GitHub released CodeQL 2.26.4 on September 3 GitHub Changelog, the static analysis engine that powers GitHub code scanning. The update adds Go 1.27 support, refines Rust data-flow alert locations, and delivers accuracy improvements across C#, Java/Kotlin, and GitHub Actions workflows.
The release is dated August 26 in the official CodeQL changelog CodeQL Documentation and was automatically deployed to GitHub.com code scanning users. GitHub Enterprise Server administrators can manually upgrade CodeQL versions on appliances without internet access.
Go developers gain first-class support for Go 1.27. Rust analysts will see more precise alert locations for data-flow queries — alerts now point to actual source and sink nodes rather than enclosing calls. This means some existing alerts will close and reappear at new locations.
Java and Kotlin projects receive SQL injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI. Taint now propagates through String.valueOf(Object) when the argument is a CharSequence such as String or StringBuilder.
C# queries see three improvements: the cs/web/missing-token-validation query recognizes enabled ASP.NET Core RequireAntiforgeryToken attributes when antiforgery middleware is used; cs/virtual-call-in-constructor no longer flags virtual members in nameof expressions; and cs/useless-cast-to-self and cs/simplifiable-boolean-expression produce fewer false positives in build-mode: none databases.
GitHub Actions security detections receive the most substantive changes. Checks on actor fields read from the event payload (for example, github.event.pull_request.user.login) now only count as protection for events that actually populate that field. Previously, a condition like github.event.pull_request.user.login != 'name' on an issues-triggered workflow was treated as protective even though github.event.pull_request is empty for issues events. The actions/unpinned-tag query now detects mutable references to reusable workflows. Environment checks can now be specified through models-as-data, allowing queries using ControlCheck to find more results when an environment is no longer a sufficient sanitizer.
Python gains taint flow through list.extend and list.insert, matching existing list.append coverage. JavaScript and TypeScript add support for regular expressions using the d flag and the React Native Worklets 'worklet' directive.
According to the CodeQL documentation, the Default suite runs 497 security queries covering 170 CWEs, with the Extended suite adding 131 queries for 32 more CWEs CodeQL Documentation. The full changelog includes new CLI features like codeql test run --reuse-dataset for faster repeated test runs.
Image credit: GitHub Blog
The update follows our earlier coverage of GitHub’s Copilot agent workflows and Docker’s agent sandboxing for firmware.
