CodeQL 2.26.4 (2026-08-26)¶

This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.

Security Coverage¶

CodeQL 2.26.4 runs a total of 497 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).

CodeQL CLI¶

Bug Fixes¶

The Java Autobuilder now expands project properties, such as ${maven.version}, when determining Maven version requirements specified by the Maven Enforcer Plugin. The Java Autobuilder now also supports Maven versions through 3.9.16.

New Features¶

codeql test run now supports the --reuse-dataset option, which reuses an existing test database from a previous run when available, skipping database extraction. This can speed up repeated test runs when only the query under test has changed. The option implies --keep-databases.

Query Packs¶

Bug Fixes¶

C#¶

The query cs/useless-cast-to-self no longer reports casts when both the expression type and the cast target type are unknown, which can occur in build-mode: none databases.

Minor Analysis Improvements¶

C#¶

The cs/simplifiable-boolean-expression query no longer suggests replacing a negated comparison when the replacement could recursively call an enclosing user-defined operator in build-mode: none databases.
The cs/web/missing-token-validation query now recognizes enabled ASP.NET Core RequireAntiforgeryToken attributes when antiforgery middleware is used.
The query cs/virtual-call-in-constructor has been improved. Uses of virtual members in nameof expressions are no longer reported, since they are not calls.
Static constructors are now used as the enclosing callable for static member initializer expressions. This improves the precision of a range of queries, including cs/useless-assignment-to-local and cs/dereferenced-value-may-be-null.

JavaScript/TypeScript¶

The js/superfluous-trailing-arguments query no longer reports valid arguments passed to the TransformStream constructor.

GitHub Actions¶

The actions/unpinned-tag query now detects mutable references to reusable workflows.

Language Libraries¶

Breaking Changes¶

GitHub Actions¶

Checks on actor fields read from the event payload (e.g. github.event.pull_request.user.login) were split out of ActorIfCheck into a new class EventActorIfCheck. The ActorIfCheck class now only covers github.actor and github.triggering_actor.

Major Analysis Improvements¶

C#¶

Simplified and streamlined the use of NuGet sources when downloading dependencies. In fallback scenarios and specialized package downloads, NuGet sources are now passed directly to dotnet restore via the CLI. Furthermore, no nuget.config files are created for fallback scenarios, and private registries are used when attempting to download missing packages that were not restored as part of the normal dotnet restore process.

Golang¶

Go 1.27 is now supported.

Rust¶

The alert locations for data flow queries have been improved. The new locations are more precise and are based on the actual source and sink nodes. Example:
```
let _ = conn.query(
//      ^^^^                 old alert location
    unsafe_query.as_str(),
//  ^^^^^^^^^^^^^^^^^^^^^    new alert location
)?;
```
This means that some alerts will have their locations changed, and hence appear as new alerts (while the old alerts will disappear).

Minor Analysis Improvements¶

Java/Kotlin¶

Removed the summary model for String.valueOf(CharSequence), which does not exist. Instead, taint is now propagated through calls to String.valueOf(Object) when the argument is a CharSequence, for example a String or a StringBuilder.
Added SQL injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI.

JavaScript/TypeScript¶

Added support for regular expressions using the d flag.

Python¶

Added taint flow through list.extend and list.insert, matching the existing taint flow through list.append.

Ruby¶

The algorithm for tracking regexes has been replaced. This can cause result changes in related queries, for example, rb/polynomial-redos.

GitHub Actions¶

Checks on actor fields read from the event payload (e.g. github.event.pull_request.user.login) now only count as protection for events whose payload actually populates that field. Previously, a condition such as github.event.pull_request.user.login != 'name' on a workflow triggered by issues events was treated as a protective check even though github.event.pull_request is not populated for issues events, which makes the condition vacuous. This change may result in more alerts for queries using the ControlCheck class.
Added an option to EnvironmentCheck to become specified by a MaD model, otherwise it will continue as the default it previously was. Without adding models to actions/ql/lib/ext/config/deployment_environment.yml the behavior of every query will be unchanged. When models are added queries using ControlCheck may find more results in cases where an environment is no longer a sufficient sanitizer.

Rust¶

Canonical paths for Rust trait items now use the format crate::Trait::item instead of <_ as crate::Trait>::item. Custom data extension models that reference trait items must be updated to use the new format.
The Rust extractor has been upgraded to use rust-analyzer version 0.0.328. As a result, the AST exposed by the Rust libraries has changed: the TraitAlias class has been removed, cfg attributes are now modeled by the new CfgMeta, CfgAtom, CfgComposite, CfgPredicate, and CfgAttrMeta classes, and the Meta class has been refined into the KeyValueMeta, PathMeta, TokenTreeMeta, and UnsafeMeta subclasses. New TryBlockModifier and FormatArgsArgName classes have also been added.

New Features¶

C#¶

Added the AdditionalTaintStep extension point (semmle.code.csharp.dataflow.FlowSteps). Extend this class to add additional taint steps that apply to all taint-tracking configurations.

JavaScript/TypeScript¶

Added support for recognizing the React Native Worklets "worklet" directive as a known directive.