantExpr extends AssignMulByConstantExpr {
+    AssignMulByNegativeConstantExpr() { constant < 0.0 }
+  }
+
+  private class UnsignedAssignMulExpr extends AssignMulExpr {
+    UnsignedAssignMulExpr() {
+      this.getType().(IntegralType).isUnsigned() and
+      // Avoid overlap. It should be slightly cheaper to analyze
+      // `AssignMulByConstantExpr`.
+      not this instanceof AssignMulByConstantExpr
+    }
+  }
+
+  /**
+   * Holds if `expr` is effectively a division of `operand` with the
+   * positive constant `positive`.
+   */
+  private predicate dividesByPositive(DivExpr expr, Expr operand, float positive) {
+    operand = expr.(DivExpr).getLeftOperand() and
+    positive = expr.(DivExpr).getRightOperand().getValue().toFloat() and
+    positive > 0.0 // doesn't include zero
+  }
+
+  /**
+   * Holds if `expr` is effectively a division of `operand` with the
+   * negative constant `negative`.
+   */
+  private predicate dividesByNegative(Expr expr, Expr operand, float negative) {
+    operand = expr.(DivExpr).getLeftOperand() and
+    negative = getValue(expr.(DivExpr).getRightOperand().getFullyConverted()).toFloat() and
+    negative < 0.0 // doesn't include zero
+  }
+
+  /**
+   * Holds if `expr` may divide by zero. Excludes dividing a constant zero divided by zero,
+   * which produces NaN instead of an infinite value.
+   */
+  predicate dividesNonzeroByZero(Expr expr) {
+    exists(Expr divisor, Expr numerator |
+      divisor = expr.(DivExpr).getRightOperand() and
+      numerator = expr.(DivExpr).getLeftOperand() and
+      getTruncatedLowerBounds(divisor) <= 0.0 and
+      getTruncatedUpperBounds(divisor) >= 0.0 and
+      not isCheckedNotZero(divisor) and
+      not getValue(numerator).toFloat() = 0.0
+    )
+  }
+
+  bindingset[name]
+  Function getMathVariants(string name) {
+    result.hasGlobalOrStdName([name, name + "f", name + "l"])
+  }
+
+  /**
+   * New support added for mathematical functions that either monotonically increase, or decrease,
+   * or that have a known lower or upper bound.
+   *
+   * For instance, log(x) monotonically increases over x, and acos(x) monotonically decreases,
+   * while sin(x) has a known output range of -1 to 1.
+   *
+   * `pow` is especially common so minimal work is done to support that here as well. `pow(c, x)`
+   * monotonically increases or decreases over `x` if `c` is a constant, though the reverse is not
+   * true except in special cases.
+   */
+  newtype TSupportedMathFunctionCall =
+    /* A monotonically increasing function call. `extra` is a constant for `pow(x, c)`. */
+    TMonotonicIncrease(FunctionCall fc, Expr input, float extra) {
+      // Note: Codeql has no default implementation in codeql for exp2, atanh, acosh, asinh, or
+      // log1p so we haven't taken the time to support them yet.
+      fc.getTarget() =
+        getMathVariants(["log", "log2", "log10", "exp", "asin", "atan", "sinh", "sqrt"]) and
+      input = fc.getArgument(0) and
+      extra = 0.0
+      or
+      // Notes: pow is monotonic if the base argument is constant, increasing if the base is greater
+      // than 1 or between -1 and 0, and decreasing otherwise. A constant power is monotonic over the
+      // base in the positive or negative domain, but distinguishing those separately can introduce
+      // non-monotonic recursion errors.
+      fc.getTarget() = getMathVariants("pow") and
+      extra = fc.getArgument(0).getValue().toFloat() and
+      (
+        extra > 1.0
+        or
+        extra < 0.0 and extra > -1.0
+      ) and
+      input = fc.getArgument(1)
+    } or
+    /* A monotonically decreasing function call. `extra` is a constant for `pow(x, c)`. */
+    TMonotonicDecrease(FunctionCall fc, Expr input, float extra) {
+      fc.getTarget() = getMathVariants(["acos"]) and
+      input = fc.getArgument(0) and
+      extra = 0.0
+      or
+      fc.getTarget() = getMathVariants("pow") and
+      extra = fc.getArgument(0).getValue().toFloat() and
+      (
+        extra < -1.0
+        or
+        extra > 0.0 and extra < 1.0
+      ) and
+      input = fc.getArgument(1)
+    } or
+    /* A non-mononotic function call with a known lower bound. */
+    TNonMonotonicLowerBound(FunctionCall fc, float lb) {
+      fc.getTarget() = getMathVariants("cosh") and
+      lb = 1.0
+      or
+      fc.getTarget() = getMathVariants(["cos", "sin"]) and
+      lb = -1.0
+    } or
+    /* A non-mononotic function call with a known upper bound. */
+    TNonMonotonicUpperBound(FunctionCall fc, float lb) {
+      fc.getTarget() = getMathVariants(["cos", "sin"]) and
+      lb = 1.0
+    }
+
+  /**
+   * A function call that is supported by range analysis.
+   */
+  class SupportedFunctionCall extends TSupportedMathFunctionCall {
+    string toString() {
+      exists(FunctionCall fc |
+        this = TMonotonicIncrease(fc, _, _) and
+        result = "Monotonic increase " + fc.getTarget().getName()
+        or
+        this = TMonotonicDecrease(fc, _, _) and
+        result = "Monotonic decrease " + fc.getTarget().getName()
+        or
+        this = TNonMonotonicLowerBound(fc, _) and
+        result = "Nonmonotonic lower bound " + fc.getTarget().getName()
+        or
+        this = TNonMonotonicUpperBound(fc, _) and
+        result = "Nonmonotonic upper bound " + fc.getTarget().getName()
+      )
+    }
+
+    /** Get the function call node this algebraic type corresponds to. */
+    FunctionCall getFunctionCall() {
+      this = TMonotonicIncrease(result, _, _)
+      or
+      this = TMonotonicDecrease(result, _, _)
+      or
+      this = TNonMonotonicLowerBound(result, _)
+      or
+      this = TNonMonotonicUpperBound(result, _)
+    }
+
+    /** Get the function name (`sin`, `pow`, etc.) without the `l` or `f` suffix. */
+    bindingset[this, result]
+    string getBaseFunctionName() { getMathVariants(result) = getFunctionCall().getTarget() }
+
+    /**
+     * Compute a result bound based on an input value and an extra constant value.
+     *
+     * The functions `getUpperBound()` and `getLowerBound()` automatically handle the differences
+     * between monotonically increasing and decreasing functions, and provide the input value. The
+     * `extra` float exists to support `pow(x, c)` for the constant `c`, otherwise it is `0.0`.
+     */
+    bindingset[value, extra, this]
+    float compute(float value, float extra) {
+      exists(string name | name = getBaseFunctionName() |
+        name = "log" and
+        result = value.log()
+        or
+        name = "log2" and
+        result = value.log2()
+        or
+        name = "log10" and
+        result = value.log10()
+        or
+        name = "exp" and
+        result = value.exp()
+        or
+        name = "asin" and
+        result = value.asin()
+        or
+        name = "atan" and
+        result = value.atan()
+        or
+        name = "acos" and
+        result = value.acos()
+        or
+        name = "sinh" and
+        result = value.sinh()
+        or
+        name = "sqrt" and
+        result = value.sqrt()
+        or
+        name = "pow" and
+        result = extra.pow(value)
+      )
+    }
+
+    /**
+     * Get the lower bound of this function, based on its fixed range (if it has one) or based on
+     * the lower or upper bound of its input, if it is a monotonically increasing or decreasing
+     * function.
+     */
+    float getLowerBound() {
+      this = TNonMonotonicLowerBound(_, result)
+      or
+      exists(Expr expr, float bound, float extra |
+        (
+          this = TMonotonicIncrease(_, expr, extra) and
+          bound = getFullyConvertedLowerBounds(expr)
+          or
+          this = TMonotonicDecrease(_, expr, extra) and
+          bound = getFullyConvertedUpperBounds(expr)
+        ) and
+        result = compute(bound, extra)
+      )
+    }
+
+    /**
+     * Get the lower bound of this function, based on its fixed range (if it has one) or based on
+     * the lower or upper bound of its input, if it is a monotonically increasing or decreasing
+     * function.
+     */
+    float getUpperBound() {
+      this = TNonMonotonicUpperBound(_, result)
+      or
+      exists(Expr expr, float bound, float extra |
+        (
+          this = TMonotonicIncrease(_, expr, extra) and
+          bound = getFullyConvertedUpperBounds(expr)
+          or
+          this = TMonotonicDecrease(_, expr, extra) and
+          bound = getFullyConvertedLowerBounds(expr)
+        ) and
+        result = compute(bound, extra)
+      )
+    }
+  }
+
+  predicate supportedMathFunction(FunctionCall fc) {
+    exists(SupportedFunctionCall sfc | sfc.getFunctionCall() = fc)
+  }
+
+  /**
+   * Holds if `expr` is checked with a guard to not be zero.
+   *
+   * Since our range analysis only tracks an upper and lower bound, that means if a variable has
+   * range [-10, 10], its range includes zero. In the body of an if statement that checks it's not
+   * equal to zero, we cannot update the range to reflect that as the upper and lower bounds are
+   * not changed. This problem is not the case for gt, lt, gte, lte, or ==, as these can be used to
+   * create a new subset range that does not include zero.
+   *
+   * It is important to know if an expr may be zero to avoid division by zero creating infinities.
+   */
+  predicate isCheckedNotZero(Expr expr) {
+    exists(RangeSsaDefinition def, StackVariable v, VariableAccess guardVa, Expr guard |
+      // This is copied from getGuardedUpperBound, which says its only an approximation. This is
+      // indeed wrong in many cases.
+      def.isGuardPhi(v, guardVa, guard, _) and
+      exists(unique(BasicBlock b | b = def.(BasicBlock).getAPredecessor())) and
+      expr = def.getAUse(v) and
+      isNEPhi(v, def, guardVa, 0)
+    )
+    or
+    guardedHashConsNotEqualZero(expr)
+  }
+
+  predicate guardedHashConsNotEqualZero(Expr e) {
+    /* Note Boolean cmpEq, false means cmpNeq */
+    exists(Expr check, Expr val, int valVal, GuardCondition guard, boolean cmpEq |
+      hashCons(check) = hashCons(e) and
+      valVal = getValue(val).toFloat() and
+      guard.controls(e.getBasicBlock(), cmpEq) and
+      (
+        guard.comparesEq(check, val, -valVal, false, cmpEq) or
+        guard.comparesEq(val, check, -valVal, false, cmpEq)
+      )
+    )
+  }
+
+  /** Set of expressions which we know how to analyze. */
+  predicate analyzableExpr(Expr e) {
+    // The type of the expression must be arithmetic. We reuse the logic in
+    // `exprMinVal` to check this.
+    exists(Util::exprMinVal(e)) and
+    (
+      exists(getValue(e).toFloat())
+      or
+      effectivelyMultipliesByPositive(e, _, _)
+      or
+      effectivelyMultipliesByNegative(e, _, _)
+      or
+      dividesByPositive(e, _, _)
+      or
+      dividesByNegative(e, _, _)
+      or
+      // Introduces non-monotonic recursion. However, analysis mostly works with this
+      // commented out.
+      // or
+      // dividesNonzeroByZero(e)
+      e instanceof DivExpr // TODO: confirm this is OK
+      or
+      supportedMathFunction(e)
+      or
+      e instanceof MinExpr
+      or
+      e instanceof MaxExpr
+      or
+      e instanceof ConditionalExpr
+      or
+      e instanceof AddExpr
+      or
+      e instanceof SubExpr
+      or
+      e instanceof UnsignedMulExpr
+      or
+      e instanceof AssignExpr
+      or
+      e instanceof AssignAddExpr
+      or
+      e instanceof AssignSubExpr
+      or
+      e instanceof UnsignedAssignMulExpr
+      or
+      e instanceof AssignMulByConstantExpr
+      or
+      e instanceof CrementOperation
+      or
+      e instanceof RemExpr
+      or
+      // A conversion is analyzable, provided that its child has an arithmetic
+      // type. (Sometimes the child is a reference type, and so does not get
+      // any bounds.) Rather than checking whether the type of the child is
+      // arithmetic, we reuse the logic that is already encoded in
+      // `exprMinVal`.
+      exists(Util::exprMinVal(e.(Conversion).getExpr()))
+      or
+      // Also allow variable accesses, provided that they have SSA
+      // information.
+      exists(RangeSsaDefinition def | e = def.getAUse(_))
+      or
+      e instanceof UnsignedBitwiseAndExpr
+      or
+      // `>>` by a constant
+      exists(getValue(e.(RShiftExpr).getRightOperand()))
+    )
+  }
+
+  /**
+   * Set of definitions that this definition depends on. The transitive
+   * closure of this relation is used to detect definitions which are
+   * recursively defined, so that we can prevent the analysis from exploding.
+   *
+   * The structure of `defDependsOnDef` and its helper predicates matches the
+   * structure of `getDefLowerBoundsImpl` and
+   * `getDefUpperBoundsImpl`. Therefore, if changes are made to the structure
+   * of the main analysis algorithm then matching changes need to be made
+   * here.
+   */
+  private predicate defDependsOnDef(
+    RangeSsaDefinition def, StackVariable v, RangeSsaDefinition srcDef, StackVariable srcVar
+  ) {
+    // Definitions with a defining value.
+    exists(Expr expr | assignmentDef(def, v, expr) | exprDependsOnDef(expr, srcDef, srcVar))
+    or
+    // Assignment operations with a defining value
+    exists(AssignOperation assignOp |
+      analyzableExpr(assignOp) and
+      def = assignOp and
+      def.getAVariable() = v and
+      exprDependsOnDef(assignOp, srcDef, srcVar)
+    )
+    or
+    exists(CrementOperation crem |
+      def = crem and
+      def.getAVariable() = v and
+      exprDependsOnDef(crem.getOperand(), srcDef, srcVar)
+    )
+    or
+    // Phi nodes.
+    phiDependsOnDef(def, v, srcDef, srcVar)
+  }
+
+  /**
+   * Helper predicate for `defDependsOnDef`. This predicate matches
+   * the structure of `getLowerBoundsImpl` and `getUpperBoundsImpl`.
+   */
+  private predicate exprDependsOnDef(Expr e, RangeSsaDefinition srcDef, StackVariable srcVar) {
+    exists(Expr operand |
+      effectivelyMultipliesByNegative(e, operand, _) and
+      exprDependsOnDef(operand, srcDef, srcVar)
+    )
+    or
+    exists(Expr operand |
+      effectivelyMultipliesByPositive(e, operand, _) and
+      exprDependsOnDef(operand, srcDef, srcVar)
+    )
+    or
+    exists(Expr operand |
+      (dividesByPositive(e, operand, _) or dividesByNegative(e, operand, _)) and
+      exprDependsOnDef(operand, srcDef, srcVar)
+    )
+    or
+    exists(DivExpr div | div = e | exprDependsOnDef(div.getAnOperand(), srcDef, srcVar))
+    or
+    exists(MinExpr minExpr | e = minExpr | exprDependsOnDef(minExpr.getAnOperand(), srcDef, srcVar))
+    or
+    exists(MaxExpr maxExpr | e = maxExpr | exprDependsOnDef(maxExpr.getAnOperand(), srcDef, srcVar))
+    or
+    exists(ConditionalExpr condExpr | e = condExpr |
+      exprDependsOnDef(condExpr.getAnOperand(), srcDef, srcVar)
+    )
+    or
+    exists(AddExpr addExpr | e = addExpr | exprDependsOnDef(addExpr.getAnOperand(), srcDef, srcVar))
+    or
+    exists(SubExpr subExpr | e = subExpr | exprDependsOnDef(subExpr.getAnOperand(), srcDef, srcVar))
+    or
+    exists(UnsignedMulExpr mulExpr | e = mulExpr |
+      exprDependsOnDef(mulExpr.getAnOperand(), srcDef, srcVar)
+    )
+    or
+    exists(AssignExpr addExpr | e = addExpr | exprDependsOnDef(addExpr.getRValue(), srcDef, srcVar))
+    or
+    exists(AssignAddExpr addExpr | e = addExpr |
+      exprDependsOnDef(addExpr.getAnOperand(), srcDef, srcVar)
+    )
+    or
+    exists(AssignSubExpr subExpr | e = subExpr |
+      exprDependsOnDef(subExpr.getAnOperand(), srcDef, srcVar)
+    )
+    or
+    exists(UnsignedAssignMulExpr mulExpr | e = mulExpr |
+      exprDependsOnDef(mulExpr.getAnOperand(), srcDef, srcVar)
+    )
+    or
+    exists(AssignMulByConstantExpr mulExpr | e = mulExpr |
+      exprDependsOnDef(mulExpr.getLValue(), srcDef, srcVar)
+    )
+    or
+    exists(CrementOperation crementExpr | e = crementExpr |
+      exprDependsOnDef(crementExpr.getOperand(), srcDef, srcVar)
+    )
+    or
+    exists(RemExpr remExpr | e = remExpr | exprDependsOnDef(remExpr.getAnOperand(), srcDef, srcVar))
+    or
+    exists(Conversion convExpr | e = convExpr |
+      exprDependsOnDef(convExpr.getExpr(), srcDef, srcVar)
+    )
+    or
+    // unsigned `&`
+    exists(UnsignedBitwiseAndExpr andExpr |
+      andExpr = e and
+      exprDependsOnDef(andExpr.getAnOperand(), srcDef, srcVar)
+    )
+    or
+    // `>>` by a constant
+    exists(RShiftExpr rs |
+      rs = e and
+      exists(getValue(rs.getRightOperand())) and
+      exprDependsOnDef(rs.getLeftOperand(), srcDef, srcVar)
+    )
+    or
+    e = srcDef.getAUse(srcVar)
+  }
+
+  /**
+   * Helper predicate for `defDependsOnDef`. This predicate matches
+   * the structure of `getPhiLowerBounds` and `getPhiUpperBounds`.
+   */
+  private predicate phiDependsOnDef(
+    RangeSsaDefinition phi, StackVariable v, RangeSsaDefinition srcDef, StackVariable srcVar
+  ) {
+    exists(VariableAccess access, Expr guard | phi.isGuardPhi(v, access, guard, _) |
+      exprDependsOnDef(guard.(ComparisonOperation).getAnOperand(), srcDef, srcVar) or
+      exprDependsOnDef(access, srcDef, srcVar)
+    )
+    or
+    srcDef = phi.getAPhiInput(v) and srcVar = v
+  }
+
+  /** The transitive closure of `defDependsOnDef`. */
+  private predicate defDependsOnDefTransitively(
+    RangeSsaDefinition def, StackVariable v, RangeSsaDefinition srcDef, StackVariable srcVar
+  ) {
+    defDependsOnDef(def, v, srcDef, srcVar)
+    or
+    exists(RangeSsaDefinition midDef, StackVariable midVar |
+      defDependsOnDef(def, v, midDef, midVar)
+    |
+      defDependsOnDefTransitively(midDef, midVar, srcDef, srcVar)
+    )
+  }
+
+  /** The set of definitions that depend recursively on themselves. */
+  private predicate isRecursiveDef(RangeSsaDefinition def, StackVariable v) {
+    defDependsOnDefTransitively(def, v, def, v)
+  }
+
+  /**
+   * Holds if the bounds of `e` depend on a recursive definition, meaning that
+   * `e` is likely to have many candidate bounds during the main recursion.
+   */
+  private predicate isRecursiveExpr(Expr e) {
+    exists(RangeSsaDefinition def, StackVariable v | exprDependsOnDef(e, def, v) |
+      isRecursiveDef(def, v)
+    )
+  }
+
+  /**
+   * Holds if `binop` is a binary operation that's likely to be assigned a
+   * quadratic (or more) number of candidate bounds during the analysis. This can
+   * happen when two conditions are satisfied:
+   * 1. It is likely there are many more candidate bounds for `binop` than for
+   *    its operands. For example, the number of candidate bounds for `x + y`,
+   *    denoted here nbounds(`x + y`), will be O(nbounds(`x`) * nbounds(`y`)).
+   *    In contrast, nbounds(`b ? x : y`) is only O(nbounds(`x`) + nbounds(`y`)).
+   * 2. Both operands of `binop` are recursively determined and are therefore
+   *    likely to have a large number of candidate bounds.
+   */
+  private predicate isRecursiveBinary(BinaryOperation binop) {
+    (
+      binop instanceof UnsignedMulExpr
+      or
+      binop instanceof AddExpr
+      or
+      binop instanceof SubExpr
+    ) and
+    isRecursiveExpr(binop.getLeftOperand()) and
+    isRecursiveExpr(binop.getRightOperand())
+  }
+
+  private predicate applyWideningToBinary(BinaryOperation op) {
+    // Original behavior:
+    isRecursiveBinary(op)
+    or
+    // As we added support for DivExpr, we found cases of combinatorial explosion that are not
+    // caused by recursion. Given expr `x` that depends on a phi node that has evaluated y unique
+    // values, `x + x` will in the worst case evaluate to y^2 unique values, even if `x` is not
+    // recursive. By adding support for division, we have revealed certain pathological cases in
+    // open source code, for instance `posix_time_from_utc` from boringssl. We can reduce this
+    // greatly by widening, and targeting division effectively reduces the chains of evaluations
+    // that cause this issue while preserving the original behavior.
+    //
+    // There is also a set of functions intended to estimate the combinations of phi nodes each
+    // expression depends on, which could be used to accurately widen only expensive nodes. However,
+    // that estimation is more involved than it may seem, and hasn't yet resulted in a net
+    // improvement. See `estimatedPhiCombinationsExpr` and `estimatedPhiCombinationsDef`.
+    //
+    // This approach currently has the best performance.
+    op instanceof DivExpr
+  }
+
+  /**
+   * Recursively scan this expr to see how many phi nodes it depends on. Binary expressions
+   * induce a combination effect, so `a + b` where `a` depends on 3 phi nodes and `b` depends on 4
+   * will induce 3*4 = 12 phi node combinations.
+   *
+   * This currently requires additional optimization to be useful in practice.
+   */
+  int estimatedPhiCombinationsExpr(Expr expr) {
+    if isRecursiveExpr(expr)
+    then
+      // Assume 10 values were computed to analyze recursive expressions.
+      result = 10
+    else (
+      exists(RangeSsaDefinition def, StackVariable v | expr = def.getAUse(v) |
+        def.isPhiNode(v) and
+        result = estimatedPhiCombinationsDef(def, v)
+      )
+      or
+      exists(BinaryOperation binop |
+        binop = expr and
+        result =
+          estimatedPhiCombinationsExpr(binop.getLeftOperand()) *
+            estimatedPhiCombinationsExpr(binop.getRightOperand())
+      )
+      or
+      not expr instanceof BinaryOperation and
+      exists(RangeSsaDefinition def, StackVariable v | exprDependsOnDef(expr, def, v) |
+        result = estimatedPhiCombinationsDef(def, v)
+      )
+      or
+      not expr instanceof BinaryOperation and
+      not exprDependsOnDef(expr, _, _) and
+      result = 1
+    )
+  }
+
+  /**
+   * Recursively scan this def to see how many phi nodes it depends on.
+   *
+   * If this def is a phi node, it sums its downstream cost and adds one to account for itself,
+   * which is not exactly correct.
+   *
+   * This def may also be a crement expression (not currently supported), or an assign expr
+   * (currently not supported), or an unanalyzable expression which is the root of the recursion
+   * and given a value of 1.
+   */
+  language[monotonicAggregates]
+  int estimatedPhiCombinationsDef(RangeSsaDefinition def, StackVariable v) {
+    if isRecursiveDef(def, v)
+    then
+      // Assume 10 values were computed to analyze recursive expressions.
+      result = 10
+    else (
+      if def.isPhiNode(v)
+      then
+        exists(Expr e | e = def.getAUse(v) |
+          result =
+            1 +
+              sum(RangeSsaDefinition srcDef |
+                srcDef = def.getAPhiInput(v)
+              |
+                estimatedPhiCombinationsDef(srcDef, v)
+              )
+        )
+      else (
+        exists(Expr expr | assignmentDef(def, v, expr) |
+          result = estimatedPhiCombinationsExpr(expr)
+        )
+        or
+        v = def.getAVariable() and
+        not assignmentDef(def, v, _) and
+        result = 1
+      )
+    )
+  }
+
+  /**
+   * We distinguish 3 kinds of RangeSsaDefinition:
+   *
+   * 1. Definitions with a defining value.
+   *    For example: x = y+3 is a definition of x with defining value y+3.
+   *
+   * 2. Phi nodes: x3 = phi(x0,x1,x2)
+   *
+   * 3. Unanalyzable definitions.
+   *    For example: a parameter is unanalyzable because we know nothing
+   *    about its value. We assign these range [-largeValue(), largeValue()]
+   *
+   * This predicate finds all the definitions in the first set.
+   */
+  private predicate assignmentDef(RangeSsaDefinition def, StackVariable v, Expr expr) {
+    Util::getVariableRangeType(v) instanceof ArithmeticType and
+    (
+      def = v.getInitializer().getExpr() and def = expr
+      or
+      exists(AssignExpr assign |
+        def = assign and
+        assign.getLValue() = v.getAnAccess() and
+        expr = assign.getRValue()
+      )
+    )
+  }
+
+  /** See comment above assignmentDef. */
+  private predicate analyzableDef(RangeSsaDefinition def, StackVariable v) {
+    assignmentDef(def, v, _)
+    or
+    analyzableExpr(def.(AssignOperation)) and
+    v = def.getAVariable()
+    or
+    analyzableExpr(def.(CrementOperation)) and
+    v = def.getAVariable()
+    or
+    phiDependsOnDef(def, v, _, _)
+  }
+
+  predicate canBoundExpr(Expr e) {
+    exists(RangeSsaDefinition def, StackVariable v | e = def.getAUse(v) | analyzableDef(def, v))
+    or
+    analyzableExpr(e)
+    or
+    exists(getGuardedUpperBound(e))
+    or
+    lowerBoundFromGuard(e, _, _, _)
+  }
+
+  /**
+   * Computes a normal form of `x` where -0.0 has changed to +0.0. This can be
+   * needed on the lesser side of a floating-point comparison or on both sides of
+   * a floating point equality because QL does not follow IEEE in floating-point
+   * comparisons but instead defines -0.0 to be less than and distinct from 0.0.
+   */
+  bindingset[x]
+  private float normalizeFloatUp(float x) { result = x + 0.0 }
+
+  /**
+   * Computes `x + y`, rounded towards +Inf. This is the general case where both
+   * `x` and `y` may be large numbers.
+   */
+  bindingset[x, y]
+  private float addRoundingUp(float x, float y) {
+    if normalizeFloatUp((x + y) - x) < y or normalizeFloatUp((x + y) - y) < x
+    then result = (x + y).nextUp()
+    else result = (x + y)
+  }
+
+  /**
+   * Computes `x + y`, rounded towards -Inf. This is the general case where both
+   * `x` and `y` may be large numbers.
+   */
+  bindingset[x, y]
+  private float addRoundingDown(float x, float y) {
+    if (x + y) - x > normalizeFloatUp(y) or (x + y) - y > normalizeFloatUp(x)
+    then result = (x + y).nextDown()
+    else result = (x + y)
+  }
+
+  /**
+   * Computes `x + small`, rounded towards +Inf, where `small` is a small
+   * constant.
+   */
+  bindingset[x, small]
+  private float addRoundingUpSmall(float x, float small) {
+    if (x + small) - x < small then result = (x + small).nextUp() else result = (x + small)
+  }
+
+  /**
+   * Computes `x + small`, rounded towards -Inf, where `small` is a small
+   * constant.
+   */
+  bindingset[x, small]
+  private float addRoundingDownSmall(float x, float small) {
+    if (x + small) - x > small then result = (x + small).nextDown() else result = (x + small)
+  }
+
+  private predicate lowerBoundableExpr(Expr expr) {
+    (analyzableExpr(expr) or dividesNonzeroByZero(expr)) and
+    getUpperBoundsImpl(expr) <= Util::exprMaxVal(expr) and
+    not exists(getValue(expr).toFloat())
+  }
+
+  /**
+   * Gets the lower bounds of the expression.
+   *
+   * Most of the work of computing the lower bounds is done by
+   * `getLowerBoundsImpl`. However, the lower bounds computed by
+   * `getLowerBoundsImpl` may not be representable by the result type of the
+   * expression. For example, if `x` and `y` are of type `int32` and each
+   * have lower bound -2147483648, then getLowerBoundsImpl` will compute a
+   * lower bound -4294967296 for the expression `x+y`, even though
+   * -4294967296 cannot be represented as an `int32`. Such unrepresentable
+   * bounds are replaced with `exprMinVal(expr)`. This predicate also adds
+   * `exprMinVal(expr)` as a lower bound if the expression might overflow
+   * positively, or if it is unanalyzable.
+   *
+   * Note: most callers should use `getFullyConvertedLowerBounds` rather than
+   * this predicate.
+   */
+  private float getTruncatedLowerBounds(Expr expr) {
+    // If the expression evaluates to a constant, then there is no
+    // need to call getLowerBoundsImpl.
+    analyzableExpr(expr) and
+    result = getValue(expr).toFloat()
+    or
+    // Some of the bounds computed by getLowerBoundsImpl might
+    // overflow, so we replace invalid bounds with exprMinVal.
+    exists(float newLB | newLB = normalizeFloatUp(getLowerBoundsImpl(expr)) |
+      if Util::exprMinVal(expr) <= newLB and newLB <= Util::exprMaxVal(expr)
+      then
+        // Apply widening where we might get a combinatorial explosion.
+        if applyWideningToBinary(expr)
+        then
+          result =
+            max(float widenLB |
+              widenLB = wideningLowerBounds(expr.getUnspecifiedType()) and
+              not widenLB > newLB
+            )
+        else result = newLB
+      else result = Util::exprMinVal(expr)
+    ) and
+    lowerBoundableExpr(expr)
+    or
+    // The expression might overflow and wrap. If so, the
+    // lower bound is exprMinVal.
+    analyzableExpr(expr) and
+    exprMightOverflowPositively(expr) and
+    not result = getValue(expr).toFloat() and
+    result = Util::exprMinVal(expr)
+    or
+    // The expression is not analyzable, so its lower bound is
+    // unknown. Note that the call to exprMinVal restricts the
+    // expressions to just those with arithmetic types. There is no
+    // need to return results for non-arithmetic expressions.
+    not analyzableExpr(expr) and
+    result = exprMinVal(expr)
+  }
+
+  /**
+   * Gets the upper bounds of the expression.
+   *
+   * Most of the work of computing the upper bounds is done by
+   * `getUpperBoundsImpl`. However, the upper bounds computed by
+   * `getUpperBoundsImpl` may not be representable by the result type of the
+   * expression. For example, if `x` and `y` are of type `int32` and each
+   * have upper bound 2147483647, then getUpperBoundsImpl` will compute an
+   * upper bound 4294967294 for the expression `x+y`, even though 4294967294
+   * cannot be represented as an `int32`. Such unrepresentable bounds are
+   * replaced with `exprMaxVal(expr)`.  This predicate also adds
+   * `exprMaxVal(expr)` as an upper bound if the expression might overflow
+   * negatively, or if it is unanalyzable.
+   *
+   * Note: most callers should use `getFullyConvertedUpperBounds` rather than
+   * this predicate.
+   */
+  private float getTruncatedUpperBounds(Expr expr) {
+    (analyzableExpr(expr) or dividesNonzeroByZero(expr)) and
+    (
+      // If the expression evaluates to a constant, then there is no
+      // need to call getUpperBoundsImpl.
+      if
+        exists(getValue(expr).toFloat()) and
+        not getValue(expr) = "NaN"
+      then result = getValue(expr).toFloat()
+      else (
+        // Some of the bounds computed by `getUpperBoundsImpl`
+        // might overflow, so we replace invalid bounds with
+        // `exprMaxVal`.
+        exists(float newUB | newUB = normalizeFloatUp(getUpperBoundsImpl(expr)) |
+          if Util::exprMinVal(expr) <= newUB and newUB <= Util::exprMaxVal(expr)
+          then
+            // Apply widening where we might get a combinatorial explosion.
+            if applyWideningToBinary(expr)
+            then
+              result =
+                min(float widenUB |
+                  widenUB = wideningUpperBounds(expr.getUnspecifiedType()) and
+                  not widenUB < newUB
+                )
+            else result = newUB
+          else result = Util::exprMaxVal(expr)
+        )
+        or
+        // The expression might overflow negatively and wrap. If so,
+        // the upper bound is `exprMaxVal`.
+        exprMightOverflowNegatively(expr) and
+        result = Util::exprMaxVal(expr)
+      )
+    )
+    or
+    not analyzableExpr(expr) and
+    // The expression is not analyzable, so its upper bound is
+    // unknown. Note that the call to exprMaxVal restricts the
+    // expressions to just those with arithmetic types. There is no
+    // need to return results for non-arithmetic expressions.
+    result = exprMaxVal(expr)
+  }
+
+  /** Only to be called by `getTruncatedLowerBounds`. */
+  private float getLowerBoundsImpl(Expr expr) {
+    (
+      exists(Expr operand, float operandLow, float positive |
+        effectivelyMultipliesByPositive(expr, operand, positive) and
+        operandLow = getFullyConvertedLowerBounds(operand) and
+        result = positive * operandLow
+      )
+      or
+      exists(Expr operand, float operandHigh, float negative |
+        effectivelyMultipliesByNegative(expr, operand, negative) and
+        operandHigh = getFullyConvertedUpperBounds(operand) and
+        result = negative * operandHigh
+      )
+      or
+      exists(Expr operand, float operandLow, float positive |
+        dividesByPositive(expr, operand, positive) and
+        operandLow = getFullyConvertedLowerBounds(operand) and
+        result = operandLow / positive
+      )
+      or
+      exists(Expr operand, float operandLow, float negative |
+        dividesByNegative(expr, operand, negative) and
+        operandLow = getFullyConvertedUpperBounds(operand) and
+        result = operandLow / negative
+      )
+      or
+      exists(DivExpr div | expr = div |
+        dividesNonzeroByZero(expr) and
+        result = getFullyConvertedLowerBounds(div.getLeftOperand()) / 0
+      )
+      or
+      exists(SupportedFunctionCall sfc | sfc.getFunctionCall() = expr |
+        result = sfc.getLowerBound()
+      )
+      or
+      exists(MinExpr minExpr |
+        expr = minExpr and
+        // Return the union of the lower bounds from both children.
+        result = getFullyConvertedLowerBounds(minExpr.getAnOperand())
+      )
+      or
+      exists(MaxExpr maxExpr |
+        expr = maxExpr and
+        // Compute the cross product of the bounds from both children.  We are
+        // using this mathematical property:
+        //
+        //    max (minimum{X}, minimum{Y})
+        //  = minimum { max(x,y) | x in X, y in Y }
+        exists(float x, float y |
+          x = getFullyConvertedLowerBounds(maxExpr.getLeftOperand()) and
+          y = getFullyConvertedLowerBounds(maxExpr.getRightOperand()) and
+          if x >= y then result = x else result = y
+        )
+      )
+      or
+      // ConditionalExpr (true branch)
+      exists(ConditionalExpr condExpr |
+        expr = condExpr and
+        // Use `boolConversionUpperBound` to determine whether the condition
+        // might evaluate to `true`.
+        boolConversionUpperBound(condExpr.getCondition().getFullyConverted()) = 1 and
+        result = getFullyConvertedLowerBounds(condExpr.getThen())
+      )
+      or
+      // ConditionalExpr (false branch)
+      exists(ConditionalExpr condExpr |
+        expr = condExpr and
+        // Use `boolConversionLowerBound` to determine whether the condition
+        // might evaluate to `false`.
+        boolConversionLowerBound(condExpr.getCondition().getFullyConverted()) = 0 and
+        result = getFullyConvertedLowerBounds(condExpr.getElse())
+      )
+      or
+      exists(AddExpr addExpr, float xLow, float yLow |
+        expr = addExpr and
+        xLow = getFullyConvertedLowerBounds(addExpr.getLeftOperand()) and
+        yLow = getFullyConvertedLowerBounds(addExpr.getRightOperand()) and
+        result = addRoundingDown(xLow, yLow)
+      )
+      or
+      exists(SubExpr subExpr, float xLow, float yHigh |
+        expr = subExpr and
+        xLow = getFullyConvertedLowerBounds(subExpr.getLeftOperand()) and
+        yHigh = getFullyConvertedUpperBounds(subExpr.getRightOperand()) and
+        result = addRoundingDown(xLow, -yHigh)
+      )
+      or
+      exists(UnsignedMulExpr mulExpr, float xLow, float yLow |
+        expr = mulExpr and
+        xLow = getFullyConvertedLowerBounds(mulExpr.getLeftOperand()) and
+        yLow = getFullyConvertedLowerBounds(mulExpr.getRightOperand()) and
+        result = xLow * yLow
+      )
+      or
+      exists(AssignExpr assign |
+        expr = assign and
+        result = getFullyConvertedLowerBounds(assign.getRValue())
+      )
+      or
+      exists(AssignAddExpr addExpr, float xLow, float yLow |
+        expr = addExpr and
+        xLow = getFullyConvertedLowerBounds(addExpr.getLValue()) and
+        yLow = getFullyConvertedLowerBounds(addExpr.getRValue()) and
+        result = addRoundingDown(xLow, yLow)
+      )
+      or
+      exists(AssignSubExpr subExpr, float xLow, float yHigh |
+        expr = subExpr and
+        xLow = getFullyConvertedLowerBounds(subExpr.getLValue()) and
+        yHigh = getFullyConvertedUpperBounds(subExpr.getRValue()) and
+        result = addRoundingDown(xLow, -yHigh)
+      )
+      or
+      exists(UnsignedAssignMulExpr mulExpr, float xLow, float yLow |
+        expr = mulExpr and
+        xLow = getFullyConvertedLowerBounds(mulExpr.getLValue()) and
+        yLow = getFullyConvertedLowerBounds(mulExpr.getRValue()) and
+        result = xLow * yLow
+      )
+      or
+      exists(AssignMulByPositiveConstantExpr mulExpr, float xLow |
+        expr = mulExpr and
+        xLow = getFullyConvertedLowerBounds(mulExpr.getLValue()) and
+        result = xLow * mulExpr.getConstant()
+      )
+      or
+      exists(AssignMulByNegativeConstantExpr mulExpr, float xHigh |
+        expr = mulExpr and
+        xHigh = getFullyConvertedUpperBounds(mulExpr.getLValue()) and
+        result = xHigh * mulExpr.getConstant()
+      )
+      or
+      exists(PrefixIncrExpr incrExpr, float xLow |
+        expr = incrExpr and
+        xLow = getFullyConvertedLowerBounds(incrExpr.getOperand()) and
+        result = xLow + 1
+      )
+      or
+      exists(PrefixDecrExpr decrExpr, float xLow |
+        expr = decrExpr and
+        xLow = getFullyConvertedLowerBounds(decrExpr.getOperand()) and
+        result = addRoundingDownSmall(xLow, -1)
+      )
+      or
+      // `PostfixIncrExpr` and `PostfixDecrExpr` return the value of their
+      // operand. The incrementing/decrementing behavior is handled in
+      // `getDefLowerBoundsImpl`.
+      exists(PostfixIncrExpr incrExpr |
+        expr = incrExpr and
+        result = getFullyConvertedLowerBounds(incrExpr.getOperand())
+      )
+      or
+      exists(PostfixDecrExpr decrExpr |
+        expr = decrExpr and
+        result = getFullyConvertedLowerBounds(decrExpr.getOperand())
+      )
+      or
+      exists(RemExpr remExpr | expr = remExpr |
+        // If both inputs are positive then the lower bound is zero.
+        result = 0
+        or
+        // If either input could be negative then the output could be
+        // negative. If so, the lower bound of `x%y` is `-abs(y) + 1`, which is
+        // equal to `min(-y + 1,y - 1)`.
+        exists(float childLB |
+          childLB = getFullyConvertedLowerBounds(remExpr.getAnOperand()) and
+          not childLB >= 0
+        |
+          result = getFullyConvertedLowerBounds(remExpr.getRightOperand()) - 1
+          or
+          exists(float rhsUB | rhsUB = getFullyConvertedUpperBounds(remExpr.getRightOperand()) |
+            result = -rhsUB + 1
+          )
+        )
+      )
+      or
+      // If the conversion is to an arithmetic type then we just return the
+      // lower bound of the child. We do not need to handle truncation and
+      // overflow here, because that is done in `getTruncatedLowerBounds`.
+      // Conversions to `bool` need to be handled specially because they test
+      // whether the value of the expression is equal to 0.
+      exists(Conversion convExpr | expr = convExpr |
+        if convExpr.getUnspecifiedType() instanceof BoolType
+        then result = boolConversionLowerBound(convExpr.getExpr())
+        else result = getTruncatedLowerBounds(convExpr.getExpr())
+      )
+      or
+      // Use SSA to get the lower bounds for a variable use.
+      exists(RangeSsaDefinition def, StackVariable v | expr = def.getAUse(v) |
+        result = getDefLowerBounds(def, v)
+      )
+      or
+      // unsigned `&` (tighter bounds may exist)
+      exists(UnsignedBitwiseAndExpr andExpr |
+        andExpr = expr and
+        result = 0.0
+      )
+      or
+      // `>>` by a constant
+      exists(RShiftExpr rsExpr, float left, int right |
+        rsExpr = expr and
+        left = getFullyConvertedLowerBounds(rsExpr.getLeftOperand()) and
+        right = getValue(rsExpr.getRightOperand().getFullyConverted()).toInt() and
+        result = safeFloor(left / 2.pow(right))
+      )
+    )
+  }
+
+  /** Only to be called by `getTruncatedUpperBounds`. */
+  private float getUpperBoundsImpl(Expr expr) {
+    (
+      exists(Expr operand, float operandHigh, float positive |
+        effectivelyMultipliesByPositive(expr, operand, positive) and
+        operandHigh = getFullyConvertedUpperBounds(operand) and
+        result = positive * operandHigh
+      )
+      or
+      exists(Expr operand, float operandLow, float negative |
+        effectivelyMultipliesByNegative(expr, operand, negative) and
+        operandLow = getFullyConvertedLowerBounds(operand) and
+        result = negative * operandLow
+      )
+      or
+      exists(Expr operand, float operandHigh, float positive |
+        dividesByPositive(expr, operand, positive) and
+        operandHigh = getFullyConvertedUpperBounds(operand) and
+        result = operandHigh / positive
+      )
+      or
+      exists(Expr operand, float operandHigh, float negative |
+        dividesByNegative(expr, operand, negative) and
+        operandHigh = getFullyConvertedLowerBounds(operand) and
+        result = operandHigh / negative
+      )
+      or
+      exists(DivExpr div | expr = div |
+        dividesNonzeroByZero(expr) and
+        result = getFullyConvertedUpperBounds(div.getLeftOperand()) / 0
+      )
+      or
+      exists(SupportedFunctionCall sfc | sfc.getFunctionCall() = expr |
+        result = sfc.getUpperBound()
+      )
+      or
+      exists(MaxExpr maxExpr |
+        expr = maxExpr and
+        // Return the union of the upper bounds from both children.
+        result = getFullyConvertedUpperBounds(maxExpr.getAnOperand())
+      )
+      or
+      exists(MinExpr minExpr |
+        expr = minExpr and
+        // Compute the cross product of the bounds from both children.  We are
+        // using this mathematical property:
+        //
+        //    min (maximum{X}, maximum{Y})
+        //  = maximum { min(x,y) | x in X, y in Y }
+        exists(float x, float y |
+          x = getFullyConvertedUpperBounds(minExpr.getLeftOperand()) and
+          y = getFullyConvertedUpperBounds(minExpr.getRightOperand()) and
+          if x <= y then result = x else result = y
+        )
+      )
+      or
+      // ConditionalExpr (true branch)
+      exists(ConditionalExpr condExpr |
+        expr = condExpr and
+        // Use `boolConversionUpperBound` to determine whether the condition
+        // might evaluate to `true`.
+        boolConversionUpperBound(condExpr.getCondition().getFullyConverted()) = 1 and
+        result = getFullyConvertedUpperBounds(condExpr.getThen())
+      )
+      or
+      // ConditionalExpr (false branch)
+      exists(ConditionalExpr condExpr |
+        expr = condExpr and
+        // Use `boolConversionLowerBound` to determine whether the condition
+        // might evaluate to `false`.
+        boolConversionLowerBound(condExpr.getCondition().getFullyConverted()) = 0 and
+        result = getFullyConvertedUpperBounds(condExpr.getElse())
+      )
+      or
+      exists(AddExpr addExpr, float xHigh, float yHigh |
+        expr = addExpr and
+        xHigh = getFullyConvertedUpperBounds(addExpr.getLeftOperand()) and
+        yHigh = getFullyConvertedUpperBounds(addExpr.getRightOperand()) and
+        result = addRoundingUp(xHigh, yHigh)
+      )
+      or
+      exists(SubExpr subExpr, float xHigh, float yLow |
+        expr = subExpr and
+        xHigh = getFullyConvertedUpperBounds(subExpr.getLeftOperand()) and
+        yLow = getFullyConvertedLowerBounds(subExpr.getRightOperand()) and
+        result = addRoundingUp(xHigh, -yLow)
+      )
+      or
+      exists(UnsignedMulExpr mulExpr, float xHigh, float yHigh |
+        expr = mulExpr and
+        xHigh = getFullyConvertedUpperBounds(mulExpr.getLeftOperand()) and
+        yHigh = getFullyConvertedUpperBounds(mulExpr.getRightOperand()) and
+        result = xHigh * yHigh
+      )
+      or
+      exists(AssignExpr assign |
+        expr = assign and
+        result = getFullyConvertedUpperBounds(assign.getRValue())
+      )
+      or
+      exists(AssignAddExpr addExpr, float xHigh, float yHigh |
+        expr = addExpr and
+        xHigh = getFullyConvertedUpperBounds(addExpr.getLValue()) and
+        yHigh = getFullyConvertedUpperBounds(addExpr.getRValue()) and
+        result = addRoundingUp(xHigh, yHigh)
+      )
+      or
+      exists(AssignSubExpr subExpr, float xHigh, float yLow |
+        expr = subExpr and
+        xHigh = getFullyConvertedUpperBounds(subExpr.getLValue()) and
+        yLow = getFullyConvertedLowerBounds(subExpr.getRValue()) and
+        result = addRoundingUp(xHigh, -yLow)
+      )
+      or
+      exists(UnsignedAssignMulExpr mulExpr, float xHigh, float yHigh |
+        expr = mulExpr and
+        xHigh = getFullyConvertedUpperBounds(mulExpr.getLValue()) and
+        yHigh = getFullyConvertedUpperBounds(mulExpr.getRValue()) and
+        result = xHigh * yHigh
+      )
+      or
+      exists(AssignMulByPositiveConstantExpr mulExpr, float xHigh |
+        expr = mulExpr and
+        xHigh = getFullyConvertedUpperBounds(mulExpr.getLValue()) and
+        result = xHigh * mulExpr.getConstant()
+      )
+      or
+      exists(AssignMulByNegativeConstantExpr mulExpr, float xLow |
+        expr = mulExpr and
+        xLow = getFullyConvertedLowerBounds(mulExpr.getLValue()) and
+        result = xLow * mulExpr.getConstant()
+      )
+      or
+      exists(PrefixIncrExpr incrExpr, float xHigh |
+        expr = incrExpr and
+        xHigh = getFullyConvertedUpperBounds(incrExpr.getOperand()) and
+        result = addRoundingUpSmall(xHigh, 1)
+      )
+      or
+      exists(PrefixDecrExpr decrExpr, float xHigh |
+        expr = decrExpr and
+        xHigh = getFullyConvertedUpperBounds(decrExpr.getOperand()) and
+        result = xHigh - 1
+      )
+      or
+      // `PostfixIncrExpr` and `PostfixDecrExpr` return the value of their operand.
+      // The incrementing/decrementing behavior is handled in
+      // `getDefUpperBoundsImpl`.
+      exists(PostfixIncrExpr incrExpr |
+        expr = incrExpr and
+        result = getFullyConvertedUpperBounds(incrExpr.getOperand())
+      )
+      or
+      exists(PostfixDecrExpr decrExpr |
+        expr = decrExpr and
+        result = getFullyConvertedUpperBounds(decrExpr.getOperand())
+      )
+      or
+      exists(RemExpr remExpr, float rhsUB |
+        expr = remExpr and
+        rhsUB = getFullyConvertedUpperBounds(remExpr.getRightOperand())
+      |
+        result = rhsUB - 1
+        or
+        // If the right hand side could be negative then we need to take its
+        // absolute value. Since `abs(x) = max(-x,x)` this is equivalent to
+        // adding `-rhsLB` to the set of upper bounds.
+        exists(float rhsLB |
+          rhsLB = getFullyConvertedLowerBounds(remExpr.getRightOperand()) and
+          not rhsLB >= 0
+        |
+          result = -rhsLB + 1
+        )
+      )
+      or
+      // If the conversion is to an arithmetic type then we just return the
+      // upper bound of the child. We do not need to handle truncation and
+      // overflow here, because that is done in `getTruncatedUpperBounds`.
+      // Conversions to `bool` need to be handled specially because they test
+      // whether the value of the expression is equal to 0.
+      exists(Conversion convExpr | expr = convExpr |
+        if convExpr.getUnspecifiedType() instanceof BoolType
+        then result = boolConversionUpperBound(convExpr.getExpr())
+        else result = getTruncatedUpperBounds(convExpr.getExpr())
+      )
+      or
+      // Use SSA to get the upper bounds for a variable use.
+      exists(RangeSsaDefinition def, StackVariable v | expr = def.getAUse(v) |
+        result = getDefUpperBounds(def, v)
+      )
+      or
+      // unsigned `&` (tighter bounds may exist)
+      exists(UnsignedBitwiseAndExpr andExpr, float left, float right |
+        andExpr = expr and
+        left = getFullyConvertedUpperBounds(andExpr.getLeftOperand()) and
+        right = getFullyConvertedUpperBounds(andExpr.getRightOperand()) and
+        result = left.minimum(right)
+      )
+      or
+      // `>>` by a constant
+      exists(RShiftExpr rsExpr, float left, int right |
+        rsExpr = expr and
+        left = getFullyConvertedUpperBounds(rsExpr.getLeftOperand()) and
+        right = getValue(rsExpr.getRightOperand().getFullyConverted()).toInt() and
+        result = safeFloor(left / 2.pow(right))
+      )
+    )
+  }
+
+  /**
+   * Holds if `expr` is converted to `bool` or if it is the child of a
+   * logical operation.
+   *
+   * The purpose of this predicate is to optimize `boolConversionLowerBound`
+   * and `boolConversionUpperBound` by preventing them from computing
+   * unnecessary results. In other words, `exprIsUsedAsBool(expr)` holds if
+   * `expr` is an expression that might be passed as an argument to
+   * `boolConversionLowerBound` or `boolConversionUpperBound`.
+   */
+  private predicate exprIsUsedAsBool(Expr expr) {
+    expr = any(BinaryLogicalOperation op).getAnOperand().getFullyConverted()
+    or
+    expr = any(UnaryLogicalOperation op).getOperand().getFullyConverted()
+    or
+    expr = any(ConditionalExpr c).getCondition().getFullyConverted()
+    or
+    exists(Conversion cast | cast.getUnspecifiedType() instanceof BoolType | expr = cast.getExpr())
+  }
+
+  /**
+   * Gets the lower bound of the conversion `(bool)expr`. If we can prove that
+   * the value of `expr` is never 0 then `lb = 1`. Otherwise `lb = 0`.
+   */
+  private float boolConversionLowerBound(Expr expr) {
+    // Case 1: if the range for `expr` includes the value 0,
+    // then `result = 0`.
+    exprIsUsedAsBool(expr) and
+    exists(float lb | lb = getTruncatedLowerBounds(expr) and not lb > 0) and
+    exists(float ub | ub = getTruncatedUpperBounds(expr) and not ub < 0) and
+    result = 0
+    or
+    // Case 2a: if the range for `expr` does not include the value 0,
+    // then `result = 1`.
+    exprIsUsedAsBool(expr) and getTruncatedLowerBounds(expr) > 0 and result = 1
+    or
+    // Case 2b: if the range for `expr` does not include the value 0,
+    // then `result = 1`.
+    exprIsUsedAsBool(expr) and getTruncatedUpperBounds(expr) < 0 and result = 1
+    or
+    // Case 3: the type of `expr` is not arithmetic. For example, it might
+    // be a pointer.
+    exprIsUsedAsBool(expr) and not exists(Util::exprMinVal(expr)) and result = 0
+  }
+
+  /**
+   * Gets the upper bound of the conversion `(bool)expr`. If we can prove that
+   * the value of `expr` is always 0 then `ub = 0`. Otherwise `ub = 1`.
+   */
+  private float boolConversionUpperBound(Expr expr) {
+    // Case 1a: if the upper bound of the operand is <= 0, then the upper
+    // bound might be 0.
+    exprIsUsedAsBool(expr) and getTruncatedUpperBounds(expr) <= 0 and result = 0
+    or
+    // Case 1b: if the upper bound of the operand is not <= 0, then the upper
+    // bound is 1.
+    exprIsUsedAsBool(expr) and
+    exists(float ub | ub = getTruncatedUpperBounds(expr) and not ub <= 0) and
+    result = 1
+    or
+    // Case 2a: if the lower bound of the operand is >= 0, then the upper
+    // bound might be 0.
+    exprIsUsedAsBool(expr) and getTruncatedLowerBounds(expr) >= 0 and result = 0
+    or
+    // Case 2b: if the lower bound of the operand is not >= 0, then the upper
+    // bound is 1.
+    exprIsUsedAsBool(expr) and
+    exists(float lb | lb = getTruncatedLowerBounds(expr) and not lb >= 0) and
+    result = 1
+    or
+    // Case 3: the type of `expr` is not arithmetic. For example, it might
+    // be a pointer.
+    exprIsUsedAsBool(expr) and not exists(Util::exprMaxVal(expr)) and result = 1
+  }
+
+  /**
+   * This predicate computes the lower bounds of a phi definition. If the
+   * phi definition corresponds to a guard, then the guard is used to
+   * deduce a better lower bound.
+   * For example:
+   *
+   *     def:      x = y % 10;
+   *     guard:    if (x >= 2) {
+   *     block:      f(x)
+   *               }
+   *
+   * In this example, the lower bound of x is 0, but we can
+   * use the guard to deduce that the lower bound is 2 inside the block.
+   */
+  private float getPhiLowerBounds(StackVariable v, RangeSsaDefinition phi) {
+    exists(VariableAccess access, Expr guard, boolean branch, float defLB, float guardLB |
+      phi.isGuardPhi(v, access, guard, branch) and
+      lowerBoundFromGuard(guard, access, guardLB, branch) and
+      defLB = getFullyConvertedLowerBounds(access)
+    |
+      // Compute the maximum of `guardLB` and `defLB`.
+      if guardLB > defLB then result = guardLB else result = defLB
+    )
+    or
+    exists(VariableAccess access, float neConstant, float lower |
+      isNEPhi(v, phi, access, neConstant) and
+      lower = getTruncatedLowerBounds(access) and
+      if lower = neConstant then result = lower + 1 else result = lower
+    )
+    or
+    exists(VariableAccess access |
+      isUnsupportedGuardPhi(v, phi, access) and
+      result = getTruncatedLowerBounds(access)
+    )
+    or
+    result = getDefLowerBounds(phi.getAPhiInput(v), v)
+  }
+
+  /** See comment for `getPhiLowerBounds`, above. */
+  private float getPhiUpperBounds(StackVariable v, RangeSsaDefinition phi) {
+    exists(VariableAccess access, Expr guard, boolean branch, float defUB, float guardUB |
+      phi.isGuardPhi(v, access, guard, branch) and
+      upperBoundFromGuard(guard, access, guardUB, branch) and
+      defUB = getFullyConvertedUpperBounds(access)
+    |
+      // Compute the minimum of `guardUB` and `defUB`.
+      if guardUB < defUB then result = guardUB else result = defUB
+    )
+    or
+    exists(VariableAccess access, float neConstant, float upper |
+      isNEPhi(v, phi, access, neConstant) and
+      upper = getTruncatedUpperBounds(access) and
+      if upper = neConstant then result = upper - 1 else result = upper
+    )
+    or
+    exists(VariableAccess access |
+      isUnsupportedGuardPhi(v, phi, access) and
+      result = getTruncatedUpperBounds(access)
+    )
+    or
+    result = getDefUpperBounds(phi.getAPhiInput(v), v)
+  }
+
+  /** Only to be called by `getDefLowerBounds`. */
+  private float getDefLowerBoundsImpl(RangeSsaDefinition def, StackVariable v) {
+    // Definitions with a defining value.
+    exists(Expr expr | assignmentDef(def, v, expr) | result = getFullyConvertedLowerBounds(expr))
+    or
+    // Assignment operations with a defining value
+    exists(AssignOperation assignOp |
+      def = assignOp and
+      assignOp.getLValue() = v.getAnAccess() and
+      result = getTruncatedLowerBounds(assignOp)
+    )
+    or
+    exists(IncrementOperation incr, float newLB |
+      def = incr and
+      incr.getOperand() = v.getAnAccess() and
+      newLB = getFullyConvertedLowerBounds(incr.getOperand()) and
+      result = newLB + 1
+    )
+    or
+    exists(DecrementOperation decr, float newLB |
+      def = decr and
+      decr.getOperand() = v.getAnAccess() and
+      newLB = getFullyConvertedLowerBounds(decr.getOperand()) and
+      result = addRoundingDownSmall(newLB, -1)
+    )
+    or
+    // Phi nodes.
+    result = getPhiLowerBounds(v, def)
+    or
+    // Unanalyzable definitions.
+    unanalyzableDefBounds(def, v, result, _)
+  }
+
+  /** Only to be called by `getDefUpperBounds`. */
+  private float getDefUpperBoundsImpl(RangeSsaDefinition def, StackVariable v) {
+    // Definitions with a defining value.
+    exists(Expr expr | assignmentDef(def, v, expr) | result = getFullyConvertedUpperBounds(expr))
+    or
+    // Assignment operations with a defining value
+    exists(AssignOperation assignOp |
+      def = assignOp and
+      assignOp.getLValue() = v.getAnAccess() and
+      result = getTruncatedUpperBounds(assignOp)
+    )
+    or
+    exists(IncrementOperation incr, float newUB |
+      def = incr and
+      incr.getOperand() = v.getAnAccess() and
+      newUB = getFullyConvertedUpperBounds(incr.getOperand()) and
+      result = addRoundingUpSmall(newUB, 1)
+    )
+    or
+    exists(DecrementOperation decr, float newUB |
+      def = decr and
+      decr.getOperand() = v.getAnAccess() and
+      newUB = getFullyConvertedUpperBounds(decr.getOperand()) and
+      result = newUB - 1
+    )
+    or
+    // Phi nodes.
+    result = getPhiUpperBounds(v, def)
+    or
+    // Unanalyzable definitions.
+    unanalyzableDefBounds(def, v, _, result)
+  }
+
+  /**
+   * Helper for `getDefLowerBounds` and `getDefUpperBounds`. Find the set of
+   * unanalyzable definitions (such as function parameters) and make their
+   * bounds unknown.
+   */
+  private predicate unanalyzableDefBounds(
+    RangeSsaDefinition def, StackVariable v, float lb, float ub
+  ) {
+    v = def.getAVariable() and
+    not analyzableDef(def, v) and
+    lb = varMinVal(v) and
+    ub = varMaxVal(v)
+  }
+
+  /**
+   * Holds if in the `branch` branch of a guard `guard` involving `v`,
+   * we know that `v` is not NaN, and therefore it is safe to make range
+   * inferences about `v`.
+   */
+  bindingset[guard, v, branch]
+  predicate nonNanGuardedVariable(Expr guard, VariableAccess v, boolean branch) {
+    Util::getVariableRangeType(v.getTarget()) instanceof IntegralType
+    or
+    Util::getVariableRangeType(v.getTarget()) instanceof FloatingPointType and
+    v instanceof NonNanVariableAccess
+    or
+    // The reason the following case is here is to ensure that when we say
+    // `if (x > 5) { ...then... } else { ...else... }`
+    // it is ok to conclude that `x > 5` in the `then`, (though not safe
+    // to conclude that x <= 5 in `else`) even if we had no prior
+    // knowledge of `x` not being `NaN`.
+    nanExcludingComparison(guard, branch)
+  }
+
+  /**
+   * If the guard is a comparison of the form `p*v + q <CMP> r`, then this
+   * predicate uses the bounds information for `r` to compute a lower bound
+   * for `v`.
+   */
+  private predicate lowerBoundFromGuard(Expr guard, VariableAccess v, float lb, boolean branch) {
+    exists(float childLB, Util::RelationStrictness strictness |
+      boundFromGuard(guard, v, childLB, true, strictness, branch)
+    |
+      if nonNanGuardedVariable(guard, v, branch)
+      then
+        if
+          strictness = Util::Nonstrict() or
+          not Util::getVariableRangeType(v.getTarget()) instanceof IntegralType
+        then lb = childLB
+        else lb = childLB + 1
+      else lb = varMinVal(v.getTarget())
+    )
+  }
+
+  /**
+   * If the guard is a comparison of the form `p*v + q <CMP> r`, then this
+   * predicate uses the bounds information for `r` to compute a upper bound
+   * for `v`.
+   */
+  private predicate upperBoundFromGuard(Expr guard, VariableAccess v, float ub, boolean branch) {
+    exists(float childUB, Util::RelationStrictness strictness |
+      boundFromGuard(guard, v, childUB, false, strictness, branch)
+    |
+      if nonNanGuardedVariable(guard, v, branch)
+      then
+        if
+          strictness = Util::Nonstrict() or
+          not Util::getVariableRangeType(v.getTarget()) instanceof IntegralType
+        then ub = childUB
+        else ub = childUB - 1
+      else ub = varMaxVal(v.getTarget())
+    )
+  }
+
+  /**
+   * This predicate simplifies the results returned by
+   * `linearBoundFromGuard`.
+   */
+  private predicate boundFromGuard(
+    Expr guard, VariableAccess v, float boundValue, boolean isLowerBound,
+    Util::RelationStrictness strictness, boolean branch
+  ) {
+    exists(float p, float q, float r, boolean isLB |
+      linearBoundFromGuard(guard, v, p, q, r, isLB, strictness, branch) and
+      boundValue = (r - q) / p
+    |
+      // If the multiplier is negative then the direction of the comparison
+      // needs to be flipped.
+      p > 0 and isLowerBound = isLB
+      or
+      p < 0 and isLowerBound = isLB.booleanNot()
+    )
+    or
+    // When `!e` is true, we know that `0 <= e <= 0`
+    exists(float p, float q, Expr e |
+      Util::linearAccess(e, v, p, q) and
+      Util::eqZeroWithNegate(guard, e, true, branch) and
+      boundValue = (0.0 - q) / p and
+      isLowerBound = [false, true] and
+      strictness = Util::Nonstrict()
+    )
+  }
+
+  /**
+   * This predicate finds guards of the form `p*v + q < r or p*v + q == r`
+   * and decomposes them into a tuple of values which can be used to deduce a
+   * lower or upper bound for `v`.
+   */
+  private predicate linearBoundFromGuard(
+    ComparisonOperation guard, VariableAccess v, float p, float q, float boundValue,
+    boolean isLowerBound, // Is this a lower or an upper bound?
+    Util::RelationStrictness strictness, boolean branch // Which control-flow branch is this bound valid on?
+  ) {
+    // For the comparison x < RHS, we create two bounds:
+    //
+    //   1. x < upperbound(RHS)
+    //   2. x >= typeLowerBound(RHS.getUnspecifiedType())
+    //
+    exists(Expr lhs, Expr rhs, Util::RelationDirection dir, Util::RelationStrictness st |
+      Util::linearAccess(lhs, v, p, q) and
+      Util::relOpWithSwapAndNegate(guard, lhs, rhs, dir, st, branch)
+    |
+      isLowerBound = Util::directionIsGreater(dir) and
+      strictness = st and
+      getBounds(rhs, boundValue, isLowerBound)
+      or
+      isLowerBound = Util::directionIsLesser(dir) and
+      strictness = Util::Nonstrict() and
+      exprTypeBounds(rhs, boundValue, isLowerBound)
+    )
+    or
+    // For x == RHS, we create the following bounds:
+    //
+    //   1. x <= upperbound(RHS)
+    //   2. x >= lowerbound(RHS)
+    //
+    exists(Expr lhs, Expr rhs |
+      Util::linearAccess(lhs, v, p, q) and
+      Util::eqOpWithSwapAndNegate(guard, lhs, rhs, true, branch) and
+      getBounds(rhs, boundValue, isLowerBound) and
+      strictness = Util::Nonstrict()
+    )
+    // x != RHS and !x are handled elsewhere
+  }
+
+  /** Utility for `linearBoundFromGuard`. */
+  private predicate getBounds(Expr expr, float boundValue, boolean isLowerBound) {
+    isLowerBound = true and boundValue = getFullyConvertedLowerBounds(expr)
+    or
+    isLowerBound = false and boundValue = getFullyConvertedUpperBounds(expr)
+  }
+
+  /** Utility for `linearBoundFromGuard`. */
+  private predicate exprTypeBounds(Expr expr, float boundValue, boolean isLowerBound) {
+    isLowerBound = true and boundValue = exprMinVal(expr.getFullyConverted())
+    or
+    isLowerBound = false and boundValue = exprMaxVal(expr.getFullyConverted())
+  }
+
+  /**
+   * Holds if `(v, phi)` ensures that `access` is not equal to `neConstant`. For
+   * example, the condition `if (x + 1 != 3)` ensures that `x` is not equal to 2.
+   * Only integral types are supported.
+   */
+  private predicate isNEPhi(
+    Variable v, RangeSsaDefinition phi, VariableAccess access, float neConstant
+  ) {
+    exists(
+      ComparisonOperation cmp, boolean branch, Expr linearExpr, Expr rExpr, float p, float q,
+      float r
+    |
+      phi.isGuardPhi(v, access, cmp, branch) and
+      Util::eqOpWithSwapAndNegate(cmp, linearExpr, rExpr, false, branch) and
+      v.getUnspecifiedType() instanceof IntegralOrEnumType and // Float `!=` is too imprecise
+      r = getValue(rExpr).toFloat() and
+      Util::linearAccess(linearExpr, access, p, q) and
+      neConstant = (r - q) / p
+    )
+    or
+    exists(Expr op, boolean branch, Expr linearExpr, float p, float q |
+      phi.isGuardPhi(v, access, op, branch) and
+      Util::eqZeroWithNegate(op, linearExpr, false, branch) and
+      v.getUnspecifiedType() instanceof IntegralOrEnumType and // Float `!` is too imprecise
+      Util::linearAccess(linearExpr, access, p, q) and
+      neConstant = (0.0 - q) / p
+    )
+  }
+
+  /**
+   * Holds if `(v, phi)` constrains the value of `access` but in a way that
+   * doesn't allow this library to constrain the upper or lower bounds of
+   * `access`. An example is `if (x != y)` if neither `x` nor `y` is a
+   * compile-time constant.
+   */
+  private predicate isUnsupportedGuardPhi(Variable v, RangeSsaDefinition phi, VariableAccess access) {
+    exists(Expr cmp, boolean branch |
+      Util::eqOpWithSwapAndNegate(cmp, _, _, false, branch)
+      or
+      Util::eqZeroWithNegate(cmp, _, false, branch)
+    |
+      phi.isGuardPhi(v, access, cmp, branch) and
+      not isNEPhi(v, phi, access, _)
+    )
+  }
+
+  /**
+   * Gets the upper bound of the expression, if the expression is guarded.
+   * An upper bound can only be found, if a guard phi node can be found, and the
+   * expression has only one immediate predecessor.
+   */
+  private float getGuardedUpperBound(VariableAccess guardedAccess) {
+    exists(
+      RangeSsaDefinition def, StackVariable v, VariableAccess guardVa, Expr guard, boolean branch
+    |
+      def.isGuardPhi(v, guardVa, guard, branch) and
+      // If the basic block for the variable access being examined has
+      // more than one predecessor, the guard phi node could originate
+      // from one of the predecessors. This is because the guard phi
+      // node is attached to the block at the end of the edge and not on
+      // the actual edge. It is therefore not possible to determine which
+      // edge the guard phi node belongs to. The predicate below ensures
+      // that there is one predecessor, albeit somewhat conservative.
+      exists(unique(BasicBlock b | b = def.(BasicBlock).getAPredecessor())) and
+      guardedAccess = def.getAUse(v) and
+      result = max(float ub | upperBoundFromGuard(guard, guardVa, ub, branch)) and
+      not convertedExprMightOverflow(guard.getAChild+())
+    )
+  }
+
+  cached
+  private module SimpleRangeAnalysisCached {
+    /**
+     * Gets the lower bound of the expression.
+     *
+     * Note: expressions in C/C++ are often implicitly or explicitly cast to a
+     * different result type. Such casts can cause the value of the expression
+     * to overflow or to be truncated. This predicate computes the lower bound
+     * of the expression without including the effect of the casts. To compute
+     * the lower bound of the expression after all the casts have been applied,
+     * call `lowerBound` like this:
+     *
+     *    `lowerBound(expr.getFullyConverted())`
+     */
+    cached
+    float lowerBound(Expr expr) {
+      // Combine the lower bounds returned by getTruncatedLowerBounds into a
+      // single minimum value.
+      result = min(float lb | lb = getTruncatedLowerBounds(expr) | lb)
+    }
+
+    /**
+     * Gets the upper bound of the expression.
+     *
+     * Note: expressions in C/C++ are often implicitly or explicitly cast to a
+     * different result type. Such casts can cause the value of the expression
+     * to overflow or to be truncated. This predicate computes the upper bound
+     * of the expression without including the effect of the casts. To compute
+     * the upper bound of the expression after all the casts have been applied,
+     * call `upperBound` like this:
+     *
+     *    `upperBound(expr.getFullyConverted())`
+     */
+    cached
+    float upperBound(Expr expr) {
+      // Combine the upper bounds returned by getTruncatedUpperBounds and
+      // getGuardedUpperBound into a single maximum value
+      result = min([max(getTruncatedUpperBounds(expr)), getGuardedUpperBound(expr)])
+    }
+
+    /** Holds if the upper bound of `expr` may have been widened. This means the upper bound is in practice likely to be overly wide. */
+    cached
+    predicate upperBoundMayBeWidened(Expr e) {
+      isRecursiveExpr(e) and
+      // Widening is not a problem if the post-analysis in `getGuardedUpperBound` has overridden the widening.
+      // Note that the RHS of `<` may be multi-valued.
+      not getGuardedUpperBound(e) < getTruncatedUpperBounds(e)
+    }
+
+    /**
+     * Holds if `expr` has a provably empty range. For example:
+     *
+     *   10 < expr and expr < 5
+     *
+     * The range of an expression can only be empty if it can never be
+     * executed. For example:
+     *
+     *   if (10 < x) {
+     *     if (x < 5) {
+     *       // Unreachable code
+     *       return x; // x has an empty range: 10 < x && x < 5
+     *     }
+     *   }
+     */
+    cached
+    predicate exprWithEmptyRange(Expr expr) {
+      analyzableExpr(expr) and
+      (
+        not exists(lowerBound(expr)) or
+        not exists(upperBound(expr)) or
+        lowerBound(expr) > upperBound(expr)
+      )
+    }
+
+    /** Holds if the definition might overflow negatively. */
+    cached
+    predicate defMightOverflowNegatively(RangeSsaDefinition def, StackVariable v) {
+      getDefLowerBoundsImpl(def, v) < Util::varMinVal(v)
+    }
+
+    /** Holds if the definition might overflow positively. */
+    cached
+    predicate defMightOverflowPositively(RangeSsaDefinition def, StackVariable v) {
+      getDefUpperBoundsImpl(def, v) > Util::varMaxVal(v)
+    }
+
+    /**
+     * Holds if the definition might overflow (either positively or
+     * negatively).
+     */
+    cached
+    predicate defMightOverflow(RangeSsaDefinition def, StackVariable v) {
+      defMightOverflowNegatively(def, v) or
+      defMightOverflowPositively(def, v)
+    }
+
+    /**
+     * Holds if `e` is an expression where the concept of overflow makes sense.
+     * This predicate is used to filter out some of the unanalyzable expressions
+     * from `exprMightOverflowPositively` and `exprMightOverflowNegatively`.
+     */
+    pragma[inline]
+    private predicate exprThatCanOverflow(Expr e) {
+      e instanceof UnaryArithmeticOperation or
+      e instanceof BinaryArithmeticOperation or
+      e instanceof AssignArithmeticOperation or
+      e instanceof LShiftExpr or
+      e instanceof AssignLShiftExpr
+    }
+
+    /**
+     * Holds if the expression might overflow negatively. This predicate
+     * does not consider the possibility that the expression might overflow
+     * due to a conversion.
+     */
+    cached
+    predicate exprMightOverflowNegatively(Expr expr) {
+      getLowerBoundsImpl(expr) < Util::exprMinVal(expr)
+      or
+      // The lower bound of the expression `x--` is the same as the lower
+      // bound of `x`, so the standard logic (above) does not work for
+      // detecting whether it might overflow.
+      getLowerBoundsImpl(expr.(PostfixDecrExpr)) = Util::exprMinVal(expr)
+      or
+      // We can't conclude that any unanalyzable expression might overflow. This
+      // is because there are many expressions that the range analysis doesn't
+      // handle, but where the concept of overflow doesn't make sense.
+      exprThatCanOverflow(expr) and not analyzableExpr(expr)
+    }
+
+    /**
+     * Holds if the expression might overflow negatively. Conversions
+     * are also taken into account. For example the expression
+     * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
+     * due to the addition.
+     */
+    cached
+    predicate convertedExprMightOverflowNegatively(Expr expr) {
+      exprMightOverflowNegatively(expr) or
+      convertedExprMightOverflowNegatively(expr.getConversion())
+    }
+
+    /**
+     * Holds if the expression might overflow positively. This predicate
+     * does not consider the possibility that the expression might overflow
+     * due to a conversion.
+     */
+    cached
+    predicate exprMightOverflowPositively(Expr expr) {
+      getUpperBoundsImpl(expr) > Util::exprMaxVal(expr)
+      or
+      // The upper bound of the expression `x++` is the same as the upper
+      // bound of `x`, so the standard logic (above) does not work for
+      // detecting whether it might overflow.
+      getUpperBoundsImpl(expr.(PostfixIncrExpr)) = Util::exprMaxVal(expr)
+    }
+
+    /**
+     * Holds if the expression might overflow positively. Conversions
+     * are also taken into account. For example the expression
+     * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
+     * due to the addition.
+     */
+    cached
+    predicate convertedExprMightOverflowPositively(Expr expr) {
+      exprMightOverflowPositively(expr) or
+      convertedExprMightOverflowPositively(expr.getConversion())
+    }
+
+    /**
+     * Holds if the expression might overflow (either positively or
+     * negatively). The possibility that the expression might overflow
+     * due to an implicit or explicit cast is also considered.
+     */
+    cached
+    predicate convertedExprMightOverflow(Expr expr) {
+      convertedExprMightOverflowNegatively(expr) or
+      convertedExprMightOverflowPositively(expr)
+    }
+  }
+
+  /**
+   * Gets the truncated lower bounds of the fully converted expression.
+   */
+  float getFullyConvertedLowerBounds(Expr expr) {
+    result = getTruncatedLowerBounds(expr.getFullyConverted())
+  }
+
+  /**
+   * Gets the truncated upper bounds of the fully converted expression.
+   */
+  float getFullyConvertedUpperBounds(Expr expr) {
+    result = getTruncatedUpperBounds(expr.getFullyConverted())
+  }
+
+  /**
+   * Get the lower bounds for a `RangeSsaDefinition`. Most of the work is
+   * done by `getDefLowerBoundsImpl`, but this is where widening is applied
+   * to prevent the analysis from exploding due to a recursive definition.
+   */
+  float getDefLowerBounds(RangeSsaDefinition def, StackVariable v) {
+    exists(float newLB, float truncatedLB |
+      newLB = getDefLowerBoundsImpl(def, v) and
+      if Util::varMinVal(v) <= newLB and newLB <= Util::varMaxVal(v)
+      then truncatedLB = newLB
+      else truncatedLB = Util::varMinVal(v)
+    |
+      // Widening: check whether the new lower bound is from a source which
+      // depends recursively on the current definition.
+      if isRecursiveDef(def, v)
+      then
+        // The new lower bound is from a recursive source, so we round
+        // down to one of a limited set of values to prevent the
+        // recursion from exploding.
+        result =
+          max(float widenLB |
+            widenLB = wideningLowerBounds(Util::getVariableRangeType(v)) and
+            not widenLB > truncatedLB
+          |
+            widenLB
+          )
+      else result = truncatedLB
+    )
+    or
+    // The definition might overflow positively and wrap. If so, the lower
+    // bound is `typeLowerBound`.
+    defMightOverflowPositively(def, v) and result = Util::varMinVal(v)
+  }
+
+  /** See comment for `getDefLowerBounds`, above. */
+  float getDefUpperBounds(RangeSsaDefinition def, StackVariable v) {
+    exists(float newUB, float truncatedUB |
+      newUB = getDefUpperBoundsImpl(def, v) and
+      if Util::varMinVal(v) <= newUB and newUB <= Util::varMaxVal(v)
+      then truncatedUB = newUB
+      else truncatedUB = Util::varMaxVal(v)
+    |
+      // Widening: check whether the new upper bound is from a source which
+      // depends recursively on the current definition.
+      if isRecursiveDef(def, v)
+      then
+        // The new upper bound is from a recursive source, so we round
+        // up to one of a fixed set of values to prevent the recursion
+        // from exploding.
+        result =
+          min(float widenUB |
+            widenUB = wideningUpperBounds(Util::getVariableRangeType(v)) and
+            not widenUB < truncatedUB
+          |
+            widenUB
+          )
+      else result = truncatedUB
+    )
+    or
+    // The definition might overflow negatively and wrap. If so, the upper
+    // bound is `typeUpperBound`.
+    defMightOverflowNegatively(def, v) and result = Util::varMaxVal(v)
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/Scope.qll b/cpp/common/src/codingstandards/cpp/Scope.qll
index d9a81b98e3..5438c17133 100644
--- a/cpp/common/src/codingstandards/cpp/Scope.qll
+++ b/cpp/common/src/codingstandards/cpp/Scope.qll
@@ -3,56 +3,86 @@
  */
 
 import cpp
+import codingstandards.cpp.ConstHelpers
 
 /**
- * Gets the parent scope of this `Element`, if any.
- * A scope is a `Type` (`Class` / `Enum`), a `Namespace`, a `Block`, a `Function`,
- * or certain kinds of `Statement`.
- * Differs from `Element::getParentScope` when `e` is a `LoopControlVariable`
+ * a `Variable` that is nonvolatile and const
+ * and of type `IntegralOrEnumType`
  */
-private Element getParentScope(Element e) {
-  /*
-   * A `Block` cannot have a `ForStmt` as its parent scope so we have to special case
-   * for loop bodies to ensure that identifiers inside the loop bodies have the for stmt as a parent scope.
-   * If this is not the case then `i2` in the following example cannot be in `i1`'s potential scope, because
-   * the parent scope of `i1` is the `ForStmt` while the transitive closure of the parent scope for `i2` doesn't include
-   * outer scope. Blocks can only have blocks as parent scopes.
-   * void f() {
-   *  for( int i1; ... ) {
-   *    for (int i2; ...) {
-   *    }
-   *  }
-   * }
-   */
+class NonVolatileConstIntegralOrEnumVariable extends Variable {
+  NonVolatileConstIntegralOrEnumVariable() {
+    not this.isVolatile() and
+    this.isConst() and
+    this.getUnspecifiedType() instanceof IntegralOrEnumType
+  }
+}
 
-  exists(Loop loop | loop.getStmt() = e and result = loop)
-  or
-  exists(IfStmt ifStmt |
-    (ifStmt.getThen() = e or ifStmt.getElse() = e) and
-    result = ifStmt
-  )
-  or
-  exists(SwitchStmt switchStmt | switchStmt.getStmt() = e and result = switchStmt)
-  or
-  not result.(Loop).getStmt() = e and
-  not result.(IfStmt).getThen() = e and
-  not result.(IfStmt).getElse() = e and
-  not result.(SwitchStmt).getStmt() = e and
-  if exists(e.getParentScope())
-  then result = e.getParentScope()
-  else (
-    // Statements do no have a parent scope, so return the enclosing block.
-    result = e.(Stmt).getEnclosingBlock()
+/**
+ * Internal module, exposed for testing.
+ */
+module Internal {
+  /**
+   * Gets the parent scope of this `Element`, if any.
+   * A scope is a `Type` (`Class` / `Enum`), a `Namespace`, a `Block`, a `Function`,
+   * or certain kinds of `Statement`.
+   * Differs from `Element::getParentScope` when `e` is a `LoopControlVariable`
+   */
+  Element getParentScope(Element e) {
+    /*
+     * A `Block` cannot have a `ForStmt` as its parent scope so we have to special case
+     * for loop bodies to ensure that identifiers inside the loop bodies have the for stmt as a parent scope.
+     * If this is not the case then `i2` in the following example cannot be in `i1`'s potential scope, because
+     * the parent scope of `i1` is the `ForStmt` while the transitive closure of the parent scope for `i2` doesn't include
+     * outer scope. Blocks can only have blocks as parent scopes.
+     * void f() {
+     *  for( int i1; ... ) {
+     *    for (int i2; ...) {
+     *    }
+     *  }
+     * }
+     */
+
+    exists(Loop loop | loop.getAChild() = e and result = loop)
+    or
+    exists(IfStmt ifStmt |
+      (ifStmt.getThen() = e or ifStmt.getElse() = e) and
+      result = ifStmt
+    )
+    or
+    exists(SwitchStmt switchStmt | switchStmt.getStmt() = e and result = switchStmt)
+    or
+    // A catch-block parameter, whose parent is the `Handler`
+    exists(CatchBlock c | c.getParameter() = e and result = c.getParent())
     or
-    result = e.(Expr).getEnclosingBlock()
+    // A catch-block `Handler`, whose parent is the `TryStmt`
+    e.(Handler).getParent() = result
     or
-    // Catch block parameters don't have an enclosing scope, so attach them to the
-    // the block itself
-    exists(CatchBlock cb |
-      e = cb.getParameter() and
-      result = cb
+    // The parent scope of a lambda is the scope in which the lambda expression is defined.
+    //
+    // Lambda functions are defined in a generated `Closure` class, as the `operator()` function. We choose the
+    // enclosing statement of the lambda expression as the parent scope of the lambda function. This is so we can
+    // determine the order of definition if a variable is defined in the same scope as the lambda expression.
+    exists(Closure lambdaClosure |
+      lambdaClosure.getLambdaFunction() = e and
+      lambdaClosure.getLambdaExpression().getEnclosingStmt() = result
     )
-  )
+    or
+    not exists(Loop loop | loop.getAChild() = e) and
+    not exists(IfStmt ifStmt | ifStmt.getThen() = e or ifStmt.getElse() = e) and
+    not exists(SwitchStmt switchStmt | switchStmt.getStmt() = e) and
+    not exists(CatchBlock c | c.getParameter() = e) and
+    not e instanceof Handler and
+    not exists(Closure lambdaClosure | lambdaClosure.getLambdaFunction() = e) and
+    if exists(e.getParentScope())
+    then result = e.getParentScope()
+    else (
+      // Statements do not have a parent scope, so return the enclosing block.
+      result = e.(Stmt).getEnclosingBlock()
+      or
+      // Expressions do not have a parent scope, so return the enclosing block.
+      result = e.(Expr).getEnclosingBlock()
+    )
+  }
 }
 
 /** A variable which is defined by the user, rather than being from a third party or compiler generated. */
@@ -68,19 +98,29 @@ class UserVariable extends Variable {
 
 /** An element which is the parent scope of at least one other element in the program. */
 class Scope extends Element {
-  Scope() { this = getParentScope(_) }
+  Scope() { this = Internal::getParentScope(_) }
 
-  UserVariable getAVariable() { getParentScope(result) = this }
+  UserVariable getAVariable() { Internal::getParentScope(result) = this }
+
+  /**
+   * Gets the `Variable` with the given `name` that is declared in this scope.
+   */
+  UserVariable getVariable(string name) {
+    result = getAVariable() and
+    result.getName() = name
+  }
 
   int getNumberOfVariables() { result = count(getAVariable()) }
 
   Scope getAnAncestor() { result = this.getStrictParent+() }
 
-  Scope getStrictParent() { result = getParentScope(this) }
+  Scope getAChildScope() { result.getStrictParent() = this }
+
+  Scope getStrictParent() { result = Internal::getParentScope(this) }
 
-  Declaration getADeclaration() { getParentScope(result) = this }
+  Declaration getADeclaration() { Internal::getParentScope(result) = this }
 
-  Expr getAnExpr() { this = getParentScope(result) }
+  Expr getAnExpr() { this = Internal::getParentScope(result) }
 
   private predicate getLocationInfo(
     PreprocessorBranchDirective pbd, string file1, string file2, int startline1, int startline2
@@ -112,43 +152,136 @@ class Scope extends Element {
   predicate isGenerated() { this instanceof GeneratedBlockStmt }
 
   int getDepth() {
-    exists(Scope parent | parent = getParentScope(this) and result = 1 + parent.getDepth())
+    exists(Scope parent |
+      parent = Internal::getParentScope(this) and result = 1 + parent.getDepth()
+    )
     or
-    not exists(getParentScope(this)) and result = 0
+    not exists(Internal::getParentScope(this)) and result = 0
   }
-}
 
-class GeneratedBlockStmt extends BlockStmt {
-  GeneratedBlockStmt() { this.getLocation() instanceof UnknownLocation }
-}
+  /**
+   * Holds if `name` is declared in this scope, or in a nested scope.
+   */
+  private predicate isNameDeclaredInThisOrNestedScope(string name) {
+    name = getAVariable().getName()
+    or
+    isNameDeclaredInNestedScope(name)
+  }
+
+  /**
+   * Holds if `name` is declared in a nested scope.
+   */
+  private predicate isNameDeclaredInNestedScope(string name) {
+    this.getAChildScope().isNameDeclaredInThisOrNestedScope(name)
+  }
+
+  /**
+   * Holds if `name` is declared in this scope and is hidden in a child scope.
+   */
+  private predicate isDeclaredNameHiddenByChild(string name) {
+    isNameDeclaredInNestedScope(name) and
+    name = getAVariable().getName()
+  }
+
+  /**
+   * Gets a variable with `name` which is potentially hidden in at least one nested scope.
+   */
+  private UserVariable getAPotentiallyHiddenVariable(string name) {
+    result = getAVariable() and
+    result.getName() = name and
+    isDeclaredNameHiddenByChild(name)
+  }
 
-/** Gets a variable that is in the potential scope of variable `v`. */
-private UserVariable getPotentialScopeOfVariable_candidate(UserVariable v) {
-  exists(Scope s |
-    result = s.getAVariable() and
+  /**
+   * Holds if `name` is declared above this scope and hidden by this or a nested scope.
+   */
+  UserVariable getAVariableHiddenByThisOrNestedScope(string name) {
+    exists(Scope parent | parent = this.getStrictParent() |
+      result = parent.getAPotentiallyHiddenVariable(name) or
+      result = parent.getAVariableHiddenByThisOrNestedScope(name)
+    ) and
+    isNameDeclaredInThisOrNestedScope(name)
+  }
+
+  /**
+   * Holds if `hiddenVariable` and `hidingVariable` are a candidate hiding pair at this scope.
+   */
+  private predicate hidesCandidate(
+    UserVariable hiddenVariable, UserVariable hidingVariable, string name
+  ) {
     (
-      // Variable in an ancestor scope, but only if there are less than 100 variables in this scope
-      v = s.getAnAncestor().getAVariable() and
-      s.getNumberOfVariables() < 100
+      // Declared in this scope
+      hidingVariable = getVariable(name) and
+      hiddenVariable = getAVariableHiddenByThisOrNestedScope(name)
       or
-      // In the same scope, but not the same variable, and choose just one to report
-      v = s.getAVariable() and
-      not result = v and
-      v.getName() <= result.getName()
+      // Declared in a child scope
+      exists(Scope child |
+        getAChildScope() = child and
+        child.hidesCandidate(hiddenVariable, hidingVariable, name)
+      )
     )
-  )
+  }
+
+  /**
+   * Holds if `hiddenVariable` is declared in this scope and hidden by `hidingVariable`.
+   */
+  predicate hides(UserVariable hiddenVariable, UserVariable hidingVariable, Scope childScope) {
+    exists(string name |
+      hiddenVariable = getAPotentiallyHiddenVariable(name) and
+      childScope = getAChildScope() and
+      childScope.hidesCandidate(hiddenVariable, hidingVariable, name)
+    )
+  }
 }
 
-/** Gets a variable that is in the potential scope of variable `v`. */
-private UserVariable getOuterScopesOfVariable_candidate(UserVariable v) {
-  exists(Scope s |
-    result = s.getAVariable() and
-    (
-      // Variable in an ancestor scope, but only if there are less than 100 variables in this scope
-      v = s.getAnAncestor().getAVariable() and
-      s.getNumberOfVariables() < 100
+/**
+ * A scope representing the generated `operator()` of a lambda function.
+ */
+class LambdaScope extends Scope {
+  Closure closure;
+
+  LambdaScope() { this = closure.getLambdaFunction() }
+
+  override UserVariable getAVariableHiddenByThisOrNestedScope(string name) {
+    // Handle special cases for lambdas
+    exists(UserVariable hiddenVariable, LambdaExpression lambdaExpr |
+      // Find the variable that is potentially hidden inside the lambda
+      hiddenVariable = super.getAVariableHiddenByThisOrNestedScope(name) and
+      result = hiddenVariable and
+      lambdaExpr = closure.getLambdaExpression()
+    |
+      // A definition can be hidden if it is in scope and it is captured by the lambda,
+      exists(LambdaCapture cap |
+        lambdaExpr.getACapture() = cap and
+        // The outer declaration is captured by the lambda
+        hiddenVariable.getAnAccess() = cap.getInitializer()
+      )
+      or
+      // it is is non-local,
+      hiddenVariable instanceof GlobalVariable
+      or
+      // it has static or thread local storage duration,
+      (hiddenVariable.isThreadLocal() or hiddenVariable.isStatic())
+      or
+      //it is a reference that has been initialized with a constant expression.
+      hiddenVariable.getType().stripTopLevelSpecifiers() instanceof ReferenceType and
+      hiddenVariable.getInitializer().getExpr() instanceof Literal
+      or
+      // //it const non-volatile integral or enumeration type and has been initialized with a constant expression
+      hiddenVariable instanceof NonVolatileConstIntegralOrEnumVariable and
+      hiddenVariable.getInitializer().getExpr() instanceof Literal
+      or
+      //it is constexpr and has no mutable members
+      hiddenVariable.isConstexpr() and
+      not exists(Class c |
+        c = hiddenVariable.getType() and not c.getAMember() instanceof MutableVariable
+      )
     )
-  )
+  }
+}
+
+class GeneratedBlockStmt extends BlockStmt {
+  GeneratedBlockStmt() { this.getLocation() instanceof UnknownLocation }
 }
 
 /** Holds if there exists a translation unit that includes both `f1` and `f2`. */
@@ -161,21 +294,17 @@ predicate inSameTranslationUnit(File f1, File f2) {
 }
 
 /**
- * Gets a user variable which occurs in the "potential scope" of variable `v`.
- */
-cached
-UserVariable getPotentialScopeOfVariable(UserVariable v) {
-  result = getPotentialScopeOfVariable_candidate(v) and
-  inSameTranslationUnit(v.getFile(), result.getFile())
-}
-
-/**
- * Gets a user variable which occurs in the "outer scope" of variable `v`.
+ * Holds if there exists a translation unit that includes both `f1` and `f2`.
+ *
+ * This version is late bound.
  */
-cached
-UserVariable getPotentialScopeOfVariableStrict(UserVariable v) {
-  result = getOuterScopesOfVariable_candidate(v) and
-  inSameTranslationUnit(v.getFile(), result.getFile())
+bindingset[f1, f2]
+pragma[inline_late]
+predicate inSameTranslationUnitLate(File f1, File f2) {
+  exists(TranslationUnit c |
+    c.getAUserFile() = f1 and
+    c.getAUserFile() = f2
+  )
 }
 
 /** A file that is a C/C++ source file */
@@ -203,67 +332,27 @@ class TranslationUnit extends SourceFile {
   }
 }
 
-/** Holds if `v2` may hide `v1`. */
-private predicate hides_candidate(UserVariable v1, UserVariable v2) {
-  not v1 = v2 and
-  v2 = getPotentialScopeOfVariable(v1) and
-  v1.getName() = v2.getName() and
-  // Member variables cannot hide other variables nor be hidden because the can be referenced through their qualified name.
-  not (v1.isMember() or v2.isMember())
-}
-
-/** Holds if `v2` may hide `v1`. */
-private predicate hides_candidateStrict(UserVariable v1, UserVariable v2) {
-  not v1 = v2 and
-  v2 = getPotentialScopeOfVariableStrict(v1) and
-  v1.getName() = v2.getName() and
-  // Member variables cannot hide other variables nor be hidden because the can be referenced through their qualified name.
-  not (v1.isMember() or v2.isMember()) and
-  (
-    // If v1 is a local variable, ensure that v1 is declared before v2
+/** Holds if `v2` strictly (`v2` is in an inner scope compared to `v1`) hides `v1`. */
+predicate hides_candidateStrict(UserVariable v1, UserVariable v2) {
+  exists(Scope parentScope, Scope childScope | parentScope.hides(v1, v2, childScope) |
+    // If v1 is a local variable defined in a `DeclStmt` ensure that it is declared before `v2`,
+    // otherwise it would not be hidden
     (
-      v1 instanceof LocalVariable and
-      // Ignore variables declared in conditional expressions, as they apply to
-      // the nested scope
-      not v1 = any(ConditionDeclExpr cde).getVariable() and
-      // Ignore variables declared in loops
-      not exists(Loop l | l.getADeclaration() = v1)
+      parentScope instanceof BlockStmt and
+      exists(DeclStmt ds | ds.getADeclaration() = v1) and
+      exists(parentScope.(BlockStmt).getIndexOfStmt(childScope))
     )
     implies
     exists(BlockStmt bs, DeclStmt v1Stmt, Stmt v2Stmt |
-      v1 = v1Stmt.getADeclaration() and
-      getEnclosingStmt(v2).getParentStmt*() = v2Stmt
+      bs = parentScope and
+      v2Stmt = childScope and
+      v1Stmt.getADeclaration() = v1
     |
       bs.getIndexOfStmt(v1Stmt) <= bs.getIndexOfStmt(v2Stmt)
     )
-  )
-}
-
-/**
- * Gets the enclosing statement of the given variable, if any.
- */
-private Stmt getEnclosingStmt(LocalScopeVariable v) {
-  result.(DeclStmt).getADeclaration() = v
-  or
-  exists(ConditionDeclExpr cde |
-    cde.getVariable() = v and
-    result = cde.getEnclosingStmt()
-  )
-  or
-  exists(CatchBlock cb |
-    cb.getParameter() = v and
-    result = cb.getEnclosingStmt()
-  )
-}
-
-/** Holds if `v2` hides `v1`. */
-predicate hides(UserVariable v1, UserVariable v2) {
-  hides_candidate(v1, v2) and
-  // Confirm that there's no closer candidate variable which `v2` hides
-  not exists(UserVariable mid |
-    hides_candidate(v1, mid) and
-    hides_candidate(mid, v2)
-  )
+  ) and
+  inSameTranslationUnitLate(v1.getFile(), v2.getFile()) and
+  not (v1.isMember() or v2.isMember())
 }
 
 /** Holds if `v2` strictly (`v2` is in an inner scope compared to `v1`) hides `v1`. */
@@ -291,6 +380,8 @@ predicate hasBlockScope(Declaration decl) { exists(BlockStmt b | b.getADeclarati
 /**
  * identifiers in nested (named/nonglobal) namespaces are exceptions to hiding due to being able access via fully qualified ids
  */
+bindingset[outerDecl, innerDecl]
+pragma[inline_late]
 predicate excludedViaNestedNamespaces(UserVariable outerDecl, UserVariable innerDecl) {
   exists(Namespace inner, Namespace outer |
     outer.getAChildNamespace+() = inner and
diff --git a/cpp/common/src/codingstandards/cpp/SideEffect.qll b/cpp/common/src/codingstandards/cpp/SideEffect.qll
index 68fe2cd0cd..883004e513 100644
--- a/cpp/common/src/codingstandards/cpp/SideEffect.qll
+++ b/cpp/common/src/codingstandards/cpp/SideEffect.qll
@@ -1,7 +1,7 @@
 /** A module to reason about side effects. */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 private import exceptions.ExceptionFlow
 private import codingstandards.cpp.Expr
 private import codingstandards.cpp.Variable
diff --git a/cpp/common/src/codingstandards/cpp/SmartPointers.qll b/cpp/common/src/codingstandards/cpp/SmartPointers.qll
index dda645a399..a643b0bc2b 100644
--- a/cpp/common/src/codingstandards/cpp/SmartPointers.qll
+++ b/cpp/common/src/codingstandards/cpp/SmartPointers.qll
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 
 // Local cached version of localExprFlow to avoid bad magic
 cached
diff --git a/cpp/common/src/codingstandards/cpp/StdFunctionOrMacro.qll b/cpp/common/src/codingstandards/cpp/StdFunctionOrMacro.qll
new file mode 100644
index 0000000000..ec4873d20e
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/StdFunctionOrMacro.qll
@@ -0,0 +1,200 @@
+/**
+ * This module intends to reduce the difficulty of handling the pattern where implementations
+ * implement a function as a macro: the class `StdFunctionOrMacro<...>::Call` matches both std
+ * function calls as well as std function macro expansions.
+ *
+ * For instance, `atomic_init` may be implemented as a function, but is also implemented as a
+ * complicated macro on some platforms. This module aids in finding calls to any standard function
+ * which may be a macro.
+ *
+ * Since a macro can be defined to expand to any expression, we cannot know generally which
+ * expanded expressions in `f(x, y)` correspond to arguments `x` or `y`. To handle this, implement
+ * the module `InferMacroExpansionArguments`.
+ *
+ * To match a function of a particular name create a predicate for the name you wish to match. For
+ * instance:
+ *
+ * ```codeql
+ *   private string atomicInit() { result = "atomic_init" }
+ *
+ *   from StdFunctionOrMacro<YourInferenceModule, atomicInit/0>::Call c
+ *   select c.getArgument(0)
+ * ```
+ */
+
+import cpp as cpp
+
+private string atomicInit() { result = "atomic_init" }
+
+class AtomicInitCall = StdFunctionOrMacro<InferAtomicMacroArgs, atomicInit/0>::Call;
+
+/** Specify the name of your function as a predicate */
+private signature string getName();
+
+/** Signature module to implement custom argument resolution behavior in expanded macros */
+private signature module InferMacroExpansionArguments {
+  bindingset[mi, argumentIdx]
+  cpp::Expr inferArgument(cpp::MacroInvocation mi, int argumentIdx);
+}
+
+private module InferAtomicMacroArgs implements InferMacroExpansionArguments {
+  bindingset[pattern]
+  private cpp::Expr getMacroVarInitializer(cpp::MacroInvocation mi, string pattern) {
+    exists(cpp::VariableDeclarationEntry decl |
+      mi.getAGeneratedElement() = decl and
+      decl.getName().matches(pattern) and
+      result = decl.getDeclaration().getInitializer().getExpr()
+    )
+  }
+
+  bindingset[mi, argumentIdx]
+  cpp::Expr inferArgument(cpp::MacroInvocation mi, int argumentIdx) {
+    result = mi.getExpr().(cpp::FunctionCall).getArgument(argumentIdx)
+    or
+    if
+      argumentIdx = 0 and
+      exists(getMacroVarInitializer(mi, "__atomic_%_ptr"))
+    then result = getMacroVarInitializer(mi, "__atomic_%_ptr")
+    else
+      if
+        argumentIdx = [1, 2] and
+        exists(getMacroVarInitializer(mi, "__atomic_%_tmp"))
+      then result = getMacroVarInitializer(mi, "__atomic_%_tmp")
+      else
+        exists(cpp::FunctionCall fc |
+          fc = mi.getAnExpandedElement() and
+          fc.getTarget().getName().matches("%atomic_%") and
+          result = fc.getArgument(argumentIdx)
+        )
+  }
+}
+
+private string atomicReadOrWriteName() {
+  result =
+    [
+        "atomic_load",
+        "atomic_store",
+        "atomic_fetch_" + ["add", "sub", "or", "xor", "and"],
+        "atomic_exchange",
+        "atomic_compare_exchange_" + ["strong", "weak"]
+      ] + ["", "_explicit"]
+}
+
+class AtomicReadOrWriteCall =
+  StdFunctionOrMacro<InferAtomicMacroArgs, atomicReadOrWriteName/0>::Call;
+
+private string atomicallySequencedName() {
+  result =
+    [
+      "atomic_thread_fence",
+      "atomic_signal_fence",
+      "atomic_flag_clear_explicit",
+      "atomic_flag_test_and_set_explicit",
+    ]
+  or
+  result = atomicReadOrWriteName() and
+  result.matches("%_explicit")
+}
+
+/** A `stdatomic.h` function which accepts a `memory_order` value as a parameter. */
+class AtomicallySequencedCall extends StdFunctionOrMacro<InferAtomicMacroArgs, atomicallySequencedName/0>::Call
+{
+  cpp::Expr getAMemoryOrderArgument() {
+    if getName() = "atomic_compare_exchange_" + ["strong", "weak"] + "_explicit"
+    then result = getArgument(getNumberOfArguments() - [1, 2])
+    else result = getArgument(getNumberOfArguments() - 1)
+  }
+}
+
+/**
+ * A module to find calls to standard functions, or expansions of macros with the same name.
+ *
+ * To use this module, specify a name predicate and an inference strategy for correlating macro
+ * expansions to macro arguments.
+ *
+ * For example:
+ *
+ * ```codeql
+ *   private string atomicInit() { result = "atomic_init" }
+ *   from StdFunctionOrMacro<YourInferenceModule, atomicInit/0>::Call c
+ *   select c.getArgument(0)
+ * ```
+ */
+private module StdFunctionOrMacro<InferMacroExpansionArguments InferExpansion, getName/0 getStdName>
+{
+  final private class Expr = cpp::Expr;
+
+  final private class FunctionCall = cpp::FunctionCall;
+
+  final private class MacroInvocation = cpp::MacroInvocation;
+
+  private newtype TStdCall =
+    TStdFunctionCall(FunctionCall fc) { fc.getTarget().hasName(getStdName()) } or
+    TStdMacroInvocation(MacroInvocation mi) { mi.getMacro().hasName(getStdName()) }
+
+  /**
+   * A call to a standard function or an expansion of a macro with the same name.
+   */
+  class Call extends TStdCall {
+    bindingset[this, argumentIdx]
+    Expr getArgument(int argumentIdx) {
+      exists(FunctionCall fc |
+        this = TStdFunctionCall(fc) and
+        result = fc.getArgument(argumentIdx)
+      )
+      or
+      exists(MacroInvocation mi |
+        this = TStdMacroInvocation(mi) and
+        result = InferExpansion::inferArgument(mi, argumentIdx)
+      )
+    }
+
+    Expr getAnArgument() {
+      exists(int i |
+        i = [0 .. getNumberOfArguments()] and
+        result = getArgument(i)
+      )
+    }
+
+    string getName() {
+      exists(FunctionCall fc |
+        this = TStdFunctionCall(fc) and
+        result = fc.getTarget().getName()
+      )
+      or
+      exists(MacroInvocation mi |
+        this = TStdMacroInvocation(mi) and
+        result = mi.getMacroName()
+      )
+    }
+
+    string toString() {
+      this = TStdFunctionCall(_) and
+      result = "Standard function call"
+      or
+      this = TStdMacroInvocation(_) and
+      result = "Invocation of a standard function implemented as a macro"
+    }
+
+    int getNumberOfArguments() {
+      exists(FunctionCall fc |
+        this = TStdFunctionCall(fc) and
+        result = fc.getTarget().getNumberOfParameters()
+      )
+      or
+      exists(MacroInvocation mi |
+        this = TStdMacroInvocation(mi) and
+        result = count(int i | i = [0 .. 10] and exists(InferExpansion::inferArgument(mi, i)))
+      )
+    }
+
+    Expr getExpr() {
+      this = TStdFunctionCall(result)
+      or
+      exists(MacroInvocation mi |
+        this = TStdMacroInvocation(mi) and
+        result = mi.getExpr()
+      )
+    }
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/Type.qll b/cpp/common/src/codingstandards/cpp/Type.qll
index 4199b4a12d..052096559a 100644
--- a/cpp/common/src/codingstandards/cpp/Type.qll
+++ b/cpp/common/src/codingstandards/cpp/Type.qll
@@ -1,72 +1,2 @@
-/**
- * A module for representing different `Type`s.
- */
-
-import cpp
-
-/**
- * A fundamental type, as defined by `[basic.fundamental]`.
- */
-class FundamentalType extends BuiltInType {
-  FundamentalType() {
-    // A fundamental type is any `BuiltInType` except types indicating errors during extraction, or
-    // "unknown" types inserted into uninstantiated templates
-    not this instanceof ErroneousType and
-    not this instanceof UnknownType
-  }
-}
-
-/**
- * A type that is incomplete.
- */
-class IncompleteType extends Class {
-  IncompleteType() { not hasDefinition() }
-}
-
-/**
- * A type that implements the BitmaskType trait.
- * https://en.cppreference.com/w/cpp/named_req/BitmaskType
- */
-abstract class BitmaskType extends Type { }
-
-/**
- * Holds if `enum` implements required overload `overload` to implement
- * the BitmaskType trait.
- */
-private predicate isRequiredEnumOverload(Enum enum, Function overload) {
-  overload.getName().regexpMatch("operator([&|^~]|&=|\\|=)") and
-  forex(Parameter p | p = overload.getAParameter() |
-    (
-      p.getType() = enum
-      or
-      p.getType().(ReferenceType).getBaseType() = enum
-    )
-  )
-}
-
-private class EnumBitmaskType extends BitmaskType, Enum {
-  EnumBitmaskType() {
-    // Implements all the required overload
-    count(Function overload | isRequiredEnumOverload(this, overload)) = 6
-  }
-}
-
-/**
- * A type without `const` and `volatile` specifiers.
- */
-Type stripSpecifiers(Type type) {
-  if type instanceof SpecifiedType
-  then result = stripSpecifiers(type.(SpecifiedType).getBaseType())
-  else result = type
-}
-
-/**
- * Get the precision of an integral type, where precision is defined as the number of bits
- * that can be used to represent the numeric value.
- * https://wiki.sei.cmu.edu/confluence/display/c/INT35-C.+Use+correct+integer+precisions
- */
-int getPrecision(IntegralType type) {
-  type.isExplicitlyUnsigned() and result = type.getSize() * 8
-  or
-  type.isExplicitlySigned() and result = type.getSize() * 8 - 1
-}
+import codingstandards.cpp.types.Type
+import codingstandards.cpp.types.Uses
diff --git a/cpp/common/src/codingstandards/cpp/alertreporting/DeduplicateMacroResults.qll b/cpp/common/src/codingstandards/cpp/alertreporting/DeduplicateMacroResults.qll
new file mode 100644
index 0000000000..b41de3ef9a
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/alertreporting/DeduplicateMacroResults.qll
@@ -0,0 +1,426 @@
+import codingstandards.cpp.AlertReporting
+
+/**
+ * A configuration for deduplicating query results inside of macros.
+ *
+ * See doc comment on `DeduplicateMacroResults` module.
+ */
+signature module DeduplicateMacroConfigSig<ResultType ResultElement> {
+  /**
+   * Stringify the `ResultElement`. All `ResultElement`s that share an "identity" should stringify
+   * to the same string to get proper results.
+   */
+  string describe(ResultElement re);
+}
+
+/**
+ * A configuration for generating reports from reports that may or may not be duplicated across
+ * macro expansions.
+ *
+ * See doc comment on `DeduplicateMacroResults` module.
+ *
+ * This signature is used to parameterize the module `DeduplicateMacroResults::Report`.
+ */
+signature module MacroReportConfigSig<ResultType ResultElement> {
+  /* Create a message to describe this macro, with a string describing its `ResultElement`. */
+  bindingset[description]
+  string getMessageSameResultInAllExpansions(Macro m, string description);
+
+  /* Create a message to describe this macro, using '$@' to describe an example `ResultElement`. */
+  string getMessageVariedResultInAllExpansions(Macro m);
+
+  /**
+   * Create a message to describe this macro expansion which produces a `ResultElement`, using '$@'
+   * to describe the relevant macro.
+   */
+  string getMessageResultInIsolatedExpansion(ResultElement element);
+
+  /**
+   * Create a message to describe a `ResultElement` which is not generated by a macro expansion.
+   */
+  string getMessageNotInMacro(ResultElement element, Locatable optExtraLoc1, string optExtraStr1);
+}
+
+/**
+ * A module for taking the results of `MacroUnwrapper<T>` and consolidating them.
+ *
+ * The module `MacroUnwrapper<T>` is great for simple alerts such as usage of banned functions. In
+ * such cases, reporting "call to 'foo()' in macro 'M'" will only have one result even if the macro
+ * is expanded multiple times.
+ *
+ * However, other queries may have a dynamic message which can vary per macro call site due to
+ * token manipulation (`a ## b`), for instance, "Macro 'M' defines unused object 'generated_name_x'"
+ * which will lead to hundreds of results if there are hundreds of such generated names.
+ *
+ * This module can be used to find and easily report non-compliant behavior, grouped by the macro
+ * it originates in, regardless of whether the messages will exactly match.
+ *
+ * ## General Usage
+ *
+ * To use this macro, define a class for the relevant behavior, and a means of stringifying
+ * relevant elements as a config, to parameterize the `DeduplicateMacroResults` module.
+ *
+ * ```
+ *   class InvalidFoo extends Foo {
+ *     InvalidFoo() { ... }
+ *   }
+ *
+ *   module DeduplicateFooInMacrosConfig implements DeduplicateMacroConfigSig<InvalidFoo> {
+ *     string describe(InvalidFoo foo) { result = ... }
+ *   }
+ *
+ *   import DeduplicateMacroResults<InvalidFoo, DeduplicateFooInMacrosConfig> as DeduplicateFooInMacros;
+ * ```
+ *
+ * This module exposes the following classes:
+ *  - `PrimaryMacroSameResultElementInAllInvocations extends Macro`: Every invocation of this macro
+ *    generates an `InvalidFoo` which stringifies to the same thing. Use the method
+ *    `getResultElementDescription()` to get that shared string.
+ *  - `PrimaryMacroDifferentResultElementInAllInvocations extends Macro`: Every invocation of this
+ *    macro generates an `InvalidFoo`, but they do not all stringify to the same thing. Use the
+ *    method `getExampleResultElement()` to get an *single* example `InvalidFoo` to help users fix
+ *    and understand the issue.
+ *  - `IsolatedMacroExpansionWithResultElement extends MacroInvocation`: An invocation of a macro
+ *    which in this particular instance generates an `InvalidFoo`, while other invocations of the
+ *    same macro do not.
+ *
+ * The three above classes all attempt to resolve to the most *specific* macro to the issue at
+ * hand. For instance, if macro `M1` calls macro `M2` which expands to an `InvalidFoo`, then the
+ * problem may be with `M2` (it is the most specific macro call here), or the problem may be with
+ * `M2` (if all expansions of `M2` generate an `InvalidFoo` but not all expansions of `M1` do so).
+ *
+ * ## Generating Report Objects
+ *
+ * This module also can be used to more easily report issues across these cases, by implementing
+ * `MacroReportConfigSig` and importing `DeduplicateMacroResults::Report::ReportResult`.
+ *
+ * ```
+ *   module InvalidFooInMacroReportConfig implements MacroReportConfigSig<InvalidFoo> {
+ *
+ *     // ***Take care that usage of $@ is correct in the following predicates***!!!!
+ *     bindingset[description]
+ *     string getMessageSameResultInAllExpansions(Macro m, string description) {
+ *       result = "Macro " + m.getName() + " always has invalid foo " + description
+ *     }
+ *
+ *     string getMessageVariedResultInAllExpansions(Macro m) {
+ *       result = "Macro " + m.getName() + " always has invalid foo, for example '$@'."
+ *     }
+ *
+ *     string getMessageResultInIsolatedExpansion(InvalidFoo foo) {
+ *       result = "Invocation of macro $@ has invalid foo '" + foo.getName() + "'."
+ *     }
+ *
+ *     string getMessageNotInMacro(ResultElement element) {
+ *       result = "Invalid foo '" + element.getName() + "'."
+ *     }
+ *   }
+ *
+ *   import DeduplicateFooInMacros::Report<InvalidFooInMacroReportConfig> as Report;
+ *
+ *   from Report::ReportResult report
+ *     where not excluded(report.getPrimaryElement(), ...)
+ *   select report.getPrimaryElement(), report.getMessage(), report.getOptionalPlaceholderLocatable(),
+ *     report.getOptionalPlaceholderMessage()
+ * ```
+ *
+ * Note that this does *not* (currently) generate a result for elements not contained by a macro.
+ * To do report such cases, either add support for that in this module, or write a separate query
+ * that reports `InvalidFoo` cases where not `.isInMacroExpansion()`.
+ */
+module DeduplicateMacroResults<
+  ResultType ResultElement, DeduplicateMacroConfigSig<ResultElement> Config>
+{
+  /* A final class so that we may extend Macro. */
+  final private class FinalMacro = Macro;
+
+  /* Helper final class import so that we may reference/extend it. */
+  final private class ResultMacroExpansion = MacroUnwrapper<ResultElement>::ResultMacroExpansion;
+
+  /**
+   * A macro for which all of its invocations produce an element that is described the same way.
+   *
+   * This is not necessarily the "primary" / most specific macro for these result elements.
+   * This difference is captured in `PrimarySameResultElementInAllMacroInvocations`, and the two
+   * classes are only separate to avoid non-monotonic recursion.
+   */
+  private class SameResultElementInAllMacroInvocations extends FinalMacro {
+    string resultElementDescription;
+
+    SameResultElementInAllMacroInvocations() {
+      forex(MacroInvocation mi | mi = getAnInvocation() |
+        Config::describe(mi.(ResultMacroExpansion).getResultElement()) = resultElementDescription
+      )
+    }
+
+    string getResultElementDescription() { result = resultElementDescription }
+
+    ResultElement getAResultElement() {
+      result = getAnInvocation().(ResultMacroExpansion).getResultElement()
+    }
+  }
+
+  /**
+   * A macro for which all of its invocations produce an element that is described the same way.
+   *
+   * This is the necessarily the "primary" / most specific macro for these result elements.
+   */
+  class PrimaryMacroSameResultElementInAllInvocations extends SameResultElementInAllMacroInvocations
+  {
+    PrimaryMacroSameResultElementInAllInvocations() {
+      not exists(MacroInvocation inner |
+        inner.getParentInvocation() = getAnInvocation() and
+        inner.getMacro() instanceof SameResultElementInAllMacroInvocations
+      )
+    }
+  }
+
+  /**
+   * A expansion that generates a `ResultElement` that is uniquely described by the config.
+   *
+   * This is used so that we can find a single example invocation site to report as an example for
+   * macros which generate an array of different `ResultElement`s that are described differently.
+   *
+   * For example, two macro invocations may be given the same arguments, and generate the same
+   * `ResultElement`, while a third macro invocation is unique and generates a unique
+   * `ResultElement`. We wish to direct the user to that unique example or we will show the user
+   * two different reports for one underlying issue.
+   */
+  private class UniqueResultMacroExpansion extends ResultMacroExpansion {
+    UniqueResultMacroExpansion() {
+      not exists(ResultMacroExpansion other |
+        not this = other and
+        this.getMacroName() = other.getMacroName() and
+        Config::describe(this.getResultElement()) = Config::describe(other.getResultElement())
+      )
+    }
+  }
+
+  /**
+   * A macro for which all of its invocations produce an element, but they are not all described the
+   * same way.
+   *
+   * This is not necessarily the "primary" / most specific macro for these result elements.
+   * This difference is captured in `PrimaryDiferentResultElementInAllMacroInvocations`, and the two
+   * classes are only separate to avoid non-monotonic recursion.
+   */
+  private class DifferentResultElementInAllMacroInvocations extends FinalMacro {
+    ResultElement exampleResultElement;
+
+    DifferentResultElementInAllMacroInvocations() {
+      forex(MacroInvocation mi | mi = getAnInvocation() | mi instanceof ResultMacroExpansion) and
+      count(getAnInvocation().(ResultMacroExpansion).getResultElement()) > 1 and
+      exists(string description |
+        description =
+          rank[1](Config::describe(getAnInvocation().(UniqueResultMacroExpansion).getResultElement())
+          ) and
+        Config::describe(exampleResultElement) = description and
+        exampleResultElement = getAnInvocation().(ResultMacroExpansion).getResultElement()
+      )
+    }
+
+    ResultElement getExampleResultElement() { result = exampleResultElement }
+
+    ResultElement getAResultElement() {
+      result = getAnInvocation().(ResultMacroExpansion).getResultElement()
+    }
+  }
+
+  /**
+   * A macro for which all of its invocations produce an element, but they are not all described the
+   * same way.
+   *
+   * This is "primary" / most specific macro for these result elements.
+   */
+  class PrimaryMacroDifferentResultElementInAllInvocations extends DifferentResultElementInAllMacroInvocations
+  {
+    PrimaryMacroDifferentResultElementInAllInvocations() {
+      not exists(MacroInvocation inner |
+        inner.getParentInvocation() = getAnInvocation() and
+        inner.getMacro() instanceof DifferentResultElementInAllMacroInvocations
+      )
+    }
+  }
+
+  /**
+   * Convenience predicate to know when invalid macro expansions have been reported at their macro
+   * definition.
+   */
+  private predicate reported(Macro macro) {
+    macro instanceof PrimaryMacroSameResultElementInAllInvocations or
+    macro instanceof PrimaryMacroDifferentResultElementInAllInvocations
+  }
+
+  /**
+   * A macro invocation for which the target macro does not always produce a `ResultElement`, but
+   * this specific invocation of it does.
+   *
+   * This is the "primary" / most specific macro for these result elements. It also does not match
+   * `MacroInvocation`s inside of a `MacroInvocation` of a `Macro` which always produces a
+   * `ResultElement`, indicating that the real problem lies with that other `Macro` instead of with
+   * this particular invocation.
+   */
+  class IsolatedMacroExpansionWithResultElement extends ResultMacroExpansion {
+    IsolatedMacroExpansionWithResultElement() {
+      not reported(getParentInvocation*().getMacro()) and
+      not exists(MacroInvocation inner |
+        reported(inner.getMacro()) and
+        inner.getParentInvocation*() = this
+      ) and
+      not exists(ResultMacroExpansion moreSpecific |
+        moreSpecific.getResultElement() = getResultElement() and
+        moreSpecific.getParentInvocation+() = this
+      )
+    }
+  }
+
+  /**
+   * A module for generating reports across the various cases of problematic macros, problematic
+   * macro invocations.
+   *
+   * See the doc comment for the `DeduplicateMacroResults` module for more info.
+   */
+  module Report<MacroReportConfigSig<ResultElement> ReportConfig> {
+    newtype TReportResult =
+      TReportMacroResultWithSameName(PrimaryMacroSameResultElementInAllInvocations def) or
+      TReportMacroResultWithVariedName(PrimaryMacroDifferentResultElementInAllInvocations def) or
+      TReportIsolatedMacroResult(IsolatedMacroExpansionWithResultElement def) or
+      TReportNotInMacro(ResultElement def) {
+        not exists(ResultMacroExpansion macroExpansion | macroExpansion.getResultElement() = def)
+      }
+
+    /**
+     * An instance of a `ResultElement` to be reported to a user.
+     *
+     * To show a report, use the following methods:
+     *  - `report.getPrimaryElement()`
+     *  - `report.getMessage()`
+     *  - `report.getOptionalPlaceholderLocatable()`
+     *  - `report.getOptionalPlaceholderMessage()`
+     *
+     * The values returned by these methods are configured by the `MacroReportConfigSig`
+     * signature parameter.
+     */
+    class ReportResult extends TReportResult {
+      string toString() {
+        this = TReportMacroResultWithVariedName(_) and
+        result =
+          "Macro that always expands to a result element with invocation-dependent description"
+        or
+        this = TReportMacroResultWithSameName(_) and
+        result = "Macro that always expands to a result element with a constant description"
+        or
+        this = TReportIsolatedMacroResult(_) and
+        result =
+          "Specific macro expansion which produces a result element, but not all expansions do"
+        or
+        this = TReportNotInMacro(_) and
+        result = "Result element that is not in a macro"
+      }
+
+      string getMessage() {
+        exists(PrimaryMacroDifferentResultElementInAllInvocations def |
+          this = TReportMacroResultWithVariedName(def) and
+          result = ReportConfig::getMessageVariedResultInAllExpansions(def)
+        )
+        or
+        exists(PrimaryMacroSameResultElementInAllInvocations def |
+          this = TReportMacroResultWithSameName(def) and
+          result =
+            ReportConfig::getMessageSameResultInAllExpansions(def, def.getResultElementDescription())
+        )
+        or
+        exists(IsolatedMacroExpansionWithResultElement def |
+          this = TReportIsolatedMacroResult(def) and
+          result = ReportConfig::getMessageResultInIsolatedExpansion(def.getResultElement())
+        )
+        or
+        exists(ResultElement def |
+          this = TReportNotInMacro(def) and
+          result = ReportConfig::getMessageNotInMacro(def, _, _)
+        )
+      }
+
+      Element getPrimaryElement() {
+        this = TReportMacroResultWithSameName(result)
+        or
+        this = TReportMacroResultWithVariedName(result)
+        or
+        this = TReportIsolatedMacroResult(result)
+        or
+        this = TReportNotInMacro(result)
+      }
+
+      Locatable getOptionalPlaceholderLocatable() {
+        exists(PrimaryMacroDifferentResultElementInAllInvocations def |
+          this = TReportMacroResultWithVariedName(def) and
+          result = def.getExampleResultElement()
+        )
+        or
+        exists(PrimaryMacroSameResultElementInAllInvocations def |
+          this = TReportMacroResultWithSameName(def) and
+          result = def
+        )
+        or
+        exists(IsolatedMacroExpansionWithResultElement def |
+          this = TReportIsolatedMacroResult(def) and
+          result = def.getMacro()
+        )
+        or
+        exists(ResultElement def |
+          this = TReportNotInMacro(def) and
+          exists(ReportConfig::getMessageNotInMacro(def, result, _))
+        )
+      }
+
+      string getOptionalPlaceholderMessage() {
+        exists(PrimaryMacroDifferentResultElementInAllInvocations def |
+          this = TReportMacroResultWithVariedName(def) and
+          result = Config::describe(def.getExampleResultElement())
+        )
+        or
+        this = TReportMacroResultWithSameName(_) and
+        result = "(ignored)"
+        or
+        this = TReportIsolatedMacroResult(_) and
+        result = getMacro().getName()
+        or
+        exists(ResultElement def |
+          this = TReportNotInMacro(def) and
+          exists(ReportConfig::getMessageNotInMacro(def, _, result))
+        )
+      }
+
+      Macro getMacro() {
+        this = TReportMacroResultWithVariedName(result)
+        or
+        this = TReportMacroResultWithSameName(result)
+        or
+        exists(IsolatedMacroExpansionWithResultElement def |
+          this = TReportIsolatedMacroResult(def) and
+          result = def.getMacro()
+        )
+      }
+
+      ResultMacroExpansion getAResultMacroExpansion() {
+        exists(PrimaryMacroDifferentResultElementInAllInvocations def |
+          this = TReportMacroResultWithVariedName(def) and
+          result = def.getAnInvocation()
+        )
+        or
+        exists(PrimaryMacroSameResultElementInAllInvocations def |
+          this = TReportMacroResultWithSameName(def) and
+          result = def.getAnInvocation()
+        )
+        or
+        this = TReportIsolatedMacroResult(result)
+      }
+
+      ResultElement getAResultElement() {
+        result = getAResultMacroExpansion().getResultElement()
+        or
+        this = TReportNotInMacro(result)
+      }
+    }
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/allocations/PlacementNew.qll b/cpp/common/src/codingstandards/cpp/allocations/PlacementNew.qll
index 5547f2e151..2c9139d0ae 100644
--- a/cpp/common/src/codingstandards/cpp/allocations/PlacementNew.qll
+++ b/cpp/common/src/codingstandards/cpp/allocations/PlacementNew.qll
@@ -22,7 +22,7 @@
 
 import cpp
 import codingstandards.cpp.Conversion
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 /*
  * TODO You can also have alignas on types
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/Atomic.qll b/cpp/common/src/codingstandards/cpp/concurrency/Atomic.qll
new file mode 100644
index 0000000000..44101f08bb
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/Atomic.qll
@@ -0,0 +1,43 @@
+import cpp
+
+/**
+ * Models calls to routines `atomic_compare_exchange_weak` and
+ * `atomic_compare_exchange_weak_explicit` in the `stdatomic` library.
+ * Note that these are typically implemented as macros within Clang and
+ * GCC's standard libraries.
+ */
+class AtomicCompareExchange extends MacroInvocation {
+  AtomicCompareExchange() {
+    getMacroName() = "atomic_compare_exchange_weak"
+    or
+    // some compilers model `atomic_compare_exchange_weak` as a macro that
+    // expands to `atomic_compare_exchange_weak_explicit` so this defeats that
+    // and other similar modeling.
+    getMacroName() = "atomic_compare_exchange_weak_explicit" and
+    not exists(MacroInvocation m |
+      m.getMacroName() = "atomic_compare_exchange_weak" and
+      m.getAnExpandedElement() = getAnExpandedElement()
+    )
+  }
+}
+
+/**
+ * Models calls to routines `atomic_store` and
+ * `atomic_store_explicit` in the `stdatomic` library.
+ * Note that these are typically implemented as macros within Clang and
+ * GCC's standard libraries.
+ */
+class AtomicStore extends MacroInvocation {
+  AtomicStore() {
+    getMacroName() = "atomic_store"
+    or
+    // some compilers model `atomic_compare_exchange_weak` as a macro that
+    // expands to `atomic_compare_exchange_weak_explicit` so this defeats that
+    // and other similar modeling.
+    getMacroName() = "atomic_store_explicit" and
+    not exists(MacroInvocation m |
+      m.getMacroName() = "atomic_store" and
+      m.getAnExpandedElement() = getAnExpandedElement()
+    )
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/CConditionOperation.qll b/cpp/common/src/codingstandards/cpp/concurrency/CConditionOperation.qll
new file mode 100644
index 0000000000..adf230f08d
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/CConditionOperation.qll
@@ -0,0 +1,31 @@
+import cpp
+
+/**
+ * Models a function which uses a c condition variable. Not integrated into the thread aware CFG.
+ */
+class CConditionOperation extends FunctionCall {
+  CConditionOperation() {
+    getTarget().hasName(["cnd_broadcast", "cnd_signal", "cnd_timedwait", "cnd_wait", "cnd_init"])
+  }
+
+  predicate isInit() { getTarget().hasName("cnd_init") }
+
+  predicate isUse() { not isInit() }
+
+  Expr getConditionExpr() { result = getArgument(0) }
+
+  /* Note: only holds for `cnd_wait()` and `cnd_timedwait()` */
+  Expr getMutexExpr() { result = getArgument(1) }
+}
+
+/**
+ * Models C style condition destruction via `cnd_destroy`.
+ */
+class C11ConditionDestroyer extends FunctionCall {
+  C11ConditionDestroyer() { getTarget().getName() = "cnd_destroy" }
+
+  /**
+   * Returns the `Expr` being destroyed.
+   */
+  Expr getConditionExpr() { result = getArgument(0) }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/ConditionalWait.qll b/cpp/common/src/codingstandards/cpp/concurrency/ConditionalWait.qll
new file mode 100644
index 0000000000..e69ea2fee5
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/ConditionalWait.qll
@@ -0,0 +1,26 @@
+import cpp
+
+/**
+ * Models a function that conditionally waits.
+ */
+abstract class ConditionalWait extends FunctionCall { }
+
+/**
+ * Models a function in CPP that will conditionally wait.
+ */
+class CPPConditionalWait extends ConditionalWait {
+  CPPConditionalWait() {
+    exists(MemberFunction mf |
+      mf = getTarget() and
+      mf.getDeclaringType().hasQualifiedName("std", "condition_variable") and
+      mf.getName() in ["wait", "wait_for", "wait_until"]
+    )
+  }
+}
+
+/**
+ * Models a function in C that will conditionally wait.
+ */
+class CConditionalWait extends ConditionalWait {
+  CConditionalWait() { getTarget().getName() in ["cnd_wait"] }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/ControlFlow.qll b/cpp/common/src/codingstandards/cpp/concurrency/ControlFlow.qll
new file mode 100644
index 0000000000..15f8ab5a61
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/ControlFlow.qll
@@ -0,0 +1,101 @@
+import cpp
+private import codingstandards.cpp.concurrency.ThreadedFunction
+
+/**
+ * Models a control flow node within a function that may be executed by some
+ * thread.
+ */
+class ThreadedCFN extends ControlFlowNode {
+  ThreadedCFN() {
+    exists(ThreadedFunction tf | this = getAThreadContextAwareSuccessor(tf.getEntryPoint()))
+  }
+}
+
+/**
+ * Models CFG nodes which should be added to a thread context.
+ */
+abstract class ThreadedCFGPathExtension extends ControlFlowNode {
+  /**
+   * Returns the next `ControlFlowNode` in this thread context.
+   */
+  abstract ControlFlowNode getNext();
+}
+
+/**
+ * Models a `FunctionCall` invoked from a threaded context.
+ */
+class ThreadContextFunctionCall extends FunctionCall, ThreadedCFGPathExtension {
+  override ControlFlowNode getNext() { getTarget().getEntryPoint() = result }
+}
+
+/**
+ * Models a specialized `FunctionCall` that may create a thread.
+ */
+abstract class ThreadCreationFunction extends FunctionCall, ThreadedCFGPathExtension {
+  /**
+   * Returns the function that will be invoked.
+   */
+  abstract Function getFunction();
+}
+
+/**
+ * The thread-aware predecessor function is defined in terms of the thread aware
+ * successor function. This is because it is simpler to construct the forward
+ * paths of a thread's execution than the backwards paths. For this reason we
+ * require a `start` and `end` node.
+ *
+ * The logic of this function is that a thread aware predecessor is one that
+ * follows a `start` node, is not equal to the ending node, and does not follow
+ * the `end` node. Such nodes can only be predecessors of `end`.
+ *
+ * For this reason this function requires a `start` node from which to start
+ * considering something a predecessor of `end`.
+ */
+pragma[inline]
+ControlFlowNode getAThreadContextAwarePredecessor(ControlFlowNode start, ControlFlowNode end) {
+  result = getAThreadContextAwareSuccessor(start) and
+  not result = getAThreadContextAwareSuccessor(end) and
+  not result = end
+}
+
+/**
+ * A predicate for finding successors of `ControlFlowNode`s that are aware of
+ * the objects that my flow into a thread's context. This is achieved by adding
+ * additional edges to thread entry points and function calls.
+ */
+ControlFlowNode getAThreadContextAwareSuccessorR(ControlFlowNode cfn) {
+  result = cfn.getASuccessor()
+  or
+  result = cfn.(ThreadedCFGPathExtension).getNext()
+}
+
+ControlFlowNode getAThreadContextAwareSuccessor(ControlFlowNode m) {
+  result = getAThreadContextAwareSuccessorR*(m) and
+  // for performance reasons we handle back edges by enforcing a lexical
+  // ordering restriction on these nodes if they are both in
+  // the same loop. One way of doing this is as follows:
+  //
+  // ````and (
+  //   exists(Loop loop |
+  //     loop.getAChild*() = m and
+  //     loop.getAChild*() = result
+  //   )
+  //   implies
+  //   not result.getLocation().isBefore(m.getLocation())
+  // )```
+  // In this implementation we opt for the more generic form below
+  // which seems to have reasonable performance.
+  (
+    m.getEnclosingStmt().getParentStmt*() = result.getEnclosingStmt().getParentStmt*()
+    implies
+    not exists(Location l1, Location l2 |
+      l1 = result.getLocation() and
+      l2 = m.getLocation()
+    |
+      l1.getEndLine() < l2.getStartLine()
+      or
+      l1.getStartLine() = l2.getEndLine() and
+      l1.getEndColumn() < l2.getStartColumn()
+    )
+  )
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/LockProtectedControlFlow.qll b/cpp/common/src/codingstandards/cpp/concurrency/LockProtectedControlFlow.qll
new file mode 100644
index 0000000000..a828ec8768
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/LockProtectedControlFlow.qll
@@ -0,0 +1,49 @@
+import cpp
+private import codingstandards.cpp.concurrency.ControlFlow
+private import codingstandards.cpp.concurrency.LockingOperation
+
+/**
+ * Models a `ControlFlowNode` that is protected by some sort of lock.
+ */
+class LockProtectedControlFlowNode extends ThreadedCFN {
+  FunctionCall lockingFunction;
+
+  LockProtectedControlFlowNode() {
+    exists(LockingOperation lock |
+      // there is a node that is a lock
+      lockingFunction = lock and
+      lock.isLock() and
+      // this node should be a successor of this lock
+      this = getAThreadContextAwareSuccessor(lock) and
+      // and there should not exist a predecessor of this
+      // node that is an unlock. Since we are doing thread context
+      // aware tracking it is easier to go forwards than backwards
+      // in constructing the call graph. Thus we can define predecessor
+      // in terms of a node that is a successor of the lock but NOT a
+      // successor of the current node.
+      not exists(ControlFlowNode unlock |
+        // it's an unlock
+        unlock = getAThreadContextAwarePredecessor(lock, this) and
+        unlock.(MutexFunctionCall).isUnlock() and
+        // note that we don't check that it's the same lock -- this is left
+        // to the caller to enforce this condition.
+        // Because of the way that `getAThreadContextAwarePredecessor` works, it is possible
+        // for operations PAST it to be technically part of the predecessors.
+        // Thus, we need to make sure that this node is a
+        // successor of the unlock in the CFG
+        getAThreadContextAwareSuccessor(unlock) = this
+      ) and
+      (lock instanceof MutexFunctionCall implies not this.(MutexFunctionCall).isUnlock())
+    )
+  }
+
+  /**
+   * The `MutexFunctionCall` holding the lock that locks this node.
+   */
+  FunctionCall coveredByLock() { result = lockingFunction }
+
+  /**
+   * The lock underlying this `LockProtectedControlFlowNode`.
+   */
+  Variable getAProtectingLock() { result = lockingFunction.(LockingOperation).getLock() }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/LockingOperation.qll b/cpp/common/src/codingstandards/cpp/concurrency/LockingOperation.qll
new file mode 100644
index 0000000000..0aab11a269
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/LockingOperation.qll
@@ -0,0 +1,235 @@
+import cpp
+private import semmle.code.cpp.dataflow.TaintTracking
+
+abstract class LockingOperation extends FunctionCall {
+  /**
+   * Returns the target of the lock underlying this RAII-style lock.
+   */
+  abstract Variable getLock();
+
+  /**
+   * Returns the lock underlying this RAII-style lock.
+   */
+  abstract Expr getLockExpr();
+
+  /**
+   * Holds if this is a lock operation
+   */
+  abstract predicate isLock();
+
+  /**
+   * Holds if this is an unlock operation
+   */
+  abstract predicate isUnlock();
+
+  /**
+   * Holds if this locking operation is really a locking operation within a
+   * designated locking operation. This library assumes the underlying locking
+   * operations are implemented correctly in that calling a `LockingOperation`
+   * results in the creation of a singular lock.
+   */
+  predicate isLockingOperationWithinLockingOperation(LockingOperation inner) {
+    exists(LockingOperation outer | outer.getTarget() = inner.getEnclosingFunction())
+  }
+}
+
+/**
+ * Common base class providing an interface into function call
+ * based mutex locks.
+ */
+abstract class MutexFunctionCall extends LockingOperation {
+  abstract predicate isRecursive();
+
+  abstract predicate isSpeculativeLock();
+
+  abstract predicate unlocks(MutexFunctionCall fc);
+}
+
+/**
+ *  Models calls to various mutex types found in CPP.
+ */
+class CPPMutexFunctionCall extends MutexFunctionCall {
+  VariableAccess var;
+
+  CPPMutexFunctionCall() {
+    getTarget()
+        .(MemberFunction)
+        .getDeclaringType()
+        .hasQualifiedName("std",
+          ["mutex", "timed_mutex", "shared_timed_mutex", "recursive_mutex", "recursive_timed_mutex"]) and
+    var = getQualifier()
+  }
+
+  /**
+   * Holds if this mutex is a recursive mutex.
+   */
+  override predicate isRecursive() {
+    getTarget()
+        .(MemberFunction)
+        .getDeclaringType()
+        .hasQualifiedName("std", ["recursive_mutex", "recursive_timed_mutex"])
+  }
+
+  /**
+   * Holds if this `CPPMutexFunctionCall` is a lock.
+   */
+  override predicate isLock() {
+    not isLockingOperationWithinLockingOperation(this) and
+    getTarget().getName() = "lock"
+  }
+
+  /**
+   * Holds if this `CPPMutexFunctionCall` is a speculative lock, defined as calling
+   * one of the speculative locking functions such as `try_lock`.
+   */
+  override predicate isSpeculativeLock() {
+    getTarget().getName() in [
+        "try_lock", "try_lock_for", "try_lock_until", "try_lock_shared_for", "try_lock_shared_until"
+      ]
+  }
+
+  /**
+   * Returns the lock to which this `CPPMutexFunctionCall` refers to.
+   */
+  override Variable getLock() { result = getQualifier().(VariableAccess).getTarget() }
+
+  /**
+   * Returns the qualifier for this `CPPMutexFunctionCall`.
+   */
+  override Expr getLockExpr() { result = var }
+
+  /**
+   * Holds if this is a `unlock` and *may* unlock the previously locked `MutexFunctionCall`.
+   * This predicate does not check that the mutex is currently locked.
+   */
+  override predicate unlocks(MutexFunctionCall fc) {
+    isUnlock() and
+    fc.getQualifier().(VariableAccess).getTarget() = getQualifier().(VariableAccess).getTarget()
+  }
+
+  /**
+   * Holds if this is an unlock call.
+   */
+  override predicate isUnlock() { getTarget().getName() = "unlock" }
+}
+
+/**
+ *  Models calls to various mutex types specialized to C code.
+ */
+class CMutexFunctionCall extends MutexFunctionCall {
+  Expr arg;
+
+  CMutexFunctionCall() {
+    // the non recursive kinds
+    getTarget().getName() = ["mtx_lock", "mtx_unlock", "mtx_timedlock", "mtx_trylock"] and
+    arg = getArgument(0)
+  }
+
+  /**
+   * Holds if this mutex is a recursive mutex.
+   */
+  override predicate isRecursive() { none() }
+
+  /**
+   * Holds if this `CMutexFunctionCall` is a lock.
+   */
+  override predicate isLock() {
+    not isLockingOperationWithinLockingOperation(this) and
+    getTarget().getName() = ["mtx_lock", "mtx_timedlock", "mtx_trylock"]
+  }
+
+  /**
+   * Holds if this `CMutexFunctionCall` is a speculative lock, defined as calling
+   * one of the speculative locking functions such as `try_lock`.
+   */
+  override predicate isSpeculativeLock() {
+    getTarget().getName() in ["mtx_timedlock", "mtx_trylock"]
+  }
+
+  /**
+   * Returns the `Variable` to which this `CMutexFunctionCall` refers to. For this
+   * style of lock it can reference a number of different variables.
+   */
+  override Variable getLock() {
+    exists(VariableAccess va |
+      TaintTracking::localTaint(DataFlow::exprNode(va), DataFlow::exprNode(getLockExpr())) and
+      result = va.getTarget()
+    )
+  }
+
+  /**
+   * Returns the expression for this `CMutexFunctionCall`.
+   */
+  override Expr getLockExpr() { result = arg }
+
+  /**
+   * Holds if this is a `unlock` and *may* unlock the previously locked `CMutexFunctionCall`.
+   * This predicate does not check that the mutex is currently locked.
+   */
+  override predicate unlocks(MutexFunctionCall fc) {
+    isUnlock() and
+    fc.getLock() = getLock()
+  }
+
+  /**
+   * Holds if this is an unlock call.
+   */
+  override predicate isUnlock() { getTarget().getName() = "mtx_unlock" }
+}
+
+/**
+ * Models a RAII-Style lock.
+ */
+class RAIIStyleLock extends LockingOperation {
+  VariableAccess lock;
+
+  RAIIStyleLock() {
+    (
+      getTarget().getDeclaringType().hasQualifiedName("std", "lock_guard") or
+      getTarget().getDeclaringType().hasQualifiedName("std", "unique_lock") or
+      getTarget().getDeclaringType().hasQualifiedName("std", "scoped_lock")
+    ) and
+    (
+      lock = getArgument(0).getAChild*()
+      or
+      this instanceof DestructorCall and
+      exists(RAIIStyleLock constructor |
+        constructor = getQualifier().(VariableAccess).getTarget().getInitializer().getExpr() and
+        lock = constructor.getArgument(0).getAChild*()
+      )
+    )
+  }
+
+  /**
+   * Holds if this is a lock operation
+   */
+  override predicate isLock() {
+    not isLockingOperationWithinLockingOperation(this) and
+    this instanceof ConstructorCall and
+    lock = getArgument(0).getAChild*() and
+    // defer_locks don't cause a lock
+    not exists(Expr exp |
+      exp = getArgument(1) and
+      exp.(VariableAccess)
+          .getTarget()
+          .getUnderlyingType()
+          .(Class)
+          .hasQualifiedName("std", "defer_lock_t")
+    )
+  }
+
+  /**
+   * Holds if this is an unlock operation
+   */
+  override predicate isUnlock() { this instanceof DestructorCall }
+
+  /**
+   * Returns the target of the lock underlying this RAII-style lock.
+   */
+  override Variable getLock() { result = lock.getTarget() }
+
+  /**
+   * Returns the lock underlying this RAII-style lock.
+   */
+  override Expr getLockExpr() { result = lock }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/MutexDestroyer.qll b/cpp/common/src/codingstandards/cpp/concurrency/MutexDestroyer.qll
new file mode 100644
index 0000000000..915efc6077
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/MutexDestroyer.qll
@@ -0,0 +1,73 @@
+import cpp
+
+/**
+ * Models expressions that destroy mutexes.
+ */
+abstract class MutexDestroyer extends StmtParent {
+  /**
+   * Gets the expression that references the mutex being destroyed.
+   */
+  abstract Expr getMutexExpr();
+}
+
+/**
+ * Models C style mutex destruction via `mtx_destroy`.
+ */
+class C11MutexDestroyer extends MutexDestroyer, FunctionCall {
+  C11MutexDestroyer() { getTarget().getName() = "mtx_destroy" }
+
+  /**
+   * Returns the `Expr` being destroyed.
+   */
+  override Expr getMutexExpr() { result = getArgument(0) }
+}
+
+/**
+ * Models a delete expression -- note it is necessary to add this in
+ * addition to destructors to handle certain implementations of the
+ * standard library which obscure the destructors of mutexes.
+ */
+class DeleteMutexDestroyer extends MutexDestroyer {
+  DeleteMutexDestroyer() { this instanceof DeleteExpr }
+
+  override Expr getMutexExpr() { this.(DeleteExpr).getExpr() = result }
+}
+
+/**
+ * Models a possible mutex variable that if it goes
+ * out of scope would destroy an underlying mutex.
+ */
+class LocalMutexDestroyer extends MutexDestroyer {
+  Expr assignedValue;
+
+  LocalMutexDestroyer() {
+    exists(LocalVariable lv |
+      // static types aren't destroyers
+      not lv.isStatic() and
+      // neither are pointers
+      not lv.getType() instanceof PointerType and
+      lv.getAnAssignedValue() = assignedValue and
+      // map the location to the return statements of the
+      // enclosing function
+      exists(ReturnStmt rs |
+        rs.getEnclosingFunction() = assignedValue.getEnclosingFunction() and
+        rs = this
+      )
+    )
+  }
+
+  override Expr getMutexExpr() { result = assignedValue }
+}
+
+/**
+ * Models implicit or explicit calls to the destructor of a mutex, either via
+ * a `delete` statement or a variable going out of scope.
+ */
+class DestructorMutexDestroyer extends MutexDestroyer, DestructorCall {
+  DestructorMutexDestroyer() { getTarget().getDeclaringType().hasQualifiedName("std", "mutex") }
+
+  /**
+   * Returns the `Expr` being deleted.
+   */
+  override Expr getMutexExpr() { getQualifier() = result }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/ThreadCreation.qll b/cpp/common/src/codingstandards/cpp/concurrency/ThreadCreation.qll
new file mode 100644
index 0000000000..4499b993ad
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/ThreadCreation.qll
@@ -0,0 +1,62 @@
+import cpp
+private import codingstandards.cpp.concurrency.ControlFlow
+
+/**
+ * Models a call to a thread constructor via `std::thread`.
+ */
+class ThreadConstructorCall extends ConstructorCall, ThreadCreationFunction {
+  Function f;
+
+  ThreadConstructorCall() {
+    getTarget().getDeclaringType().hasQualifiedName("std", "thread") and
+    f = getArgument(0).(FunctionAccess).getTarget()
+  }
+
+  /**
+   * Returns the function that will be invoked by this `std::thread`.
+   */
+  override Function getFunction() { result = f }
+
+  override ControlFlowNode getNext() { result = getFunction().getEntryPoint() }
+}
+
+/**
+ * Models a call to a thread creation via `thrd_create` or `pthread_create`.
+ */
+class CThreadCreateCall extends FunctionCall {
+  Function f;
+  int fArgIdx;
+
+  CThreadCreateCall() {
+    (
+      getTarget().getName() = "thrd_create" and
+      fArgIdx = 1
+      or
+      getTarget().getName() = "pthread_create" and
+      fArgIdx = 2
+    ) and
+    (
+      f = getArgument(fArgIdx).(FunctionAccess).getTarget() or
+      f = getArgument(fArgIdx).(AddressOfExpr).getOperand().(FunctionAccess).getTarget()
+    )
+  }
+
+  /**
+   * Returns the function that will be invoked by this thread.
+   */
+  Function getFunction() { result = f }
+}
+
+/**
+ * Models a call to a thread constructor via `thrd_create`.
+ */
+class C11ThreadCreateCall extends ThreadCreationFunction, CThreadCreateCall {
+  C11ThreadCreateCall() { getTarget().getName() = "thrd_create" }
+
+  /**
+   * Returns the function that will be invoked by this thread.
+   */
+  override Function getFunction() { result = f }
+
+  override ControlFlowNode getNext() { result = getFunction().getEntryPoint() }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/ThreadDependentMutex.qll b/cpp/common/src/codingstandards/cpp/concurrency/ThreadDependentMutex.qll
new file mode 100644
index 0000000000..f86e94566f
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/ThreadDependentMutex.qll
@@ -0,0 +1,246 @@
+import cpp
+import semmle.code.cpp.dataflow.TaintTracking
+private import codingstandards.cpp.concurrency.ControlFlow
+private import codingstandards.cpp.concurrency.ThreadedFunction
+
+abstract class MutexSource extends FunctionCall { }
+
+/**
+ * Models a C++ style mutex.
+ */
+class CPPMutexSource extends MutexSource, ConstructorCall {
+  CPPMutexSource() { getTarget().getDeclaringType().hasQualifiedName("std", "mutex") }
+}
+
+/**
+ * Models a C11 style mutex.
+ */
+class C11MutexSource extends MutexSource, FunctionCall {
+  C11MutexSource() { getTarget().hasName("mtx_init") }
+
+  Expr getMutexExpr() { result = getArgument(0) }
+
+  Expr getMutexTypeExpr() { result = getArgument(1) }
+
+  predicate isRecursive() {
+    exists(EnumConstantAccess recursive |
+      recursive = getMutexTypeExpr().getAChild*() and
+      recursive.getTarget().hasName("mtx_recursive")
+    )
+  }
+}
+
+/**
+ * Models a thread dependent mutex. A thread dependent mutex is a mutex
+ * that is used by a thread. This dependency is established either by directly
+ * passing in a mutex or by referencing a mutex that is in the local scope. The utility
+ * of this class is it captures the `DataFlow::Node` source at which the mutex
+ * came from. For example, if it is passed in from a local function to a thread.
+ * This functionality is critical, since it allows one to inspect how the thread
+ * behaves with respect to the owner of a resource.
+ *
+ * To model the myriad ways this can happen, the subclasses of this class are
+ * responsible for implementing the various usage patterns.
+ */
+abstract class ThreadDependentMutex extends DataFlow::Node {
+  DataFlow::Node sink;
+
+  DataFlow::Node getASource() {
+    // the source is either the thing that declared
+    // the mutex
+    result = this
+    or
+    // or the thread we are using it in
+    result = getAThreadSource()
+  }
+
+  /**
+   * Gets the dataflow nodes corresponding to thread local usages of the
+   * dependent mutex.
+   */
+  DataFlow::Node getAThreadSource() {
+    // here we line up the actual parameter at the thread creation
+    // site with the formal parameter in the target thread.
+    // Note that there are differences between the C and C++ versions
+    // of the argument ordering in the thread creation function. However,
+    // since the C version only takes one parameter (as opposed to multiple)
+    // we can simplify this search by considering only the first argument.
+    exists(FunctionCall fc, Function f, int n |
+      // Get the argument to which the mutex flowed.
+      fc.getArgument(n) = sink.asExpr() and
+      // Get the thread function we are calling.
+      f = fc.getArgument(0).(FunctionAccess).getTarget() and
+      // in C++, there is an extra argument to the `std::thread` call
+      // so we must subtract 1 since this is not passed to the thread.
+      (
+        result = DataFlow::exprNode(f.getParameter(n - 1).getAnAccess())
+        or
+        // In C, only one argument is allowed. Thus IF the flow predicate holds,
+        // it will be to the first argument
+        result = DataFlow::exprNode(f.getParameter(0).getAnAccess())
+      )
+    )
+  }
+
+  /**
+   * Produces the set of dataflow nodes to thread creation for threads
+   * that are dependent on this mutex.
+   */
+  DataFlow::Node getADependentThreadCreationExpr() {
+    exists(FunctionCall fc |
+      fc.getAnArgument() = sink.asExpr() and
+      result = DataFlow::exprNode(fc)
+    )
+  }
+
+  /**
+   * Gets a set of usages of this mutex in both the local and thread scope.
+   * In the case of scoped usage, this also captures typical accesses of variables.
+   */
+  DataFlow::Node getAUsage() { TaintTracking::localTaint(getASource(), result) }
+}
+
+/**
+ * This class models the type of thread/mutex dependency that is established
+ * through the typical parameter passing mechanisms found in C++.
+ */
+class FlowBasedThreadDependentMutex extends ThreadDependentMutex {
+  FlowBasedThreadDependentMutex() {
+    // some sort of dataflow, likely through parameter passing.
+    ThreadDependentMutexFlow::flow(this, sink)
+  }
+}
+
+/**
+ * This class models the type of thread/mutex dependency that is established by
+ * either scope based accesses (e.g., global variables) or block scope differences.
+ */
+class AccessBasedThreadDependentMutex extends ThreadDependentMutex {
+  Variable variableSource;
+
+  AccessBasedThreadDependentMutex() {
+    // encapsulates usages from outside scopes not directly expressed
+    // in dataflow.
+    exists(MutexSource mutexSrc, ThreadedFunction f |
+      DataFlow::exprNode(mutexSrc) = this and
+      // find a variable that was assigned the mutex
+      TaintTracking::localTaint(DataFlow::exprNode(mutexSrc),
+        DataFlow::exprNode(variableSource.getAnAssignedValue())) and
+      // find all subsequent accesses of that variable that are within a
+      // function and set those to the sink
+      exists(VariableAccess va |
+        va = variableSource.getAnAccess() and
+        va.getEnclosingFunction() = f and
+        sink = DataFlow::exprNode(va)
+      )
+    )
+  }
+
+  override DataFlow::Node getAUsage() { DataFlow::exprNode(variableSource.getAnAccess()) = result }
+}
+
+/**
+ * In the typical C thread model, a mutex is a created by a function that is not responsible
+ * for creating the variable. Thus this class encodes a slightly different semantics
+ * wherein the usage pattern is that of variables that have been both initialized
+ * and then subsequently passed into a thread directly.
+ */
+class DeclarationInitBasedThreadDependentMutex extends ThreadDependentMutex {
+  Variable variableSource;
+
+  DeclarationInitBasedThreadDependentMutex() {
+    exists(MutexSource ms, ThreadCreationFunction tcf |
+      this = DataFlow::exprNode(ms) and
+      // accessed as a mutex source
+      TaintTracking::localTaint(DataFlow::exprNode(variableSource.getAnAccess()),
+        DataFlow::exprNode(ms.getAnArgument())) and
+      // subsequently passed to a thread creation function (order not strictly
+      // enforced for performance reasons)
+      sink = DataFlow::exprNode(tcf.getAnArgument()) and
+      TaintTracking::localTaint(DataFlow::exprNode(variableSource.getAnAccess()), sink)
+    )
+  }
+
+  override DataFlow::Node getAUsage() {
+    TaintTracking::localTaint(getASource(), result) or
+    DataFlow::exprNode(variableSource.getAnAccess()) = result
+  }
+
+  override DataFlow::Node getASource() {
+    // the source is either the thing that declared
+    // the mutex
+    result = this
+    or
+    // or the thread we are using it in
+    result = getAThreadSource()
+  }
+
+  DataFlow::Node getSink() { result = sink }
+
+  /**
+   * Gets the dataflow nodes corresponding to thread local usages of the
+   * dependent mutex.
+   */
+  override DataFlow::Node getAThreadSource() {
+    // here we line up the actual parameter at the thread creation
+    // site with the formal parameter in the target thread.
+    // Note that there are differences between the C and C++ versions
+    // of the argument ordering in the thread creation function. However,
+    // since the C version only takes one parameter (as opposed to multiple)
+    // we can simplify this search by considering only the first argument.
+    exists(
+      FunctionCall fc, Function f, int n // CPP Version
+    |
+      fc.getArgument(n) = sink.asExpr() and
+      f = fc.getArgument(0).(FunctionAccess).getTarget() and
+      // in C++, there is an extra argument to the `std::thread` call
+      // so we must subtract 1 since this is not passed to the thread.
+      result = DataFlow::exprNode(f.getParameter(n - 1).getAnAccess())
+    )
+    or
+    exists(
+      FunctionCall fc, Function f // C Version
+    |
+      fc.getAnArgument() = sink.asExpr() and
+      // in C, the second argument is the function
+      f = fc.getArgument(1).(FunctionAccess).getTarget() and
+      // in C, the passed argument is always the zeroth argument
+      result = DataFlow::exprNode(f.getParameter(0).getAnAccess())
+    )
+  }
+}
+
+/**
+ * In the typical C model, another way to use mutexes is to work with global variables
+ * that can be initialized at various points -- one of which must be inside a thread.
+ * This class encapsulates this pattern.
+ */
+class DeclarationInitAccessBasedThreadDependentMutex extends ThreadDependentMutex {
+  Variable variableSource;
+
+  DeclarationInitAccessBasedThreadDependentMutex() {
+    exists(MutexSource ms, ThreadedFunction tf, VariableAccess va |
+      this = DataFlow::exprNode(ms) and
+      // accessed as a mutex source
+      TaintTracking::localTaint(DataFlow::exprNode(variableSource.getAnAccess()),
+        DataFlow::exprNode(ms.getAnArgument())) and
+      // is accessed somewhere else
+      va = variableSource.getAnAccess() and
+      sink = DataFlow::exprNode(va) and
+      // one of which must be a thread
+      va.getEnclosingFunction() = tf
+    )
+  }
+
+  override DataFlow::Node getAUsage() { result = DataFlow::exprNode(variableSource.getAnAccess()) }
+}
+
+module ThreadDependentMutexConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node node) { node.asExpr() instanceof MutexSource }
+
+  predicate isSink(DataFlow::Node node) {
+    exists(ThreadCreationFunction f | f.getAnArgument() = node.asExpr())
+  }
+}
+
+module ThreadDependentMutexFlow = TaintTracking::Global<ThreadDependentMutexConfig>;
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/ThreadSpecificStorage.qll b/cpp/common/src/codingstandards/cpp/concurrency/ThreadSpecificStorage.qll
new file mode 100644
index 0000000000..aa7daf972c
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/ThreadSpecificStorage.qll
@@ -0,0 +1,59 @@
+import cpp
+private import semmle.code.cpp.dataflow.DataFlow
+private import codingstandards.cpp.concurrency.ThreadCreation
+
+/**
+ * Models calls to thread specific storage function calls.
+ */
+abstract class ThreadSpecificStorageFunctionCall extends FunctionCall {
+  /**
+   * Gets the key to which this call references.
+   */
+  Expr getKey() { getArgument(0) = result }
+}
+
+/**
+ * Models calls to `tss_get`.
+ */
+class TSSGetFunctionCall extends ThreadSpecificStorageFunctionCall {
+  TSSGetFunctionCall() { getTarget().getName() = "tss_get" }
+}
+
+/**
+ * Models calls to `tss_set`.
+ */
+class TSSSetFunctionCall extends ThreadSpecificStorageFunctionCall {
+  TSSSetFunctionCall() { getTarget().getName() = "tss_set" }
+}
+
+/**
+ * Models calls to `tss_create`
+ */
+class TSSCreateFunctionCall extends ThreadSpecificStorageFunctionCall {
+  TSSCreateFunctionCall() { getTarget().getName() = "tss_create" }
+
+  predicate hasDeallocator() {
+    not exists(MacroInvocation mi, NullMacro nm |
+      getArgument(1) = mi.getExpr() and
+      mi = nm.getAnInvocation()
+    )
+  }
+}
+
+/**
+ * Models calls to `tss_delete`
+ */
+class TSSDeleteFunctionCall extends ThreadSpecificStorageFunctionCall {
+  TSSDeleteFunctionCall() { getTarget().getName() = "tss_delete" }
+}
+
+/**
+ * Gets a call to `DeallocationExpr` that deallocates memory owned by thread specific
+ * storage.
+ */
+predicate getAThreadSpecificStorageDeallocationCall(C11ThreadCreateCall tcc, DeallocationExpr dexp) {
+  exists(TSSGetFunctionCall tsg |
+    tcc.getFunction().getEntryPoint().getASuccessor*() = tsg and
+    DataFlow::localFlow(DataFlow::exprNode(tsg), DataFlow::exprNode(dexp.getFreedExpr()))
+  )
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/ThreadWaitDetach.qll b/cpp/common/src/codingstandards/cpp/concurrency/ThreadWaitDetach.qll
new file mode 100644
index 0000000000..6898dc54df
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/ThreadWaitDetach.qll
@@ -0,0 +1,41 @@
+import cpp
+
+/**
+ * Models thread waiting functions.
+ */
+abstract class ThreadWait extends FunctionCall { }
+
+/**
+ * Models a call to a `std::thread` join.
+ */
+class CPPThreadWait extends ThreadWait {
+  VariableAccess var;
+
+  CPPThreadWait() {
+    getTarget().(MemberFunction).getDeclaringType().hasQualifiedName("std", "thread") and
+    getTarget().getName() = "join"
+  }
+}
+
+/**
+ * Models a call to `thrd_join` in C11.
+ */
+class C11ThreadWait extends ThreadWait {
+  VariableAccess var;
+
+  C11ThreadWait() { getTarget().getName() = "thrd_join" }
+}
+
+/**
+ * Models thread detach functions.
+ */
+abstract class ThreadDetach extends FunctionCall { }
+
+/**
+ * Models a call to `thrd_detach` in C11.
+ */
+class C11ThreadDetach extends ThreadWait {
+  VariableAccess var;
+
+  C11ThreadDetach() { getTarget().getName() = "thrd_detach" }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/ThreadedFunction.qll b/cpp/common/src/codingstandards/cpp/concurrency/ThreadedFunction.qll
new file mode 100644
index 0000000000..a8d2c609c5
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/ThreadedFunction.qll
@@ -0,0 +1,37 @@
+import cpp
+private import codingstandards.cpp.concurrency.ThreadCreation
+
+/**
+ * Models a function that may be executed by some thread.
+ */
+abstract class ThreadedFunctionBase extends Function {
+  abstract Expr getSpawnExpr();
+
+  predicate isMultiplySpawned() { getSpawnExpr().getBasicBlock().inLoop() }
+}
+
+final class ThreadedFunction = ThreadedFunctionBase;
+
+/**
+ * Models a function that may be executed by some thread via
+ * C++ standard classes.
+ */
+class CPPThreadedFunction extends ThreadedFunctionBase {
+  ThreadConstructorCall tcc;
+
+  CPPThreadedFunction() { tcc.getFunction() = this }
+
+  override Expr getSpawnExpr() { result = tcc }
+}
+
+/**
+ * Models a function that may be executed by some thread via
+ * C11 standard functions.
+ */
+class C11ThreadedFunction extends ThreadedFunctionBase {
+  C11ThreadCreateCall cc;
+
+  C11ThreadedFunction() { cc.getFunction() = this }
+
+  override Expr getSpawnExpr() { result = cc }
+}
diff --git a/cpp/common/src/codingstandards/cpp/concurrency/Types.qll b/cpp/common/src/codingstandards/cpp/concurrency/Types.qll
new file mode 100644
index 0000000000..3b865d5171
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/concurrency/Types.qll
@@ -0,0 +1,29 @@
+import cpp
+
+class C11MutexType extends TypedefType {
+  C11MutexType() { this.hasName("mtx_t") }
+}
+
+class C11ThreadType extends TypedefType {
+  C11ThreadType() { this.hasName("thrd_t") }
+}
+
+class C11ConditionType extends TypedefType {
+  C11ConditionType() { this.hasName("cnd_t") }
+}
+
+class C11ThreadStorageType extends TypedefType {
+  C11ThreadStorageType() { this.hasName("tss_t") }
+}
+
+class C11ThreadingObjectType extends TypedefType {
+  C11ThreadingObjectType() {
+    this instanceof C11MutexType
+    or
+    this instanceof C11ThreadType
+    or
+    this instanceof C11ConditionType
+    or
+    this instanceof C11ThreadStorageType
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/dataflow/DataFlow.qll b/cpp/common/src/codingstandards/cpp/dataflow/DataFlow.qll
deleted file mode 100644
index c11bf80fc6..0000000000
--- a/cpp/common/src/codingstandards/cpp/dataflow/DataFlow.qll
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Provides a library for local (intra-procedural) and global (inter-procedural)
- * data flow analysis: deciding whether data can flow from a _source_ to a
- * _sink_.
- *
- * Unless configured otherwise, _flow_ means that the exact value of
- * the source may reach the sink. We do not track flow across pointer
- * dereferences or array indexing. To track these types of flow, where the
- * exact value may not be preserved, import
- * `semmle.code.cpp.dataflow.TaintTracking`.
- *
- * To use global (interprocedural) data flow, extend the class
- * `DataFlow::Configuration` as documented on that class. To use local
- * (intraprocedural) data flow between expressions, call
- * `DataFlow::localExprFlow`. For more general cases of local data flow, call
- * `DataFlow::localFlow` or `DataFlow::localFlowStep` with arguments of type
- * `DataFlow::Node`.
- *
- * NOTE: This is copied from `codeql/cpp-all` to avoid deprecation warnings
- * that cannot be avoided in tests.
- */
-
-import cpp
-
-/**
- * DEPRECATED: Use `semmle.code.cpp.dataflow.new.DataFlow` instead.
- *
- * Provides classes for performing local (intra-procedural) and
- * global (inter-procedural) data flow analyses.
- */
-module DataFlow {
-  private import semmle.code.cpp.dataflow.internal.DataFlowImplSpecific
-  private import codeql.dataflow.DataFlow
-  import DataFlowMake<CppOldDataFlow>
-  import semmle.code.cpp.dataflow.internal.DataFlowImpl1
-}
diff --git a/cpp/common/src/codingstandards/cpp/dataflow/DataFlow2.qll b/cpp/common/src/codingstandards/cpp/dataflow/DataFlow2.qll
deleted file mode 100644
index 83859535d8..0000000000
--- a/cpp/common/src/codingstandards/cpp/dataflow/DataFlow2.qll
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Provides a `DataFlow2` module, which is a copy of the `DataFlow` module. Use
- * this class when data-flow configurations must depend on each other. Two
- * classes extending `DataFlow::Configuration` should never depend on each
- * other, but one of them should instead depend on a
- * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
- * `DataFlow4::Configuration`.
- *
- * See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
- *
- * NOTE: This is copied from `codeql/cpp-all` to avoid deprecation warnings
- * that cannot be avoided in tests.
- */
-
-import cpp
-
-/**
- * DEPRECATED: Use `semmle.code.cpp.dataflow.new.DataFlow2` instead.
- *
- * Provides classes for performing local (intra-procedural) and
- * global (inter-procedural) data flow analyses.
- */
-module DataFlow2 {
-  import semmle.code.cpp.dataflow.internal.DataFlowImpl2
-}
diff --git a/cpp/common/src/codingstandards/cpp/dataflow/TaintTracking.qll b/cpp/common/src/codingstandards/cpp/dataflow/TaintTracking.qll
deleted file mode 100644
index 2b43a53ccb..0000000000
--- a/cpp/common/src/codingstandards/cpp/dataflow/TaintTracking.qll
+++ /dev/null
@@ -1,37 +0,0 @@
-/**
- * Provides classes for performing local (intra-procedural) and
- * global (inter-procedural) taint-tracking analyses.
- *
- * We define _taint propagation_ informally to mean that a substantial part of
- * the information from the source is preserved at the sink. For example, taint
- * propagates from `x` to `x + 100`, but it does not propagate from `x` to `x >
- * 100` since we consider a single bit of information to be too little.
- *
- * To use global (interprocedural) taint tracking, extend the class
- * `TaintTracking::Configuration` as documented on that class. To use local
- * (intraprocedural) taint tracking between expressions, call
- * `TaintTracking::localExprTaint`. For more general cases of local taint
- * tracking, call `TaintTracking::localTaint` or
- * `TaintTracking::localTaintStep` with arguments of type `DataFlow::Node`.
- *
- * NOTE: This is copied from `codeql/cpp-all` to avoid deprecation warnings
- * that cannot be avoided in tests.
- */
-
-import codingstandards.cpp.dataflow.DataFlow
-import codingstandards.cpp.dataflow.DataFlow2
-
-/**
- * DEPRECATED: Use `semmle.code.cpp.dataflow.new.TaintTracking` instead.
- *
- * Provides classes for performing local (intra-procedural) and
- * global (inter-procedural) taint-tracking analyses.
- */
-module TaintTracking {
-  import codingstandards.cpp.dataflow.internal.tainttracking1.TaintTrackingParameter::Public
-  private import semmle.code.cpp.dataflow.internal.DataFlowImplSpecific
-  private import semmle.code.cpp.dataflow.internal.TaintTrackingImplSpecific
-  private import codeql.dataflow.TaintTracking
-  import TaintFlowMake<CppOldDataFlow, CppOldTaintTracking>
-  import semmle.code.cpp.dataflow.internal.tainttracking1.TaintTrackingImpl
-}
diff --git a/cpp/common/src/codingstandards/cpp/dataflow/internal/tainttracking1/TaintTrackingParameter.qll b/cpp/common/src/codingstandards/cpp/dataflow/internal/tainttracking1/TaintTrackingParameter.qll
deleted file mode 100644
index 63e9c85e22..0000000000
--- a/cpp/common/src/codingstandards/cpp/dataflow/internal/tainttracking1/TaintTrackingParameter.qll
+++ /dev/null
@@ -1,6 +0,0 @@
-import semmle.code.cpp.dataflow.internal.TaintTrackingUtil as Public
-
-module Private {
-  import codingstandards.cpp.dataflow.DataFlow::DataFlow as DataFlow
-  import semmle.code.cpp.dataflow.internal.DataFlowImpl as DataFlowInternal
-}
diff --git a/cpp/common/src/codingstandards/cpp/deadcode/UnusedObjects.qll b/cpp/common/src/codingstandards/cpp/deadcode/UnusedObjects.qll
new file mode 100644
index 0000000000..94ae16ec4f
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/deadcode/UnusedObjects.qll
@@ -0,0 +1,71 @@
+import cpp
+import codingstandards.cpp.deadcode.UnusedVariables
+import codingstandards.cpp.alertreporting.HoldsForAllCopies
+import codingstandards.cpp.alertreporting.DeduplicateMacroResults
+
+/**
+ * An unused object definition is an object, meaning a place in memory, whose definition could be
+ * removed and the program would still compile.
+ *
+ * Technically, parameters may be considered objects, but they are covered by their own rule.
+ * Similarly, members of structs are an addressable place in memory, and may be considered objects.
+ * However, the member declaration is nothing but a layout offset, which is not an object.
+ *
+ * This therefore only reports variables (local or top level) which have a definition, and are
+ * unused.
+ */
+class UnusedObjectDefinition extends VariableDeclarationEntry {
+  UnusedObjectDefinition() {
+    (
+      getVariable() instanceof BasePotentiallyUnusedLocalVariable
+      or
+      getVariable() instanceof BasePotentiallyUnusedGlobalOrNamespaceVariable
+    ) and
+    not exists(VariableAccess access | access.getTarget() = getVariable()) and
+    getVariable().getDefinition() = this
+  }
+
+  /* Dead objects with these attributes are reported in the "strict" queries. */
+  predicate hasAttrUnused() {
+    getVariable().getAnAttribute().hasName(["unused", "used", "maybe_unused", "cleanup"])
+  }
+}
+
+/* Configuration to use the `DedupMacroResults` module to reduce alert noise */
+module UnusedObjectDefinitionDedupeConfig implements
+  DeduplicateMacroConfigSig<UnusedObjectDefinition>
+{
+  string describe(UnusedObjectDefinition def) { result = def.getName() }
+}
+
+import DeduplicateMacroResults<UnusedObjectDefinition, UnusedObjectDefinitionDedupeConfig> as DeduplicateUnusedMacroObjects
+
+/* Module config to use the `DeduplicateUnusedMacroObjects::Report` module */
+module ReportDeadObjectConfig implements MacroReportConfigSig<UnusedObjectDefinition> {
+  bindingset[description]
+  string getMessageSameResultInAllExpansions(Macro m, string description) {
+    result = "Macro '" + m.getName() + "' defines unused object '" + description + "'."
+  }
+
+  string getMessageVariedResultInAllExpansions(Macro m) {
+    result =
+      "Macro '" + m.getName() +
+        "' defines unused object with an invocation-dependent name, for example, '$@'."
+  }
+
+  string getMessageResultInIsolatedExpansion(UnusedObjectDefinition unused) {
+    result = "Invocation of macro '$@' defines unused object '" + unused.getName() + "'."
+  }
+
+  string getMessageNotInMacro(UnusedObjectDefinition unused, Locatable optLoc1, string optStr1) {
+    result = "Unused object '" + unused.getName() + "'." and
+    optLoc1 = unused and
+    optStr1 = "(ignored)"
+  }
+}
+
+/* The object to report in queries of dead objects used in macros */
+class ReportDeadObject extends DeduplicateUnusedMacroObjects::Report<ReportDeadObjectConfig>::ReportResult
+{
+  predicate hasAttrUnused() { getAResultElement().hasAttrUnused() }
+}
diff --git a/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll b/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll
index 912d2babcd..a7accd5252 100644
--- a/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll
+++ b/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll
@@ -36,11 +36,11 @@ predicate declarationHasSideEffects(Variable v) {
   v.getType() instanceof TemplateDependentType
 }
 
-/** A `LocalVariable` which is a candidate for being unused. */
-class PotentiallyUnusedLocalVariable extends LocalVariable {
-  PotentiallyUnusedLocalVariable() {
-    // Ignore variables declared in macro expansions
-    not exists(DeclStmt ds | ds.getADeclaration() = this and ds.isInMacroExpansion()) and
+/**
+ * A `LocalVariable` which is a candidate for being unused, and may or may not be defined in a macro.
+ */
+class BasePotentiallyUnusedLocalVariable extends LocalVariable {
+  BasePotentiallyUnusedLocalVariable() {
     // Ignore variables where initializing the variable has side effects
     not declarationHasSideEffects(this) and // TODO non POD types with initializers? Also, do something different with templates?
     exists(Function f | f = getFunction() |
@@ -56,6 +56,16 @@ class PotentiallyUnusedLocalVariable extends LocalVariable {
   }
 }
 
+/**
+ * A `LocalVariable` which is a candidate for being unused, and not defined in a macro.
+ */
+class PotentiallyUnusedLocalVariable extends BasePotentiallyUnusedLocalVariable {
+  PotentiallyUnusedLocalVariable() {
+    // Ignore variables declared in macro expansions
+    not exists(DeclStmt ds | ds.getADeclaration() = this and ds.isInMacroExpansion())
+  }
+}
+
 /** Holds if `mf` is "defined" in this database. */
 predicate isDefined(MemberFunction mf) {
   exists(MemberFunction definedMemberFunction |
@@ -105,13 +115,11 @@ class PotentiallyUnusedMemberVariable extends MemberVariable {
   }
 }
 
-/** A `GlobalOrNamespaceVariable` which is potentially unused. */
-class PotentiallyUnusedGlobalOrNamespaceVariable extends GlobalOrNamespaceVariable {
-  PotentiallyUnusedGlobalOrNamespaceVariable() {
+/** A `GlobalOrNamespaceVariable` which is potentially unused and may or may not be defined in a macro */
+class BasePotentiallyUnusedGlobalOrNamespaceVariable extends GlobalOrNamespaceVariable {
+  BasePotentiallyUnusedGlobalOrNamespaceVariable() {
     // A non-defined variable may never be used
     hasDefinition() and
-    // Not declared in a macro expansion
-    not isInMacroExpansion() and
     // No side-effects from declaration
     not declarationHasSideEffects(this) and
     // exclude uninstantiated template members
@@ -121,6 +129,17 @@ class PotentiallyUnusedGlobalOrNamespaceVariable extends GlobalOrNamespaceVariab
   }
 }
 
+/**
+ * A `GlobalOrNamespaceVariable` which is potentially unused, and is not defined in a macro.
+ */
+class PotentiallyUnusedGlobalOrNamespaceVariable extends BasePotentiallyUnusedGlobalOrNamespaceVariable
+{
+  PotentiallyUnusedGlobalOrNamespaceVariable() {
+    // Not declared in a macro expansion
+    not isInMacroExpansion()
+  }
+}
+
 predicate isUnused(Variable variable) {
   not exists(variable.getAnAccess()) and
   variable.getInitializer().fromSource()
diff --git a/cpp/common/src/codingstandards/cpp/deviations/CodeIdentifierDeviation.qll b/cpp/common/src/codingstandards/cpp/deviations/CodeIdentifierDeviation.qll
new file mode 100644
index 0000000000..00e02d5712
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/deviations/CodeIdentifierDeviation.qll
@@ -0,0 +1,428 @@
+/**
+ * A module for identifying in code markers in code that trigger deviations.
+ *
+ * This module supports two different code identifier markers:
+ *  - A C/C++ attribute based syntax
+ *  - A comment-based format
+ *
+ * The C/C++ attribute based syntax uses the following format:
+ * ```
+ * [[codeql::<standard>_deviation("code-identifier")]]
+ * ```
+ * The deviation will be applied to the selected program element, and any syntactically nested children of that program element.
+ *
+ * For the comment format the marker consists of a `code-identifier` with some optional annotations. A deviation will be applied to
+ * some range of lines in the file containing the comment based on the annotation. The supported marker annotation
+ * formats are:
+ *  - `<code-identifier>` - the deviation applies to results on the current line.
+ *  - `codeql::<standard>_deviation(<code-identifier>)` - same as above.
+ *  - `codeql::<standard>_deviation_next_line(<code-identifier>)` - this deviation applies to results on the next line.
+ *  - `codeql::<standard>_deviation_begin(<code-identifier>)` - marks the beginning of a range of lines where the deviation applies.
+ *  - `codeql::<standard>_deviation_end(<code-identifier>)` - marks the end of a range of lines where the deviation applies.
+ *
+ * The valid `code-identifier`s are specified in deviation records, which also specify the query whose results are
+ * suppressed by the deviation.
+ *
+ * For begin/end, we maintain a stack of begin markers. When we encounter an end marker, we pop the stack to determine
+ * the range of that begin/end marker. If the stack is empty, the end marker is considered unmatched and invalid. If
+ * the stack is non-empty at the end of the file, all the begin markers are considered unmatched and invalid.
+ *
+ * Begin/end markers are not valid across include boundaries, as the stack is not maintained across files.
+ */
+
+import cpp
+import Deviations
+import codingstandards.cpp.Locations
+
+string supportedStandard() { result = ["misra", "autosar", "cert"] }
+
+/**
+ * Holds if the given comment contains the code identifier.
+ */
+bindingset[codeIdentifier]
+private predicate commentMatches(Comment comment, string codeIdentifier) {
+  exists(string text |
+    comment instanceof CppStyleComment and
+    // strip the beginning slashes
+    text = comment.getContents().suffix(2).trim()
+    or
+    comment instanceof CStyleComment and
+    // strip both the beginning /* and the end */ the comment
+    exists(string text0 |
+      text0 = comment.getContents().suffix(2) and
+      text = text0.prefix(text0.length() - 2).trim()
+    ) and
+    // The /* */ comment must be a single-line comment
+    not text.matches("%\n%")
+  |
+    // Code identifier appears at the start of the comment (modulo whitespace)
+    text.prefix(codeIdentifier.length()) = codeIdentifier
+    or
+    // Code identifier appears at the end of the comment (modulo whitespace)
+    text.suffix(text.length() - codeIdentifier.length()) = codeIdentifier
+  )
+}
+
+/**
+ * A deviation marker in the code.
+ */
+abstract class CommentDeviationMarker extends Comment {
+  DeviationRecord record;
+
+  /**
+   * Gets the deviation record associated with this deviation marker.
+   */
+  DeviationRecord getRecord() { result = record }
+}
+
+/**
+ * A deviation marker in a comment that is not a valid deviation marker.
+ */
+class InvalidCommentDeviationMarker extends Comment {
+  InvalidCommentDeviationMarker() {
+    not this instanceof CommentDeviationMarker and
+    commentMatches(this, "codeql::" + supportedStandard() + "_deviation")
+  }
+}
+
+/**
+ * A deviation marker for a deviation that applies to the current line.
+ */
+class DeviationEndOfLineMarker extends CommentDeviationMarker {
+  DeviationEndOfLineMarker() {
+    commentMatches(this,
+      "codeql::" + supportedStandard() + "_deviation(" + record.getCodeIdentifier() + ")")
+  }
+}
+
+/**
+ * A deviation marker for a deviation that applies to the next line.
+ */
+class DeviationNextLineMarker extends CommentDeviationMarker {
+  DeviationNextLineMarker() {
+    commentMatches(this,
+      "codeql::" + supportedStandard() + "_deviation_next_line(" + record.getCodeIdentifier() + ")")
+  }
+}
+
+/**
+ * A deviation marker for a deviation that applies to a range of lines
+ */
+abstract class CommentDeviationRangeMarker extends CommentDeviationMarker { }
+
+/**
+ * A deviation marker for a deviation that begins on this line.
+ */
+class DeviationBegin extends CommentDeviationRangeMarker {
+  DeviationBegin() {
+    commentMatches(this,
+      "codeql::" + supportedStandard() + "_deviation_begin(" + record.getCodeIdentifier() + ")")
+  }
+}
+
+/**
+ * A deviation marker for a deviation that ends on this line.
+ */
+class DeviationEnd extends CommentDeviationRangeMarker {
+  DeviationEnd() {
+    commentMatches(this,
+      "codeql::" + supportedStandard() + "_deviation_end(" + record.getCodeIdentifier() + ")")
+  }
+}
+
+private predicate hasDeviationCommentFileOrdering(
+  DeviationRecord record, CommentDeviationRangeMarker comment, File file, int index
+) {
+  comment =
+    rank[index](CommentDeviationRangeMarker c |
+      c.getRecord() = record and
+      file = c.getFile()
+    |
+      c order by c.getLocation().getStartLine(), c.getLocation().getStartColumn()
+    )
+}
+
+/**
+ * Calculate the stack of deviation begin markers related to the given deviation record, in the given file,
+ * at the given `markerRecordFileIndex` into the list of deviation markers for that record in that file.
+ */
+private BeginStack calculateBeginStack(DeviationRecord record, File file, int markerRecordFileIndex) {
+  // Stack is empty at the start
+  markerRecordFileIndex = 0 and
+  result = TEmptyBeginStack() and
+  // Only initialize when there is at least one such comment marker for this file and record
+  // pairing
+  exists(CommentDeviationRangeMarker marker |
+    marker.getRecord() = record and marker.getLocation().getFile() = file
+  )
+  or
+  // Next token is begin, so push it to the stack
+  exists(DeviationBegin begin, BeginStack prev |
+    record = begin.getRecord() and
+    hasDeviationCommentFileOrdering(record, begin, file, markerRecordFileIndex) and
+    prev = calculateBeginStack(record, file, markerRecordFileIndex - 1) and
+    result = TConsBeginStack(begin, prev)
+  )
+  or
+  // Next token is end
+  exists(DeviationEnd end, BeginStack prevStack |
+    record = end.getRecord() and
+    hasDeviationCommentFileOrdering(record, end, file, markerRecordFileIndex) and
+    prevStack = calculateBeginStack(record, file, markerRecordFileIndex - 1)
+  |
+    // There is, so pop the most recent begin off the stack
+    prevStack = TConsBeginStack(_, result)
+    or
+    // Error, no begin on the stack, ignore the end and continue
+    prevStack = TEmptyBeginStack() and
+    result = TEmptyBeginStack()
+  )
+}
+
+newtype TBeginStack =
+  TConsBeginStack(DeviationBegin begin, TBeginStack prev) {
+    exists(File file, int index |
+      hasDeviationCommentFileOrdering(begin.getRecord(), begin, file, index) and
+      prev = calculateBeginStack(begin.getRecord(), file, index - 1)
+    )
+  } or
+  TEmptyBeginStack()
+
+/**
+ * A stack of begin markers that occur in the same file, referring to the same record.
+ */
+private class BeginStack extends TBeginStack {
+  /** Gets the top begin marker on the stack. */
+  DeviationBegin peek() { this = TConsBeginStack(result, _) }
+
+  string toString() {
+    exists(DeviationBegin begin, BeginStack prev | this = TConsBeginStack(begin, prev) |
+      result = "(" + begin + ", " + prev.toString() + ")"
+    )
+    or
+    this = TEmptyBeginStack() and
+    result = "()"
+  }
+}
+
+predicate isDeviationRangePaired(DeviationRecord record, DeviationBegin begin, DeviationEnd end) {
+  exists(File file, int index |
+    record = end.getRecord() and
+    hasDeviationCommentFileOrdering(record, end, file, index) and
+    begin = calculateBeginStack(record, file, index - 1).peek()
+  )
+}
+
+/**
+ * A standard attribute that either deviates a result.
+ */
+class DeviationAttribute extends StdAttribute {
+  DeviationRecord record;
+
+  DeviationAttribute() {
+    this.hasQualifiedName("codeql", supportedStandard() + "_deviation") and
+    // Support multiple argument deviations
+    "\"" + record.getCodeIdentifier() + "\"" = this.getAnArgument().getValueText()
+  }
+
+  DeviationRecord getADeviationRecord() { result = record }
+
+  /** Gets the element to which this attribute was applied. */
+  Element getPrimarySuppressedElement() {
+    result.(Type).getAnAttribute() = this
+    or
+    result.(Stmt).getAnAttribute() = this
+    or
+    result.(Variable).getAnAttribute() = this
+    or
+    result.(Function).getAnAttribute() = this
+  }
+
+  pragma[nomagic]
+  Element getASuppressedElement() {
+    result = this.getPrimarySuppressedElement()
+    or
+    result.(Expr).getEnclosingStmt() = this.getASuppressedElement()
+    or
+    result.(Stmt).getParentStmt() = this.getASuppressedElement()
+    or
+    result.(Stmt).getEnclosingFunction() = this.getASuppressedElement()
+    or
+    result.(LocalVariable) = this.getASuppressedElement().(DeclStmt).getADeclaration()
+    or
+    result.(Function).getDeclaringType() = this.getASuppressedElement()
+    or
+    result.(Variable).getDeclaringType() = this.getASuppressedElement()
+    or
+    exists(LambdaExpression expr |
+      expr = this.getASuppressedElement() and
+      result = expr.getLambdaFunction()
+    )
+    or
+    exists(Function f |
+      f = this.getASuppressedElement() and
+      // A suppression on the function should apply to the noexcept expression
+      result = f.getADeclarationEntry().getNoExceptExpr()
+    )
+  }
+}
+
+/**
+ * A deviation attribute that is not associated with any deviation record.
+ */
+class InvalidDeviationAttribute extends StdAttribute {
+  string unknownCodeIdentifier;
+
+  InvalidDeviationAttribute() {
+    this.hasQualifiedName("codeql", supportedStandard() + "_deviation") and
+    "\"" + unknownCodeIdentifier + "\"" = this.getAnArgument().getValueText() and
+    not exists(DeviationRecord record | record.getCodeIdentifier() = unknownCodeIdentifier)
+  }
+
+  string getAnUnknownCodeIdentifier() { result = unknownCodeIdentifier }
+}
+
+newtype TCodeIndentifierDeviation =
+  TSingleLineDeviation(DeviationRecord record, Comment comment, string filepath, int suppressedLine) {
+    (
+      commentMatches(comment, record.getCodeIdentifier()) or
+      comment.(DeviationEndOfLineMarker).getRecord() = record
+    ) and
+    comment.getLocation().hasLocationInfo(filepath, suppressedLine, _, _, _)
+    or
+    comment.(DeviationNextLineMarker).getRecord() = record and
+    comment.getLocation().hasLocationInfo(filepath, suppressedLine - 1, _, _, _)
+  } or
+  TMultiLineDeviation(
+    DeviationRecord record, DeviationBegin beginComment, DeviationEnd endComment, string filepath,
+    int suppressedStartLine, int suppressedStartColumn, int suppressedEndLine,
+    int suppressedEndColumn
+  ) {
+    isDeviationRangePaired(record, beginComment, endComment) and
+    beginComment
+        .getLocation()
+        .hasLocationInfo(filepath, suppressedStartLine, suppressedStartColumn, _, _) and
+    endComment.getLocation().hasLocationInfo(filepath, _, _, suppressedEndLine, suppressedEndColumn)
+  } or
+  TCodeIdentifierDeviation(DeviationRecord record, DeviationAttribute attribute) {
+    attribute.getADeviationRecord() = record
+  }
+
+class CodeIdentifierDeviation extends TCodeIndentifierDeviation {
+  /** The deviation record associated with the deviation comment. */
+  DeviationRecord getADeviationRecord() {
+    this = TSingleLineDeviation(result, _, _, _)
+    or
+    this = TMultiLineDeviation(result, _, _, _, _, _, _, _)
+    or
+    this = TCodeIdentifierDeviation(result, _)
+  }
+
+  /**
+   * Holds if the given element is matched by this code identifier deviation.
+   */
+  bindingset[e]
+  pragma[inline_late]
+  predicate isElementMatching(Element e) {
+    exists(string filepath, int elementLocationStart, int elementLocationColumnStart |
+      e.getLocation()
+          .hasLocationInfo(filepath, elementLocationStart, elementLocationColumnStart, _, _)
+    |
+      exists(int suppressedLine |
+        this = TSingleLineDeviation(_, _, filepath, suppressedLine) and
+        suppressedLine = elementLocationStart
+      )
+      or
+      exists(
+        int suppressedStartLine, int suppressedStartColumn, int suppressedEndLine,
+        int suppressedEndColumn
+      |
+        this =
+          TMultiLineDeviation(_, _, _, filepath, suppressedStartLine, suppressedStartColumn,
+            suppressedEndLine, suppressedEndColumn) and
+        (
+          // Element starts on a line after the begin marker of the suppression
+          suppressedStartLine < elementLocationStart
+          or
+          // Element exists on the same line as the begin marker, and occurs after it
+          suppressedStartLine = elementLocationStart and
+          suppressedStartColumn < elementLocationColumnStart
+        ) and
+        (
+          // Element starts on a line before the end marker of the suppression
+          suppressedEndLine > elementLocationStart
+          or
+          // Element exists on the same line as the end marker of the suppression, and occurs before it
+          suppressedEndLine = elementLocationStart and
+          elementLocationColumnStart < suppressedEndColumn
+        )
+      )
+    )
+    or
+    exists(DeviationAttribute attribute |
+      this = TCodeIdentifierDeviation(_, attribute) and
+      attribute.getASuppressedElement() = e
+    )
+  }
+
+  /**
+   * Holds for the region matched by this code identifier deviation.
+   *
+   * Note: this is not the location of the marker itself.
+   */
+  predicate hasLocationInfo(
+    string filepath, int suppressedLine, int suppressedColumn, int endline, int endcolumn
+  ) {
+    exists(Comment commentMarker |
+      this = TSingleLineDeviation(_, commentMarker, filepath, suppressedLine) and
+      suppressedColumn = 1 and
+      endline = suppressedLine
+    |
+      if commentMarker instanceof DeviationEndOfLineMarker
+      then endcolumn = commentMarker.(DeviationEndOfLineMarker).getLocation().getEndColumn()
+      else
+        // Find the last column for a location on the next line
+        endcolumn = getLastColumnNumber(filepath, suppressedLine)
+    )
+    or
+    this =
+      TMultiLineDeviation(_, _, _, filepath, suppressedLine, suppressedColumn, endline, endcolumn)
+    or
+    exists(DeviationAttribute attribute |
+      this = TCodeIdentifierDeviation(_, attribute) and
+      attribute
+          .getPrimarySuppressedElement()
+          .getLocation()
+          .hasLocationInfo(filepath, suppressedLine, suppressedColumn, endline, endcolumn)
+    )
+  }
+
+  string toString() {
+    exists(string filepath |
+      exists(int suppressedLine |
+        this = TSingleLineDeviation(_, _, filepath, suppressedLine) and
+        result =
+          "Deviation of " + getADeviationRecord().getQuery() + " applied to " + filepath + " Line " +
+            suppressedLine
+      )
+      or
+      exists(
+        int suppressedStartLine, int suppressedStartColumn, int suppressedEndLine,
+        int suppressedEndColumn
+      |
+        this =
+          TMultiLineDeviation(_, _, _, filepath, suppressedStartLine, suppressedStartColumn,
+            suppressedEndLine, suppressedEndColumn) and
+        result =
+          "Deviation of " + getADeviationRecord().getQuery() + " applied to " + filepath + " Line " +
+            suppressedStartLine + ":" + suppressedStartColumn + ":" + suppressedEndLine + ":" +
+            suppressedEndColumn
+      )
+    )
+    or
+    exists(DeviationAttribute attribute |
+      this = TCodeIdentifierDeviation(_, attribute) and
+      result = "Deviation of " + getADeviationRecord().getQuery() + " applied to " + attribute
+    )
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/deviations/Deviations.qll b/cpp/common/src/codingstandards/cpp/deviations/Deviations.qll
index 4dfadd12eb..e8c030cdd4 100644
--- a/cpp/common/src/codingstandards/cpp/deviations/Deviations.qll
+++ b/cpp/common/src/codingstandards/cpp/deviations/Deviations.qll
@@ -8,6 +8,7 @@ import cpp
 import semmle.code.cpp.XML
 import codingstandards.cpp.exclusions.RuleMetadata
 import codingstandards.cpp.Config
+import CodeIdentifierDeviation
 
 predicate applyDeviationsAtQueryLevel() {
   not exists(CodingStandardsReportDeviatedAlerts reportDeviatedResults |
@@ -219,32 +220,8 @@ class DeviationRecord extends XmlElement {
     else result = getADeviationPermit().getCodeIdentifier()
   }
 
-  /** Gets a comment which starts or ends with the code identifier comment. */
-  Comment getACodeIdentifierComment() {
-    exists(string text |
-      (
-        result instanceof CppStyleComment and
-        // strip the beginning slashes
-        text = result.getContents().suffix(2).trim()
-        or
-        result instanceof CStyleComment and
-        // strip both the beginning /* and the end */ the comment
-        exists(string text0 |
-          text0 = result.getContents().suffix(2) and
-          text = text0.prefix(text0.length() - 2).trim()
-        ) and
-        // The /* */ comment must be a single-line comment
-        not text.matches("%\n%")
-      ) and
-      (
-        // Code identifier appears at the start of the comment (modulo whitespace)
-        text.prefix(getCodeIdentifier().length()) = getCodeIdentifier()
-        or
-        // Code identifier appears at the end of the comment (modulo whitespace)
-        text.suffix(text.length() - getCodeIdentifier().length()) = getCodeIdentifier()
-      )
-    )
-  }
+  /** Gets a code identifier deviation in code which starts or ends with the code identifier comment. */
+  CodeIdentifierDeviation getACodeIdentifierDeviation() { this = result.getADeviationRecord() }
 
   /** Gets the `rule-id` specified for this record, if any. */
   private string getRawRuleId() { result = getAChild("rule-id").getTextValue() }
@@ -363,25 +340,30 @@ class DeviationRecord extends XmlElement {
     result.getRelativePath() = getAChild("paths").getAChild("paths-entry").getTextValue()
   }
 
+  private string getADeviationPath0() {
+    if exists(getPathAContainer())
+    then
+      // Use the path, which will be relative to this file, if specified
+      result = getPathAContainer().getRelativePath()
+    else (
+      // Otherwise, if no code identifier was supplied, it applies to the parent container of the
+      // file itself
+      not exists(getCodeIdentifier()) and
+      result = this.getFile().getParentContainer().getRelativePath()
+    )
+  }
+
   /** Gets a path to which this deviation applies. */
   string getADeviationPath() {
-    (
-      if exists(getPathAContainer())
-      then
-        // Use the path, which will be relative to this file, if specified
-        result = getPathAContainer().getRelativePath()
-      else (
-        // Otherwise, if no code identifier was supplied, it applies to the parent container of the
-        // file itself
-        not exists(getCodeIdentifier()) and
-        result = this.getFile().getParentContainer().getRelativePath()
-      )
+    exists(string res |
+      res = getADeviationPath0() and
+      if res = "" then result = "(root)" else result = res
     )
   }
 
   cached
   predicate isDeviated(Query query, string deviationPath) {
     query = getQuery() and
-    deviationPath = getADeviationPath()
+    deviationPath = getADeviationPath0()
   }
 }
diff --git a/cpp/common/src/codingstandards/cpp/deviations/DeviationsSuppression.ql b/cpp/common/src/codingstandards/cpp/deviations/DeviationsSuppression.ql
index 9035b7d288..94f45c74b3 100644
--- a/cpp/common/src/codingstandards/cpp/deviations/DeviationsSuppression.ql
+++ b/cpp/common/src/codingstandards/cpp/deviations/DeviationsSuppression.ql
@@ -7,29 +7,7 @@
 
 import cpp
 import Deviations
-
-/** Holds if `lineNumber` is an indexed line number in file `f`. */
-private predicate isLineNumber(File f, int lineNumber) {
-  exists(Location l | l.getFile() = f |
-    l.getStartLine() = lineNumber
-    or
-    l.getEndLine() = lineNumber
-  )
-}
-
-/** Gets the last line number in `f`. */
-private int getLastLineNumber(File f) { result = max(int lineNumber | isLineNumber(f, lineNumber)) }
-
-/** Gets the last column number on the last line of `f`. */
-int getLastColumnNumber(File f) {
-  result =
-    max(Location l |
-      l.getFile() = f and
-      l.getEndLine() = getLastLineNumber(f)
-    |
-      l.getEndColumn()
-    )
-}
+import codingstandards.cpp.Locations
 
 newtype TDeviationScope =
   TDeviationRecordFileScope(DeviationRecord dr, File file) {
@@ -38,7 +16,9 @@ newtype TDeviationScope =
       file.getRelativePath().prefix(deviationPath.length()) = deviationPath
     )
   } or
-  TDeviationRecordCommentScope(DeviationRecord dr, Comment c) { c = dr.getACodeIdentifierComment() }
+  TDeviationRecordCodeIdentiferDeviationScope(DeviationRecord dr, CodeIdentifierDeviation c) {
+    c = dr.getACodeIdentifierDeviation()
+  }
 
 /** A deviation scope. */
 class DeviationScope extends TDeviationScope {
@@ -69,10 +49,9 @@ class DeviationRecordFileScope extends DeviationScope, TDeviationRecordFileScope
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
     // In an ideal world, we would produce a URL here that informed the AlertSuppression code that
-    // the whole file was suppressed. However, experimentation suggestions the alert suppression
-    // code only works with locations with lines and columns, so we generate a location that covers
-    // the whole "indexed" file, by finding the location indexed in the database with the latest
-    // line and column number.
+    // the whole file was suppressed. However, the alert suppression code only works with locations
+    // with lines and columns, so we generate a location that covers the whole "indexed" file, by
+    // finding the location indexed in the database with the latest line and column number.
     exists(File f | f = getFile() |
       f.getLocation().hasLocationInfo(filepath, _, _, _, _) and
       startline = 1 and
@@ -91,10 +70,16 @@ class DeviationRecordFileScope extends DeviationScope, TDeviationRecordFileScope
  * A deviation scope derived from a comment corresponding to a "code-identifier" entry for a
  * `DeviationRecord`.
  */
-class DeviationRecordCommentScope extends DeviationScope, TDeviationRecordCommentScope {
-  private DeviationRecord getDeviationRecord() { this = TDeviationRecordCommentScope(result, _) }
+class DeviationRecordCommentScope extends DeviationScope,
+  TDeviationRecordCodeIdentiferDeviationScope
+{
+  private DeviationRecord getDeviationRecord() {
+    this = TDeviationRecordCodeIdentiferDeviationScope(result, _)
+  }
 
-  private Comment getComment() { this = TDeviationRecordCommentScope(_, result) }
+  private CodeIdentifierDeviation getCodeIdentifierDeviation() {
+    this = TDeviationRecordCodeIdentiferDeviationScope(_, result)
+  }
 
   override Locatable getDeviationDefinitionLocation() { result = getDeviationRecord() }
 
@@ -103,14 +88,11 @@ class DeviationRecordCommentScope extends DeviationScope, TDeviationRecordCommen
   override predicate hasLocationInfo(
     string filepath, int startline, int startcolumn, int endline, int endcolumn
   ) {
-    getComment().getLocation().hasLocationInfo(filepath, startline, _, endline, endcolumn) and
-    startcolumn = 1
+    getCodeIdentifierDeviation()
+        .hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
   }
 
-  override string toString() {
-    result =
-      "Deviation of " + getDeviationRecord().getQuery() + " for comment " + getComment() + "."
-  }
+  override string toString() { result = getCodeIdentifierDeviation().toString() }
 }
 
 from DeviationScope deviationScope
diff --git a/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationCodeIdentifier.md b/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationCodeIdentifier.md
new file mode 100644
index 0000000000..364e1ae915
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationCodeIdentifier.md
@@ -0,0 +1,19 @@
+# Invalid deviation code identifier
+
+## Overview
+
+Invalid deviation markers in code have no effect on the results but may indicate confusion over which results will be suppressed. 
+
+Deviation code markers are used to suppress CodeQL Coding Standards results, following the process specified in the "MISRA Compliance 2020" document. There are a range of different deviation markers, with specific syntactic requirements. If those syntactic requirements are not met, the marker is invalid and will not be applied, which is likely contrary to developer expectations.
+
+## Recommendation
+
+Ensure the following requirements are met:
+
+ * All `codeql::<standard>_deviation_begin(..)` markers are paired with a matching `codeql::<standard>_deviation_end(..)` marker.
+ * All instances of `codeql::<standard>_deviation` in comments are correctly formatted comment markers, and reference a `code-identifier`s that is specified in a deviation record included in the analysis.
+ * All deviation attributes reference `code-identifier`s that are specified in a deviation record included in the analysis.
+
+## References
+
+* [MISRA Compliance 2020 document - Chapter 4.2 (page 12) - Deviations](https://www.misra.org.uk/app/uploads/2021/06/MISRA-Compliance-2020.pdf)
\ No newline at end of file
diff --git a/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationCodeIdentifier.ql b/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationCodeIdentifier.ql
new file mode 100644
index 0000000000..87dafbba13
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/deviations/InvalidDeviationCodeIdentifier.ql
@@ -0,0 +1,41 @@
+/**
+ * @id cpp/coding-standards/invalid-deviation-code-identifiers
+ * @name Invalid deviation code identifiers
+ * @description Deviation code identifiers must be valid.
+ * @kind problem
+ * @problem.severity error
+ */
+
+import cpp
+import CodeIdentifierDeviation
+
+predicate deviationCodeIdentifierError(Element e, string message) {
+  exists(DeviationEnd end |
+    e = end and
+    not isDeviationRangePaired(_, _, end) and
+    message = "Deviation end block is unmatched."
+  )
+  or
+  exists(DeviationBegin begin |
+    e = begin and
+    not isDeviationRangePaired(_, begin, _) and
+    message = "Deviation start block is unmatched."
+  )
+  or
+  exists(InvalidDeviationAttribute b |
+    e = b and
+    message =
+      "Deviation attribute references unknown code identifier " + b.getAnUnknownCodeIdentifier() +
+        "."
+  )
+  or
+  exists(InvalidCommentDeviationMarker m |
+    e = m and
+    message =
+      "Deviation marker does not match an expected format, or references an unknown code identifier."
+  )
+}
+
+from Element e, string message
+where deviationCodeIdentifierError(e, message)
+select e, message
diff --git a/cpp/common/src/codingstandards/cpp/dominance/BehavioralSet.qll b/cpp/common/src/codingstandards/cpp/dominance/BehavioralSet.qll
new file mode 100644
index 0000000000..8609e3213b
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/dominance/BehavioralSet.qll
@@ -0,0 +1,40 @@
+import cpp
+import semmle.code.cpp.controlflow.ControlFlowGraph
+
+signature class TargetNode extends ControlFlowNode;
+
+signature module DominatingSetConfigSig<TargetNode Target> {
+  predicate isTargetBehavior(ControlFlowNode behavior, Target target);
+
+  default predicate isBlockingBehavior(ControlFlowNode behavior, Target target) { none() }
+}
+
+/**
+ * A module to find whether there exists a dominator set for a node which performs a relevant
+ * behavior.
+ *
+ * For instance, we may wish to see that all paths leading to an `abort()` statement include a
+ * logging call. In this case, the `abort()` statement is the `Target` node, and the config module
+ * predicate `isTargetBehavior` logging statements.
+ *
+ * Additionally, the config may specify `isBlockingBehavior` to prevent searching too far for the
+ * relevant behavior. For instance, if analyzing that all paths to an `fflush()` call are preceded
+ * by a write, we should ignore paths from write operations that have already been flushed through
+ * an intermediary `fflush()` call.
+ */
+module DominatingBehavioralSet<TargetNode Target, DominatingSetConfigSig<Target> Config> {
+  /**
+   * Holds if this search step can reach the entry or a blocking node, without passing through a
+   * target behavior, indicating that the target is has no relevant dominator set.
+   */
+  private predicate searchStep(ControlFlowNode node, Target target) {
+    Config::isBlockingBehavior(node, target)
+    or
+    not Config::isTargetBehavior(node, target) and
+    exists(ControlFlowNode prev | prev = node.getAPredecessor() | searchStep(prev, target))
+  }
+
+  predicate isDominatedByBehavior(Target target) {
+    forex(ControlFlowNode prev | prev = target.getAPredecessor() | not searchStep(prev, target))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Banned.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Banned.qll
index 888e0863a3..f8a4e027bb 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/c/Banned.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Banned.qll
@@ -77,7 +77,7 @@ predicate isBannedQueryMetadata(Query query, string queryId, string ruleId, stri
     // `@id` for the `standardHeaderFileTgmathhUsed` query
     "c/misra/standard-header-file-tgmathh-used" and
   ruleId = "RULE-21-11" and
-  category = "required"
+  category = "advisory"
   or
   query =
     // `Query` instance for the `exceptionHandlingFeaturesOfFenvhUsed` query
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency6.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency6.qll
new file mode 100644
index 0000000000..62d9f362fe
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency6.qll
@@ -0,0 +1,112 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype Concurrency6Query =
+  TNotNoDeadlocksBetweenThreadsQuery() or
+  TThreadCreatedByThreadQuery() or
+  TBannedDynamicThreadCreationQuery() or
+  TAtomicAggregateObjectDirectlyAccessedQuery() or
+  TInvalidMemoryOrderArgumentQuery() or
+  TThreadPreviouslyJoinedOrDetachedQuery()
+
+predicate isConcurrency6QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `notNoDeadlocksBetweenThreads` query
+    Concurrency6Package::notNoDeadlocksBetweenThreadsQuery() and
+  queryId =
+    // `@id` for the `notNoDeadlocksBetweenThreads` query
+    "c/misra/not-no-deadlocks-between-threads" and
+  ruleId = "DIR-5-2" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `threadCreatedByThread` query
+    Concurrency6Package::threadCreatedByThreadQuery() and
+  queryId =
+    // `@id` for the `threadCreatedByThread` query
+    "c/misra/thread-created-by-thread" and
+  ruleId = "DIR-5-3" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `bannedDynamicThreadCreation` query
+    Concurrency6Package::bannedDynamicThreadCreationQuery() and
+  queryId =
+    // `@id` for the `bannedDynamicThreadCreation` query
+    "c/misra/banned-dynamic-thread-creation" and
+  ruleId = "DIR-5-3" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `atomicAggregateObjectDirectlyAccessed` query
+    Concurrency6Package::atomicAggregateObjectDirectlyAccessedQuery() and
+  queryId =
+    // `@id` for the `atomicAggregateObjectDirectlyAccessed` query
+    "c/misra/atomic-aggregate-object-directly-accessed" and
+  ruleId = "RULE-12-6" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `invalidMemoryOrderArgument` query
+    Concurrency6Package::invalidMemoryOrderArgumentQuery() and
+  queryId =
+    // `@id` for the `invalidMemoryOrderArgument` query
+    "c/misra/invalid-memory-order-argument" and
+  ruleId = "RULE-21-25" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `threadPreviouslyJoinedOrDetached` query
+    Concurrency6Package::threadPreviouslyJoinedOrDetachedQuery() and
+  queryId =
+    // `@id` for the `threadPreviouslyJoinedOrDetached` query
+    "c/misra/thread-previously-joined-or-detached" and
+  ruleId = "RULE-22-11" and
+  category = "required"
+}
+
+module Concurrency6Package {
+  Query notNoDeadlocksBetweenThreadsQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `notNoDeadlocksBetweenThreads` query
+      TQueryC(TConcurrency6PackageQuery(TNotNoDeadlocksBetweenThreadsQuery()))
+  }
+
+  Query threadCreatedByThreadQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `threadCreatedByThread` query
+      TQueryC(TConcurrency6PackageQuery(TThreadCreatedByThreadQuery()))
+  }
+
+  Query bannedDynamicThreadCreationQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `bannedDynamicThreadCreation` query
+      TQueryC(TConcurrency6PackageQuery(TBannedDynamicThreadCreationQuery()))
+  }
+
+  Query atomicAggregateObjectDirectlyAccessedQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `atomicAggregateObjectDirectlyAccessed` query
+      TQueryC(TConcurrency6PackageQuery(TAtomicAggregateObjectDirectlyAccessedQuery()))
+  }
+
+  Query invalidMemoryOrderArgumentQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `invalidMemoryOrderArgument` query
+      TQueryC(TConcurrency6PackageQuery(TInvalidMemoryOrderArgumentQuery()))
+  }
+
+  Query threadPreviouslyJoinedOrDetachedQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `threadPreviouslyJoinedOrDetached` query
+      TQueryC(TConcurrency6PackageQuery(TThreadPreviouslyJoinedOrDetachedQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency7.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency7.qll
new file mode 100644
index 0000000000..ba492b2a6b
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency7.qll
@@ -0,0 +1,44 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype Concurrency7Query =
+  TUninitializedAtomicObjectQuery() or
+  TTimedlockOnInappropriateMutexTypeQuery()
+
+predicate isConcurrency7QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `uninitializedAtomicObject` query
+    Concurrency7Package::uninitializedAtomicObjectQuery() and
+  queryId =
+    // `@id` for the `uninitializedAtomicObject` query
+    "c/misra/uninitialized-atomic-object" and
+  ruleId = "RULE-9-7" and
+  category = "mandatory"
+  or
+  query =
+    // `Query` instance for the `timedlockOnInappropriateMutexType` query
+    Concurrency7Package::timedlockOnInappropriateMutexTypeQuery() and
+  queryId =
+    // `@id` for the `timedlockOnInappropriateMutexType` query
+    "c/misra/timedlock-on-inappropriate-mutex-type" and
+  ruleId = "RULE-21-26" and
+  category = "required"
+}
+
+module Concurrency7Package {
+  Query uninitializedAtomicObjectQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `uninitializedAtomicObject` query
+      TQueryC(TConcurrency7PackageQuery(TUninitializedAtomicObjectQuery()))
+  }
+
+  Query timedlockOnInappropriateMutexTypeQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `timedlockOnInappropriateMutexType` query
+      TQueryC(TConcurrency7PackageQuery(TTimedlockOnInappropriateMutexTypeQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency8.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency8.qll
new file mode 100644
index 0000000000..677b35d12b
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency8.qll
@@ -0,0 +1,112 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype Concurrency8Query =
+  TNonstandardUseOfThreadingObjectQuery() or
+  TThreadingObjectWithInvalidStorageDurationQuery() or
+  TMutexNotInitializedBeforeUseQuery() or
+  TMutexInitializedInsideThreadQuery() or
+  TMutexInitWithInvalidMutexTypeQuery() or
+  TMutexObjectsNotAlwaysUnlockedQuery()
+
+predicate isConcurrency8QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `nonstandardUseOfThreadingObject` query
+    Concurrency8Package::nonstandardUseOfThreadingObjectQuery() and
+  queryId =
+    // `@id` for the `nonstandardUseOfThreadingObject` query
+    "c/misra/nonstandard-use-of-threading-object" and
+  ruleId = "RULE-22-12" and
+  category = "mandatory"
+  or
+  query =
+    // `Query` instance for the `threadingObjectWithInvalidStorageDuration` query
+    Concurrency8Package::threadingObjectWithInvalidStorageDurationQuery() and
+  queryId =
+    // `@id` for the `threadingObjectWithInvalidStorageDuration` query
+    "c/misra/threading-object-with-invalid-storage-duration" and
+  ruleId = "RULE-22-13" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `mutexNotInitializedBeforeUse` query
+    Concurrency8Package::mutexNotInitializedBeforeUseQuery() and
+  queryId =
+    // `@id` for the `mutexNotInitializedBeforeUse` query
+    "c/misra/mutex-not-initialized-before-use" and
+  ruleId = "RULE-22-14" and
+  category = "mandatory"
+  or
+  query =
+    // `Query` instance for the `mutexInitializedInsideThread` query
+    Concurrency8Package::mutexInitializedInsideThreadQuery() and
+  queryId =
+    // `@id` for the `mutexInitializedInsideThread` query
+    "c/misra/mutex-initialized-inside-thread" and
+  ruleId = "RULE-22-14" and
+  category = "mandatory"
+  or
+  query =
+    // `Query` instance for the `mutexInitWithInvalidMutexType` query
+    Concurrency8Package::mutexInitWithInvalidMutexTypeQuery() and
+  queryId =
+    // `@id` for the `mutexInitWithInvalidMutexType` query
+    "c/misra/mutex-init-with-invalid-mutex-type" and
+  ruleId = "RULE-22-14" and
+  category = "mandatory"
+  or
+  query =
+    // `Query` instance for the `mutexObjectsNotAlwaysUnlocked` query
+    Concurrency8Package::mutexObjectsNotAlwaysUnlockedQuery() and
+  queryId =
+    // `@id` for the `mutexObjectsNotAlwaysUnlocked` query
+    "c/misra/mutex-objects-not-always-unlocked" and
+  ruleId = "RULE-22-16" and
+  category = "required"
+}
+
+module Concurrency8Package {
+  Query nonstandardUseOfThreadingObjectQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `nonstandardUseOfThreadingObject` query
+      TQueryC(TConcurrency8PackageQuery(TNonstandardUseOfThreadingObjectQuery()))
+  }
+
+  Query threadingObjectWithInvalidStorageDurationQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `threadingObjectWithInvalidStorageDuration` query
+      TQueryC(TConcurrency8PackageQuery(TThreadingObjectWithInvalidStorageDurationQuery()))
+  }
+
+  Query mutexNotInitializedBeforeUseQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `mutexNotInitializedBeforeUse` query
+      TQueryC(TConcurrency8PackageQuery(TMutexNotInitializedBeforeUseQuery()))
+  }
+
+  Query mutexInitializedInsideThreadQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `mutexInitializedInsideThread` query
+      TQueryC(TConcurrency8PackageQuery(TMutexInitializedInsideThreadQuery()))
+  }
+
+  Query mutexInitWithInvalidMutexTypeQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `mutexInitWithInvalidMutexType` query
+      TQueryC(TConcurrency8PackageQuery(TMutexInitWithInvalidMutexTypeQuery()))
+  }
+
+  Query mutexObjectsNotAlwaysUnlockedQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `mutexObjectsNotAlwaysUnlocked` query
+      TQueryC(TConcurrency8PackageQuery(TMutexObjectsNotAlwaysUnlockedQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency9.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency9.qll
new file mode 100644
index 0000000000..b013bbdabb
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Concurrency9.qll
@@ -0,0 +1,146 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype Concurrency9Query =
+  TPossibleDataRaceBetweenThreadsQuery() or
+  TThreadResourceDisposedBeforeThreadsJoinedQuery() or
+  TInvalidOperationOnUnlockedMutexQuery() or
+  TNonRecursiveMutexRecursivelyLockedQuery() or
+  TNonRecursiveMutexRecursivelyLockedAuditQuery() or
+  TConditionVariableUsedWithMultipleMutexesQuery() or
+  TThreadStorageNotInitializedBeforeUseQuery() or
+  TThreadStoragePointerInitializedInsideThreadQuery()
+
+predicate isConcurrency9QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `possibleDataRaceBetweenThreads` query
+    Concurrency9Package::possibleDataRaceBetweenThreadsQuery() and
+  queryId =
+    // `@id` for the `possibleDataRaceBetweenThreads` query
+    "c/misra/possible-data-race-between-threads" and
+  ruleId = "DIR-5-1" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `threadResourceDisposedBeforeThreadsJoined` query
+    Concurrency9Package::threadResourceDisposedBeforeThreadsJoinedQuery() and
+  queryId =
+    // `@id` for the `threadResourceDisposedBeforeThreadsJoined` query
+    "c/misra/thread-resource-disposed-before-threads-joined" and
+  ruleId = "RULE-22-15" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `invalidOperationOnUnlockedMutex` query
+    Concurrency9Package::invalidOperationOnUnlockedMutexQuery() and
+  queryId =
+    // `@id` for the `invalidOperationOnUnlockedMutex` query
+    "c/misra/invalid-operation-on-unlocked-mutex" and
+  ruleId = "RULE-22-17" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `nonRecursiveMutexRecursivelyLocked` query
+    Concurrency9Package::nonRecursiveMutexRecursivelyLockedQuery() and
+  queryId =
+    // `@id` for the `nonRecursiveMutexRecursivelyLocked` query
+    "c/misra/non-recursive-mutex-recursively-locked" and
+  ruleId = "RULE-22-18" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `nonRecursiveMutexRecursivelyLockedAudit` query
+    Concurrency9Package::nonRecursiveMutexRecursivelyLockedAuditQuery() and
+  queryId =
+    // `@id` for the `nonRecursiveMutexRecursivelyLockedAudit` query
+    "c/misra/non-recursive-mutex-recursively-locked-audit" and
+  ruleId = "RULE-22-18" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `conditionVariableUsedWithMultipleMutexes` query
+    Concurrency9Package::conditionVariableUsedWithMultipleMutexesQuery() and
+  queryId =
+    // `@id` for the `conditionVariableUsedWithMultipleMutexes` query
+    "c/misra/condition-variable-used-with-multiple-mutexes" and
+  ruleId = "RULE-22-19" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `threadStorageNotInitializedBeforeUse` query
+    Concurrency9Package::threadStorageNotInitializedBeforeUseQuery() and
+  queryId =
+    // `@id` for the `threadStorageNotInitializedBeforeUse` query
+    "c/misra/thread-storage-not-initialized-before-use" and
+  ruleId = "RULE-22-20" and
+  category = "mandatory"
+  or
+  query =
+    // `Query` instance for the `threadStoragePointerInitializedInsideThread` query
+    Concurrency9Package::threadStoragePointerInitializedInsideThreadQuery() and
+  queryId =
+    // `@id` for the `threadStoragePointerInitializedInsideThread` query
+    "c/misra/thread-storage-pointer-initialized-inside-thread" and
+  ruleId = "RULE-22-20" and
+  category = "mandatory"
+}
+
+module Concurrency9Package {
+  Query possibleDataRaceBetweenThreadsQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `possibleDataRaceBetweenThreads` query
+      TQueryC(TConcurrency9PackageQuery(TPossibleDataRaceBetweenThreadsQuery()))
+  }
+
+  Query threadResourceDisposedBeforeThreadsJoinedQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `threadResourceDisposedBeforeThreadsJoined` query
+      TQueryC(TConcurrency9PackageQuery(TThreadResourceDisposedBeforeThreadsJoinedQuery()))
+  }
+
+  Query invalidOperationOnUnlockedMutexQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `invalidOperationOnUnlockedMutex` query
+      TQueryC(TConcurrency9PackageQuery(TInvalidOperationOnUnlockedMutexQuery()))
+  }
+
+  Query nonRecursiveMutexRecursivelyLockedQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `nonRecursiveMutexRecursivelyLocked` query
+      TQueryC(TConcurrency9PackageQuery(TNonRecursiveMutexRecursivelyLockedQuery()))
+  }
+
+  Query nonRecursiveMutexRecursivelyLockedAuditQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `nonRecursiveMutexRecursivelyLockedAudit` query
+      TQueryC(TConcurrency9PackageQuery(TNonRecursiveMutexRecursivelyLockedAuditQuery()))
+  }
+
+  Query conditionVariableUsedWithMultipleMutexesQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `conditionVariableUsedWithMultipleMutexes` query
+      TQueryC(TConcurrency9PackageQuery(TConditionVariableUsedWithMultipleMutexesQuery()))
+  }
+
+  Query threadStorageNotInitializedBeforeUseQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `threadStorageNotInitializedBeforeUse` query
+      TQueryC(TConcurrency9PackageQuery(TThreadStorageNotInitializedBeforeUseQuery()))
+  }
+
+  Query threadStoragePointerInitializedInsideThreadQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `threadStoragePointerInitializedInsideThread` query
+      TQueryC(TConcurrency9PackageQuery(TThreadStoragePointerInitializedInsideThreadQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Contracts.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Contracts.qll
new file mode 100644
index 0000000000..174e7769b7
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Contracts.qll
@@ -0,0 +1,78 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype ContractsQuery =
+  TDoNotViolateInLineLinkageConstraintsQuery() or
+  TCheckMathLibraryFunctionParametersQuery() or
+  TLowPrecisionPeriodicTrigonometricFunctionCallQuery() or
+  TFunctionErrorInformationUntestedQuery()
+
+predicate isContractsQueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `doNotViolateInLineLinkageConstraints` query
+    ContractsPackage::doNotViolateInLineLinkageConstraintsQuery() and
+  queryId =
+    // `@id` for the `doNotViolateInLineLinkageConstraints` query
+    "c/cert/do-not-violate-in-line-linkage-constraints" and
+  ruleId = "MSC40-C" and
+  category = "rule"
+  or
+  query =
+    // `Query` instance for the `checkMathLibraryFunctionParameters` query
+    ContractsPackage::checkMathLibraryFunctionParametersQuery() and
+  queryId =
+    // `@id` for the `checkMathLibraryFunctionParameters` query
+    "c/misra/check-math-library-function-parameters" and
+  ruleId = "DIR-4-11" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `lowPrecisionPeriodicTrigonometricFunctionCall` query
+    ContractsPackage::lowPrecisionPeriodicTrigonometricFunctionCallQuery() and
+  queryId =
+    // `@id` for the `lowPrecisionPeriodicTrigonometricFunctionCall` query
+    "c/misra/low-precision-periodic-trigonometric-function-call" and
+  ruleId = "DIR-4-11" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `functionErrorInformationUntested` query
+    ContractsPackage::functionErrorInformationUntestedQuery() and
+  queryId =
+    // `@id` for the `functionErrorInformationUntested` query
+    "c/misra/function-error-information-untested" and
+  ruleId = "DIR-4-7" and
+  category = "required"
+}
+
+module ContractsPackage {
+  Query doNotViolateInLineLinkageConstraintsQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `doNotViolateInLineLinkageConstraints` query
+      TQueryC(TContractsPackageQuery(TDoNotViolateInLineLinkageConstraintsQuery()))
+  }
+
+  Query checkMathLibraryFunctionParametersQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `checkMathLibraryFunctionParameters` query
+      TQueryC(TContractsPackageQuery(TCheckMathLibraryFunctionParametersQuery()))
+  }
+
+  Query lowPrecisionPeriodicTrigonometricFunctionCallQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `lowPrecisionPeriodicTrigonometricFunctionCall` query
+      TQueryC(TContractsPackageQuery(TLowPrecisionPeriodicTrigonometricFunctionCallQuery()))
+  }
+
+  Query functionErrorInformationUntestedQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `functionErrorInformationUntested` query
+      TQueryC(TContractsPackageQuery(TFunctionErrorInformationUntestedQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Contracts6.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Contracts6.qll
index bd897bd79f..eed78ae507 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/c/Contracts6.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Contracts6.qll
@@ -25,7 +25,7 @@ predicate isContracts6QueryMetadata(Query query, string queryId, string ruleId,
     // `@id` for the `arrayFunctionArgumentNumberOfElements` query
     "c/misra/array-function-argument-number-of-elements" and
   ruleId = "RULE-17-5" and
-  category = "advisory"
+  category = "required"
   or
   query =
     // `Query` instance for the `valueReturnedByAFunctionNotUsed` query
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/DeadCode2.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/DeadCode2.qll
new file mode 100644
index 0000000000..611062a5ac
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/DeadCode2.qll
@@ -0,0 +1,44 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype DeadCode2Query =
+  TUnusedObjectDefinitionQuery() or
+  TUnusedObjectDefinitionStrictQuery()
+
+predicate isDeadCode2QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `unusedObjectDefinition` query
+    DeadCode2Package::unusedObjectDefinitionQuery() and
+  queryId =
+    // `@id` for the `unusedObjectDefinition` query
+    "c/misra/unused-object-definition" and
+  ruleId = "RULE-2-8" and
+  category = "advisory"
+  or
+  query =
+    // `Query` instance for the `unusedObjectDefinitionStrict` query
+    DeadCode2Package::unusedObjectDefinitionStrictQuery() and
+  queryId =
+    // `@id` for the `unusedObjectDefinitionStrict` query
+    "c/misra/unused-object-definition-strict" and
+  ruleId = "RULE-2-8" and
+  category = "advisory"
+}
+
+module DeadCode2Package {
+  Query unusedObjectDefinitionQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `unusedObjectDefinition` query
+      TQueryC(TDeadCode2PackageQuery(TUnusedObjectDefinitionQuery()))
+  }
+
+  Query unusedObjectDefinitionStrictQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `unusedObjectDefinitionStrict` query
+      TQueryC(TDeadCode2PackageQuery(TUnusedObjectDefinitionStrictQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Declarations9.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Declarations9.qll
new file mode 100644
index 0000000000..8a63e50ed4
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Declarations9.qll
@@ -0,0 +1,26 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype Declarations9Query = TAtomicQualifierAppliedToVoidQuery()
+
+predicate isDeclarations9QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `atomicQualifierAppliedToVoid` query
+    Declarations9Package::atomicQualifierAppliedToVoidQuery() and
+  queryId =
+    // `@id` for the `atomicQualifierAppliedToVoid` query
+    "c/misra/atomic-qualifier-applied-to-void" and
+  ruleId = "RULE-11-10" and
+  category = "required"
+}
+
+module Declarations9Package {
+  Query atomicQualifierAppliedToVoidQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `atomicQualifierAppliedToVoid` query
+      TQueryC(TDeclarations9PackageQuery(TAtomicQualifierAppliedToVoidQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/EssentialTypes2.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/EssentialTypes2.qll
new file mode 100644
index 0000000000..e1dd8d5636
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/EssentialTypes2.qll
@@ -0,0 +1,44 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype EssentialTypes2Query =
+  TTgMathArgumentWithInvalidEssentialTypeQuery() or
+  TTgMathArgumentsWithDifferingStandardTypeQuery()
+
+predicate isEssentialTypes2QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `tgMathArgumentWithInvalidEssentialType` query
+    EssentialTypes2Package::tgMathArgumentWithInvalidEssentialTypeQuery() and
+  queryId =
+    // `@id` for the `tgMathArgumentWithInvalidEssentialType` query
+    "c/misra/tg-math-argument-with-invalid-essential-type" and
+  ruleId = "RULE-21-22" and
+  category = "mandatory"
+  or
+  query =
+    // `Query` instance for the `tgMathArgumentsWithDifferingStandardType` query
+    EssentialTypes2Package::tgMathArgumentsWithDifferingStandardTypeQuery() and
+  queryId =
+    // `@id` for the `tgMathArgumentsWithDifferingStandardType` query
+    "c/misra/tg-math-arguments-with-differing-standard-type" and
+  ruleId = "RULE-21-23" and
+  category = "required"
+}
+
+module EssentialTypes2Package {
+  Query tgMathArgumentWithInvalidEssentialTypeQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `tgMathArgumentWithInvalidEssentialType` query
+      TQueryC(TEssentialTypes2PackageQuery(TTgMathArgumentWithInvalidEssentialTypeQuery()))
+  }
+
+  Query tgMathArgumentsWithDifferingStandardTypeQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `tgMathArgumentsWithDifferingStandardType` query
+      TQueryC(TEssentialTypes2PackageQuery(TTgMathArgumentsWithDifferingStandardTypeQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Expressions2.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Expressions2.qll
new file mode 100644
index 0000000000..e7dffc30bb
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Expressions2.qll
@@ -0,0 +1,26 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype Expressions2Query = TDoNotCompareFunctionPointersToConstantValuesQuery()
+
+predicate isExpressions2QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `doNotCompareFunctionPointersToConstantValues` query
+    Expressions2Package::doNotCompareFunctionPointersToConstantValuesQuery() and
+  queryId =
+    // `@id` for the `doNotCompareFunctionPointersToConstantValues` query
+    "c/cert/do-not-compare-function-pointers-to-constant-values" and
+  ruleId = "EXP16-C" and
+  category = "recommendation"
+}
+
+module Expressions2Package {
+  Query doNotCompareFunctionPointersToConstantValuesQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `doNotCompareFunctionPointersToConstantValues` query
+      TQueryC(TExpressions2PackageQuery(TDoNotCompareFunctionPointersToConstantValuesQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/FloatingTypes2.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/FloatingTypes2.qll
new file mode 100644
index 0000000000..0dbc6cc22d
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/FloatingTypes2.qll
@@ -0,0 +1,44 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype FloatingTypes2Query =
+  TPossibleMisuseOfUndetectedInfinityQuery() or
+  TPossibleMisuseOfUndetectedNaNQuery()
+
+predicate isFloatingTypes2QueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `possibleMisuseOfUndetectedInfinity` query
+    FloatingTypes2Package::possibleMisuseOfUndetectedInfinityQuery() and
+  queryId =
+    // `@id` for the `possibleMisuseOfUndetectedInfinity` query
+    "c/misra/possible-misuse-of-undetected-infinity" and
+  ruleId = "DIR-4-15" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `possibleMisuseOfUndetectedNaN` query
+    FloatingTypes2Package::possibleMisuseOfUndetectedNaNQuery() and
+  queryId =
+    // `@id` for the `possibleMisuseOfUndetectedNaN` query
+    "c/misra/possible-misuse-of-undetected-nan" and
+  ruleId = "DIR-4-15" and
+  category = "required"
+}
+
+module FloatingTypes2Package {
+  Query possibleMisuseOfUndetectedInfinityQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `possibleMisuseOfUndetectedInfinity` query
+      TQueryC(TFloatingTypes2PackageQuery(TPossibleMisuseOfUndetectedInfinityQuery()))
+  }
+
+  Query possibleMisuseOfUndetectedNaNQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `possibleMisuseOfUndetectedNaN` query
+      TQueryC(TFloatingTypes2PackageQuery(TPossibleMisuseOfUndetectedNaNQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Generics.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Generics.qll
new file mode 100644
index 0000000000..05e3402c19
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Generics.qll
@@ -0,0 +1,163 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype GenericsQuery =
+  TGenericSelectionNotExpandedFromAMacroQuery() or
+  TGenericSelectionDoesntDependOnMacroArgumentQuery() or
+  TGenericSelectionNotFromMacroWithSideEffectsQuery() or
+  TGenericWithoutNonDefaultAssociationQuery() or
+  TGenericAssociationWithUnselectableTypeQuery() or
+  TDangerousDefaultSelectionForPointerInGenericQuery() or
+  TGenericExpressionWithIncorrectEssentialTypeQuery() or
+  TInvalidGenericMacroArgumentEvaluationQuery() or
+  TDefaultGenericSelectionNotFirstOrLastQuery()
+
+predicate isGenericsQueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `genericSelectionNotExpandedFromAMacro` query
+    GenericsPackage::genericSelectionNotExpandedFromAMacroQuery() and
+  queryId =
+    // `@id` for the `genericSelectionNotExpandedFromAMacro` query
+    "c/misra/generic-selection-not-expanded-from-a-macro" and
+  ruleId = "RULE-23-1" and
+  category = "advisory"
+  or
+  query =
+    // `Query` instance for the `genericSelectionDoesntDependOnMacroArgument` query
+    GenericsPackage::genericSelectionDoesntDependOnMacroArgumentQuery() and
+  queryId =
+    // `@id` for the `genericSelectionDoesntDependOnMacroArgument` query
+    "c/misra/generic-selection-doesnt-depend-on-macro-argument" and
+  ruleId = "RULE-23-1" and
+  category = "advisory"
+  or
+  query =
+    // `Query` instance for the `genericSelectionNotFromMacroWithSideEffects` query
+    GenericsPackage::genericSelectionNotFromMacroWithSideEffectsQuery() and
+  queryId =
+    // `@id` for the `genericSelectionNotFromMacroWithSideEffects` query
+    "c/misra/generic-selection-not-from-macro-with-side-effects" and
+  ruleId = "RULE-23-2" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `genericWithoutNonDefaultAssociation` query
+    GenericsPackage::genericWithoutNonDefaultAssociationQuery() and
+  queryId =
+    // `@id` for the `genericWithoutNonDefaultAssociation` query
+    "c/misra/generic-without-non-default-association" and
+  ruleId = "RULE-23-3" and
+  category = "advisory"
+  or
+  query =
+    // `Query` instance for the `genericAssociationWithUnselectableType` query
+    GenericsPackage::genericAssociationWithUnselectableTypeQuery() and
+  queryId =
+    // `@id` for the `genericAssociationWithUnselectableType` query
+    "c/misra/generic-association-with-unselectable-type" and
+  ruleId = "RULE-23-4" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `dangerousDefaultSelectionForPointerInGeneric` query
+    GenericsPackage::dangerousDefaultSelectionForPointerInGenericQuery() and
+  queryId =
+    // `@id` for the `dangerousDefaultSelectionForPointerInGeneric` query
+    "c/misra/dangerous-default-selection-for-pointer-in-generic" and
+  ruleId = "RULE-23-5" and
+  category = "advisory"
+  or
+  query =
+    // `Query` instance for the `genericExpressionWithIncorrectEssentialType` query
+    GenericsPackage::genericExpressionWithIncorrectEssentialTypeQuery() and
+  queryId =
+    // `@id` for the `genericExpressionWithIncorrectEssentialType` query
+    "c/misra/generic-expression-with-incorrect-essential-type" and
+  ruleId = "RULE-23-6" and
+  category = "required"
+  or
+  query =
+    // `Query` instance for the `invalidGenericMacroArgumentEvaluation` query
+    GenericsPackage::invalidGenericMacroArgumentEvaluationQuery() and
+  queryId =
+    // `@id` for the `invalidGenericMacroArgumentEvaluation` query
+    "c/misra/invalid-generic-macro-argument-evaluation" and
+  ruleId = "RULE-23-7" and
+  category = "advisory"
+  or
+  query =
+    // `Query` instance for the `defaultGenericSelectionNotFirstOrLast` query
+    GenericsPackage::defaultGenericSelectionNotFirstOrLastQuery() and
+  queryId =
+    // `@id` for the `defaultGenericSelectionNotFirstOrLast` query
+    "c/misra/default-generic-selection-not-first-or-last" and
+  ruleId = "RULE-23-8" and
+  category = "required"
+}
+
+module GenericsPackage {
+  Query genericSelectionNotExpandedFromAMacroQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `genericSelectionNotExpandedFromAMacro` query
+      TQueryC(TGenericsPackageQuery(TGenericSelectionNotExpandedFromAMacroQuery()))
+  }
+
+  Query genericSelectionDoesntDependOnMacroArgumentQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `genericSelectionDoesntDependOnMacroArgument` query
+      TQueryC(TGenericsPackageQuery(TGenericSelectionDoesntDependOnMacroArgumentQuery()))
+  }
+
+  Query genericSelectionNotFromMacroWithSideEffectsQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `genericSelectionNotFromMacroWithSideEffects` query
+      TQueryC(TGenericsPackageQuery(TGenericSelectionNotFromMacroWithSideEffectsQuery()))
+  }
+
+  Query genericWithoutNonDefaultAssociationQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `genericWithoutNonDefaultAssociation` query
+      TQueryC(TGenericsPackageQuery(TGenericWithoutNonDefaultAssociationQuery()))
+  }
+
+  Query genericAssociationWithUnselectableTypeQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `genericAssociationWithUnselectableType` query
+      TQueryC(TGenericsPackageQuery(TGenericAssociationWithUnselectableTypeQuery()))
+  }
+
+  Query dangerousDefaultSelectionForPointerInGenericQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `dangerousDefaultSelectionForPointerInGeneric` query
+      TQueryC(TGenericsPackageQuery(TDangerousDefaultSelectionForPointerInGenericQuery()))
+  }
+
+  Query genericExpressionWithIncorrectEssentialTypeQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `genericExpressionWithIncorrectEssentialType` query
+      TQueryC(TGenericsPackageQuery(TGenericExpressionWithIncorrectEssentialTypeQuery()))
+  }
+
+  Query invalidGenericMacroArgumentEvaluationQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `invalidGenericMacroArgumentEvaluation` query
+      TQueryC(TGenericsPackageQuery(TInvalidGenericMacroArgumentEvaluationQuery()))
+  }
+
+  Query defaultGenericSelectionNotFirstOrLastQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `defaultGenericSelectionNotFirstOrLast` query
+      TQueryC(TGenericsPackageQuery(TDefaultGenericSelectionNotFirstOrLastQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/Pointers1.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/Pointers1.qll
index e35f0f3a88..725fe46904 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/c/Pointers1.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/Pointers1.qll
@@ -19,6 +19,7 @@ newtype Pointers1Query =
   TDoNotUseAdditionOrSubtractionOperatorsOnPointersQuery() or
   TNoMoreThanTwoLevelsOfPointerNestingInDeclarationsQuery() or
   TAutomaticStorageObjectAddressCopiedToOtherObjectQuery() or
+  TThreadLocalObjectAddressCopiedToGlobalObjectQuery() or
   TObjectWithNoPointerDereferenceShouldBeOpaqueQuery() or
   TPointerShouldPointToConstTypeWhenPossibleQuery()
 
@@ -158,6 +159,15 @@ predicate isPointers1QueryMetadata(Query query, string queryId, string ruleId, s
   ruleId = "RULE-18-6" and
   category = "required"
   or
+  query =
+    // `Query` instance for the `threadLocalObjectAddressCopiedToGlobalObject` query
+    Pointers1Package::threadLocalObjectAddressCopiedToGlobalObjectQuery() and
+  queryId =
+    // `@id` for the `threadLocalObjectAddressCopiedToGlobalObject` query
+    "c/misra/thread-local-object-address-copied-to-global-object" and
+  ruleId = "RULE-18-6" and
+  category = "required"
+  or
   query =
     // `Query` instance for the `objectWithNoPointerDereferenceShouldBeOpaque` query
     Pointers1Package::objectWithNoPointerDereferenceShouldBeOpaqueQuery() and
@@ -283,6 +293,13 @@ module Pointers1Package {
       TQueryC(TPointers1PackageQuery(TAutomaticStorageObjectAddressCopiedToOtherObjectQuery()))
   }
 
+  Query threadLocalObjectAddressCopiedToGlobalObjectQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `threadLocalObjectAddressCopiedToGlobalObject` query
+      TQueryC(TPointers1PackageQuery(TThreadLocalObjectAddressCopiedToGlobalObjectQuery()))
+  }
+
   Query objectWithNoPointerDereferenceShouldBeOpaqueQuery() {
     //autogenerate `Query` type
     result =
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/RuleMetadata.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/RuleMetadata.qll
index 1562ba7894..b574f7551c 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/c/RuleMetadata.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/RuleMetadata.qll
@@ -12,6 +12,11 @@ import Concurrency2
 import Concurrency3
 import Concurrency4
 import Concurrency5
+import Concurrency6
+import Concurrency7
+import Concurrency8
+import Concurrency9
+import Contracts
 import Contracts1
 import Contracts2
 import Contracts3
@@ -20,6 +25,7 @@ import Contracts5
 import Contracts6
 import Contracts7
 import DeadCode
+import DeadCode2
 import Declarations1
 import Declarations2
 import Declarations3
@@ -28,10 +34,15 @@ import Declarations5
 import Declarations6
 import Declarations7
 import Declarations8
+import Declarations9
 import EssentialTypes
+import EssentialTypes2
 import Expressions
+import Expressions2
 import FloatingTypes
+import FloatingTypes2
 import FunctionTypes
+import Generics
 import IO1
 import IO2
 import IO3
@@ -91,6 +102,11 @@ newtype TCQuery =
   TConcurrency3PackageQuery(Concurrency3Query q) or
   TConcurrency4PackageQuery(Concurrency4Query q) or
   TConcurrency5PackageQuery(Concurrency5Query q) or
+  TConcurrency6PackageQuery(Concurrency6Query q) or
+  TConcurrency7PackageQuery(Concurrency7Query q) or
+  TConcurrency8PackageQuery(Concurrency8Query q) or
+  TConcurrency9PackageQuery(Concurrency9Query q) or
+  TContractsPackageQuery(ContractsQuery q) or
   TContracts1PackageQuery(Contracts1Query q) or
   TContracts2PackageQuery(Contracts2Query q) or
   TContracts3PackageQuery(Contracts3Query q) or
@@ -99,6 +115,7 @@ newtype TCQuery =
   TContracts6PackageQuery(Contracts6Query q) or
   TContracts7PackageQuery(Contracts7Query q) or
   TDeadCodePackageQuery(DeadCodeQuery q) or
+  TDeadCode2PackageQuery(DeadCode2Query q) or
   TDeclarations1PackageQuery(Declarations1Query q) or
   TDeclarations2PackageQuery(Declarations2Query q) or
   TDeclarations3PackageQuery(Declarations3Query q) or
@@ -107,10 +124,15 @@ newtype TCQuery =
   TDeclarations6PackageQuery(Declarations6Query q) or
   TDeclarations7PackageQuery(Declarations7Query q) or
   TDeclarations8PackageQuery(Declarations8Query q) or
+  TDeclarations9PackageQuery(Declarations9Query q) or
   TEssentialTypesPackageQuery(EssentialTypesQuery q) or
+  TEssentialTypes2PackageQuery(EssentialTypes2Query q) or
   TExpressionsPackageQuery(ExpressionsQuery q) or
+  TExpressions2PackageQuery(Expressions2Query q) or
   TFloatingTypesPackageQuery(FloatingTypesQuery q) or
+  TFloatingTypes2PackageQuery(FloatingTypes2Query q) or
   TFunctionTypesPackageQuery(FunctionTypesQuery q) or
+  TGenericsPackageQuery(GenericsQuery q) or
   TIO1PackageQuery(IO1Query q) or
   TIO2PackageQuery(IO2Query q) or
   TIO3PackageQuery(IO3Query q) or
@@ -170,6 +192,11 @@ predicate isQueryMetadata(Query query, string queryId, string ruleId, string cat
   isConcurrency3QueryMetadata(query, queryId, ruleId, category) or
   isConcurrency4QueryMetadata(query, queryId, ruleId, category) or
   isConcurrency5QueryMetadata(query, queryId, ruleId, category) or
+  isConcurrency6QueryMetadata(query, queryId, ruleId, category) or
+  isConcurrency7QueryMetadata(query, queryId, ruleId, category) or
+  isConcurrency8QueryMetadata(query, queryId, ruleId, category) or
+  isConcurrency9QueryMetadata(query, queryId, ruleId, category) or
+  isContractsQueryMetadata(query, queryId, ruleId, category) or
   isContracts1QueryMetadata(query, queryId, ruleId, category) or
   isContracts2QueryMetadata(query, queryId, ruleId, category) or
   isContracts3QueryMetadata(query, queryId, ruleId, category) or
@@ -178,6 +205,7 @@ predicate isQueryMetadata(Query query, string queryId, string ruleId, string cat
   isContracts6QueryMetadata(query, queryId, ruleId, category) or
   isContracts7QueryMetadata(query, queryId, ruleId, category) or
   isDeadCodeQueryMetadata(query, queryId, ruleId, category) or
+  isDeadCode2QueryMetadata(query, queryId, ruleId, category) or
   isDeclarations1QueryMetadata(query, queryId, ruleId, category) or
   isDeclarations2QueryMetadata(query, queryId, ruleId, category) or
   isDeclarations3QueryMetadata(query, queryId, ruleId, category) or
@@ -186,10 +214,15 @@ predicate isQueryMetadata(Query query, string queryId, string ruleId, string cat
   isDeclarations6QueryMetadata(query, queryId, ruleId, category) or
   isDeclarations7QueryMetadata(query, queryId, ruleId, category) or
   isDeclarations8QueryMetadata(query, queryId, ruleId, category) or
+  isDeclarations9QueryMetadata(query, queryId, ruleId, category) or
   isEssentialTypesQueryMetadata(query, queryId, ruleId, category) or
+  isEssentialTypes2QueryMetadata(query, queryId, ruleId, category) or
   isExpressionsQueryMetadata(query, queryId, ruleId, category) or
+  isExpressions2QueryMetadata(query, queryId, ruleId, category) or
   isFloatingTypesQueryMetadata(query, queryId, ruleId, category) or
+  isFloatingTypes2QueryMetadata(query, queryId, ruleId, category) or
   isFunctionTypesQueryMetadata(query, queryId, ruleId, category) or
+  isGenericsQueryMetadata(query, queryId, ruleId, category) or
   isIO1QueryMetadata(query, queryId, ruleId, category) or
   isIO2QueryMetadata(query, queryId, ruleId, category) or
   isIO3QueryMetadata(query, queryId, ruleId, category) or
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects1.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects1.qll
index 24175cdfb7..ec8ab3eae8 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects1.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects1.qll
@@ -104,7 +104,7 @@ predicate isSideEffects1QueryMetadata(Query query, string queryId, string ruleId
     // `@id` for the `sizeofOperandWithSideEffect` query
     "c/misra/sizeof-operand-with-side-effect" and
   ruleId = "RULE-13-6" and
-  category = "mandatory"
+  category = "required"
 }
 
 module SideEffects1Package {
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects3.qll b/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects3.qll
index eff4f2caf9..7b01c18099 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects3.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/c/SideEffects3.qll
@@ -3,7 +3,9 @@ import cpp
 import RuleMetadata
 import codingstandards.cpp.exclusions.RuleMetadata
 
-newtype SideEffects3Query = TUnsequencedSideEffectsQuery()
+newtype SideEffects3Query =
+  TUnsequencedSideEffectsQuery() or
+  TUnsequencedAtomicReadsQuery()
 
 predicate isSideEffects3QueryMetadata(Query query, string queryId, string ruleId, string category) {
   query =
@@ -14,6 +16,15 @@ predicate isSideEffects3QueryMetadata(Query query, string queryId, string ruleId
     "c/misra/unsequenced-side-effects" and
   ruleId = "RULE-13-2" and
   category = "required"
+  or
+  query =
+    // `Query` instance for the `unsequencedAtomicReads` query
+    SideEffects3Package::unsequencedAtomicReadsQuery() and
+  queryId =
+    // `@id` for the `unsequencedAtomicReads` query
+    "c/misra/unsequenced-atomic-reads" and
+  ruleId = "RULE-13-2" and
+  category = "required"
 }
 
 module SideEffects3Package {
@@ -23,4 +34,11 @@ module SideEffects3Package {
       // `Query` type for `unsequencedSideEffects` query
       TQueryC(TSideEffects3PackageQuery(TUnsequencedSideEffectsQuery()))
   }
+
+  Query unsequencedAtomicReadsQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `unsequencedAtomicReads` query
+      TQueryC(TSideEffects3PackageQuery(TUnsequencedAtomicReadsQuery()))
+  }
 }
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/cpp/Classes.qll b/cpp/common/src/codingstandards/cpp/exclusions/cpp/Classes.qll
index 92c7a4280e..3daf48c696 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/cpp/Classes.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/cpp/Classes.qll
@@ -13,7 +13,6 @@ newtype ClassesQuery =
   TClassDataMembersInitializationConditionQuery() or
   TRedundantMemberFunctionsShouldBeDefaultedOrLeftUndefinedQuery() or
   TNonTemplateMemberDefinedInTemplateQuery() or
-  TTrivialOrTemplateFunctionDefinedOutsideClassDefinitionQuery() or
   TNonTrivialNonTemplateFunctionDefinedInsideClassDefinitionQuery() or
   TInParametersForNotCheapToCopyTypesNotPassedByReferenceQuery() or
   TInParametersForCheapToCopyTypesNotPassedByValueQuery() or
@@ -105,15 +104,6 @@ predicate isClassesQueryMetadata(Query query, string queryId, string ruleId, str
   ruleId = "A14-5-2" and
   category = "advisory"
   or
-  query =
-    // `Query` instance for the `trivialOrTemplateFunctionDefinedOutsideClassDefinition` query
-    ClassesPackage::trivialOrTemplateFunctionDefinedOutsideClassDefinitionQuery() and
-  queryId =
-    // `@id` for the `trivialOrTemplateFunctionDefinedOutsideClassDefinition` query
-    "cpp/autosar/trivial-or-template-function-defined-outside-class-definition" and
-  ruleId = "A3-1-5" and
-  category = "required"
-  or
   query =
     // `Query` instance for the `nonTrivialNonTemplateFunctionDefinedInsideClassDefinition` query
     ClassesPackage::nonTrivialNonTemplateFunctionDefinedInsideClassDefinitionQuery() and
@@ -251,13 +241,6 @@ module ClassesPackage {
       TQueryCPP(TClassesPackageQuery(TNonTemplateMemberDefinedInTemplateQuery()))
   }
 
-  Query trivialOrTemplateFunctionDefinedOutsideClassDefinitionQuery() {
-    //autogenerate `Query` type
-    result =
-      // `Query` type for `trivialOrTemplateFunctionDefinedOutsideClassDefinition` query
-      TQueryCPP(TClassesPackageQuery(TTrivialOrTemplateFunctionDefinedOutsideClassDefinitionQuery()))
-  }
-
   Query nonTrivialNonTemplateFunctionDefinedInsideClassDefinitionQuery() {
     //autogenerate `Query` type
     result =
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/cpp/Const.qll b/cpp/common/src/codingstandards/cpp/exclusions/cpp/Const.qll
index 09f40388cc..f542ddf486 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/cpp/Const.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/cpp/Const.qll
@@ -7,7 +7,6 @@ newtype ConstQuery =
   TRemoveConstOrVolatileQualificationAutosarQuery() or
   TDeclarationUnmodifiedObjectMissingConstSpecifierQuery() or
   TVariableMissingConstexprQuery() or
-  TFunctionMissingConstexprQuery() or
   TCvQualifiersNotPlacedOnTheRightHandSideQuery() or
   TOutputParametersUsedQuery() or
   TInOutParametersDeclaredAsTNotModifiedQuery() or
@@ -45,15 +44,6 @@ predicate isConstQueryMetadata(Query query, string queryId, string ruleId, strin
   ruleId = "A7-1-2" and
   category = "required"
   or
-  query =
-    // `Query` instance for the `functionMissingConstexpr` query
-    ConstPackage::functionMissingConstexprQuery() and
-  queryId =
-    // `@id` for the `functionMissingConstexpr` query
-    "cpp/autosar/function-missing-constexpr" and
-  ruleId = "A7-1-2" and
-  category = "required"
-  or
   query =
     // `Query` instance for the `cvQualifiersNotPlacedOnTheRightHandSide` query
     ConstPackage::cvQualifiersNotPlacedOnTheRightHandSideQuery() and
@@ -149,13 +139,6 @@ module ConstPackage {
       TQueryCPP(TConstPackageQuery(TVariableMissingConstexprQuery()))
   }
 
-  Query functionMissingConstexprQuery() {
-    //autogenerate `Query` type
-    result =
-      // `Query` type for `functionMissingConstexpr` query
-      TQueryCPP(TConstPackageQuery(TFunctionMissingConstexprQuery()))
-  }
-
   Query cvQualifiersNotPlacedOnTheRightHandSideQuery() {
     //autogenerate `Query` type
     result =
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/cpp/FloatingPoint.qll b/cpp/common/src/codingstandards/cpp/exclusions/cpp/FloatingPoint.qll
new file mode 100644
index 0000000000..0ff7a07214
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exclusions/cpp/FloatingPoint.qll
@@ -0,0 +1,44 @@
+//** THIS FILE IS AUTOGENERATED, DO NOT MODIFY DIRECTLY.  **/
+import cpp
+import RuleMetadata
+import codingstandards.cpp.exclusions.RuleMetadata
+
+newtype FloatingPointQuery =
+  TPossibleMisuseOfInfiniteFloatingPointValueQuery() or
+  TPossibleMisuseOfNaNFloatingPointValueQuery()
+
+predicate isFloatingPointQueryMetadata(Query query, string queryId, string ruleId, string category) {
+  query =
+    // `Query` instance for the `possibleMisuseOfInfiniteFloatingPointValue` query
+    FloatingPointPackage::possibleMisuseOfInfiniteFloatingPointValueQuery() and
+  queryId =
+    // `@id` for the `possibleMisuseOfInfiniteFloatingPointValue` query
+    "cpp/misra/possible-misuse-of-infinite-floating-point-value" and
+  ruleId = "DIR-0-3-1" and
+  category = "advisory"
+  or
+  query =
+    // `Query` instance for the `possibleMisuseOfNaNFloatingPointValue` query
+    FloatingPointPackage::possibleMisuseOfNaNFloatingPointValueQuery() and
+  queryId =
+    // `@id` for the `possibleMisuseOfNaNFloatingPointValue` query
+    "cpp/misra/possible-misuse-of-nan-floating-point-value" and
+  ruleId = "DIR-0-3-1" and
+  category = "advisory"
+}
+
+module FloatingPointPackage {
+  Query possibleMisuseOfInfiniteFloatingPointValueQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `possibleMisuseOfInfiniteFloatingPointValue` query
+      TQueryCPP(TFloatingPointPackageQuery(TPossibleMisuseOfInfiniteFloatingPointValueQuery()))
+  }
+
+  Query possibleMisuseOfNaNFloatingPointValueQuery() {
+    //autogenerate `Query` type
+    result =
+      // `Query` type for `possibleMisuseOfNaNFloatingPointValue` query
+      TQueryCPP(TFloatingPointPackageQuery(TPossibleMisuseOfNaNFloatingPointValueQuery()))
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exclusions/cpp/RuleMetadata.qll b/cpp/common/src/codingstandards/cpp/exclusions/cpp/RuleMetadata.qll
index 4a6cbe936b..abd6aeff96 100644
--- a/cpp/common/src/codingstandards/cpp/exclusions/cpp/RuleMetadata.qll
+++ b/cpp/common/src/codingstandards/cpp/exclusions/cpp/RuleMetadata.qll
@@ -18,6 +18,7 @@ import ExceptionSafety
 import Exceptions1
 import Exceptions2
 import Expressions
+import FloatingPoint
 import Freed
 import Functions
 import IO
@@ -72,6 +73,7 @@ newtype TCPPQuery =
   TExceptions1PackageQuery(Exceptions1Query q) or
   TExceptions2PackageQuery(Exceptions2Query q) or
   TExpressionsPackageQuery(ExpressionsQuery q) or
+  TFloatingPointPackageQuery(FloatingPointQuery q) or
   TFreedPackageQuery(FreedQuery q) or
   TFunctionsPackageQuery(FunctionsQuery q) or
   TIOPackageQuery(IOQuery q) or
@@ -126,6 +128,7 @@ predicate isQueryMetadata(Query query, string queryId, string ruleId, string cat
   isExceptions1QueryMetadata(query, queryId, ruleId, category) or
   isExceptions2QueryMetadata(query, queryId, ruleId, category) or
   isExpressionsQueryMetadata(query, queryId, ruleId, category) or
+  isFloatingPointQueryMetadata(query, queryId, ruleId, category) or
   isFreedQueryMetadata(query, queryId, ruleId, category) or
   isFunctionsQueryMetadata(query, queryId, ruleId, category) or
   isIOQueryMetadata(query, queryId, ruleId, category) or
diff --git a/cpp/common/src/codingstandards/cpp/exprs/FunctionExprs.qll b/cpp/common/src/codingstandards/cpp/exprs/FunctionExprs.qll
new file mode 100644
index 0000000000..5c46fce075
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exprs/FunctionExprs.qll
@@ -0,0 +1,59 @@
+import cpp
+import codingstandards.cpp.types.FunctionType
+
+/**
+ * A class representing an expression that has a function pointer type. This can be a function
+ * access, a variable access, or any expression that has a function pointer type.
+ */
+abstract class FunctionExpr extends Expr {
+  /** Any element that could represent the function, for example, a variable or an expression. */
+  abstract Element getFunction();
+
+  /** A name or string that describes the function. */
+  abstract string describe();
+
+  /** Get calls of this function */
+  abstract Call getACall();
+}
+
+/**
+ * A function access is an an expression of function type where we know the function.
+ */
+class SimpleFunctionAccess extends FunctionExpr, FunctionAccess {
+  override Element getFunction() { result = this.getTarget() }
+
+  override string describe() { result = "Address of function " + this.getTarget().getName() }
+
+  override FunctionCall getACall() { result.getTarget() = this.getTarget() }
+}
+
+/**
+ * An access of a variable that has a function pointer type is also a function expression, for which
+ * we can track certain properties of the function.
+ */
+class FunctionVariableAccess extends FunctionExpr, VariableAccess {
+  FunctionVariableAccess() { this.getUnderlyingType() instanceof FunctionType }
+
+  override Element getFunction() { result = this.getTarget() }
+
+  override string describe() { result = "Function pointer variable " + this.getTarget().getName() }
+
+  override ExprCall getACall() { result.getExpr().(VariableAccess).getTarget() = this.getTarget() }
+}
+
+/**
+ * A function typed expression that is not a function access or a variable access.
+ */
+class FunctionTypedExpr extends FunctionExpr {
+  FunctionTypedExpr() {
+    this.getUnderlyingType() instanceof FunctionType and
+    not this instanceof FunctionAccess and
+    not this instanceof VariableAccess
+  }
+
+  override Element getFunction() { result = this }
+
+  override string describe() { result = "Expression with function pointer type" }
+
+  override ExprCall getACall() { result.getExpr() = this }
+}
diff --git a/cpp/common/src/codingstandards/cpp/exprs/Guards.qll b/cpp/common/src/codingstandards/cpp/exprs/Guards.qll
new file mode 100644
index 0000000000..73a35ccc6b
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/exprs/Guards.qll
@@ -0,0 +1,34 @@
+import cpp
+import codeql.util.Boolean
+import semmle.code.cpp.controlflow.Guards
+import codingstandards.cpp.exprs.FunctionExprs
+
+/**
+ * A guard of the form: `if (funcPtr) funcPtr();`, e.g., a null check on a function before calling
+ * that function.
+ *
+ * Note this does not consider the above to be a null function call guard if `funcPtr` is a
+ * function name, as that could only be null via unusual linkage steps, and is not expected to be
+ * an intentional null check.
+ */
+class NullFunctionCallGuard extends GuardCondition {
+  FunctionExpr expr;
+
+  NullFunctionCallGuard() {
+    exists(BasicBlock block, Call guardedCall |
+      (
+        // Handles 'if (funcPtr != NULL)`:
+        this.ensuresEq(expr, 0, block, false)
+        or
+        // Handles `if (funcPtr)` in C where no implicit conversion to bool exists:
+        expr = this and
+        expr.getFunction() instanceof Variable and
+        this.controls(block, true)
+      ) and
+      guardedCall = expr.getACall() and
+      block.contains(guardedCall)
+    )
+  }
+
+  FunctionExpr getFunctionExpr() { result = expr }
+}
diff --git a/cpp/common/src/codingstandards/cpp/lifetimes/CLifetimes.qll b/cpp/common/src/codingstandards/cpp/lifetimes/CLifetimes.qll
deleted file mode 100644
index 9282260fb9..0000000000
--- a/cpp/common/src/codingstandards/cpp/lifetimes/CLifetimes.qll
+++ /dev/null
@@ -1,48 +0,0 @@
-import cpp
-import codingstandards.cpp.Clvalues
-
-/**
- * A struct or union type that contains an array type.
- */
-class StructOrUnionTypeWithArrayField extends Struct {
-  StructOrUnionTypeWithArrayField() {
-    this.getAField().getUnspecifiedType() instanceof ArrayType
-    or
-    // nested struct or union containing an array type
-    this.getAField().getUnspecifiedType().(Struct) instanceof StructOrUnionTypeWithArrayField
-  }
-}
-
-/**
- * A non-lvalue expression with struct or or union type that has a field member
- * of array type, has a temporary lifetime.
- *
- * The array members are also part of that object, and thus also have temporary
- * lifetime.
- */
-class TemporaryLifetimeExpr extends Expr {
-  TemporaryLifetimeExpr() {
-    getUnconverted().getUnspecifiedType() instanceof StructOrUnionTypeWithArrayField and
-    not isCLValue(this)
-    or
-    this.getUnconverted().(ArrayExpr).getArrayBase() instanceof TemporaryLifetimeArrayAccess
-  }
-}
-
-/**
- * A field access on a temporary object that returns an array member.
- */
-class TemporaryLifetimeArrayAccess extends FieldAccess {
-  // The temporary lifetime object which owns the array that is returned.
-  TemporaryLifetimeExpr temporary;
-
-  TemporaryLifetimeArrayAccess() {
-    getQualifier().getUnconverted() = temporary and
-    getUnspecifiedType() instanceof ArrayType
-  }
-
-  /**
-   * Get the temporary lifetime object which own the array that is returned.
-   */
-  Expr getTemporary() { result = temporary }
-}
diff --git a/cpp/common/src/codingstandards/cpp/lifetimes/lifetimeprofile/LifetimeProfile.qll b/cpp/common/src/codingstandards/cpp/lifetimes/lifetimeprofile/LifetimeProfile.qll
index 7990f50216..b02f51380e 100644
--- a/cpp/common/src/codingstandards/cpp/lifetimes/lifetimeprofile/LifetimeProfile.qll
+++ b/cpp/common/src/codingstandards/cpp/lifetimes/lifetimeprofile/LifetimeProfile.qll
@@ -1,5 +1,4 @@
 import cpp
-private import codingstandards.cpp.dataflow.DataFlow
 private import semmle.code.cpp.controlflow.Nullness
 private import codingstandards.cpp.Dereferenced
 private import codingstandards.cpp.Expr
diff --git a/cpp/common/src/codingstandards/cpp/resources/ResourceLeakAnalysis.qll b/cpp/common/src/codingstandards/cpp/resources/ResourceLeakAnalysis.qll
new file mode 100644
index 0000000000..3dd61e934d
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/resources/ResourceLeakAnalysis.qll
@@ -0,0 +1,91 @@
+import cpp
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.valuenumbering.HashCons
+import semmle.code.cpp.controlflow.Dominance
+import codeql.util.Boolean
+
+/**
+ * A library for detecting leaked resources.
+ *
+ * To use this library, implement `ResourceLeakConfigSig`:
+ *
+ * ```
+ * class UnjoinedThreadConfig implements ResourceLeakConfigSig {
+ *   predicate isResource(DataFlow::Node node) {
+ *     node.asExpr().isThreadCreate()
+ *   }
+ *
+ *   predicate isFree(ControlFlowNode node, DataFlow::Node resource) {
+ *     node.asExpr().isThreadJoin(resource.asExpr())
+ *   }
+ * }
+ * ```
+ *
+ * You can now check if a resource is leaked through the module predicate
+ * `ResourceLeak<UnjoinedThreadConfig>::isLeaked(resource)`.
+ *
+ * The leak analysis finds the exit point of the function in which the resource is is declared, and
+ * then reverses execution from there using `getAPredecessor()`. When this backwards walk discovers
+ * a control flow node that frees the resource, that exploration stops. If any exploration reaches
+ * a resource, that resource may be leaked via that path.
+ *
+ * Uses `DataFlow::Node` in order to track aliases of the resource to better detect when the
+ * resource is freed.
+ *
+ * This library by default assumes that resources are expression nodes. To use it with other kinds
+ * of nodes requires overriding `resourceInitPoint`.
+ */
+signature module ResourceLeakConfigSig {
+  predicate isAllocate(ControlFlowNode node, DataFlow::Node resource);
+
+  predicate isFree(ControlFlowNode node, DataFlow::Node resource);
+
+  bindingset[node]
+  default DataFlow::Node getAnAlias(DataFlow::Node node) {
+    DataFlow::localFlow(node, result)
+    or
+    exists(Expr current, Expr after |
+      current in [node.asExpr(), node.asDefiningArgument()] and
+      after in [result.asExpr(), result.asDefiningArgument()] and
+      hashCons(current) = hashCons(after) and
+      strictlyDominates(current, after)
+    )
+  }
+
+  /* A point at which a resource is considered to have leaked if it has not been freed. */
+  default ControlFlowNode outOfScope(ControlFlowNode allocPoint) {
+    result = allocPoint.(Expr).getEnclosingFunction().getBlock().getLastStmt()
+  }
+}
+
+module ResourceLeak<ResourceLeakConfigSig Config> {
+  private newtype TResource =
+    TJustResource(DataFlow::Node resource, ControlFlowNode cfgNode) {
+      Config::isAllocate(cfgNode, resource)
+    }
+
+  private predicate isLeakedAtControlPoint(TResource resource, ControlFlowNode cfgNode) {
+    // Holds if this control point is where the resource was allocated (and therefore not freed).
+    resource = TJustResource(_, cfgNode)
+    or
+    // Holds if this control point does not free the resource, and is reachable from a point that
+    // does not free the resource.
+    isLeakedAtControlPoint(resource, cfgNode.getAPredecessor()) and
+    not exists(DataFlow::Node freed, DataFlow::Node resourceNode |
+      Config::isFree(cfgNode, freed) and
+      freed = Config::getAnAlias(resourceNode) and
+      resource = TJustResource(resourceNode, _)
+    )
+  }
+
+  /**
+   * Holds if `resource` is leaked. Use this module predicate to find leaked resources.
+   */
+  ControlFlowNode getALeak(ControlFlowNode allocPoint) {
+    exists(TResource resourceWrapper, DataFlow::Node resource |
+      resourceWrapper = TJustResource(resource, allocPoint) and
+      result = Config::outOfScope(allocPoint) and
+      isLeakedAtControlPoint(resourceWrapper, result)
+    )
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/resources/ResourceManagement.qll b/cpp/common/src/codingstandards/cpp/resources/ResourceManagement.qll
index 0798575495..17c30196a0 100644
--- a/cpp/common/src/codingstandards/cpp/resources/ResourceManagement.qll
+++ b/cpp/common/src/codingstandards/cpp/resources/ResourceManagement.qll
@@ -1,58 +1,45 @@
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
+import codingstandards.cpp.resources.ResourceLeakAnalysis
 
-/**
- * The `ResourceAcquisitionExpr` abstract class models resource
- * acquisition and release expressions
- */
-abstract class ResourceAcquisitionExpr extends Expr {
-  abstract Expr getReleaseExpr();
-}
-
-// allocation - deallocation
-class AllocExpr extends ResourceAcquisitionExpr {
-  AllocExpr() { this.(AllocationExpr).requiresDealloc() }
-
-  override Expr getReleaseExpr() {
-    exists(DeallocationExpr d | result = d.getFreedExpr()) and
-    DataFlow::localFlow(DataFlow::exprNode(this), DataFlow::exprNode(result))
-  }
-}
-
-// file open-close
-class FstreamAcquisitionExpr extends ResourceAcquisitionExpr {
-  FstreamAcquisitionExpr() {
+module ResourceLeakConfig implements ResourceLeakConfigSig {
+  predicate isAllocate(ControlFlowNode allocPoint, DataFlow::Node node) {
+    exists(AllocationExpr alloc |
+      allocPoint = alloc and
+      alloc.requiresDealloc() and
+      node.asExpr() = alloc
+    )
+    or
     exists(FunctionCall f |
-      f.getTarget().hasQualifiedName("std", "basic_fstream", "open") and this = f.getQualifier()
+      f.getTarget().hasQualifiedName("std", "basic_fstream", "open") and
+      allocPoint = f and
+      node.asDefiningArgument() = f.getQualifier()
     )
-  }
-
-  override Expr getReleaseExpr() {
+    or
     exists(FunctionCall f |
-      f.getTarget().hasQualifiedName("std", "basic_fstream", "close") and result = f.getQualifier()
-    ) and
-    exists(DataFlow::Node def |
-      def.asDefiningArgument() = this and
-      DataFlow::localFlow(def, DataFlow::exprNode(result))
+      f.getTarget().hasQualifiedName("std", "mutex", "lock") and
+      allocPoint = f and
+      node.asDefiningArgument() = f.getQualifier()
     )
   }
-}
 
-// mutex lock unlock
-class MutexAcquisitionExpr extends ResourceAcquisitionExpr {
-  MutexAcquisitionExpr() {
+  predicate isFree(ControlFlowNode node, DataFlow::Node resource) {
+    exists(DeallocationExpr d, Expr freedExpr |
+      freedExpr = d.getFreedExpr() and
+      node = d and
+      resource.asExpr() = freedExpr
+    )
+    or
     exists(FunctionCall f |
-      f.getTarget().hasQualifiedName("std", "mutex", "lock") and this = f.getQualifier()
+      f.getTarget().hasQualifiedName("std", "basic_fstream", "close") and
+      node = f and
+      resource.asExpr() = f.getQualifier()
     )
-  }
-
-  override Expr getReleaseExpr() {
+    or
     exists(FunctionCall f |
-      f.getTarget().hasQualifiedName("std", "mutex", "unlock") and result = f.getQualifier()
-    ) and
-    exists(DataFlow::Node def |
-      def.asDefiningArgument() = this and
-      DataFlow::localFlow(def, DataFlow::exprNode(result))
+      f.getTarget().hasQualifiedName("std", "mutex", "unlock") and
+      node = f and
+      resource.asExpr() = f.getQualifier()
     )
   }
 }
diff --git a/cpp/common/src/codingstandards/cpp/rules/accessofnonexistingmemberthroughpointertomember/AccessOfNonExistingMemberThroughPointerToMember.qll b/cpp/common/src/codingstandards/cpp/rules/accessofnonexistingmemberthroughpointertomember/AccessOfNonExistingMemberThroughPointerToMember.qll
index 138c0a89b5..ac135386f3 100644
--- a/cpp/common/src/codingstandards/cpp/rules/accessofnonexistingmemberthroughpointertomember/AccessOfNonExistingMemberThroughPointerToMember.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/accessofnonexistingmemberthroughpointertomember/AccessOfNonExistingMemberThroughPointerToMember.qll
@@ -7,7 +7,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Expr
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 abstract class AccessOfNonExistingMemberThroughPointerToMemberSharedQuery extends Query { }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughnullpointer/AccessOfUndefinedMemberThroughNullPointer.qll b/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughnullpointer/AccessOfUndefinedMemberThroughNullPointer.qll
index ab8659efd8..b213087c5c 100644
--- a/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughnullpointer/AccessOfUndefinedMemberThroughNullPointer.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughnullpointer/AccessOfUndefinedMemberThroughNullPointer.qll
@@ -7,7 +7,6 @@ import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Nullness
 import codingstandards.cpp.Expr
-import codingstandards.cpp.dataflow.DataFlow
 import NullPointerToPointerMemberExpressionFlow::PathGraph
 
 abstract class AccessOfUndefinedMemberThroughNullPointerSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughuninitializedstaticpointer/AccessOfUndefinedMemberThroughUninitializedStaticPointer.qll b/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughuninitializedstaticpointer/AccessOfUndefinedMemberThroughUninitializedStaticPointer.qll
index ca1e2a4282..0271d7c6e7 100644
--- a/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughuninitializedstaticpointer/AccessOfUndefinedMemberThroughUninitializedStaticPointer.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/accessofundefinedmemberthroughuninitializedstaticpointer/AccessOfUndefinedMemberThroughUninitializedStaticPointer.qll
@@ -12,7 +12,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.EncapsulatingFunctions
diff --git a/cpp/common/src/codingstandards/cpp/rules/basicstringmaynotbenullterminated/BasicStringMayNotBeNullTerminated.qll b/cpp/common/src/codingstandards/cpp/rules/basicstringmaynotbenullterminated/BasicStringMayNotBeNullTerminated.qll
index cea798ae11..e27f09fd98 100644
--- a/cpp/common/src/codingstandards/cpp/rules/basicstringmaynotbenullterminated/BasicStringMayNotBeNullTerminated.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/basicstringmaynotbenullterminated/BasicStringMayNotBeNullTerminated.qll
@@ -8,8 +8,8 @@ import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import semmle.code.cpp.security.BufferWrite
 import semmle.code.cpp.commons.Buffer
-import codingstandards.cpp.dataflow.DataFlow
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 
 abstract class BasicStringMayNotBeNullTerminatedSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.qll b/cpp/common/src/codingstandards/cpp/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.qll
new file mode 100644
index 0000000000..66f1006d17
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.qll
@@ -0,0 +1,26 @@
+/**
+ * Provides a library which includes a `problems` predicate for reporting....
+ */
+
+import cpp
+import codingstandards.cpp.Customizations
+import codingstandards.cpp.Exclusions
+
+abstract class CastCharBeforeConvertingToLargerSizesSharedQuery extends Query { }
+
+Query getQuery() { result instanceof CastCharBeforeConvertingToLargerSizesSharedQuery }
+
+query predicate problems(Cast c, string message) {
+  not isExcluded(c, getQuery()) and
+  // find cases where there is a conversion happening wherein the
+  // base type is a char
+  c.getExpr().getType() instanceof CharType and
+  not c.getExpr().getType() instanceof UnsignedCharType and
+  // it's a bigger type
+  c.getType().getSize() > c.getExpr().getType().getSize() and
+  // and it's some kind of integer type
+  c.getType().getUnderlyingType() instanceof IntegralType and
+  not c.isFromTemplateInstantiation(_) and
+  message =
+    "Expression not converted to `unsigned char` before converting to a larger integer type."
+}
diff --git a/cpp/common/src/codingstandards/cpp/rules/catchexceptionsbylvaluereference/CatchExceptionsByLvalueReference.qll b/cpp/common/src/codingstandards/cpp/rules/catchexceptionsbylvaluereference/CatchExceptionsByLvalueReference.qll
index 75c86e50dc..81fd306d86 100644
--- a/cpp/common/src/codingstandards/cpp/rules/catchexceptionsbylvaluereference/CatchExceptionsByLvalueReference.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/catchexceptionsbylvaluereference/CatchExceptionsByLvalueReference.qll
@@ -6,7 +6,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 import codingstandards.cpp.exceptions.ExceptionFlow
 
 abstract class CatchExceptionsByLvalueReferenceSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll b/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll
index 2f672a1181..a366991714 100644
--- a/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll
@@ -8,7 +8,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import DFFlow::PathGraph
 
 abstract class ConstLikeReturnValueSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll b/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll
index 71e18a5c05..fcf20afbc0 100644
--- a/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll
@@ -12,7 +12,7 @@ import codingstandards.cpp.Operator
 import semmle.code.cpp.controlflow.Guards
 private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 abstract class ContainerAccessWithoutRangeCheckSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenmovinglambdaobject/DanglingCaptureWhenMovingLambdaObject.qll b/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenmovinglambdaobject/DanglingCaptureWhenMovingLambdaObject.qll
index ab2b067279..902d0ecf1f 100644
--- a/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenmovinglambdaobject/DanglingCaptureWhenMovingLambdaObject.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenmovinglambdaobject/DanglingCaptureWhenMovingLambdaObject.qll
@@ -5,7 +5,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Expr
diff --git a/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.qll b/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.qll
index c35b723ff3..4ab01520f6 100644
--- a/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/danglingcapturewhenreturninglambdaobject/DanglingCaptureWhenReturningLambdaObject.qll
@@ -5,7 +5,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/differentidentifiersnottypographicallyunambiguous/DifferentIdentifiersNotTypographicallyUnambiguous.qll b/cpp/common/src/codingstandards/cpp/rules/differentidentifiersnottypographicallyunambiguous/DifferentIdentifiersNotTypographicallyUnambiguous.qll
index 87a4580ab3..5c7475883e 100644
--- a/cpp/common/src/codingstandards/cpp/rules/differentidentifiersnottypographicallyunambiguous/DifferentIdentifiersNotTypographicallyUnambiguous.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/differentidentifiersnottypographicallyunambiguous/DifferentIdentifiersNotTypographicallyUnambiguous.qll
@@ -46,16 +46,32 @@ string step1(string s) {
 
 string step2(string s) { s = "m_" and result = "rn" }
 
-predicate violation(UserVariable v1, UserVariable v2) {
-  v2 = getPotentialScopeOfVariable(v1) and
+class VariableName extends string {
+  VariableName() { exists(UserVariable uv | uv.getName() = this) }
+
+  string getCanon() {
+    result =
+      this.toLowerCase()
+          .replaceAll("_", "")
+          .regexpReplaceAll("[il]", "1")
+          .replaceAll("s", "5")
+          .replaceAll("z", "2")
+          .replaceAll("b", "8")
+          .replaceAll("h", "n")
+          .replaceAll("m", "rn")
+          .replaceAll("o", "0")
+  }
+}
+
+predicate isConflictingName(VariableName name1, VariableName name2) {
   exists(string s1, string s2 |
     // over-approximate a match, because it is cheaper to compute
-    getCanon(v1) = getCanon(v2) and
-    v1 != v2 and
-    not v1.getName() = v2.getName() and
+    name1.getCanon() = name2.getCanon() and
+    // Exclude identical names
+    not name1 = name2 and
     // expand 'm' to 'm_' to match either 'm_' or 'rn'
-    s1 = v1.getName().replaceAll("_", "").replaceAll("m", "m_") and
-    s2 = v2.getName().replaceAll("_", "").replaceAll("m", "m_") and
+    s1 = name1.replaceAll("_", "").replaceAll("m", "m_") and
+    s2 = name2.replaceAll("_", "").replaceAll("m", "m_") and
     // at this point the strings must have equal length, the substitutions do not expand nor contract the string
     s1.length() = s2.length() and
     forall(int i | i in [0 .. s1.length() - 1] |
@@ -87,6 +103,23 @@ predicate violation(UserVariable v1, UserVariable v2) {
   )
 }
 
+predicate violation(UserVariable v1, UserVariable v2) {
+  exists(string name1, string name2 |
+    isConflictingName(name1, name2) and
+    exists(Scope parentScope, Scope childScope |
+      parentScope.getVariable(name1) = v1 and
+      childScope.getVariable(name2) = v2
+    |
+      childScope.getStrictParent+() = parentScope
+      or
+      // Disambiguate names in the same scope by name order
+      childScope = parentScope and
+      name1 < name2
+    ) and
+    inSameTranslationUnitLate(v1.getFile(), v2.getFile())
+  )
+}
+
 query predicate problems(
   UserVariable v, string message, UserVariable v1, string v1Description, UserVariable v2,
   string v2Description
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotaccessaclosedfile/DoNotAccessAClosedFile.qll b/cpp/common/src/codingstandards/cpp/rules/donotaccessaclosedfile/DoNotAccessAClosedFile.qll
index 3d84366d9a..83266ed524 100644
--- a/cpp/common/src/codingstandards/cpp/rules/donotaccessaclosedfile/DoNotAccessAClosedFile.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/donotaccessaclosedfile/DoNotAccessAClosedFile.qll
@@ -6,7 +6,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.standardlibrary.FileAccess
 import semmle.code.cpp.controlflow.SubBasicBlocks
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotallowamutextogooutofscopewhilelocked/DoNotAllowAMutexToGoOutOfScopeWhileLocked.qll b/cpp/common/src/codingstandards/cpp/rules/donotallowamutextogooutofscopewhilelocked/DoNotAllowAMutexToGoOutOfScopeWhileLocked.qll
index 8a8155f971..759d235eb4 100644
--- a/cpp/common/src/codingstandards/cpp/rules/donotallowamutextogooutofscopewhilelocked/DoNotAllowAMutexToGoOutOfScopeWhileLocked.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/donotallowamutextogooutofscopewhilelocked/DoNotAllowAMutexToGoOutOfScopeWhileLocked.qll
@@ -17,7 +17,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Concurrency
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 
 abstract class DoNotAllowAMutexToGoOutOfScopeWhileLockedSharedQuery extends Query { }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotdestroyamutexwhileitislocked/DoNotDestroyAMutexWhileItIsLocked.qll b/cpp/common/src/codingstandards/cpp/rules/donotdestroyamutexwhileitislocked/DoNotDestroyAMutexWhileItIsLocked.qll
index 46335c3d94..d77ae8cf39 100644
--- a/cpp/common/src/codingstandards/cpp/rules/donotdestroyamutexwhileitislocked/DoNotDestroyAMutexWhileItIsLocked.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/donotdestroyamutexwhileitislocked/DoNotDestroyAMutexWhileItIsLocked.qll
@@ -15,7 +15,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Concurrency
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 
 abstract class DoNotDestroyAMutexWhileItIsLockedSharedQuery extends Query { }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotpassaliasedpointertorestrictqualifiedparamshared/DoNotPassAliasedPointerToRestrictQualifiedParamShared.qll b/cpp/common/src/codingstandards/cpp/rules/donotpassaliasedpointertorestrictqualifiedparamshared/DoNotPassAliasedPointerToRestrictQualifiedParamShared.qll
index bea0235881..79eda7714d 100644
--- a/cpp/common/src/codingstandards/cpp/rules/donotpassaliasedpointertorestrictqualifiedparamshared/DoNotPassAliasedPointerToRestrictQualifiedParamShared.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/donotpassaliasedpointertorestrictqualifiedparamshared/DoNotPassAliasedPointerToRestrictQualifiedParamShared.qll
@@ -5,9 +5,9 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.Pointers
+import codingstandards.cpp.types.Pointers
 import codingstandards.cpp.Variable
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.pointsto.PointsTo
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.qll b/cpp/common/src/codingstandards/cpp/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.qll
index 0aa8d64feb..adb9785814 100644
--- a/cpp/common/src/codingstandards/cpp/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.qll
@@ -6,7 +6,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import ArrayToPointerDiffOperandFlow::PathGraph
 
 module ArrayToPointerDiffOperandConfig implements DataFlow::ConfigSig {
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.qll b/cpp/common/src/codingstandards/cpp/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.qll
index dd10b840c5..5d3a7e1cda 100644
--- a/cpp/common/src/codingstandards/cpp/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.qll
@@ -7,20 +7,133 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
+import codeql.util.Boolean
 
 abstract class DoNotUsePointerArithmeticToAddressDifferentArraysSharedQuery extends Query { }
 
 Query getQuery() { result instanceof DoNotUsePointerArithmeticToAddressDifferentArraysSharedQuery }
 
+/**
+ * A `VariableAccess` of a variable that is an array, or a pointer type casted to a byte pointer.
+ */
+abstract class ArrayLikeAccess extends Expr {
+  abstract Element getElement();
+
+  abstract string getName();
+
+  abstract int getSize();
+
+  abstract DataFlow::Node getNode();
+}
+
+/**
+ * A `VariableAccess` of a variable that is an array.
+ */
+class ArrayVariableAccess extends ArrayLikeAccess, VariableAccess {
+  int size;
+
+  ArrayVariableAccess() { size = getType().(ArrayType).getArraySize() }
+
+  override Variable getElement() { result = getTarget() }
+
+  override string getName() { result = getElement().getName() }
+
+  override int getSize() { result = size }
+
+  override DataFlow::Node getNode() { result.asExpr() = this }
+}
+
+/**
+ * Get the size of the object pointed to by a type (pointer or array).
+ *
+ * Depth of type unwrapping depends on the type. Pointer will be dereferenced only once: the element
+ * size of `T*` is `sizeof(T)` while the element size of `T**` is `sizeof(T*)`. However, array types
+ * will be deeply unwrapped, as the pointed to size of `T[][]` is `sizeof(T)`. These processes
+ * interact, so the element size of a pointer to an array of `T` has an element size of `sizeof(T)`
+ * and not `sizeof(T[length])`.
+ */
+int elementSize(Type type, Boolean deref) {
+  if type instanceof ArrayType
+  then result = elementSize(type.(ArrayType).getBaseType(), false)
+  else
+    if deref = true and type instanceof PointerType
+    then result = elementSize(type.(PointerType).getBaseType(), false)
+    else result = type.getSize()
+}
+
+/**
+ * A pointer type casted to a byte pointer, which is effectively a pointer to a byte array whose
+ * length depends on `elementSize()` of the original pointed-to type.
+ */
+class CastedToBytePointer extends ArrayLikeAccess, Conversion {
+  /** The sizeof() the pointed-to type */
+  int size;
+
+  CastedToBytePointer() {
+    getType().(PointerType).getBaseType().getSize() = 1 and
+    size = elementSize(getExpr().getType(), true) and
+    size > 1
+  }
+
+  override Element getElement() { result = this }
+
+  override string getName() { result = "cast to byte pointer" }
+
+  override int getSize() { result = size }
+
+  override DataFlow::Node getNode() {
+    // Carefully avoid use-use flow, which would mean any later usage of the original pointer value
+    // after the cast would be considered a usage of the byte pointer value.
+    //
+    // To fix this, we currently assume the value is assigned to a variable, and find that variable
+    // with `.asDefinition()` like so:
+    exists(DataFlow::Node conversion |
+      conversion.asConvertedExpr() = this and
+      result.asDefinition() = conversion.asExpr()
+    )
+  }
+}
+
+predicate pointerRecastBarrier(DataFlow::Node barrier) {
+  // Casting to a differently sized pointer
+  exists(CStyleCast cast, Expr casted |
+    cast.getExpr() = casted and casted = barrier.asConvertedExpr()
+  |
+    not casted.getType().(PointerType).getBaseType().getSize() =
+      cast.getType().(PointerType).getBaseType().getSize()
+  )
+}
+
+/**
+ * A data-flow configuration that tracks access to an array to type to an array index expression.
+ * This is used to determine possible pointer to array creations.
+ */
+module ByteArrayToArrayExprConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) { exists(CastedToBytePointer a | a.getNode() = source) }
+
+  predicate isBarrier(DataFlow::Node barrier) {
+    // Casting to a differently sized pointer invalidates this analysis.
+    pointerRecastBarrier(barrier)
+  }
+
+  predicate isSink(DataFlow::Node sink) { exists(ArrayExpr c | c.getArrayBase() = sink.asExpr()) }
+}
+
+module BytePointerToArrayExprFlow = DataFlow::Global<ByteArrayToArrayExprConfig>;
+
 /**
  * A data-flow configuration that tracks access to an array to type to an array index expression.
  * This is used to determine possible pointer to array creations.
  */
 module ArrayToArrayExprConfig implements DataFlow::ConfigSig {
-  predicate isSource(DataFlow::Node source) {
-    source.asExpr().(VariableAccess).getType() instanceof ArrayType
+  predicate isSource(DataFlow::Node source) { exists(ArrayVariableAccess a | a.getNode() = source) }
+
+  predicate isBarrier(DataFlow::Node barrier) {
+    // Casting to a differently sized pointer invalidates this analysis.
+    pointerRecastBarrier(barrier)
   }
 
   predicate isSink(DataFlow::Node sink) { exists(ArrayExpr c | c.getArrayBase() = sink.asExpr()) }
@@ -28,32 +141,39 @@ module ArrayToArrayExprConfig implements DataFlow::ConfigSig {
 
 module ArrayToArrayExprFlow = DataFlow::Global<ArrayToArrayExprConfig>;
 
-/** Holds if the address taken expression `addressOf` takes the address of an array element at `index` of `array` with size `arraySize`. */
-predicate pointerOperandCreation(AddressOfExpr addressOf, Variable array, int arraySize, int index) {
-  arraySize = array.getType().(ArrayType).getArraySize() and
-  exists(ArrayExpr ae |
-    ArrayToArrayExprFlow::flow(DataFlow::exprNode(array.getAnAccess()),
-      DataFlow::exprNode(ae.getArrayBase())) and
-    index = lowerBound(ae.getArrayOffset().getFullyConverted()) and
+/** Holds if the address taken expression `addressOf` takes the address of an array element at `index` of `array`. */
+predicate pointerOperandCreation(AddressOfExpr addressOf, ArrayLikeAccess array, int index) {
+  exists(ArrayExpr ae, Expr arrayOffset |
+    (
+      ArrayToArrayExprFlow::flow(array.getNode(), DataFlow::exprNode(ae.getArrayBase())) and
+      array instanceof ArrayVariableAccess
+      or
+      // Since casts can occur in the middle of flow, barriers are not perfect for modeling the
+      // desired behavior. Handle casts to byte pointers as sources in a separate flow analysis.
+      BytePointerToArrayExprFlow::flow(array.getNode(), DataFlow::exprNode(ae.getArrayBase())) and
+      // flow() may hold for `ArrayVariableAccess` in the above, even though they aren't sources
+      array instanceof CastedToBytePointer
+    ) and
+    arrayOffset = ae.getArrayOffset().getFullyConverted() and
+    index = lowerBound(arrayOffset) and
+    // This case typically indicates range analysis has gone wrong:
+    not index = exprMaxVal(arrayOffset) and
     addressOf.getOperand() = ae
   )
 }
 
 /** A variable that points to an element of an array. */
 class PointerOperand extends Variable {
-  Variable array;
-  int arraySize;
+  ArrayLikeAccess array;
   int index;
   AddressOfExpr source;
 
   PointerOperand() {
-    pointerOperandCreation(source, array, arraySize, index) and
+    pointerOperandCreation(source, array, index) and
     this.getAnAssignedValue() = source
   }
 
-  Variable getArray() { result = array }
-
-  int getArraySize() { result = arraySize }
+  ArrayLikeAccess getArray() { result = array }
 
   int getIndex() { result = index }
 
@@ -111,9 +231,7 @@ class DerivedArrayPointer extends Variable {
 
   DerivedArrayPointer() { derivedPointer(this, source, operand, index) }
 
-  Variable getArray() { result = operand.getArray() }
-
-  int getArraySize() { result = operand.getArraySize() }
+  ArrayLikeAccess getArray() { result = operand.getArray() }
 
   int getIndex() { result = index }
 
@@ -131,15 +249,10 @@ class DerivedArrayPointerOrPointerOperand extends Variable {
     this instanceof PointerOperand
   }
 
-  Variable getArray() {
+  ArrayLikeAccess getArray() {
     result = this.(DerivedArrayPointer).getArray() or result = this.(PointerOperand).getArray()
   }
 
-  int getArraySize() {
-    result = this.(DerivedArrayPointer).getArraySize() or
-    result = this.(PointerOperand).getArraySize()
-  }
-
   int getIndex() {
     result = this.(DerivedArrayPointer).getIndex() or result = this.(PointerOperand).getIndex()
   }
@@ -149,14 +262,16 @@ class DerivedArrayPointerOrPointerOperand extends Variable {
   }
 }
 
-query predicate problems(Expr arrayPointerCreation, string message, Variable array, string arrayName) {
+query predicate problems(Expr arrayPointerCreation, string message, Element array, string arrayName) {
   not isExcluded(arrayPointerCreation, getQuery()) and
   exists(
     DerivedArrayPointerOrPointerOperand derivedArrayPointerOrPointerOperand, int index,
-    int arraySize, int difference, string denomination
+    ArrayLikeAccess arrayAccess, int arraySize, int difference, string denomination
   |
-    array = derivedArrayPointerOrPointerOperand.getArray() and
-    arraySize = derivedArrayPointerOrPointerOperand.getArraySize() and
+    arrayAccess = derivedArrayPointerOrPointerOperand.getArray() and
+    array = arrayAccess.getElement() and
+    arrayName = arrayAccess.getName() and
+    arraySize = arrayAccess.getSize() and
     index = derivedArrayPointerOrPointerOperand.getIndex() and
     arrayPointerCreation = derivedArrayPointerOrPointerOperand.getSource() and
     difference = index - arraySize and
@@ -173,7 +288,6 @@ query predicate problems(Expr arrayPointerCreation, string message, Variable arr
     ) and
     message =
       "Array pointer " + derivedArrayPointerOrPointerOperand.getName() + " points " +
-        (index - arraySize).toString() + " " + denomination + " passed the end of $@."
-  ) and
-  arrayName = array.getName()
+        difference.toString() + " " + denomination + " past the end of $@."
+  )
 }
diff --git a/cpp/common/src/codingstandards/cpp/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.qll b/cpp/common/src/codingstandards/cpp/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.qll
index 155ed1a7f4..aa8fa29bfd 100644
--- a/cpp/common/src/codingstandards/cpp/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.qll
@@ -7,7 +7,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import ArrayToRelationalOperationOperandFlow::PathGraph
 
 abstract class DoNotUseRelationalOperatorsWithDifferingArraysSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.qll b/cpp/common/src/codingstandards/cpp/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.qll
index 16f86f78be..5a712dd522 100644
--- a/cpp/common/src/codingstandards/cpp/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.qll
@@ -4,43 +4,17 @@
  */
 
 import cpp
-import semmle.code.cpp.controlflow.SubBasicBlocks
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.exceptions.ExceptionFlow
 import codingstandards.cpp.ExceptionSafety
 import codingstandards.cpp.resources.ResourceManagement
+import codingstandards.cpp.resources.ResourceLeakAnalysis
 
 abstract class ExceptionSafetyValidStateSharedQuery extends Query { }
 
 Query getQuery() { result instanceof ExceptionSafetyValidStateSharedQuery }
 
-/**
- * Ensures that `UncaughtThrowExpr` and `Expr` appear at the start of a `SubBasicBlock`.
- */
-class SafetyValidStateSubBasicBlock extends SubBasicBlockCutNode {
-  SafetyValidStateSubBasicBlock() {
-    this instanceof ResourceAcquisitionExpr or
-    this = any(ResourceAcquisitionExpr rae).getReleaseExpr() or
-    this instanceof UncaughtThrowExpr
-  }
-}
-
-/**
- * Execution continues from an allocation expression
- * without releasing the resource
- */
-SubBasicBlock followsInitialized(ResourceAcquisitionExpr src) {
-  result = src
-  or
-  exists(SubBasicBlock mid |
-    mid = followsInitialized(src) and
-    result = mid.getASuccessor() and
-    //stop recursion on resource release
-    not result = src.getReleaseExpr()
-  )
-}
-
 /**
  * `UncaughtThrowExpr` models a `throw` expression that is not handled
  */
@@ -48,14 +22,25 @@ class UncaughtThrowExpr extends ThrowExpr {
   UncaughtThrowExpr() { getASuccessor() = getEnclosingFunction() }
 }
 
-query predicate problems(
-  UncaughtThrowExpr te, string message, ResourceAcquisitionExpr e, string eDescription
-) {
+module ThrowLeakConfig implements ResourceLeakConfigSig {
+  predicate isAllocate(ControlFlowNode node, DataFlow::Node resource) {
+    ResourceLeakConfig::isAllocate(node, resource)
+  }
+
+  predicate isFree(ControlFlowNode node, DataFlow::Node resource) {
+    ResourceLeakConfig::isFree(node, resource)
+  }
+
+  ControlFlowNode outOfScope(ControlFlowNode allocPoint) {
+    result.(UncaughtThrowExpr).getEnclosingFunction() = allocPoint.(Expr).getEnclosingFunction()
+  }
+
+  DataFlow::Node getAnAlias(DataFlow::Node node) { DataFlow::localFlow(node, result) }
+}
+
+query predicate problems(UncaughtThrowExpr te, string message, Element e, string eDescription) {
   not isExcluded(te, getQuery()) and
-  exists(SubBasicBlock sbb |
-    sbb.getANode() = e and
-    te = followsInitialized(sbb)
-  ) and
+  te = ResourceLeak<ThrowLeakConfig>::getALeak(e) and
   message = "The $@ is not released explicitly before throwing an exception." and
   eDescription = "allocated resource"
 }
diff --git a/cpp/common/src/codingstandards/cpp/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.qll b/cpp/common/src/codingstandards/cpp/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.qll
new file mode 100644
index 0000000000..93177e4f46
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.qll
@@ -0,0 +1,62 @@
+/**
+ * Provides a library which includes a `problems` predicate for reporting unchecked error values.
+ */
+
+import cpp
+import codingstandards.cpp.Customizations
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.controlflow.Guards
+import codingstandards.cpp.Exclusions
+
+abstract class FunctionErroneousReturnValueNotTestedSharedQuery extends Query { }
+
+Query getQuery() { result instanceof FunctionErroneousReturnValueNotTestedSharedQuery }
+
+query predicate problems(FunctionCall fc, string message) {
+  not isExcluded(fc, getQuery()) and
+  fc.getTarget()
+      .hasGlobalOrStdName([
+          // fcntl.h
+          "open", "openat", "fcntl", "creat",
+          // locale.h
+          "setlocale",
+          // stdlib.h
+          "system", "getenv", "getenv_s",
+          // signal.h
+          "signal", "raise",
+          // setjmp.h
+          "setjmp",
+          // stdio.h
+          "fopen", "fopen_s", "freopen", "freopen_s", "fclose", "fcloseall", "fflush", "setvbuf",
+          "fgetc", "getc", "fgets", "fputc", "getchar", "gets", "gets_s", "putchar", "puts",
+          "ungetc", "scanf", "fscanf", "sscanf", "scanf_s", "fscanf_s", "sscanf_s", "vscanf",
+          "vfscanf", "vsscanf", "vscanf_s", "vfscanf_s", "vsscanf_s", "printf", "fprintf",
+          "sprintf", "snprintf", "printf_s", "fprintf_s", "sprintf_s", "snprintf_s", "vprintf",
+          "vfprintf", "vsprintf", "vsnprintf", "vprintf_s", "vfprintf_s", "vsprintf_s",
+          "vsnprintf_s", "ftell", "fgetpos", "fseek", "fsetpos", "remove", "rename", "tmpfile",
+          "tmpfile_s", "tmpnam", "tmpnam_s",
+          // string.h
+          "strcpy_s", "strncpy_s", "strcat_s", "strncat_s", "memset_s", "memcpy_s", "memmove_s",
+          "strerror_s",
+          // threads.h
+          "thrd_create", "thrd_sleep", "thrd_detach", "thrd_join", "mtx_init", "mtx_lock",
+          "mtx_timedlock", "mtx_trylock", "mtx_unlock", "cnd_init", "cnd_signal", "cnd_broadcast",
+          "cnd_wait", "cnd_timedwait", "tss_create", "tss_get", "tss_set",
+          // time.h
+          "time", "clock", "timespec_get", "asctime_s", "ctime_s", "gmtime", "gmtime_s",
+          "localtime", "localtime_s",
+          // unistd.h
+          "write", "read", "close", "unlink",
+          // wchar.h
+          "fgetwc", "getwc", "fgetws", "fputwc", "putwc", "fputws", "getwchar", "putwchar",
+          "ungetwc", "wscanf", "fwscanf", "swscanf", "wscanf_s", "fwscanf_s", "swscanf_s",
+          "vwscanf", "vfwscanf", "vswscanf", "vwscanf_s", "vfwscanf_s", "vswscanf_s", "wprintf",
+          "fwprintf", "swprintf", "wprintf_s", "fwprintf_s", "swprintf_s", "snwprintf_s",
+          "vwprintf", "vfwprintf", "vswprintf", "vwprintf_s", "vfwprintf_s", "vswprintf_s",
+          "vsnwprintf_s"
+        ]) and
+  not exists(GuardCondition gc |
+    DataFlow::localFlow(DataFlow::exprNode(fc), DataFlow::exprNode(gc.getAChild*()))
+  ) and
+  message = "Return value from " + fc.getTarget().getName() + " is not tested for errors."
+}
diff --git a/cpp/common/src/codingstandards/cpp/rules/functionscallthemselveseitherdirectlyorindirectly/FunctionsCallThemselvesEitherDirectlyOrIndirectly.qll b/cpp/common/src/codingstandards/cpp/rules/functionscallthemselveseitherdirectlyorindirectly/FunctionsCallThemselvesEitherDirectlyOrIndirectly.qll
index 87f27c134f..e54e4378e9 100644
--- a/cpp/common/src/codingstandards/cpp/rules/functionscallthemselveseitherdirectlyorindirectly/FunctionsCallThemselvesEitherDirectlyOrIndirectly.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/functionscallthemselveseitherdirectlyorindirectly/FunctionsCallThemselvesEitherDirectlyOrIndirectly.qll
@@ -19,17 +19,17 @@ class RecursiveCall extends FunctionCall {
   }
 }
 
-query predicate problems(FunctionCall fc, string message, Function f, string f_name) {
-  exists(RecursiveCall call |
-    not isExcluded(call, getQuery()) and
-    f = fc.getTarget() and
-    f_name = fc.getTarget().getName() and
-    fc.getTarget() = call.getTarget() and
-    if fc.getTarget() = fc.getEnclosingFunction()
-    then message = "This call directly invokes its containing function $@."
-    else
-      message =
-        "The function " + fc.getEnclosingFunction() +
-          " is indirectly recursive via this call to $@."
-  )
+class RecursiveFunction extends Function {
+  RecursiveFunction() { exists(RecursiveCall fc | fc.getEnclosingFunction() = this) }
+}
+
+query predicate problems(FunctionCall fc, string message, RecursiveFunction f, string functionName) {
+  not isExcluded(fc, getQuery()) and
+  f = fc.getTarget() and
+  functionName = f.getName() and
+  if f = fc.getEnclosingFunction()
+  then message = "This call directly invokes its containing function $@."
+  else
+    message =
+      "The function " + fc.getEnclosingFunction() + " is indirectly recursive via this call to $@."
 }
diff --git a/cpp/common/src/codingstandards/cpp/rules/identifierhidden/IdentifierHidden.qll b/cpp/common/src/codingstandards/cpp/rules/identifierhidden/IdentifierHidden.qll
index 9534c2f78a..39d24299b8 100644
--- a/cpp/common/src/codingstandards/cpp/rules/identifierhidden/IdentifierHidden.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/identifierhidden/IdentifierHidden.qll
@@ -9,75 +9,11 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Scope
-import codingstandards.cpp.ConstHelpers
 
 abstract class IdentifierHiddenSharedQuery extends Query { }
 
 Query getQuery() { result instanceof IdentifierHiddenSharedQuery }
 
-/**
- * a `Variable` that is nonvolatile and const
- * and of type `IntegralOrEnumType`
- */
-class NonVolatileConstIntegralOrEnumVariable extends Variable {
-  NonVolatileConstIntegralOrEnumVariable() {
-    not this.isVolatile() and
-    this.isConst() and
-    this.getUnspecifiedType() instanceof IntegralOrEnumType
-  }
-}
-
-/**
- * Holds if declaration `innerDecl`, declared in a lambda, hides a declaration `outerDecl` by the lambda.
- */
-predicate hiddenInLambda(UserVariable outerDecl, UserVariable innerDecl) {
-  exists(
-    Scope innerScope, LambdaExpression lambdaExpr, Scope lambdaExprScope, Scope outerScope,
-    Closure lambdaClosure
-  |
-    // The variable `innerDecl` is declared inside of the lambda.
-    innerScope.getADeclaration() = innerDecl and
-    // Because a lambda is compiled down to a closure, we need to use the closure to determine if the declaration
-    // is part of the lambda.
-    innerScope.getAnAncestor() = lambdaClosure and
-    // Next we determine the scope of the lambda expression to determine if `outerDecl` is visible in the scope of the lambda.
-    lambdaClosure.getLambdaExpression() = lambdaExpr and
-    lambdaExprScope.getAnExpr() = lambdaExpr and
-    outerScope.getADeclaration() = outerDecl and
-    lambdaExprScope.getStrictParent*() = outerScope and
-    (
-      // A definition can be hidden if it is in scope and it is captured by the lambda,
-      exists(LambdaCapture cap |
-        lambdaExpr.getACapture() = cap and
-        // The outer declaration is captured by the lambda
-        outerDecl.getAnAccess() = cap.getInitializer()
-      )
-      or
-      // it is is non-local,
-      outerDecl instanceof GlobalVariable
-      or
-      // it has static or thread local storage duration,
-      (outerDecl.isThreadLocal() or outerDecl.isStatic())
-      or
-      //it is a reference that has been initialized with a constant expression.
-      outerDecl.getType().stripTopLevelSpecifiers() instanceof ReferenceType and
-      outerDecl.getInitializer().getExpr() instanceof Literal
-      or
-      // //it const non-volatile integral or enumeration type and has been initialized with a constant expression
-      outerDecl instanceof NonVolatileConstIntegralOrEnumVariable and
-      outerDecl.getInitializer().getExpr() instanceof Literal
-      or
-      //it is constexpr and has no mutable members
-      outerDecl.isConstexpr() and
-      not exists(Class c |
-        c = outerDecl.getType() and not c.getAMember() instanceof MutableVariable
-      )
-    ) and
-    // Finally, the variables must have the same names.
-    innerDecl.getName() = outerDecl.getName()
-  )
-}
-
 query predicate problems(
   UserVariable innerDecl, string message, UserVariable outerDecl, string varName
 ) {
@@ -86,7 +22,7 @@ query predicate problems(
   //ignore template variables for this rule
   not outerDecl instanceof TemplateVariable and
   not innerDecl instanceof TemplateVariable and
-  (hidesStrict(outerDecl, innerDecl) or hiddenInLambda(outerDecl, innerDecl)) and
+  hidesStrict(outerDecl, innerDecl) and
   not excludedViaNestedNamespaces(outerDecl, innerDecl) and
   varName = outerDecl.getName() and
   message = "Variable is hiding variable $@."
diff --git a/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.qll b/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.qll
index 81a3251355..0f4a98cf6f 100644
--- a/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.qll
@@ -6,7 +6,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 abstract class InvalidatedEnvStringPointersSharedQuery extends Query { }
 
@@ -45,6 +45,12 @@ predicate incompatibleFunctions(GetenvFunction f1, GetenvFunction f2) {
   or
   f1.getName() = ["setlocale", "localeconv"] and
   f2.getName() = ["setlocale", "localeconv"]
+  or
+  f1.getName() = ["asctime", "ctime"] and
+  f2.getName() = ["asctime", "ctime"]
+  or
+  f1.getName() = ["gmtime", "localtime"] and
+  f2.getName() = ["gmtime", "localtime"]
 }
 
 query predicate problems(
diff --git a/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointerswarn/InvalidatedEnvStringPointersWarn.qll b/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointerswarn/InvalidatedEnvStringPointersWarn.qll
index fd8a969d00..759bc08deb 100644
--- a/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointerswarn/InvalidatedEnvStringPointersWarn.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/invalidatedenvstringpointerswarn/InvalidatedEnvStringPointersWarn.qll
@@ -6,7 +6,6 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
 import codingstandards.cpp.rules.invalidatedenvstringpointers.InvalidatedEnvStringPointers as EnvString
 
 abstract class InvalidatedEnvStringPointersWarnSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/iofstreammissingpositioning/IOFstreamMissingPositioning.qll b/cpp/common/src/codingstandards/cpp/rules/iofstreammissingpositioning/IOFstreamMissingPositioning.qll
index 3a7e225369..b26421c72c 100644
--- a/cpp/common/src/codingstandards/cpp/rules/iofstreammissingpositioning/IOFstreamMissingPositioning.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/iofstreammissingpositioning/IOFstreamMissingPositioning.qll
@@ -5,7 +5,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.standardlibrary.FileStreams
 import codingstandards.cpp.standardlibrary.FileAccess
@@ -51,23 +51,26 @@ class WriteFunctionCall extends ReadWriteCall {
   }
 }
 
-pragma[inline]
+bindingset[a, b]
+pragma[inline_late]
 predicate sameSource(FunctionCall a, FunctionCall b) {
   sameStreamSource(a, b) or
   sameFileSource(a, b)
 }
 
+bindingset[a, b]
 predicate sameAccessDirection(ReadWriteCall a, ReadWriteCall b) {
   a.getAccessDirection() = b.getAccessDirection()
 }
 
+bindingset[a, b]
 predicate oppositeAccessDirection(ReadWriteCall a, ReadWriteCall b) {
   not sameAccessDirection(a, b)
 }
 
 /**
  * A write operation reaching a read and vice versa
- * without intervening filepositioning
+ * without intervening file positioning calls.
  */
 ControlFlowNode reachesInExOperator(ReadWriteCall op) {
   result = op
diff --git a/cpp/common/src/codingstandards/cpp/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.qll b/cpp/common/src/codingstandards/cpp/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.qll
new file mode 100644
index 0000000000..5ccbe83c72
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/rules/joinordetachthreadonlyonce/JoinOrDetachThreadOnlyOnce.qll
@@ -0,0 +1,49 @@
+/**
+ * Provides a library with a `problems` predicate for the following issue:
+ * Joining or detaching a previously joined or detached thread can lead to undefined
+ * program behavior.
+ */
+
+import cpp
+import codingstandards.cpp.Customizations
+import codingstandards.cpp.Exclusions
+import codingstandards.cpp.Concurrency
+
+abstract class JoinOrDetachThreadOnlyOnceSharedQuery extends Query { }
+
+Query getQuery() { result instanceof JoinOrDetachThreadOnlyOnceSharedQuery }
+
+// OK
+// 1) Thread calls detach parent DOES NOT call join
+// 2) Parent calls join, thread does NOT call detach()
+// NOT OK
+// 1) Thread calls detach, parent calls join
+// 2) Thread calls detach twice, parent does not call join
+// 3) Parent calls join twice, thread does not call detach
+query predicate problems(C11ThreadCreateCall tcc, string message) {
+  not isExcluded(tcc, getQuery()) and
+  message = "Thread may call join or detach after the thread is joined or detached." and
+  (
+    // Note: These cases can be simplified but they are presented like this for clarity
+    // case 1 - calls to `thrd_join` and `thrd_detach` within the parent or
+    // within the parent / child CFG.
+    exists(C11ThreadWait tw, C11ThreadDetach dt |
+      tw = getAThreadContextAwareSuccessor(tcc) and
+      dt = getAThreadContextAwareSuccessor(tcc)
+    )
+    or
+    // case 2 - multiple calls to `thrd_detach` within the threaded CFG.
+    exists(C11ThreadDetach dt1, C11ThreadDetach dt2 |
+      dt1 = getAThreadContextAwareSuccessor(tcc) and
+      dt2 = getAThreadContextAwareSuccessor(tcc) and
+      not dt1 = dt2
+    )
+    or
+    // case 3 - multiple calls to `thrd_join` within the threaded CFG.
+    exists(C11ThreadWait tw1, C11ThreadWait tw2 |
+      tw1 = getAThreadContextAwareSuccessor(tcc) and
+      tw2 = getAThreadContextAwareSuccessor(tcc) and
+      not tw1 = tw2
+    )
+  )
+}
diff --git a/cpp/common/src/codingstandards/cpp/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.qll b/cpp/common/src/codingstandards/cpp/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.qll
new file mode 100644
index 0000000000..eecd349ad7
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.qll
@@ -0,0 +1,141 @@
+/**
+ * Provides a library with a `problems` predicate for the following issue:
+ * Possible misuse of a generate infinite floating point value.
+ */
+
+import cpp
+import codeql.util.Boolean
+import codingstandards.cpp.Customizations
+import codingstandards.cpp.Exclusions
+import codingstandards.cpp.RestrictedRangeAnalysis
+import codingstandards.cpp.FloatingPoint
+import codingstandards.cpp.AlertReporting
+import semmle.code.cpp.controlflow.Guards
+import semmle.code.cpp.dataflow.new.DataFlow
+import semmle.code.cpp.dataflow.new.TaintTracking
+import semmle.code.cpp.controlflow.Dominance
+
+module InvalidInfinityUsage implements DataFlow::ConfigSig {
+  /**
+   * An operation which does not have Infinity as an input, but may produce Infinity, according
+   * to the `RestrictedRangeAnalysis` module.
+   */
+  predicate isSource(DataFlow::Node node) {
+    potentialSource(node) and
+    not exists(DataFlow::Node prior |
+      isAdditionalFlowStep(prior, node) and
+      potentialSource(prior)
+    )
+  }
+
+  /**
+   * An operation which may produce Infinity acconding to the `RestrictedRangeAnalysis` module.
+   */
+  additional predicate potentialSource(DataFlow::Node node) {
+    node.asExpr() instanceof Operation and
+    exprMayEqualInfinity(node.asExpr(), _)
+  }
+
+  predicate isBarrierOut(DataFlow::Node node) {
+    guardedNotFPClass(node.asExpr(), TInfinite())
+    or
+    exists(Expr e |
+      e.getType() instanceof IntegralType and
+      e = node.asConvertedExpr()
+    )
+  }
+
+  /**
+   * An additional flow step to handle operations which propagate Infinity.
+   *
+   * This double checks that an Infinity may propagate by checking the `RestrictedRangeAnalysis`
+   * value estimate. This is conservative, since `RestrictedRangeAnalysis` is performed locally
+   * in scope with unanalyzable values in a finite range. However, this conservative approach
+   * leverages analysis of guards and other local conditions to avoid false positives.
+   */
+  predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Operation o |
+      o.getAnOperand() = source.asExpr() and
+      o = sink.asExpr() and
+      potentialSource(sink)
+    )
+  }
+
+  predicate isSink(DataFlow::Node node) {
+    node instanceof InvalidInfinityUsage and
+    (
+      // Require that range analysis finds this value potentially infinite, to avoid false positives
+      // in the presence of guards. This may induce false negatives.
+      exprMayEqualInfinity(node.asExpr(), _)
+      or
+      // Unanalyzable expressions are not checked against range analysis, which assumes a finite
+      // range.
+      not RestrictedRangeAnalysis::canBoundExpr(node.asExpr())
+      or
+      node.asExpr().(VariableAccess).getTarget() instanceof Parameter
+    )
+  }
+}
+
+class InvalidInfinityUsage extends DataFlow::Node {
+  string description;
+
+  InvalidInfinityUsage() {
+    // Case 2: NaNs and infinities shall not be cast to integers
+    exists(Conversion c |
+      asExpr() = c.getUnconverted() and
+      c.getExpr().getType() instanceof FloatingPointType and
+      c.getType() instanceof IntegralType and
+      description = "cast to integer."
+    )
+    or
+    // Case 3: Infinities shall not underflow or otherwise produce finite values
+    exists(BinaryOperation op |
+      asExpr() = op.getRightOperand() and
+      op.getOperator() = "/" and
+      description = "divisor, which would silently underflow and produce zero."
+    )
+  }
+
+  string getDescription() { result = description }
+}
+
+module InvalidInfinityFlow = DataFlow::Global<InvalidInfinityUsage>;
+
+import InvalidInfinityFlow::PathGraph
+
+abstract class MisuseOfInfiniteFloatingPointValueSharedQuery extends Query { }
+
+Query getQuery() { result instanceof MisuseOfInfiniteFloatingPointValueSharedQuery }
+
+query predicate problems(
+  Element elem, InvalidInfinityFlow::PathNode source, InvalidInfinityFlow::PathNode sink,
+  string message, Expr sourceExpr, string sourceString, Function function, string functionName
+) {
+  not isExcluded(elem, getQuery()) and
+  exists(InvalidInfinityUsage usage, string computedInFunction |
+    elem = MacroUnwrapper<Expr>::unwrapElement(sink.getNode().asExpr()) and
+    not InvalidInfinityFlow::PathGraph::edges(_, source, _, _) and
+    not InvalidInfinityFlow::PathGraph::edges(sink, _, _, _) and
+    not sourceExpr.isFromTemplateInstantiation(_) and
+    not usage.asExpr().isFromTemplateInstantiation(_) and
+    usage = sink.getNode() and
+    sourceExpr = source.getNode().asExpr() and
+    function = sourceExpr.getEnclosingFunction() and
+    InvalidInfinityFlow::flow(source.getNode(), usage) and
+    (
+      if not sourceExpr.getEnclosingFunction() = usage.asExpr().getEnclosingFunction()
+      then computedInFunction = "computed in function $@ "
+      else computedInFunction = ""
+    ) and
+    (
+      if sourceExpr instanceof DivExpr
+      then sourceString = "from division by zero"
+      else sourceString = sourceExpr.toString()
+    ) and
+    message =
+      "Possibly infinite float value $@ " + computedInFunction + "flows to " +
+        usage.getDescription() and
+    functionName = function.getName()
+  )
+}
diff --git a/cpp/common/src/codingstandards/cpp/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.qll b/cpp/common/src/codingstandards/cpp/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.qll
new file mode 100644
index 0000000000..19ec4e1986
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.qll
@@ -0,0 +1,201 @@
+/**
+ * Provides a library with a `problems` predicate for the following issue:
+ * Possible mishandling of an undetected NaN value produced by a floating point
+ * operation.
+ */
+
+import cpp
+import codeql.util.Boolean
+import codingstandards.cpp.Customizations
+import codingstandards.cpp.Exclusions
+import codingstandards.cpp.RestrictedRangeAnalysis
+import codingstandards.cpp.FloatingPoint
+import codingstandards.cpp.AlertReporting
+import semmle.code.cpp.controlflow.Guards
+import semmle.code.cpp.dataflow.new.DataFlow
+import semmle.code.cpp.dataflow.new.TaintTracking
+import semmle.code.cpp.controlflow.Dominance
+
+abstract class PotentiallyNaNExpr extends Expr {
+  abstract string getReason();
+}
+
+class DomainErrorFunctionCall extends FunctionCall, PotentiallyNaNExpr {
+  string reason;
+
+  DomainErrorFunctionCall() { RestrictedDomainError::hasDomainError(this, reason) }
+
+  override string getReason() { result = reason }
+}
+
+// IEEE 754-1985 Section 7.1 invalid operations
+class InvalidOperationExpr extends BinaryOperation, PotentiallyNaNExpr {
+  string reason;
+
+  InvalidOperationExpr() {
+    // Usual arithmetic conversions in both languages mean that if either operand is a floating
+    // type, the other one is converted to a floating type as well.
+    getAnOperand().getFullyConverted().getType() instanceof FloatingPointType and
+    (
+      // 7.1.1 propagates signaling NaNs, we rely on flow analysis and/or assume quiet NaNs, so we
+      // intentionally do not cover this case.
+      // 7.1.2: magnitude subtraction of infinities, such as +Inf + -Inf
+      getOperator() = "+" and
+      exists(Boolean sign |
+        exprMayEqualInfinity(getLeftOperand(), sign) and
+        exprMayEqualInfinity(getRightOperand(), sign.booleanNot())
+      ) and
+      reason = "from addition of infinity and negative infinity"
+      or
+      // 7.1.2 continued
+      getOperator() = "-" and
+      exists(Boolean sign |
+        exprMayEqualInfinity(getLeftOperand(), sign) and
+        exprMayEqualInfinity(getRightOperand(), sign)
+      ) and
+      reason = "from subtraction of an infinity from itself"
+      or
+      // 7.1.3: multiplication of zero by infinity
+      getOperator() = "*" and
+      exists(Expr zeroOp, Expr infinityOp |
+        zeroOp = getAnOperand() and
+        infinityOp = getAnOperand() and
+        not zeroOp = infinityOp and
+        exprMayEqualZero(zeroOp) and
+        exprMayEqualInfinity(infinityOp, _)
+      ) and
+      reason = "from multiplication of zero by infinity"
+      or
+      // 7.1.4: Division of zero by zero, or infinity by infinity
+      getOperator() = "/" and
+      exprMayEqualZero(getLeftOperand()) and
+      exprMayEqualZero(getRightOperand()) and
+      reason = "from division of zero by zero"
+      or
+      // 7.1.4 continued
+      getOperator() = "/" and
+      exprMayEqualInfinity(getLeftOperand(), _) and
+      exprMayEqualInfinity(getRightOperand(), _) and
+      reason = "from division of infinity by infinity"
+      or
+      // 7.1.5: x % y where y is zero or x is infinite
+      getOperator() = "%" and
+      exprMayEqualInfinity(getLeftOperand(), _) and
+      reason = "from modulus of infinity"
+      or
+      // 7.1.5 continued
+      getOperator() = "%" and
+      exprMayEqualZero(getRightOperand()) and
+      reason = "from modulus by zero"
+      // 7.1.6 handles the sqrt function, not covered here.
+      // 7.1.7 declares exceptions during invalid conversions, which we catch as sinks in our flow
+      // analysis.
+      // 7.1.8 declares exceptions for unordered comparisons, which we catch as sinks in our flow
+      // analysis.
+    )
+  }
+
+  override string getReason() { result = reason }
+}
+
+module InvalidNaNUsage implements DataFlow::ConfigSig {
+  /**
+   * An expression which has non-NaN inputs and may produce a NaN output.
+   */
+  predicate isSource(DataFlow::Node node) {
+    potentialSource(node) and
+    not exists(DataFlow::Node prior |
+      isAdditionalFlowStep(prior, node) and
+      potentialSource(prior)
+    )
+  }
+
+  /**
+   * An expression which may produce a NaN output.
+   */
+  additional predicate potentialSource(DataFlow::Node node) {
+    node.asExpr() instanceof PotentiallyNaNExpr
+  }
+
+  predicate isBarrierOut(DataFlow::Node node) {
+    guardedNotFPClass(node.asExpr(), TNaN())
+    or
+    exists(Expr e |
+      e.getType() instanceof IntegralType and
+      e = node.asConvertedExpr()
+    )
+  }
+
+  /**
+   * Add an additional flow step to handle NaN propagation through floating point operations.
+   */
+  predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
+    exists(Operation o |
+      o.getAnOperand() = source.asExpr() and
+      o = sink.asExpr() and
+      o.getType() instanceof FloatingPointType
+    )
+  }
+
+  predicate isSink(DataFlow::Node node) {
+    not guardedNotFPClass(node.asExpr(), TNaN()) and
+    node instanceof InvalidNaNUsage
+  }
+}
+
+class InvalidNaNUsage extends DataFlow::Node {
+  string description;
+
+  InvalidNaNUsage() {
+    // Case 1: NaNs shall not be compared, except to themselves
+    exists(ComparisonOperation cmp |
+      this.asExpr() = cmp.getAnOperand() and
+      not hashCons(cmp.getLeftOperand()) = hashCons(cmp.getRightOperand()) and
+      description = "comparison, which would always evaluate to false."
+    )
+    or
+    // Case 2: NaNs and infinities shall not be cast to integers
+    exists(Conversion c |
+      this.asExpr() = c.getUnconverted() and
+      c.getExpr().getType() instanceof FloatingPointType and
+      c.getType() instanceof IntegralType and
+      description = "a cast to integer."
+    )
+  }
+
+  string getDescription() { result = description }
+}
+
+module InvalidNaNFlow = DataFlow::Global<InvalidNaNUsage>;
+
+import InvalidNaNFlow::PathGraph
+
+abstract class MisuseOfNaNFloatingPointValueSharedQuery extends Query { }
+
+Query getQuery() { result instanceof MisuseOfNaNFloatingPointValueSharedQuery }
+
+query predicate problems(
+  Element elem, InvalidNaNFlow::PathNode source, InvalidNaNFlow::PathNode sink, string message,
+  Expr sourceExpr, string sourceString, Function function, string functionName
+) {
+  not isExcluded(elem, getQuery()) and
+  exists(InvalidNaNUsage usage, string computedInFunction |
+    not InvalidNaNFlow::PathGraph::edges(_, source, _, _) and
+    not InvalidNaNFlow::PathGraph::edges(sink, _, _, _) and
+    not sourceExpr.isFromTemplateInstantiation(_) and
+    not usage.asExpr().isFromTemplateInstantiation(_) and
+    elem = MacroUnwrapper<Expr>::unwrapElement(sink.getNode().asExpr()) and
+    usage = sink.getNode() and
+    sourceExpr = source.getNode().asExpr() and
+    sourceString = source.getNode().asExpr().(PotentiallyNaNExpr).getReason() and
+    function = sourceExpr.getEnclosingFunction() and
+    InvalidNaNFlow::flow(source.getNode(), usage) and
+    (
+      if not sourceExpr.getEnclosingFunction() = usage.asExpr().getEnclosingFunction()
+      then computedInFunction = "computed in function $@ "
+      else computedInFunction = ""
+    ) and
+    message = "Possible NaN value $@ " + computedInFunction + "flows to " + usage.getDescription() and
+    functionName = function.getName()
+  )
+}
diff --git a/cpp/common/src/codingstandards/cpp/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.qll b/cpp/common/src/codingstandards/cpp/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.qll
index a0006eb643..f17da7e457 100644
--- a/cpp/common/src/codingstandards/cpp/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/movedfromobjectsunspecifiedstate/MovedFromObjectsUnspecifiedState.qll
@@ -4,7 +4,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.standardlibrary.Utility
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll b/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll
index 91b2b05a3f..248cde106f 100644
--- a/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll
@@ -1,7 +1,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.commons.Printf
 
 abstract class NonConstantFormatSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.qll b/cpp/common/src/codingstandards/cpp/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.qll
index bede451e24..89c732ff5a 100644
--- a/cpp/common/src/codingstandards/cpp/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/onlyfreememoryallocateddynamicallyshared/OnlyFreeMemoryAllocatedDynamicallyShared.qll
@@ -7,7 +7,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.Allocations
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import NonDynamicPointerToFreeFlow::PathGraph
 
 /**
diff --git a/cpp/common/src/codingstandards/cpp/rules/orderingpredicatemustbestrictlyweak/OrderingPredicateMustBeStrictlyWeak.qll b/cpp/common/src/codingstandards/cpp/rules/orderingpredicatemustbestrictlyweak/OrderingPredicateMustBeStrictlyWeak.qll
index aa4b646ec6..1e9c025e4d 100644
--- a/cpp/common/src/codingstandards/cpp/rules/orderingpredicatemustbestrictlyweak/OrderingPredicateMustBeStrictlyWeak.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/orderingpredicatemustbestrictlyweak/OrderingPredicateMustBeStrictlyWeak.qll
@@ -14,19 +14,19 @@ abstract class OrderingPredicateMustBeStrictlyWeakSharedQuery extends Query { }
 
 Query getQuery() { result instanceof OrderingPredicateMustBeStrictlyWeakSharedQuery }
 
+class IsStrictlyWeaklyOrderedComment extends Comment {
+  IsStrictlyWeaklyOrderedComment() {
+    exists(getContents().regexpFind("(?m)^\\s*(//|\\*)\\s*@IsStrictlyWeaklyOrdered\\s*$", _, _))
+  }
+}
+
 /**
  * User annotated class indicating a comparator is axiomatically strictly weakly
  * ordering.
  */
 class UserDefinedStrictlyWeakOrderingComparator extends Class {
   UserDefinedStrictlyWeakOrderingComparator() {
-    exists(Comment c, string contents |
-      c.getCommentedElement() = this.getADeclarationEntry() and
-      contents =
-        c.getContents()
-            .splitAt("\n")
-            .regexpFind("^\\s*(//|\\*)\\s*@IsStrictlyWeaklyOrdered\\s*$", _, _)
-    )
+    exists(IsStrictlyWeaklyOrderedComment c | c.getCommentedElement() = this.getADeclarationEntry())
   }
 }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.qll b/cpp/common/src/codingstandards/cpp/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.qll
index e24fb91539..2ee92b1611 100644
--- a/cpp/common/src/codingstandards/cpp/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.qll
@@ -8,7 +8,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.SmartPointers
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import PointerToSmartPointerConstructorFlowFlow::PathGraph
 
 abstract class OwnedPointerValueStoredInUnrelatedSmartPointerSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/placementnewinsufficientstorage/PlacementNewInsufficientStorage.qll b/cpp/common/src/codingstandards/cpp/rules/placementnewinsufficientstorage/PlacementNewInsufficientStorage.qll
index dc26d13b87..6b2c6c87c9 100644
--- a/cpp/common/src/codingstandards/cpp/rules/placementnewinsufficientstorage/PlacementNewInsufficientStorage.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/placementnewinsufficientstorage/PlacementNewInsufficientStorage.qll
@@ -7,7 +7,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.allocations.PlacementNew
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import PlacementNewOriginFlow::PathGraph
 
 abstract class PlacementNewInsufficientStorageSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/placementnewnotproperlyaligned/PlacementNewNotProperlyAligned.qll b/cpp/common/src/codingstandards/cpp/rules/placementnewnotproperlyaligned/PlacementNewNotProperlyAligned.qll
index 72286f2d79..d250061a23 100644
--- a/cpp/common/src/codingstandards/cpp/rules/placementnewnotproperlyaligned/PlacementNewNotProperlyAligned.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/placementnewnotproperlyaligned/PlacementNewNotProperlyAligned.qll
@@ -7,7 +7,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.allocations.PlacementNew
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import PlacementNewOriginFlow::PathGraph
 
 abstract class PlacementNewNotProperlyAlignedSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/predicatefunctionobjectsshouldnotbemutable/PredicateFunctionObjectsShouldNotBeMutable.qll b/cpp/common/src/codingstandards/cpp/rules/predicatefunctionobjectsshouldnotbemutable/PredicateFunctionObjectsShouldNotBeMutable.qll
index bf47c1f649..ba2f6ed82a 100644
--- a/cpp/common/src/codingstandards/cpp/rules/predicatefunctionobjectsshouldnotbemutable/PredicateFunctionObjectsShouldNotBeMutable.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/predicatefunctionobjectsshouldnotbemutable/PredicateFunctionObjectsShouldNotBeMutable.qll
@@ -9,6 +9,7 @@ import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import codingstandards.cpp.SideEffect
 import codingstandards.cpp.sideeffect.DefaultEffects
+import semmle.code.cpp.dataflow.DataFlow
 
 abstract class PredicateFunctionObjectsShouldNotBeMutableSharedQuery extends Query { }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/readofuninitializedmemory/ReadOfUninitializedMemory.qll b/cpp/common/src/codingstandards/cpp/rules/readofuninitializedmemory/ReadOfUninitializedMemory.qll
index 9de640db9c..8d701cb26c 100644
--- a/cpp/common/src/codingstandards/cpp/rules/readofuninitializedmemory/ReadOfUninitializedMemory.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/readofuninitializedmemory/ReadOfUninitializedMemory.qll
@@ -131,6 +131,8 @@ class UninitializedVariable extends LocalVariable {
     // Not static or thread local, because they are not initialized with indeterminate values
     not isStatic() and
     not isThreadLocal() and
+    // Not atomic, which have special initialization rules
+    not getType().hasSpecifier("atomic") and
     // Not a class type, because default initialization of a class calls the default constructor
     // The default constructor may leave certain fields uninitialized, but that would be a separate
     // field-wise analysis
diff --git a/cpp/common/src/codingstandards/cpp/rules/returnreferenceorpointertoautomaticlocalvariable/ReturnReferenceOrPointerToAutomaticLocalVariable.qll b/cpp/common/src/codingstandards/cpp/rules/returnreferenceorpointertoautomaticlocalvariable/ReturnReferenceOrPointerToAutomaticLocalVariable.qll
index cd623f711c..b37a9cd02b 100644
--- a/cpp/common/src/codingstandards/cpp/rules/returnreferenceorpointertoautomaticlocalvariable/ReturnReferenceOrPointerToAutomaticLocalVariable.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/returnreferenceorpointertoautomaticlocalvariable/ReturnReferenceOrPointerToAutomaticLocalVariable.qll
@@ -13,7 +13,7 @@ abstract class ReturnReferenceOrPointerToAutomaticLocalVariableSharedQuery exten
 Query getQuery() { result instanceof ReturnReferenceOrPointerToAutomaticLocalVariableSharedQuery }
 
 query predicate problems(
-  ReturnStmt rs, string message, Function f, string f_string, Variable auto, string auto_string
+  ReturnStmt rs, string message, Function f, string f_string, StackVariable auto, string auto_string
 ) {
   exists(VariableAccess va, string returnType |
     not isExcluded(rs, getQuery()) and
diff --git a/cpp/common/src/codingstandards/cpp/rules/stringnumberconversionmissingerrorcheck/StringNumberConversionMissingErrorCheck.qll b/cpp/common/src/codingstandards/cpp/rules/stringnumberconversionmissingerrorcheck/StringNumberConversionMissingErrorCheck.qll
index 98fd51a58f..fd56f5d899 100644
--- a/cpp/common/src/codingstandards/cpp/rules/stringnumberconversionmissingerrorcheck/StringNumberConversionMissingErrorCheck.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/stringnumberconversionmissingerrorcheck/StringNumberConversionMissingErrorCheck.qll
@@ -7,7 +7,7 @@ import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
-import codingstandards.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.TaintTracking
 import codingstandards.cpp.standardlibrary.CharStreams
 
 abstract class StringNumberConversionMissingErrorCheckSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.qll b/cpp/common/src/codingstandards/cpp/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.qll
index 9dbefeaa75..e28ef7ab07 100644
--- a/cpp/common/src/codingstandards/cpp/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/throwingoperatornewreturnsnull/ThrowingOperatorNewReturnsNull.qll
@@ -4,7 +4,7 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 import codingstandards.cpp.allocations.CustomOperatorNewDelete
 import codingstandards.cpp.exceptions.ExceptionSpecifications
 import codingstandards.cpp.Customizations
diff --git a/cpp/common/src/codingstandards/cpp/rules/uncheckedrangedomainpoleerrors/UncheckedRangeDomainPoleErrors.qll b/cpp/common/src/codingstandards/cpp/rules/uncheckedrangedomainpoleerrors/UncheckedRangeDomainPoleErrors.qll
index ad93f70bd4..acc7888d2c 100644
--- a/cpp/common/src/codingstandards/cpp/rules/uncheckedrangedomainpoleerrors/UncheckedRangeDomainPoleErrors.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/uncheckedrangedomainpoleerrors/UncheckedRangeDomainPoleErrors.qll
@@ -4,63 +4,14 @@
 
 import cpp
 import codingstandards.cpp.CodingStandards
+import codingstandards.cpp.FloatingPoint
+import codingstandards.cpp.FloatingPoint::SimpleDomainError
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
 abstract class UncheckedRangeDomainPoleErrorsSharedQuery extends Query { }
 
 Query getQuery() { result instanceof UncheckedRangeDomainPoleErrorsSharedQuery }
 
-bindingset[name]
-Function getMathVariants(string name) { result.hasGlobalOrStdName([name, name + "f", name + "l"]) }
-
-predicate hasDomainError(FunctionCall fc, string description) {
-  exists(Function functionWithDomainError | fc.getTarget() = functionWithDomainError |
-    functionWithDomainError = [getMathVariants(["acos", "asin", "atanh"])] and
-    not (
-      upperBound(fc.getArgument(0)) <= 1.0 and
-      lowerBound(fc.getArgument(0)) >= -1.0
-    ) and
-    description =
-      "the argument has a range " + lowerBound(fc.getArgument(0)) + "..." +
-        upperBound(fc.getArgument(0)) + " which is outside the domain of this function (-1.0...1.0)"
-    or
-    functionWithDomainError = getMathVariants(["atan2", "pow"]) and
-    (
-      fc.getArgument(0).getValue().toFloat() = 0 and
-      fc.getArgument(1).getValue().toFloat() = 0 and
-      description = "both arguments are equal to zero"
-    )
-    or
-    functionWithDomainError = getMathVariants("pow") and
-    (
-      upperBound(fc.getArgument(0)) < 0.0 and
-      upperBound(fc.getArgument(1)) < 0.0 and
-      description = "both arguments are less than zero"
-    )
-    or
-    functionWithDomainError = getMathVariants("acosh") and
-    upperBound(fc.getArgument(0)) < 1.0 and
-    description = "argument is less than 1"
-    or
-    //pole error is the same as domain for logb and tgamma (but not ilogb - no pole error exists)
-    functionWithDomainError = getMathVariants(["ilogb", "logb", "tgamma"]) and
-    fc.getArgument(0).getValue().toFloat() = 0 and
-    description = "argument is equal to zero"
-    or
-    functionWithDomainError = getMathVariants(["log", "log10", "log2", "sqrt"]) and
-    upperBound(fc.getArgument(0)) < 0.0 and
-    description = "argument is negative"
-    or
-    functionWithDomainError = getMathVariants("log1p") and
-    upperBound(fc.getArgument(0)) < -1.0 and
-    description = "argument is less than 1"
-    or
-    functionWithDomainError = getMathVariants("fmod") and
-    fc.getArgument(1).getValue().toFloat() = 0 and
-    description = "y is 0"
-  )
-}
-
 predicate hasRangeError(FunctionCall fc, string description) {
   exists(Function functionWithRangeError | fc.getTarget() = functionWithRangeError |
     functionWithRangeError.hasGlobalOrStdName(["abs", "labs", "llabs", "imaxabs"]) and
diff --git a/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll b/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll
index 85ffb7b992..b6d085619a 100644
--- a/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll
@@ -5,7 +5,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.TypeUses
+import codingstandards.cpp.types.Uses
 
 abstract class UnusedTypeDeclarationsSharedQuery extends Query { }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/useonlyarrayindexingforpointerarithmetic/UseOnlyArrayIndexingForPointerArithmetic.qll b/cpp/common/src/codingstandards/cpp/rules/useonlyarrayindexingforpointerarithmetic/UseOnlyArrayIndexingForPointerArithmetic.qll
index c421ae3cc9..3b0abbad0d 100644
--- a/cpp/common/src/codingstandards/cpp/rules/useonlyarrayindexingforpointerarithmetic/UseOnlyArrayIndexingForPointerArithmetic.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/useonlyarrayindexingforpointerarithmetic/UseOnlyArrayIndexingForPointerArithmetic.qll
@@ -6,7 +6,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import codingstandards.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow
 
 abstract class UseOnlyArrayIndexingForPointerArithmeticSharedQuery extends Query { }
 
diff --git a/cpp/common/src/codingstandards/cpp/standardlibrary/FileStreams.qll b/cpp/common/src/codingstandards/cpp/standardlibrary/FileStreams.qll
index c4724d36c2..99eec1f5e0 100644
--- a/cpp/common/src/codingstandards/cpp/standardlibrary/FileStreams.qll
+++ b/cpp/common/src/codingstandards/cpp/standardlibrary/FileStreams.qll
@@ -10,8 +10,8 @@
  */
 
 import cpp
-import codingstandards.cpp.dataflow.DataFlow
-import codingstandards.cpp.dataflow.TaintTracking
+private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.TaintTracking
 private import codingstandards.cpp.Operator
 
 /**
diff --git a/cpp/common/src/codingstandards/cpp/trustboundary/UninitializedField.qll b/cpp/common/src/codingstandards/cpp/trustboundary/UninitializedField.qll
index e6a2bbe706..f58f1352a7 100644
--- a/cpp/common/src/codingstandards/cpp/trustboundary/UninitializedField.qll
+++ b/cpp/common/src/codingstandards/cpp/trustboundary/UninitializedField.qll
@@ -5,7 +5,7 @@
  */
 
 import cpp
-private import codingstandards.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.DataFlow
 private import semmle.code.cpp.controlflow.SubBasicBlocks
 private import semmle.code.cpp.padding.Padding as Padding
 private import semmle.code.cpp.dataflow.internal.FlowVar
diff --git a/cpp/common/src/codingstandards/cpp/types/Compatible.qll b/cpp/common/src/codingstandards/cpp/types/Compatible.qll
new file mode 100644
index 0000000000..83983e1df4
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/types/Compatible.qll
@@ -0,0 +1,532 @@
+import cpp
+import codeql.util.Boolean
+import codingstandards.cpp.types.Graph
+import codingstandards.cpp.types.FunctionType
+
+module TypeNamesMatchConfig implements TypeEquivalenceSig {
+  predicate resolveTypedefs() {
+    // We don't want to resolve typedefs here, as we want to compare the names of the types.
+    none()
+  }
+}
+
+/**
+ * The set of types that are used in function signatures.
+ */
+class FunctionSignatureType extends Type {
+  FunctionSignatureType() {
+    exists(FunctionDeclarationEntry f |
+      this = f.getType() or this = f.getAParameterDeclarationEntry().getType()
+    )
+  }
+}
+
+class VariableType extends Type {
+  VariableType() { this = any(VariableDeclarationEntry v).getType() }
+}
+
+predicate parameterNamesUnmatched(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
+  pragma[only_bind_into](f1).getDeclaration() = pragma[only_bind_into](f2).getDeclaration() and
+  exists(string p1Name, string p2Name, int i |
+    p1Name = f1.getParameterDeclarationEntry(i).getName() and
+    p2Name = f2.getParameterDeclarationEntry(i).getName()
+  |
+    not p1Name = p2Name
+  )
+}
+
+/**
+ * Implements type compatibility as defined in C17, assuming typedefs have already been resolved.
+ *
+ * The default TypeEquivalence already handles the following:
+ *  - A type is compatible with itself
+ *  - All specifiers must match, but the order does not matter
+ *  - Function types are compatible if they have the same return type and compatible parameters.
+ *
+ * Additional override for array sizes and enums are added here.
+ */
+module TypesCompatibleConfig implements TypeEquivalenceSig {
+  bindingset[t1, t2]
+  predicate equalLeafTypes(Type t1, Type t2) {
+    t1 = t2
+    or
+    t1.(IntegralType).getCanonicalArithmeticType() = t2.(IntegralType).getCanonicalArithmeticType()
+    or
+    // Enum types are compatible with one of char, int, or signed int, but the implementation
+    // decides.
+    t1 instanceof Enum and
+    (t2 instanceof CharType or t2 instanceof IntType)
+    or
+    t2 instanceof Enum and
+    (t1 instanceof CharType or t1 instanceof IntType)
+  }
+
+  bindingset[t1, t2]
+  predicate equalArrayTypes(ArrayType t1, ArrayType t2, Boolean baseTypesEqual) {
+    baseTypesEqual = true and
+    // Compatible array types have compatible element types. If both have a constant size then that
+    // size must match.
+    count(int i | i = [t1, t2].(ArrayType).getSize()) < 2
+  }
+}
+
+/**
+ * Utilize QlBuiltins::InternSets to efficiently compare the sets of specifiers on two types.
+ */
+bindingset[t1, t2]
+private predicate specifiersMatchExactly(Type t1, Type t2) {
+  t1 = t2
+  or
+  SpecifierSet::getSet(t1) = SpecifierSet::getSet(t2)
+}
+
+/**
+ * Base predicate for `QlBuiltins::InternSets` to get the specifier set for a type.
+ *
+ * Note that this also efficiently handles complex typedef cases, where a specified type points to
+ * a typedef that points to another specified type. In this case, `getASpecifier()` will return all
+ * of specifiers, not just those above the TypedefType.
+ */
+Specifier getASpecifier(SpecifiedType key) { result = key.getASpecifier() }
+
+module SpecifierSet = QlBuiltins::InternSets<SpecifiedType, Specifier, getASpecifier/1>;
+
+/**
+ * Signature module for handling various kinds of potentially recursive type equivalence using the
+ * module `TypeEquivalence<T>`.
+ *
+ * The various kinds of types to be compared all have an overridable predicate with default
+ * behavior here, and a boolean flag that indicates whether the base types are equal. This pattern
+ * is used because we can't make a default implementation of a predicate such as
+ * `equalPointerTypes` that recurses into the `TypeEquivalence` module. Instead, the
+ * `TypeEquivalence` module drives all of the recursion, and these predicates take the result of
+ * that recursion and use it to determine whether the types are equivalent.
+ */
+signature module TypeEquivalenceSig {
+  /**
+   * Whether two leaf types are equivalent, such as `int`s and structs. By default, we assume only
+   * that types are equal to themselves and that equivalent arithmetic types are equal.
+   */
+  bindingset[t1, t2]
+  default predicate equalLeafTypes(Type t1, Type t2) {
+    t1 = t2
+    or
+    t1.(IntegralType).getCanonicalArithmeticType() = t2.(IntegralType).getCanonicalArithmeticType()
+  }
+
+  /**
+   * A predicate to arbitrarily override the default behavior of the `TypeEquivalence` module,
+   * including preventing recursion. If this predicate holds for a pair of types, then
+   * `TypeEquivalence::equalTypes()` holds only if `areEqual` is true.
+   */
+  bindingset[t1, t2]
+  default predicate overrideTypeComparison(Type t1, Type t2, Boolean areEqual) { none() }
+
+  /**
+   * Whether two specified types are equivalent. By default, we assume that the specifier sets are
+   * exactly the same, and the inner types also match.
+   */
+  bindingset[t1, t2]
+  default predicate equalSpecifiedTypes(
+    SpecifiedType t1, SpecifiedType t2, Boolean unspecifiedTypesEqual
+  ) {
+    specifiersMatchExactly(t1, t2) and
+    unspecifiedTypesEqual = true
+  }
+
+  /**
+   * Whether two specified types are equivalent. By default, we only require that the base (pointed
+   * to) types match.
+   */
+  bindingset[t1, t2]
+  default predicate equalPointerTypes(PointerType t1, PointerType t2, Boolean baseTypesEqual) {
+    baseTypesEqual = true
+  }
+
+  /**
+   * Whether two array types are equivalent. By default, we only require that the element types and
+   * array sizes match.
+   */
+  bindingset[t1, t2]
+  default predicate equalArrayTypes(ArrayType t1, ArrayType t2, Boolean baseTypesEqual) {
+    t1.getSize() = t2.getSize() and
+    baseTypesEqual = true
+  }
+
+  /**
+   * Whether two reference types are equivalent. By default, we only require that the base types match.
+   */
+  bindingset[t1, t2]
+  default predicate equalReferenceTypes(ReferenceType t1, ReferenceType t2, Boolean baseTypesEqual) {
+    baseTypesEqual = true
+  }
+
+  /**
+   * Whether typedefs should be resolved before comparison. By default, we assume `TypeEquivalence`
+   * should resolve typedefs before comparison.
+   */
+  default predicate resolveTypedefs() { any() }
+
+  /**
+   * Whether two typedef types are equivalent.
+   *
+   * This predicate is only used if `resolveTypedefs()` is false. If so, then we assume two
+   * typedefs are the same if they have the same name and their base types are equal.
+   */
+  bindingset[t1, t2]
+  default predicate equalTypedefTypes(TypedefType t1, TypedefType t2, Boolean baseTypesEqual) {
+    t1.getName() = t2.getName() and
+    baseTypesEqual = true
+  }
+
+  /**
+   * Whether two routine types are equivalent. By default, we only require that the return types and
+   * parameter types match.
+   */
+  bindingset[t1, t2]
+  default predicate equalRoutineTypes(
+    RoutineType t1, RoutineType t2, Boolean returnTypeEqual, Boolean parameterTypesEqual
+  ) {
+    returnTypeEqual = true and parameterTypesEqual = true
+  }
+
+  /**
+   * Whether two function pointer/reference types are equivalent. By default, we only require that
+   * the return types and parameter types match.
+   */
+  bindingset[t1, t2]
+  default predicate equalFunctionPointerIshTypes(
+    FunctionPointerIshType t1, FunctionPointerIshType t2, Boolean returnTypeEqual,
+    Boolean parameterTypesEqual
+  ) {
+    returnTypeEqual = true and parameterTypesEqual = true
+  }
+}
+
+/**
+ * The default equivalence behavior for the `TypeEquivalence` module.
+ */
+module DefaultEquivalence implements TypeEquivalenceSig { }
+
+/**
+ * A signature predicate used to restrict the set of types considered by `TypeEquivalence`, for
+ * performance reasons.
+ */
+signature predicate interestedInEquality(Type a, Type b);
+
+/**
+ * A module to check the equivalence of two types, as defined by the provided `TypeEquivalenceSig`.
+ *
+ * For performance reasons, this module is designed to be used with a predicate
+ * `interestedInEquality` that restricts the set of considered pairwise comparisons.
+ *
+ * To use this module, define a `TypeEquivalenceSig` module and implement a subset of `Type` that
+ * selects the relevant root types to be considered. Then use the predicate `equalTypes(a, b)`.
+ * Note that `equalTypes(a, b)` only holds if `interestedIn(a, b)` holds. A type is always
+ * considered to be equal to itself, and this module does not support configurations that declare
+ * otherwise. Additionally, `interestedIn(a, b)` implies `interestedIn(b, a)`.
+ *
+ * This module will recursively select pairs of types to be compared. For instance, if
+ * `interestedInEquality(a, b)` holds, then types `a` and `b` will be compared. If
+ * `Config::equalPointerTypes(a, b, true)` holds, then the pointed-to types of `a` and `b` will be
+ * compared. However, if `Config::equalPointerTypes(a, b, false)` holds, then `a` and `b` will be
+ * compared, but their pointed-to types will not. Similarly, inner types will not be compared if
+ * `Config::overrideTypeComparison(a, b, _)` holds. For detail, see the module predicates
+ * `shouldRecurseOn` and `interestedInNestedTypes`.
+ */
+module TypeEquivalence<TypeEquivalenceSig Config, interestedInEquality/2 interestedIn> {
+  /**
+   * Performance-related predicate that holds for a pair of types `(a, b)` such that
+   * `interestedIn(a, b)` holds, or there exists a pair of types `(c, d)` such that
+   * `interestedIn(c, d)` holds, and computing `equalTypes(a, b)` requires computing
+   * `equalTypes(c, d)`.
+   *
+   * The goal of this predicate is to force top down rather than bottom up evaluation of type
+   * equivalence. That is to say, if we compare array types `int[]` and `int[]`, we to compare that
+   * both types are arrays first, and then compare that their base types are equal. Naively, CodeQL
+   * is liable to compute this kind of recursive equality in a bottom up fashion, where the cross
+   * product of all types is considered in computing `equalTypes(a, b)`.
+   *
+   * This interoperates with the predicate `shouldRecurseOn` to find types that will be compared,
+   * along with the inner types of those types that will be compared. See `shouldRecurseOn` for
+   * cases where this algorithm will or will not recurse. We still need to know which types are
+   * compared, even if we do not recurse on them, in order to properly constrain `equalTypes(x, y)`
+   * to hold for types such as leaf types, where we do not recurse during comparison.
+   *
+   * At each stage of recursion, we specify `pragma[only_bind_into]` to ensure that the
+   * prior `shouldRecurseOn` results are considered first in the pipeline.
+   */
+  private predicate interestedInNestedTypes(Type t1, Type t2) {
+    // Base case: config specifies that these root types will be compared.
+    interestedInUnordered(t1, t2)
+    or
+    // If derived types are compared, their base types must be compared.
+    exists(DerivedType t1Derived, DerivedType t2Derived |
+      not t1Derived instanceof SpecifiedType and
+      not t2Derived instanceof SpecifiedType and
+      shouldRecurseOn(pragma[only_bind_into](t1Derived), pragma[only_bind_into](t2Derived)) and
+      t1 = t1Derived.getBaseType() and
+      t2 = t2Derived.getBaseType()
+    )
+    or
+    // If specified types are compared, their unspecified types must be compared.
+    exists(SpecifiedType t1Spec, SpecifiedType t2Spec |
+      shouldRecurseOn(pragma[only_bind_into](t1Spec), pragma[only_bind_into](t2Spec)) and
+      (
+        t1 = unspecify(t1Spec) and
+        t2 = unspecify(t2Spec)
+      )
+    )
+    or
+    // If function types are compared, their return types and parameter types must be compared.
+    exists(FunctionType t1Func, FunctionType t2Func |
+      shouldRecurseOn(pragma[only_bind_into](t1Func), pragma[only_bind_into](t2Func)) and
+      (
+        t1 = t1Func.getReturnType() and
+        t2 = t2Func.getReturnType()
+        or
+        exists(int i |
+          t1 = t1Func.getParameterType(pragma[only_bind_out](i)) and
+          t2 = t2Func.getParameterType(i)
+        )
+      )
+    )
+    or
+    // If the config says to resolve typedefs, and a typedef type is compared to a non-typedef
+    // type, then the non-typedef type must be compared to the base type of the typedef.
+    Config::resolveTypedefs() and
+    exists(TypedefType tdtype |
+      tdtype.getBaseType() = t1 and
+      shouldRecurseOn(pragma[only_bind_into](tdtype), t2)
+      or
+      tdtype.getBaseType() = t2 and
+      shouldRecurseOn(t1, pragma[only_bind_into](tdtype))
+    )
+    or
+    // If two typedef types are compared, then their base types must be compared.
+    exists(TypedefType t1Typedef, TypedefType t2Typedef |
+      shouldRecurseOn(pragma[only_bind_into](t1Typedef), pragma[only_bind_into](t2Typedef)) and
+      (
+        t1 = t1Typedef.getBaseType() and
+        t2 = t2Typedef.getBaseType()
+      )
+    )
+  }
+
+  /**
+   * Performance related predicate to force top down rather than bottom up evaluation of type
+   * equivalence.
+   *
+   * This predicate is used to determine whether we should recurse on a type. It is used in
+   * conjunction with the `interestedInNestedTypes` predicate to only recurse on types that are
+   * being compared.
+   *
+   * We don't recurse on identical types, as they are already equal. We also don't recurse on
+   * types that are overriden by `Config::overrideTypeComparison`, as that predicate determines
+   * their equalivance.
+   *
+   * For the other types, we have a set of predicates such as `Config::equalPointerTypes` that
+   * holds for `(x, y, true)` if the types `x` and `y` should be considered equivalent when the
+   * pointed-to types of `x` and `y` are equivalent. If the predicate does not hold, or holds for
+   * `(x, y, false)`, then we do not recurse on the types.
+   *
+   * We do not recurse on leaf types.
+   */
+  private predicate shouldRecurseOn(Type t1, Type t2) {
+    // We only recurse on types we are comparing.
+    interestedInNestedTypes(pragma[only_bind_into](t1), pragma[only_bind_into](t2)) and
+    // We don't recurse on identical types, as they are already equal.
+    not t1 = t2 and
+    // We don't recurse on overriden comparisons
+    not Config::overrideTypeComparison(t1, t2, _) and
+    (
+      // These pointer types are equal if their base types are equal: recurse.
+      Config::equalPointerTypes(t1, t2, true)
+      or
+      // These array types are equal if their base types are equal: recurse.
+      Config::equalArrayTypes(t1, t2, true)
+      or
+      // These reference types are equal if their base types are equal: recurse.
+      Config::equalReferenceTypes(t1, t2, true)
+      or
+      // These routine types are equal if their return and parameter types are equal: recurse.
+      Config::equalRoutineTypes(t1, t2, true, true)
+      or
+      // These function pointer-ish types are equal if their return and parameter types are equal: recurse.
+      Config::equalFunctionPointerIshTypes(t1, t2, true, true)
+      or
+      // These typedef types are equal if their base types are equal: recurse.
+      Config::equalTypedefTypes(t1, t2, true)
+      or
+      // These specified types are equal if their unspecified types are equal: recurse.
+      Config::equalSpecifiedTypes(t1, t2, true)
+      or
+      // We resolve typedefs, and one of these types is a typedef type: recurse.
+      Config::resolveTypedefs() and
+      (
+        t1 instanceof TypedefType
+        or
+        t2 instanceof TypedefType
+      )
+    )
+  }
+
+  /**
+   * Check whether two types are equivalent, as defined by the `TypeEquivalenceSig` module.
+   *
+   * This only holds if the specified predicate `interestedIn` holds for the types, or
+   * `interestedInNestedTypes` holds for the types, and holds if `t1` and `t2` are identical,
+   * regardless of how `TypeEquivalenceSig` is defined.
+   */
+  predicate equalTypes(Type t1, Type t2) {
+    interestedInNestedTypes(pragma[only_bind_into](t1), pragma[only_bind_into](t2)) and
+    (
+      t1 = t2
+      or
+      not t1 = t2 and
+      if Config::overrideTypeComparison(t1, t2, _)
+      then Config::overrideTypeComparison(t1, t2, true)
+      else (
+        equalLeafRelation(t1, t2)
+        or
+        equalDerivedTypes(t1, t2)
+        or
+        equalFunctionTypes(t1, t2)
+        or
+        Config::resolveTypedefs() and
+        (
+          equalTypes(t1.(TypedefType).getBaseType(), t2)
+          or
+          equalTypes(t1, t2.(TypedefType).getBaseType())
+        )
+        or
+        not Config::resolveTypedefs() and
+        equalTypedefTypes(t1, t2)
+      )
+    )
+  }
+
+  /** Whether two types will be compared, regardless of order (a, b) or (b, a). */
+  private predicate interestedInUnordered(Type t1, Type t2) {
+    interestedIn(t1, t2) or
+    interestedIn(t2, t1)
+  }
+
+  bindingset[t1, t2]
+  private predicate equalLeafRelation(LeafType t1, LeafType t2) { Config::equalLeafTypes(t1, t2) }
+
+  bindingset[t]
+  private Type unspecify(SpecifiedType t) {
+    // This subtly and importantly handles the complicated cases of typedefs. Under most scenarios,
+    // if we see a typedef in `equalTypes()` we can simply get the base type and continue. However,
+    // there is an exception if we have a specified type that points to a typedef that points to
+    // another specified type. In this case, `SpecifiedType::getASpecifier()` will return all of
+    // specifiers, not just those above the TypedefType, and `stripTopLevelSpecifiers` will return
+    // the innermost type that is not a TypedefType or a SpecifiedType, which is what we want, as
+    // all specifiers have already been accounted for when we visit the outermost `SpecifiedType`.
+    if Config::resolveTypedefs()
+    then result = t.(SpecifiedType).stripTopLevelSpecifiers()
+    else result = t.(SpecifiedType).getBaseType()
+  }
+
+  bindingset[t1, t2]
+  private predicate equalDerivedTypes(DerivedType t1, DerivedType t2) {
+    exists(Boolean baseTypesEqual |
+      (baseTypesEqual = true implies equalTypes(t1.getBaseType(), t2.getBaseType())) and
+      (
+        Config::equalPointerTypes(t1, t2, baseTypesEqual)
+        or
+        Config::equalArrayTypes(t1, t2, baseTypesEqual)
+        or
+        Config::equalReferenceTypes(t1, t2, baseTypesEqual)
+      )
+    )
+    or
+    exists(Boolean unspecifiedTypesEqual |
+      // Note that this case is different from the above, in that we don't merely get the base
+      // type (as that could be a TypedefType that points to another SpecifiedType). We need to
+      // unspecify the type to see if the base types are equal.
+      (unspecifiedTypesEqual = true implies equalTypes(unspecify(t1), unspecify(t2))) and
+      Config::equalSpecifiedTypes(t1, t2, unspecifiedTypesEqual)
+    )
+  }
+
+  bindingset[t1, t2]
+  private predicate equalFunctionTypes(FunctionType t1, FunctionType t2) {
+    exists(Boolean returnTypeEqual, Boolean parameterTypesEqual |
+      (returnTypeEqual = true implies equalTypes(t1.getReturnType(), t2.getReturnType())) and
+      (
+        parameterTypesEqual = true
+        implies
+        forall(int i | exists([t1, t2].getParameterType(i)) |
+          equalTypes(t1.getParameterType(i), t2.getParameterType(i))
+        )
+      ) and
+      (
+        Config::equalRoutineTypes(t1, t2, returnTypeEqual, parameterTypesEqual)
+        or
+        Config::equalFunctionPointerIshTypes(t1, t2, returnTypeEqual, parameterTypesEqual)
+      )
+    )
+  }
+
+  bindingset[t1, t2]
+  private predicate equalTypedefTypes(TypedefType t1, TypedefType t2) {
+    exists(Boolean baseTypesEqual |
+      (baseTypesEqual = true implies equalTypes(t1.getBaseType(), t2.getBaseType())) and
+      Config::equalTypedefTypes(t1, t2, baseTypesEqual)
+    )
+  }
+}
+
+signature predicate interestedInFunctionDeclarations(
+  FunctionDeclarationEntry f1, FunctionDeclarationEntry f2
+);
+
+module FunctionDeclarationTypeEquivalence<
+  TypeEquivalenceSig Config, interestedInFunctionDeclarations/2 interestedInFunctions>
+{
+  private predicate interestedInReturnTypes(Type a, Type b) {
+    exists(FunctionDeclarationEntry aFun, FunctionDeclarationEntry bFun |
+      interestedInFunctions(pragma[only_bind_into](aFun), pragma[only_bind_into](bFun)) and
+      a = aFun.getType() and
+      b = bFun.getType()
+    )
+  }
+
+  private predicate interestedInParameterTypes(Type a, Type b) {
+    exists(FunctionDeclarationEntry aFun, FunctionDeclarationEntry bFun, int i |
+      interestedInFunctions(pragma[only_bind_into](aFun), pragma[only_bind_into](bFun)) and
+      a = aFun.getParameterDeclarationEntry(i).getType() and
+      b = bFun.getParameterDeclarationEntry(i).getType()
+    )
+  }
+
+  predicate equalReturnTypes(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
+    interestedInFunctions(f1, f2) and
+    TypeEquivalence<Config, interestedInReturnTypes/2>::equalTypes(f1.getType(), f2.getType())
+  }
+
+  predicate equalParameterTypes(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2) {
+    interestedInFunctions(f1, f2) and
+    f1.getDeclaration() = f2.getDeclaration() and
+    forall(int i | exists([f1, f2].getParameterDeclarationEntry(i)) |
+      equalParameterTypesAt(f1, f2, pragma[only_bind_into](i))
+    )
+  }
+
+  predicate equalParameterTypesAt(FunctionDeclarationEntry f1, FunctionDeclarationEntry f2, int i) {
+    interestedInFunctions(f1, f2) and
+    f1.getDeclaration() = f2.getDeclaration() and
+    TypeEquivalence<Config, interestedInParameterTypes/2>::equalTypes(f1.getParameterDeclarationEntry(pragma[only_bind_into](i))
+          .getType(), f2.getParameterDeclarationEntry(pragma[only_bind_into](i)).getType())
+  }
+}
+
+private class LeafType extends Type {
+  LeafType() {
+    not this instanceof DerivedType and
+    not this instanceof FunctionType and
+    not this instanceof FunctionType
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/types/FunctionType.qll b/cpp/common/src/codingstandards/cpp/types/FunctionType.qll
new file mode 100644
index 0000000000..20166322f1
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/types/FunctionType.qll
@@ -0,0 +1,19 @@
+import cpp
+
+/**
+ * Convenience class to reduce the awkwardness of how `RoutineType` and `FunctionPointerIshType`
+ * don't have a common ancestor.
+ */
+class FunctionType extends Type {
+  FunctionType() { this instanceof RoutineType or this instanceof FunctionPointerIshType }
+
+  Type getReturnType() {
+    result = this.(RoutineType).getReturnType() or
+    result = this.(FunctionPointerIshType).getReturnType()
+  }
+
+  Type getParameterType(int i) {
+    result = this.(RoutineType).getParameterType(i) or
+    result = this.(FunctionPointerIshType).getParameterType(i)
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/types/Graph.qll b/cpp/common/src/codingstandards/cpp/types/Graph.qll
new file mode 100644
index 0000000000..70c51a40ba
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/types/Graph.qll
@@ -0,0 +1,15 @@
+import cpp
+
+predicate typeGraph(Type t, Type refersTo) {
+  refersTo = t.(DerivedType).getBaseType()
+  or
+  refersTo = t.(RoutineType).getReturnType()
+  or
+  refersTo = t.(RoutineType).getAParameterType()
+  or
+  refersTo = t.(FunctionPointerIshType).getReturnType()
+  or
+  refersTo = t.(FunctionPointerIshType).getAParameterType()
+  or
+  refersTo = t.(TypedefType).getBaseType()
+}
diff --git a/cpp/common/src/codingstandards/cpp/types/LvalueConversion.qll b/cpp/common/src/codingstandards/cpp/types/LvalueConversion.qll
new file mode 100644
index 0000000000..252e783438
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/types/LvalueConversion.qll
@@ -0,0 +1,38 @@
+import cpp
+
+/**
+ * Get the type of an lvalue after lvalue conversion.
+ *
+ * This will return the type itself if no conversion is performed.
+ */
+Type getLvalueConverted(Type t) {
+  if exists(performLvalueConversion(t, _))
+  then result = performLvalueConversion(t, _)
+  else result = t
+}
+
+/**
+ * Perform lvalue conversion on a type, allowing for a description of why the type was converted
+ * if it was.
+ *
+ * Does not return a value if no lvalue conversion was performed.
+ *
+ * Warning: This predicate may not return a result if the resulting type is not in the database.
+ * For convenience, this is accepted here, otherwise we would have to create a new type to return
+ * that wouldn't implement the type APIs and likely wouldn't be very useful.
+ */
+Type performLvalueConversion(Type t, string reason) {
+  result.(PointerType).getBaseType() = t.(ArrayType).getBaseType() and
+  reason = "array-to-pointer decay"
+  or
+  t instanceof RoutineType and
+  result.(PointerType).getBaseType() = t and
+  reason = "function-to-function-pointer decay"
+  or
+  isObjectType(t) and
+  exists(t.getASpecifier()) and
+  result = t.stripTopLevelSpecifiers() and
+  reason = "qualifiers removed"
+}
+
+private predicate isObjectType(Type t) { not t.stripTopLevelSpecifiers() instanceof PointerType }
diff --git a/cpp/common/src/codingstandards/cpp/Pointers.qll b/cpp/common/src/codingstandards/cpp/types/Pointers.qll
similarity index 100%
rename from cpp/common/src/codingstandards/cpp/Pointers.qll
rename to cpp/common/src/codingstandards/cpp/types/Pointers.qll
diff --git a/cpp/common/src/codingstandards/cpp/types/SimpleAssignment.qll b/cpp/common/src/codingstandards/cpp/types/SimpleAssignment.qll
new file mode 100644
index 0000000000..a31400a340
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/types/SimpleAssignment.qll
@@ -0,0 +1,77 @@
+/**
+ * Helper predicates related to C11/C17 constraints on simple assignment between two types.
+ *
+ * Currently only a subset of the constraints are implemented, specifically those
+ * related to pointer types.
+ */
+
+import codingstandards.cpp.types.LvalueConversion
+import codingstandards.cpp.types.Compatible
+
+module SimpleAssignment<interestedInEquality/2 checksAssignment> {
+  /**
+   * Whether a pair of qualified or unqualified pointer types satisfy the simple assignment
+   * constraints from 6.5.16.1.
+   *
+   * There are additional constraints not implemented here involving one or more arithmetic types.
+   */
+  predicate satisfiesSimplePointerAssignment(Type left, Type right) {
+    checksAssignment(left, right) and
+    simplePointerAssignmentImpl(getLvalueConverted(left), right)
+  }
+
+  private predicate satisfiedWhenTypesCompatible(Type left, Type right, Type checkA, Type checkB) {
+    interestedInTypes(left, right) and
+    exists(Type leftBase, Type rightBase |
+      // The left operand has atomic, qualified, or unqualified pointer type:
+      leftBase = left.stripTopLevelSpecifiers().(PointerType).getBaseType() and
+      rightBase = right.stripTopLevelSpecifiers().(PointerType).getBaseType() and
+      (
+        // and both operands are pointers to qualified or unqualified versions of compatible types:
+        checkA = leftBase.stripTopLevelSpecifiers() and
+        checkB = rightBase.stripTopLevelSpecifiers()
+      ) and
+      // and the type pointed to by the left has all the qualifiers of the type pointed to by the
+      // right:
+      forall(Specifier s | s = rightBase.getASpecifier() | s = leftBase.getASpecifier())
+    )
+  }
+
+  predicate interestedInTypes(Type left, Type right) {
+    exists(Type unconverted |
+      left = getLvalueConverted(unconverted) and
+      checksAssignment(unconverted, right)
+    )
+  }
+
+  predicate checksCompatibility(Type left, Type right) {
+    // Check if the types are compatible
+    exists(Type assignA, Type assignB |
+      checksAssignment(assignA, assignB) and
+      satisfiedWhenTypesCompatible(assignA, assignB, left, right)
+    )
+  }
+
+  /**
+   * Implementation of 6.5.16.1 for a pair of pointer types, that assumes lvalue conversion has been
+   * performed on the left operand.
+   */
+  bindingset[left, right]
+  private predicate simplePointerAssignmentImpl(Type left, Type right) {
+    exists(Type checkA, Type checkB |
+      satisfiedWhenTypesCompatible(left, right, checkA, checkB) and
+      TypeEquivalence<TypesCompatibleConfig, checksCompatibility/2>::equalTypes(checkA, checkB)
+    )
+    or
+    exists(Type leftBase, Type rightBase |
+      // The left operand has atomic, qualified, or unqualified pointer type:
+      leftBase = left.stripTopLevelSpecifiers().(PointerType).getBaseType() and
+      rightBase = right.stripTopLevelSpecifiers().(PointerType).getBaseType() and
+      // or one operand is a pointer to a qualified or unqualified version of void
+      [leftBase, rightBase].stripTopLevelSpecifiers() instanceof VoidType and
+      // and the type pointed to by the left has all the qualifiers of the type pointed to by the
+      // right:
+      forall(Specifier s | s = rightBase.getASpecifier() | s = leftBase.getASpecifier())
+    )
+  }
+}
diff --git a/cpp/common/src/codingstandards/cpp/TrivialType.qll b/cpp/common/src/codingstandards/cpp/types/TrivialType.qll
similarity index 100%
rename from cpp/common/src/codingstandards/cpp/TrivialType.qll
rename to cpp/common/src/codingstandards/cpp/types/TrivialType.qll
diff --git a/cpp/common/src/codingstandards/cpp/types/Type.qll b/cpp/common/src/codingstandards/cpp/types/Type.qll
new file mode 100644
index 0000000000..42d77b8055
--- /dev/null
+++ b/cpp/common/src/codingstandards/cpp/types/Type.qll
@@ -0,0 +1,96 @@
+/**
+ * A module for representing different `Type`s.
+ */
+
+import cpp
+
+/**
+ * A fundamental type, as defined by `[basic.fundamental]`.
+ */
+class FundamentalType extends BuiltInType {
+  FundamentalType() {
+    // A fundamental type is any `BuiltInType` except types indicating errors during extraction, or
+    // "unknown" types inserted into uninstantiated templates
+    not this instanceof ErroneousType and
+    not this instanceof UnknownType
+  }
+}
+
+/**
+ * A type that is incomplete.
+ */
+class IncompleteType extends Class {
+  IncompleteType() { not hasDefinition() }
+}
+
+/**
+ * A type that implements the BitmaskType trait.
+ * https://en.cppreference.com/w/cpp/named_req/BitmaskType
+ */
+abstract class BitmaskType extends Type { }
+
+/**
+ * Holds if `enum` implements required overload `overload` to implement
+ * the BitmaskType trait.
+ */
+private predicate isRequiredEnumOverload(Enum enum, Function overload) {
+  overload.getName().regexpMatch("operator([&|^~]|&=|\\|=)") and
+  forex(Parameter p | p = overload.getAParameter() |
+    (
+      p.getType() = enum
+      or
+      p.getType().(ReferenceType).getBaseType() = enum
+    )
+  )
+}
+
+private class EnumBitmaskType extends BitmaskType, Enum {
+  EnumBitmaskType() {
+    // Implements all the required overload
+    count(Function overload | isRequiredEnumOverload(this, overload)) = 6
+  }
+}
+
+/**
+ * A type without `const` and `volatile` specifiers.
+ */
+Type stripSpecifiers(Type type) {
+  if type instanceof SpecifiedType
+  then result = stripSpecifiers(type.(SpecifiedType).getBaseType())
+  else result = type
+}
+
+signature class PossiblySpecifiedBaseType extends Type;
+
+/**
+ * This module defines a class `Type` which holds for types `T` and `const/volatile T` etc.
+ *
+ * Similar to `getUnspecifiedType()`, but does not resolve typedefs. Useful for matching
+ * potentially qualified versions of standard typedef types, such as `const mtx_t`.
+ *
+ * Example usage: `someType.(PossiblySpecified<PointerType>::Type).strip()`
+ */
+module PossiblySpecified<PossiblySpecifiedBaseType BaseType> {
+  import cpp as cpp
+
+  final class CppType = cpp::Type;
+
+  class Type extends CppType {
+    BaseType baseType;
+
+    Type() { baseType = stripSpecifiers(this) }
+
+    BaseType strip() { result = baseType }
+  }
+}
+
+/**
+ * Get the precision of an integral type, where precision is defined as the number of bits
+ * that can be used to represent the numeric value.
+ * https://wiki.sei.cmu.edu/confluence/display/c/INT35-C.+Use+correct+integer+precisions
+ */
+int getPrecision(IntegralType type) {
+  type.isExplicitlyUnsigned() and result = type.getSize() * 8
+  or
+  type.isExplicitlySigned() and result = type.getSize() * 8 - 1
+}
diff --git a/cpp/common/src/codingstandards/cpp/TypeUses.qll b/cpp/common/src/codingstandards/cpp/types/Uses.qll
similarity index 100%
rename from cpp/common/src/codingstandards/cpp/TypeUses.qll
rename to cpp/common/src/codingstandards/cpp/types/Uses.qll
diff --git a/cpp/common/src/codingstandards/cpp/VariablyModifiedTypes.qll b/cpp/common/src/codingstandards/cpp/types/VariablyModifiedTypes.qll
similarity index 100%
rename from cpp/common/src/codingstandards/cpp/VariablyModifiedTypes.qll
rename to cpp/common/src/codingstandards/cpp/types/VariablyModifiedTypes.qll
diff --git a/cpp/common/src/qlpack.yml b/cpp/common/src/qlpack.yml
index 3912f3531f..8b60314b91 100644
--- a/cpp/common/src/qlpack.yml
+++ b/cpp/common/src/qlpack.yml
@@ -1,7 +1,7 @@
 name: codeql/common-cpp-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 license: MIT
 dependencies:
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
 dataExtensions:
 - ext/*.model.yml
diff --git a/cpp/common/test/codeql-pack.lock.yml b/cpp/common/test/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/common/test/codeql-pack.lock.yml
+++ b/cpp/common/test/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/common/test/deviations/deviation_permits_basic_test/UnusedReturnValue.ql b/cpp/common/test/deviations/deviation_permits_basic_test/UnusedReturnValue.ql
index 2517965fc1..469a7f7f73 100644
--- a/cpp/common/test/deviations/deviation_permits_basic_test/UnusedReturnValue.ql
+++ b/cpp/common/test/deviations/deviation_permits_basic_test/UnusedReturnValue.ql
@@ -16,7 +16,6 @@
 
 import cpp
 import codingstandards.cpp.CodingStandards
-import codingstandards.cpp.dataflow.DataFlow
 import codingstandards.cpp.exclusions.cpp.RuleMetadata
 
 /* This is a copy of an AUTOSAR rule, which we are using for testing purposes. */
diff --git a/cpp/common/test/deviations/deviations_basic_test/ListDeviationRecords.expected b/cpp/common/test/deviations/deviations_basic_test/ListDeviationRecords.expected
index 3a095d8fb9..5115cc8a70 100644
--- a/cpp/common/test/deviations/deviations_basic_test/ListDeviationRecords.expected
+++ b/cpp/common/test/deviations/deviations_basic_test/ListDeviationRecords.expected
@@ -1,3 +1,3 @@
-| A0-1-1 | cpp/autosar/useless-assignment | Applies to the following file paths: deviations/deviations_basic_test |  | This useless assignment is required. |  |  |
-| A0-1-2 | cpp/autosar/unused-return-value | Applies to the following file paths: deviations/deviations_basic_test/nested/nested1,deviations/deviations_basic_test/nested/nested2 |  | Unused return value. |  |  |
+| A0-1-1 | cpp/autosar/useless-assignment | Applies to the following file paths: (root) |  | This useless assignment is required. |  |  |
+| A0-1-2 | cpp/autosar/unused-return-value | Applies to the following file paths: nested/nested1,nested/nested2 |  | Unused return value. |  |  |
 | A0-4-2 | cpp/autosar/type-long-double-used | Identified by the use of the code-identifier: a-0-4-2-deviation |  | long double is required for interaction with third-party libraries. |  |  |
diff --git a/cpp/common/test/deviations/deviations_basic_test/TypeLongDoubleUsed.expected b/cpp/common/test/deviations/deviations_basic_test/TypeLongDoubleUsed.expected
index 7b78d54892..afc613642a 100644
--- a/cpp/common/test/deviations/deviations_basic_test/TypeLongDoubleUsed.expected
+++ b/cpp/common/test/deviations/deviations_basic_test/TypeLongDoubleUsed.expected
@@ -1 +1,14 @@
+| attribute_syntax.cpp:6:15:6:17 | dd1 | Use of long double type. |
+| attribute_syntax.cpp:21:15:21:17 | d10 | Use of long double type. |
+| attribute_syntax.cpp:29:15:29:17 | d14 | Use of long double type. |
+| attribute_syntax.cpp:34:20:34:22 | d16 | Use of long double type. |
+| attribute_syntax.cpp:55:15:55:16 | d1 | Use of long double type. |
+| attribute_syntax.cpp:57:17:57:18 | d2 | Use of long double type. |
+| attribute_syntax.cpp:60:17:60:18 | d3 | Use of long double type. |
 | main.cpp:13:15:13:16 | d1 | Use of long double type. |
+| main.cpp:18:15:18:16 | d4 | Use of long double type. |
+| main.cpp:21:15:21:16 | d6 | Use of long double type. |
+| main.cpp:30:15:30:17 | d10 | Use of long double type. |
+| main.cpp:38:15:38:17 | d14 | Use of long double type. |
+| main.cpp:42:15:42:17 | d15 | Use of long double type. |
+| main.cpp:43:113:43:115 | d18 | Use of long double type. |
diff --git a/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.expected b/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.expected
index 7cc5d2e1ab..fc7af4b197 100644
--- a/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.expected
+++ b/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.expected
@@ -1,3 +1,17 @@
+| attribute_syntax.cpp:5:3:5:6 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:16:5:16:8 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:18:5:18:8 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:24:5:24:8 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:26:5:26:8 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:30:3:30:6 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:42:3:42:6 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:49:5:49:8 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
+| attribute_syntax.cpp:61:5:61:8 | call to getZ | Return value from call to $@ is unused. | attribute_syntax.cpp:1:5:1:8 | getZ | getZ |
 | main.cpp:12:3:12:6 | call to getX | Return value from call to $@ is unused. | main.cpp:8:5:8:8 | getX | getX |
+| main.cpp:25:3:25:6 | call to getX | Return value from call to $@ is unused. | main.cpp:8:5:8:8 | getX | getX |
+| main.cpp:27:3:27:6 | call to getX | Return value from call to $@ is unused. | main.cpp:8:5:8:8 | getX | getX |
+| main.cpp:33:3:33:6 | call to getX | Return value from call to $@ is unused. | main.cpp:8:5:8:8 | getX | getX |
+| main.cpp:35:3:35:6 | call to getX | Return value from call to $@ is unused. | main.cpp:8:5:8:8 | getX | getX |
+| main.cpp:39:3:39:6 | call to getX | Return value from call to $@ is unused. | main.cpp:8:5:8:8 | getX | getX |
 | nested/nested3/test3.h:5:3:5:7 | call to getZ3 | Return value from call to $@ is unused. | nested/nested3/test3.h:1:5:1:9 | getZ3 | getZ3 |
 | nested/test.h:5:3:5:6 | call to getY | Return value from call to $@ is unused. | nested/test.h:1:5:1:8 | getY | getY |
diff --git a/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.ql b/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.ql
index 2517965fc1..469a7f7f73 100644
--- a/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.ql
+++ b/cpp/common/test/deviations/deviations_basic_test/UnusedReturnValue.ql
@@ -16,7 +16,6 @@
 
 import cpp
 import codingstandards.cpp.CodingStandards
-import codingstandards.cpp.dataflow.DataFlow
 import codingstandards.cpp.exclusions.cpp.RuleMetadata
 
 /* This is a copy of an AUTOSAR rule, which we are using for testing purposes. */
diff --git a/cpp/common/test/deviations/deviations_basic_test/attribute_syntax.cpp b/cpp/common/test/deviations/deviations_basic_test/attribute_syntax.cpp
new file mode 100644
index 0000000000..e363de55af
--- /dev/null
+++ b/cpp/common/test/deviations/deviations_basic_test/attribute_syntax.cpp
@@ -0,0 +1,76 @@
+int getZ() { return 5; }
+
+int alt() {
+  int x = 0;       // COMPLIANT[DEVIATED]
+  getZ();          // NON_COMPLIANT
+  long double dd1; // NON_COMPLIANT (A0-4-2)
+
+  long double [[codeql::autosar_deviation(
+      "a-0-4-2-deviation")]] dd3; // COMPLIANT[DEVIATED]
+
+  [[codeql::autosar_deviation(
+      "a-0-4-2-deviation")]] long double dd4; // COMPLIANT[DEVIATED]
+
+  [[codeql::autosar_deviation("a-0-4-2-deviation")]] {
+    long double d7; // COMPLIANT[DEVIATED]
+    getZ();         // NON_COMPLIANT (A0-1-2)
+    long double d8; // COMPLIANT[DEVIATED]
+    getZ();         // NON_COMPLIANT (A0-1-2)
+    long double d9; // COMPLIANT[DEVIATED]
+  }
+  long double d10; // NON_COMPLIANT (A0-4-2)
+  [[codeql::autosar_deviation("a-0-4-2-deviation")]] {
+    long double d11; // COMPLIANT[DEVIATED]
+    getZ();          // NON_COMPLIANT (A0-1-2)
+    long double d12; // COMPLIANT[DEVIATED]
+    getZ();          // NON_COMPLIANT (A0-1-2)
+    long double d13; // COMPLIANT[DEVIATED]
+  }
+  long double d14; // NON_COMPLIANT (A0-4-2)
+  getZ();          // NON_COMPLIANT (A0-1-2)
+  [[codeql::autosar_deviation("a-0-4-2-deviation")]] for (long double d15 = 0.0;
+                                                          true;) {
+  }                                    // COMPLIANT[DEVIATED]
+  for (long double d16 = 0.0; true;) { // NON_COMPLIANT (A0-4-2)
+  }
+  return 0;
+}
+
+[[codeql::autosar_deviation("a-0-4-2-deviation")]] int
+test_function_deviation() {
+  int x = 0;       // COMPLIANT[DEVIATED]
+  getZ();          // NON_COMPLIANT
+  long double dd1; // COMPLIANT[DEVIATED]
+}
+
+[[codeql::autosar_deviation("a-0-4-2-deviation")]] void test_lambdas() {
+  auto l = []() {
+    long double d4; // COMPLIANT[DEVIATED]
+    getZ();         // NON_COMPLIANT
+  };
+}
+
+// Attributes are not supported on a class level at the moment
+[[codeql::autosar_deviation("a-0-4-2-deviation")]] class ClassA {
+  long double d1; // COMPLIANT[DEVIATED - false positive]
+  class ClassNested {
+    long double d2; // COMPLIANT[DEVIATED - false positive]
+  };
+  void test() {
+    long double d3; // COMPLIANT[DEVIATED - false positive]
+    getZ();         // NON_COMPLIANT
+  }
+};
+
+// static_assert, templates, noexcept, multiple declarations
+
+// Namespaces not currently supported by attributes
+// [[codeql::autosar_deviation("a-0-4-2-deviation")]] namespace NS {
+// long double d1; // COMPLIANT[DEVIATED]
+// class ClassA {
+//   long double d1; // COMPLIANT[DEVIATED]
+// };
+// void test() {
+//   long double d1; // COMPLIANT[DEVIATED]
+// }
+// }
\ No newline at end of file
diff --git a/cpp/common/test/deviations/deviations_basic_test/main.cpp b/cpp/common/test/deviations/deviations_basic_test/main.cpp
index 0b302ea1f2..17126364f4 100644
--- a/cpp/common/test/deviations/deviations_basic_test/main.cpp
+++ b/cpp/common/test/deviations/deviations_basic_test/main.cpp
@@ -12,5 +12,35 @@ int main(int argc, char **argv) {
   getX();         // NON_COMPLIANT
   long double d1; // NON_COMPLIANT (A0-4-2)
   long double d2; // a-0-4-2-deviation COMPLIANT[DEVIATED]
+
+  long double d3; // codeql::autosar_deviation(a-0-4-2-deviation)
+                  // COMPLIANT[DEVIATED]
+  long double d4; // NON_COMPLIANT (A0-4-2)
+  // codeql::autosar_deviation_next_line(a-0-4-2-deviation)
+  long double d5; // COMPLIANT[DEVIATED]
+  long double d6; // NON_COMPLIANT (A0-4-2)
+
+  // codeql::autosar_deviation_begin(a-0-4-2-deviation)
+  long double d7; // COMPLIANT[DEVIATED]
+  getX();         // NON_COMPLIANT (A0-1-2)
+  long double d8; // COMPLIANT[DEVIATED]
+  getX();         // NON_COMPLIANT (A0-1-2)
+  long double d9; // COMPLIANT[DEVIATED]
+  // codeql::autosar_deviation_end(a-0-4-2-deviation)
+  long double d10; // NON_COMPLIANT (A0-4-2)
+  // codeql::autosar_deviation_begin(a-0-4-2-deviation)
+  long double d11; // COMPLIANT[DEVIATED]
+  getX();          // NON_COMPLIANT (A0-1-2)
+  long double d12; // COMPLIANT[DEVIATED]
+  getX();          // NON_COMPLIANT (A0-1-2)
+  long double d13; // COMPLIANT[DEVIATED]
+  // codeql::autosar_deviation_end(a-0-4-2-deviation)
+  long double d14; // NON_COMPLIANT (A0-4-2)
+  getX();          // NON_COMPLIANT (A0-1-2)
+
+  // clang-format off
+  long double d15; /* NON_COMPLIANT*/ /* codeql::autosar_deviation_begin(a-0-4-2-deviation) */ long double d16; // COMPLIANT[DEVIATED]
+  long double d17; /* COMPLIANT[DEVIATED] */ /* codeql::autosar_deviation_end(a-0-4-2-deviation) */ long double d18; // NON_COMPLIANT
+  // clang-format on
   return 0;
 }
\ No newline at end of file
diff --git a/cpp/common/test/deviations/deviations_report_deviated/DeviationsSuppression.expected b/cpp/common/test/deviations/deviations_report_deviated/DeviationsSuppression.expected
index 50ceb35b9d..35fca84928 100644
--- a/cpp/common/test/deviations/deviations_report_deviated/DeviationsSuppression.expected
+++ b/cpp/common/test/deviations/deviations_report_deviated/DeviationsSuppression.expected
@@ -1,7 +1,12 @@
-| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/type-long-double-used] | lgtm[cpp/autosar/type-long-double-used] | main.cpp:12:1:12:58 | Deviation of cpp/autosar/type-long-double-used for comment // a-0-4-2-deviation COMPLIANT[DEVIATED]. |
+| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/type-long-double-used] | lgtm[cpp/autosar/type-long-double-used] | main.cpp:12:1:12:58 | Deviation of cpp/autosar/type-long-double-used applied to main.cpp Line 12 |
+| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/type-long-double-used] | lgtm[cpp/autosar/type-long-double-used] | main.cpp:14:1:14:65 | Deviation of cpp/autosar/type-long-double-used applied to main.cpp Line 14 |
+| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/type-long-double-used] | lgtm[cpp/autosar/type-long-double-used] | main.cpp:18:1:18:40 | Deviation of cpp/autosar/type-long-double-used applied to main.cpp Line 18 |
+| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/type-long-double-used] | lgtm[cpp/autosar/type-long-double-used] | main.cpp:21:3:27:53 | Deviation of cpp/autosar/type-long-double-used applied to main.cpp Line 21:3:27:53 |
+| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/type-long-double-used] | lgtm[cpp/autosar/type-long-double-used] | main.cpp:29:3:35:53 | Deviation of cpp/autosar/type-long-double-used applied to main.cpp Line 29:3:35:53 |
+| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/type-long-double-used] | lgtm[cpp/autosar/type-long-double-used] | main.cpp:40:39:41:99 | Deviation of cpp/autosar/type-long-double-used applied to main.cpp Line 40:39:41:99 |
 | file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/unused-return-value] | lgtm[cpp/autosar/unused-return-value] | nested/nested2/test2.h:1:1:6:1 | Deviation of cpp/autosar/unused-return-value for nested/nested2/test2.h. |
 | file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/useless-assignment] | lgtm[cpp/autosar/useless-assignment] | coding-standards.xml:1:1:17:19 | Deviation of cpp/autosar/useless-assignment for coding-standards.xml. |
-| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/useless-assignment] | lgtm[cpp/autosar/useless-assignment] | main.cpp:1:1:14:1 | Deviation of cpp/autosar/useless-assignment for main.cpp. |
+| file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/useless-assignment] | lgtm[cpp/autosar/useless-assignment] | main.cpp:1:1:44:1 | Deviation of cpp/autosar/useless-assignment for main.cpp. |
 | file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/useless-assignment] | lgtm[cpp/autosar/useless-assignment] | nested/coding-standards.xml:1:1:13:19 | Deviation of cpp/autosar/useless-assignment for nested/coding-standards.xml. |
 | file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/useless-assignment] | lgtm[cpp/autosar/useless-assignment] | nested/nested2/test2.h:1:1:6:1 | Deviation of cpp/autosar/useless-assignment for nested/nested2/test2.h. |
 | file://:0:0:0:0 | (no string representation) | // lgtm[cpp/autosar/useless-assignment] | lgtm[cpp/autosar/useless-assignment] | nested/test.h:1:1:6:1 | Deviation of cpp/autosar/useless-assignment for nested/test.h. |
diff --git a/cpp/common/test/deviations/deviations_report_deviated/TypeLongDoubleUsed.expected b/cpp/common/test/deviations/deviations_report_deviated/TypeLongDoubleUsed.expected
new file mode 100644
index 0000000000..e9099fa64a
--- /dev/null
+++ b/cpp/common/test/deviations/deviations_report_deviated/TypeLongDoubleUsed.expected
@@ -0,0 +1,18 @@
+| main.cpp:11:15:11:16 | d1 | Use of long double type. |
+| main.cpp:12:15:12:16 | d2 | Use of long double type. |
+| main.cpp:14:15:14:16 | d3 | Use of long double type. |
+| main.cpp:16:15:16:16 | d4 | Use of long double type. |
+| main.cpp:18:15:18:16 | d5 | Use of long double type. |
+| main.cpp:19:15:19:16 | d6 | Use of long double type. |
+| main.cpp:22:15:22:16 | d7 | Use of long double type. |
+| main.cpp:24:15:24:16 | d8 | Use of long double type. |
+| main.cpp:26:15:26:16 | d9 | Use of long double type. |
+| main.cpp:28:15:28:17 | d10 | Use of long double type. |
+| main.cpp:30:15:30:17 | d11 | Use of long double type. |
+| main.cpp:32:15:32:17 | d12 | Use of long double type. |
+| main.cpp:34:15:34:17 | d13 | Use of long double type. |
+| main.cpp:36:15:36:17 | d14 | Use of long double type. |
+| main.cpp:40:15:40:17 | d15 | Use of long double type. |
+| main.cpp:40:108:40:110 | d16 | Use of long double type. |
+| main.cpp:41:15:41:17 | d17 | Use of long double type. |
+| main.cpp:41:113:41:115 | d18 | Use of long double type. |
diff --git a/cpp/common/test/deviations/deviations_report_deviated/TypeLongDoubleUsed.ql b/cpp/common/test/deviations/deviations_report_deviated/TypeLongDoubleUsed.ql
new file mode 100644
index 0000000000..0ff7b93251
--- /dev/null
+++ b/cpp/common/test/deviations/deviations_report_deviated/TypeLongDoubleUsed.ql
@@ -0,0 +1,38 @@
+/**
+ * @id cpp/autosar/type-long-double-used
+ * @name A0-4-2: Type long double shall not be used
+ * @description The type long double has an implementation-defined width and therefore shall not be
+ *              used.
+ * @kind problem
+ * @precision very-high
+ * @problem.severity warning
+ * @tags external/autosar/id/a0-4-2
+ *       correctness
+ *       readability
+ *       external/autosar/allocated-target/implementation
+ *       external/autosar/enforcement/automated
+ *       external/autosar/obligation/required
+ */
+
+import cpp
+import codingstandards.cpp.CodingStandards
+import codingstandards.cpp.exclusions.cpp.RuleMetadata
+
+predicate isUsingLongDouble(ClassTemplateInstantiation c) {
+  c.getATemplateArgument() instanceof LongDoubleType or
+  isUsingLongDouble(c.getATemplateArgument())
+}
+
+from Variable v
+where
+  not isExcluded(v, BannedTypesPackage::typeLongDoubleUsedQuery()) and
+  (
+    v.getUnderlyingType() instanceof LongDoubleType and
+    not v.isFromTemplateInstantiation(_)
+    or
+    exists(ClassTemplateInstantiation c |
+      c = v.getType() and
+      isUsingLongDouble(c)
+    )
+  )
+select v, "Use of long double type."
diff --git a/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.expected b/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.expected
index 7b8860d5a3..ab75d81f6f 100644
--- a/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.expected
+++ b/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.expected
@@ -1,3 +1,8 @@
 | main.cpp:10:3:10:6 | call to getX | Return value from call to $@ is unused. | main.cpp:6:5:6:8 | getX | getX |
+| main.cpp:23:3:23:6 | call to getX | Return value from call to $@ is unused. | main.cpp:6:5:6:8 | getX | getX |
+| main.cpp:25:3:25:6 | call to getX | Return value from call to $@ is unused. | main.cpp:6:5:6:8 | getX | getX |
+| main.cpp:31:3:31:6 | call to getX | Return value from call to $@ is unused. | main.cpp:6:5:6:8 | getX | getX |
+| main.cpp:33:3:33:6 | call to getX | Return value from call to $@ is unused. | main.cpp:6:5:6:8 | getX | getX |
+| main.cpp:37:3:37:6 | call to getX | Return value from call to $@ is unused. | main.cpp:6:5:6:8 | getX | getX |
 | nested/nested2/test2.h:5:3:5:6 | call to getZ | Return value from call to $@ is unused. | nested/nested2/test2.h:1:5:1:8 | getZ | getZ |
 | nested/test.h:5:3:5:6 | call to getY | Return value from call to $@ is unused. | nested/test.h:1:5:1:8 | getY | getY |
diff --git a/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.ql b/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.ql
index 2517965fc1..469a7f7f73 100644
--- a/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.ql
+++ b/cpp/common/test/deviations/deviations_report_deviated/UnusedReturnValue.ql
@@ -16,7 +16,6 @@
 
 import cpp
 import codingstandards.cpp.CodingStandards
-import codingstandards.cpp.dataflow.DataFlow
 import codingstandards.cpp.exclusions.cpp.RuleMetadata
 
 /* This is a copy of an AUTOSAR rule, which we are using for testing purposes. */
diff --git a/cpp/common/test/deviations/deviations_report_deviated/main.cpp b/cpp/common/test/deviations/deviations_report_deviated/main.cpp
index c59dea5609..d2f58d9db1 100644
--- a/cpp/common/test/deviations/deviations_report_deviated/main.cpp
+++ b/cpp/common/test/deviations/deviations_report_deviated/main.cpp
@@ -10,5 +10,35 @@ int main(int argc, char **argv) {
   getX();         // NON_COMPLIANT
   long double d1; // NON_COMPLIANT (A0-4-2)
   long double d2; // a-0-4-2-deviation COMPLIANT[DEVIATED]
+
+  long double d3; // codeql::autosar_deviation(a-0-4-2-deviation)
+                  // COMPLIANT[DEVIATED]
+  long double d4; // NON_COMPLIANT (A0-4-2)
+  // codeql::autosar_deviation_next_line(a-0-4-2-deviation)
+  long double d5; // COMPLIANT[DEVIATED]
+  long double d6; // NON_COMPLIANT (A0-4-2)
+
+  // codeql::autosar_deviation_begin(a-0-4-2-deviation)
+  long double d7; // COMPLIANT[DEVIATED]
+  getX();         // NON_COMPLIANT (A0-1-2)
+  long double d8; // COMPLIANT[DEVIATED]
+  getX();         // NON_COMPLIANT (A0-1-2)
+  long double d9; // COMPLIANT[DEVIATED]
+  // codeql::autosar_deviation_end(a-0-4-2-deviation)
+  long double d10; // NON_COMPLIANT (A0-4-2)
+  // codeql::autosar_deviation_begin(a-0-4-2-deviation)
+  long double d11; // COMPLIANT[DEVIATED]
+  getX();          // NON_COMPLIANT (A0-1-2)
+  long double d12; // COMPLIANT[DEVIATED]
+  getX();          // NON_COMPLIANT (A0-1-2)
+  long double d13; // COMPLIANT[DEVIATED]
+  // codeql::autosar_deviation_end(a-0-4-2-deviation)
+  long double d14; // NON_COMPLIANT (A0-4-2)
+  getX();          // NON_COMPLIANT (A0-1-2)
+
+  // clang-format off
+  long double d15; /* NON_COMPLIANT*/ /* codeql::autosar_deviation_begin(a-0-4-2-deviation) */ long double d16; // COMPLIANT[DEVIATED]
+  long double d17; /* COMPLIANT[DEVIATED] */ /* codeql::autosar_deviation_end(a-0-4-2-deviation) */ long double d18; // NON_COMPLIANT
+  // clang-format on
   return 0;
 }
\ No newline at end of file
diff --git a/cpp/common/test/deviations/invalid_deviations/InvalidDeviationCodeIdentifier.expected b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationCodeIdentifier.expected
new file mode 100644
index 0000000000..1d7153bafd
--- /dev/null
+++ b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationCodeIdentifier.expected
@@ -0,0 +1,13 @@
+| invalidcodeidentifiers.cpp:1:1:1:45 | // codeql::misra_deviation(x) - invalid, no x | Deviation marker does not match an expected format, or references an unknown code identifier. |
+| invalidcodeidentifiers.cpp:2:1:2:47 | // codeql::autosar_deviation(x) - invalid, no x | Deviation marker does not match an expected format, or references an unknown code identifier. |
+| invalidcodeidentifiers.cpp:3:1:3:44 | // codeql::cert_deviation(x) - invalid, no x | Deviation marker does not match an expected format, or references an unknown code identifier. |
+| invalidcodeidentifiers.cpp:4:1:4:71 | // codeql::misra_deviation_next(a-0-4-2-deviation) - invalid, next_line | Deviation marker does not match an expected format, or references an unknown code identifier. |
+| invalidcodeidentifiers.cpp:5:1:5:73 | // codeql::autosar_deviation_next(a-0-4-2-deviation) - invalid, next_line | Deviation marker does not match an expected format, or references an unknown code identifier. |
+| invalidcodeidentifiers.cpp:6:1:6:70 | // codeql::cert_deviation_next(a-0-4-2-deviation) - invalid, next_line | Deviation marker does not match an expected format, or references an unknown code identifier. |
+| invalidcodeidentifiers.cpp:14:1:14:74 | // codeql::misra_deviation_end(a-0-4-2-deviation) - invalid, unmatched end | Deviation end block is unmatched. |
+| invalidcodeidentifiers.cpp:15:1:15:76 | // codeql::autosar_deviation_end(a-0-4-2-deviation) - invalid, unmatched end | Deviation end block is unmatched. |
+| invalidcodeidentifiers.cpp:16:1:16:73 | // codeql::cert_deviation_end(a-0-4-2-deviation) - invalid, unmatched end | Deviation end block is unmatched. |
+| invalidcodeidentifiers.cpp:17:1:17:78 | // codeql::misra_deviation_begin(a-0-4-2-deviation) - invalid, unmatched begin | Deviation start block is unmatched. |
+| invalidcodeidentifiers.cpp:18:1:18:80 | // codeql::autosar_deviation_begin(a-0-4-2-deviation) - invalid, unmatched begin | Deviation start block is unmatched. |
+| invalidcodeidentifiers.cpp:19:1:19:77 | // codeql::cert_deviation_begin(a-0-4-2-deviation) - invalid, unmatched begin | Deviation start block is unmatched. |
+| invalidcodeidentifiers.cpp:21:3:21:25 | misra_deviation | Deviation attribute references unknown code identifier x. |
diff --git a/cpp/common/test/deviations/invalid_deviations/InvalidDeviationCodeIdentifier.qlref b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationCodeIdentifier.qlref
new file mode 100644
index 0000000000..c70989966f
--- /dev/null
+++ b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationCodeIdentifier.qlref
@@ -0,0 +1 @@
+codingstandards/cpp/deviations/InvalidDeviationCodeIdentifier.ql
\ No newline at end of file
diff --git a/cpp/common/test/deviations/invalid_deviations/InvalidDeviationPermits.expected b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationPermits.expected
index 433dc8a342..4378fdf11d 100644
--- a/cpp/common/test/deviations/invalid_deviations/InvalidDeviationPermits.expected
+++ b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationPermits.expected
@@ -1,2 +1,2 @@
-| coding-standards.xml:100:7:103:33 | deviation-permits-entry | deviations/invalid_deviations/coding-standards.xml: Deviation permit does not specify a permit identifier. |
-| coding-standards.xml:104:7:107:33 | deviation-permits-entry | deviations/invalid_deviations/coding-standards.xml: Deviation permit specifies unknown property `invalid-property`. |
+| coding-standards.xml:105:7:108:33 | deviation-permits-entry | coding-standards.xml: Deviation permit does not specify a permit identifier. |
+| coding-standards.xml:109:7:112:33 | deviation-permits-entry | coding-standards.xml: Deviation permit specifies unknown property `invalid-property`. |
diff --git a/cpp/common/test/deviations/invalid_deviations/InvalidDeviationRecords.expected b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationRecords.expected
index c4f66eeaf5..2cd438c5c6 100644
--- a/cpp/common/test/deviations/invalid_deviations/InvalidDeviationRecords.expected
+++ b/cpp/common/test/deviations/invalid_deviations/InvalidDeviationRecords.expected
@@ -1,14 +1,14 @@
-| coding-standards.xml:5:7:5:27 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: No rule-id and query-id specified for this deviation record. |
-| coding-standards.xml:6:7:8:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: The rule-id `bad rule id` for this deviation matches none of the available queries. |
-| coding-standards.xml:9:7:11:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A query-id of `bad rule id` is specified for this deviation, but not rule-id is specified. |
-| coding-standards.xml:15:7:17:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A query-id of `cpp/autosar/useless-assignment` is specified for this deviation, but not rule-id is specified. |
-| coding-standards.xml:22:7:26:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A deviation `raised-by` is specified without providing an `approved-by`. |
-| coding-standards.xml:22:7:26:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A deviation `raised-by` is specified without providing both a `name` and `date`. |
-| coding-standards.xml:27:7:33:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A deviation `raised-by` is specified without providing an `approved-by`. |
-| coding-standards.xml:27:7:33:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A deviation `raised-by` is specified without providing both a `name` and `date`. |
-| coding-standards.xml:34:7:41:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A deviation `raised-by` is specified without providing an `approved-by`. |
-| coding-standards.xml:42:7:50:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A deviation `approved-by` is specified without providing both a `name` and `date`. |
-| coding-standards.xml:51:7:61:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: A deviation `approved-by` is specified without providing both a `name` and `date`. |
-| coding-standards.xml:74:7:78:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: There is no deviation permit with id `non-existing-permit`. |
-| coding-standards.xml:79:7:81:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: No rule-id and query-id specified for this deviation record. |
-| coding-standards.xml:85:7:88:26 | deviations-entry | deviations/invalid_deviations/coding-standards.xml: The deviation is applied to a query with the rule category 'mandatory' that does not permit a deviation. |
+| coding-standards.xml:5:7:5:27 | deviations-entry | coding-standards.xml: No rule-id and query-id specified for this deviation record. |
+| coding-standards.xml:6:7:8:26 | deviations-entry | coding-standards.xml: The rule-id `bad rule id` for this deviation matches none of the available queries. |
+| coding-standards.xml:9:7:11:26 | deviations-entry | coding-standards.xml: A query-id of `bad rule id` is specified for this deviation, but not rule-id is specified. |
+| coding-standards.xml:15:7:17:26 | deviations-entry | coding-standards.xml: A query-id of `cpp/autosar/useless-assignment` is specified for this deviation, but not rule-id is specified. |
+| coding-standards.xml:22:7:26:26 | deviations-entry | coding-standards.xml: A deviation `raised-by` is specified without providing an `approved-by`. |
+| coding-standards.xml:22:7:26:26 | deviations-entry | coding-standards.xml: A deviation `raised-by` is specified without providing both a `name` and `date`. |
+| coding-standards.xml:27:7:33:26 | deviations-entry | coding-standards.xml: A deviation `raised-by` is specified without providing an `approved-by`. |
+| coding-standards.xml:27:7:33:26 | deviations-entry | coding-standards.xml: A deviation `raised-by` is specified without providing both a `name` and `date`. |
+| coding-standards.xml:34:7:41:26 | deviations-entry | coding-standards.xml: A deviation `raised-by` is specified without providing an `approved-by`. |
+| coding-standards.xml:42:7:50:26 | deviations-entry | coding-standards.xml: A deviation `approved-by` is specified without providing both a `name` and `date`. |
+| coding-standards.xml:51:7:61:26 | deviations-entry | coding-standards.xml: A deviation `approved-by` is specified without providing both a `name` and `date`. |
+| coding-standards.xml:74:7:78:26 | deviations-entry | coding-standards.xml: There is no deviation permit with id `non-existing-permit`. |
+| coding-standards.xml:79:7:81:26 | deviations-entry | coding-standards.xml: No rule-id and query-id specified for this deviation record. |
+| coding-standards.xml:85:7:88:26 | deviations-entry | coding-standards.xml: The deviation is applied to a query with the rule category 'mandatory' that does not permit a deviation. |
diff --git a/cpp/common/test/deviations/invalid_deviations/coding-standards.xml b/cpp/common/test/deviations/invalid_deviations/coding-standards.xml
index 179227a13d..ff0d69eaec 100644
--- a/cpp/common/test/deviations/invalid_deviations/coding-standards.xml
+++ b/cpp/common/test/deviations/invalid_deviations/coding-standards.xml
@@ -83,8 +83,13 @@
          <permit-id>DP2</permit-id>
       </deviations-entry>
       <deviations-entry>
-         <rule-id>RULE-13-6</rule-id>
-         <query-id>c/misra/sizeof-operand-with-side-effect</query-id>
+         <rule-id>RULE-9-1</rule-id>
+         <query-id>c/misra/object-with-auto-storage-duration-read-before-init</query-id>
+      </deviations-entry>
+      <deviations-entry>
+         <rule-id>A0-4-2</rule-id>
+         <justification>long double is required for interaction with third-party libraries.</justification>
+         <code-identifier>a-0-4-2-deviation</code-identifier>
       </deviations-entry>
    </deviations>
    <deviation-permits>
diff --git a/cpp/common/test/deviations/invalid_deviations/coding-standards.yml b/cpp/common/test/deviations/invalid_deviations/coding-standards.yml
index 7b12c7a8c2..ceea31c460 100644
--- a/cpp/common/test/deviations/invalid_deviations/coding-standards.yml
+++ b/cpp/common/test/deviations/invalid_deviations/coding-standards.yml
@@ -44,8 +44,11 @@ deviations:
     permit-id: non-existing-permit
   - permit-id: DP1
   - permit-id: DP2
-  - rule-id: RULE-13-6
-    query-id: c/misra/sizeof-operand-with-side-effect
+  - rule-id: RULE-9-1
+    query-id: c/misra/object-with-auto-storage-duration-read-before-init
+  - rule-id: A0-4-2
+    justification: long double is required for interaction with third-party libraries.
+    code-identifier: a-0-4-2-deviation
 deviation-permits:
   - permit-id: DP1
     justification: foo bar baz
diff --git a/cpp/common/test/deviations/invalid_deviations/dummy.cpp b/cpp/common/test/deviations/invalid_deviations/dummy.cpp
deleted file mode 100644
index 4a3cb36e40..0000000000
--- a/cpp/common/test/deviations/invalid_deviations/dummy.cpp
+++ /dev/null
@@ -1 +0,0 @@
-// Deliberately blank
\ No newline at end of file
diff --git a/cpp/common/test/deviations/invalid_deviations/invalidcodeidentifiers.cpp b/cpp/common/test/deviations/invalid_deviations/invalidcodeidentifiers.cpp
new file mode 100644
index 0000000000..a4da098dcb
--- /dev/null
+++ b/cpp/common/test/deviations/invalid_deviations/invalidcodeidentifiers.cpp
@@ -0,0 +1,24 @@
+// codeql::misra_deviation(x) - invalid, no x
+// codeql::autosar_deviation(x) - invalid, no x
+// codeql::cert_deviation(x) - invalid, no x
+// codeql::misra_deviation_next(a-0-4-2-deviation) - invalid, next_line
+// codeql::autosar_deviation_next(a-0-4-2-deviation) - invalid, next_line
+// codeql::cert_deviation_next(a-0-4-2-deviation) - invalid, next_line
+
+// codeql::misra_deviation_begin(a-0-4-2-deviation)
+// codeql::autosar_deviation_begin(a-0-4-2-deviation)
+// codeql::cert_deviation_begin(a-0-4-2-deviation)
+// codeql::misra_deviation_end(a-0-4-2-deviation)
+// codeql::autosar_deviation_end(a-0-4-2-deviation)
+// codeql::cert_deviation_end(a-0-4-2-deviation)
+// codeql::misra_deviation_end(a-0-4-2-deviation) - invalid, unmatched end
+// codeql::autosar_deviation_end(a-0-4-2-deviation) - invalid, unmatched end
+// codeql::cert_deviation_end(a-0-4-2-deviation) - invalid, unmatched end
+// codeql::misra_deviation_begin(a-0-4-2-deviation) - invalid, unmatched begin
+// codeql::autosar_deviation_begin(a-0-4-2-deviation) - invalid, unmatched begin
+// codeql::cert_deviation_begin(a-0-4-2-deviation) - invalid, unmatched begin
+
+[[codeql::misra_deviation("x")]] // invalid
+void test() {}
+
+[[codeql::autosar_deviation("a-0-4-2-deviation")]] void test2() {}
diff --git a/cpp/common/test/guideline_recategorizations/DisappliedQuery.ql b/cpp/common/test/guideline_recategorizations/DisappliedQuery.ql
index 0254eca9bd..aa2caa8ad2 100644
--- a/cpp/common/test/guideline_recategorizations/DisappliedQuery.ql
+++ b/cpp/common/test/guideline_recategorizations/DisappliedQuery.ql
@@ -10,14 +10,14 @@
 
 import cpp
 import codingstandards.cpp.CodingStandards
-import codingstandards.cpp.TypeUses
+import codingstandards.cpp.types.Uses
 import codingstandards.cpp.exclusions.cpp.RuleMetadata
 
 from UserType ut, string reason
 where
   isExcluded(ut, DeadCodePackage::unusedTypeDeclarationsQuery(), reason) and
   exists(ut.getFile()) and
-  not ut instanceof TemplateParameter and
+  not ut instanceof TypeTemplateParameter and
   not ut instanceof ProxyClass and
   not exists(getATypeUse(ut)) and
   not ut.isFromUninstantiatedTemplate(_)
diff --git a/cpp/common/test/guideline_recategorizations/InvalidGuidelineRecategorizations.expected b/cpp/common/test/guideline_recategorizations/InvalidGuidelineRecategorizations.expected
index 971c70a9b6..6d9c892eba 100644
--- a/cpp/common/test/guideline_recategorizations/InvalidGuidelineRecategorizations.expected
+++ b/cpp/common/test/guideline_recategorizations/InvalidGuidelineRecategorizations.expected
@@ -1,5 +1,5 @@
-| invalid/coding-standards.xml:5:7:8:43 | guideline-recategorizations-entry | guideline_recategorizations/invalid/coding-standards.xml: 'Invalid recategorization from 'required' to 'advisory'.' for rule A0-1-1. |
-| invalid/coding-standards.xml:9:7:12:43 | guideline-recategorizations-entry | guideline_recategorizations/invalid/coding-standards.xml: 'Invalid recategorization from 'required' to 'disapplied'.' for rule A0-1-2. |
-| invalid/coding-standards.xml:13:7:16:43 | guideline-recategorizations-entry | guideline_recategorizations/invalid/coding-standards.xml: 'Unknown rule id 'A1-4-3'.' for rule A1-4-3. |
-| invalid/coding-standards.xml:17:7:20:43 | guideline-recategorizations-entry | guideline_recategorizations/invalid/coding-standards.xml: 'Invalid recategorization from 'mandatory' to 'required'.' for rule RULE-13-6. |
-| invalid/coding-standards.xml:21:7:24:43 | guideline-recategorizations-entry | guideline_recategorizations/invalid/coding-standards.xml: 'Invalid recategorization from 'rule' to 'required'.' for rule CON50-CPP. |
+| invalid/coding-standards.xml:5:7:8:43 | guideline-recategorizations-entry | invalid/coding-standards.xml: 'Invalid recategorization from 'required' to 'advisory'.' for rule A0-1-1. |
+| invalid/coding-standards.xml:9:7:12:43 | guideline-recategorizations-entry | invalid/coding-standards.xml: 'Invalid recategorization from 'required' to 'disapplied'.' for rule A0-1-2. |
+| invalid/coding-standards.xml:13:7:16:43 | guideline-recategorizations-entry | invalid/coding-standards.xml: 'Unknown rule id 'A1-4-3'.' for rule A1-4-3. |
+| invalid/coding-standards.xml:17:7:20:43 | guideline-recategorizations-entry | invalid/coding-standards.xml: 'Invalid recategorization from 'mandatory' to 'required'.' for rule RULE-9-1. |
+| invalid/coding-standards.xml:21:7:24:43 | guideline-recategorizations-entry | invalid/coding-standards.xml: 'Invalid recategorization from 'rule' to 'required'.' for rule CON50-CPP. |
\ No newline at end of file
diff --git a/cpp/common/test/guideline_recategorizations/ListGuidelineRecategorizations.expected b/cpp/common/test/guideline_recategorizations/ListGuidelineRecategorizations.expected
index 0a8aeb9ba1..8e6a397620 100644
--- a/cpp/common/test/guideline_recategorizations/ListGuidelineRecategorizations.expected
+++ b/cpp/common/test/guideline_recategorizations/ListGuidelineRecategorizations.expected
@@ -5,4 +5,4 @@
 | A10-4-1 | advisory | required |
 | A11-0-1 | advisory | mandatory |
 | CON50-CPP | rule | required |
-| RULE-13-6 | mandatory | required |
+| RULE-9-1 | mandatory | required |
diff --git a/cpp/common/test/guideline_recategorizations/invalid/coding-standards.xml b/cpp/common/test/guideline_recategorizations/invalid/coding-standards.xml
index d89f27050b..dfb7b6f13c 100644
--- a/cpp/common/test/guideline_recategorizations/invalid/coding-standards.xml
+++ b/cpp/common/test/guideline_recategorizations/invalid/coding-standards.xml
@@ -15,7 +15,7 @@
          <category>mandatory</category>
       </guideline-recategorizations-entry>
       <guideline-recategorizations-entry>
-         <rule-id>RULE-13-6</rule-id>
+         <rule-id>RULE-9-1</rule-id>
          <category>required</category>
       </guideline-recategorizations-entry>
       <guideline-recategorizations-entry>
diff --git a/cpp/common/test/guideline_recategorizations/invalid/coding-standards.yml b/cpp/common/test/guideline_recategorizations/invalid/coding-standards.yml
index 89e562c05c..cd6abbf120 100644
--- a/cpp/common/test/guideline_recategorizations/invalid/coding-standards.yml
+++ b/cpp/common/test/guideline_recategorizations/invalid/coding-standards.yml
@@ -5,7 +5,7 @@ guideline-recategorizations:
     category: "disapplied"
   - rule-id: "A1-4-3"
     category: "mandatory"
-  - rule-id: "RULE-13-6"
+  - rule-id: "RULE-9-1"
     category: "required"
   - rule-id: "CON50-CPP"
     category: "required"
diff --git a/cpp/common/test/includes/standard-library/array b/cpp/common/test/includes/standard-library/array
index ca4d3291ad..9465ccba97 100644
--- a/cpp/common/test/includes/standard-library/array
+++ b/cpp/common/test/includes/standard-library/array
@@ -8,8 +8,8 @@ namespace std {
 template <class T, size_t N> struct array {
   typedef T &reference;
   typedef const T &const_reference;
-  typedef std::iterator<random_access_iterator_tag, T> iterator;
-  typedef std::iterator<random_access_iterator_tag, T> const_iterator;
+  typedef __iterator<T> iterator;
+  typedef __iterator<const T> const_iterator;
   typedef size_t size_type;
 
   typedef ptrdiff_t difference_type;
diff --git a/cpp/common/test/includes/standard-library/cmath b/cpp/common/test/includes/standard-library/cmath
index e69de29bb2..9f3fffda8d 100644
--- a/cpp/common/test/includes/standard-library/cmath
+++ b/cpp/common/test/includes/standard-library/cmath
@@ -0,0 +1,19 @@
+namespace std {
+#include <math.h>
+
+int isinf(float x);
+int isinf(double x);
+int isinf(long double x);
+bool isfinite(float x);
+bool isfinite(double x);
+bool isfinite(long double x);
+bool isnan(float x);
+bool isnan(double x);
+bool isnan(long double x);
+bool isnormal(float x);
+bool isnormal(double x);
+bool isnormal(long double x);
+int fpclassify(float x);
+int fpclassify(double x);
+int fpclassify(long double x);
+}
\ No newline at end of file
diff --git a/cpp/common/test/includes/standard-library/math.h b/cpp/common/test/includes/standard-library/math.h
index 460c0a9c2f..7ff0ef8357 100644
--- a/cpp/common/test/includes/standard-library/math.h
+++ b/cpp/common/test/includes/standard-library/math.h
@@ -17,6 +17,9 @@ long double acoshl(long double x);
 double atanh(double x);
 float atanhf(float x);
 long double atanhl(long double x);
+float cos(float x);
+double cos(double x);
+long double cos(long double x);
 double fmod(double x, double y);
 float fmodf(float x, float y);
 long double fmodl(long double x, long double y);
@@ -47,6 +50,9 @@ long double logbl(long double x);
 double pow(double x, double y);
 float powf(float x, float y);
 long double powl(long double x, long double y);
+float sin(float x);
+double sin(double x);
+long double sin(long double x);
 double sqrt(double x);
 float sqrtf(float x);
 long double sqrtl(long double x);
diff --git a/cpp/common/test/library/codingstandards/cpp/alertreporting/DeduplicateMacroResults.expected b/cpp/common/test/library/codingstandards/cpp/alertreporting/DeduplicateMacroResults.expected
new file mode 100644
index 0000000000..c273346e3b
--- /dev/null
+++ b/cpp/common/test/library/codingstandards/cpp/alertreporting/DeduplicateMacroResults.expected
@@ -0,0 +1,7 @@
+| deduplicatemacroresults.cpp:4:8:4:9 | definition of g1 | Findme var 'g1'. | deduplicatemacroresults.cpp:4:8:4:9 | definition of g1 |  |
+| deduplicatemacroresults.cpp:10:1:10:34 | SOMETIMES_HAS_RESULTS1(type,name) | Invocation of macro $@ has findme var 'g3'. | deduplicatemacroresults.cpp:6:1:6:52 | #define SOMETIMES_HAS_RESULTS1(type,name) type name | SOMETIMES_HAS_RESULTS1 |
+| deduplicatemacroresults.cpp:13:1:13:34 | SOMETIMES_HAS_RESULTS2(type,name) | Invocation of macro $@ has findme var 'g5'. | deduplicatemacroresults.cpp:7:1:7:53 | #define SOMETIMES_HAS_RESULTS2(type,name) type name; | SOMETIMES_HAS_RESULTS2 |
+| deduplicatemacroresults.cpp:15:1:15:50 | #define ALWAYS_HAS_SAME_RESULT() extern findme g6; | Macro ALWAYS_HAS_SAME_RESULT always has findme var named g6 | deduplicatemacroresults.cpp:15:1:15:50 | #define ALWAYS_HAS_SAME_RESULT() extern findme g6; | (ignored) |
+| deduplicatemacroresults.cpp:21:1:21:70 | #define ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(name) extern findme name; | Macro ALWAYS_HAS_RESULT_VARIED_DESCRIPTION always has findme var, for example '$@'. | deduplicatemacroresults.cpp:23:38:23:39 | declaration of g7 | g7 |
+| deduplicatemacroresults.cpp:30:1:31:50 | #define OUTER_ALWAYS_HAS_SAME_RESULT() extern INNER_SOMETIMES_HAS_RESULTS(findme, g10); | Macro OUTER_ALWAYS_HAS_SAME_RESULT always has findme var named g10 | deduplicatemacroresults.cpp:30:1:31:50 | #define OUTER_ALWAYS_HAS_SAME_RESULT() extern INNER_SOMETIMES_HAS_RESULTS(findme, g10); | (ignored) |
+| deduplicatemacroresults.cpp:37:1:38:52 | #define OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(name) INNER_SOMETIMES_HAS_RESULTS(findme, name ## suffix); | Macro OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION always has findme var, for example '$@'. | deduplicatemacroresults.cpp:40:44:40:47 | definition of g11suffix | g11suffix |
diff --git a/cpp/common/test/library/codingstandards/cpp/alertreporting/DeduplicateMacroResults.ql b/cpp/common/test/library/codingstandards/cpp/alertreporting/DeduplicateMacroResults.ql
new file mode 100644
index 0000000000..68cfc9a78f
--- /dev/null
+++ b/cpp/common/test/library/codingstandards/cpp/alertreporting/DeduplicateMacroResults.ql
@@ -0,0 +1,36 @@
+import cpp
+import codingstandards.cpp.alertreporting.DeduplicateMacroResults
+
+class FindMe extends VariableDeclarationEntry {
+  FindMe() { getType().toString() = "findme" }
+}
+
+module FindMeDedupeConfig implements DeduplicateMacroConfigSig<FindMe> {
+  string describe(FindMe def) { result = def.getName() }
+}
+
+module FindMeReportConfig implements MacroReportConfigSig<FindMe> {
+  bindingset[description]
+  string getMessageSameResultInAllExpansions(Macro m, string description) {
+    result = "Macro " + m.getName() + " always has findme var named " + description
+  }
+
+  string getMessageVariedResultInAllExpansions(Macro m) {
+    result = "Macro " + m.getName() + " always has findme var, for example '$@'."
+  }
+
+  string getMessageResultInIsolatedExpansion(FindMe f) {
+    result = "Invocation of macro $@ has findme var '" + f.getName() + "'."
+  }
+
+  string getMessageNotInMacro(FindMe f, Locatable extra, string extraString) {
+    result = "Findme var '" + f.getName() + "'." and extra = f and extraString = ""
+  }
+}
+
+import DeduplicateMacroResults<FindMe, FindMeDedupeConfig>
+import DeduplicateMacroResults<FindMe, FindMeDedupeConfig>::Report<FindMeReportConfig>
+
+from ReportResult report
+select report.getPrimaryElement(), report.getMessage(), report.getOptionalPlaceholderLocatable(),
+  report.getOptionalPlaceholderMessage()
diff --git a/cpp/common/test/library/codingstandards/cpp/alertreporting/deduplicatemacroresults.cpp b/cpp/common/test/library/codingstandards/cpp/alertreporting/deduplicatemacroresults.cpp
new file mode 100644
index 0000000000..d9b3659bf6
--- /dev/null
+++ b/cpp/common/test/library/codingstandards/cpp/alertreporting/deduplicatemacroresults.cpp
@@ -0,0 +1,53 @@
+typedef struct {
+} findme;
+
+findme g1; // baseline report, not in a macro
+
+#define SOMETIMES_HAS_RESULTS1(type, name) type name  // ignore
+#define SOMETIMES_HAS_RESULTS2(type, name) type name; // ignore
+
+SOMETIMES_HAS_RESULTS1(int, g2);    // ignore
+SOMETIMES_HAS_RESULTS1(findme, g3); // RESULT
+
+SOMETIMES_HAS_RESULTS2(int, g4)    // ignore
+SOMETIMES_HAS_RESULTS2(findme, g5) // RESULT
+
+#define ALWAYS_HAS_SAME_RESULT() extern findme g6; // RESULT
+
+ALWAYS_HAS_SAME_RESULT() // ignore
+ALWAYS_HAS_SAME_RESULT() // ignore
+ALWAYS_HAS_SAME_RESULT() // ignore
+
+#define ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(name) extern findme name; // RESULT
+
+ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g7) // ignore
+ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g8) // ignore
+ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g9) // ignore
+ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g9) // ignore
+ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g9) // ignore
+
+#define INNER_SOMETIMES_HAS_RESULTS(type, name) type name; // ignore
+#define OUTER_ALWAYS_HAS_SAME_RESULT()                                         \
+  extern INNER_SOMETIMES_HAS_RESULTS(findme, g10); // RESULT
+
+OUTER_ALWAYS_HAS_SAME_RESULT() // ignore
+OUTER_ALWAYS_HAS_SAME_RESULT() // ignore
+
+// 'name ## suffix' required to work around extractor bug.
+#define OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(name)                       \
+  INNER_SOMETIMES_HAS_RESULTS(findme, name##suffix); // RESULT
+
+OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g11) // ignore
+OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g12) // ignore
+
+#define OUTER_OUTER_ALWAYS_HAS_SAME_RESULT()                                   \
+  OUTER_ALWAYS_HAS_SAME_RESULT();    // ignore
+OUTER_OUTER_ALWAYS_HAS_SAME_RESULT() // ignore
+OUTER_OUTER_ALWAYS_HAS_SAME_RESULT() // ignore
+
+// 'name ## suffix' required to work around extractor bug.
+#define OUTER_OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(name)                 \
+  OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(name##suffix); // ignore
+
+OUTER_OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g13) // ignore
+OUTER_OUTER_ALWAYS_HAS_RESULT_VARIED_DESCRIPTION(g14) // ignore
\ No newline at end of file
diff --git a/cpp/common/test/library/codingstandards/cpp/scope/ParentScope.expected b/cpp/common/test/library/codingstandards/cpp/scope/ParentScope.expected
new file mode 100644
index 0000000000..90aa3b30c8
--- /dev/null
+++ b/cpp/common/test/library/codingstandards/cpp/scope/ParentScope.expected
@@ -0,0 +1,91 @@
+| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | operator= |
+| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | operator= |
+| file://:0:0:0:0 | (unnamed parameter 0) | test.cpp:8:7:8:7 | operator= |
+| file://:0:0:0:0 | (unnamed parameter 0) | test.cpp:8:7:8:7 | operator= |
+| file://:0:0:0:0 | (unnamed parameter 0) | test.cpp:27:28:27:28 | (unnamed constructor) |
+| file://:0:0:0:0 | (unnamed parameter 0) | test.cpp:27:28:27:28 | (unnamed constructor) |
+| file://:0:0:0:0 | (unnamed parameter 0) | test.cpp:27:28:27:28 | operator= |
+| file://:0:0:0:0 | __va_list_tag | file://:0:0:0:0 | (global namespace) |
+| file://:0:0:0:0 | fp_offset | file://:0:0:0:0 | __va_list_tag |
+| file://:0:0:0:0 | gp_offset | file://:0:0:0:0 | __va_list_tag |
+| file://:0:0:0:0 | operator= | file://:0:0:0:0 | __va_list_tag |
+| file://:0:0:0:0 | operator= | file://:0:0:0:0 | __va_list_tag |
+| file://:0:0:0:0 | overflow_arg_area | file://:0:0:0:0 | __va_list_tag |
+| file://:0:0:0:0 | reg_save_area | file://:0:0:0:0 | __va_list_tag |
+| test.cpp:1:5:1:7 | id1 | file://:0:0:0:0 | (global namespace) |
+| test.cpp:3:11:3:13 | ns1 | file://:0:0:0:0 | (global namespace) |
+| test.cpp:4:5:4:7 | id1 | test.cpp:3:11:3:13 | ns1 |
+| test.cpp:6:11:6:13 | ns1::ns2 | test.cpp:3:11:3:13 | ns1 |
+| test.cpp:7:5:7:7 | id1 | test.cpp:6:11:6:13 | ns1::ns2 |
+| test.cpp:8:7:8:7 | C1 | test.cpp:8:7:8:8 | C1 |
+| test.cpp:8:7:8:7 | operator= | test.cpp:8:7:8:8 | C1 |
+| test.cpp:8:7:8:7 | operator= | test.cpp:8:7:8:8 | C1 |
+| test.cpp:8:7:8:8 | C1 | test.cpp:6:11:6:13 | ns1::ns2 |
+| test.cpp:9:7:9:9 | id1 | test.cpp:8:7:8:8 | C1 |
+| test.cpp:10:8:10:17 | test_scope | test.cpp:8:7:8:8 | C1 |
+| test.cpp:10:23:10:25 | id1 | test.cpp:10:8:10:17 | test_scope |
+| test.cpp:10:28:34:3 | { ... } | test.cpp:10:8:10:17 | test_scope |
+| test.cpp:11:5:33:5 | for(...;...;...) ... | test.cpp:10:28:34:3 | { ... } |
+| test.cpp:11:10:11:17 | declaration | test.cpp:11:5:33:5 | for(...;...;...) ... |
+| test.cpp:11:14:11:16 | id1 | test.cpp:11:5:33:5 | for(...;...;...) ... |
+| test.cpp:11:19:11:21 | id1 | test.cpp:10:28:34:3 | { ... } |
+| test.cpp:11:19:11:25 | ... < ... | test.cpp:11:5:33:5 | for(...;...;...) ... |
+| test.cpp:11:25:11:25 | 1 | test.cpp:10:28:34:3 | { ... } |
+| test.cpp:11:28:11:30 | id1 | test.cpp:10:28:34:3 | { ... } |
+| test.cpp:11:28:11:32 | ... ++ | test.cpp:11:5:33:5 | for(...;...;...) ... |
+| test.cpp:11:35:33:5 | { ... } | test.cpp:11:5:33:5 | for(...;...;...) ... |
+| test.cpp:12:7:32:7 | for(...;...;...) ... | test.cpp:11:35:33:5 | { ... } |
+| test.cpp:12:12:12:19 | declaration | test.cpp:12:7:32:7 | for(...;...;...) ... |
+| test.cpp:12:16:12:18 | id1 | test.cpp:12:7:32:7 | for(...;...;...) ... |
+| test.cpp:12:21:12:23 | id1 | test.cpp:11:35:33:5 | { ... } |
+| test.cpp:12:21:12:27 | ... < ... | test.cpp:12:7:32:7 | for(...;...;...) ... |
+| test.cpp:12:27:12:27 | 1 | test.cpp:11:35:33:5 | { ... } |
+| test.cpp:12:30:12:32 | id1 | test.cpp:11:35:33:5 | { ... } |
+| test.cpp:12:30:12:34 | ... ++ | test.cpp:12:7:32:7 | for(...;...;...) ... |
+| test.cpp:12:37:32:7 | { ... } | test.cpp:12:7:32:7 | for(...;...;...) ... |
+| test.cpp:13:9:31:9 | { ... } | test.cpp:12:37:32:7 | { ... } |
+| test.cpp:14:11:14:18 | declaration | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:14:15:14:17 | id1 | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:16:11:20:11 | if (...) ...  | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:16:15:16:17 | id1 | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:16:15:16:22 | ... == ... | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:16:22:16:22 | 0 | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:16:25:18:11 | { ... } | test.cpp:16:11:20:11 | if (...) ...  |
+| test.cpp:17:13:17:20 | declaration | test.cpp:16:25:18:11 | { ... } |
+| test.cpp:17:17:17:19 | id1 | test.cpp:16:25:18:11 | { ... } |
+| test.cpp:18:18:20:11 | { ... } | test.cpp:16:11:20:11 | if (...) ...  |
+| test.cpp:19:13:19:20 | declaration | test.cpp:18:18:20:11 | { ... } |
+| test.cpp:19:17:19:19 | id1 | test.cpp:18:18:20:11 | { ... } |
+| test.cpp:21:11:25:11 | switch (...) ...  | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:21:19:21:21 | id1 | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:21:24:25:11 | { ... } | test.cpp:21:11:25:11 | switch (...) ...  |
+| test.cpp:22:11:22:17 | case ...: | test.cpp:21:24:25:11 | { ... } |
+| test.cpp:22:16:22:16 | 0 | test.cpp:21:24:25:11 | { ... } |
+| test.cpp:23:13:23:20 | declaration | test.cpp:21:24:25:11 | { ... } |
+| test.cpp:23:17:23:19 | id1 | test.cpp:21:24:25:11 | { ... } |
+| test.cpp:24:13:24:18 | break; | test.cpp:21:24:25:11 | { ... } |
+| test.cpp:25:11:25:11 | label ...: | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:26:11:28:11 | try { ... } | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:26:15:28:11 | { ... } | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:27:13:27:53 | declaration | test.cpp:26:15:28:11 | { ... } |
+| test.cpp:27:18:27:24 | lambda1 | test.cpp:26:15:28:11 | { ... } |
+| test.cpp:27:27:27:52 | [...](...){...} | test.cpp:26:15:28:11 | { ... } |
+| test.cpp:27:27:27:52 | {...} | test.cpp:26:15:28:11 | { ... } |
+| test.cpp:27:28:27:28 | (unnamed constructor) | file://:0:0:0:0 | decltype([...](...){...}) |
+| test.cpp:27:28:27:28 | (unnamed constructor) | file://:0:0:0:0 | decltype([...](...){...}) |
+| test.cpp:27:28:27:28 | (unnamed constructor) | file://:0:0:0:0 | decltype([...](...){...}) |
+| test.cpp:27:28:27:28 | operator= | file://:0:0:0:0 | decltype([...](...){...}) |
+| test.cpp:27:29:27:29 | id1 | file://:0:0:0:0 | decltype([...](...){...}) |
+| test.cpp:27:29:27:31 | id1 | test.cpp:26:15:28:11 | { ... } |
+| test.cpp:27:33:27:33 | operator() | test.cpp:27:13:27:53 | declaration |
+| test.cpp:27:36:27:52 | { ... } | test.cpp:27:33:27:33 | operator() |
+| test.cpp:27:38:27:50 | declaration | test.cpp:27:36:27:52 | { ... } |
+| test.cpp:27:42:27:44 | id1 | test.cpp:27:36:27:52 | { ... } |
+| test.cpp:27:47:27:49 | 10 | test.cpp:27:36:27:52 | { ... } |
+| test.cpp:27:52:27:52 | return ... | test.cpp:27:36:27:52 | { ... } |
+| test.cpp:28:24:28:26 | id1 | test.cpp:28:29:30:11 | <handler> |
+| test.cpp:28:29:30:11 | <handler> | test.cpp:26:11:28:11 | try { ... } |
+| test.cpp:28:29:30:11 | { ... } | test.cpp:13:9:31:9 | { ... } |
+| test.cpp:29:13:29:20 | declaration | test.cpp:28:29:30:11 | { ... } |
+| test.cpp:29:17:29:19 | id1 | test.cpp:28:29:30:11 | { ... } |
+| test.cpp:34:3:34:3 | return ... | test.cpp:10:28:34:3 | { ... } |
diff --git a/cpp/common/test/library/codingstandards/cpp/scope/ParentScope.ql b/cpp/common/test/library/codingstandards/cpp/scope/ParentScope.ql
new file mode 100644
index 0000000000..47d27fb0f0
--- /dev/null
+++ b/cpp/common/test/library/codingstandards/cpp/scope/ParentScope.ql
@@ -0,0 +1,5 @@
+import codingstandards.cpp.Scope
+
+from Element e, Element parent
+where Internal::getParentScope(e) = parent
+select e, parent
diff --git a/cpp/common/test/library/codingstandards/cpp/scope/test.cpp b/cpp/common/test/library/codingstandards/cpp/scope/test.cpp
new file mode 100644
index 0000000000..a0b617916d
--- /dev/null
+++ b/cpp/common/test/library/codingstandards/cpp/scope/test.cpp
@@ -0,0 +1,37 @@
+int id1;
+
+namespace ns1 {
+int id1; // COMPLIANT
+
+namespace ns2 {
+int id1; // COMPLIANT
+class C1 {
+  int id1;
+  void test_scope(int id1) {
+    for (int id1; id1 < 1; id1++) {
+      for (int id1; id1 < 1; id1++) {
+        {
+          int id1;
+
+          if (id1 == 0) {
+            int id1;
+          } else {
+            int id1;
+          }
+          switch (id1) {
+          case 0:
+            int id1;
+            break;
+          }
+          try {
+            auto lambda1 = [id1]() { int id1 = 10; };
+          } catch (int id1) {
+            int id1;
+          }
+        }
+      }
+    }
+  }
+};
+} // namespace ns2
+} // namespace ns1
diff --git a/cpp/common/test/library/codingstandards/cpp/trivialtypes/LiteralType.ql b/cpp/common/test/library/codingstandards/cpp/trivialtypes/LiteralType.ql
index 4d0f8567d0..e7a1d5ebd3 100644
--- a/cpp/common/test/library/codingstandards/cpp/trivialtypes/LiteralType.ql
+++ b/cpp/common/test/library/codingstandards/cpp/trivialtypes/LiteralType.ql
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 
 from Type t
 where
diff --git a/cpp/common/test/library/codingstandards/cpp/trivialtypes/TrivialType.ql b/cpp/common/test/library/codingstandards/cpp/trivialtypes/TrivialType.ql
index a85fcf5676..edbfbe5303 100644
--- a/cpp/common/test/library/codingstandards/cpp/trivialtypes/TrivialType.ql
+++ b/cpp/common/test/library/codingstandards/cpp/trivialtypes/TrivialType.ql
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 
 from Type t
 where
diff --git a/cpp/common/test/library/codingstandards/cpp/trivialtypes/TriviallyCopyableType.ql b/cpp/common/test/library/codingstandards/cpp/trivialtypes/TriviallyCopyableType.ql
index 3b3f498796..1667372f4b 100644
--- a/cpp/common/test/library/codingstandards/cpp/trivialtypes/TriviallyCopyableType.ql
+++ b/cpp/common/test/library/codingstandards/cpp/trivialtypes/TriviallyCopyableType.ql
@@ -1,5 +1,5 @@
 import cpp
-import codingstandards.cpp.TrivialType
+import codingstandards.cpp.types.TrivialType
 
 from TriviallyCopyableClass t
 select t
diff --git a/cpp/common/test/qlpack.yml b/cpp/common/test/qlpack.yml
index 3f061a2920..cb54217f76 100644
--- a/cpp/common/test/qlpack.yml
+++ b/cpp/common/test/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/common-cpp-coding-standards-tests
-version: 2.39.0-dev
+version: 2.49.0-dev
 extractor: cpp
 license: MIT
 dependencies:
diff --git a/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected b/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected
new file mode 100644
index 0000000000..886d03ddac
--- /dev/null
+++ b/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.expected
@@ -0,0 +1,2 @@
+| test.cpp:11:9:11:9 | (int32_t)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
+| test.cpp:12:41:12:41 | (signed int)... | Expression not converted to `unsigned char` before converting to a larger integer type. |
diff --git a/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.ql b/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.ql
new file mode 100644
index 0000000000..2a1e49774f
--- /dev/null
+++ b/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/CastCharBeforeConvertingToLargerSizes.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.castcharbeforeconvertingtolargersizes.CastCharBeforeConvertingToLargerSizes
+
+class TestFileQuery extends CastCharBeforeConvertingToLargerSizesSharedQuery, TestQuery { }
diff --git a/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/test.cpp b/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/test.cpp
new file mode 100644
index 0000000000..4e5d90e714
--- /dev/null
+++ b/cpp/common/test/rules/castcharbeforeconvertingtolargersizes/test.cpp
@@ -0,0 +1,17 @@
+// NOTICE: THE TEST CASES BELOW ARE ALSO INCLUDED IN THE C TEST CASE AND
+// CHANGES SHOULD BE REFLECTED THERE AS WELL.
+#include <cstdint>
+
+template <typename S, typename T> S get(T t) {
+  S s = t; // COMPLIANT
+  return s;
+}
+
+void test(std::int32_t i32, std::int8_t i8, char c) {
+  i32 = c;                                   // NON_COMPLIANT
+  i32 = get<std::int32_t, std::int32_t>(c);  // NON_COMPLIANT
+  i32 = get<std::int32_t, std::int8_t>(c);   // COMPLIANT
+  i32 = i8;                                  // COMPLIANT
+  i32 = get<std::int32_t, std::int32_t>(i8); // COMPLIANT
+  i32 = get<std::int32_t, std::int8_t>(i8);  // COMPLIANT
+}
diff --git a/cpp/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected b/cpp/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected
index dcbc6d05bc..2d293e6928 100644
--- a/cpp/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected
+++ b/cpp/common/test/rules/donotsubtractpointersaddressingdifferentarrays/DoNotSubtractPointersAddressingDifferentArrays.expected
@@ -4,10 +4,10 @@ problems
 | test.cpp:13:10:13:11 | p4 | test.cpp:5:14:5:15 | l2 | test.cpp:13:10:13:11 | p4 | Subtraction between left operand pointing to array $@ and other operand pointing to array $@. | test.cpp:3:7:3:8 | l2 | l2 | test.cpp:2:7:2:8 | l1 | l1 |
 | test.cpp:13:15:13:16 | l1 | test.cpp:13:15:13:16 | l1 | test.cpp:13:15:13:16 | l1 | Subtraction between right operand pointing to array $@ and other operand pointing to array $@. | test.cpp:2:7:2:8 | l1 | l1 | test.cpp:3:7:3:8 | l2 | l2 |
 edges
-| test.cpp:4:14:4:15 | l1 | test.cpp:4:14:4:18 | access to array | provenance |  |
+| test.cpp:4:14:4:15 | l1 | test.cpp:4:14:4:18 | access to array | provenance | Config |
 | test.cpp:4:14:4:18 | access to array | test.cpp:10:10:10:11 | p1 | provenance |  |
 | test.cpp:4:14:4:18 | access to array | test.cpp:12:10:12:11 | p1 | provenance |  |
-| test.cpp:5:14:5:15 | l2 | test.cpp:5:14:5:19 | access to array | provenance |  |
+| test.cpp:5:14:5:15 | l2 | test.cpp:5:14:5:19 | access to array | provenance | Config |
 | test.cpp:5:14:5:19 | access to array | test.cpp:11:10:11:11 | p2 | provenance |  |
 | test.cpp:5:14:5:19 | access to array | test.cpp:12:15:12:16 | p2 | provenance |  |
 | test.cpp:5:14:5:19 | access to array | test.cpp:13:10:13:11 | p4 | provenance |  |
diff --git a/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected b/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected
index fa181755e8..31ff47e55c 100644
--- a/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected
+++ b/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/DoNotUsePointerArithmeticToAddressDifferentArrays.expected
@@ -1,5 +1,8 @@
-| test.cpp:4:13:4:18 | ... + ... | Array pointer p2 points 1 element passed the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
-| test.cpp:5:13:5:18 | ... + ... | Array pointer p3 points 1 element passed the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
-| test.cpp:6:13:6:18 | & ... | Array pointer p4 points 1 element passed the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
-| test.cpp:11:8:11:11 | ... -- | Array pointer p7 points 1 element passed the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
-| test.cpp:12:8:12:9 | p3 | Array pointer p8 points 1 element passed the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
+| test.cpp:4:13:4:18 | ... + ... | Array pointer p2 points 1 element past the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
+| test.cpp:5:13:5:18 | ... + ... | Array pointer p3 points 1 element past the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
+| test.cpp:6:13:6:18 | & ... | Array pointer p4 points 1 element past the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
+| test.cpp:11:8:11:11 | ... -- | Array pointer p7 points 1 element past the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
+| test.cpp:12:8:12:9 | p3 | Array pointer p8 points 1 element past the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
+| test.cpp:25:15:25:21 | & ... | Array pointer p14 points 1 element past the end of $@. | test.cpp:2:7:2:8 | l1 | l1 |
+| test.cpp:30:15:30:21 | & ... | Array pointer p17 points 1 element past the end of $@. | test.cpp:28:24:28:42 | (unsigned char *)... | cast to byte pointer |
+| test.cpp:35:15:35:21 | & ... | Array pointer p20 points 1 element past the end of $@. | test.cpp:33:24:33:43 | (unsigned char *)... | cast to byte pointer |
diff --git a/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/test.cpp b/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/test.cpp
index c1032ee735..d9874bfb29 100644
--- a/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/test.cpp
+++ b/cpp/common/test/rules/donotusepointerarithmetictoaddressdifferentarrays/test.cpp
@@ -17,4 +17,37 @@ void f1() {
       3 + p1; // COMPLIANT - points to an element on beyond the end of the array
   int *p11 =
       &l1[3]; // COMPLIANT - points to an element on beyond the end of the array
+
+  // Casting to a pointer to a type of the same size doesn't invalidate the
+  // analysis
+  unsigned int *p12 = (unsigned int *)l1;
+  void *p13 = &p12[3]; // COMPLIANT
+  void *p14 = &p12[4]; // NON_COMPLIANT
+
+  // Casting to a char* is effectively a new array of length sizeof(T)
+  unsigned char *p15 = (unsigned char *)l1;
+  void *p16 = &p15[4]; // COMPLIANT
+  void *p17 = &p15[5]; // NON_COMPLIANT
+
+  long l2[3];
+  unsigned char *p18 = (unsigned char *)&l2;
+  void *p19 = &p18[8]; // COMPLIANT
+  void *p20 = &p18[9]; // NON_COMPLIANT
+
+  // Casting to a pointer to a differently sized type that isn't char
+  // invalidates analysis
+  long *p21 = (long *)&l1;
+  void *p22 = &p21[0];   // COMPLIANT
+  void *p23 = &p21[100]; // NON_COMPLIANT[FALSE_NEGATIVE]
+
+  // Casting a byte pointer to a differently sized type that isn't char
+  // invalidates analysis
+  long *p24 = (long *)p15;
+  void *p25 = &p24[0];   // COMPLIANT
+  void *p26 = &p24[100]; // NON_COMPLIANT[FALSE_NEGATIVE]
+
+  // Void pointers have size zero and can't be analyzed.
+  void *p27 = 0;
+  unsigned char *p28 = (unsigned char *)p27;
+  void *p29 = &p28[100]; // COMPLIANT
 }
\ No newline at end of file
diff --git a/cpp/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected b/cpp/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
index f02c9a5712..cab80e0fe0 100644
--- a/cpp/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
+++ b/cpp/common/test/rules/donotuserelationaloperatorswithdifferingarrays/DoNotUseRelationalOperatorsWithDifferingArrays.expected
@@ -11,17 +11,17 @@ problems
 | test.cpp:25:7:25:14 | ... >= ... | test.cpp:25:13:25:14 | l3 | test.cpp:25:13:25:14 | l3 | Compare operation >= comparing right operand pointing to array $@ and other operand pointing to array $@. | test.cpp:4:7:4:8 | l3 | l3 | test.cpp:2:7:2:8 | l1 | l1 |
 edges
 | test.cpp:6:13:6:14 | l1 | test.cpp:13:12:13:13 | p0 | provenance |  |
-| test.cpp:7:14:7:15 | l1 | test.cpp:7:14:7:18 | access to array | provenance |  |
+| test.cpp:7:14:7:15 | l1 | test.cpp:7:14:7:18 | access to array | provenance | Config |
 | test.cpp:7:14:7:18 | access to array | test.cpp:11:7:11:8 | p1 | provenance |  |
 | test.cpp:7:14:7:18 | access to array | test.cpp:13:7:13:8 | p1 | provenance |  |
 | test.cpp:7:14:7:18 | access to array | test.cpp:15:13:15:14 | p1 | provenance |  |
 | test.cpp:7:14:7:18 | access to array | test.cpp:17:7:17:8 | p1 | provenance |  |
 | test.cpp:7:14:7:18 | access to array | test.cpp:23:13:23:14 | p1 | provenance |  |
 | test.cpp:7:14:7:18 | access to array | test.cpp:25:7:25:8 | p1 | provenance |  |
-| test.cpp:8:14:8:15 | l1 | test.cpp:8:14:8:18 | access to array | provenance |  |
+| test.cpp:8:14:8:15 | l1 | test.cpp:8:14:8:18 | access to array | provenance | Config |
 | test.cpp:8:14:8:18 | access to array | test.cpp:11:12:11:13 | p2 | provenance |  |
 | test.cpp:8:14:8:18 | access to array | test.cpp:21:7:21:8 | p2 | provenance |  |
-| test.cpp:9:14:9:15 | l2 | test.cpp:9:14:9:18 | access to array | provenance |  |
+| test.cpp:9:14:9:15 | l2 | test.cpp:9:14:9:18 | access to array | provenance | Config |
 | test.cpp:9:14:9:18 | access to array | test.cpp:21:12:21:13 | p3 | provenance |  |
 nodes
 | test.cpp:6:13:6:14 | l1 | semmle.label | l1 |
diff --git a/cpp/common/test/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.expected b/cpp/common/test/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.expected
index 18689c333b..b8a8c17435 100644
--- a/cpp/common/test/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.expected
+++ b/cpp/common/test/rules/exceptionsafetyvalidstate/ExceptionSafetyValidState.expected
@@ -6,7 +6,7 @@
 | test.cpp:103:5:103:9 | re-throw exception  | The $@ is not released explicitly before throwing an exception. | test.cpp:99:12:99:21 | new | allocated resource |
 | test.cpp:125:5:125:37 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:124:9:124:18 | new | allocated resource |
 | test.cpp:134:5:134:37 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:133:23:133:32 | new | allocated resource |
-| test.cpp:142:3:142:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:141:3:141:4 | fs | allocated resource |
-| test.cpp:154:3:154:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:152:3:152:4 | fs | allocated resource |
-| test.cpp:160:3:160:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:159:3:159:5 | mtx | allocated resource |
-| test.cpp:172:3:172:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:170:3:170:5 | mtx | allocated resource |
+| test.cpp:142:3:142:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:141:6:141:9 | call to open | allocated resource |
+| test.cpp:154:3:154:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:152:6:152:9 | call to open | allocated resource |
+| test.cpp:160:3:160:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:159:7:159:10 | call to lock | allocated resource |
+| test.cpp:172:3:172:35 | throw ... | The $@ is not released explicitly before throwing an exception. | test.cpp:170:7:170:10 | call to lock | allocated resource |
diff --git a/cpp/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.expected b/cpp/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.expected
new file mode 100644
index 0000000000..2f681c9210
--- /dev/null
+++ b/cpp/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.expected
@@ -0,0 +1 @@
+| test.cpp:16:3:16:8 | call to remove | Return value from remove is not tested for errors. |
diff --git a/cpp/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql b/cpp/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql
new file mode 100644
index 0000000000..12c2196efd
--- /dev/null
+++ b/cpp/common/test/rules/functionerroneousreturnvaluenottested/FunctionErroneousReturnValueNotTested.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.functionerroneousreturnvaluenottested.FunctionErroneousReturnValueNotTested
+
+class TestFileQuery extends FunctionErroneousReturnValueNotTestedSharedQuery, TestQuery { }
diff --git a/cpp/common/test/rules/functionerroneousreturnvaluenottested/test.cpp b/cpp/common/test/rules/functionerroneousreturnvaluenottested/test.cpp
new file mode 100644
index 0000000000..08e2f23dec
--- /dev/null
+++ b/cpp/common/test/rules/functionerroneousreturnvaluenottested/test.cpp
@@ -0,0 +1,17 @@
+#include <stdio.h>
+
+void test_compliant() {
+  // Return value is passed to an lvalue and then tested.
+  FILE *fh = fopen("/etc/foo", "r");
+  if (!fh) { // COMPLIANT
+    return;
+  }
+
+  // Return value is tested immediately as an rvalue.
+  if (fclose(fh)) // COMPLIANT
+    return;
+}
+
+void test_noncompliant() {
+  remove("/bin/bash"); // NON_COMPLIANT
+}
\ No newline at end of file
diff --git a/cpp/common/test/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.expected b/cpp/common/test/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.expected
index 9a39d3a88d..36c66a94fe 100644
--- a/cpp/common/test/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.expected
+++ b/cpp/common/test/rules/invalidatedenvstringpointers/InvalidatedEnvStringPointers.expected
@@ -4,3 +4,8 @@
 | test.cpp:165:14:165:26 | tmpvar_global | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:157:19:157:24 | call to getenv | call to getenv | test.cpp:161:20:161:25 | call to getenv | call to getenv |
 | test.cpp:188:18:188:18 | r | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:185:7:185:15 | call to setlocale | call to setlocale | test.cpp:187:8:187:17 | call to localeconv | call to localeconv |
 | test.cpp:208:10:208:15 | tmpvar | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:202:12:202:17 | call to getenv | call to getenv | test.cpp:206:3:206:8 | call to f11fun | call to f11fun |
+| test.cpp:216:16:216:17 | r1 | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:214:14:214:18 | call to ctime | call to ctime | test.cpp:215:3:215:9 | call to asctime | call to asctime |
+| test.cpp:226:16:226:17 | r1 | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:222:14:222:18 | call to ctime | call to ctime | test.cpp:225:14:225:20 | call to asctime | call to asctime |
+| test.cpp:231:16:231:17 | r2 | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:225:14:225:20 | call to asctime | call to asctime | test.cpp:229:8:229:12 | call to ctime | call to ctime |
+| test.cpp:240:16:240:17 | r1 | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:236:19:236:27 | call to localtime | call to localtime | test.cpp:239:19:239:24 | call to gmtime | call to gmtime |
+| test.cpp:245:16:245:17 | r2 | This pointer was returned by a $@ and may have been overwritten by the susequent $@. | test.cpp:239:19:239:24 | call to gmtime | call to gmtime | test.cpp:243:8:243:16 | call to localtime | call to localtime |
diff --git a/cpp/common/test/rules/invalidatedenvstringpointers/test.cpp b/cpp/common/test/rules/invalidatedenvstringpointers/test.cpp
index 74e3d1b8f5..920d97c657 100644
--- a/cpp/common/test/rules/invalidatedenvstringpointers/test.cpp
+++ b/cpp/common/test/rules/invalidatedenvstringpointers/test.cpp
@@ -207,3 +207,40 @@ void f11(void) {
 
   printf(tmpvar); // NON_COMPLIANT
 }
+
+void f12(void) {
+  time_t rawtime;
+  time(&rawtime);
+  char *r1 = ctime(&rawtime);
+  asctime(localtime(&rawtime));
+  printf("%s", r1); // NON_COMPLIANT
+}
+
+void f13(void) {
+  time_t rawtime;
+  time(&rawtime);
+  char *r1 = ctime(&rawtime);
+  printf("%s", r1); // COMPLIANT
+
+  char *r2 = asctime(localtime(&rawtime));
+  printf("%s", r1); // NON_COMPLIANT
+  printf("%s", r2); // COMPLIANT
+
+  r1 = ctime(&rawtime);
+  printf("%s", r1); // COMPLIANT
+  printf("%s", r2); // NON_COMPLIANT
+}
+
+void f14(void) {
+  time_t rawtime;
+  struct tm *r1 = localtime(&rawtime);
+  printf("%d", r1->tm_year); // COMPLIANT
+
+  struct tm *r2 = gmtime(&rawtime);
+  printf("%s", r1->tm_year); // NON_COMPLIANT
+  printf("%s", r2->tm_year); // COMPLIANT
+
+  r1 = localtime(&rawtime);
+  printf("%s", r1->tm_year); // COMPLIANT
+  printf("%s", r2->tm_year); // NON_COMPLIANT
+}
\ No newline at end of file
diff --git a/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.expected b/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.expected
new file mode 100644
index 0000000000..45bc2466b6
--- /dev/null
+++ b/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.expected
@@ -0,0 +1,113 @@
+problems
+| test.cpp:12:8:12:9 | l2 | test.cpp:8:14:8:20 | ... / ... | test.cpp:12:8:12:9 | l2 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.cpp:8:14:8:20 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:13:8:13:9 | l3 | test.cpp:8:14:8:20 | ... / ... | test.cpp:13:8:13:9 | l3 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.cpp:8:14:8:20 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:18:20:18:21 | l2 | test.cpp:8:14:8:20 | ... / ... | test.cpp:18:3:18:22 | l2 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:8:14:8:20 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:19:20:19:21 | l3 | test.cpp:8:14:8:20 | ... / ... | test.cpp:19:3:19:22 | l3 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:8:14:8:20 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:29:19:29:20 | l2 | test.cpp:8:14:8:20 | ... / ... | test.cpp:29:19:29:20 | l2 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.cpp:8:14:8:20 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:30:19:30:20 | l3 | test.cpp:8:14:8:20 | ... / ... | test.cpp:30:19:30:20 | l3 | Possibly infinite float value $@ flows to divisor, which would silently underflow and produce zero. | test.cpp:8:14:8:20 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:40:20:40:21 | l7 | test.cpp:33:14:34:15 | ... / ... | test.cpp:40:3:40:22 | l7 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:33:14:34:15 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:64:9:64:15 | ... / ... | test.cpp:63:5:64:16 | ... / ... | test.cpp:63:5:64:16 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.cpp:64:9:64:15 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:70:9:70:17 | ... / ... | test.cpp:69:5:70:18 | ... / ... | test.cpp:69:5:70:18 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.cpp:70:9:70:17 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:76:31:76:39 | ... / ... | test.cpp:76:14:76:40 | ... / ... | test.cpp:76:14:76:40 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.cpp:76:31:76:39 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:79:35:79:43 | ... / ... | test.cpp:79:18:79:44 | ... / ... | test.cpp:79:18:79:44 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.cpp:79:35:79:43 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:83:22:83:24 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:83:5:83:25 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:91:22:91:24 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:91:5:91:25 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:95:22:95:24 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:95:5:95:25 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:97:22:97:24 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:97:5:97:25 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:103:22:103:24 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:103:5:103:25 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:109:22:109:24 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:109:5:109:25 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:115:22:115:24 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:115:5:115:25 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:118:38:118:40 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:118:21:118:41 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:127:26:127:28 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:127:9:127:29 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:133:26:133:28 | l12 | test.cpp:81:15:81:21 | ... / ... | test.cpp:133:9:133:29 | l12 | Possibly infinite float value $@ flows to cast to integer. | test.cpp:81:15:81:21 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:188:7:189:17 | ... / ... | test.cpp:187:3:189:18 | ... / ... | test.cpp:187:3:189:18 | ... / ... | Possibly infinite float value $@ flows to cast to integer. | test.cpp:188:7:189:17 | ... / ... | from division by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:202:44:202:44 | p | test.cpp:216:51:216:59 | ... / ... | test.cpp:202:27:202:45 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.cpp:216:51:216:59 | ... / ... | from division by zero | test.cpp:216:6:216:24 | addInfThenCastToInt | addInfThenCastToInt |
+| test.cpp:202:44:202:44 | p | test.cpp:220:13:221:15 | ... / ... | test.cpp:202:27:202:45 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.cpp:220:13:221:15 | ... / ... | from division by zero | test.cpp:219:6:219:7 | f2 | f2 |
+| test.cpp:202:44:202:44 | p | test.cpp:231:19:231:27 | ... / ... | test.cpp:202:27:202:45 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.cpp:231:19:231:27 | ... / ... | from division by zero | test.cpp:219:6:219:7 | f2 | f2 |
+| test.cpp:212:30:212:30 | p | test.cpp:227:25:227:33 | ... / ... | test.cpp:212:13:212:31 | p | Possibly infinite float value $@ computed in function $@ flows to cast to integer. | test.cpp:227:25:227:33 | ... / ... | from division by zero | test.cpp:219:6:219:7 | f2 | f2 |
+edges
+| test.cpp:8:14:8:20 | ... / ... | test.cpp:8:14:8:20 | ... / ... | provenance |  |
+| test.cpp:8:14:8:20 | ... / ... | test.cpp:9:14:9:16 | - ... | provenance | Config |
+| test.cpp:8:14:8:20 | ... / ... | test.cpp:12:8:12:9 | l2 | provenance |  |
+| test.cpp:8:14:8:20 | ... / ... | test.cpp:18:3:18:22 | l2 | provenance |  |
+| test.cpp:8:14:8:20 | ... / ... | test.cpp:29:19:29:20 | l2 | provenance |  |
+| test.cpp:9:14:9:16 | - ... | test.cpp:9:14:9:16 | - ... | provenance |  |
+| test.cpp:9:14:9:16 | - ... | test.cpp:13:8:13:9 | l3 | provenance |  |
+| test.cpp:9:14:9:16 | - ... | test.cpp:19:3:19:22 | l3 | provenance |  |
+| test.cpp:9:14:9:16 | - ... | test.cpp:30:19:30:20 | l3 | provenance |  |
+| test.cpp:33:14:34:15 | ... / ... | test.cpp:33:14:34:15 | ... / ... | provenance |  |
+| test.cpp:33:14:34:15 | ... / ... | test.cpp:40:3:40:22 | l7 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:81:15:81:21 | ... / ... | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:83:5:83:25 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:91:5:91:25 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:95:5:95:25 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:97:5:97:25 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:103:5:103:25 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:109:5:109:25 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:115:5:115:25 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:118:21:118:41 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:127:9:127:29 | l12 | provenance |  |
+| test.cpp:81:15:81:21 | ... / ... | test.cpp:133:9:133:29 | l12 | provenance |  |
+| test.cpp:202:22:202:22 | p | test.cpp:202:27:202:45 | p | provenance |  |
+| test.cpp:210:34:210:34 | p | test.cpp:212:13:212:31 | p | provenance |  |
+| test.cpp:216:32:216:32 | p | test.cpp:216:47:216:59 | ... + ... | provenance | Config |
+| test.cpp:216:47:216:59 | ... + ... | test.cpp:202:22:202:22 | p | provenance |  |
+| test.cpp:216:47:216:59 | ... + ... | test.cpp:202:22:202:22 | p | provenance |  |
+| test.cpp:216:51:216:59 | ... / ... | test.cpp:216:47:216:59 | ... + ... | provenance | Config |
+| test.cpp:220:13:221:15 | ... / ... | test.cpp:202:22:202:22 | p | provenance |  |
+| test.cpp:227:25:227:33 | ... / ... | test.cpp:210:34:210:34 | p | provenance |  |
+| test.cpp:231:19:231:27 | ... / ... | test.cpp:231:19:231:27 | ... / ... | provenance |  |
+| test.cpp:231:19:231:27 | ... / ... | test.cpp:233:21:233:31 | ... + ... | provenance | Config |
+| test.cpp:233:21:233:31 | ... + ... | test.cpp:233:21:233:31 | ... + ... | provenance |  |
+| test.cpp:233:21:233:31 | ... + ... | test.cpp:235:13:235:21 | middleInf | provenance |  |
+| test.cpp:233:21:233:31 | ... + ... | test.cpp:237:23:237:31 | middleInf | provenance |  |
+| test.cpp:235:13:235:21 | middleInf | test.cpp:202:22:202:22 | p | provenance |  |
+| test.cpp:237:23:237:31 | middleInf | test.cpp:216:32:216:32 | p | provenance |  |
+nodes
+| test.cpp:8:14:8:20 | ... / ... | semmle.label | ... / ... |
+| test.cpp:8:14:8:20 | ... / ... | semmle.label | ... / ... |
+| test.cpp:9:14:9:16 | - ... | semmle.label | - ... |
+| test.cpp:9:14:9:16 | - ... | semmle.label | - ... |
+| test.cpp:12:8:12:9 | l2 | semmle.label | l2 |
+| test.cpp:13:8:13:9 | l3 | semmle.label | l3 |
+| test.cpp:18:3:18:22 | l2 | semmle.label | l2 |
+| test.cpp:19:3:19:22 | l3 | semmle.label | l3 |
+| test.cpp:29:19:29:20 | l2 | semmle.label | l2 |
+| test.cpp:30:19:30:20 | l3 | semmle.label | l3 |
+| test.cpp:33:14:34:15 | ... / ... | semmle.label | ... / ... |
+| test.cpp:33:14:34:15 | ... / ... | semmle.label | ... / ... |
+| test.cpp:40:3:40:22 | l7 | semmle.label | l7 |
+| test.cpp:63:5:64:16 | ... / ... | semmle.label | ... / ... |
+| test.cpp:69:5:70:18 | ... / ... | semmle.label | ... / ... |
+| test.cpp:76:14:76:40 | ... / ... | semmle.label | ... / ... |
+| test.cpp:79:18:79:44 | ... / ... | semmle.label | ... / ... |
+| test.cpp:81:15:81:21 | ... / ... | semmle.label | ... / ... |
+| test.cpp:81:15:81:21 | ... / ... | semmle.label | ... / ... |
+| test.cpp:83:5:83:25 | l12 | semmle.label | l12 |
+| test.cpp:91:5:91:25 | l12 | semmle.label | l12 |
+| test.cpp:95:5:95:25 | l12 | semmle.label | l12 |
+| test.cpp:97:5:97:25 | l12 | semmle.label | l12 |
+| test.cpp:103:5:103:25 | l12 | semmle.label | l12 |
+| test.cpp:109:5:109:25 | l12 | semmle.label | l12 |
+| test.cpp:115:5:115:25 | l12 | semmle.label | l12 |
+| test.cpp:118:21:118:41 | l12 | semmle.label | l12 |
+| test.cpp:127:9:127:29 | l12 | semmle.label | l12 |
+| test.cpp:133:9:133:29 | l12 | semmle.label | l12 |
+| test.cpp:187:3:189:18 | ... / ... | semmle.label | ... / ... |
+| test.cpp:202:22:202:22 | p | semmle.label | p |
+| test.cpp:202:27:202:45 | p | semmle.label | p |
+| test.cpp:210:34:210:34 | p | semmle.label | p |
+| test.cpp:212:13:212:31 | p | semmle.label | p |
+| test.cpp:216:32:216:32 | p | semmle.label | p |
+| test.cpp:216:47:216:59 | ... + ... | semmle.label | ... + ... |
+| test.cpp:216:47:216:59 | ... + ... | semmle.label | ... + ... |
+| test.cpp:216:51:216:59 | ... / ... | semmle.label | ... / ... |
+| test.cpp:220:13:221:15 | ... / ... | semmle.label | ... / ... |
+| test.cpp:227:25:227:33 | ... / ... | semmle.label | ... / ... |
+| test.cpp:231:19:231:27 | ... / ... | semmle.label | ... / ... |
+| test.cpp:231:19:231:27 | ... / ... | semmle.label | ... / ... |
+| test.cpp:233:21:233:31 | ... + ... | semmle.label | ... + ... |
+| test.cpp:233:21:233:31 | ... + ... | semmle.label | ... + ... |
+| test.cpp:235:13:235:21 | middleInf | semmle.label | middleInf |
+| test.cpp:237:23:237:31 | middleInf | semmle.label | middleInf |
+subpaths
diff --git a/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql b/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql
new file mode 100644
index 0000000000..f0d160a650
--- /dev/null
+++ b/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.misuseofinfinitefloatingpointvalue.MisuseOfInfiniteFloatingPointValue
+
+class TestFileQuery extends MisuseOfInfiniteFloatingPointValueSharedQuery, TestQuery { }
diff --git a/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/test.cpp b/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/test.cpp
new file mode 100644
index 0000000000..a0624ccbf3
--- /dev/null
+++ b/cpp/common/test/rules/misuseofinfinitefloatingpointvalue/test.cpp
@@ -0,0 +1,239 @@
+#include <cmath>
+
+float getFloat() { return 1.0; }
+
+// Parameter could be infinity
+void f1(float p1) {
+  float l1 = 1;
+  float l2 = 1.0 / 0;
+  float l3 = -l2;
+
+  10 / l1;         // COMPLIANT
+  10 / l2;         // NON_COMPLIANT: Underflows to zero
+  10 / l3;         // NON_COMPLIANT: Underflow to negative zero
+  10 / p1;         // COMPLIANT: Reduce false positives by assuming not infinity
+  10 / getFloat(); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  static_cast<int>(l1); // COMPLIANT
+  static_cast<int>(l2); // NON_COMPLIANT
+  static_cast<int>(l3); // NON_COMPLIANT
+  static_cast<int>(
+      p1); // COMPLIANT: Reduce false positives by assuming not infinity
+  static_cast<int>(
+      getFloat()); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  // Not NaN:
+  float l4 = l1 / l1; // COMPLIANT
+
+  // NaN because of infinity divided by itself:
+  float l5 = l2 / l2; // NON_COMPLIANT: Division by infinity not allowed.
+  float l6 = l3 / l3; // NON_COMPLIANT: Division by infinity not allowed.
+
+  // NaN because of zero divided by itself:
+  float l7 = getFloat() /
+             p1; // COMPLIANT: Reduce false positives by assuming not infinity
+  float l8 = 0.0 / 0.0;
+
+  static_cast<int>(l4); // COMPLIANT
+  static_cast<int>(l5); // COMPLIANT: Casting NaN to int
+  static_cast<int>(l6); // COMPLIANT: Casting NaN to int
+  static_cast<int>(l7); // NON_COMPLIANT: Casting Infinity to int
+  static_cast<int>(l8); // COMPLIANT: Casting NaN to int
+
+  l4 == 0; // COMPLIANT
+  l4 != 0; // COMPLIANT
+  l4 <= 0; // COMPLIANT
+  l4 < 0;  // COMPLIANT
+  l4 >= 0; // COMPLIANT
+  l5 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 != 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 < 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 <= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 > 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 >= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l6 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l7 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l8 == 0; // NON_COMPLIANT: Comparison with NaN always false
+
+  // Guards
+  float l9 = 0;
+  if (l9 != 0) {
+    static_cast<int>(l9 / l9); // COMPLIANT: l9 is not zero
+  } else {
+    static_cast<int>(
+        l9 / l9); // NON_COMPLIANT[False positive]: Guarded to not be NaN
+  }
+
+  float l10 = 0;
+  if (l10 == 0) {
+    static_cast<int>(
+        l10 / l10); // NON_COMPLIANT[False positive]: Casting NaN to integer
+  } else {
+    static_cast<int>(l10 / l10); // COMPLIANT: Guarded to not be NaN
+  }
+
+  float l11 = 0;
+  l11 == 0 ? static_cast<int>(l11 / l11) : 0; // NON_COMPLIANT[False positive]
+  l11 == 0 ? 0 : static_cast<int>(l11 / l11); // COMPLIANT
+  l11 != 0 ? static_cast<int>(l11 / l11) : 0; // COMPLIANT
+  l11 != 0 ? 0 : static_cast<int>(l11 / l11); // NON_COMPLIANT[False positive]
+
+  float l12 = 1.0 / 0;
+  if (std::isinf(l12)) {
+    static_cast<int>(l12); // NON_COMPLIANT: Casting Infinity to integer
+  } else {
+    static_cast<int>(l12); // COMPLIANT: Guarded not to be Infinity
+  }
+
+  if (!std::isinf(l12)) {
+    static_cast<int>(l12); // COMPLIANT: Guarded not to be Infinity
+  } else {
+    static_cast<int>(l12); // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  if (std::isinf(l12) == 1) {
+    static_cast<int>(l12); // NON_COMPLIANT: Must be +Infinity
+  } else {
+    static_cast<int>(l12); // NON_COMPLIANT: May be -Infinity
+  }
+
+  if (std::isfinite(l12)) {
+    static_cast<int>(l12); // COMPLIANT: Guarded not to be Infinity
+  } else {
+    static_cast<int>(l12); // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  if (std::isnormal(l12)) {
+    static_cast<int>(l12); // COMPLIANT: Guarded not to be Infinity
+  } else {
+    static_cast<int>(l12); // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  if (std::isnan(l12)) {
+    static_cast<int>(l12); // COMPLIANT: Guarded not to be Infinity
+  } else {
+    static_cast<int>(l12); // NON_COMPLIANT: Casting Infinity to integer
+  }
+
+  std::isinf(l12) ? static_cast<int>(l12)
+                  : 0; // NON_COMPLIANT: Check on wrong branch
+  std::isinf(l12)
+      ? 0
+      : static_cast<int>(l12); // COMPLIANT: Checked not infinite before use
+  std::isfinite(l12) ? static_cast<int>(l12)
+                     : 0; // COMPLIANT: Checked finite before use
+  std::isfinite(l12)
+      ? 0
+      : static_cast<int>(l12); // NON_COMPLIANT: Checked on wrong branch
+  std::isnan(l12)
+      ? static_cast<int>(l12)
+      : 0; // COMPLIANT: Checked NaN, therefore not infinite, before use
+  std::isnan(l12)
+      ? 0
+      : static_cast<int>(l12); // NON_COMPLIANT: Check on wrong branch
+
+  float l13 = 0.0 / 0;
+  if (std::isinf(l13)) {
+    static_cast<int>(l13); // COMPLIANT: Guarded not to be NaN
+  } else {
+    static_cast<int>(l13); // COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isinf(l13) == 1) {
+    static_cast<int>(
+        l13); // COMPLIANT: Guarded not to be NaN (must be +Infinity)
+  } else {
+    static_cast<int>(l13); // COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isfinite(l13)) {
+    static_cast<int>(l13); // COMPLIANT: Guarded not to be NaN
+  } else {
+    static_cast<int>(l13); // COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isnormal(l13)) {
+    static_cast<int>(l13); // COMPLIANT: Guarded not to be NaN
+  } else {
+    static_cast<int>(l13); // COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isnan(l13)) {
+    static_cast<int>(l13); // COMPLIANT: Casting NaN to integer
+  } else {
+    static_cast<int>(l13); // COMPLIANT: Guarded not to be NaN
+  }
+
+  std::isinf(l13)
+      ? static_cast<int>(l13)
+      : 0; // COMPLIANT: Checked infinite, therefore not NaN, before use
+  std::isinf(l13) ? 0
+                  : static_cast<int>(l13); // COMPLIANT: Check on wrong branch
+  std::isfinite(l13) ? static_cast<int>(l13)
+                     : 0; // COMPLIANT: Checked finite before use
+  std::isfinite(l13)
+      ? 0
+      : static_cast<int>(l13); // COMPLIANT: Checked on wrong branch
+  std::isnan(l13) ? static_cast<int>(l13)
+                  : 0; // COMPLIANT: Check on wrong branch
+  std::isnan(l13)
+      ? 0
+      : static_cast<int>(l13); // COMPLIANT: Checked not NaN before use
+
+  static_cast<int>(
+      std::pow(2, p1)); // NON_COMPLIANT[False negative]: likely to be Infinity
+  static_cast<int>(
+      std::pow(2, std::sin(p1))); // COMPLIANT: not likely to be Infinity
+  static_cast<int>(
+      1 / std::sin(
+              p1)); // NON_COMPLIANT: possible infinity from zero in denominator
+  static_cast<int>(1 /
+                   std::log(p1)); // COMPLIANT: not possibly zero in denominator
+  static_cast<int>(std::pow(p1, p1)); // COMPLIANT: NaN if p1 is zero
+  if (p1 != 0) {
+    static_cast<int>(std::pow(p1, p1)); // COMPLIANT: p1 is not zero
+  }
+
+  static_cast<int>(std::acos(p1)); // COMPLIANT: NaN if p1 is not within -1..1
+  static_cast<int>(
+      std::acos(std::cos(p1))); // COMPLIANT: cos(p1) is within -1..1
+}
+
+void castToInt(float p) { static_cast<int>(p); }
+
+void checkBeforeCastToInt(float p) {
+  if (std::isfinite(p)) {
+    castToInt(p);
+  }
+}
+
+void castToIntToFloatToInt(float p) {
+  // This should be reported as a violation, but not downstream from here.
+  castToInt(static_cast<int>(p));
+}
+
+void addOneThenCastToInt(float p) { castToInt(p + 1); }
+void addInfThenCastToInt(float p) { castToInt(p + 1.0 / 0.0); }
+void addNaNThenCastToInt(float p) { castToInt(p + 0.0 / 0.0); }
+
+void f2() {
+  castToInt(1.0 /
+            0.0); // NON_COMPLIANT: Infinity flows to denominator in division
+  castToInt(0.0 / 0.0);             // COMPLIANT
+  checkBeforeCastToInt(1.0 / 0.0);  // COMPLIANT
+  checkBeforeCastToInt(0.0 / 0.0);  // COMPLIANT
+  addOneThenCastToInt(1.0 / 0.0);   // NON_COMPLIANT[False negative]
+  addOneThenCastToInt(0.0 / 0.0);   // NON_COMPLIANT
+  castToIntToFloatToInt(1.0 / 0.0); // NON_COMPLIANT
+  castToIntToFloatToInt(0.0 / 0.0); // COMPLIANT
+
+  // Check that during flow analysis, we only report the true root cause:
+  float rootInf = 1.0 / 0.0;
+  float rootNaN = 0.0 / 0.0;
+  float middleInf = rootInf + 1;
+  float middleNaN = rootNaN + 1;
+  castToInt(middleInf);           // NON_COMPLIANT
+  castToInt(middleNaN);           // COMPLIANT
+  addInfThenCastToInt(middleInf); // NON_COMPLIANT
+  addNaNThenCastToInt(middleNaN); // COMPLIANT
+}
\ No newline at end of file
diff --git a/cpp/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.expected b/cpp/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.expected
new file mode 100644
index 0000000000..5e4d3cacd7
--- /dev/null
+++ b/cpp/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.expected
@@ -0,0 +1,136 @@
+problems
+| test.cpp:36:8:36:9 | l5 | test.cpp:27:14:27:20 | ... / ... | test.cpp:36:3:36:9 | l5 | Possible NaN value $@ flows to a cast to integer. | test.cpp:27:14:27:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:37:8:37:9 | l6 | test.cpp:28:14:28:20 | ... / ... | test.cpp:37:3:37:9 | l6 | Possible NaN value $@ flows to a cast to integer. | test.cpp:28:14:28:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:38:8:38:9 | l7 | test.cpp:31:14:32:15 | ... / ... | test.cpp:38:3:38:9 | l7 | Possible NaN value $@ flows to a cast to integer. | test.cpp:31:14:32:15 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:39:8:39:9 | l8 | test.cpp:33:14:33:22 | ... / ... | test.cpp:39:3:39:9 | l8 | Possible NaN value $@ flows to a cast to integer. | test.cpp:33:14:33:22 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:46:3:46:4 | l5 | test.cpp:27:14:27:20 | ... / ... | test.cpp:46:3:46:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:27:14:27:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:47:3:47:4 | l5 | test.cpp:27:14:27:20 | ... / ... | test.cpp:47:3:47:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:27:14:27:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:48:3:48:4 | l5 | test.cpp:27:14:27:20 | ... / ... | test.cpp:48:3:48:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:27:14:27:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:49:3:49:4 | l5 | test.cpp:27:14:27:20 | ... / ... | test.cpp:49:3:49:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:27:14:27:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:50:3:50:4 | l5 | test.cpp:27:14:27:20 | ... / ... | test.cpp:50:3:50:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:27:14:27:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:51:3:51:4 | l5 | test.cpp:27:14:27:20 | ... / ... | test.cpp:51:3:51:4 | l5 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:27:14:27:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:52:3:52:4 | l6 | test.cpp:28:14:28:20 | ... / ... | test.cpp:52:3:52:4 | l6 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:28:14:28:20 | ... / ... | from division of infinity by infinity | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:53:3:53:4 | l7 | test.cpp:31:14:32:15 | ... / ... | test.cpp:53:3:53:4 | l7 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:31:14:32:15 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:54:3:54:4 | l8 | test.cpp:33:14:33:22 | ... / ... | test.cpp:54:3:54:4 | l8 | Possible NaN value $@ flows to comparison, which would always evaluate to false. | test.cpp:33:14:33:22 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:61:11:61:17 | ... / ... | test.cpp:61:5:61:18 | ... / ... | test.cpp:61:5:61:18 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.cpp:61:11:61:17 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:66:11:66:19 | ... / ... | test.cpp:66:5:66:20 | ... / ... | test.cpp:66:5:66:20 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.cpp:66:11:66:19 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:72:20:72:28 | ... / ... | test.cpp:72:14:72:29 | ... / ... | test.cpp:72:14:72:29 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.cpp:72:20:72:28 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:75:24:75:32 | ... / ... | test.cpp:75:18:75:33 | ... / ... | test.cpp:75:18:75:33 | ... / ... | Possible NaN value $@ flows to a cast to integer. | test.cpp:75:24:75:32 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:127:10:127:12 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:127:5:127:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:133:10:133:12 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:133:5:133:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:139:10:139:12 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:139:5:139:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:145:10:145:12 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:145:5:145:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:149:10:149:12 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:149:5:149:12 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:157:30:157:32 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:157:25:157:32 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:159:33:159:35 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:159:28:159:35 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:160:26:160:28 | l13 | test.cpp:123:15:123:21 | ... / ... | test.cpp:160:21:160:28 | l13 | Possible NaN value $@ flows to a cast to integer. | test.cpp:123:15:123:21 | ... / ... | from division of zero by zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:168:8:168:15 | call to pow | test.cpp:168:3:168:23 | call to pow | test.cpp:168:3:168:23 | call to pow | Possible NaN value $@ flows to a cast to integer. | test.cpp:168:8:168:15 | call to pow | both arguments are equal to zero | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:173:8:173:16 | call to acos | test.cpp:173:3:173:20 | call to acos | test.cpp:173:3:173:20 | call to acos | Possible NaN value $@ flows to a cast to integer. | test.cpp:173:8:173:16 | call to acos | the argument has a range -1000000000000000...1000000000000000 which is outside the domain of this function (-1.0...1.0) | test.cpp:6:6:6:7 | f1 | f1 |
+| test.cpp:177:32:177:32 | p | test.cpp:192:51:192:59 | ... / ... | test.cpp:177:27:177:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.cpp:192:51:192:59 | ... / ... | from division of zero by zero | test.cpp:192:6:192:24 | addNaNThenCastToInt | addNaNThenCastToInt |
+| test.cpp:177:32:177:32 | p | test.cpp:196:13:196:21 | ... / ... | test.cpp:177:27:177:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.cpp:196:13:196:21 | ... / ... | from division of zero by zero | test.cpp:194:6:194:7 | f2 | f2 |
+| test.cpp:177:32:177:32 | p | test.cpp:200:23:200:31 | ... / ... | test.cpp:177:27:177:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.cpp:200:23:200:31 | ... / ... | from division of zero by zero | test.cpp:194:6:194:7 | f2 | f2 |
+| test.cpp:177:32:177:32 | p | test.cpp:206:19:206:27 | ... / ... | test.cpp:177:27:177:32 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.cpp:206:19:206:27 | ... / ... | from division of zero by zero | test.cpp:194:6:194:7 | f2 | f2 |
+| test.cpp:187:18:187:18 | p | test.cpp:202:25:202:33 | ... / ... | test.cpp:187:13:187:18 | p | Possible NaN value $@ computed in function $@ flows to a cast to integer. | test.cpp:202:25:202:33 | ... / ... | from division of zero by zero | test.cpp:194:6:194:7 | f2 | f2 |
+edges
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:27:14:27:20 | ... / ... | provenance |  |
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:36:3:36:9 | l5 | provenance |  |
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:46:3:46:4 | l5 | provenance |  |
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:47:3:47:4 | l5 | provenance |  |
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:48:3:48:4 | l5 | provenance |  |
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:49:3:49:4 | l5 | provenance |  |
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:50:3:50:4 | l5 | provenance |  |
+| test.cpp:27:14:27:20 | ... / ... | test.cpp:51:3:51:4 | l5 | provenance |  |
+| test.cpp:28:14:28:20 | ... / ... | test.cpp:28:14:28:20 | ... / ... | provenance |  |
+| test.cpp:28:14:28:20 | ... / ... | test.cpp:37:3:37:9 | l6 | provenance |  |
+| test.cpp:28:14:28:20 | ... / ... | test.cpp:52:3:52:4 | l6 | provenance |  |
+| test.cpp:31:14:32:15 | ... / ... | test.cpp:31:14:32:15 | ... / ... | provenance |  |
+| test.cpp:31:14:32:15 | ... / ... | test.cpp:38:3:38:9 | l7 | provenance |  |
+| test.cpp:31:14:32:15 | ... / ... | test.cpp:53:3:53:4 | l7 | provenance |  |
+| test.cpp:33:14:33:22 | ... / ... | test.cpp:33:14:33:22 | ... / ... | provenance |  |
+| test.cpp:33:14:33:22 | ... / ... | test.cpp:39:3:39:9 | l8 | provenance |  |
+| test.cpp:33:14:33:22 | ... / ... | test.cpp:54:3:54:4 | l8 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:123:15:123:21 | ... / ... | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:127:5:127:12 | l13 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:133:5:133:12 | l13 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:139:5:139:12 | l13 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:145:5:145:12 | l13 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:149:5:149:12 | l13 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:157:25:157:32 | l13 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:159:28:159:35 | l13 | provenance |  |
+| test.cpp:123:15:123:21 | ... / ... | test.cpp:160:21:160:28 | l13 | provenance |  |
+| test.cpp:177:22:177:22 | p | test.cpp:177:27:177:32 | p | provenance |  |
+| test.cpp:185:34:185:34 | p | test.cpp:187:13:187:18 | p | provenance |  |
+| test.cpp:190:32:190:32 | p | test.cpp:190:47:190:51 | ... + ... | provenance | Config |
+| test.cpp:190:47:190:51 | ... + ... | test.cpp:177:22:177:22 | p | provenance |  |
+| test.cpp:192:32:192:32 | p | test.cpp:192:47:192:59 | ... + ... | provenance | Config |
+| test.cpp:192:47:192:59 | ... + ... | test.cpp:177:22:177:22 | p | provenance |  |
+| test.cpp:192:47:192:59 | ... + ... | test.cpp:177:22:177:22 | p | provenance |  |
+| test.cpp:192:51:192:59 | ... / ... | test.cpp:192:47:192:59 | ... + ... | provenance | Config |
+| test.cpp:196:13:196:21 | ... / ... | test.cpp:177:22:177:22 | p | provenance |  |
+| test.cpp:200:23:200:31 | ... / ... | test.cpp:190:32:190:32 | p | provenance |  |
+| test.cpp:202:25:202:33 | ... / ... | test.cpp:185:34:185:34 | p | provenance |  |
+| test.cpp:206:19:206:27 | ... / ... | test.cpp:206:19:206:27 | ... / ... | provenance |  |
+| test.cpp:206:19:206:27 | ... / ... | test.cpp:208:21:208:31 | ... + ... | provenance | Config |
+| test.cpp:208:21:208:31 | ... + ... | test.cpp:208:21:208:31 | ... + ... | provenance |  |
+| test.cpp:208:21:208:31 | ... + ... | test.cpp:210:13:210:21 | middleNaN | provenance |  |
+| test.cpp:208:21:208:31 | ... + ... | test.cpp:212:23:212:31 | middleNaN | provenance |  |
+| test.cpp:210:13:210:21 | middleNaN | test.cpp:177:22:177:22 | p | provenance |  |
+| test.cpp:212:23:212:31 | middleNaN | test.cpp:192:32:192:32 | p | provenance |  |
+nodes
+| test.cpp:27:14:27:20 | ... / ... | semmle.label | ... / ... |
+| test.cpp:27:14:27:20 | ... / ... | semmle.label | ... / ... |
+| test.cpp:28:14:28:20 | ... / ... | semmle.label | ... / ... |
+| test.cpp:28:14:28:20 | ... / ... | semmle.label | ... / ... |
+| test.cpp:31:14:32:15 | ... / ... | semmle.label | ... / ... |
+| test.cpp:31:14:32:15 | ... / ... | semmle.label | ... / ... |
+| test.cpp:33:14:33:22 | ... / ... | semmle.label | ... / ... |
+| test.cpp:33:14:33:22 | ... / ... | semmle.label | ... / ... |
+| test.cpp:36:3:36:9 | l5 | semmle.label | l5 |
+| test.cpp:37:3:37:9 | l6 | semmle.label | l6 |
+| test.cpp:38:3:38:9 | l7 | semmle.label | l7 |
+| test.cpp:39:3:39:9 | l8 | semmle.label | l8 |
+| test.cpp:46:3:46:4 | l5 | semmle.label | l5 |
+| test.cpp:47:3:47:4 | l5 | semmle.label | l5 |
+| test.cpp:48:3:48:4 | l5 | semmle.label | l5 |
+| test.cpp:49:3:49:4 | l5 | semmle.label | l5 |
+| test.cpp:50:3:50:4 | l5 | semmle.label | l5 |
+| test.cpp:51:3:51:4 | l5 | semmle.label | l5 |
+| test.cpp:52:3:52:4 | l6 | semmle.label | l6 |
+| test.cpp:53:3:53:4 | l7 | semmle.label | l7 |
+| test.cpp:54:3:54:4 | l8 | semmle.label | l8 |
+| test.cpp:61:5:61:18 | ... / ... | semmle.label | ... / ... |
+| test.cpp:66:5:66:20 | ... / ... | semmle.label | ... / ... |
+| test.cpp:72:14:72:29 | ... / ... | semmle.label | ... / ... |
+| test.cpp:75:18:75:33 | ... / ... | semmle.label | ... / ... |
+| test.cpp:123:15:123:21 | ... / ... | semmle.label | ... / ... |
+| test.cpp:123:15:123:21 | ... / ... | semmle.label | ... / ... |
+| test.cpp:127:5:127:12 | l13 | semmle.label | l13 |
+| test.cpp:133:5:133:12 | l13 | semmle.label | l13 |
+| test.cpp:139:5:139:12 | l13 | semmle.label | l13 |
+| test.cpp:145:5:145:12 | l13 | semmle.label | l13 |
+| test.cpp:149:5:149:12 | l13 | semmle.label | l13 |
+| test.cpp:157:25:157:32 | l13 | semmle.label | l13 |
+| test.cpp:159:28:159:35 | l13 | semmle.label | l13 |
+| test.cpp:160:21:160:28 | l13 | semmle.label | l13 |
+| test.cpp:168:3:168:23 | call to pow | semmle.label | call to pow |
+| test.cpp:173:3:173:20 | call to acos | semmle.label | call to acos |
+| test.cpp:177:22:177:22 | p | semmle.label | p |
+| test.cpp:177:27:177:32 | p | semmle.label | p |
+| test.cpp:185:34:185:34 | p | semmle.label | p |
+| test.cpp:187:13:187:18 | p | semmle.label | p |
+| test.cpp:190:32:190:32 | p | semmle.label | p |
+| test.cpp:190:47:190:51 | ... + ... | semmle.label | ... + ... |
+| test.cpp:192:32:192:32 | p | semmle.label | p |
+| test.cpp:192:47:192:59 | ... + ... | semmle.label | ... + ... |
+| test.cpp:192:47:192:59 | ... + ... | semmle.label | ... + ... |
+| test.cpp:192:51:192:59 | ... / ... | semmle.label | ... / ... |
+| test.cpp:196:13:196:21 | ... / ... | semmle.label | ... / ... |
+| test.cpp:200:23:200:31 | ... / ... | semmle.label | ... / ... |
+| test.cpp:202:25:202:33 | ... / ... | semmle.label | ... / ... |
+| test.cpp:206:19:206:27 | ... / ... | semmle.label | ... / ... |
+| test.cpp:206:19:206:27 | ... / ... | semmle.label | ... / ... |
+| test.cpp:208:21:208:31 | ... + ... | semmle.label | ... + ... |
+| test.cpp:208:21:208:31 | ... + ... | semmle.label | ... + ... |
+| test.cpp:210:13:210:21 | middleNaN | semmle.label | middleNaN |
+| test.cpp:212:23:212:31 | middleNaN | semmle.label | middleNaN |
+subpaths
diff --git a/cpp/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql b/cpp/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql
new file mode 100644
index 0000000000..a1f729ed02
--- /dev/null
+++ b/cpp/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql
@@ -0,0 +1,4 @@
+// GENERATED FILE - DO NOT MODIFY
+import codingstandards.cpp.rules.misuseofnanfloatingpointvalue.MisuseOfNaNFloatingPointValue
+
+class TestFileQuery extends MisuseOfNaNFloatingPointValueSharedQuery, TestQuery { }
diff --git a/cpp/common/test/rules/misuseofnanfloatingpointvalue/test.cpp b/cpp/common/test/rules/misuseofnanfloatingpointvalue/test.cpp
new file mode 100644
index 0000000000..a68a47daf7
--- /dev/null
+++ b/cpp/common/test/rules/misuseofnanfloatingpointvalue/test.cpp
@@ -0,0 +1,213 @@
+#include <cmath>
+
+float getFloat() { return 1.0; }
+
+// Parameter could be infinity
+void f1(float p1) {
+  float l1 = 1;
+  float l2 = 1.0 / 0;
+  float l3 = -l2;
+
+  10 / l1;         // COMPLIANT
+  10 / l2;         // COMPLIANT: Underflows to zero
+  10 / l3;         // COMPLIANT: Underflow to negative zero
+  10 / p1;         // COMPLIANT: Reduce false positives by assuming not infinity
+  10 / getFloat(); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  (int)l1;         // COMPLIANT
+  (int)l2;         // COMPLIANT
+  (int)l3;         // COMPLIANT
+  (int)p1;         // COMPLIANT: Reduce false positives by assuming not infinity
+  (int)getFloat(); // COMPLIANT: Reduce false positives by assuming not infinity
+
+  // Not NaN:
+  float l4 = l1 / l1; // COMPLIANT
+
+  // NaN because of infinity divided by itself:
+  float l5 = l2 / l2; // COMPLIANT: Division by infinity not allowed.
+  float l6 = l3 / l3; // COMPLIANT: Division by infinity not allowed.
+
+  // NaN because of zero divided by itself:
+  float l7 = getFloat() /
+             p1; // COMPLIANT: Reduce false positives by assuming not infinity
+  float l8 = 0.0 / 0.0;
+
+  (int)l4; // COMPLIANT
+  (int)l5; // NON_COMPLIANT: Casting NaN to int
+  (int)l6; // NON_COMPLIANT: Casting NaN to int
+  (int)l7; // NON_COMPLIANT: Casting NaN to int
+  (int)l8; // NON_COMPLIANT: Casting NaN to int
+
+  l4 == 0; // COMPLIANT
+  l4 != 0; // COMPLIANT
+  l4 <= 0; // COMPLIANT
+  l4 < 0;  // COMPLIANT
+  l4 >= 0; // COMPLIANT
+  l5 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 != 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 < 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 <= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l5 > 0;  // NON_COMPLIANT: Comparison with NaN always false
+  l5 >= 0; // NON_COMPLIANT: Comparison with NaN always false
+  l6 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l7 == 0; // NON_COMPLIANT: Comparison with NaN always false
+  l8 == 0; // NON_COMPLIANT: Comparison with NaN always false
+
+  // Guards
+  float l9 = 0;
+  if (l9 != 0) {
+    (int)(l9 / l9); // COMPLIANT: l9 is not zero
+  } else {
+    (int)(l9 / l9); // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  float l10 = 0;
+  if (l10 == 0) {
+    (int)(l10 / l10); // NON_COMPLIANT: Casting NaN to integer
+  } else {
+    (int)(l10 / l10); // COMPLIANT: Guarded to not be NaN
+  }
+
+  float l11 = 0;
+  l11 == 0 ? (int)(l11 / l11) : 0; // NON_COMPLIANT
+  l11 == 0 ? 0 : (int)(l11 / l11); // COMPLIANT
+  l11 != 0 ? (int)(l11 / l11) : 0; // COMPLIANT
+  l11 != 0 ? 0 : (int)(l11 / l11); // NON_COMPLIANT
+
+  float l12 = 1.0 / 0;
+  if (std::isinf(l12)) {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  } else {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  }
+
+  if (!std::isinf(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  if (std::isinf(l12) == 1) {
+    (int)l12; // COMPLIANT: Must be +Infinity
+  } else {
+    (int)l12; // COMPLIANT: May be -Infinity
+  }
+
+  if (std::isfinite(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  if (std::isnormal(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  if (std::isnan(l12)) {
+    (int)l12; // COMPLIANT: Guarded not to be Infinity
+  } else {
+    (int)l12; // COMPLIANT: Casting Infinity to integer
+  }
+
+  std::isinf(l12) ? (int)l12 : 0; // COMPLIANT: Check on wrong branch
+  std::isinf(l12) ? 0 : (int)l12; // COMPLIANT: Checked not infinite before use
+  std::isfinite(l12) ? (int)l12 : 0; // COMPLIANT: Checked finite before use
+  std::isfinite(l12) ? 0 : (int)l12; // COMPLIANT: Checked on wrong branch
+  std::isnan(l12)
+      ? (int)l12
+      : 0; // COMPLIANT: Checked NaN, therefore not infinite, before use
+  std::isnan(l12) ? 0 : (int)l12; // COMPLIANT: Check on wrong branch
+
+  float l13 = 0.0 / 0;
+  if (std::isinf(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isinf(l13) == 1) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN (must be +Infinity)
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isfinite(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isnormal(l13)) {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  } else {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  }
+
+  if (std::isnan(l13)) {
+    (int)l13; // NON_COMPLIANT: Casting NaN to integer
+  } else {
+    (int)l13; // COMPLIANT: Guarded not to be NaN
+  }
+
+  std::isinf(l13)
+      ? (int)l13
+      : 0; // COMPLIANT: Checked infinite, therefore not NaN, before use
+  std::isinf(l13) ? 0 : (int)l13;    // NON_COMPLIANT: Check on wrong branch
+  std::isfinite(l13) ? (int)l13 : 0; // COMPLIANT: Checked finite before use
+  std::isfinite(l13) ? 0 : (int)l13; // NON_COMPLIANT: Checked on wrong branch
+  std::isnan(l13) ? (int)l13 : 0;    // NON_COMPLIANT: Check on wrong branch
+  std::isnan(l13) ? 0 : (int)l13;    // COMPLIANT: Checked not NaN before use
+
+  (int)std::pow(2, p1);           // COMPLIANT: likely to be Infinity
+  (int)std::pow(2, std::sin(p1)); // COMPLIANT: not likely to be Infinity
+  (int)(1 /
+        std::sin(p1)); // COMPLIANT: possible infinity from zero in denominator
+  (int)(1 / std::log(p1)); // COMPLIANT: not possibly zero in denominator
+  (int)std::pow(p1, p1);   // NON_COMPLIANT: NaN if p1 is zero
+  if (p1 != 0) {
+    (int)std::pow(p1, p1); // COMPLIANT: p1 is not zero
+  }
+
+  (int)std::acos(p1);           // NON_COMPLIANT: NaN if p1 is not within -1..1
+  (int)std::acos(std::cos(p1)); // COMPLIANT: cos(p1) is within -1..1
+}
+
+void castToInt(float p) { (int)p; }
+
+void checkBeforeCastToInt(float p) {
+  if (std::isfinite(p)) {
+    castToInt(p);
+  }
+}
+
+void castToIntToFloatToInt(float p) {
+  // This should be reported as a violation, but not downstream from here.
+  castToInt((int)p);
+}
+
+void addOneThenCastToInt(float p) { castToInt(p + 1); }
+void addInfThenCastToInt(float p) { castToInt(p + 1.0 / 0.0); }
+void addNaNThenCastToInt(float p) { castToInt(p + 0.0 / 0.0); }
+
+void f2() {
+  castToInt(1.0 / 0.0); // COMPLIANT: Infinity flows to denominator in division
+  castToInt(0.0 / 0.0); // COMPLIANT: NaN flows to denominator in division
+  checkBeforeCastToInt(1.0 / 0.0);  // COMPLIANT
+  checkBeforeCastToInt(0.0 / 0.0);  // COMPLIANT
+  addOneThenCastToInt(1.0 / 0.0);   // COMPLIANT
+  addOneThenCastToInt(0.0 / 0.0);   // NON_COMPLIANT
+  castToIntToFloatToInt(1.0 / 0.0); // COMPLIANT
+  castToIntToFloatToInt(0.0 / 0.0); // NON_COMPLIANT
+
+  // Check that during flow analysis, we only report the true root cause:
+  float rootInf = 1.0 / 0.0;
+  float rootNaN = 0.0 / 0.0;
+  float middleInf = rootInf + 1;
+  float middleNaN = rootNaN + 1;
+  castToInt(middleInf);           // COMPLIANT
+  castToInt(middleNaN);           // NON_COMPLIANT
+  addInfThenCastToInt(middleInf); // COMPLIANT
+  addNaNThenCastToInt(middleNaN); // NON_COMPLIANT
+}
\ No newline at end of file
diff --git a/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected b/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected
index 0b23493cfa..7790582443 100644
--- a/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected
+++ b/cpp/common/test/rules/ownedpointervaluestoredinunrelatedsmartpointer/OwnedPointerValueStoredInUnrelatedSmartPointer.expected
@@ -11,10 +11,11 @@ edges
 | test.cpp:3:14:3:15 | v1 | test.cpp:7:28:7:29 | v2 | provenance |  |
 | test.cpp:4:13:4:14 | v1 | test.cpp:7:28:7:29 | v2 | provenance |  |
 | test.cpp:5:27:5:28 | v1 | test.cpp:5:27:5:29 | call to shared_ptr | provenance |  |
+| test.cpp:5:27:5:28 | v1 | test.cpp:5:27:5:29 | call to shared_ptr | provenance | Config |
 | test.cpp:5:27:5:29 | call to shared_ptr | test.cpp:6:28:6:29 | p1 | provenance |  |
 | test.cpp:5:27:5:29 | call to shared_ptr | test.cpp:6:28:6:29 | p1 | provenance |  |
-| test.cpp:6:28:6:29 | p1 | test.cpp:6:31:6:33 | call to get | provenance |  |
-| test.cpp:6:28:6:29 | p1 | test.cpp:6:31:6:33 | call to get | provenance |  |
+| test.cpp:6:28:6:29 | p1 | test.cpp:6:31:6:33 | call to get | provenance | Config |
+| test.cpp:6:28:6:29 | p1 | test.cpp:6:31:6:33 | call to get | provenance | Config |
 | test.cpp:8:8:8:14 | 0 | test.cpp:9:28:9:29 | v2 | provenance |  |
 | test.cpp:10:8:10:17 | new | test.cpp:11:28:11:29 | v2 | provenance |  |
 | test.cpp:10:8:10:17 | new | test.cpp:12:28:12:29 | v2 | provenance |  |
diff --git a/cpp/common/test/rules/readofuninitializedmemory/test.cpp b/cpp/common/test/rules/readofuninitializedmemory/test.cpp
index bdd3fdc203..6ed07d795f 100644
--- a/cpp/common/test/rules/readofuninitializedmemory/test.cpp
+++ b/cpp/common/test/rules/readofuninitializedmemory/test.cpp
@@ -121,4 +121,6 @@ void test_non_default_init() {
   use(slp); // COMPLIANT - static variables are zero initialized
   thread_local int *tlp;
   use(tlp); // COMPLIANT - thread local variables are zero initialized
+  _Atomic int ai;
+  use(ai); // COMPLIANT - atomics are special and not covered by this rule
 }
\ No newline at end of file
diff --git a/cpp/common/test/rules/returnreferenceorpointertoautomaticlocalvariable/test.cpp b/cpp/common/test/rules/returnreferenceorpointertoautomaticlocalvariable/test.cpp
index bc4fbf8f1d..d383d7859f 100644
--- a/cpp/common/test/rules/returnreferenceorpointertoautomaticlocalvariable/test.cpp
+++ b/cpp/common/test/rules/returnreferenceorpointertoautomaticlocalvariable/test.cpp
@@ -32,4 +32,17 @@ void test_templatefunction_return() {
   int j = 2;
   int k = 3;
   t1(j, k);
+}
+
+class C1 {
+private:
+  int x;
+
+public:
+  int test() { return x; } // COMPLIANT - ignore member vars
+};
+
+int x;
+int test_global() {
+  return x; // COMPLIANT - ignore global vars
 }
\ No newline at end of file
diff --git a/cpp/misra/src/codeql-pack.lock.yml b/cpp/misra/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/misra/src/codeql-pack.lock.yml
+++ b/cpp/misra/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/misra/src/qlpack.yml b/cpp/misra/src/qlpack.yml
index c27400fc8e..201291b135 100644
--- a/cpp/misra/src/qlpack.yml
+++ b/cpp/misra/src/qlpack.yml
@@ -1,8 +1,8 @@
 name: codeql/misra-cpp-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 description: MISRA C++ 2023
 default-suite: codeql-suites/misra-cpp-default.qls
 license: MIT
 dependencies:
   codeql/common-cpp-coding-standards: '*'
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
diff --git a/cpp/misra/src/rules/DIR-0-3-1/PossibleMisuseOfInfiniteFloatingPointValue.ql b/cpp/misra/src/rules/DIR-0-3-1/PossibleMisuseOfInfiniteFloatingPointValue.ql
new file mode 100644
index 0000000000..0e3363137e
--- /dev/null
+++ b/cpp/misra/src/rules/DIR-0-3-1/PossibleMisuseOfInfiniteFloatingPointValue.ql
@@ -0,0 +1,22 @@
+/**
+ * @id cpp/misra/possible-misuse-of-infinite-floating-point-value
+ * @name DIR-0-3-1: Possible misuse of a generate infinite floating point value
+ * @description Possible misuse of a generate infinite floating point value.
+ * @kind path-problem
+ * @precision medium
+ * @problem.severity warning
+ * @tags external/misra/id/dir-0-3-1
+ *       correctness
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.cpp.misra
+import codingstandards.cpp.rules.misuseofinfinitefloatingpointvalue.MisuseOfInfiniteFloatingPointValue
+
+class PossibleMisuseOfInfiniteFloatingPointValueQuery extends MisuseOfInfiniteFloatingPointValueSharedQuery
+{
+  PossibleMisuseOfInfiniteFloatingPointValueQuery() {
+    this = FloatingPointPackage::possibleMisuseOfInfiniteFloatingPointValueQuery()
+  }
+}
diff --git a/cpp/misra/src/rules/DIR-0-3-1/PossibleMisuseOfNaNFloatingPointValue.ql b/cpp/misra/src/rules/DIR-0-3-1/PossibleMisuseOfNaNFloatingPointValue.ql
new file mode 100644
index 0000000000..035edd85b8
--- /dev/null
+++ b/cpp/misra/src/rules/DIR-0-3-1/PossibleMisuseOfNaNFloatingPointValue.ql
@@ -0,0 +1,22 @@
+/**
+ * @id cpp/misra/possible-misuse-of-nan-floating-point-value
+ * @name DIR-0-3-1: Possible mishandling of an undetected NaN value produced by a floating point operation
+ * @description Possible mishandling of an undetected NaN value produced by a floating point
+ *              operation.
+ * @kind path-problem
+ * @precision low
+ * @problem.severity warning
+ * @tags external/misra/id/dir-0-3-1
+ *       correctness
+ *       external/misra/obligation/advisory
+ */
+
+import cpp
+import codingstandards.cpp.misra
+import codingstandards.cpp.rules.misuseofnanfloatingpointvalue.MisuseOfNaNFloatingPointValue
+
+class PossibleMisuseOfNaNFloatingPointValueQuery extends MisuseOfNaNFloatingPointValueSharedQuery {
+  PossibleMisuseOfNaNFloatingPointValueQuery() {
+    this = FloatingPointPackage::possibleMisuseOfNaNFloatingPointValueQuery()
+  }
+}
diff --git a/cpp/misra/test/codeql-pack.lock.yml b/cpp/misra/test/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/misra/test/codeql-pack.lock.yml
+++ b/cpp/misra/test/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/misra/test/qlpack.yml b/cpp/misra/test/qlpack.yml
index e79e5934fa..fb0cc1201c 100644
--- a/cpp/misra/test/qlpack.yml
+++ b/cpp/misra/test/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/misra-cpp-coding-standards-tests
-version: 2.39.0-dev
+version: 2.49.0-dev
 extractor: cpp
 license: MIT
 dependencies:
diff --git a/cpp/misra/test/rules/DIR-0-3-1/PossibleMisuseOfInfiniteFloatingPointValue.testref b/cpp/misra/test/rules/DIR-0-3-1/PossibleMisuseOfInfiniteFloatingPointValue.testref
new file mode 100644
index 0000000000..952d461d00
--- /dev/null
+++ b/cpp/misra/test/rules/DIR-0-3-1/PossibleMisuseOfInfiniteFloatingPointValue.testref
@@ -0,0 +1 @@
+cpp/common/test/rules/misuseofinfinitefloatingpointvalue/MisuseOfInfiniteFloatingPointValue.ql
\ No newline at end of file
diff --git a/cpp/misra/test/rules/DIR-0-3-1/PossibleMisuseOfNaNFloatingPointValue.testref b/cpp/misra/test/rules/DIR-0-3-1/PossibleMisuseOfNaNFloatingPointValue.testref
new file mode 100644
index 0000000000..2cd2de067d
--- /dev/null
+++ b/cpp/misra/test/rules/DIR-0-3-1/PossibleMisuseOfNaNFloatingPointValue.testref
@@ -0,0 +1 @@
+cpp/common/test/rules/misuseofnanfloatingpointvalue/MisuseOfNaNFloatingPointValue.ql
\ No newline at end of file
diff --git a/cpp/report/src/Diagnostics/ExtractionErrors.qll b/cpp/report/src/Diagnostics/ExtractionErrors.qll
index 55e1c96461..58757ca544 100644
--- a/cpp/report/src/Diagnostics/ExtractionErrors.qll
+++ b/cpp/report/src/Diagnostics/ExtractionErrors.qll
@@ -60,10 +60,10 @@ class ExtractionError extends TExtractionError {
   /** Gets the error message for this error. */
   string getErrorMessage() { none() }
 
-  /** Gets the file this error occured in. */
+  /** Gets the file this error occurred in. */
   File getFile() { none() }
 
-  /** Gets the location this error occured in. */
+  /** Gets the location this error occurred in. */
   Location getLocation() { none() }
 
   /** Gets the SARIF severity of this error. */
diff --git a/cpp/report/src/codeql-pack.lock.yml b/cpp/report/src/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/cpp/report/src/codeql-pack.lock.yml
+++ b/cpp/report/src/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/cpp/report/src/qlpack.yml b/cpp/report/src/qlpack.yml
index 6477e52747..1574721c0f 100644
--- a/cpp/report/src/qlpack.yml
+++ b/cpp/report/src/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/report-cpp-coding-standards
-version: 2.39.0-dev
+version: 2.49.0-dev
 license: MIT
 dependencies:
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
diff --git a/docs/design/detection_of_genenated_infinities_and_nans.md b/docs/design/detection_of_genenated_infinities_and_nans.md
new file mode 100644
index 0000000000..62396eea99
--- /dev/null
+++ b/docs/design/detection_of_genenated_infinities_and_nans.md
@@ -0,0 +1,294 @@
+# Coding Standards: Detection of generated Infinities and NaNs
+
+- [Coding Standards: Detection of generated Infinities and NaNs](#coding-standards-detection-of-generated-infinities-and-nans)
+  - [Document management](#document-management)
+  - [Background](#background)
+  - [Critical problems](#critical-problems)
+  - [TL;DR](#tldr)
+  - [Range / Source Analysis, In Detail](#range-source-analysis-in-detail)
+    - [Mathematical Operations](#mathematical-operations)
+    - [Range / Source Proposal #1 (Recommended)](#range-source-proposal-1-recommended)
+    - [Range / Source Proposal #2 (Not Recommended)](#range-source-proposal-2-not-recommended)
+    - [Range / Source Proposal #3 (Not Recommended)](#range-source-proposal-3-not-recommended)
+    - [Range / Source Proposal #4 (Not Recommended)](#range-source-proposal-4-not-recommended)
+  - [Detection / Sink Analysis, In Detail](#detection-sink-analysis-in-detail)
+    - [Detection / Sink Proposal #1 (Recommended)](#range-source-proposal-1-recommended)
+    - [Detection / Sink Proposal #2 (Not Recommended)](#range-source-proposal-2-not-recommended)
+  - [Case study examples](#case-study-examples)
+
+## Document management
+
+**ID**: codeql-coding-standards/design/detection-infinities-nans<br/>
+**Status**: Draft
+
+| Version | Date       | Author(s)      | Reviewer (s)                                                                                   |
+| ------- | ---------- | -------------- | ---------------------------------------------------------------------------------------------- |
+| 0.1     | 12/13/2024 | Mike Fairhurst | Robert C. Seacord, J.F. Bastien, Luke Cartey, Vincent Mailhol, Fernando Jose, Rakesh Pothengil |
+
+## Background
+
+Directive 4-15 of MISRA-C 2023 states that a program shall not have undetected generation of Infinities and NaNs. It also states that infinities and NaNs may propagate across various FLOPs, but may not propagate into sections of code not designed to handle infinities and NaNs.
+
+This directive is intentionally open to a large degree of interpretation. This document is intended to help guide the decision making for how to implement this directive in the most useful way.
+
+## Critical problems
+
+There are two fundamental problems to decide on before implementing this directive:
+- **Range / source analysis**, even a simple expression like `a + b` can be a source of infinity or NaN if there is no estimated value for `a` and/or `b`, which violates developer expectations and produces false positives.
+- **Detection / sink analysis**, how we decide which sources need to be reported to users. This can be flow analysis with sinks, or it can be modeled as a resource leak analysis where certain actions (`isnan(x), x < 10`) are handled as freeing the NaN/infinite value.
+
+## TL;DR
+
+This document proposes to create a float-specialized copy of standard range analysis which assumes most values are in the range of +/-1e15, which covers most valid program use cases, and allows `a * b` without generating `Infinity`. Then standard flow analysis will be used to detect when these values flow into underflowing operations (`x / infinity` and `x % infinity`, etc.), and when NaNs flow into comparison operations (`>`, `>=`, `<`, `<=`). If the query is noisy, we may ignore NaNs and/or infinities that come from the mostly safe basic operations (`+`, `-`, `*`).
+
+## Range / Source Analysis, In Detail:
+
+Default CodeQL range analysis is limited for performance reasons (etc):
+
+- Range analysis is local, not interprocedural
+- Global variables are assumed to be in the range of [-Infinity, Infinity]
+- Struct members, array values are assumed to be in the range of [-Infinity, Infinity]
+- Guards (e.g. `x != 0 ? y / x : ...`) are not always tracked
+
+This creates a scenario where even `a + b` can be `Infinity` or `NaN`; if either `a` or `b` is `Inf` then the expression is `Inf`, and if `a` is `+Inf` while `b` is `-Inf` then the result is `NaN`.
+
+Perhaps the flaw is in assuming `a` or `b` may be an infinite value. However, if the analysis considered `a` and `b` to be between the largest positive and negative finite floating values, then still `a + b` can produce an infinity, and only offers a single step of protection from false positives and negatives.
+
+There are a few proposals to handle this.
+
+#### Mathematical Operations
+
+IEEE 754-1985 specifies floating point semantics for “add, subtract, multiply, divide, square root, remainder, and compare operations,” including invalid use of these operators that produce NaN, propagating NaNs, and overflows that produce +/- Infinity. These semantics shall be used in the analysis.
+
+The C17 standard states that implementations compiling with IEEE 754-1985 shall define `__STDC_IEC_559__`. Under this proposal we will detect compilations where this macro is not defined and report a warning.
+
+Beyond the standard binary operators defined by IEEE 754-1985, programs may generate Infinity and/or NaN in the standard library mathematical functions. Note that technically, the c spec is vague in certain ways about when range errors, pole errors, and invalid operation errors in the standard math functions produce infinities or NaNs. We propose to assume IEEE 754-2019 behavior in this regard as a practical matter, though there is no guarantee that is the case. An alternative approach which we do not plan to take would be to broadly assume that all range errors, pole errors, invalid operation errors produce both Infinities and NaNs. This alternative would increase false positives. 
+
+### Range / Source Proposal #1 (Recommended):
+
+We will create a new float-specific version of range analysis. The actual values stored in floating point variables in real programs are very unlikely to be close to the limits of finite floating point numbers (+/- 3.4e38 for floats, 1.8e308 for doubles). This proposal is that we, for the purposes of this rule, create a new range analysis for floats where otherwise undeterminable values are assumed to be a very large range that is small compared to the range of floating point values, such as +/-1e15.
+
+Creating a new version of float analysis rather than extending previous analysis is likely to have better performance than extending standard range analysis. When floats and integers interact, the integer from standard range analysis can be used.
+
+Implications of this approach (assuming values `a` and `b` have no estimated range):
+- `a + b` will be finite
+- `a * b` will be finite
+- `a * b * c` will be possibly infinite
+- `a / b` will be possibly infinite, as the range includes small values such as 1e-30, as well as zero
+- `acos(a)` will be considered out of domain
+
+**Additional option**: If this query is still noisy, we may simply exclude reporting NaN’s and Infinities that come from a basic float operation such as `+`, `-`, or `*`. We would most likely still choose to report `/`, as divide-by-zero errors are the most common and most important to catch.
+
+### Range / Source Proposal #2 (Not Recommended):
+
+This proposal mirrors Proposal #1 except that otherwise undeterminable values will be treated as the max finite value +/-3.4e38 (floats) or 1.7e308 (doubles).
+
+The implications are as above except:
+- `a + b` will be possibly infinite
+- `a * b` will be possibly infinite
+
+### Range / Source Proposal #3 (Not Recommended):
+
+Under this proposal, standard CodeQL range analysis is used to detect generation of NaN/Infinity. All uses of a global or otherwise undeterminable value will be considered possibly infinite.
+
+### Range / Source Proposal #4 (Recommended):
+
+Under this proposal, standard CodeQL range analysis is extended to provide the support of proposal #1. While this should mostly have the same results, it will likely create performance problems, as it would rerun all range analysis code on every expression in order to have different findings in a subset of them.
+
+## Detection / Sink Analysis, In Detail:
+
+The directive states that: 
+
+- Generated Infinities and NaNs may not be unchecked
+- Infinities and NaNs may propagate to delay NaN/Infinity checking for performance reasons
+- Infinities and NaNs may not reach sections of code not designed to handle them
+
+This leaves open some questions. For instance, is `printf("%f", a * b)` possibly sending an infinity to code prepared to handle it?
+
+### Detection / Sink Proposal #1 (recommended):
+
+This proposal is to identify sinks that should not accept Infinity or NaN, and then rely on standard flow analysis as the backbone of supporting this directive.
+
+If a valid propagation of a NaN or an Infinity can be distinguished from cases where a program was not prepared to receive a NaN or Infinity, then flow analysis is the only thing that is needed, and a resource-leak approach is not necessary. This proposes that the following cases are detected as sinks, such that if NaN or Infinity flows into them they are reported.
+
+**Case 1**:  _NaNs shall not be compared, except to themselves_
+```c
+void f(float x, float y) {
+  float z = x / y; // Could be 0.0 / 0.0 which produces NaN
+
+  if (x < 10) { ... } // Not allowed
+  if (x != x) { ... } // OK
+}
+```
+
+**Case 2**: _NaNs and infinities shall not be cast to integers_
+```c
+void f(float x, float y) {
+  int z = x / y; // 0.0 / 0.0 may produce Infinity or NaN
+}
+```
+
+**Case 3**: _Infinite values shall not underflow or otherwise produce finite values_
+```c
+float f(void) {
+  float x = ...; // Could be a positive number / 0.0, which produces Infinity
+  1 / x; // If x is Infinity, this underflows to 0.0
+  1 % x; // If x is Infinity, this is defined to produce 1.
+}
+```
+
+**Case 4**: _Functions shall not return NaNs and infinities_
+```c
+void f(float* p) {
+  float local1 = ...; // Could be infinity
+
+  return local1;
+}
+```
+
+**Case 5**: _NaNs and infinities shall only be stored in local stack variables_
+```c
+float global;
+void f(float* p) {
+  float local1 = ...; // Could be infinity
+
+  // The following assignments could store an infinity in the heap:
+  global = local1;
+  extern_function(local1);
+  *p = local1;
+
+  // The following cases should be possible to analyze correctly as well
+  // with modest effort:
+  float arr[10] = ...;
+  struct my_struct = ...;
+  arr[0] = local2;
+  my_struct.member = local1;
+}
+```
+
+**Case 6 (not planned, compiler specific)**: _Functions can use assume() to declare they are not prepared for Infinity or NaN_
+```c
+void f(float x, float[] y, struct foo z) {
+  assume(!isnan(x));        // May be supportable, not planned
+  assert(!isnan(y[0]));     // Not supportable
+  assert(!isnan(z.member)); // Not supportable
+}
+```
+
+With these cases specified, we can detect invalid usage of Infinity and NaN with simple flow analysis.
+
+## Detection / Sink Proposal #2 (not recommended):
+
+This proposed solution takes inspiration from resource leak detection. In this metaphor, a generated infinity or NaN is treated like a resource that must be disposed. [There is a draft WIP of this approach here.](https://github.com/github/codeql-coding-standards/compare/main...michaelrfairhurst/implement-floatingtype-package)
+
+The advantage of this solution is that we do not need to define every way in which a NaN or an Infinity could be misused. Rather, we only need to define a few ways that a NaN or Infinity can be checked, and then find possible Infinities and NaNs that are not checked (or propagated to a value that is checked).
+
+Under this proposal, the following are echecks for infinity and NaN:
+
+- The macros `isnan(x)`, `isinf(x)`, `isfinite(x)` should be considered checks for infinity.
+- Reflexive equality checks (`x == x` or `x != x`) should be considered checks for NaN.
+- Any comparison operation (`>`, `>=`, `<`, and `<=`) should be considered a check on both positive and negative and positive infinities for an operand if the other is finite.
+  - If `a` may only be positive infinity, `a < b` and `a > b` both create a branch of the code where `a` is not positive infinity.
+  - If `a` may only be negative infinity, the same as above is the case for negative infinity cases.
+  - If `a` may be both positive or negative infinity, then a single check is not sufficient, however detecting an appropriate pair of checks would be a much more difficult implementation
+
+Only local leak detection analysis is feasible at this time. Therefore, this proposal suggests that an infinite or NaN value should be flagged if it goes out of scope before it is checked. _(In other leak detection problems, this would typically be considered a free event to avoid false positives, and that is an option here as well)_.
+
+```c
+float g;
+void f(void) {
+  float l = 1 / 0; // Must be checked
+  g = l; // May send Infinity to code not prepared to handle it
+  isinf(l); // check occurs too late
+}
+```
+
+Overall, this option is not recommended for the following reasons:
+
+- Slower performance than Proposal #1
+- Limited benefits over Proposal #1
+- Detecting out-of-scope cases heavily resembles Proposal #1
+- Unused values will be flagged, which is not useful to developers
+- Intraprocedural analysis will be difficult to support
+- High false positive rate if too few checks are detected, as opposed to the alternative where missing sinks do not create false positives
+
+In this analysis, a method or function call which can generate an infinity, such as `x / y` is treated somewhat like opening a file descriptor, and calls to `isinf(x)` or `isnan(x)` are treated as closing that file descriptor. _There are some differences between how we would approach this and how an actual resource leak detection would be modeled. For instance, we are not searching for use-after-free or double-free bugs, in this metaphor._
+
+Note that resource leak detection is not the same as standard CodeQL flow analysis. For instance, if the below example is analyzed with flow analysis, CodeQL will detect that the result of `fopen` flows into a call to `fclose`. However, this only means it is possible that the program will close the file, it does not mean the file descriptor cannot leak.
+
+```c
+void f(bool p) {
+  FILE* fd = fopen(...);
+  if (p) {
+    fclose(fd);
+  }
+}
+```
+
+The drafted leak detection algorithm follows [this paper](https://arxiv.org/html/2312.01912v2/#S2.SS2). In this approach, the program flow from the exit of `f()` is walked backwards. The walk stops upon reaching a call to `fclose()`, and if a call to `fopen()` is reached by this iterative process then that resource could leak.
+
+_Note that this approach still uses flow analysis to determine that fclose(fd) is referring to an initial fopen() call. In the paper, flow analysis is used to find aliases of resources, so that disposing an alias of a resource is handled correctly._
+
+This approach is still neither 100% accurate nor precise. It can generate both false positives and false negatives, though it is hopefully accurate and precise enough for our purposes:
+
+```c
+// FALSE POSITIVE: See fprintf call marked (1). Not all successors from (1)
+  // call fclose(), and not all predecessors of (1) call fclose() either.
+  // All paths dispose fd, but this algorithm does not see that.
+  fd = fopen(...);
+  if (!cond) {
+    fclose(fd);
+  }
+  fprintf(...); // (1)
+  if (cond) {
+    fclose(fd);
+  }
+
+  // FALSE NEGATIVE: The file descriptor opened at (2) flows into the dispose
+  // call at (3) if the values of x and y are not known. However, the resource
+  // is only closed when x == y, which is not necessarily the case.
+  fds[x] = fopen(...); // (2)
+  fclose(fds[y]);      // (3)
+```
+
+Nevertheless, their approach is sensible and likely good enough.
+
+Lastly, this approach has the unfortunate downside that unused float values which could be NaN or Infinity will be reported, when they do not have any negative effect on a program (as opposed to the negative effects of leaking unused file descriptors, or unused memory, etc).
+
+## Case study examples
+
+The following is an interesting set of examples and code snippets that come from the open source project [pandas](https://github.com/commaai/panda), which aims to be MISRA compliant and is used for self-driving cars.
+
+These examples are hand picked results from a query that selected expressions with a floating point type along with their upper and lower bounds.
+
+**Example 1**:
+```c
+float filtered_pcm_speed =
+  ((to_push->data[6] << 8) | to_push->data[7])
+  * 0.01 / 3.6;
+// Disable controls if speeds from ABS and PCM ECUs are too far apart.
+bool is_invalid_speed = ABS(filtered_pcm_speed
+  - ((float)vehicle_speed.values[0] / VEHICLE_SPEED_FACTOR))
+  > FORD_MAX_SPEED_DELTA;
+```
+
+While `filter_pcm_speed` cannot be infinity or NaN, it is interesting to see how this value is sanity checked. If this code were refactored such that it could produce NaN, the greater-than check would return false, resulting in a bug. If the condition were flipped (check inside valid range, rather than outside), it would handle NaN correctly. This cannot be captured via static analysis.
+
+**Example 2**:
+```c
+        float x0 = xy.x[i];
+        float y0 = xy.y[i];
+        float dx = xy.x[i+1] - x0;
+        float dy = xy.y[i+1] - y0;
+        // dx should not be zero as xy.x is supposed to be monotonic
+        dx = MAX(dx, 0.0001);
+        ret = (dy * (x - x0) / dx) + y0;
+```
+
+This is an [interpolation function](https://github.com/commaai/panda/blob/dec9223f9726e400e4a4eb91ca19fffcd745f97a/board/safety.h#L538), where `xy` is a struct parameter, with array members `x` and `y` that represent points in the domain and range to interpolate across.
+
+Range analysis is performed with local information only, and therefore, the expression `xy.x[i]` is given the range [-Infinity, Infinity]. This is not a generated infinity. However, the computations of `dx` and `dy` could generate a positive or negative infinity (if both numbers are finite and the result exceeds the maximum float value), they could propagate a positive or negative infinity, and/or they could generate a NaN (if an infinite value is subtracted from itself).
+
+The call to `MAX()` will not check if `dx` = positive infinity, and is unsafe to use with NaN. It prevents a divide-by-zero error, but `ret` could still propagate or generate a NaN or one of the infinities since we know so little about `dy`, `x0`, and `y0`.
+
+It’s worth noting that if `dx` is positive Infinity, then `(x - x0) / dx` will produce zero, rather than propagating the infinity. This may be worth flagging.
\ No newline at end of file
diff --git a/docs/development_handbook.md b/docs/development_handbook.md
index dc50bf59ff..83670dbbc8 100644
--- a/docs/development_handbook.md
+++ b/docs/development_handbook.md
@@ -42,6 +42,7 @@
 | 0.32.0 | 2024-05-01 | Luke Cartey | Refer to the user manual for the list of supported standards. |
 | 0.33.0 | 2024-07-30 | Kristen Newbury | Remove out dated references to codeql modules directory usage. |
 | 0.34.0 | 2024-08-22 | Kristen Newbury | Remove out dated references to git submodules usage. |
+| 0.35.0 | 2025-01-15 | Mike Fairhurst | Add guidance for the addition of 'strict' queries. |
 
 ## Scope of work
 
@@ -51,6 +52,8 @@ Each coding standard consists of a list of "guidelines", however not all the gui
 
 For some of the rules which are not amenable to static analysis, we may opt to provide a query which aids with "auditing" the rules. For example, AUTOSAR includes a rule (A10-0-1) "Public inheritance shall be used to implement 'is-a' relationship.". This is not directly amenable to static analysis, because it requires external context around the concept being modeled. However, we can provide an "audit" rule which reports all the public and private inheritance relationships in the program, so they can be manually verified.
 
+For other rules, there may be means of indicating that a contravention is intentional, and where requiring a _devation report_ may be extra burdensome on developers and require double-entry. These results should be reported under a "strict" query. For instance, `RULE-2-8` "A project should not contain unused object definitions," where adding `__attribute__((unused))` may be preferable in order to suppress compiler warnings (which _deviation reports_ do not do) and are highly indicative of an intentional contravention by a developer.
+
 For each rule which will be implemented with a query we have assigned a "rule package". Rule packages represent sets of rules, possibly across standards, that will be implemented together. Examples of rule packages include "Exceptions", "Naming", "Pointers" and so forth. By implementing queries for related rules together, we intend to maximize the amount of code shared between queries, and to ensure query developers can gain a deep understanding of that specific topic.
 
 The canonical list of rules, with implementation categorization and assigned rule packages, are stored in this repository in the `rules.csv` file.
diff --git a/docs/user_manual.md b/docs/user_manual.md
index 4c020dc73b..f4449082c7 100644
--- a/docs/user_manual.md
+++ b/docs/user_manual.md
@@ -29,18 +29,21 @@
 | 0.21.0  | 2024-05-01 | Luke Cartey     | Add MISRA C++ 2023 as under development, and clarify MISRA C 2012 coverage.                                             |
 | 0.22.0  | 2024-10-02 | Luke Cartey     | Add MISRA C 2023 as under development, and clarify MISRA C 2012 coverage.                                               |
 | 0.23.0  | 2024-10-21 | Luke Cartey     | Add assembly as a hazard.                                                                                               |
-| 0.24.0  | 2024-10-22 | Luke Cartey     | Add CodeQL packs as a usable output, update release artifacts list.                                                                                               |
+| 0.24.0  | 2024-10-22 | Luke Cartey     | Add CodeQL packs as a usable output, update release artifacts list.                                                     |
+| 0.25.0  | 2025-01-15 | Mike Fairhurst  | Add guidance for the usage of 'strict' queries.                                                                         |
+| 0.26.0  | 2025-02-12 | Luke Cartey     | Describe support for new deviation code identifier formats                                                              |
+| 0.27.0  | 2025-05-15 | Luke Cartey     | Documented completed support for MISRA C 2023.                                                                          |
 
 ## Release information
 
-This user manual documents release `2.39.0-dev` of the coding standards located at [https://github.com/github/codeql-coding-standards](https://github.com/github/codeql-coding-standards).
+This user manual documents release `2.49.0-dev` of the coding standards located at [https://github.com/github/codeql-coding-standards](https://github.com/github/codeql-coding-standards).
 The release page documents the release notes and contains the following artifacts part of the release:
 
 - `coding-standards-codeql-packs-2.37.0-dev.zip`: CodeQL packs that can be used with GitHub Code Scanning or the CodeQL CLI as documented in the section _Operating manual_.
-- `code-scanning-cpp-query-pack-2.39.0-dev.zip`: Legacy packaging for the queries and scripts to be used with GitHub Code Scanning or the CodeQL CLI as documented in the section _Operating manual_.
-- `supported_rules_list_2.39.0-dev.csv`: A Comma Separated File (CSV) containing the supported rules per standard and the queries that implement the rule.
-- `supported_rules_list_2.39.0-dev.md`: A Markdown formatted file with a table containing the supported rules per standard and the queries that implement the rule.
-- `user_manual_2.39.0-dev.md`: This user manual.
+- `code-scanning-cpp-query-pack-2.49.0-dev.zip`: Legacy packaging for the queries and scripts to be used with GitHub Code Scanning or the CodeQL CLI as documented in the section _Operating manual_.
+- `supported_rules_list_2.49.0-dev.csv`: A Comma Separated File (CSV) containing the supported rules per standard and the queries that implement the rule.
+- `supported_rules_list_2.49.0-dev.md`: A Markdown formatted file with a table containing the supported rules per standard and the queries that implement the rule.
+- `user_manual_2.49.0-dev.md`: This user manual.
 - `Source Code (zip)`: A zip archive containing the contents of https://github.com/github/codeql-coding-standards
 - `Source Code (tar.gz)`: A GZip compressed tar archive containing the contents of https://github.com/github/codeql-coding-standards
 - `checksums.txt`: A text file containing sha256 checksums for the aforementioned artifacts.
@@ -57,16 +60,16 @@ A _coding standard_ is a set of rules or guidelines which restrict or prohibit t
 
 The _CodeQL Coding Standards_ product is a set of CodeQL queries for identifying contraventions of rules in the following coding standards:
 
-| Standard                                                                                                             | Version | Rules | Supportable rules | Implemented rules | Status            |
-| -------------------------------------------------------------------------------------------------------------------- | ------- | ----------- | ----------------------- | ----------------- | ------- |
-| AUTOSAR C++ | [^1] [R22-11](https://www.autosar.org/fileadmin/standards/R22-11/AP/AUTOSAR_RS_CPP14Guidelines.pdf), R21-11, R20-11, R19-11, R19-03 | 397         | 372                     | 370[^2] | Implemented       |
-| CERT-C++   | [2016](https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-cpp-coding-standard-2016-v01.pdf)    | 83          | 82                      | 82 | Implemented       |
-| CERT C       | [2016](https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-c-coding-standard-2016-v01.pdf)    | 99          | 97                      | 97 | Implemented |
-| MISRA C                                | [2012 Third Edition, First Revision](https://www.misra.org.uk/product/misra-c2012-third-edition-first-revision/), [Amendment 2](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD2.pdf) and TC2  | 175         | 164                     | 162[^3] | Implemented |
-|                                | [MISRA C 2012 Amendment 3](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD3.pdf)   | 24         | 24                     | - | Under development |
-|                                 | [MISRA C 2012 Amendment 4](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD4.pdf)   | 22         | 22                     | - | Under development |
-|                                 | [2023 Third Edition, Second Revision](https://misra.org.uk/product/misra-c2023/)  | 221         | 210                     | - | Under development |
-| MISRA C++                                | [2023](https://misra.org.uk/product/misra-cpp2023/)  | 179         | 176[^4]                     | - | Under development |
+| Standard    | Version                                                                                                                                                                                                  | Rules | Supportable rules | Implemented rules | Status            |
+| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ----------------- | ----------------- | ----------------- |
+| AUTOSAR C++ | [^1] [R22-11](https://www.autosar.org/fileadmin/standards/R22-11/AP/AUTOSAR_RS_CPP14Guidelines.pdf), R21-11, R20-11, R19-11, R19-03                                                                      | 397   | 372               | 370[^2]           | Implemented       |
+| CERT-C++    | [2016](https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-cpp-coding-standard-2016-v01.pdf)                                                                                           | 83    | 82                | 82                | Implemented       |
+| CERT C      | [2016](https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-c-coding-standard-2016-v01.pdf)                                                                                             | 99    | 97                | 97                | Implemented       |
+| MISRA C     | [2012 Third Edition, First Revision](https://www.misra.org.uk/product/misra-c2012-third-edition-first-revision/), [Amendment 2](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD2.pdf) and TC2  | 175   | 164               | 162[^3]           | Implemented       |
+|             | [2012 Amendment 3](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD3.pdf)                                                                                                                       | 24    | 24                | 24                | Implemented       |
+|             | [2012 Amendment 4](https://misra.org.uk/app/uploads/2021/06/MISRA-C-2012-AMD4.pdf)                                                                                                                       | 22    | 22                | 21[^4]            | Implemented       |
+|             | [2023 Third Edition, Second Revision](https://misra.org.uk/product/misra-c2023/)                                                                                                                         | 221   | 210               | 207[^5]           | Implemented       |
+| MISRA C++   | [2023](https://misra.org.uk/product/misra-cpp2023/)                                                                                                                                                      | 179   | 176[^6]           | -                 | Under development |
 
 Not all rules in these standards are amenable to static analysis by CodeQL - some rules require external or domain specific knowledge to validate, or refer to properties which are not present in our representation of the codebase under analysis. In addition, some rules are natively enforced by the supported compilers. As CodeQL requires that the program under analysis compiles, we are unable to implement queries for these rules, and doing so would be redundant.
 
@@ -74,6 +77,7 @@ For each rule we therefore identify whether it is supportable or not. Furthermor
 
 - **Automated** - the queries for the rule find contraventions directly.
 - **Audit only** - the queries for the rule does not find contraventions directly, but instead report a list of _candidates_ that can be used as input into a manual audit. For example, `A10-0-1` (_Public inheritance shall be used to implement 'is-a' relationship_) is not directly amenable to static analysis, but CodeQL can be used to produce a list of all the locations that use public inheritance so they can be manually reviewed.
+- **Strict only** - the queries for the rule find contraventions directly, but find results which are strongly indicated to be intentional, and where adding a _deviation report_ may be extra burden on developers. For example, in `RULE-2-8` (_A project should not contain unused object definitions_), declaring objects with `__attribute__((unused))` may be preferable to a _deviation report_, which will not suppress relevant compiler warnings, and therefore would otherwise require developer double-entry.
 
 Each supported rule is implemented as one or more CodeQL queries, with each query covering an aspect of the rule. In many coding standards, the rules cover non-trivial semantic properties of the codebase under analysis.
 
@@ -81,8 +85,10 @@ The datasheet _"CodeQL Coding Standards: supported rules"_, provided with each r
 
 [^1]: AUTOSAR C++ versions R22-11, R21-11, R20-11, R19-11 and R19-03 are all identical as indicated in the document change history.
 [^2]: The unimplemented supportable AUTOSAR rules are `A7-1-8` and `A8-2-1`. These rules require additional support in the CodeQL CLI to ensure the required information is available in the CodeQL database to identify violations of these rules.
-[^3]: The unimplemented supportable MISRA C 2012 rules are `Rule 9.5`, `Rule 17.13`, and `Dir 4.14`. `Rule 9.5` and `Rule 17.13` require additional support in the CodeQL CLI to ensure the required information is available in the CodeQL database to identify violations of these rules. `Dir 4.14` is covered by the default CodeQL queries, which identify potential security vulnerabilities caused by not validating external input.
-[^4]: The rules 5.13.7, 19.0.1 and 19.1.2 are not planned to be implemented by CodeQL as they are compiler checked in all supported compilers.
+[^3]: The unimplemented supportable MISRA C 2012 rules are `Rule 9.5`, `Rule 17.13`. `Rule 9.5` and `Rule 17.13` require additional support in the CodeQL CLI to ensure the required information is available in the CodeQL database to identify violations of these rules. Note: `Dir 4.14` is covered by the default CodeQL queries, which identify potential security vulnerabilities caused by not validating external input.
+[^4]: The unimplemented supportable MISRA C 2012 Amendment 4 rule is `Rule 9.6`. `Rule 9.6` requires additional support in the CodeQL CLI to ensure the required information is available in the CodeQL database to identify violations of this rule.
+[^5]: The unimplemented supportable MISRA C 2023 rules are `Rule 9.5`, `Rule 9.6`, `Rule 17.13`. `Rule 9.5`, `Rule 9.6` and `Rule 17.13` require additional support in the CodeQL CLI to ensure the required information is available in the CodeQL database to identify violations of these rules. Note: `Dir 4.14` is covered by the default CodeQL queries, which identify potential security vulnerabilities caused by not validating external input.
+[^6]: The rules `5.13.7`, `19.0.1` and `19.1.2` are not planned to be implemented by CodeQL as they are compiler checked in all supported compilers.
 
 ## Supported environment
 
@@ -286,14 +292,22 @@ For each Coding Standard you want to run, add a trailing entry in the following
 
 All other options discussed above are valid.
 
-#### Running the analysis for audit level queries
+#### Running the analysis for strict and/or audit level queries
 
-Optionally, you may want to run the "audit" level queries. These queries produce lists of results that do not directly highlight contraventions of the rule. Instead, they identify locations in the code that can be manually audited to verify the absence of problems for that particular rule.
+Optionally, you may want to run the "strict" or "audit" level queries.
+
+Audit queries produce lists of results that do not directly highlight contraventions of the rule. Instead, they identify locations in the code that can be manually audited to verify the absence of problems for that particular rule.
 
 ```bash
 codeql database analyze --format=sarifv2.1.0 --output=<name-of-results-file>.sarif path/to/<output_database_name> path/to/codeql-coding-standards/cpp/<coding-standard>/src/codeql-suites/<coding-standard>-audit.qls...
 ```
 
+Strict queries identify contraventions in the code that strongly suggest they are deliberate, and where adding an explicit _deviation report_ may be extra burden on developers.
+
+```bash
+codeql database analyze --format=sarifv2.1.0 --output=<name-of-results-file>.sarif path/to/<output_database_name> path/to/codeql-coding-standards/cpp/<coding-standard>/src/codeql-suites/<coding-standard>-strict.qls...
+```
+
 #### Producing an analysis report
 
 In addition to producing a results file, an analysis report can be produced that summarizes:
@@ -405,7 +419,7 @@ The example describes three ways of scoping a deviation:
 
 1. The deviation for `A18-1-1` applies to any source file in the same or a child directory of the directory containing the example `coding-standards.yml`.
 2. The deviation for `A18-5-1` applies to any source file in the directory `foo/bar` or a child directory of `foo/bar` relative to the directory containing the `coding-standards.yml`.
-3. The deviation for `A0-4-2` applies to any source element that has a comment residing on **the same line** containing the identifier specified in `code-identifier`.
+3. The deviation for `A0-4-2` applies to any source element that marked by a comment containing the identifier specified in `code-identifier`. The different acceptable formats are discussed in the next section.
 
 The activation of the deviation mechanism requires an extra step in the database creation process.
 This extra step is the invocation of the Python script `path/to/codeql-coding-standards/scripts/configuration/process_coding_standards_config.py` that is part of the coding standards code scanning pack.
@@ -420,7 +434,90 @@ The `process_coding_standards_config.py` has a dependency on the package `pyyaml
 
 `pip3 install -r path/to/codeql-coding-standards/scripts/configuration/requirements.txt`
 
-##### Deviation permit
+##### Deviation code identifier attributes
+
+A code identifier specified in a deviation record can be applied to certain results in the code by adding a C or C++ attribute of the following format:
+
+```
+[[codeql::<standard>_deviation("code-identifier")]]
+```
+
+For example `[[codeql::autosar_deviation("a1-2-4")]]` would apply a deviation of a rule in the AUTOSAR standard, using the code identifier `a1-2-4`. The supported standard names are `misra`, `autosar` and `cert`.
+
+This attribute may be added to the following program elements:
+
+ * Functions
+ * Statements
+ * Variables
+
+Deviation attributes are inherited from parents in the code structure. For example, a deviation attribute applied to a function will apply the deviation to all code within the function.
+
+Multiple code identifiers may be passed in a single attribute to apply multiple deviations, for example:
+
+```
+[[codeql::misra_deviation("code-identifier-1", "code-identifier-2")]]
+```
+
+Note - considation should be taken to ensure the use of custom attributes for deviations is compatible with your chosen language version, compiler, compiler configuration and coding standard.
+
+**Use of attributes in C Coding Standards**: The C Standard introduces attributes in C23, however some compilers support attributes as a language extension in prior versions. You should:
+ * Confirm that your compiler supports attributes for your chosen compiler configuration, if necessary as a language extension.
+ * Confirm that unknown attributes are ignored by the compiler.
+ * For MISRA C, add a project deviation against "Rule 1.2: Language extensions should not be used", if attribute support is a language extension in your language version. 
+
+**Use of attributes in C++ Coding Standards**: The C++ Standard supports attributes in C++14, however the handling of unknown attributes is implementation defined. From C++17 onwards, unknown attributes are mandated to be ignored. Unknown attributes will usually raise an "unknown attribute" warning. You should:
+ * If using C++14, confirm that your compiler ignores unknown attributes.
+ * If using AUTOSAR and a compiler which produces warnings on unknown attributes, the compiler warning should be disabled (as per `A1-1-2: A warning level of the compilation process shall be set in compliance with project policies`),  to ensure compliance with `A1-4-3: All code should compiler free of compiler warnings`.
+
+If you cannot satisfy these condition, please use the deviation code identifier comment format instead.
+
+##### Deviation code identifier comments
+
+As an alternative to attributes, a code identifier specified in a deviation record can be applied to certain results in the code by adding a comment marker consisting of a `code-identifier` with some optional annotations. The supported marker annotation formats are:
+
+ - `<code-identifier>` - the deviation applies to results on the current line.
+ - `codeql::<standard>_deviation(<code-identifier>)` - the deviation applies to results on the current line.
+ - `codeql::<standard>_deviation_next_line(<code-identifier>)` - this deviation applies to results on the next line.
+ - `codeql::<standard>_deviation_begin(<code-identifier>)` - marks the beginning of a range of lines where the deviation applies.
+ - `codeql::<standard>_deviation_end(<code-identifier>)` - marks the end of a range of lines where the deviation applies.
+
+Here are some examples, using the deviation record with the `a-0-4-2-deviation` code-identifier specified above:
+```cpp
+  long double x1; // NON_COMPLIANT
+
+  long double x2; // a-0-4-2-deviation - COMPLIANT
+  long double x3; // COMPLIANT - a-0-4-2-deviation
+
+  long double x4; // codeql::autosar_deviation(a-0-4-2-deviation) - COMPLIANT
+  long double x5; // COMPLIANT - codeql::autosar_deviation(a-0-4-2-deviation)
+
+  // codeql::autosar_deviation_next_line(a-0-4-2-deviation)
+  long double x6; // COMPLIANT
+
+  // codeql::autosar_deviation_begin(a-0-4-2-deviation)
+  long double x7; // COMPLIANT
+  // codeql::autosar_deviation_end(a-0-4-2-deviation)
+```
+
+`codeql::<standard>_deviation_end` markers will pair with the closest unmatched `codeql::<standard>_deviation_begin` for the same `code-identifier`. Consider this example:
+```cpp
+1 | // codeql::autosar_deviation_begin(a-0-4-2-deviation)
+2 |
+3 | // codeql::autosar_deviation_begin(a-0-4-2-deviation)
+4 |
+5 | // codeql::autosar_deviation_end(a-0-4-2-deviation)
+6 |
+7 | // codeql::autosar_deviation_end(a-0-4-2-deviation)
+```
+Here, Line 1 will pair with Line 7, and Line 3 will pair with Line 5.
+
+A `codeql::<standard>_deviation_end` without a matching `codeql::<standard>_deviation_begin`, or `codeql::<standard>_deviation_begin` without a matching `codeql::<standard>_deviation_end` is invalid and will be ignored.
+
+`codeql::<standard>_deviation_begin` and `ccodeql::<standard>_deviation_end` markers only apply within a single file. Markers cannot be paired across files, and deviations do not apply to included files.
+
+Note: deviation comment markers cannot be applied to the body of a macro. Please apply the deviation to macro expansion, or use the attribute deviation format.
+
+##### Deviation permits
 
 The current implementation supports _deviation permits_ as described in the [MISRA Compliance:2020](https://www.misra.org.uk/app/uploads/2021/06/MISRA-Compliance-2020.pdf) section _4.3 Deviation permits_.
 
@@ -573,7 +670,7 @@ This section describes known failure modes for "CodeQL Coding Standards" and des
 |                              | Out of space                                                                                                                                                       | Less output. Some files may be only be partially analyzed, or not analyzed at all.                                                                        | Error reported on the command line.                                                                                                                                                                                                                                                                                                  | Increase space. If it remains an issue report space consumption issues via the CodeQL Coding Standards [bug tracker](https://github.com/github/codeql-coding-standards/issues).                                                                                                                                                                                            |
 |                              | False positives                                                                                                                                                    | More output. Results are reported which are not violations of the guidelines.                                                                             | All reported results must be reviewed.                                                                                                                                                                                                                                                                                               | Report false positive issues via the CodeQL Coding Standards [bug tracker](https://github.com/github/codeql-coding-standards/issues).                                                                                                                                                                                                                                      |
 |                              | False negatives                                                                                                                                                    | Less output. Violations of the guidelines are not reported.                                                                                               | Other validation and verification processes during software development should be used to complement the analysis performed by CodeQL Coding Standards.                                                                                                                                                                              | Report false negative issues via the CodeQL Coding Standards [bug tracker](https://github.com/github/codeql-coding-standards/issues).                                                                                                                                                                                                                                      |
-|                              | Modifying coding standard suite                                                                                                                                    | More or less output. If queries are added to the query set more result can be reported. If queries are removed less results might be reported.            | All queries supported by the CodeQL Coding Standards are listed in the release artifacts `supported_rules_list_2.39.0-dev.csv` where VERSION is replaced with the used release. The rules in the resulting Sarif file must be cross-referenced with the expected rules in this list to determine the validity of the used CodeQL suite. | Ensure that the CodeQL Coding Standards are not modified in ways that are not documented as supported modifications.                                                                                                                                                                                                                                                    |
+|                              | Modifying coding standard suite                                                                                                                                    | More or less output. If queries are added to the query set more result can be reported. If queries are removed less results might be reported.            | All queries supported by the CodeQL Coding Standards are listed in the release artifacts `supported_rules_list_2.49.0-dev.csv` where VERSION is replaced with the used release. The rules in the resulting Sarif file must be cross-referenced with the expected rules in this list to determine the validity of the used CodeQL suite. | Ensure that the CodeQL Coding Standards are not modified in ways that are not documented as supported modifications.                                                                                                                                                                                                                                                    |
 |                              | Incorrect deviation record specification                                                                                                                           | More output. Results are reported for guidelines for which a deviation is assigned.                                                                       | Analysis integrity report lists all deviations and incorrectly specified deviation records with a reason. Ensure that all deviation records are correctly specified.                                                                                                                                                                 | Ensure that the deviation record is specified according to the specification in the user manual.                                                                                                                                                                                                                                                                           |
 |                              | Incorrect deviation permit specification                                                                                                                           | More output. Results are reported for guidelines for which a deviation is assigned.                                                                       | Analysis integrity report lists all deviations and incorrectly specified deviation permits with a reason. Ensure that all deviation permits are correctly specified.                                                                                                                                                                 | Ensure that the deviation record is specified according to the specification in the user manual.                                                                                                                                                                                                                                                                           |
 |                              | Unapproved use of a deviation record                                                                                                                               | Less output. Results for guideline violations are not reported.                                                                                           | Validate that the deviation record use is approved by verifying the approved-by attribute of the deviation record specification.                                                                                                                                                                                                     | Ensure that each raised deviation record is approved by an independent approver through an auditable process.                                                                                                                                                                                                                                                              |
diff --git a/rule_packages/c/Banned.json b/rule_packages/c/Banned.json
index d3825f8f30..265a41de51 100644
--- a/rule_packages/c/Banned.json
+++ b/rule_packages/c/Banned.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "DoNotCallSystem",
           "tags": [
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -104,7 +109,7 @@
     },
     "RULE-21-11": {
       "properties": {
-        "obligation": "required"
+        "obligation": "advisory"
       },
       "queries": [
         {
diff --git a/rule_packages/c/Concurrency1.json b/rule_packages/c/Concurrency1.json
index 15e38e941d..9daa2a83be 100644
--- a/rule_packages/c/Concurrency1.json
+++ b/rule_packages/c/Concurrency1.json
@@ -15,7 +15,12 @@
           "shared_implementation_short_name": "GuardAccessToBitFields",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -35,7 +40,12 @@
           "short_name": "RaceConditionsWhenUsingLibraryFunctions",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -55,7 +65,12 @@
           "short_name": "DoNotCallSignalInMultithreadedProgram",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "This implementation does not consider threads created function pointers."
diff --git a/rule_packages/c/Concurrency2.json b/rule_packages/c/Concurrency2.json
index d9102a07df..d9e364d046 100644
--- a/rule_packages/c/Concurrency2.json
+++ b/rule_packages/c/Concurrency2.json
@@ -15,7 +15,12 @@
           "shared_implementation_short_name": "PreventDeadlockByLockingInPredefinedOrder",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -36,7 +41,12 @@
           "shared_implementation_short_name": "WrapSpuriousFunctionInLoop",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Concurrency3.json b/rule_packages/c/Concurrency3.json
index a57b73f034..6328f6b43c 100644
--- a/rule_packages/c/Concurrency3.json
+++ b/rule_packages/c/Concurrency3.json
@@ -15,7 +15,12 @@
           "shared_implementation_short_name": "DoNotAllowAMutexToGoOutOfScopeWhileLocked",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This implementation does not allow for thread synchronization to be performed in subroutines. All synchronization must be performed within the context of the other thread management functions."
@@ -31,7 +36,12 @@
           "shared_implementation_short_name": "DoNotDestroyAMutexWhileItIsLocked",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -52,7 +62,12 @@
           "shared_implementation_short_name": "PreserveSafetyWhenUsingConditionVariables",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This implementation does not attempt to identify unique condition variables and instead advocates for the usage of `cnd_broadcast`."
@@ -75,7 +90,12 @@
           "short_name": "WrapFunctionsThatCanFailSpuriouslyInLoop",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This implementation does not attempt to identify a relationship between the condition variable and the atomic operation."
diff --git a/rule_packages/c/Concurrency4.json b/rule_packages/c/Concurrency4.json
index d537ee713e..b981ebaa8b 100644
--- a/rule_packages/c/Concurrency4.json
+++ b/rule_packages/c/Concurrency4.json
@@ -14,7 +14,12 @@
           "short_name": "CleanUpThreadSpecificStorage",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query does not attempt to ensure that the deallocation function in fact deallocates memory and instead assumes the contract is valid. Additionally, this query requires that all `tss_create` calls are bookended by calls to `tss_delete`, even if a thread is not created."
@@ -37,7 +42,12 @@
           "short_name": "AppropriateThreadObjectStorageDurations",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query does not consider Windows implementations or OpenMP implementations. This query is primarily about excluding cases wherein the storage duration of a variable is appropriate. As such, this query is not concerned if the appropriate synchronization mechanisms are used, such as sequencing calls to `thrd_join` and `free`. An audit query is supplied to handle some of those cases."
@@ -53,7 +63,12 @@
           "tags": [
             "external/cert/audit",
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Concurrency5.json b/rule_packages/c/Concurrency5.json
index 67707201fd..d1a685dd34 100644
--- a/rule_packages/c/Concurrency5.json
+++ b/rule_packages/c/Concurrency5.json
@@ -12,9 +12,15 @@
           "precision": "high",
           "severity": "error",
           "short_name": "ThreadWasPreviouslyJoinedOrDetached",
+          "shared_implementation_short_name": "JoinOrDetachThreadOnlyOnce",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "This query considers problematic usages of join and detach irrespective of the execution of the program and other synchronization and interprocess communication mechanisms that may be used."
@@ -37,7 +43,12 @@
           "short_name": "AtomicVariableTwiceInExpression",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/Concurrency6.json b/rule_packages/c/Concurrency6.json
new file mode 100644
index 0000000000..cfb793877e
--- /dev/null
+++ b/rule_packages/c/Concurrency6.json
@@ -0,0 +1,132 @@
+{
+  "MISRA-C-2012": {
+    "DIR-5-2": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Circular waits leading to thread deadlocks may be avoided by locking in a predefined order.",
+          "kind": "problem",
+          "name": "There shall be no deadlocks between threads",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "NotNoDeadlocksBetweenThreads",
+          "shared_implementation_short_name": "PreventDeadlockByLockingInPredefinedOrder",
+          "tags": [
+            "external/misra/c/2012/amendment4",
+            "correctness",
+            "concurrency"
+          ]
+        }
+      ],
+      "title": "There shall be no deadlocks between threads"
+    },
+    "DIR-5-3": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Creating threads within threads creates uncertainty in program behavior and concurrency overhead costs.",
+          "kind": "problem",
+          "name": "Threads shall not be created by other threads",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "ThreadCreatedByThread",
+          "tags": [
+            "external/misra/c/2012/amendment4",
+            "correctness",
+            "maintainability",
+            "concurrency",
+            "performance"
+          ]
+        },
+        {
+          "description": "Creating threads outside of a well-defined program start-up phase creates uncertainty in program behavior and concurrency overhead costs.",
+          "kind": "problem",
+          "name": "There shall be no dynamic thread creation",
+          "precision": "low",
+          "severity": "error",
+          "short_name": "BannedDynamicThreadCreation",
+          "tags": [
+            "external/misra/c/2012/amendment4",
+            "external/misra/c/audit",
+            "correctness",
+            "maintainability",
+            "concurrency",
+            "performance"
+          ]
+        }
+      ],
+      "title": "There shall be no dynamic thread creation"
+    },
+    "RULE-12-6": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Accessing a member of an atomic structure or union results in undefined behavior.",
+          "kind": "problem",
+          "name": "Structure and union members of atomic objects shall not be directly accessed",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "AtomicAggregateObjectDirectlyAccessed",
+          "tags": [
+            "external/misra/c/2012/amendment4",
+            "correctness",
+            "concurrency"
+          ]
+        }
+      ],
+      "title": "Structure and union members of atomic objects shall not be directly accessed"
+    },
+    "RULE-21-25": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Only the memory ordering of 'memory_order_seq_cst' is fully portable and consistent.",
+          "kind": "path-problem",
+          "name": "All memory synchronization operations shall be executed in sequentially consistent order",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "InvalidMemoryOrderArgument",
+          "tags": [
+            "external/misra/c/2012/amendment4",
+            "correctness",
+            "concurrency"
+          ]
+        }
+      ],
+      "title": "All memory synchronization operations shall be executed in sequentially consistent order"
+    },
+    "RULE-22-11": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Joining or detaching a previously joined or detached thread can lead to undefined program behavior.",
+          "kind": "problem",
+          "name": "A thread that was previously either joined or detached shall not be subsequently joined nor detached",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "ThreadPreviouslyJoinedOrDetached",
+          "shared_implementation_short_name": "JoinOrDetachThreadOnlyOnce",
+          "tags": [
+            "external/misra/c/2012/amendment4",
+            "correctness",
+            "concurrency"
+          ],
+          "implementation_scope": {
+            "description": "This query considers problematic usages of join and detach irrespective of the execution of the program and other synchronization and interprocess communication mechanisms that may be used."
+          }
+        }
+      ],
+      "title": "A thread that was previously either joined or detached shall not be subsequently joined nor detached"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Concurrency7.json b/rule_packages/c/Concurrency7.json
new file mode 100644
index 0000000000..bda8881934
--- /dev/null
+++ b/rule_packages/c/Concurrency7.json
@@ -0,0 +1,49 @@
+{
+  "MISRA-C-2012": {
+    "RULE-9-7": {
+      "properties": {
+        "obligation": "mandatory"
+      },
+      "queries": [
+        {
+          "description": "Atomic objects that do not have static storage duration shall be initialized with a value or by using 'atomic_init()'.",
+          "kind": "problem",
+          "name": "Atomic objects shall be appropriately initialized before being accessed",
+          "precision": "high",
+          "severity": "warning",
+          "short_name": "UninitializedAtomicObject",
+          "tags": [
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ],
+          "implementation_scope": {
+            "description": "This query tracks which functions may start threads, either indirectly or directly (\"thread spawning functions\"), and checks for local atomic variables that are not passed by address into `atomic_init` or other function calls, before such a thread spawning function is called.",
+            "items": []
+          }
+        }
+      ],
+      "title": "Atomic objects shall be appropriately initialized before being accessed"
+    },
+    "RULE-21-26": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "The Standard Library function mtx_timedlock() shall only be invoked on mutex objects of appropriate mutex type.",
+          "kind": "path-problem",
+          "name": "The Standard Library function mtx_timedlock() shall only be invoked on mutexes of type mtx_timed",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "TimedlockOnInappropriateMutexType",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "The Standard Library function mtx_timedlock() shall only be invoked on mutex objects of appropriate mutex type"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Concurrency8.json b/rule_packages/c/Concurrency8.json
new file mode 100644
index 0000000000..2dc5d48042
--- /dev/null
+++ b/rule_packages/c/Concurrency8.json
@@ -0,0 +1,115 @@
+{
+  "MISRA-C-2012": {
+    "RULE-22-12": {
+      "properties": {
+        "obligation": "mandatory"
+      },
+      "queries": [
+        {
+          "description": "Thread objects, thread synchronization objects, and thread-specific storage pointers shall only be accessed by the appropriate Standard Library functions.",
+          "kind": "problem",
+          "name": "Standard library threading objects (mutexes, threads, etc.) shall only be accessed by the appropriate Standard Library functions",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "NonstandardUseOfThreadingObject",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "Thread objects, thread synchronization objects, and thread-specific storage pointers shall only be accessed by the appropriate Standard Library functions"
+    },
+    "RULE-22-13": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Thread objects, thread synchronization objects, and thread specific storage pointers shall have appropriate storage duration.",
+          "kind": "problem",
+          "name": "Threading objects (mutexes, threads, etc). shall have not have automatic or thread storage duration",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "ThreadingObjectWithInvalidStorageDuration",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "Thread objects, thread synchronization objects, and thread specific storage pointers shall have appropriate storage duration"
+    },
+    "RULE-22-14": {
+      "properties": {
+        "obligation": "mandatory"
+      },
+      "queries": [
+        {
+          "description": "Mutex and condition objects shall be initialized with the standard library functions before using them.",
+          "kind": "problem",
+          "name": "Thread synchronization objects shall be initialized before being accessed",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "MutexNotInitializedBeforeUse",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        },
+        {
+          "description": "Mutex and condition objects initialized inside of threads may result in indeterministic state.",
+          "kind": "problem",
+          "name": "Thread synchronization objects shall be initialized deterministically",
+          "precision": "high",
+          "severity": "recommendation",
+          "short_name": "MutexInitializedInsideThread",
+          "tags": [
+            "readability",
+            "maintainability",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        },
+        {
+          "description": "Mutexes shall be initialized with a valid mutex type.",
+          "kind": "problem",
+          "name": "Mutexes shall be initialized with a valid mutex type",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "MutexInitWithInvalidMutexType",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "Thread synchronization objects shall be initialized before being accessed"
+    },
+    "RULE-22-16": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Mutex not unlocked by thread on all execution paths in current thread after being locked.",
+          "kind": "problem",
+          "name": "All mutex objects locked by a thread shall be explicitly unlocked by the same thread",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "MutexObjectsNotAlwaysUnlocked",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "All mutex objects locked by a thread shall be explicitly unlocked by the same thread"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Concurrency9.json b/rule_packages/c/Concurrency9.json
new file mode 100644
index 0000000000..6ae1df8173
--- /dev/null
+++ b/rule_packages/c/Concurrency9.json
@@ -0,0 +1,158 @@
+{
+  "MISRA-C-2012": {
+    "DIR-5-1": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Threads shall not access the same memory location concurrently without utilization of thread synchronization objects.",
+          "kind": "problem",
+          "name": "There shall be no data races between threads",
+          "precision": "medium",
+          "severity": "error",
+          "short_name": "PossibleDataRaceBetweenThreads",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "There shall be no data races between threads"
+    },
+    "RULE-22-15": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Thread synchronization objects and thread-specific storage pointers shall not be destroyed until after all threads accessing them have terminated.",
+          "kind": "problem",
+          "name": "Thread synchronization objects and thread-specific storage pointers shall not be disposed unsafely",
+          "precision": "medium",
+          "severity": "error",
+          "short_name": "ThreadResourceDisposedBeforeThreadsJoined",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "Thread synchronization objects and thread-specific storage pointers shall not be destroyed until after all threads accessing them have terminated"
+    },
+    "RULE-22-17": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "No thread shall unlock a mutex or call cnd_wait() or cnd_timedwait() for a mutex it has not locked before.",
+          "kind": "problem",
+          "name": "No thread shall unlock a mutex or call cnd_wait() or cnd_timedwait() for a mutex it has not locked",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "InvalidOperationOnUnlockedMutex",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "No thread shall unlock a mutex or call cnd_wait() or cnd_timedwait() for a mutex it has not locked before"
+    },
+    "RULE-22-18": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Mutexes initialized with mtx_init() without mtx_recursive shall not be locked by a thread that has previously locked it.",
+          "kind": "problem",
+          "name": "Non-recursive mutexes shall not be recursively locked",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "NonRecursiveMutexRecursivelyLocked",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        },
+        {
+          "description": "Mutexes that may be initialized without mtx_recursive shall not be locked by a thread that may have previously locked it.",
+          "kind": "problem",
+          "name": "(Audit) Non-recursive mutexes shall not be recursively locked",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "NonRecursiveMutexRecursivelyLockedAudit",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4",
+            "external/misra/audit"
+          ]
+        }
+      ],
+      "title": "Non-recursive mutexes shall not be recursively locked"
+    },
+    "RULE-22-19": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Standard library functions cnd_wait() and cnd_timedwait() shall specify the same mutex object for each condition object in all calls.",
+          "kind": "problem",
+          "name": "A condition variable shall be associated with at most one mutex object",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "ConditionVariableUsedWithMultipleMutexes",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "A condition variable shall be associated with at most one mutex object"
+    },
+    "RULE-22-20": {
+      "properties": {
+        "obligation": "mandatory"
+      },
+      "queries": [
+        {
+          "description": "Thread specific storage pointers shall be initialized with the standard library functions before using them.",
+          "kind": "problem",
+          "name": "Thread-specific storage pointers shall be created before being accessed",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "ThreadStorageNotInitializedBeforeUse",
+          "tags": [
+            "correctness",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        },
+        {
+          "description": "Thread specific storage pointers initialized inside of threads may result in indeterministic state.",
+          "kind": "problem",
+          "name": "Thread specific storage pointers shall be initialized deterministically",
+          "precision": "very-high",
+          "severity": "recommendation",
+          "short_name": "ThreadStoragePointerInitializedInsideThread",
+          "tags": [
+            "readability",
+            "maintainability",
+            "concurrency",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "Thread-specific storage pointers shall be created before being accessed"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Contracts.json b/rule_packages/c/Contracts.json
new file mode 100644
index 0000000000..0d2e0a97bd
--- /dev/null
+++ b/rule_packages/c/Contracts.json
@@ -0,0 +1,94 @@
+{
+  "CERT-C": {
+    "MSC40-C": {
+      "properties": {
+        "obligation": "rule"
+      },
+      "queries": [
+        {
+          "description": "Inlined external functions are prohibited by the language standard from defining modifiable static or thread storage objects, or referencing identifiers with internal linkage.",
+          "kind": "problem",
+          "name": "Do not violate inline linkage constraints",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "DoNotViolateInLineLinkageConstraints",
+          "tags": [
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
+          ],
+          "implementation_scope": {
+            "description": "This query only considers the constraints related to inline extern functions."
+          }
+        }
+      ],
+      "title": "Do not violate constraints"
+    }
+  },
+  "MISRA-C-2012": {
+    "DIR-4-11": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Range, domain or pole errors in math functions may return unexpected values, trigger floating-point exceptions or set unexpected error modes.",
+          "kind": "problem",
+          "name": "The validity of values passed to `math.h` library functions shall be checked",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "CheckMathLibraryFunctionParameters",
+          "shared_implementation_short_name": "UncheckedRangeDomainPoleErrors",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/third-edition-first-revision"
+          ],
+          "implementation_scope": {
+            "description": "This query identifies possible domain, pole and range errors on a selection of C standard library fuctions from math.h."
+          }
+        },
+        {
+          "description": "Trigonometric periodic functions have significantly less precision when called with large floating-point values.",
+          "kind": "problem",
+          "name": "The validity of values passed to trigonometric functions shall be checked",
+          "precision": "high",
+          "severity": "warning",
+          "short_name": "LowPrecisionPeriodicTrigonometricFunctionCall",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/third-edition-first-revision",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "The validity of values passed to library functions shall be checked"
+    },
+    "DIR-4-7": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "A function (whether it is part of the standard library, a third party library or a user defined function) may provide some means of indicating the occurrence of an error. This may be via a global error flag, a parametric error flag, a special return value or some other means. Whenever such a mechanism is provided by a function the calling program shall check for the indication of an error as soon as the function returns.",
+          "kind": "problem",
+          "name": "If a function generates error information, then that error information shall be tested",
+          "precision": "very-high",
+          "severity": "recommendation",
+          "short_name": "FunctionErrorInformationUntested",
+          "shared_implementation_short_name": "FunctionErroneousReturnValueNotTested",
+          "tags": [
+            "maintainability",
+            "external/misra/c/2012/third-edition-first-revision"
+          ],
+          "implementation_scope": {
+            "description": "This query enforces checking on some C standard library functions that may return error codes."
+          }
+        }
+      ],
+      "title": "If a function returns error information, then that error information shall be tested"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Contracts1.json b/rule_packages/c/Contracts1.json
index 21641922af..65ffdc5e71 100644
--- a/rule_packages/c/Contracts1.json
+++ b/rule_packages/c/Contracts1.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotModifyTheReturnValueOfCertainFunctions",
           "shared_implementation_short_name": "ConstLikeReturnValue",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -33,7 +38,12 @@
           "severity": "error",
           "short_name": "EnvPointerIsInvalidAfterCertainOperations",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function."
diff --git a/rule_packages/c/Contracts2.json b/rule_packages/c/Contracts2.json
index b07f8f0503..6c1bf77de2 100644
--- a/rule_packages/c/Contracts2.json
+++ b/rule_packages/c/Contracts2.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "ExitHandlersMustReturnNormally",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -33,7 +38,12 @@
           "short_name": "DoNotStorePointersReturnedByEnvFunctions",
           "shared_implementation_short_name": "InvalidatedEnvStringPointers",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -45,7 +55,12 @@
           "short_name": "DoNotStorePointersReturnedByEnvironmentFunWarn",
           "shared_implementation_short_name": "InvalidatedEnvStringPointersWarn",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Contracts4.json b/rule_packages/c/Contracts4.json
index 8ba25ab32b..a62e9d1762 100644
--- a/rule_packages/c/Contracts4.json
+++ b/rule_packages/c/Contracts4.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "SetlocaleMightSetErrno",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -24,7 +29,12 @@
           "severity": "error",
           "short_name": "ErrnoReadBeforeReturn",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -35,7 +45,12 @@
           "severity": "error",
           "short_name": "FunctionCallBeforeErrnoCheck",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -46,7 +61,12 @@
           "severity": "error",
           "short_name": "ErrnoNotSetToZero",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/Contracts5.json b/rule_packages/c/Contracts5.json
index 9f62ce9255..d4b38b5756 100644
--- a/rule_packages/c/Contracts5.json
+++ b/rule_packages/c/Contracts5.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "DoNotRelyOnIndeterminateValuesOfErrno",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function."
@@ -35,7 +40,12 @@
           "severity": "error",
           "short_name": "DetectAndHandleStandardLibraryErrors",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function."
diff --git a/rule_packages/c/Contracts6.json b/rule_packages/c/Contracts6.json
index 4dbae7e121..d89617d6dc 100644
--- a/rule_packages/c/Contracts6.json
+++ b/rule_packages/c/Contracts6.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "DoNotModifyConstantObjects",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The implementation does not consider pointer aliasing via multiple indirection."
@@ -26,7 +31,7 @@
   "MISRA-C-2012": {
     "RULE-17-5": {
       "properties": {
-        "obligation": "advisory"
+        "obligation": "required"
       },
       "queries": [
         {
diff --git a/rule_packages/c/Contracts7.json b/rule_packages/c/Contracts7.json
index f76b737db1..95df01ca32 100644
--- a/rule_packages/c/Contracts7.json
+++ b/rule_packages/c/Contracts7.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotPassInvalidDataToTheAsctimeFunction",
           "tags": [
             "security",
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p27",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -33,7 +38,12 @@
           "severity": "error",
           "short_name": "DoNotCallVaArgOnAVaListThatHasAnIndeterminateValue",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/DeadCode2.json b/rule_packages/c/DeadCode2.json
new file mode 100644
index 0000000000..8b373c31b6
--- /dev/null
+++ b/rule_packages/c/DeadCode2.json
@@ -0,0 +1,42 @@
+{
+  "MISRA-C-2012": {
+    "RULE-2-8": {
+      "properties": {
+        "obligation": "advisory"
+      },
+      "queries": [
+        {
+          "description": "Object definitions which are unused should be removed.",
+          "kind": "problem",
+          "name": "A project should not contain unused object definitions",
+          "precision": "very-high",
+          "severity": "recommendation",
+          "short_name": "UnusedObjectDefinition",
+          "tags": [
+            "maintainability",
+            "performance",
+            "external/misra/c/2012/amendment4"
+          ]
+        },
+        {
+          "description": "A strict query which reports all unused object definitions with '__attribute__((unused))'.",
+          "kind": "problem",
+          "name": "A project should not contain '__attribute__((unused))' object definitions",
+          "precision": "very-high",
+          "severity": "recommendation",
+          "short_name": "UnusedObjectDefinitionStrict",
+          "tags": [
+            "maintainability",
+            "performance",
+            "external/misra/c/2012/amendment4",
+            "external/misra/c/strict"
+          ]
+        }
+      ],
+      "title": "A project should not contain unused object definitions",
+      "implementation_scope": {
+        "description": "Unused object definitions marked with `__attribute__((unused))` (and `used`, `maybe_used`, `cleanup`) are separately reported under the 'strict' query suite. This is because these attributes strongly indicate the contravention is intentional, and a deviation report alone will not suppress compiler warnings."
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Declarations1.json b/rule_packages/c/Declarations1.json
index 90202a5b52..dba6a07eeb 100644
--- a/rule_packages/c/Declarations1.json
+++ b/rule_packages/c/Declarations1.json
@@ -15,7 +15,12 @@
           "shared_implementation_short_name": "TypeOmitted",
           "tags": [
             "correctness",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query does not check for implicitly typed parameters, typedefs or member declarations as this is partially compiler checked.",
@@ -41,7 +46,12 @@
           "tags": [
             "correctness",
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query does not consider identifiers described in the future library directions section of the standard. This query also checks for any reserved identifier as declared regardless of whether its header file is included or not.",
diff --git a/rule_packages/c/Declarations2.json b/rule_packages/c/Declarations2.json
index 9acb117d1e..c5b827e682 100644
--- a/rule_packages/c/Declarations2.json
+++ b/rule_packages/c/Declarations2.json
@@ -15,7 +15,12 @@
           "tags": [
             "correctness",
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -37,7 +42,12 @@
           "tags": [
             "correctness",
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query considers the first 31 characters of identifiers as significant, as per C99 and reports the case when names are longer than 31 characters and differ in those characters past the 31 first only. This query does not consider universal or extended source characters.",
@@ -54,7 +64,12 @@
           "tags": [
             "correctness",
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -67,7 +82,12 @@
           "tags": [
             "correctness",
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -88,7 +108,12 @@
           "tags": [
             "correctness",
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Declarations7.json b/rule_packages/c/Declarations7.json
index cdb74123b1..86818cdcb5 100644
--- a/rule_packages/c/Declarations7.json
+++ b/rule_packages/c/Declarations7.json
@@ -14,7 +14,12 @@
           "short_name": "InformationLeakageAcrossTrustBoundariesC",
           "shared_implementation_short_name": "InformationLeakageAcrossBoundaries",
           "tags": [
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p1",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The rule does not detect cases where fields may have uninitialized padding but are initialized via an initializer."
diff --git a/rule_packages/c/Declarations8.json b/rule_packages/c/Declarations8.json
index a70523b72f..6275e32595 100644
--- a/rule_packages/c/Declarations8.json
+++ b/rule_packages/c/Declarations8.json
@@ -14,7 +14,12 @@
           "short_name": "AppropriateStorageDurationsStackAdressEscape",
           "shared_implementation_short_name": "DoNotCopyAddressOfAutoStorageObjectToOtherObject",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "The rule checks specifically for pointers to objects with automatic storage duration that are assigned to static storage duration variables."
@@ -28,7 +33,12 @@
           "severity": "error",
           "short_name": "AppropriateStorageDurationsFunctionReturn",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "The rule checks specifically for pointers to objects with automatic storage duration that are returned by functions or assigned to function output parameters."
diff --git a/rule_packages/c/Declarations9.json b/rule_packages/c/Declarations9.json
new file mode 100644
index 0000000000..ebfcf7c41f
--- /dev/null
+++ b/rule_packages/c/Declarations9.json
@@ -0,0 +1,25 @@
+{
+  "MISRA-C-2012": {
+    "RULE-11-10": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Conversions between types by using an _Atomic void type may result in undefined behavior.",  
+          "kind": "problem",
+          "name": "The _Atomic qualifier shall not be applied to the incomplete type void",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "AtomicQualifierAppliedToVoid",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/third-edition-first-revision",
+            "external/misra/c/2012/amendment4"
+          ]
+        }
+      ],
+      "title": "The _Atomic qualifier shall not be applied to the incomplete type void"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/EssentialTypes2.json b/rule_packages/c/EssentialTypes2.json
new file mode 100644
index 0000000000..5292eccdb8
--- /dev/null
+++ b/rule_packages/c/EssentialTypes2.json
@@ -0,0 +1,47 @@
+{
+  "MISRA-C-2012": {
+    "RULE-21-22": {
+      "properties": {
+        "obligation": "mandatory"
+      },
+      "queries": [
+        {
+          "description": "All operand arguments to any type-generic macros in <tgmath.h> shall have an appropriate essential type.",
+          "kind": "problem",
+          "name": "All operand arguments to type-generic macros in <tgmath.h> shall have an appropriate essential type",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "TgMathArgumentWithInvalidEssentialType",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "implementation_scope": {
+        "description": "The CodeQL database may not contain the necessary information to determine the essential type of literal macro arguments such as character literals."
+      },
+      "title": "All operand arguments to any type-generic macros in <tgmath.h> shall have an appropriate essential type"
+    },
+    "RULE-21-23": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "All operand arguments to any multi-argument type-generic macros in <tgmath.h> shall have the same standard type.",
+          "kind": "problem",
+          "name": "Operand arguments for an invocation of a type-generic macro shall have the same standard type",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "TgMathArgumentsWithDifferingStandardType",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "All operand arguments to any multi-argument type-generic macros in <tgmath.h> shall have the same standard type"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Expressions.json b/rule_packages/c/Expressions.json
index 9d1f8b16a7..9be722b761 100644
--- a/rule_packages/c/Expressions.json
+++ b/rule_packages/c/Expressions.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "DoNotCallFunctionPointerWithIncompatibleType",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query raises a result for a function assigned to a function pointer of an incompatible type even if the function pointer is never eventually called."
@@ -27,7 +32,12 @@
           "severity": "error",
           "short_name": "DoNotCallFunctionsWithIncompatibleArguments",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -39,7 +49,12 @@
           "short_name": "CallPOSIXOpenWithCorrectArgumentCount",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The analysis of invalid parameter count passed to POSIX open calls only applies when the value of the flags argument is computed locally."
@@ -62,7 +77,12 @@
           "short_name": "DoNotUseABitwiseOperatorWithABooleanLikeOperand",
           "tags": [
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/Expressions2.json b/rule_packages/c/Expressions2.json
new file mode 100644
index 0000000000..d639ae2c34
--- /dev/null
+++ b/rule_packages/c/Expressions2.json
@@ -0,0 +1,28 @@
+{
+  "CERT-C": {
+    "EXP16-C": {
+      "properties": {
+        "obligation": "recommendation"
+      },
+      "queries": [
+        {
+          "description": "Comparing function pointers to a constant value is not reliable and likely indicates a programmer error.",
+          "kind": "problem",
+          "name": "Do not compare function pointers to constant values",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "DoNotCompareFunctionPointersToConstantValues",
+          "tags": [
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
+          ]
+        }
+      ],
+      "title": "Do not compare function pointers to constant values"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/FloatingTypes.json b/rule_packages/c/FloatingTypes.json
index 1dfd663597..17690574e5 100644
--- a/rule_packages/c/FloatingTypes.json
+++ b/rule_packages/c/FloatingTypes.json
@@ -14,8 +14,16 @@
           "short_name": "UncheckedRangeDomainPoleErrors",
           "shared_implementation_short_name": "UncheckedRangeDomainPoleErrors",
           "tags": [
-            "correctness"
-          ]
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
+          ],
+          "implementation_scope": {
+            "description": "This query identifies possible domain, pole and range errors on a selection of C standard library fuctions from math.h."
+          }
         }
       ],
       "title": "Prevent or detect domain and range errors in math functions"
@@ -33,7 +41,12 @@
           "severity": "error",
           "short_name": "UncheckedFloatingPointConversion",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -52,7 +65,12 @@
           "severity": "error",
           "short_name": "IntToFloatPreservePrecision",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -71,7 +89,12 @@
           "severity": "error",
           "short_name": "MemcmpUsedToCompareFloats",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/FloatingTypes2.json b/rule_packages/c/FloatingTypes2.json
new file mode 100644
index 0000000000..a1c02daaf5
--- /dev/null
+++ b/rule_packages/c/FloatingTypes2.json
@@ -0,0 +1,38 @@
+{
+  "MISRA-C-2012": {
+    "DIR-4-15": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Evaluation of floating-point expressions shall not lead to the undetected generation of infinities.",
+          "kind": "path-problem",
+          "name": "Evaluation of floating-point expressions shall not lead to the undetected generation of infinities",
+          "precision": "medium",
+          "severity": "warning",
+          "short_name": "PossibleMisuseOfUndetectedInfinity",
+          "shared_implementation_short_name": "MisuseOfInfiniteFloatingPointValue",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
+        },
+        {
+          "description": "Evaluation of floating-point expressions shall not lead to the undetected generation of NaNs.",
+          "kind": "path-problem",
+          "name": "Evaluation of floating-point expressions shall not lead to the undetected generation of NaNs",
+          "precision": "low",
+          "severity": "warning",
+          "short_name": "PossibleMisuseOfUndetectedNaN",
+          "shared_implementation_short_name": "MisuseOfNaNFloatingPointValue",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "Evaluation of floating-point expressions shall not lead to the undetected generation of infinities and NaNs"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/Generics.json b/rule_packages/c/Generics.json
new file mode 100644
index 0000000000..02c7cb2364
--- /dev/null
+++ b/rule_packages/c/Generics.json
@@ -0,0 +1,191 @@
+{
+  "MISRA-C-2012": {
+    "RULE-23-1": {
+      "properties": {
+        "obligation": "advisory"
+      },
+      "queries": [
+        {
+          "description": "A generic selection should only be expanded from a macro.",
+          "kind": "problem",
+          "name": "A generic selection should only be expanded from a macro",
+          "precision": "very-high",
+          "severity": "warning",
+          "short_name": "GenericSelectionNotExpandedFromAMacro",
+          "tags": [
+            "maintainability",
+            "external/misra/c/2012/amendment3"
+          ]
+        },
+        {
+          "description": "A generic selection should depend on the type of a macro argument.",
+          "kind": "problem",
+          "name": "A generic selection should depend on the type of a macro argument",
+          "precision": "high",
+          "severity": "warning",
+          "short_name": "GenericSelectionDoesntDependOnMacroArgument",
+          "tags": [
+            "correctness",
+            "maintainability",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "A generic selection should only be expanded from a macro"
+    },
+    "RULE-23-2": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "A generic selection that is not expanded from a macro shall not contain potential side effects in the controlling expression.",
+          "kind": "problem",
+          "name": "A generic selection shall not contain side-effects if it is not expanded from a macro",
+          "precision": "high",
+          "severity": "warning",
+          "short_name": "GenericSelectionNotFromMacroWithSideEffects",
+          "tags": [
+            "maintainability",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "implementation_scope": {
+        "description":
+          "Due to limited information in the CodeQL database for macro argument expansions, this implementation reports generics not of the form `_Generic((X)` where all invocations of that generic contain a side effect in the controlling expression."
+      },
+      "title": "A generic selection that is not expanded from a macro shall not contain potential side effects in the controlling expression"
+    },
+    "RULE-23-3": {
+      "properties": {
+        "obligation": "advisory"
+      },
+      "queries": [
+        {
+          "description": "A generic selection should contain at least one non-default association.",
+          "kind": "problem",
+          "name": "A generic selection should contain at least one non-default association",
+          "precision": "very-high",
+          "severity": "warning",
+          "short_name": "GenericWithoutNonDefaultAssociation",
+          "tags": [
+            "correctness",
+            "maintainability",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "A generic selection should contain at least one non-default association"
+    },
+    "RULE-23-4": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "Generic selections undergo lvalue conversion before type comparison, leading to certain types being impossible to select.",
+          "kind": "problem",
+          "name": "A generic association shall list an appropriate type",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "GenericAssociationWithUnselectableType",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "A generic association shall list an appropriate type"
+    },
+    "RULE-23-5": {
+      "properties": {
+        "obligation": "advisory"
+      },
+      "queries": [
+        {
+          "description": "Pointer types in a generic selection do not undergo pointer conversions and should not counterintuitively fall through to the default association.",
+          "kind": "problem",
+          "name": "A generic selection should not depend on implicit pointer type conversion",
+          "precision": "very-high",
+          "severity": "warning",
+          "short_name": "DangerousDefaultSelectionForPointerInGeneric",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "A generic selection should not depend on implicit pointer type conversion"
+    },
+    "RULE-23-6": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "The controlling expression of a generic selection shall have an essential type that matches its standard type.",
+          "kind": "problem",
+          "name": "The controlling expression of a generic selection shall have an essential type that matches its standard type",
+          "precision": "high",
+          "severity": "error",
+          "short_name": "GenericExpressionWithIncorrectEssentialType",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "implementation_scope": {
+        "description":
+          "The CodeQL extractor will expand character literals passed into macros into integer literals, and therefore the essential type system for character literals will not necessarily be analyzed correctly."
+      },
+      "title": "The controlling expression of a generic selection shall have an essential type that matches its standard type"
+    },
+    "RULE-23-7": {
+      "properties": {
+        "obligation": "advisory"
+      },
+      "queries": [
+        {
+          "description": "A generic selection that is expanded from a macro should evaluate its argument only once.",
+          "kind": "problem",
+          "name": "A generic selection that is expanded from a macro should evaluate its argument only once",
+          "precision": "medium",
+          "severity": "warning",
+          "short_name": "InvalidGenericMacroArgumentEvaluation",
+          "tags": [
+            "correctness",
+            "maintainability",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "implementation_scope": {
+        "description":
+          "Due to limited information in the CodeQL database for macro argument expansions, this implementation performs string matching on the macro parameters against the macro body to determine where parameters are expanded. If text indicating a nonevaluated context such as sizeof() or _Alignof() appear, there will be no positive result."
+      },
+      "title": "A generic selection that is expanded from a macro should evaluate its argument only once"
+    },
+    "RULE-23-8": {
+      "properties": {
+        "obligation": "required"
+      },
+      "queries": [
+        {
+          "description": "A default association shall appear as either the first or the last association of a generic selection.",
+          "kind": "problem",
+          "name": "A default association shall appear as either the first or the last association of a generic",
+          "precision": "very-high",
+          "severity": "warning",
+          "short_name": "DefaultGenericSelectionNotFirstOrLast",
+          "tags": [
+            "maintainability",
+            "external/misra/c/2012/amendment3"
+          ]
+        }
+      ],
+      "title": "A default association shall appear as either the first or the last association of a generic selection"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/c/IO1.json b/rule_packages/c/IO1.json
index f5b9ec8b0e..8a42c4e52a 100644
--- a/rule_packages/c/IO1.json
+++ b/rule_packages/c/IO1.json
@@ -15,7 +15,12 @@
           "shared_implementation_short_name": "NonConstantFormat",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -35,7 +40,12 @@
           "short_name": "DistinguishBetweenCharReadFromAFileAndEofOrWeof",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function. The query does not validate if the FILE status is handled correctly after being read."
@@ -50,7 +60,12 @@
           "short_name": "EndOfFileCheckPortability",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function. The query does not validate if the FILE status is handled correctly after being read."
@@ -73,7 +88,12 @@
           "short_name": "DoNotAlternatelyIOFromAStreamWithoutPositioning",
           "shared_implementation_short_name": "IOFstreamMissingPositioning",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function."
@@ -97,7 +117,12 @@
           "shared_implementation_short_name": "CloseFileHandleWhenNoLongerNeededShared",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function."
@@ -120,7 +145,12 @@
           "short_name": "UndefinedBehaviorAccessingAClosedFile",
           "shared_implementation_short_name": "DoNotAccessAClosedFile",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function."
diff --git a/rule_packages/c/IO2.json b/rule_packages/c/IO2.json
index 41c14a0d0e..69c12d7723 100644
--- a/rule_packages/c/IO2.json
+++ b/rule_packages/c/IO2.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotCopyAFileObject",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -34,7 +39,12 @@
           "short_name": "ResetStringsOnFgetsOrFgetwsFailure",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -53,7 +63,12 @@
           "severity": "error",
           "short_name": "DoNotCallGetcAndPutcWithSideEffects",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -72,7 +87,12 @@
           "severity": "error",
           "short_name": "OnlyUseValuesForFsetposThatAreReturnedFromFgetpos",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/IO3.json b/rule_packages/c/IO3.json
index 52276eb05c..af6e9da732 100644
--- a/rule_packages/c/IO3.json
+++ b/rule_packages/c/IO3.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotPerformFileOperationsOnDevices",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The rule checks that filenames are not tainted. It does not verify that appropriate OS-specific checks are in place to exclude that the opened file is a device."
@@ -36,7 +41,12 @@
           "severity": "error",
           "short_name": "SuccessfulFgetsOrFgetwsMayReturnAnEmptyString",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "The rule checks that access to a string returned by fgets() or fgetws() if protected by a guard condition. The rule is enforced in the context of a single function."
diff --git a/rule_packages/c/IO4.json b/rule_packages/c/IO4.json
index 1303f9b50f..8d9c150335 100644
--- a/rule_packages/c/IO4.json
+++ b/rule_packages/c/IO4.json
@@ -14,7 +14,12 @@
           "short_name": "ToctouRaceConditionsWhileAccessingFiles",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "The query is limited to the specific class of TOCTOU race conditions that derives from the incorrectuse of `fopen` to check the existence of a file."
@@ -37,7 +42,12 @@
           "short_name": "UseValidSpecifiers",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -49,7 +59,12 @@
           "short_name": "WrongNumberOfFormatArguments",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -61,7 +76,12 @@
           "short_name": "WrongTypeFormatArguments",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/IntegerOverflow.json b/rule_packages/c/IntegerOverflow.json
index a7897fad9e..f528d3d542 100644
--- a/rule_packages/c/IntegerOverflow.json
+++ b/rule_packages/c/IntegerOverflow.json
@@ -15,7 +15,12 @@
           "shared_implementation_short_name": "UnsignedOperationWithConstantOperandsWraps",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -34,7 +39,12 @@
           "severity": "error",
           "short_name": "IntegerConversionCausesDataLoss",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -54,7 +64,12 @@
           "short_name": "SignedIntegerOverflow",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -73,7 +88,12 @@
           "severity": "error",
           "short_name": "DivOrRemByZero",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -92,7 +112,12 @@
           "severity": "error",
           "short_name": "UseCorrectIntegerPrecisions",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/InvalidMemory1.json b/rule_packages/c/InvalidMemory1.json
index 227ec37558..3b0a6bb40c 100644
--- a/rule_packages/c/InvalidMemory1.json
+++ b/rule_packages/c/InvalidMemory1.json
@@ -15,7 +15,12 @@
           "short_name": "DoNotReadUninitializedMemory",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -35,7 +40,12 @@
           "shared_implementation_short_name": "DereferenceOfNullPointer",
           "short_name": "DoNotDereferenceNullPointers",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -55,7 +65,12 @@
           "short_name": "DoNotAccessFreedMemory",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rule_packages/c/InvalidMemory2.json b/rule_packages/c/InvalidMemory2.json
index cb7d380159..025a5d246c 100644
--- a/rule_packages/c/InvalidMemory2.json
+++ b/rule_packages/c/InvalidMemory2.json
@@ -14,7 +14,12 @@
           "short_name": "VariableLengthArraySizeNotInValidRange",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -33,7 +38,12 @@
           "severity": "error",
           "short_name": "DoNotUsePointerArithmeticOnNonArrayObjectPointers",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -52,7 +62,12 @@
           "severity": "error",
           "short_name": "DoNotModifyObjectsWithTemporaryLifetime",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This implementation also always reports non-modifying accesses of objects with temporary lifetime, which are only compliant in C11."
diff --git a/rule_packages/c/Memory2.json b/rule_packages/c/Memory2.json
index 358d482194..55a7dd2a35 100644
--- a/rule_packages/c/Memory2.json
+++ b/rule_packages/c/Memory2.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotSubtractPointersThatDoNotReferToTheSameArray",
           "shared_implementation_short_name": "DoNotSubtractPointersAddressingDifferentArrays",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -26,7 +31,12 @@
           "short_name": "DoNotRelatePointersThatDoNotReferToTheSameArray",
           "shared_implementation_short_name": "DoNotUseRelationalOperatorsWithDifferingArrays",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -46,7 +56,12 @@
           "short_name": "DoNotComparePaddingData",
           "shared_implementation_short_name": "MemcmpUsedToComparePaddingData",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -67,7 +82,12 @@
           "shared_implementation_short_name": "FreeMemoryWhenNoLongerNeededShared",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "The rule is enforced in the context of a single function."
@@ -89,7 +109,12 @@
           "severity": "error",
           "short_name": "AllocStructsWithAFlexibleArrayMemberDynamically",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -100,7 +125,12 @@
           "severity": "error",
           "short_name": "CopyStructsWithAFlexibleArrayMemberDynamically",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -121,7 +151,12 @@
           "shared_implementation_short_name": "OnlyFreeMemoryAllocatedDynamicallyShared",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -141,7 +176,12 @@
           "short_name": "DoNotModifyAlignmentOfMemoryWithRealloc",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Memory3.json b/rule_packages/c/Memory3.json
index 6eafcc6509..e1ed7382e0 100644
--- a/rule_packages/c/Memory3.json
+++ b/rule_packages/c/Memory3.json
@@ -14,7 +14,12 @@
           "short_name": "InsufficientMemoryAllocatedForObject",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/Misc.json b/rule_packages/c/Misc.json
index bba96db85c..183c05988b 100644
--- a/rule_packages/c/Misc.json
+++ b/rule_packages/c/Misc.json
@@ -14,7 +14,12 @@
           "short_name": "RandUsedForGeneratingPseudorandomNumbers",
           "shared_implementation_short_name": "DoNotUseRandForGeneratingPseudorandomNumbers",
           "tags": [
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -33,7 +38,12 @@
           "severity": "error",
           "short_name": "ProperlySeedPseudorandomNumberGenerators",
           "tags": [
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "This rule will be checked by looking for calls to random that are no preceded by a call to srandom(). We perform a simple check for the argument to srandom() and verify it is not a literal (or a value easily deduced to be a literal)."
@@ -56,7 +66,12 @@
           "short_name": "ControlFlowReachesTheEndOfANonVoidFunction",
           "shared_implementation_short_name": "NonVoidFunctionDoesNotReturn",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/OutOfBounds.json b/rule_packages/c/OutOfBounds.json
index 759b68e294..3354348230 100644
--- a/rule_packages/c/OutOfBounds.json
+++ b/rule_packages/c/OutOfBounds.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotFormOutOfBoundsPointersOrArraySubscripts",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -34,7 +39,12 @@
           "short_name": "LibraryFunctionArgumentOutOfBounds",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rule_packages/c/Pointers1.json b/rule_packages/c/Pointers1.json
index 29b658d823..1b54fc1fb6 100644
--- a/rule_packages/c/Pointers1.json
+++ b/rule_packages/c/Pointers1.json
@@ -244,7 +244,7 @@
           ]
         }
       ],
-      "title": "The relational operators >, >=, < and <= shall not be applied to objects of pointer type except where they point into the same object"
+      "title": "The relational operators >, >=, < and <= shall not be applied to expressions of pointer type except where they point into the same object"
     },
     "RULE-18-4": {
       "properties": {
@@ -305,6 +305,18 @@
             "correctness",
             "external/misra/c/2012/third-edition-first-revision"
           ]
+        },
+        {
+          "description": "Storing the address of a thread-local object in a global object will result in undefined behavior if the address is accessed after the relevant thread is terminated.",
+          "kind": "problem",
+          "name": "The address of an object with thread-local storage shall not be copied to a global object",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "ThreadLocalObjectAddressCopiedToGlobalObject",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
         }
       ],
       "title": "The address of an object with automatic storage shall not be copied to another object that persists after the first object has ceased to exist"
diff --git a/rule_packages/c/Pointers2.json b/rule_packages/c/Pointers2.json
index 9abf4c98ce..fcfd9356e6 100644
--- a/rule_packages/c/Pointers2.json
+++ b/rule_packages/c/Pointers2.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "DoNotAddOrSubtractAScaledIntegerToAPointer",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/Pointers3.json b/rule_packages/c/Pointers3.json
index f35f5b7bd1..8a169b71a8 100644
--- a/rule_packages/c/Pointers3.json
+++ b/rule_packages/c/Pointers3.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "DoNotAccessVolatileObjectWithNonVolatileReference",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "In limited cases, this query can raise false-positives for assignment of volatile objects and subsequent accesses of those objects via non-volatile pointers."
@@ -35,7 +40,12 @@
           "severity": "error",
           "short_name": "DoNotCastPointerToMoreStrictlyAlignedPointerType",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -54,7 +64,12 @@
           "severity": "error",
           "short_name": "DoNotAccessVariableViaPointerOfIncompatibleType",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -74,7 +89,12 @@
           "short_name": "DoNotPassAliasedPointerToRestrictQualifiedParam",
           "shared_implementation_short_name": "DoNotPassAliasedPointerToRestrictQualifiedParamShared",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -85,7 +105,12 @@
           "severity": "error",
           "short_name": "RestrictPointerReferencesOverlappingObject",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Preprocessor5.json b/rule_packages/c/Preprocessor5.json
index ef17b83c00..60a1752e73 100644
--- a/rule_packages/c/Preprocessor5.json
+++ b/rule_packages/c/Preprocessor5.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotTreatAPredefinedIdentifierAsObject",
           "tags": [
             "correctness",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query reports locations corresponding to both redefinitions of those standard library macros as well as locations where the identifiers used for accesses.",
@@ -38,7 +43,12 @@
           "short_name": "MacroOrFunctionArgsContainHashToken",
           "tags": [
             "correctness",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This query defines end of function call as the next node in the control flow graph.",
diff --git a/rule_packages/c/SideEffects1.json b/rule_packages/c/SideEffects1.json
index 9ecb79447d..4dec3d8bbf 100644
--- a/rule_packages/c/SideEffects1.json
+++ b/rule_packages/c/SideEffects1.json
@@ -13,7 +13,12 @@
           "severity": "warning",
           "short_name": "DependenceOnOrderOfScalarEvaluationForSideEffects",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -24,7 +29,12 @@
           "severity": "warning",
           "short_name": "DependenceOnOrderOfFunctionArgumentsForSideEffects",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -43,7 +53,12 @@
           "severity": "error",
           "short_name": "UnevaluatedOperandWithSideEffect",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -62,7 +77,12 @@
           "severity": "error",
           "short_name": "AssignmentsInSelectionStatements",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -166,7 +186,7 @@
     },
     "RULE-13-6": {
       "properties": {
-        "obligation": "mandatory"
+        "obligation": "required"
       },
       "queries": [
         {
diff --git a/rule_packages/c/SideEffects3.json b/rule_packages/c/SideEffects3.json
index 2bf91d77b9..1ff29ec166 100644
--- a/rule_packages/c/SideEffects3.json
+++ b/rule_packages/c/SideEffects3.json
@@ -16,6 +16,18 @@
             "correctness",
             "external/misra/c/2012/third-edition-first-revision"
           ]
+        },
+        {
+          "description": "The value of an atomic variable shall not depend on evaluation order and interleaving of threads.",
+          "kind": "problem",
+          "name": "The value of an atomic variable shall not depend on the evaluation order of interleaved threads",
+          "precision": "very-high",
+          "severity": "error",
+          "short_name": "UnsequencedAtomicReads",
+          "tags": [
+            "correctness",
+            "external/misra/c/2012/amendment3"
+          ]
         }
       ],
       "title": "The value of an expression and its persistent side effects shall be the same under all permitted evaluation orders"
diff --git a/rule_packages/c/SideEffects4.json b/rule_packages/c/SideEffects4.json
index 77121019de..5b0c6da3f5 100644
--- a/rule_packages/c/SideEffects4.json
+++ b/rule_packages/c/SideEffects4.json
@@ -13,7 +13,12 @@
           "severity": "error",
           "short_name": "SideEffectsInArgumentsToUnsafeMacros",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "This implementation only considers ++ and function call side effects. Due to the textual nature of macro expansion it is not always possible to determine accurately whether a side-effect was produced by a particular argument, and this may cause both false positives and false negatives. The query does not consider the case where a macro argument including a side-effect is never evaluated."
diff --git a/rule_packages/c/SignalHandlers.json b/rule_packages/c/SignalHandlers.json
index 0ceaa5914d..ae9045a64d 100644
--- a/rule_packages/c/SignalHandlers.json
+++ b/rule_packages/c/SignalHandlers.json
@@ -14,7 +14,12 @@
           "short_name": "CallOnlyAsyncSafeFunctionsWithinSignalHandlers",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -34,7 +39,12 @@
           "short_name": "DoNotAccessSharedObjectsInSignalHandlers",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ],
           "implementation_scope": {
             "description": "The implementation does not verify the correct usage of `atomic_is_lock_free`."
@@ -57,7 +67,12 @@
           "short_name": "DoNotCallSignalFromInterruptibleSignalHandlers",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -77,7 +92,12 @@
           "short_name": "DoNotReturnFromAComputationalExceptionHandler",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p1",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Statements4.json b/rule_packages/c/Statements4.json
index 5b0cc9be26..e770fe032a 100644
--- a/rule_packages/c/Statements4.json
+++ b/rule_packages/c/Statements4.json
@@ -15,7 +15,12 @@
           "tags": [
             "maintainability",
             "readability",
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/c/Statements5.json b/rule_packages/c/Statements5.json
index 329819b61f..03380f4897 100644
--- a/rule_packages/c/Statements5.json
+++ b/rule_packages/c/Statements5.json
@@ -20,6 +20,9 @@
           ]
         }
       ],
+      "implementation_scope": {
+        "description": "Not all invariant logical expressions which contain dynamic values are detected to be invariant, for instance, `x < 3 && x > 5` where x does not have a statically known value."
+      },
       "title": "Controlling expressions shall not be invariant"
     },
     "RULE-15-5": {
diff --git a/rule_packages/c/Strings1.json b/rule_packages/c/Strings1.json
index 39529df3cc..c4565fc898 100644
--- a/rule_packages/c/Strings1.json
+++ b/rule_packages/c/Strings1.json
@@ -14,7 +14,12 @@
           "short_name": "DoNotAttemptToModifyStringLiterals",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -34,7 +39,12 @@
           "short_name": "StringsHasSufficientSpaceForTheNullTerminator",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "The enforcement of this rule does not try to approximate the effects of loops and as such may not find cases where a loop operation on a string fails to null terminate a string (or causes an overflow)."
@@ -57,7 +67,12 @@
           "short_name": "NonNullTerminatedToFunctionThatExpectsAString",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "Wide character types are not handled correctly on the `aarch64le` architecture. This can lead to false negative alerts."
diff --git a/rule_packages/c/Strings2.json b/rule_packages/c/Strings2.json
index 99f5e240d7..a32b1b4c28 100644
--- a/rule_packages/c/Strings2.json
+++ b/rule_packages/c/Strings2.json
@@ -14,7 +14,12 @@
           "short_name": "ToCharacterHandlingFunctionsRepresentableAsUChar",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/c/Strings3.json b/rule_packages/c/Strings3.json
index 9456f4b422..c9003f2ff8 100644
--- a/rule_packages/c/Strings3.json
+++ b/rule_packages/c/Strings3.json
@@ -12,9 +12,15 @@
           "precision": "very-high",
           "severity": "error",
           "short_name": "CastCharBeforeConvertingToLargerSizes",
+          "shared_implementation_short_name": "CastCharBeforeConvertingToLargerSizes",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -34,7 +40,12 @@
           "short_name": "DoNotConfuseNarrowAndWideFunctions",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p27",
+            "external/cert/level/l1"
           ],
           "implementation_scope": {
             "description": "Wide character types are not handled correctly on the `aarch64le` architecture. This can lead to false negative alerts."
diff --git a/rule_packages/c/Types1.json b/rule_packages/c/Types1.json
index cbf7f0b632..bb451eba70 100644
--- a/rule_packages/c/Types1.json
+++ b/rule_packages/c/Types1.json
@@ -12,7 +12,13 @@
           "precision": "very-high",
           "severity": "error",
           "short_name": "ExprShiftedbyNegativeOrGreaterPrecisionOperand",
-          "tags": []
+          "tags": [
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
+          ]
         }
       ],
       "title": "Do not shift an expression by a negative number of bits or by greater than or equal to the number of bits that exist in the operand"
@@ -29,7 +35,13 @@
           "precision": "very-high",
           "severity": "error",
           "short_name": "ConvertingAPointerToIntegerOrIntegerToPointer",
-          "tags": []
+          "tags": [
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
+          ]
         }
       ],
       "title": "Converting a pointer to integer or integer to pointer"
diff --git a/rule_packages/cpp/Allocations.json b/rule_packages/cpp/Allocations.json
index 6b40523e16..416cd3b567 100644
--- a/rule_packages/cpp/Allocations.json
+++ b/rule_packages/cpp/Allocations.json
@@ -197,7 +197,12 @@
           "short_name": "ProperlyDeallocateDynamicallyAllocatedResources",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -216,7 +221,12 @@
           "severity": "error",
           "short_name": "DetectAndHandleMemoryAllocationErrors",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -235,7 +245,12 @@
           "severity": "error",
           "short_name": "MissingConstructorCallForManuallyManagedObject",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         },
         {
@@ -246,7 +261,12 @@
           "severity": "error",
           "short_name": "MissingDestructorCallForManuallyManagedObject",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -267,7 +287,12 @@
           "shared_implementation_short_name": "PlacementNewNotProperlyAligned",
           "tags": [
             "security",
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         },
         {
@@ -280,7 +305,12 @@
           "shared_implementation_short_name": "PlacementNewInsufficientStorage",
           "tags": [
             "security",
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -300,7 +330,12 @@
           "short_name": "ThrowingOperatorNewReturnsNullCert",
           "shared_implementation_short_name": "ThrowingOperatorNewReturnsNull",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         },
         {
@@ -312,7 +347,12 @@
           "short_name": "ThrowingOperatorNewThrowsInvalidExceptionCert",
           "shared_implementation_short_name": "ThrowingOperatorNewThrowsInvalidException",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         },
         {
@@ -324,7 +364,12 @@
           "short_name": "ThrowingNoThrowOperatorNewDeleteCert",
           "shared_implementation_short_name": "ThrowingNoThrowOperatorNewDelete",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         },
         {
@@ -336,7 +381,12 @@
           "short_name": "OperatorDeleteMissingPartnerCert",
           "shared_implementation_short_name": "OperatorDeleteMissingPartner",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -356,7 +406,12 @@
           "short_name": "UsingDefaultOperatorNewForOverAlignedTypes",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/BannedFunctions.json b/rule_packages/cpp/BannedFunctions.json
index 8ef93db1a0..6cdb019ace 100644
--- a/rule_packages/cpp/BannedFunctions.json
+++ b/rule_packages/cpp/BannedFunctions.json
@@ -215,7 +215,12 @@
           "shared_implementation_short_name": "DoNotUseSetjmpOrLongjmpShared",
           "tags": [
             "correctness",
-            "scope/single-translation-unit"
+            "scope/single-translation-unit",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -236,7 +241,12 @@
           "shared_implementation_short_name": "DoNotUseRandForGeneratingPseudorandomNumbers",
           "tags": [
             "security",
-            "scope/single-translation-unit"
+            "scope/single-translation-unit",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -256,7 +266,12 @@
           "short_name": "PreferSpecialMemberFunctionsAndOverloadedOperatorsToCStandardLibraryFunctions",
           "tags": [
             "correctness",
-            "scope/single-translation-unit"
+            "scope/single-translation-unit",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/BannedSyntax.json b/rule_packages/cpp/BannedSyntax.json
index 8e307c02db..8f739145f7 100644
--- a/rule_packages/cpp/BannedSyntax.json
+++ b/rule_packages/cpp/BannedSyntax.json
@@ -417,7 +417,12 @@
           "tags": [
             "correctness",
             "security",
-            "scope/single-translation-unit"
+            "scope/single-translation-unit",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Classes.json b/rule_packages/cpp/Classes.json
index 61eab45081..e7c8a10d92 100644
--- a/rule_packages/cpp/Classes.json
+++ b/rule_packages/cpp/Classes.json
@@ -178,23 +178,16 @@
         "obligation": "required"
       },
       "queries": [
-        {
-          "description": "A function that is either trivial, a template function, or a member of a template class may not be defined outside of a class body.",
-          "kind": "problem",
-          "name": "A function shall be defined with a class body if and only if it is intended to be inlined",
-          "precision": "very-high",
-          "severity": "recommendation",
-          "short_name": "TrivialOrTemplateFunctionDefinedOutsideClassDefinition",
-          "tags": []
-        },
         {
           "description": "A function that is not either trivial, a template function, or a member of a template class may not be defined within a class body.",
           "kind": "problem",
           "name": "A function shall be defined with a class body if and only if it is intended to be inlined",
-          "precision": "very-high",
+          "precision": "low",
           "severity": "recommendation",
           "short_name": "NonTrivialNonTemplateFunctionDefinedInsideClassDefinition",
-          "tags": []
+          "tags": [
+            "external/autosar/audit"
+          ]
         }
       ],
       "title": "A function definition shall only be placed in a class definition if (1) the function is intended to be inlined (2) it is a member function template (3) it is a member function of a class template."
@@ -322,7 +315,12 @@
           "severity": "recommendation",
           "short_name": "OffsetUsedOnInvalidTypeOrMember",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Concurrency.json b/rule_packages/cpp/Concurrency.json
index 6e5898ecd8..3bba2f409f 100644
--- a/rule_packages/cpp/Concurrency.json
+++ b/rule_packages/cpp/Concurrency.json
@@ -15,7 +15,12 @@
           "shared_implementation_short_name": "DoNotAllowAMutexToGoOutOfScopeWhileLocked",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -28,7 +33,12 @@
           "shared_implementation_short_name": "DoNotDestroyAMutexWhileItIsLocked",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -48,7 +58,12 @@
           "short_name": "EnsureActivelyHeldLocksAreReleasedOnExceptionalConditions",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -69,7 +84,12 @@
           "shared_implementation_short_name": "GuardAccessToBitFields",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -90,7 +110,12 @@
           "shared_implementation_short_name": "PreventDeadlockByLockingInPredefinedOrder",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -111,7 +136,12 @@
           "shared_implementation_short_name": "WrapSpuriousFunctionInLoop",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -132,7 +162,12 @@
           "shared_implementation_short_name": "PreserveSafetyWhenUsingConditionVariables",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -152,7 +187,12 @@
           "short_name": "DoNotSpeculativelyLockALockedNonRecursiveMutex",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p1",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -164,7 +204,12 @@
           "short_name": "LockedALockedNonRecursiveMutexAudit",
           "tags": [
             "correctness",
-            "concurrency"
+            "concurrency",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p1",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Const.json b/rule_packages/cpp/Const.json
index c574e547bf..6f76b7f5b8 100644
--- a/rule_packages/cpp/Const.json
+++ b/rule_packages/cpp/Const.json
@@ -71,17 +71,6 @@
           "tags": [
             "maintainability"
           ]
-        },
-        {
-          "description": "Using 'constexpr' makes it clear that a function is intended to return a compile time constant.",
-          "kind": "problem",
-          "name": "The constexpr specifier shall be used for functions whose return value can be determined at compile time",
-          "precision": "high",
-          "severity": "recommendation",
-          "short_name": "FunctionMissingConstexpr",
-          "tags": [
-            "maintainability"
-          ]
         }
       ],
       "title": "The constexpr specifier shall be used for values that can be determined at compile time."
@@ -262,7 +251,12 @@
           "shared_implementation_short_name": "RemoveConstOrVolatileQualification",
           "short_name": "RemoveConstOrVolatileQualificationCert",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/ExceptionSafety.json b/rule_packages/cpp/ExceptionSafety.json
index 07e97ae328..73b84edde4 100644
--- a/rule_packages/cpp/ExceptionSafety.json
+++ b/rule_packages/cpp/ExceptionSafety.json
@@ -90,7 +90,12 @@
           "short_name": "GuaranteeExceptionSafety",
           "shared_implementation_short_name": "ExceptionSafetyGuarantees",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -111,7 +116,12 @@
           "shared_implementation_short_name": "ExceptionSafetyValidState",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Exceptions1.json b/rule_packages/cpp/Exceptions1.json
index 23b37778db..7c3a2a708a 100644
--- a/rule_packages/cpp/Exceptions1.json
+++ b/rule_packages/cpp/Exceptions1.json
@@ -502,7 +502,12 @@
           "shared_implementation_short_name": "ConditionVariablePostConditionFailed",
           "tags": [
             "correctness",
-            "external/cert/audit"
+            "external/cert/audit",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -513,7 +518,12 @@
           "short_name": "JoinableThreadCopiedOrDestroyedCert",
           "shared_implementation_short_name": "JoinableThreadCopiedOrDestroyed",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -525,7 +535,12 @@
           "short_name": "RethrowNestedWithoutCaptureCert",
           "shared_implementation_short_name": "RethrowNestedWithoutCapture",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -537,7 +552,12 @@
           "short_name": "ExplicitAbruptTerminationCert",
           "shared_implementation_short_name": "ExplicitAbruptTermination",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -549,7 +569,12 @@
           "short_name": "ExitHandlerThrowsExceptionCert",
           "shared_implementation_short_name": "ExitHandlerThrowsException",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -568,7 +593,12 @@
           "kind": "path-problem",
           "short_name": "HandleAllExceptions",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -587,7 +617,12 @@
           "shared_implementation_short_name": "DestroyedValueReferencedInDestructorCatchBlock",
           "short_name": "DestroyedValueReferencedInConstructorDestructorCatchBlock",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -606,7 +641,12 @@
           "kind": "path-problem",
           "short_name": "HonorExceptionSpecifications",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -626,7 +666,12 @@
           "shared_implementation_short_name": "HandleAllExceptionsDuringStartup",
           "short_name": "HandleAllExceptionsThrownBeforeMainBeginsExecuting",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -644,7 +689,12 @@
           "severity": "error",
           "short_name": "ExceptionObjectsMustBeNothrowCopyConstructible",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -663,7 +713,12 @@
           "shared_implementation_short_name": "CatchExceptionsByLvalueReference",
           "short_name": "CatchExceptionsByLvalueReference",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Exceptions2.json b/rule_packages/cpp/Exceptions2.json
index ece305a04a..2e2f2dfba6 100644
--- a/rule_packages/cpp/Exceptions2.json
+++ b/rule_packages/cpp/Exceptions2.json
@@ -295,7 +295,12 @@
           "severity": "error",
           "short_name": "DoNotLetExceptionsEscapeFromDestructorsOrDeallocationFunctions",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -315,7 +320,12 @@
           "shared_implementation_short_name": "CatchBlockShadowing",
           "short_name": "CatchBlockShadowingCert",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Expressions.json b/rule_packages/cpp/Expressions.json
index c0a7b6bb0b..10f85237de 100644
--- a/rule_packages/cpp/Expressions.json
+++ b/rule_packages/cpp/Expressions.json
@@ -86,9 +86,13 @@
           "precision": "very-high",
           "severity": "recommendation",
           "short_name": "FunctionErroneousReturnValueNotTested",
+          "shared_implementation_short_name": "FunctionErroneousReturnValueNotTested",
           "tags": [
             "maintainability"
-          ]
+          ],
+          "implementation_scope": {
+            "description": "The query enforces checking on some C standard library functions that may return error codes."
+          }
         }
       ],
       "title": "If a function generates error information, then that error information shall be tested."
@@ -126,7 +130,7 @@
       },
       "queries": [
         {
-          "description": "Expressions with type (plain) char and wchar_t shall not be used as operands to built-in operators other than the assignment operator =, the equality operators == and ! =, and the unary & operator. Manipulation of character data may generate results that are contrary to developer expectations. For example, ISO/IEC 14882:2003 [1] §2.2(3) only requires that the digits \"0\" to \"9\" have consecutive numerical values.",
+          "description": "Expressions with type (plain) char and wchar_t shall not be used as operands to built-in operators other than the assignment operator =, the equality operators == and ! =, and the unary & operator. Manipulation of character data may generate results that are contrary to developer expectations. For example, ISO/IEC 14882:2003 [1] \u00a72.2(3) only requires that the digits \"0\" to \"9\" have consecutive numerical values.",
           "kind": "problem",
           "name": "Expressions with type (plain) char and wchar_t shall only be used as operands to =, ==, !=, &",
           "precision": "very-high",
@@ -319,7 +323,12 @@
           "severity": "error",
           "short_name": "PassPromotablePrimitiveTypeToVaStart",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -330,7 +339,12 @@
           "severity": "error",
           "short_name": "PassReferenceTypeToVaStart",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -341,7 +355,12 @@
           "severity": "warning",
           "short_name": "PassNonTrivialObjectToVaStart",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/FloatingPoint.json b/rule_packages/cpp/FloatingPoint.json
new file mode 100644
index 0000000000..672e57acff
--- /dev/null
+++ b/rule_packages/cpp/FloatingPoint.json
@@ -0,0 +1,36 @@
+{
+  "MISRA-C++-2023": {
+    "DIR-0-3-1": {
+      "properties": {
+        "obligation": "advisory"
+      },
+      "queries": [
+        {
+          "description": "Possible misuse of a generate infinite floating point value.",
+          "kind": "path-problem",
+          "name": "Possible misuse of a generate infinite floating point value",
+          "precision": "medium",
+          "severity": "warning",
+          "short_name": "PossibleMisuseOfInfiniteFloatingPointValue",
+          "shared_implementation_short_name": "MisuseOfInfiniteFloatingPointValue",
+          "tags": [
+            "correctness"
+          ]
+        },
+        {
+          "description": "Possible mishandling of an undetected NaN value produced by a floating point operation.",
+          "kind": "path-problem",
+          "name": "Possible mishandling of an undetected NaN value produced by a floating point operation",
+          "precision": "low",
+          "severity": "warning",
+          "short_name": "PossibleMisuseOfNaNFloatingPointValue",
+          "shared_implementation_short_name": "MisuseOfNaNFloatingPointValue",
+          "tags": [
+            "correctness"
+          ]
+        }
+      ],
+      "title": "Floating-point arithmetic should be used appropriately"
+    }
+  }
+}
\ No newline at end of file
diff --git a/rule_packages/cpp/Freed.json b/rule_packages/cpp/Freed.json
index 36b9b31c3d..30ab6982b2 100644
--- a/rule_packages/cpp/Freed.json
+++ b/rule_packages/cpp/Freed.json
@@ -111,7 +111,12 @@
           "severity": "error",
           "short_name": "DoNotDeleteAnArrayThroughAPointerOfTheIncorrectType",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -132,7 +137,12 @@
           "short_name": "ObjectAccessedBeforeLifetimeCert",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -145,7 +155,12 @@
           "short_name": "ObjectAccessedAfterLifetimeCert",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -166,7 +181,12 @@
           "short_name": "UseAfterFree",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Functions.json b/rule_packages/cpp/Functions.json
index 367ab67437..b650b0937c 100644
--- a/rule_packages/cpp/Functions.json
+++ b/rule_packages/cpp/Functions.json
@@ -281,7 +281,12 @@
           "severity": "error",
           "short_name": "FunctionWithMismatchedLanguageLinkage",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -301,7 +306,12 @@
           "short_name": "NonVoidFunctionDoesNotReturnCert",
           "shared_implementation_short_name": "NonVoidFunctionDoesNotReturn",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -321,7 +331,12 @@
           "short_name": "FunctionNoReturnAttributeConditionCert",
           "shared_implementation_short_name": "FunctionNoReturnAttributeCondition",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/IO.json b/rule_packages/cpp/IO.json
index 9ad0650e62..3d1012232c 100644
--- a/rule_packages/cpp/IO.json
+++ b/rule_packages/cpp/IO.json
@@ -43,7 +43,12 @@
           "short_name": "InterleavedInputOutputWithoutPosition",
           "shared_implementation_short_name": "IOFstreamMissingPositioning",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -63,7 +68,12 @@
           "short_name": "CloseFilesWhenTheyAreNoLongerNeeded",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Inheritance.json b/rule_packages/cpp/Inheritance.json
index efc241a8e6..fc4805fc21 100644
--- a/rule_packages/cpp/Inheritance.json
+++ b/rule_packages/cpp/Inheritance.json
@@ -229,7 +229,13 @@
           "precision": "very-high",
           "severity": "error",
           "short_name": "DoNotInvokeVirtualFunctionsFromConstructorsOrDestructors",
-          "tags": []
+          "tags": [
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
+          ]
         }
       ],
       "title": "Do not invoke virtual functions from constructors or destructors"
@@ -246,7 +252,13 @@
           "precision": "very-high",
           "severity": "error",
           "short_name": "DoNotSliceDerivedObjects",
-          "tags": []
+          "tags": [
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
+          ]
         }
       ],
       "title": "Do not slice derived objects"
@@ -263,7 +275,13 @@
           "precision": "very-high",
           "severity": "warning",
           "short_name": "DoNotDeleteAPolymorphicObjectWithoutAVirtualDestructor",
-          "tags": []
+          "tags": [
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
+          ]
         }
       ],
       "title": "Do not delete a polymorphic object without a virtual destructor"
diff --git a/rule_packages/cpp/Initialization.json b/rule_packages/cpp/Initialization.json
index 3ca901a865..e81160a273 100644
--- a/rule_packages/cpp/Initialization.json
+++ b/rule_packages/cpp/Initialization.json
@@ -417,7 +417,12 @@
           "short_name": "CyclesDuringStaticObjectInit",
           "tags": [
             "correctness",
-            "maintainability"
+            "maintainability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -437,7 +442,12 @@
           "short_name": "BadlySeededRandomNumberGenerator",
           "tags": [
             "security",
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -460,7 +470,12 @@
             "correctness",
             "security",
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Invariants.json b/rule_packages/cpp/Invariants.json
index b473fb499d..215e4edff4 100644
--- a/rule_packages/cpp/Invariants.json
+++ b/rule_packages/cpp/Invariants.json
@@ -63,7 +63,12 @@
           "shared_implementation_short_name": "OrderingPredicateMustBeStrictlyWeak",
           "short_name": "ProvideAValidOrderingPredicate",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -82,7 +87,12 @@
           "severity": "error",
           "short_name": "SignalHandlerMustBeAPlainOldFunction",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -101,7 +111,12 @@
           "severity": "error",
           "short_name": "HonorTerminationReplacementHandlerRequirements",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -112,7 +127,12 @@
           "severity": "error",
           "short_name": "HonorNewReplacementHandlerRequirements",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Iterators.json b/rule_packages/cpp/Iterators.json
index a43740f7e7..c345adb371 100644
--- a/rule_packages/cpp/Iterators.json
+++ b/rule_packages/cpp/Iterators.json
@@ -61,7 +61,12 @@
           "severity": "error",
           "short_name": "UsesValidContainerElementAccess",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -80,7 +85,12 @@
           "severity": "error",
           "short_name": "UseValidIteratorRanges",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -99,7 +109,12 @@
           "severity": "error",
           "short_name": "DoNotSubtractIteratorsForDifferentContainers",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -118,7 +133,12 @@
           "severity": "error",
           "short_name": "DoNotUseAnAdditiveOperatorOnAnIterator",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -138,7 +158,12 @@
           "severity": "error",
           "short_name": "UseValidReferencesForElementsOfString",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Lambdas.json b/rule_packages/cpp/Lambdas.json
index ea43fa0231..8f973c361f 100644
--- a/rule_packages/cpp/Lambdas.json
+++ b/rule_packages/cpp/Lambdas.json
@@ -205,7 +205,12 @@
           "shared_implementation_short_name": "DanglingCaptureWhenReturningLambdaObject",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -218,7 +223,12 @@
           "shared_implementation_short_name": "DanglingCaptureWhenMovingLambdaObject",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/MoveForward.json b/rule_packages/cpp/MoveForward.json
index b7e47116f1..6f071a6f53 100644
--- a/rule_packages/cpp/MoveForward.json
+++ b/rule_packages/cpp/MoveForward.json
@@ -154,7 +154,12 @@
           "short_name": "DoNotRelyOnTheValueOfAMovedFromObject",
           "shared_implementation_short_name": "MovedFromObjectsUnspecifiedState",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Naming.json b/rule_packages/cpp/Naming.json
index 441979c3c9..34a9f2c66e 100644
--- a/rule_packages/cpp/Naming.json
+++ b/rule_packages/cpp/Naming.json
@@ -382,7 +382,12 @@
           "severity": "error",
           "short_name": "RedefiningOfStandardLibraryName",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -392,7 +397,12 @@
           "severity": "error",
           "short_name": "ReuseOfReservedIdentifier",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -403,7 +413,12 @@
           "short_name": "UseOfSingleUnderscoreReservedPrefix",
           "tags": [
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -414,7 +429,12 @@
           "short_name": "UseOfDoubleUnderscoreReservedPrefix",
           "tags": [
             "maintainability",
-            "readability"
+            "readability",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -426,7 +446,12 @@
           "tags": [
             "maintainability",
             "readability",
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -438,7 +463,12 @@
           "tags": [
             "maintainability",
             "readability",
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -450,7 +480,12 @@
           "tags": [
             "maintainability",
             "readability",
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -462,7 +497,12 @@
           "tags": [
             "maintainability",
             "readability",
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Null.json b/rule_packages/cpp/Null.json
index a5410840ce..543552660c 100644
--- a/rule_packages/cpp/Null.json
+++ b/rule_packages/cpp/Null.json
@@ -63,7 +63,12 @@
           "severity": "error",
           "short_name": "DoNotAttemptToCreateAStringFromANullPointer",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rule_packages/cpp/OperatorInvariants.json b/rule_packages/cpp/OperatorInvariants.json
index 8ba76cd0f7..5eaefd68c8 100644
--- a/rule_packages/cpp/OperatorInvariants.json
+++ b/rule_packages/cpp/OperatorInvariants.json
@@ -177,7 +177,12 @@
           "severity": "error",
           "short_name": "GracefullyHandleSelfCopyAssignment",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -196,7 +201,12 @@
           "severity": "error",
           "short_name": "CopyOperationsMustNotMutateTheSourceObject",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/OutOfBounds.json b/rule_packages/cpp/OutOfBounds.json
index a3cb8fbf91..2a657df95c 100644
--- a/rule_packages/cpp/OutOfBounds.json
+++ b/rule_packages/cpp/OutOfBounds.json
@@ -42,7 +42,12 @@
           "shared_implementation_short_name": "ContainerAccessWithoutRangeCheck",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -62,7 +67,12 @@
           "short_name": "GuaranteeGenericCppLibraryFunctionsDoNotOverflow",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -82,7 +92,12 @@
           "short_name": "RangeCheckStringElementAccess",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Pointers.json b/rule_packages/cpp/Pointers.json
index b6a0aaef09..fb1fbe2918 100644
--- a/rule_packages/cpp/Pointers.json
+++ b/rule_packages/cpp/Pointers.json
@@ -396,7 +396,12 @@
           "severity": "warning",
           "short_name": "DoNotUsePointerArithmeticOnPolymorphicObjects",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p9",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -416,7 +421,12 @@
           "short_name": "DeletingPointerToIncompleteClass",
           "shared_implementation_short_name": "DeleteOfPointerToIncompleteClass",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -427,7 +437,12 @@
           "severity": "error",
           "short_name": "CastOfPointerToIncompleteClass",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -447,7 +462,12 @@
           "short_name": "UseOfPointerToMemberToAccessUndefinedMember",
           "shared_implementation_short_name": "AccessOfUndefinedMemberThroughNullPointer",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -459,7 +479,12 @@
           "short_name": "MemberAccessWithUninitializedStaticPointerToMember",
           "shared_implementation_short_name": "AccessOfUndefinedMemberThroughUninitializedStaticPointer",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -471,7 +496,12 @@
           "short_name": "UseOfPointerToMemberToAccessNonexistentMember",
           "shared_implementation_short_name": "AccessOfNonExistingMemberThroughPointerToMember",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Representation.json b/rule_packages/cpp/Representation.json
index 0284d8098f..813373afb4 100644
--- a/rule_packages/cpp/Representation.json
+++ b/rule_packages/cpp/Representation.json
@@ -131,7 +131,12 @@
           "severity": "error",
           "short_name": "MemsetUsedToAccessObjectRepresentation",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -143,7 +148,12 @@
           "short_name": "MemcmpUsedToAccessObjectRepresentation",
           "shared_implementation_short_name": "MemcmpUsedToComparePaddingData",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -154,7 +164,12 @@
           "severity": "error",
           "short_name": "MemcpyUsedToAccessObjectRepresentation",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Scope.json b/rule_packages/cpp/Scope.json
index 6677b8b81a..6fc3aa8487 100644
--- a/rule_packages/cpp/Scope.json
+++ b/rule_packages/cpp/Scope.json
@@ -254,7 +254,12 @@
           "severity": "warning",
           "short_name": "LocalFunctionDeclaration",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -265,7 +270,12 @@
           "severity": "warning",
           "short_name": "LocalConstructorInitializedObjectHidesIdentifier",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p2",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -284,7 +294,12 @@
           "severity": "error",
           "short_name": "SingularOverloadOfMemoryFunction",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -304,7 +319,12 @@
           "short_name": "ModificationOfTheStandardNamespaces",
           "shared_implementation_short_name": "NonStandardEntitiesInStandardNamespaces",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p6",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -323,7 +343,12 @@
           "severity": "error",
           "short_name": "UnnamedNamespaceInHeaderFile",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -343,7 +368,12 @@
           "short_name": "OneDefinitionRuleNotObeyed",
           "shared_implementation_short_name": "OneDefinitionRuleViolation",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/SideEffects1.json b/rule_packages/cpp/SideEffects1.json
index adddbc3b36..587a6ceb66 100644
--- a/rule_packages/cpp/SideEffects1.json
+++ b/rule_packages/cpp/SideEffects1.json
@@ -84,7 +84,12 @@
           "severity": "warning",
           "short_name": "DoNotDependOnTheOrderOfScalarObjectEvaluationForSideEffects",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         },
         {
@@ -95,7 +100,12 @@
           "severity": "warning",
           "short_name": "DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p8",
+            "external/cert/level/l2"
           ]
         }
       ],
@@ -114,7 +124,12 @@
           "severity": "warning",
           "short_name": "DoNotRelyOnSideEffectsInSizeOfOperand",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -125,7 +140,12 @@
           "severity": "warning",
           "short_name": "DoNotRelyOnSideEffectsInTypeIdOperand",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -136,7 +156,12 @@
           "severity": "warning",
           "short_name": "DoNotRelyOnSideEffectsInNoExceptOperand",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -147,7 +172,12 @@
           "severity": "warning",
           "short_name": "DoNotRelyOnSideEffectsInDeclTypeOperand",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         },
         {
@@ -158,7 +188,12 @@
           "severity": "warning",
           "short_name": "DoNotRelyOnSideEffectsInDeclValExpression",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/low",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/SideEffects2.json b/rule_packages/cpp/SideEffects2.json
index 6e5e4812fb..0338b88895 100644
--- a/rule_packages/cpp/SideEffects2.json
+++ b/rule_packages/cpp/SideEffects2.json
@@ -165,7 +165,12 @@
           "shared_implementation_short_name": "PredicateFunctionObjectsShouldNotBeMutable",
           "short_name": "PredicateFunctionObjectsShouldNotBeMutable",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/low",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p3",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/SmartPointers2.json b/rule_packages/cpp/SmartPointers2.json
index 2f89c4868a..db641b4c7e 100644
--- a/rule_packages/cpp/SmartPointers2.json
+++ b/rule_packages/cpp/SmartPointers2.json
@@ -16,7 +16,10 @@
           "precision": "medium",
           "severity": "warning",
           "short_name": "WeakPtrNotUsedToRepresentTemporarySharedOwnership",
-          "tags": ["correctness", "external/autosar/audit"]
+          "tags": [
+            "correctness",
+            "external/autosar/audit"
+          ]
         }
       ],
       "title": "A std::weak_ptr shall be used to represent temporary shared ownership."
@@ -36,8 +39,14 @@
           "severity": "error",
           "short_name": "OwnedPointerValueStoredInUnrelatedSmartPointerCert",
           "shared_implementation_short_name": "OwnedPointerValueStoredInUnrelatedSmartPointer",
-
-          "tags": ["correctness"]
+          "tags": [
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
+          ]
         }
       ],
       "title": "Do not store an already-owned pointer value in an unrelated smart pointer"
diff --git a/rule_packages/cpp/Strings.json b/rule_packages/cpp/Strings.json
index 2152684792..acccdc7753 100644
--- a/rule_packages/cpp/Strings.json
+++ b/rule_packages/cpp/Strings.json
@@ -133,7 +133,13 @@
           "severity": "recommendation",
           "shared_implementation_short_name": "BasicStringMayNotBeNullTerminated",
           "short_name": "BasicStringMayNotBeNullTerminatedCert",
-          "tags": []
+          "tags": [
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
+          ]
         },
         {
           "description": "Certain operations may not null terminate CStyle strings which may cause unpredictable behavior.",
@@ -143,7 +149,13 @@
           "severity": "recommendation",
           "shared_implementation_short_name": "OperationMayNotNullTerminateCStyleString",
           "short_name": "OperationMayNotNullTerminateCStyleStringCert",
-          "tags": []
+          "tags": [
+            "external/cert/severity/high",
+            "external/cert/likelihood/likely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p18",
+            "external/cert/level/l1"
+          ]
         }
       ],
       "title": "Guarantee that storage for strings has sufficient space for character data and the null terminator"
diff --git a/rule_packages/cpp/TrustBoundaries.json b/rule_packages/cpp/TrustBoundaries.json
index 7387fffc1f..0b697cd49c 100644
--- a/rule_packages/cpp/TrustBoundaries.json
+++ b/rule_packages/cpp/TrustBoundaries.json
@@ -38,7 +38,12 @@
           "severity": "error",
           "short_name": "DoNotThrowAnExceptionAcrossExecutionBoundaries",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ]
         }
       ],
@@ -57,7 +62,12 @@
           "severity": "error",
           "short_name": "DoNotPassANonstandardObjectAcrossBoundaries",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rule_packages/cpp/TypeRanges.json b/rule_packages/cpp/TypeRanges.json
index 1b27e0ed91..1e8ef914bf 100644
--- a/rule_packages/cpp/TypeRanges.json
+++ b/rule_packages/cpp/TypeRanges.json
@@ -184,7 +184,12 @@
           "short_name": "DetectErrorsWhenConvertingAStringToANumber",
           "shared_implementation_short_name": "StringNumberConversionMissingErrorCheck",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
@@ -203,7 +208,12 @@
           "severity": "error",
           "short_name": "DoNotCastToAnOutOfRangeEnumerationValue",
           "tags": [
-            "correctness"
+            "correctness",
+            "external/cert/severity/medium",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p4",
+            "external/cert/level/l3"
           ]
         }
       ],
diff --git a/rule_packages/cpp/Uninitialized.json b/rule_packages/cpp/Uninitialized.json
index 019987eef4..1432e11603 100644
--- a/rule_packages/cpp/Uninitialized.json
+++ b/rule_packages/cpp/Uninitialized.json
@@ -41,7 +41,12 @@
           "short_name": "InformationLeakageAcrossTrustBoundaries",
           "shared_implementation_short_name": "InformationLeakageAcrossBoundaries",
           "tags": [
-            "security"
+            "security",
+            "external/cert/severity/low",
+            "external/cert/likelihood/unlikely",
+            "external/cert/remediation-cost/high",
+            "external/cert/priority/p1",
+            "external/cert/level/l3"
           ],
           "implementation_scope": {
             "description": "The rule does not detect cases where fields may have uninitialized padding but are initialized via an initializer."
@@ -65,7 +70,12 @@
           "shared_implementation_short_name": "ReadOfUninitializedMemory",
           "tags": [
             "correctness",
-            "security"
+            "security",
+            "external/cert/severity/high",
+            "external/cert/likelihood/probable",
+            "external/cert/remediation-cost/medium",
+            "external/cert/priority/p12",
+            "external/cert/level/l1"
           ]
         }
       ],
diff --git a/rules.csv b/rules.csv
index 475ea1d66c..68049625e6 100644
--- a/rules.csv
+++ b/rules.csv
@@ -515,6 +515,7 @@ c,CERT-C,ERR30-C,Yes,Rule,,,Take care when reading errno,M19-3-1,Contracts4,Hard
 c,CERT-C,ERR32-C,Yes,Rule,,,Do not rely on indeterminate values of errno,,Contracts5,Hard,
 c,CERT-C,ERR33-C,Yes,Rule,,,Detect and handle standard library errors,MEM52-CPP,Contracts5,Hard,
 c,CERT-C,ERR34-C,OutOfScope,Rule,,,Detect errors when converting a string to a number,,,,
+c,CERT-C,EXP16-C,Yes,Recommendation,,,Do not compare function pointers to constant values,,Expressions2,Medium,
 c,CERT-C,EXP30-C,Yes,Rule,,,Do not depend on the order of evaluation for side effects,EXP50-CPP,SideEffects1,Easy,
 c,CERT-C,EXP32-C,Yes,Rule,,,Do not access a volatile object through a nonvolatile reference,,Pointers3,Easy,
 c,CERT-C,EXP33-C,Yes,Rule,,,Do not read uninitialized memory,EXP53-CPP,InvalidMemory1,Import,
@@ -530,6 +531,8 @@ c,CERT-C,EXP44-C,Yes,Rule,,,"Do not rely on side effects in operands to sizeof,
 c,CERT-C,EXP45-C,Yes,Rule,,,Do not perform assignments in selection statements,M6-2-1,SideEffects1,Medium,
 c,CERT-C,EXP46-C,Yes,Rule,,,Do not use a bitwise operator with a Boolean-like operand,,Expressions,Easy,
 c,CERT-C,EXP47-C,OutOfScope,Rule,,,Do not call va_arg with an argument of the incorrect type,,,,
+c,CERT-C,FIO03-C,Yes,Recommendation,,,Do not make assumptions about fopen() and file creation,,IO5,Hard,
+c,CERT-C,FIO21-C,Yes,Recommendation,,,Do not create temporary files in shared directories,,IO5,Easy,
 c,CERT-C,FIO30-C,Yes,Rule,,,Exclude user input from format strings,A27-0-1,IO1,Import,
 c,CERT-C,FIO32-C,Yes,Rule,,,Do not perform operations on devices that are only appropriate for files,,IO3,Medium,
 c,CERT-C,FIO34-C,Yes,Rule,,,Distinguish between characters read from a file and EOF or WEOF,,IO1,Hard,
@@ -569,7 +572,7 @@ c,CERT-C,MSC38-C,Yes,Rule,,,Do not treat a predefined identifier as an object if
 c,CERT-C,MSC39-C,Yes,Rule,,,Do not call va_arg() on a va_list that has an indeterminate value,,Contracts7,Hard,
 c,CERT-C,MSC40-C,Yes,Rule,,,Do not violate constraints,,Contracts,Very Hard,
 c,CERT-C,MSC41-C,OutOfScope,Rule,,,Never hard code sensitive information,,,,
-c,CERT-C,POS30-C,OutOfScope,Rule,,,Use the readlink() function properly,,,,
+c,CERT-C,POS30-C,Yes,Rule,,,Use the readlink() function properly,,IO5,Hard,
 c,CERT-C,POS34-C,OutOfScope,Rule,,,Do not call putenv() with a pointer to an automatic variable as the argument,,,,
 c,CERT-C,POS35-C,OutOfScope,Rule,,,Avoid race conditions while checking for the existence of a symbolic link,,,,
 c,CERT-C,POS36-C,OutOfScope,Rule,,,Observe correct revocation order while relinquishing privileges,,,,
@@ -615,9 +618,9 @@ c,MISRA-C-2012,DIR-4-10,Yes,Required,,,Precautions shall be taken in order to pr
 c,MISRA-C-2012,DIR-4-11,Yes,Required,,,The validity of values passed to library functions shall be checked,,Contracts,Hard,
 c,MISRA-C-2012,DIR-4-12,Yes,Required,,,Dynamic memory allocation shall not be used,,Banned,Medium,
 c,MISRA-C-2012,DIR-4-13,No,Advisory,,,Functions which are designed to provide operations on a resource should be called in an appropriate sequence,,,,"Rule 22.1, 22.2 and 22.6 cover aspects of this rule. In other cases this is a design issue and needs to be checked manually."
-c,MISRA-C-2012,DIR-4-14,Yes,Required,,,The validity of values received from external sources shall be checked,,Contracts,Hard,This is supported by CodeQLs default C security queries.
+c,MISRA-C-2012,DIR-4-14,Yes,Required,,,The validity of values received from external sources shall be checked,,Contracts8,Hard,This is supported by CodeQLs default C security queries.
 c,MISRA-C-2012,DIR-4-15,Yes,Required,,,Evaluation of floating-point expressions shall not lead to the undetected generation of infinities and NaNs,FLP32-C and FLP04-C,FloatingTypes2,Medium,
-c,MISRA-C-2012,DIR-5-1,Yes,Required,,,There shall be no data races between threads,CON43-C and CON32-C,Concurrency6,Very Hard,
+c,MISRA-C-2012,DIR-5-1,Yes,Required,,,There shall be no data races between threads,CON43-C and CON32-C,Concurrency9,Very Hard,
 c,MISRA-C-2012,DIR-5-2,Yes,Required,,,There shall be no deadlocks between threads,CON35-C,Concurrency6,Import,
 c,MISRA-C-2012,DIR-5-3,Yes,Required,,,There shall be no dynamic thread creation,,Concurrency6,Easy,
 c,MISRA-C-2012,RULE-1-1,No,Required,,,"The program shall contain no violations of the standard C syntax and constraints, and shall not exceed the implementation's translation limits",,,Easy,"This should be checked via the compiler output, rather than CodeQL, which adds unnecessary steps."
@@ -677,8 +680,8 @@ c,MISRA-C-2012,RULE-9-2,Yes,Required,,,The initializer for an aggregate or union
 c,MISRA-C-2012,RULE-9-3,Yes,Required,,,Arrays shall not be partially initialized,,Memory1,Medium,
 c,MISRA-C-2012,RULE-9-4,Yes,Required,,,An element of an object shall not be initialized more than once,,Memory1,Medium,
 c,MISRA-C-2012,RULE-9-5,No,Required,,,Where designated initializers are used to initialize an array object the size of the array shall be specified explicitly,,,Medium,
-c,MISRA-C-2012,RULE-9-6,Yes,Required,,,An initializer using chained designators shall not contain initializers without designators,,Declarations9,Hard,
-c,MISRA-C-2012,RULE-9-7,Yes,Mandatory,,,Atomic objects shall be appropriately initialized before being accessed,,Concurrency6,Hard,
+c,MISRA-C-2012,RULE-9-6,Yes,Required,,,An initializer using chained designators shall not contain initializers without designators,,Declarations10,Hard,
+c,MISRA-C-2012,RULE-9-7,Yes,Mandatory,,,Atomic objects shall be appropriately initialized before being accessed,,Concurrency7,Hard,
 c,MISRA-C-2012,RULE-10-1,Yes,Required,,,Operands shall not be of an inappropriate essential type,,EssentialTypes,Hard,
 c,MISRA-C-2012,RULE-10-2,Yes,Required,,,Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations,,EssentialTypes,Medium,
 c,MISRA-C-2012,RULE-10-3,Yes,Required,,,The value of an expression shall not be assigned to an object with a narrower essential type or of a different essential type category,,EssentialTypes,Hard,
@@ -708,7 +711,7 @@ c,MISRA-C-2012,RULE-13-2,Yes,Required,,,The value of an expression and its persi
 c,MISRA-C-2012,RULE-13-3,Yes,Advisory,,,A full expression containing an increment (++) or decrement (--) operator should have no other potential side effects other than that caused by the increment or decrement operator,,SideEffects2,Medium,
 c,MISRA-C-2012,RULE-13-4,Yes,Advisory,,,The result of an assignment operator should not be used,M6-2-1,SideEffects1,Easy,
 c,MISRA-C-2012,RULE-13-5,Yes,Required,,,The right hand operand of a logical && or || operator shall not contain persistent side effects,M5-14-1,SideEffects1,Import,
-c,MISRA-C-2012,RULE-13-6,Yes,Mandatory,,,The operand of the sizeof operator shall not contain any expressiosn which has potential side effects,M5-3-4,SideEffects1,Import,
+c,MISRA-C-2012,RULE-13-6,Yes,Required,,,The operand of the sizeof operator shall not contain any expressiosn which has potential side effects,M5-3-4,SideEffects1,Import,
 c,MISRA-C-2012,RULE-14-1,Yes,Required,,,A loop counter shall not have essentially floating type,FLP30-C A6-5-2,EssentialTypes,Hard,
 c,MISRA-C-2012,RULE-14-2,Yes,Required,,,A for loop shall be well-formed,M6-5-1...M6-5-6,Statements4,Medium,
 c,MISRA-C-2012,RULE-14-3,Yes,Required,,,Controlling expressions shall not be invariant,,Statements5,Medium,
@@ -731,7 +734,7 @@ c,MISRA-C-2012,RULE-17-1,Yes,Required,,,The features of <stdarg.h> shall not be
 c,MISRA-C-2012,RULE-17-2,Yes,Required,,,"Functions shall not call themselves, either directly or indirectly",A7-5-2,Statements3,Import,
 c,MISRA-C-2012,RULE-17-3,Yes,Mandatory,,,A function shall not be declared implicitly,,Declarations6,Medium,
 c,MISRA-C-2012,RULE-17-4,Yes,Mandatory,,,All exit paths from a function with non-void return type shall have an explicit return statement with an expression,MSC52-CPP,Statements5,Medium,
-c,MISRA-C-2012,RULE-17-5,Yes,Advisory,,,The function argument corresponding to a parameter declared to have an array type shall have an appropriate number of elements,,Contracts6,Hard,
+c,MISRA-C-2012,RULE-17-5,Yes,Required,,,The function argument corresponding to a parameter declared to have an array type shall have an appropriate number of elements,,Contracts6,Hard,
 c,MISRA-C-2012,RULE-17-6,Yes,Mandatory,,,The declaration of an array parameter shall not contain the static keyword between the [ ],,Static,Easy,
 c,MISRA-C-2012,RULE-17-7,Yes,Required,,,The value returned by a function having non-void return type shall be used,A0-1-2,Contracts6,Easy,
 c,MISRA-C-2012,RULE-17-8,Yes,Advisory,,,A function parameter should not be modified,,SideEffects2,Medium,
@@ -776,7 +779,7 @@ c,MISRA-C-2012,RULE-21-7,Yes,Required,,,"The Standard Library functions atof, at
 c,MISRA-C-2012,RULE-21-8,Yes,Required,,,The Standard Library termination functions of <stdlib.h> shall not be used,ERR50-CPP,Banned,Easy,
 c,MISRA-C-2012,RULE-21-9,Yes,Required,,,The Standard Library functions bsearch and qsort of <stdlib.h> shall not be used,,Banned,Easy,
 c,MISRA-C-2012,RULE-21-10,Yes,Required,,,The Standard Library time and date functions shall not be used,,Banned,Easy,
-c,MISRA-C-2012,RULE-21-11,Yes,Required,,,The standard header file <tgmath.h> shall not be used,,Banned,Easy,
+c,MISRA-C-2012,RULE-21-11,Yes,Advisory,,,The standard header file <tgmath.h> shall not be used,,Banned,Easy,
 c,MISRA-C-2012,RULE-21-12,Yes,Advisory,,,The exception handling features of <fenv.h> should not be used,,Banned,Easy,
 c,MISRA-C-2012,RULE-21-13,Yes,Mandatory,,,Any value passed to a function in <ctype.h> shall be representable as an unsigned char or be the value EOF,,StandardLibraryFunctionTypes,Medium,
 c,MISRA-C-2012,RULE-21-14,Yes,Required,,,The Standard Library function memcmp shall not be used to compare null terminated strings,,EssentialTypes,Hard,
@@ -791,7 +794,7 @@ c,MISRA-C-2012,RULE-21-22,Yes,Mandatory,,,All operand arguments to any type-gene
 c,MISRA-C-2012,RULE-21-23,Yes,Required,,,All operand arguments to any multi-argument type-generic macros in <tgmath.h> shall have the same standard type,Rule-21-22,EssentialTypes2,Easy,
 c,MISRA-C-2012,RULE-21-24,Yes,Required,,,The random number generator functions of <stdlib.h> shall not be used,MSC30-C,Banned2,Easy,
 c,MISRA-C-2012,RULE-21-25,Yes,Required,,,All memory synchronization operations shall be executed in sequentially consistent order,,Concurrency6,Medium,
-c,MISRA-C-2012,RULE-21-26,Yes,Required,,,The Standard Library function mtx_timedlock() shall only be invoked on mutex objects of appropriate mutex type,,Concurrency6,Hard,
+c,MISRA-C-2012,RULE-21-26,Yes,Required,,,The Standard Library function mtx_timedlock() shall only be invoked on mutex objects of appropriate mutex type,,Concurrency7,Hard,
 c,MISRA-C-2012,RULE-22-1,Yes,Required,,,All resources obtained dynamically by means of Standard Library functions shall be explicitly released,,Memory2,Hard,
 c,MISRA-C-2012,RULE-22-2,Yes,Mandatory,,,A block of memory shall only be freed if it was allocated by means of a Standard Library function,,Memory2,Hard,
 c,MISRA-C-2012,RULE-22-3,Yes,Required,,,The same file shall not be open for read and write access at the same time on different streams,,IO3,Hard,
@@ -803,15 +806,15 @@ c,MISRA-C-2012,RULE-22-8,Yes,Required,,,The value of errno shall be set to zero
 c,MISRA-C-2012,RULE-22-9,Yes,Required,,,The value of errno shall be tested against zero after calling an errno-setting-function,,Contracts3,Medium,
 c,MISRA-C-2012,RULE-22-10,Yes,Required,,,The value of errno shall only be tested when the last function to be called was an errno-setting-function,,Contracts3,Medium,
 c,MISRA-C-2012,RULE-22-11,Yes,Required,,,A thread that was previously either joined or detached shall not be subsequently joined nor detached,CON39-C,Concurrency6,Import,
-c,MISRA-C-2012,RULE-22-12,Yes,Mandatory,,,"Thread objects, thread synchronization objects, and thread-specific storage pointers shall only be accessed by the appropriate Standard Library functions",,Concurrency6,Medium,
-c,MISRA-C-2012,RULE-22-13,Yes,Required,,,"Thread objects, thread synchronization objects, and thread specific storage pointers shall have appropriate storage duration",EXP54-CPP and CON34-C,Concurrency6,Medium,
-c,MISRA-C-2012,RULE-22-14,Yes,Mandatory,,,Thread synchronization objects shall be initialized before being accessed,EXP53-CPP,Concurrency6,Hard,
-c,MISRA-C-2012,RULE-22-15,Yes,Required,,,Thread synchronization objects and thread-specific storage pointers shall not be destroyed until after all threads accessing them have terminated,,Concurrency6,Hard,
-c,MISRA-C-2012,RULE-22-16,Yes,Required,,,All mutex objects locked by a thread shall be explicitly unlocked by the same thread,MEM51-CPP,Concurrency6,Hard,
-c,MISRA-C-2012,RULE-22-17,Yes,Required,,,No thread shall unlock a mutex or call cnd_wait() or cnd_timedwait() for a mutex it has not locked before,Rule 22.2,Concurrency6,Medium,
-c,MISRA-C-2012,RULE-22-18,Yes,Required,,,Non-recursive mutexes shall not be recursively locked,CON56-CPP,Concurrency6,Medium,
-c,MISRA-C-2012,RULE-22-19,Yes,Required,,,A condition variable shall be associated with at most one mutex object,,Concurrency6,Medium,
-c,MISRA-C-2012,RULE-22-20,Yes,Mandatory,,,Thread-specific storage pointers shall be created before being accessed,,Concurrency6,Hard,
+c,MISRA-C-2012,RULE-22-12,Yes,Mandatory,,,"Thread objects, thread synchronization objects, and thread-specific storage pointers shall only be accessed by the appropriate Standard Library functions",,Concurrency8,Medium,
+c,MISRA-C-2012,RULE-22-13,Yes,Required,,,"Thread objects, thread synchronization objects, and thread specific storage pointers shall have appropriate storage duration",EXP54-CPP and CON34-C,Concurrency8,Medium,
+c,MISRA-C-2012,RULE-22-14,Yes,Mandatory,,,Thread synchronization objects shall be initialized before being accessed,EXP53-CPP,Concurrency8,Hard,
+c,MISRA-C-2012,RULE-22-15,Yes,Required,,,Thread synchronization objects and thread-specific storage pointers shall not be destroyed until after all threads accessing them have terminated,,Concurrency9,Hard,
+c,MISRA-C-2012,RULE-22-16,Yes,Required,,,All mutex objects locked by a thread shall be explicitly unlocked by the same thread,MEM51-CPP,Concurrency8,Hard,
+c,MISRA-C-2012,RULE-22-17,Yes,Required,,,No thread shall unlock a mutex or call cnd_wait() or cnd_timedwait() for a mutex it has not locked before,Rule 22.2,Concurrency9,Medium,
+c,MISRA-C-2012,RULE-22-18,Yes,Required,,,Non-recursive mutexes shall not be recursively locked,CON56-CPP,Concurrency9,Medium,
+c,MISRA-C-2012,RULE-22-19,Yes,Required,,,A condition variable shall be associated with at most one mutex object,,Concurrency9,Medium,
+c,MISRA-C-2012,RULE-22-20,Yes,Mandatory,,,Thread-specific storage pointers shall be created before being accessed,,Concurrency9,Hard,
 c,MISRA-C-2012,RULE-23-1,Yes,Advisory,,,A generic selection should only be expanded from a macro,,Generics,Medium,
 c,MISRA-C-2012,RULE-23-2,Yes,Required,,,A generic selection that is not expanded from a macro shall not contain potential side effects in the controlling expression,,Generics,Hard,
 c,MISRA-C-2012,RULE-23-3,Yes,Advisory,,,A generic selection should contain at least one non-default association,,Generics,Easy,
diff --git a/schemas/rule-package.schema.json b/schemas/rule-package.schema.json
index a43deb2141..fff79fede0 100644
--- a/schemas/rule-package.schema.json
+++ b/schemas/rule-package.schema.json
@@ -141,7 +141,8 @@
                                         "obligation": {
                                             "type": "string",
                                             "enum": [
-                                                "rule"
+                                                "rule",
+                                                "recommendation"
                                             ]
                                         }
                                     },
@@ -342,10 +343,34 @@
                             "external/autosar/strict",
                             "scope/single-translation-unit",
                             "scope/system",
+                            "external/misra/audit",
                             "external/misra/c/2012/third-edition-first-revision",
                             "external/misra/c/2012/amendment2",
                             "external/misra/c/2012/amendment3",
-                            "external/misra/c/2012/amendment4"
+                            "external/misra/c/2012/amendment4",
+                            "external/misra/c/strict",
+                            "external/cert/severity/low",
+                            "external/cert/severity/medium",
+                            "external/cert/severity/high",
+                            "external/cert/likelihood/unlikely",
+                            "external/cert/likelihood/probable",
+                            "external/cert/likelihood/likely",
+                            "external/cert/remediation-cost/low",
+                            "external/cert/remediation-cost/medium",
+                            "external/cert/remediation-cost/high",
+                            "external/cert/priority/p1",
+                            "external/cert/priority/p2",
+                            "external/cert/priority/p3",
+                            "external/cert/priority/p4",
+                            "external/cert/priority/p6",
+                            "external/cert/priority/p8",
+                            "external/cert/priority/p9",
+                            "external/cert/priority/p12",
+                            "external/cert/priority/p18",
+                            "external/cert/priority/p27",
+                            "external/cert/level/l1",
+                            "external/cert/level/l2",
+                            "external/cert/level/l3"
                         ]
                     },
                     "minLength": 1
diff --git a/scripts/add_risk_assessment_tags.py b/scripts/add_risk_assessment_tags.py
new file mode 100644
index 0000000000..6560d82a44
--- /dev/null
+++ b/scripts/add_risk_assessment_tags.py
@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""
+Add risk assessment tags to rule package JSON files.
+
+This script:
+1. Iterates through each JSON file in rule_packages directory
+2. Looks for CERT-C or CERT-CPP sections
+3. For each rule, finds the corresponding markdown file
+4. Extracts risk assessment data from the markdown file
+5. Adds risk assessment data as tags to each query in the JSON file
+"""
+
+import os
+import json
+import re
+import glob
+from bs4 import BeautifulSoup
+import logging
+
+logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
+logger = logging.getLogger(__name__)
+
+def find_rule_packages():
+    """Find all JSON rule package files in the rule_packages directory."""
+    repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    rule_packages_dir = os.path.join(repo_root, "rule_packages")
+    return glob.glob(os.path.join(rule_packages_dir, "**", "*.json"), recursive=True)
+
+def extract_risk_assessment_from_md(md_file_path):
+    """Extract risk assessment data from the markdown file."""
+    risk_data = {}
+    
+    try:
+        with open(md_file_path, 'r', encoding='utf-8') as f:
+            content = f.read()
+        
+        # Find the Risk Assessment section
+        risk_section_match = re.search(r'## Risk Assessment(.*?)##', content, re.DOTALL)
+        if not risk_section_match:
+            # Try to find it as the last section
+            risk_section_match = re.search(r'## Risk Assessment(.*?)$', content, re.DOTALL)
+            if not risk_section_match:
+                logger.warning(f"No Risk Assessment section found in {md_file_path}")
+                return risk_data
+        
+        risk_section = risk_section_match.group(1)
+        
+        # Look for the table with risk assessment data
+        table_match = re.search(r'<table>(.*?)</table>', risk_section, re.DOTALL)
+        if not table_match:
+            logger.warning(f"No risk assessment table found in {md_file_path}")
+            return risk_data
+        
+        table_html = table_match.group(0)
+        soup = BeautifulSoup(table_html, 'html.parser')
+        
+        # Find all rows in the table
+        rows = soup.find_all('tr')
+        if len(rows) < 2:  # Need at least header and data row
+            logger.warning(f"Incomplete risk assessment table in {md_file_path}")
+            return risk_data
+        
+        # Extract headers and values
+        headers = [th.get_text().strip() for th in rows[0].find_all('th')]
+        values = [td.get_text().strip() for td in rows[1].find_all('td')]
+        
+        # Create a dictionary of headers and values
+        if len(headers) == len(values):
+            for i, header in enumerate(headers):
+                risk_data[header] = values[i]
+        else:
+            logger.warning(f"Header and value count mismatch in {md_file_path}")
+        
+    except Exception as e:
+        logger.error(f"Error extracting risk assessment from {md_file_path}: {e}")
+    
+    return risk_data
+
+def find_md_file(rule_id, short_name, language):
+    """Find the markdown file for the given rule ID and short name."""
+    repo_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    md_path = os.path.join(repo_root, language, "cert", "src", "rules", rule_id, f"{short_name}.md")
+    
+    if os.path.exists(md_path):
+        return md_path
+    else:
+        # Try without short name (sometimes the file is named after the rule ID)
+        md_path = os.path.join(repo_root, language, "cert", "src", "rules", rule_id, f"{rule_id}.md")
+        if os.path.exists(md_path):
+            return md_path
+        else:
+            logger.warning(f"Could not find markdown file for {language} rule {rule_id} ({short_name})")
+            return None
+
+def process_rule_package(rule_package_file):
+    """Process a single rule package JSON file."""
+    try:
+        with open(rule_package_file, 'r', encoding='utf-8') as f:
+            data = json.load(f)
+        
+        modified = False
+        
+        # Look for CERT-C and CERT-CPP sections
+        for cert_key in ["CERT-C", "CERT-C++"]:
+            if cert_key in data:
+                language = "c" if cert_key == "CERT-C" else "cpp"
+                
+                # Process each rule in the CERT section
+                for rule_id, rule_data in data[cert_key].items():
+                    if "queries" in rule_data:
+                        for query in rule_data["queries"]:
+                            if "short_name" in query:
+                                md_file = find_md_file(rule_id, query["short_name"], language)
+                                
+                                if md_file:
+                                    risk_data = extract_risk_assessment_from_md(md_file)
+                                    
+                                    if risk_data:
+                                        # Add risk assessment data as tags
+                                        if "tags" not in query:
+                                            query["tags"] = []
+                                        
+                                        # Add each risk assessment property as a tag
+                                        for key, value in risk_data.items():
+                                            key_sanitized = key.lower().replace(" ", "-")
+                                            if key_sanitized == "rule" or key_sanitized == "recommendation":
+                                                # skip rule/recommendation as they just repeat the rule ID
+                                                continue
+                                            tag = f"external/cert/{key_sanitized}/{value.lower()}"
+                                            if tag not in query["tags"]:
+                                                query["tags"].append(tag)
+                                                modified = True
+                                                logger.info(f"Added tag {tag} to {rule_id} ({query['short_name']})")
+        
+        # Save the modified data back to the file if any changes were made
+        if modified:
+            with open(rule_package_file, 'w', encoding='utf-8') as f:
+                json.dump(data, f, indent=2)
+            logger.info(f"Updated {rule_package_file}")
+        else:
+            logger.info(f"No changes made to {rule_package_file}")
+            
+    except Exception as e:
+        logger.error(f"Error processing {rule_package_file}: {e}")
+
+def main():
+    """Main function to process all rule packages."""
+    logger.info("Starting risk assessment tag addition process")
+    
+    rule_packages = find_rule_packages()
+    logger.info(f"Found {len(rule_packages)} rule package files")
+    
+    for rule_package in rule_packages:
+        logger.info(f"Processing {rule_package}")
+        process_rule_package(rule_package)
+    
+    logger.info("Completed risk assessment tag addition process")
+
+if __name__ == "__main__":
+    main()
\ No newline at end of file
diff --git a/scripts/generate_modules/queries/codeql-pack.lock.yml b/scripts/generate_modules/queries/codeql-pack.lock.yml
index 2cbbccee53..a45ea8f438 100644
--- a/scripts/generate_modules/queries/codeql-pack.lock.yml
+++ b/scripts/generate_modules/queries/codeql-pack.lock.yml
@@ -2,17 +2,23 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/cpp-all:
-    version: 0.12.9
+    version: 4.0.3
   codeql/dataflow:
-    version: 0.2.3
+    version: 2.0.3
+  codeql/mad:
+    version: 1.0.19
   codeql/rangeanalysis:
-    version: 0.0.11
+    version: 1.0.19
   codeql/ssa:
-    version: 0.2.12
+    version: 1.0.19
   codeql/tutorial:
-    version: 0.2.12
+    version: 1.0.19
+  codeql/typeflow:
+    version: 1.0.19
   codeql/typetracking:
-    version: 0.2.12
+    version: 2.0.3
   codeql/util:
-    version: 0.2.12
+    version: 2.0.6
+  codeql/xml:
+    version: 1.0.19
 compiled: false
diff --git a/scripts/generate_modules/queries/qlpack.yml b/scripts/generate_modules/queries/qlpack.yml
index fea871b973..9aabee2562 100644
--- a/scripts/generate_modules/queries/qlpack.yml
+++ b/scripts/generate_modules/queries/qlpack.yml
@@ -2,4 +2,4 @@ name: codeql/standard-library-extraction-cpp-coding-standards
 version: 0.0.0
 license: MIT
 dependencies:
-  codeql/cpp-all: 0.12.9
+  codeql/cpp-all: 4.0.3
diff --git a/scripts/generate_rules/coding_standards_utils.py b/scripts/generate_rules/coding_standards_utils.py
index 6f96460ef7..b0bcd48443 100644
--- a/scripts/generate_rules/coding_standards_utils.py
+++ b/scripts/generate_rules/coding_standards_utils.py
@@ -19,8 +19,10 @@
 
 def split_camel_case(short_name : str) -> List[str]:
     """Split a camel case string to a list."""
+    # Edge case, turn FooNaNBar into foo-nan-bar instead of foo-na-n-bar by a preprocessing step.
+    nan_fixed = short_name.replace("NaN", "Nan")
     matches = re.finditer(
-        ".+?(?:(?<=[a-z])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])|$)", short_name)
+        ".+?(?:(?<=[a-z])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])|$)", nan_fixed)
     return [m.group(0) for m in matches]
 
 
diff --git a/scripts/generate_rules/templates/misra-c++-2023-help.md.template b/scripts/generate_rules/templates/misra-c++-2023-help.md.template
new file mode 100644
index 0000000000..4fb7b17ee8
--- /dev/null
+++ b/scripts/generate_rules/templates/misra-c++-2023-help.md.template
@@ -0,0 +1,49 @@
+# {{ rule_id }}: {{ name }}
+
+This query implements the {{ standard_name | escape }} rule {{ rule_id | escape }}:
+
+> {{ rule_title }}
+
+## Classification
+
+** REPLACE THIS WITH THE CORRECT CLASSIFICATION **
+* required
+* implementation
+* automated
+
+## Rationale
+
+**REPLACE THIS WITH RATIONAL, IF ANY** 
+
+## Exception
+
+**REPLACE THIS WITH EXCEPTION, IF ANY**
+
+## Example
+
+```cpp
+// REPLACE THIS WITH C++ EXAMPLE, IF ANY
+```
+
+## See more
+
+** REPLACE THIS WITH THE ANY SEE MORE REFERENCES **
+
+## Implementation notes
+
+{% if implementation_scope is defined %}
+{{ implementation_scope["description"] }}
+{% if implementation_scope["items"] is iterable %}
+{% for implementation_scope_entry in implementation_scope["items"] %}
+* {{ implementation_scope_entry }}
+{% endfor %}
+{% endif %}
+{% else %}
+None
+{% endif %}
+
+## References
+
+{% if standard_title | length %}
+* {{ standard_title | escape }}: [{{ rule_id }}: {{ rule_title }}]({{ standard_url }})
+{% endif %}
diff --git a/scripts/help/cert-help-extraction.py b/scripts/help/cert-help-extraction.py
index 6bd1abccd5..f785b0955f 100755
--- a/scripts/help/cert-help-extraction.py
+++ b/scripts/help/cert-help-extraction.py
@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 from argparse import ArgumentParser
+from typing import Generator
 import tempfile
 import re
 import urllib.request
@@ -23,6 +24,7 @@
 
 CERT_WIKI = "https://wiki.sei.cmu.edu"
 RULES_LIST_C = "/confluence/display/c/2+Rules"
+RECOMMENDED_LIST_C = "/confluence/display/c/3+Recommendations"
 RULES_LIST_CPP = "/confluence/display/cplusplus/2+Rules"
 
 cache_path = script_path.parent / '.cache'
@@ -47,16 +49,22 @@ def soupify(url: str) -> BeautifulSoup:
 
     return BeautifulSoup(content, 'html.parser')
 
-
-def get_rules():
-    rules = []
-    for soup in [soupify(f"{CERT_WIKI}{RULES_LIST_C}"), soupify(f"{CERT_WIKI}{RULES_LIST_CPP}")]:
+def get_rule_listings() -> Generator[Tag, None, None]:
+    for rule_list_id in [RULES_LIST_C, RULES_LIST_CPP]:
+        soup = soupify(f"{CERT_WIKI}{rule_list_id}")
         if soup == None:
-            return None
-
-        rule_listing_start = soup.find(
+            continue
+    
+        yield soup.find(
             "h1", string="Rule Listing")
         
+    soup = soupify(f"{CERT_WIKI}{RECOMMENDED_LIST_C}")
+    if soup != None:
+        yield soup.find("h1", string="Recommendation Listing")
+
+def get_rules():
+    rules = []
+    for rule_listing_start in get_rule_listings():
         for link in rule_listing_start.next_element.next_element.find_all('a'):
             if '-C' in link.string:
                 rule, title = map(str.strip, link.string.split('.', 1))
@@ -214,6 +222,8 @@ def helper(node):
                 # Fix a broken url present in many CERT-C pages
                 if node.name == 'a' and 'href' in node.attrs and node['href'] == "http://BB. Definitions#vulnerability":
                     node['href'] = "https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-vulnerability"
+                elif node.name == 'a' and 'href' in node.attrs and node['href'] == "http://BB. Definitions#unexpected behavior":
+                    node['href'] = "https://wiki.sei.cmu.edu/confluence/display/c/BB.+Definitions#BB.Definitions-unexpectedbehavior"
                 # Turn relative URLs into absolute URLS
                 elif node.name == 'a' and 'href' in node.attrs and node['href'].startswith("/confluence"):
                     node['href'] = f"{CERT_WIKI}{node['href']}"
diff --git a/scripts/reports/test-data/deviations/invalid/coding-standards.yml b/scripts/reports/test-data/deviations/invalid/coding-standards.yml
index 7b12c7a8c2..1ce8cc718a 100644
--- a/scripts/reports/test-data/deviations/invalid/coding-standards.yml
+++ b/scripts/reports/test-data/deviations/invalid/coding-standards.yml
@@ -44,8 +44,8 @@ deviations:
     permit-id: non-existing-permit
   - permit-id: DP1
   - permit-id: DP2
-  - rule-id: RULE-13-6
-    query-id: c/misra/sizeof-operand-with-side-effect
+  - rule-id: RULE-9-1
+    query-id: c/misra/object-with-auto-storage-duration-read-before-init
 deviation-permits:
   - permit-id: DP1
     justification: foo bar baz
diff --git a/scripts/reports/test-data/guideline-recategorizations/guideline_recategorizations_report.md.expected b/scripts/reports/test-data/guideline-recategorizations/guideline_recategorizations_report.md.expected
index 54fb25ae83..425eba1bc3 100644
--- a/scripts/reports/test-data/guideline-recategorizations/guideline_recategorizations_report.md.expected
+++ b/scripts/reports/test-data/guideline-recategorizations/guideline_recategorizations_report.md.expected
@@ -13,7 +13,7 @@
 | A0-1-1 | required | advisory | 
 | A0-1-1 | required | mandatory | 
 | A0-1-2 | required | disapplied | 
-| RULE-13-6 | mandatory | required | 
+| RULE-9-1 | mandatory | required | 
 | CON50-CPP | rule | required | 
 | A0-1-6 | advisory | disapplied | 
 | A10-4-1 | advisory | required | 
@@ -25,5 +25,5 @@
 | invalid/coding-standards.xml:5:7:8:43 | 'Invalid recategorization from 'required' to 'advisory'.' for rule A0-1-1. |
 | invalid/coding-standards.xml:9:7:12:43 | 'Invalid recategorization from 'required' to 'disapplied'.' for rule A0-1-2. |
 | invalid/coding-standards.xml:13:7:16:43 | 'Unknown rule id 'A1-4-3'.' for rule A1-4-3. |
-| invalid/coding-standards.xml:17:7:20:43 | 'Invalid recategorization from 'mandatory' to 'required'.' for rule RULE-13-6. |
+| invalid/coding-standards.xml:17:7:20:43 | 'Invalid recategorization from 'mandatory' to 'required'.' for rule RULE-9-1. |
 | invalid/coding-standards.xml:21:7:24:43 | 'Invalid recategorization from 'rule' to 'required'.' for rule CON50-CPP. |
diff --git a/scripts/reports/test-data/guideline-recategorizations/invalid/coding-standards.yml b/scripts/reports/test-data/guideline-recategorizations/invalid/coding-standards.yml
index 89e562c05c..cd6abbf120 100644
--- a/scripts/reports/test-data/guideline-recategorizations/invalid/coding-standards.yml
+++ b/scripts/reports/test-data/guideline-recategorizations/invalid/coding-standards.yml
@@ -5,7 +5,7 @@ guideline-recategorizations:
     category: "disapplied"
   - rule-id: "A1-4-3"
     category: "mandatory"
-  - rule-id: "RULE-13-6"
+  - rule-id: "RULE-9-1"
     category: "required"
   - rule-id: "CON50-CPP"
     category: "required"
diff --git a/scripts/verify_rule_package_consistency.py b/scripts/verify_rule_package_consistency.py
index 034e367db2..b9eaa5b934 100644
--- a/scripts/verify_rule_package_consistency.py
+++ b/scripts/verify_rule_package_consistency.py
@@ -109,6 +109,24 @@
                             print(
                                 f' - ERROR: {standard_name} query {query["short_name"]}.ql for Rule {rule_id} in {package_name}.json has a spurious `external/misra/c/2012/...` tag.')
                             failed = True
+                        if standard_name == "CERT-C" or standard_name == "CERT-C++":
+                            expected_properties = [
+                                "severity",
+                                "likelihood",
+                                "remediation-cost",
+                                "priority",
+                                "level"
+                            ]
+                            for expected_property in expected_properties:
+                                if not any(tag for tag in query["tags"] if tag.startswith(f"external/cert/{expected_property}/")):
+                                    print(
+                                        f' - ERROR: {standard_name} query {query["short_name"]}.ql for Rule {rule_id} in {package_name}.json is missing a `external/cert/{expected_property}/...` tag.')
+                                    failed = True
+                        if not standard_name == "CERT-C" and not standard_name == "CERT-C++":
+                            if any(tag for tag in query["tags"] if tag.startswith("external/cert/")):
+                                print(
+                                    f' - ERROR: {standard_name} query {query["short_name"]}.ql for Rule {rule_id} in {package_name}.json has a spurious `external/cert/...` tag.')
+                                failed = True
             rules_csv_rule_ids = package_rules_from_csv[package_name]
 
             json_missing_rules = rules_csv_rule_ids.difference(package_json_rule_ids)
diff --git a/supported_codeql_configs.json b/supported_codeql_configs.json
index e8b2597100..9b89dd849e 100644
--- a/supported_codeql_configs.json
+++ b/supported_codeql_configs.json
@@ -1,9 +1,9 @@
 {
   "supported_environment": [
     {
-      "codeql_cli": "2.16.6",
-      "codeql_standard_library": "codeql-cli/v2.16.6",
-      "codeql_cli_bundle": "codeql-bundle-v2.16.6"
+      "codeql_cli": "2.20.7",
+      "codeql_standard_library": "codeql-cli/v2.20.7",
+      "codeql_cli_bundle": "codeql-bundle-v2.20.7"
     }
   ],
   "supported_language": [