CodeQL 2.27.3 (2026-10-20)¶

This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.

Security Coverage¶

CodeQL 2.27.3 runs a total of 498 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).

CodeQL CLI¶

Breaking Changes¶

With the release of macOS 27 and Xcode 27, Apple stopped shipping multi-architecture x86-64/arm64 binaries. These binaries are required by CodeQL to perform traced analysis. For this reason, CodeQL’s autobuild and manual build modes will not be supported for compiled languages on macOS 27 with any Xcode version, and on macOS 26 when Xcode 27 is selected.

Bug Fixes¶

Fixed a bug that caused database downgrades to fail for GitHub Actions databases.

Improvements¶

Data extension files now support JSON syntax, with the same structure as existing YAML data extensions. Java-style comments (// ... and /* ... */) are also supported. Files using the .json extension will be parsed as JSON, while all other files will continue to be parsed as YAML.
The codeql test run feature to load a data extension named <test>.ext.yml when running <test>.ql or <test>.qlref has been updated to support JSON data extensions, and files named <test>.ext.json will now also be loaded automatically.

Query Packs¶

Minor Analysis Improvements¶

C/C++¶

The cpp/resource-not-released-in-destructor query now recognizes resources released through local aliases, reducing false-positive results.

C#¶

The cs/simplifiable-boolean-expression query now produces fewer false-positive results when type information is incomplete.

Language Libraries¶

Breaking Changes¶

GitHub Actions¶

The GitHub Actions control flow graph (CFG) now uses the shared CFG library. The CFG includes explicit before and after nodes and uses the shared entry and exit node representations. Existing code that relies on specific CFG nodes, edges, textual representations, or basic block boundaries may need to be updated. The legacy Completion, NormalCompletion, SimpleCompletion, BooleanCompletion, and ReturnCompletion classes have been removed because completions are no longer part of the Actions CFG API. Code that inspected completions should inspect CFG edge labels such as DirectSuccessor, BooleanSuccessor, and ReturnSuccessor instead.

Minor Analysis Improvements¶

C/C++¶

Added flow summaries for the BlazingMQ BloombergLP::bmqa::Message and MessageProperties classes and their iterators.

C#¶

Avoid logging warnings when there are no explicit or inherited feeds to check for reachability.
The subprocess for the NuGet CLI is now provided with the proxy and certificate environment variables needed to access private registries if any are configured.
Added support for data flow through positional patterns in is expressions and switch cases.

Java/Kotlin¶

The queries java/ssrf and java/unvalidated-url-redirection recognize case-insensitive comparisons of URI.getHost() with fixed string allowlist entries, as well as equality and case-insensitive comparisons when the host is stored in a local variable.

Python¶

Updated the py/xxe, py/xml-bomb, and py/nosql-injection queries to respect the configured threat model when selecting untrusted data sources. The default behavior remains unchanged and uses remote flow sources. As a side effect, these queries now correctly include sources modeled using data extensions.
Added taint-flow modeling for unicodedata.iter_graphemes, introduced in Python 3.15.
Added data-flow modeling for threading.serialize_iterator and threading.concurrent_tee, introduced in Python 3.15.
Added modeling for the Base32, Base85, and Ascii85 encoding and decoding functions introduced in Python 3.15’s binascii module, including taint flow through custom alphabets.
Added support for the frozendict and sentinel builtins introduced in Python 3.15, and data-flow modeling for frozendict construction.
The Python extractor now supports unary plus in match literal patterns, introduced in Python 3.15.
The Python extractor now supports Unicode 17 identifiers, introduced in Python 3.15.
Added modeling for the extra_response_headers constructor argument and instance attribute of http.server.SimpleHTTPRequestHandler, introduced in Python 3.15.
Added modeling for Python 3.15’s re.prefixmatch and re.Pattern.prefixmatch, matching the existing support for their match counterparts.
Added taint-flow modeling for bytearray construction and Python 3.15’s bytearray.take_bytes method.

Rust¶

The Rust extractor has been upgraded to use rust-analyzer version 0.0.357. As a result, the AST exposed by the Rust libraries now includes the CfgPredExpr and CfgPredPat classes.

New Features¶

C/C++¶

Added support for C23 bit-precise integers (_BitInt(N)).

Ruby¶

Added modeling for Grape::API‘s request sub-accessors (body.read, body.string, params, GET, POST, cookies, env, query_string, and path_info) as remote flow sources.

Shared Libraries¶

New Features¶

Threat Models¶

Added the opt-in ai threat model for LLM-generated data. No built-in source models are included.