The latest iteration of CodeQL, GitHub's static analysis platform for identifying and fixing security vulnerabilities, brings expanded language compatibility and refined detection capabilities. Version 2.26.4 delivers Go 1.27 compatibility, enhanced pinpointing of alerts in Rust data flow analysis, and accuracy refinements spanning C#, Java/Kotlin, and GitHub Actions workflows.

Language and framework support

  • SQL injection sink models have been introduced for Spring R2DBC DatabaseClient and the R2DBC SPI.
  • Taint tracking now extends through String.valueOf(Object) method invocations when arguments implement CharSequence (such as String or StringBuilder).

Query changes

  • The cs/web/missing-token-validation query now identifies enabled ASP.NET Core RequireAntiforgeryToken attributes in scenarios where antiforgery middleware is active.
  • The cs/virtual-call-in-constructor query has been refined to exclude virtual member usage within nameof expressions, as these do not constitute actual method calls.
  • The cs/useless-cast-to-self and cs/simplifiable-boolean-expression queries generate reduced false positive rates when analyzing build-mode databases.
  • Actor field checks extracted from event payloads (for instance, github.event.pull_request.user.login) are now restricted to events that genuinely supply those fields. This approach may result in additional alerts for queries leveraging the ControlCheck class.
  • The actions/unpinned-tag query now identifies mutable tag references pointing to reusable workflows.
  • EnvironmentCheck configuration is now available through models-as-data specifications. Queries relying on ControlCheck may detect additional instances when environment variables no longer function as adequate sanitizers.

The comprehensive changelog for version 2.26.4 contains the complete enumeration of modifications. Deployment of each CodeQL release to GitHub code scanning users on github.com occurs automatically. CodeQL 2.26.4 capabilities will appear in an upcoming GitHub Enterprise Server (GHES) release. Users operating earlier GHES versions retain the option to upgrade CodeQL independently.