Overview of CodeQL 2.27.1

GitHub has officially launched CodeQL 2.27.1, the latest version of the static analysis engine behind GitHub code scanning. This release introduces new queries for C/C++ and C#, support for Kotlin 2.4.20, and several query-accuracy improvements designed to help developers find and remediate security issues in their code more effectively. For comprehensive details regarding the changes, users can consult the official CodeQL 2.27.1 changelog.

As the static analysis engine powering automated code scanning across the platform, CodeQL continually evolves to handle complex programming paradigms and newer language specifications. Developers looking to review specific CLI release updates can check the dedicated CodeQL 2.27.1 release notes for technical specifications and guidance.

C, C++, and Rust Enhancements

The latest release brings significant additions to C and C++ analysis. Specifically, the team added a new cpp/ambiguous-assignment-of-comparison query to detect potentially ambiguous expressions that assign a comparison result to a variable and subsequently use that assignment as a truth value. Furthermore, new taint flow models were added for boost::asio::ip::basic_resolver::resolve , along with flow summaries for Bloomberg Development Environment’s BloombergLP::bdlbb::Blob segmented byte buffer and the Protocol Buffers google::protobuf::MessageLite C++ API.

Additionally, data flow models for core::fmt::Write have been integrated to improve the detection of vulnerabilities where tainted data is written to formatted output buffers. For Rust development, the Rust extractor now utilizes rust-analyzer version 0.0.347, updating the Rust library AST with new node types and accessor APIs.

Go and Kotlin Updates

CodeQL 2.27.1 expands data flow models for Go 1.27 standard-library APIs, including bytes.CutLast , database/sql.ConvertAssign , database/sql/driver.RowsColumnScanner.ScanColumn , net/url.URL.Clone , net/url.Values.Clone , strings.CutLast , and the new encoding/json/jsontext package. Furthermore, data flow models for the strings package were extensively expanded to include Clone , Cut , CutPrefix , CutSuffix , Fields , FieldsFunc , Join , Builder , Reader , and Replacer APIs.

On the Kotlin front, the update adds formal support for Kotlin 2.4.20. Alongside this integration, the release fixes the extraction of Foo::class.java arguments when using the Kotlin K2 compiler, a change that successfully reduces false positives in queries such as java/android/implicit-pendingintents .

C# and JavaScript Query Improvements

C# analysis receives the new cs/linq/missed-firstordefault query, which identifies foreach loops that can be expressed more clearly using LINQ’s FirstOrDefault method. Additionally, cs/linq/missed-* queries will no longer suggest lambda rewrites that capture in , out , or ref parameters, preventing suggestions that would otherwise fail to compile.

The cs/web/missing-token-validation query now properly recognizes ASP.NET Core’s AutoValidateAntiforgeryTokenAttribute when registered as a global MVC filter through AddControllersWithViews and related methods, reducing false positives for protected actions. In the JavaScript domain, CodeQL now recognizes Fastify servers configured through chainable methods like fastify().withTypeProvider() and fastify().setValidatorCompiler(...) , improving route attribution and plugin interactions.

Workflow and Registry Changes

The actions/unpinned-tag query has been updated so that it no longer reports actions pinned by a structurally valid .github/workflows/actions.lock entry for the enclosing workflow. It also excludes $/ self-repository references—such as uses: $/path/to/action —since they resolve to the same repository at the running commit and are inherently pinned.

For enterprise environments utilizing private NuGet registries with the Replaces base option enabled in organization-level configurations, CodeQL will now correctly replace default NuGet feeds whenever downloading dependencies, even if a project explicitly configures default feeds.

Deployment and Availability

GitHub automatically deploys every new CodeQL version to users of GitHub code scanning on github.com. For self-hosted environments, GitHub Enterprise Server (GHES) 3.24 will include the new functionality natively. Administrators running an older version of GHES can manually upgrade your CodeQL version to adopt the latest features.

Sources

• GitHub ChangelogCodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support