Go: Add new import path for nhooyr.io/websocket

[owen-mc]

Active development on this package moved in August 2024. This PR adds the new import path, along with the old one (which still works).

[Copilot]

Copilot review overview

🟡 Changes recommended

The source models omit the required group: prefix and therefore match neither supported package path.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 2

Open (3)

• Add required group: prefix to package group rows · New
• Remove trailing slash from old import path · New
• Add tests for github.com/coder/websocket source models · New

What changed in this PR

Adds support for the migrated github.com/coder/websocket import path while retaining the legacy path.

Changes:

• Groups both package paths under shared models.
• Updates WebSocket framework matching.
• Adds a change note.

File	Description
go/​ql/​lib/​semmle/​go/​frameworks/​WebSocket.qll	Matches both WebSocket import paths.
go/​ql/​lib/​ext/​nhooyr.io.websocket.model.yml	Removes the superseded standalone models.
go/​ql/​lib/​ext/​github.com.coder.websocket.model.yml	Introduces grouped source models.
go/​ql/​lib/​change-notes/​2026-09-22-nhooyr-package-rename.md	Documents the added import path.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged.

Click to show differences in coverage

go

Generated file changes for go

• Changes to framework-coverage-go.rst:

+    Others,``github.com/coder/websocket``,2,,
-    Totals,,688,1134,1580
+    Totals,,690,1134,1580

• Changes to framework-coverage-go.csv:

+ github.com/coder/websocket,,2,,,,,,,,,,,,,,,,,,,,,,2,,,