CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.

Language and framework support

CodeQL CLI

  • You can now run CodeQL natively on Linux arm64. Download the CodeQL CLI and CodeQL bundle from the linux-arm64 per-platform release assets.
  • GitHub code scanning default setup can now use your organization’s private registry configurations to authenticate with container registries or the GitHub API when fetching custom queries or packs. This lets you use custom content from private Git sources and Docker registries.

C#

  • We’ve improved ASP.NET Core MVC controller and action discovery to more closely match runtime behavior. This improves coverage for application parts, endpoint mappings, inherited actions, as well as controller and action exclusions.
  • We’ve added taint tracking support for OData action parameter binding. This improves detection coverage for vulnerabilities involving values extracted from ODataActionParameters and entities tracked by Delta.
  • In build-mode: none, CodeQL now always attempts to restore projects and solutions using available NuGet feeds. CodeQL also reports explicitly configured feeds that aren’t reachable, making it easier to identify dependencies that may be missing from analysis.

Java/Kotlin

  • We’ve added modeling for the Micronaut framework, including HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.

Query changes

C/C++

  • We’ve added PostgreSQL libpq query-execution and prepared-statement functions as SQL injection sinks. Queries such as cpp/sql-injection can now identify vulnerabilities involving PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare.

GitHub Actions

  • We’ve improved how CodeQL evaluates checks of author-association fields from event payloads. CodeQL now treats these checks as protection only when the event payload provides the relevant field. This may produce additional alerts for workflows that rely on ineffective checks.

Rust

  • We’ve added the rust/command-line-injection query to detect uncontrolled command lines.
  • We’ve updated the rust/hard-coded-cryptographic-value query to reduce duplicate results with very similar source locations.
  • The rust/unused-variable query no longer reports variables in functions that contain the standard todo!() or unimplemented!() macros.

Upcoming Deprecations

  • Language support for Java 9 and 10 has been deprecated and will be removed in January 2027. Java 7 and 8 will continue to be supported.
  • The generic multi-platform codeql.zip CLI distribution will be removed in a future release. Download the per-platform .zip for your platform instead. The CLI now emits a warning when it is run from an all-platforms distribution; set CODEQL_ALLOW_ALL_PLATFORMS_DIST=true to suppress it.

For full details, see the CodeQL 2.27.0 changelog. GitHub automatically deploys every new CodeQL version to users of GitHub code scanning on github.com. A future GitHub Enterprise Server (GHES) release will also include the new functionality in CodeQL 2.27.0. If you use an older version of GHES, you can manually upgrade your CodeQL version.