CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.27.3. It supports new Python 3.15 language features, adds JSON syntax for data extensions, adds C23 bit-precise integers, and includes accuracy improvements across languages.

Language and framework support

CodeQL CLI

  • Data extension files now support JSON syntax, using the same structure as YAML data extensions. Java-style comments (// ... and /* ... */) also work. CodeQL parses files with the .json extension as JSON and continues to parse all other files as YAML.
  • We’ve added an opt-in ai threat model for LLM-generated data. It doesn’t include any built-in source models, so you can define your own sources with data extensions.

Python

  • The Python extractor now supports Python 3.15 syntax, including unary plus in match literal patterns and Unicode 17 identifiers.
  • We’ve added support for the new frozendict and sentinel builtins introduced in Python 3.15, including data flow modeling for frozendict construction.

C/C++

  • We’ve added support for C23 bit-precise integers (_BitInt(N)).
  • We’ve added flow summaries for the BlazingMQ BloombergLP::bmqa::Message and MessageProperties classes and their iterators.

C#

  • We’ve added support for data flow through positional patterns in is expressions and switch cases.
  • When you configure private registries, CodeQL now passes the required proxy and certificate environment variables to the NuGet CLI.

Ruby

  • CodeQL now treats Grape::API request sub-accessors as remote flow sources. These include body.read, body.string, params, GET, POST, cookies, env, query_string, and path_info.

Query changes

C/C++

  • The cpp/resource-not-released-in-destructor query now recognizes resources released through local aliases, reducing false positives.

C#

  • The cs/simplifiable-boolean-expression query now produces fewer false positives when type information is incomplete.

Java/Kotlin

  • The java/ssrf and java/unvalidated-url-redirection queries now recognize case-insensitive comparisons of URI.getHost() with fixed allowlist entries. They also recognize these checks when code stores the host in a local variable, which reduces false positives.

Python

  • The py/xxe, py/xml-bomb, and py/nosql-injection queries now respect your configured threat model when selecting untrusted data sources. By default, they still use remote flow sources. These queries now also include sources you model with data extensions.

Breaking changes

  • GitHub Actions: The GitHub Actions control flow graph (CFG) now uses the shared CFG library. If your custom queries rely on specific CFG nodes, edges, or basic block boundaries, you may need to update them. We’ve removed the legacy Completion classes, so use CFG edge labels such as DirectSuccessor, BooleanSuccessor, and ReturnSuccessor instead.

For a full list of changes, please refer to the complete changelog for version 2.27.3. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.27.3 will also be included in GitHub Enterprise Server (GHES) 3.24 release. If you use an older version of GHES, you can manually upgrade your CodeQL version.