CodeQL 2.27.0 has arrived with native support for Linux ARM64 systems, alongside fresh security detection capabilities for Rust and strengthened framework recognition for Java, Kotlin, and C#. The static analysis engine powering GitHub code scanning enables development teams to identify and fix security vulnerabilities within their codebases.

Language and framework support

  • CodeQL now runs directly on Linux arm64 architecture. The CodeQL CLI and CodeQL bundle are available through linux-arm64 per-platform release assets.
  • GitHub code scanning's default setup can leverage your organization's private registry settings to authenticate against container registries or the GitHub API when downloading custom queries or packs. This capability enables teams to incorporate custom content from private Git repositories and Docker registries.
  • ASP.NET Core MVC controller and action detection has been refined to better align with actual runtime behavior. The improvements extend to application parts, endpoint mappings, inherited actions, and controller and action filtering.
  • Taint tracking for OData action parameter binding is now supported. This enhancement strengthens detection of vulnerabilities tied to values sourced from ODataActionParameters and Delta-tracked entities.
  • When build-mode is set to none, CodeQL attempts project and solution restoration using accessible NuGet feeds. The tool also identifies explicitly configured feeds that cannot be reached, helping teams spot potential gaps in dependency coverage.

Query changes

  • A new rust/command-line-injection query has been introduced to identify uncontrolled command lines.
  • The rust/hard-coded-cryptographic-value query has been updated to minimize duplicate findings with nearly identical source locations.
  • The rust/unused-variable query now excludes variables within functions that use the standard todo!() or unimplemented!() macros.

Support for Java 9 and 10 has been marked for deprecation, with removal scheduled for January 2027. Java 7 and 8 will remain supported.

The generic multi-platform codeql.zip CLI distribution will be discontinued in an upcoming release. Users should download the per-platform .zip file matching their system instead. The CLI now displays a warning when executed from an all-platforms distribution; the warning can be suppressed by setting CODEQL_ALLOW_ALL_PLATFORMS_DIST=true.

Complete information is available in the CodeQL 2.27.0 changelog. GitHub automatically rolls out each new CodeQL version to GitHub code scanning users on github.com. A forthcoming GitHub Enterprise Server (GHES) release will incorporate the CodeQL 2.27.0 enhancements. Organizations running older GHES versions have the option to manually update their CodeQL installation.

Source: GitHub Blog