GitHub Releases CodeQL 2.27.4 with Enhanced Accuracy and Security Checks

Summary of CodeQL 2.27.4 Release

On November 4, 2026, GitHub announced the release of CodeQL version 2.27.4. As the static code analysis engine behind GitHub code scanning, CodeQL helps developers detect and fix security vulnerabilities in their code bases. This new release brings improved query accuracy in several programming languages, strengthened security checks when bundling or publishing packs, and adjustments to query metadata.

Key Improvements Across Languages

The update introduces targeted enhancements to CodeQL queries:

• Java/Kotlin: The java/log-injection query now identifies a wider range of sanitizers and guards from frequently used libraries such as JDK, Apache Commons Lang and Text, Guava, OWASP Java Encoder, and Spring Framework. Additionally, path-injection queries can now recognize more substring guards and string manipulation functions from Apache Commons Lang and Guava.
• Rust: Several queries including rust/uncontrolled-allocation-size, rust/log-injection, and rust/cleartext-logging have been refined to reduce false positive rates.
• C/C++: The suspicious pointer scaling query no longer flags intentional pointer arithmetic on std::byte* buffers. Queries detecting unused variables (cpp/unused-local-variable and cpp/unused-static-variable) now properly ignore variables annotated with [[maybe_unused]].

CWE Metadata Adjustments

This release corrects Common Weakness Enumeration (CWE) tag usage by removing CWE-730 from several queries across multiple languages such as C#, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, and Swift. This adjustment reflects improved accuracy in vulnerability classification based on community feedback, notably from the issue report #22318.

CodeQL CLI Enhancements and Security Checks

The CodeQL command-line interface (CLI) has also been enhanced. Java Virtual Machine warnings and initialization errors now output to standard error instead of standard output, preventing interference with machine-readable outputs like JSON. When bundling or publishing a pack, the CLI verifies that all files remain within the pack root after resolving symbolic links, omitting files resolving outside this root and issuing warnings where appropriate. This helps prevent accidental inclusion of files from outside intended directories, enhancing security and integrity of code packs.

Who Should Care and Next Steps

Developers using GitHub code scanning and CodeQL for static analysis should be aware of this update to benefit from improved accuracy and enhanced security during pack creation. Users of GitHub Enterprise Server (GHES) will find the new features included in the GHES 3.24 release, though older versions requires manual CodeQL version upgrades.

Recommended Actions for Developers

1. Verify your GitHub code scanning configurations to ensure you are using CodeQL 2.27.4 or later, especially if on GHES prior to 3.24.
2. Review and possibly re-run analyses of your Java/Kotlin, Rust, and C/C++ projects to leverage improved accuracy and reduced false positives.
3. When bundling or publishing CodeQL packs, monitor CLI warnings about file locations to avoid security issues related to symbolic links.
4. Check your tooling for correct interpretation of output streams from the CLI to avoid mis-parsing of Java VM warnings.

Summary Checklist

• Update to CodeQL 2.27.4 or later (automatic on github.com or manual on older GHES versions).
• Audit and re-assess scan results in affected languages with new query improvements.
• Inspect CodeQL pack bundles for symbolic link warnings.
• Monitor CLI output streams for Java VM-related warnings on stderr.