The latest iteration of CodeQL, GitHub's static analysis platform for identifying and fixing security vulnerabilities, now ships with Swift 6.2.4 support alongside a reconstructed Java control flow graph that delivers better precision. Version 2.25.0 also encompasses enhancements spanning multiple programming languages. A companion release, CodeQL 2.25.1, has rolled out as well, though it addresses only minor defects.
Language and framework support
- C# 14 partial constructors now receive full support.
- System.Net.WebSockets::ReceiveAsync has been integrated as a remote flow source, strengthening the ability to identify taint flows originating from WebSocket communication channels.
The comprehensive list of modifications introduced in version 2.25.0 is available in the official changelog. GitHub code scanning users on github.com receive automatic deployment of each CodeQL release. Upcoming versions of GitHub Enterprise Server (GHES) will incorporate the enhancements present in CodeQL 2.25.0. Organizations operating earlier GHES deployments have the option to manually refresh their CodeQL installation to a newer version.