diff --git a/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql b/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql
index 48b9487728..24a7089ccc 100644
--- a/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql
+++ b/c/cert/src/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.ql
@@ -19,7 +19,7 @@
 import cpp
 import codingstandards.c.cert
 import codingstandards.cpp.SideEffect
-import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.new.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 /** Holds if the function's return value is derived from the `AliasParamter` p. */
diff --git a/c/cert/test/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.expected b/c/cert/test/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.expected
index fe7ac757a6..6f52ab29e3 100644
--- a/c/cert/test/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.expected
+++ b/c/cert/test/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.expected
@@ -5,7 +5,13 @@
 | test.c:45:17:45:30 | ... + ... | Buffer may access up to offset 101*1 which is greater than the fixed size 100 of the $@. | test.c:45:17:45:22 | buffer | buffer |
 | test.c:55:5:55:13 | ... - ... | Buffer access may be to a negative index in the buffer. | test.c:55:5:55:9 | ptr16 | buffer |
 | test.c:57:5:57:14 | ... + ... | Buffer accesses offset 22 which is greater than the fixed size 20 of the $@. | test.c:57:5:57:9 | ptr16 | buffer |
+| test.c:58:5:58:14 | ... - ... | Buffer access may be to a negative index in the buffer. | test.c:55:5:55:9 | ptr16 | buffer |
+| test.c:58:5:58:14 | ... - ... | Buffer access may be to a negative index in the buffer. | test.c:56:5:56:9 | ptr16 | buffer |
+| test.c:58:5:58:14 | ... - ... | Buffer access may be to a negative index in the buffer. | test.c:57:5:57:9 | ptr16 | buffer |
 | test.c:58:5:58:14 | ... - ... | Buffer access may be to a negative index in the buffer. | test.c:58:5:58:9 | ptr16 | buffer |
 | test.c:63:3:63:9 | access to array | Buffer access may be to a negative index in the buffer. | test.c:63:3:63:5 | arr | buffer |
 | test.c:65:3:65:9 | access to array | Buffer accesses offset 44 which is greater than the fixed size 40 of the $@. | test.c:65:3:65:5 | arr | buffer |
+| test.c:66:3:66:10 | access to array | Buffer access may be to a negative index in the buffer. | test.c:63:3:63:5 | arr | buffer |
+| test.c:66:3:66:10 | access to array | Buffer access may be to a negative index in the buffer. | test.c:64:3:64:5 | arr | buffer |
+| test.c:66:3:66:10 | access to array | Buffer access may be to a negative index in the buffer. | test.c:65:3:65:5 | arr | buffer |
 | test.c:66:3:66:10 | access to array | Buffer access may be to a negative index in the buffer. | test.c:66:3:66:5 | arr | buffer |
diff --git a/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected b/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected
index 034f7e9366..3ea1a05fd7 100644
--- a/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected
+++ b/c/cert/test/rules/EXP30-C/DependenceOnOrderOfFunctionArgumentsForSideEffects.expected
@@ -1,25 +1 @@
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:28,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:28,59-67)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:31,33-41)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:31,57-65)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:35,33-41)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:35,59-67)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:44,5-13)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:44,25-33)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:44,53-61)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:47,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:47,57-65)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:56,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:56,55-63)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:63,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:63,57-65)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:75,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:75,55-63)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:28,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:31,7-20)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:35,7-20)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:47,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:56,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:63,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DependenceOnOrderOfFunctionArgumentsForSideEffects.ql:75,5-18)
 | test.c:20:3:20:4 | call to f1 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.c:20:6:20:7 | call to f2 | call to f2 | test.c:20:12:20:13 | call to f3 | call to f3 |
diff --git a/c/common/src/codingstandards/c/OutOfBounds.qll b/c/common/src/codingstandards/c/OutOfBounds.qll
index 1f1680f56c..dffb48b5fa 100644
--- a/c/common/src/codingstandards/c/OutOfBounds.qll
+++ b/c/common/src/codingstandards/c/OutOfBounds.qll
@@ -11,7 +11,6 @@ import codingstandards.cpp.Allocations
 import codingstandards.cpp.Overflow
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 import codingstandards.cpp.SimpleRangeAnalysisCustomizations
-private import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 module OOB {
@@ -380,8 +379,13 @@ module OOB {
     StrncatLibraryFunction() { this.getName() = getNameOrInternalName(["strncat", "wcsncat"]) }
 
     override predicate getALengthParameterIndex(int i) {
-      // `strncat` and `wcsncat` exclude the size of a null terminator
-      i = 2
+      // The source need not contain a null terminator within the first `n` characters.
+      none()
+    }
+
+    override predicate getANullTerminatedParameterIndex(int i) {
+      // The destination must be null-terminated.
+      i = 0
     }
   }
 
@@ -645,42 +649,46 @@ module OOB {
   }
 
   /**
-   * A class for reasoning about the offset of a variable from the original value flowing to it
-   * as a result of arithmetic or pointer arithmetic expressions.
+   * Gets the offset of `expr` from `underlyingBase` due to arithmetic or pointer arithmetic.
+   *
+   * `underlyingBase` may be the arithmetic operand's base expression or `expr` itself, allowing
+   * callers to use whichever dataflow node is available.
    */
   bindingset[expr]
-  private int getArithmeticOffsetValue(Expr expr, Expr base) {
-    result = getMinStatedValue(expr.(PointerArithmeticExpr).getOperand()) and
-    base = expr.(PointerArithmeticExpr).getPointer()
-    or
-    // &(array[index]) expressions
-    result =
-      getMinStatedValue(expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getOperand()) and
-    base = expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getPointer()
-    or
-    result = getMinStatedValue(expr.(AddExpr).getRightOperand()) and
-    base = expr.(AddExpr).getLeftOperand()
-    or
-    result = -getMinStatedValue(expr.(SubExpr).getRightOperand()) and
-    base = expr.(SubExpr).getLeftOperand()
-    or
-    expr instanceof IncrementOperation and
-    result = 1 and
-    base = expr.(IncrementOperation).getOperand()
-    or
-    expr instanceof DecrementOperation and
-    result = -1 and
-    base = expr.(DecrementOperation).getOperand()
-    or
-    // fall-back if `expr` is not an arithmetic or pointer arithmetic expression
-    not expr instanceof PointerArithmeticExpr and
-    not expr.(AddressOfExpr).getOperand() instanceof PointerArithmeticExpr and
-    not expr instanceof AddExpr and
-    not expr instanceof SubExpr and
-    not expr instanceof IncrementOperation and
-    not expr instanceof DecrementOperation and
-    base = expr and
-    result = 0
+  private int getArithmeticOffsetValue(Expr expr, Expr underlyingBase) {
+    exists(Expr base | underlyingBase = [base, expr] |
+      result = getMinStatedValue(expr.(PointerArithmeticExpr).getOperand()) and
+      base = expr.(PointerArithmeticExpr).getPointer()
+      or
+      // &(array[index]) expressions
+      result =
+        getMinStatedValue(expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getOperand()) and
+      base = expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getPointer()
+      or
+      result = getMinStatedValue(expr.(AddExpr).getRightOperand()) and
+      base = expr.(AddExpr).getLeftOperand()
+      or
+      result = -getMinStatedValue(expr.(SubExpr).getRightOperand()) and
+      base = expr.(SubExpr).getLeftOperand()
+      or
+      expr instanceof IncrementOperation and
+      result = 1 and
+      base = expr.(IncrementOperation).getOperand()
+      or
+      expr instanceof DecrementOperation and
+      result = -1 and
+      base = expr.(DecrementOperation).getOperand()
+      or
+      // fall-back if `expr` is not an arithmetic or pointer arithmetic expression
+      not expr instanceof PointerArithmeticExpr and
+      not expr.(AddressOfExpr).getOperand() instanceof PointerArithmeticExpr and
+      not expr instanceof AddExpr and
+      not expr instanceof SubExpr and
+      not expr instanceof IncrementOperation and
+      not expr instanceof DecrementOperation and
+      base = expr and
+      result = 0
+    )
   }
 
   private int constOrZero(Expr e) {
diff --git a/c/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected b/c/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
index afbb275c6c..813c0791cb 100644
--- a/c/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
+++ b/c/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
@@ -1,5 +1,4 @@
 problems
-| test.c:11:7:11:12 | * ... | test.c:18:16:18:21 | call to getenv | test.c:11:7:11:12 | * ... | The object returned by the function getenv should not be modified. |
 | test.c:11:8:11:12 | c_str | test.c:18:16:18:21 | call to getenv | test.c:11:7:11:12 | * ... | The object returned by the function getenv should not be modified. |
 | test.c:67:5:67:9 | conv4 | test.c:64:11:64:20 | call to localeconv | test.c:67:5:67:9 | conv4 | The object returned by the function localeconv should not be modified. |
 | test.c:76:5:76:8 | conv | test.c:72:25:72:34 | call to localeconv | test.c:76:5:76:8 | conv | The object returned by the function localeconv should not be modified. |
diff --git a/c/misra/src/rules/RULE-14-3/ControllingExprInvariant.ql b/c/misra/src/rules/RULE-14-3/ControllingExprInvariant.ql
index 1bd2708750..01580a756e 100644
--- a/c/misra/src/rules/RULE-14-3/ControllingExprInvariant.ql
+++ b/c/misra/src/rules/RULE-14-3/ControllingExprInvariant.ql
@@ -40,7 +40,9 @@ where
         conditionAlwaysFalse(expr) and
         not (
           getEssentialTypeCategory(getEssentialType(expr)) instanceof EssentiallyBooleanType and
-          expr.getValue() = "0"
+          expr.getValue() = "0" and
+          // Only apply to expressions that do not reference variables.
+          not exists(VariableAccess va | va = expr.getAChild*())
         )
         or
         conditionAlwaysTrue(expr) and
diff --git a/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected b/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected
index 3beb834f84..fce8f8e5d6 100644
--- a/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected
+++ b/c/misra/test/rules/RULE-14-3/ControllingExprInvariant.expected
@@ -3,6 +3,8 @@
 | test.c:16:9:16:13 | ... > ... | Controlling expression in if statement has an invariant value. |
 | test.c:20:20:20:24 | ... < ... | Controlling expression in loop statement has an invariant value. |
 | test.c:27:10:27:14 | ... < ... | Controlling expression in loop statement has an invariant value. |
-| test.c:37:3:37:6 | 1 | Controlling expression in conditional statement has an invariant value. |
-| test.c:38:3:38:3 | 1 | Controlling expression in conditional statement has an invariant value. |
-| test.c:45:10:45:26 | ... && ... | Controlling expression in loop statement has an invariant value. |
+| test.c:35:12:35:12 | 0 | Controlling expression in loop statement has an invariant value. |
+| test.c:39:3:39:6 | 1 | Controlling expression in conditional statement has an invariant value. |
+| test.c:40:3:40:3 | 1 | Controlling expression in conditional statement has an invariant value. |
+| test.c:47:10:47:26 | ... && ... | Controlling expression in loop statement has an invariant value. |
+| test.c:49:10:49:21 | ... && ... | Controlling expression in loop statement has an invariant value. |
diff --git a/c/misra/test/rules/RULE-14-3/test.c b/c/misra/test/rules/RULE-14-3/test.c
index ed8854afd2..1687ed66be 100644
--- a/c/misra/test/rules/RULE-14-3/test.c
+++ b/c/misra/test/rules/RULE-14-3/test.c
@@ -31,6 +31,8 @@ void f3() {
 void f4() {
   do {
   } while (0u == 1u); // COMPLIANT - by exception 2
+  do {
+  } while (0); // NON_COMPLIANT - a bare literal `0` is not essentially Boolean
 }
 
 void f5(bool b1) {
@@ -44,4 +46,6 @@ void f6(int p1) {
   }
   while (1 == 0 && p1 > 12) { // NON_COMPLIANT
   }
+  while (0 && p1 > 12) { // NON_COMPLIANT
+  }
 }
\ No newline at end of file
diff --git a/c/misra/test/rules/RULE-21-18/test.c b/c/misra/test/rules/RULE-21-18/test.c
index d1668a774b..f6daf6bdf2 100644
--- a/c/misra/test/rules/RULE-21-18/test.c
+++ b/c/misra/test/rules/RULE-21-18/test.c
@@ -103,4 +103,10 @@ void test(void) {
     strxfrm(buf + 1, buf2,
             sizeof(buf) - 1); // NON_COMPLIANT - not null-terminated
   }
-}
\ No newline at end of file
+}
+
+void test_strncat_bounded_source(void) {
+  char destination[2] = {0};
+  char source[1] = {'x'};
+  strncat(destination, source, 1); // COMPLIANT
+}
diff --git a/change_notes/2026-08-28-cpp-all-upgrade-result-changes.md b/change_notes/2026-08-28-cpp-all-upgrade-result-changes.md
new file mode 100644
index 0000000000..77d83b9822
--- /dev/null
+++ b/change_notes/2026-08-28-cpp-all-upgrade-result-changes.md
@@ -0,0 +1,9 @@
+- Upgraded CodeQL to v2.23.9, updating `codeql/cpp-all` and related dependencies. 
+- `RULE-1-2` - `LanguageExtensionsShouldNotBeUsed.ql`: fixed a false negative where `_Decimal32`,
+  `_Decimal64` and `_Decimal128` declarations were no longer reported as compiler extensions.
+- `ENV30-C`, `RULE-21-19`, `RULE-25-5-2`: fixed a duplicate alert reported for the same pointer
+  write.
+- `INT31-C` - `IntegerConversionCausesDataLoss.ql`: fixed a false positive on the standard-permitted
+  `(time_t)-1` conversion.
+- `RULE-14-3` - `ControllingExprInvariant.ql`: fixed a false negative where a loop's compound
+  controlling expression that always evaluates to false was incorrectly permitted.
diff --git a/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql b/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql
index 960d04449e..cf4906a8f2 100644
--- a/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql
+++ b/cpp/cert/src/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql
@@ -19,7 +19,6 @@
 import cpp
 import codingstandards.cpp.cert
 import codingstandards.cpp.SideEffect
-import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.dataflow.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
diff --git a/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql b/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql
index 79ff7a08a2..010e9e7b8a 100644
--- a/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql
+++ b/cpp/cert/src/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.ql
@@ -18,7 +18,7 @@
 import cpp
 import codingstandards.cpp.cert
 import semmle.code.cpp.controlflow.Guards
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.exceptions.ExceptionSpecifications
 
 /**
diff --git a/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected b/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected
index 08d46a7bbd..a054976ae6 100644
--- a/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected
+++ b/cpp/cert/test/rules/EXP50-CPP/DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.expected
@@ -1,27 +1,27 @@
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:29,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:29,59-67)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:32,33-41)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:32,57-65)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:36,33-41)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:36,59-67)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:45,5-13)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:45,25-33)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:45,53-61)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:48,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:48,57-65)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:57,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:57,55-63)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:64,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:64,57-65)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:76,31-39)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:76,55-63)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:29,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:32,7-20)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:36,7-20)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:48,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:57,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:64,5-18)
-WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:76,5-18)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:28,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:28,59-67)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:31,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:31,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:35,33-41)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:35,59-67)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:44,5-13)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:44,25-33)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:44,53-61)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:47,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:47,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:56,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:56,55-63)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:63,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:63,57-65)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:75,31-39)
+WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:75,55-63)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:28,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:31,7-20)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:35,7-20)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:47,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:56,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:63,5-18)
+WARNING: module 'TaintTracking' has been deprecated and may be removed in future (DoNotDependOnTheOrderOfEvaluationForSideEffectsInFunctionCallsAsFunctionArguments.ql:75,5-18)
 | test.cpp:82:3:82:4 | call to f2 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.cpp:82:6:82:7 | call to f5 | call to f5 | test.cpp:82:12:82:13 | call to f6 | call to f6 |
 | test.cpp:84:3:84:4 | call to f2 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.cpp:84:6:84:7 | call to f5 | call to f5 | test.cpp:84:12:84:13 | call to f7 | call to f7 |
 | test.cpp:87:3:87:4 | call to f2 | Depending on the order of evaluation for the arguments $@ and $@ for side effects on shared state is unspecified and can result in unexpected behavior. | test.cpp:87:9:87:10 | call to m1 | call to m1 | test.cpp:87:18:87:19 | call to m1 | call to m1 |
diff --git a/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected b/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected
index ec11edcd2b..b7452ec199 100644
--- a/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected
+++ b/cpp/cert/test/rules/MEM52-CPP/DetectAndHandleMemoryAllocationErrors.expected
@@ -1,8 +1,2 @@
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:64,5-13)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:87,46-54)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:88,22-30)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:92,20-28)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:97,35-43)
-WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:102,38-46)
 | test.cpp:24:7:24:34 | new | nothrow new allocation of $@ returns here without a subsequent check to see whether the pointer is valid. | test.cpp:24:7:24:34 | new | StructA * |
 | test.cpp:40:17:40:38 | call to allocate_without_check | nothrow new allocation of $@ returns here without a subsequent check to see whether the pointer is valid. | test.cpp:35:17:35:44 | new | StructA * |
diff --git a/cpp/common/src/codingstandards/cpp/AccessPath.qll b/cpp/common/src/codingstandards/cpp/AccessPath.qll
index 3af462e1ec..a83575cb7e 100644
--- a/cpp/common/src/codingstandards/cpp/AccessPath.qll
+++ b/cpp/common/src/codingstandards/cpp/AccessPath.qll
@@ -1,5 +1,5 @@
 import cpp
-private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.new.DataFlow
 
 newtype TFieldQualifier =
   ExplicitQualifier(VariableAccess v) or
diff --git a/cpp/common/src/codingstandards/cpp/Allocations.qll b/cpp/common/src/codingstandards/cpp/Allocations.qll
index decdfe9fc4..6c775ccbab 100644
--- a/cpp/common/src/codingstandards/cpp/Allocations.qll
+++ b/cpp/common/src/codingstandards/cpp/Allocations.qll
@@ -7,7 +7,7 @@
 
 import cpp
 import semmle.code.cpp.controlflow.SSA
-private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.new.DataFlow
 
 /**
  * Holds if `alloc` is a use of `malloc` or `new`.  `kind` is
diff --git a/cpp/common/src/codingstandards/cpp/ConstHelpers.qll b/cpp/common/src/codingstandards/cpp/ConstHelpers.qll
index a3d12fd127..2a675cad5e 100644
--- a/cpp/common/src/codingstandards/cpp/ConstHelpers.qll
+++ b/cpp/common/src/codingstandards/cpp/ConstHelpers.qll
@@ -4,7 +4,7 @@
 
 import cpp
 import codingstandards.cpp.SideEffect
-private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.FunctionParameter
 
 /** A variable that can be modified (both the pointer and object pointed to if pointer type) */
diff --git a/cpp/common/src/codingstandards/cpp/Expr.qll b/cpp/common/src/codingstandards/cpp/Expr.qll
index bf3d1dcd56..c4650ea0b4 100644
--- a/cpp/common/src/codingstandards/cpp/Expr.qll
+++ b/cpp/common/src/codingstandards/cpp/Expr.qll
@@ -1,5 +1,5 @@
 import cpp
-private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.new.DataFlow
 private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import codingstandards.cpp.AccessPath
 
diff --git a/cpp/common/src/codingstandards/cpp/Identifiers.qll b/cpp/common/src/codingstandards/cpp/Identifiers.qll
index cbacb9b8e2..67fd8634b4 100644
--- a/cpp/common/src/codingstandards/cpp/Identifiers.qll
+++ b/cpp/common/src/codingstandards/cpp/Identifiers.qll
@@ -22,7 +22,7 @@ class InterestingIdentifiers extends Declaration {
   InterestingIdentifiers() {
     not this.isFromTemplateInstantiation(_) and
     not this.isFromUninstantiatedTemplate(_) and
-    not this instanceof TemplateParameter and
+    not this instanceof TypeTemplateParameter and
     not this.hasDeclaringType() and
     not this instanceof Operator and
     not this.hasName("main") and
@@ -291,7 +291,7 @@ private module IdentifierIntroductionImpl {
         // A template parameter may itself be a template (`template <template<typename> class T>`).
         // The inner template parameter `template<typename>` is anonymous and does not introduce an
         // identifier.
-        not type.(TemplateParameter).isAnonymous()
+        not type.(TypeTemplateParameter).isAnonymous()
         or
         // In the above case, the template template parameter `T` is incorrectly marked as anonymous
         // in the database. But it does introduce the identifier `T`, so it must not be excluded.
diff --git a/cpp/common/src/codingstandards/cpp/Iterators.qll b/cpp/common/src/codingstandards/cpp/Iterators.qll
index 38ebf3f7b7..b830151236 100644
--- a/cpp/common/src/codingstandards/cpp/Iterators.qll
+++ b/cpp/common/src/codingstandards/cpp/Iterators.qll
@@ -3,13 +3,13 @@
  */
 
 import cpp
-private import semmle.code.cpp.dataflow.DataFlow
-private import semmle.code.cpp.dataflow.TaintTracking
+private import semmle.code.cpp.dataflow.new.TaintTracking
 import codingstandards.cpp.StdNamespace
 import codingstandards.cpp.rules.containeraccesswithoutrangecheck.ContainerAccessWithoutRangeCheck as ContainerAccessWithoutRangeCheck
 import semmle.code.cpp.controlflow.Guards
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
+import codingstandards.cpp.standardlibrary.STLContainers
 
 abstract class ContainerAccess extends VariableAccess {
   abstract Variable getOwningContainer();
diff --git a/cpp/common/src/codingstandards/cpp/OutOfBounds.qll b/cpp/common/src/codingstandards/cpp/OutOfBounds.qll
index b088233f92..38ed19712b 100644
--- a/cpp/common/src/codingstandards/cpp/OutOfBounds.qll
+++ b/cpp/common/src/codingstandards/cpp/OutOfBounds.qll
@@ -16,7 +16,6 @@ import codingstandards.cpp.Allocations
 import codingstandards.cpp.Overflow
 import codingstandards.cpp.PossiblyUnsafeStringOperation
 import codingstandards.cpp.SimpleRangeAnalysisCustomizations
-private import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 module OOB {
@@ -385,16 +384,13 @@ module OOB {
     StrncatLibraryFunction() { this.getName() = getNameOrInternalName(["strncat", "wcsncat"]) }
 
     override predicate getALengthParameterIndex(int i) {
-      // `strncat` and `wcsncat` exclude the size of a null terminator, but
-      // both stops copying right after the null terminator is encountered.
-      // In fact, they don't care if the source buffer is null-terminated
-      // or not.
+      // The source need not contain a null terminator within the first `n` characters.
       none()
     }
 
     override predicate getANullTerminatedParameterIndex(int i) {
-      // `strncat` does not require null-terminated parameters
-      none()
+      // The destination must be null-terminated.
+      i = 0
     }
   }
 
@@ -658,42 +654,46 @@ module OOB {
   }
 
   /**
-   * A class for reasoning about the offset of a variable from the original value flowing to it
-   * as a result of arithmetic or pointer arithmetic expressions.
+   * Gets the offset of `expr` from `underlyingBase` due to arithmetic or pointer arithmetic.
+   *
+   * `underlyingBase` may be the arithmetic operand's base expression or `expr` itself, allowing
+   * callers to use whichever dataflow node is available.
    */
   bindingset[expr]
-  private int getArithmeticOffsetValue(Expr expr, Expr base) {
-    result = getMinStatedValue(expr.(PointerArithmeticExpr).getOperand()) and
-    base = expr.(PointerArithmeticExpr).getPointer()
-    or
-    // &(array[index]) expressions
-    result =
-      getMinStatedValue(expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getOperand()) and
-    base = expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getPointer()
-    or
-    result = getMinStatedValue(expr.(AddExpr).getRightOperand()) and
-    base = expr.(AddExpr).getLeftOperand()
-    or
-    result = -getMinStatedValue(expr.(SubExpr).getRightOperand()) and
-    base = expr.(SubExpr).getLeftOperand()
-    or
-    expr instanceof IncrementOperation and
-    result = 1 and
-    base = expr.(IncrementOperation).getOperand()
-    or
-    expr instanceof DecrementOperation and
-    result = -1 and
-    base = expr.(DecrementOperation).getOperand()
-    or
-    // fall-back if `expr` is not an arithmetic or pointer arithmetic expression
-    not expr instanceof PointerArithmeticExpr and
-    not expr.(AddressOfExpr).getOperand() instanceof PointerArithmeticExpr and
-    not expr instanceof AddExpr and
-    not expr instanceof SubExpr and
-    not expr instanceof IncrementOperation and
-    not expr instanceof DecrementOperation and
-    base = expr and
-    result = 0
+  private int getArithmeticOffsetValue(Expr expr, Expr underlyingBase) {
+    exists(Expr base | underlyingBase = [base, expr] |
+      result = getMinStatedValue(expr.(PointerArithmeticExpr).getOperand()) and
+      base = expr.(PointerArithmeticExpr).getPointer()
+      or
+      // &(array[index]) expressions
+      result =
+        getMinStatedValue(expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getOperand()) and
+      base = expr.(AddressOfExpr).getOperand().(PointerArithmeticExpr).getPointer()
+      or
+      result = getMinStatedValue(expr.(AddExpr).getRightOperand()) and
+      base = expr.(AddExpr).getLeftOperand()
+      or
+      result = -getMinStatedValue(expr.(SubExpr).getRightOperand()) and
+      base = expr.(SubExpr).getLeftOperand()
+      or
+      expr instanceof IncrementOperation and
+      result = 1 and
+      base = expr.(IncrementOperation).getOperand()
+      or
+      expr instanceof DecrementOperation and
+      result = -1 and
+      base = expr.(DecrementOperation).getOperand()
+      or
+      // fall-back if `expr` is not an arithmetic or pointer arithmetic expression
+      not expr instanceof PointerArithmeticExpr and
+      not expr.(AddressOfExpr).getOperand() instanceof PointerArithmeticExpr and
+      not expr instanceof AddExpr and
+      not expr instanceof SubExpr and
+      not expr instanceof IncrementOperation and
+      not expr instanceof DecrementOperation and
+      base = expr and
+      result = 0
+    )
   }
 
   private int constOrZero(Expr e) {
diff --git a/cpp/common/src/codingstandards/cpp/Overflow.qll b/cpp/common/src/codingstandards/cpp/Overflow.qll
index b81147d6bf..06a05429c0 100644
--- a/cpp/common/src/codingstandards/cpp/Overflow.qll
+++ b/cpp/common/src/codingstandards/cpp/Overflow.qll
@@ -6,7 +6,7 @@ import cpp
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 import SimpleRangeAnalysisCustomizations
 import semmle.code.cpp.controlflow.Guards
-private import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.new.TaintTracking
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 import codingstandards.cpp.Expr
 import codingstandards.cpp.UndefinedBehavior
diff --git a/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll b/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll
index 94e7f89796..af24ab9a7c 100644
--- a/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll
+++ b/cpp/common/src/codingstandards/cpp/ReadErrorsAndEOF.qll
@@ -1,5 +1,5 @@
 import cpp
-private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.standardlibrary.FileAccess
 
 /**
diff --git a/cpp/common/src/codingstandards/cpp/SmartPointers.qll b/cpp/common/src/codingstandards/cpp/SmartPointers.qll
index a643b0bc2b..99d5fa853f 100644
--- a/cpp/common/src/codingstandards/cpp/SmartPointers.qll
+++ b/cpp/common/src/codingstandards/cpp/SmartPointers.qll
@@ -1,5 +1,5 @@
 import cpp
-private import semmle.code.cpp.dataflow.DataFlow
+private import semmle.code.cpp.dataflow.new.DataFlow
 
 // Local cached version of localExprFlow to avoid bad magic
 cached
diff --git a/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll b/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll
index a0caabe624..0e21cf6cc2 100644
--- a/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll
+++ b/cpp/common/src/codingstandards/cpp/deadcode/UnusedVariables.qll
@@ -13,7 +13,7 @@ import codingstandards.cpp.Scope
  */
 class TemplateDependentType extends Type {
   TemplateDependentType() {
-    this instanceof TemplateParameter
+    this instanceof TypeTemplateParameter
     or
     exists(TemplateDependentType t |
       this.refersToDirectly(t) and
diff --git a/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll b/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll
index d17cd560bb..59bb231a4a 100644
--- a/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/constlikereturnvalue/ConstLikeReturnValue.qll
@@ -52,7 +52,9 @@ module DFConfig implements DataFlow::ConfigSig {
 
 module DFFlow = DataFlow::Global<DFConfig>;
 
-query predicate problems(Element e, DFFlow::PathNode source, DFFlow::PathNode sink, string message) {
+query predicate problems(
+  ObjectWrite e, DFFlow::PathNode source, DFFlow::PathNode sink, string message
+) {
   not isExcluded(e, getQuery()) and
   // the modified object comes from a call to one of the ENV functions
   DFFlow::flowPath(source, sink) and
diff --git a/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll b/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll
index fcf20afbc0..784b585950 100644
--- a/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/containeraccesswithoutrangecheck/ContainerAccessWithoutRangeCheck.qll
@@ -12,7 +12,7 @@ import codingstandards.cpp.Operator
 import semmle.code.cpp.controlflow.Guards
 private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
 import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import semmle.code.cpp.valuenumbering.GlobalValueNumbering
 
 abstract class ContainerAccessWithoutRangeCheckSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/multipleglobalormemberdeclarators/MultipleGlobalOrMemberDeclarators.qll b/cpp/common/src/codingstandards/cpp/rules/multipleglobalormemberdeclarators/MultipleGlobalOrMemberDeclarators.qll
index 05821d7270..712e61ab03 100644
--- a/cpp/common/src/codingstandards/cpp/rules/multipleglobalormemberdeclarators/MultipleGlobalOrMemberDeclarators.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/multipleglobalormemberdeclarators/MultipleGlobalOrMemberDeclarators.qll
@@ -31,7 +31,7 @@ Query getQuery() { result instanceof MultipleGlobalOrMemberDeclaratorsSharedQuer
 class NonLocalUserDeclaration extends Declaration {
   NonLocalUserDeclaration() {
     not this instanceof StackVariable and
-    not this instanceof TemplateParameter and
+    not this instanceof TypeTemplateParameter and
     not this instanceof EnumConstant and
     not this instanceof TypedefType and
     not any(LambdaCapture lc).getField() = this and
diff --git a/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll b/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll
index 248cde106f..0b4cabbfee 100644
--- a/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/nonconstantformat/NonConstantFormat.qll
@@ -1,7 +1,7 @@
 import cpp
 import codingstandards.cpp.Customizations
 import codingstandards.cpp.Exclusions
-import semmle.code.cpp.dataflow.TaintTracking
+import semmle.code.cpp.dataflow.new.TaintTracking
 import semmle.code.cpp.commons.Printf
 
 abstract class NonConstantFormatSharedQuery extends Query { }
diff --git a/cpp/common/src/codingstandards/cpp/rules/nonvoidfunctiondoesnotreturn/NonVoidFunctionDoesNotReturn.qll b/cpp/common/src/codingstandards/cpp/rules/nonvoidfunctiondoesnotreturn/NonVoidFunctionDoesNotReturn.qll
index cd5d1bdef4..2ee0a1a152 100644
--- a/cpp/common/src/codingstandards/cpp/rules/nonvoidfunctiondoesnotreturn/NonVoidFunctionDoesNotReturn.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/nonvoidfunctiondoesnotreturn/NonVoidFunctionDoesNotReturn.qll
@@ -16,7 +16,7 @@ predicate functionsMissingReturnStmt(Function f, ControlFlowNode blame) {
   exists(Type returnType |
     returnType = f.getUnspecifiedType() and
     not returnType instanceof VoidType and
-    not returnType instanceof TemplateParameter
+    not returnType instanceof TypeTemplateParameter
   ) and
   exists(ReturnStmt s |
     f.getAPredecessor() = s and
diff --git a/cpp/common/src/codingstandards/cpp/rules/unnecessaryexposedidentifierdeclarationshared/UnnecessaryExposedIdentifierDeclarationShared.qll b/cpp/common/src/codingstandards/cpp/rules/unnecessaryexposedidentifierdeclarationshared/UnnecessaryExposedIdentifierDeclarationShared.qll
index 695a8740b6..8b0dcbc6c2 100644
--- a/cpp/common/src/codingstandards/cpp/rules/unnecessaryexposedidentifierdeclarationshared/UnnecessaryExposedIdentifierDeclarationShared.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/unnecessaryexposedidentifierdeclarationshared/UnnecessaryExposedIdentifierDeclarationShared.qll
@@ -218,7 +218,7 @@ class CandidateDeclaration extends Declaration {
     or
     this instanceof Type and
     not this instanceof ClassTemplateInstantiation and
-    not this instanceof TemplateParameter
+    not this instanceof TypeTemplateParameter
   }
 }
 
diff --git a/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll b/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll
index b6d085619a..a0de4fe329 100644
--- a/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll
+++ b/cpp/common/src/codingstandards/cpp/rules/unusedtypedeclarations/UnusedTypeDeclarations.qll
@@ -14,7 +14,7 @@ Query getQuery() { result instanceof UnusedTypeDeclarationsSharedQuery }
 query predicate problems(UserType ut, string message) {
   not isExcluded(ut, getQuery()) and
   message = "Type declaration " + ut.getName() + " is not used." and
-  not ut instanceof TemplateParameter and
+  not ut instanceof TypeTemplateParameter and
   not ut instanceof ProxyClass and
   not exists(getATypeUse(ut)) and
   not ut.isFromUninstantiatedTemplate(_)
diff --git a/cpp/common/src/codingstandards/cpp/standardlibrary/STLContainers.qll b/cpp/common/src/codingstandards/cpp/standardlibrary/STLContainers.qll
index 3e53fbba8e..8736ba1e19 100644
--- a/cpp/common/src/codingstandards/cpp/standardlibrary/STLContainers.qll
+++ b/cpp/common/src/codingstandards/cpp/standardlibrary/STLContainers.qll
@@ -1,8 +1,7 @@
 import cpp
 import codingstandards.cpp.StdNamespace
 private import codingstandards.cpp.standardlibrary.Iterators
-private import semmle.code.cpp.dataflow.DataFlow
-private import semmle.code.cpp.dataflow.TaintTracking
+private import semmle.code.cpp.dataflow.new.TaintTracking
 private import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 
 newtype TContainerKind =
diff --git a/cpp/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected b/cpp/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
index dbbff59c9f..a24ad445f8 100644
--- a/cpp/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
+++ b/cpp/common/test/rules/constlikereturnvalue/ConstLikeReturnValue.expected
@@ -1,5 +1,4 @@
 problems
-| test.cpp:11:7:11:12 | * ... | test.cpp:18:16:18:21 | call to getenv | test.cpp:11:7:11:12 | * ... | The object returned by the function getenv should not be modified. |
 | test.cpp:11:8:11:12 | c_str | test.cpp:18:16:18:21 | call to getenv | test.cpp:11:7:11:12 | * ... | The object returned by the function getenv should not be modified. |
 | test.cpp:67:5:67:9 | conv4 | test.cpp:64:11:64:20 | call to localeconv | test.cpp:67:5:67:9 | conv4 | The object returned by the function localeconv should not be modified. |
 | test.cpp:76:5:76:8 | conv | test.cpp:72:25:72:34 | call to localeconv | test.cpp:76:5:76:8 | conv | The object returned by the function localeconv should not be modified. |
diff --git a/cpp/common/test/rules/unusedtypedeclarations/UnusedTypeDeclarations.expected b/cpp/common/test/rules/unusedtypedeclarations/UnusedTypeDeclarations.expected
index a4538f01c5..e6dce8b051 100644
--- a/cpp/common/test/rules/unusedtypedeclarations/UnusedTypeDeclarations.expected
+++ b/cpp/common/test/rules/unusedtypedeclarations/UnusedTypeDeclarations.expected
@@ -3,8 +3,8 @@
 | test.cpp:13:11:13:11 | D | Type declaration D is not used. |
 | test.cpp:77:11:77:11 | R | Type declaration R is not used. |
 | test.cpp:90:12:90:12 | (unnamed class/struct/union) | Type declaration (unnamed class/struct/union) is not used. |
-| test.cpp:111:29:111:30 | AA | Type declaration AA is not used. |
-| test.cpp:126:7:126:12 | Nested | Type declaration Nested is not used. |
-| test.cpp:135:9:135:20 | UnusedNested | Type declaration UnusedNested is not used. |
-| test.cpp:138:7:138:22 | NestedBlockScope | Type declaration NestedBlockScope is not used. |
-| test.cpp:149:11:149:16 | Unused | Type declaration Unused is not used. |
+| test.cpp:112:29:112:30 | AA | Type declaration AA is not used. |
+| test.cpp:127:7:127:12 | Nested | Type declaration Nested is not used. |
+| test.cpp:136:9:136:20 | UnusedNested | Type declaration UnusedNested is not used. |
+| test.cpp:139:7:139:22 | NestedBlockScope | Type declaration NestedBlockScope is not used. |
+| test.cpp:150:11:150:16 | Unused | Type declaration Unused is not used. |
diff --git a/cpp/common/test/rules/unusedtypedeclarations/test.cpp b/cpp/common/test/rules/unusedtypedeclarations/test.cpp
index 2c2699af04..6f168d23aa 100644
--- a/cpp/common/test/rules/unusedtypedeclarations/test.cpp
+++ b/cpp/common/test/rules/unusedtypedeclarations/test.cpp
@@ -107,7 +107,8 @@ template <class T> class X { // COMPLIANT - template class never instantiated
 template <class T> class Y {}; // COMPLIANT - used in the test case below
 
 // Alias templates
-template <typename T> using Z = Y<T>;  // COMPLIANT - used below
+template <typename T> using Z = Y<T>; // COMPLIANT - used below
+
 template <typename T> using AA = Y<T>; // NON_COMPLIANT - never instantiated
 
 void test_alias_template() { Z<int> v; }
diff --git a/cpp/misra/src/rules/RULE-0-1-1/UnnecessaryWriteToLocalObject.ql b/cpp/misra/src/rules/RULE-0-1-1/UnnecessaryWriteToLocalObject.ql
index b175717f70..9cd1ad6804 100644
--- a/cpp/misra/src/rules/RULE-0-1-1/UnnecessaryWriteToLocalObject.ql
+++ b/cpp/misra/src/rules/RULE-0-1-1/UnnecessaryWriteToLocalObject.ql
@@ -16,7 +16,7 @@
  */
 
 import cpp
-import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.new.DataFlow
 import codingstandards.cpp.misra
 import codingstandards.cpp.lifetimes.CppObjects
 import codingstandards.cpp.lifetimes.CppSubObjects
diff --git a/cpp/misra/test/rules/RULE-8-7-1/PointerArgumentToCstringFunctionIsInvalid.expected b/cpp/misra/test/rules/RULE-8-7-1/PointerArgumentToCstringFunctionIsInvalid.expected
index ce95541160..497146751a 100644
--- a/cpp/misra/test/rules/RULE-8-7-1/PointerArgumentToCstringFunctionIsInvalid.expected
+++ b/cpp/misra/test/rules/RULE-8-7-1/PointerArgumentToCstringFunctionIsInvalid.expected
@@ -37,3 +37,4 @@
 | test.cpp:477:5:477:10 | call to memcpy | The size of the $@ passed to memcpy is 63 bytes, but the $@ is 128 bytes. | test.cpp:477:17:477:24 | ... + ... | read buffer | test.cpp:477:27:477:41 | ... * ... | size argument |
 | test.cpp:477:5:477:10 | call to memcpy | The size of the $@ passed to memcpy is 64 bytes, but the $@ is 128 bytes. | test.cpp:477:12:477:14 | buf | write buffer | test.cpp:477:27:477:41 | ... * ... | size argument |
 | test.cpp:484:3:484:8 | call to memcpy | The $@ passed to memcpy is accessed at an excessive offset of 1 element(s) from the $@. | test.cpp:484:10:484:10 | p | write buffer | test.cpp:482:30:482:50 | ... * ... | allocation size base |
+| test.cpp:552:3:552:9 | call to strncat | The $@ passed to strncat might not be null-terminated. | test.cpp:552:11:552:21 | destination | argument | test.cpp:552:11:552:21 | destination |  |
diff --git a/cpp/misra/test/rules/RULE-8-7-1/test.cpp b/cpp/misra/test/rules/RULE-8-7-1/test.cpp
index 6877e1a9ed..20b3ee645f 100644
--- a/cpp/misra/test/rules/RULE-8-7-1/test.cpp
+++ b/cpp/misra/test/rules/RULE-8-7-1/test.cpp
@@ -442,7 +442,7 @@ void test_wrong_buf_size(void) {
 
   // strncat
   {
-    char buf[65];
+    char buf[65] = {0};
     char buf2[32];
     strncat(buf, buf2, sizeof(buf2));         // COMPLIANT
     strncat(buf, buf2, sizeof(buf2) + 1);     // NON_COMPLIANT
@@ -546,3 +546,8 @@ int main(int argc, char *argv[]) {
 
   return 0;
 }
+
+void test_strncat_null_termination() {
+  char destination[2];
+  strncat(destination, "x", 1); // NON_COMPLIANT
+}