CodeQL 2.27.3 Released With Python 3.15 and JSON Support
The latest static analysis engine update brings advanced language compatibility, enhanced data extension formatting, and various query accuracy refinements across multiple programming ecosystems.
Radwan AbdulhadiEditor and technology writer
Introduction to CodeQL 2.27.3
CodeQL serves as the static analysis engine behind GitHub code scanning, helping developers find and remediate security issues within their codebases. The team has officially released CodeQL 2.27.3, bringing a wide array of new capabilities, expanded language feature support, and cross-language accuracy improvements.
Users looking to review every minor change can consult the complete changelog for version 2.27.3. Automated updates ensure that github.com code scanning users receive every new version of CodeQL automatically, while GitHub Enterprise Server deployments handle updates according to their specific release schedules.
JSON Data Extensions and AI Threat Modeling
Data extension files now support JSON syntax, utilizing the exact same structural design found in YAML data extensions. Furthermore, developers can incorporate Java-style comments using both single-line and multi-line formats. CodeQL automatically parses files bearing the .json extension as JSON while continuing to parse all other supported extension files as YAML.
An opt-in AI threat model has been introduced specifically for handling LLM-generated data. Because this threat model does not come with any built-in source models pre-configured, developers are empowered to define their own custom sources utilizing data extensions.
Python 3.15 Language Support and Enhancements
The Python extractor has been upgraded to support critical Python 3.15 syntax updates. These additions encompass support for unary plus operations inside match literal patterns as well as comprehensive Unicode 17 identifier parsing.
Additionally, support has been incorporated for the newly introduced frozendict and sentinel builtins native to Python 3.15. This includes specific data flow modeling tailored for frozendict construction, ensuring accurate analysis of newer Python coding patterns.
C23 Integers and Additional Language Features
For systems and low-level programming environments, the engine now adds support for C23 bit-precise integers through the syntax _BitInt(N). This broadens the tool's capacity to accurately analyze modern C code standards.
The update also provides flow summaries for the BlazingMQ BloombergLP::bmqa::Message and MessageProperties classes, alongside their respective iterators. Furthermore, CodeQL now supports data flow tracking through positional patterns in both is expressions and switch cases.
Query Accuracy and Ecosystem Integration
A number of query modifications have been implemented to reduce false positive results across multiple languages. For instance, the cpp/resource-not-released-in-destructor query now successfully recognizes resources released via local aliases, while the cs/simplifiable-boolean-expression query minimizes noise when handling incomplete type information.
Java security queries including java/ssrf and java/unvalidated-url-redirection now account for case-insensitive comparisons of URI.getHost() with fixed allowlist entries. Python security checks like py/xxe, py/xml-bomb, and py/nosql-injection now respect user-configured threat models when identifying untrusted data sources.
When setting up private registries, CodeQL seamlessly relays necessary proxy and certificate environment variables directly to the NuGet CLI. At the same time, Grape::API request sub-accessors are now categorized as remote flow sources, covering parameters, cookies, environment attributes, and path configurations.
GitHub Actions and Enterprise Deployment
The GitHub Actions control flow graph now relies on the shared CFG library. Custom queries dependent on specific control flow graph nodes, basic block boundaries, or edges may require updates, as legacy Completion classes have been removed in favor of explicit CFG edge labels.
The new functionality included in this release will ship natively with the upcoming GitHub Enterprise Server 3.24 release. Administrators running older versions of the enterprise platform who require the latest analytical features can manually upgrade your CodeQL version to maintain compliance and security coverage.
Sources
- GitHub ChangelogCodeQL 2.27.3 adds Python 3.15 features and JSON data extensions
Continue chronologically
Related entity coverage
Related stories
CodeQL 2.27.1 Released With Kotlin 2.4.20 Support and New Queries
GitHub has released CodeQL 2.27.1, introducing support for Kotlin 2.4.20, new queries for C/C++ and C#, and various accuracy improvements.
CodeQL 2.27.2 Improves C++, Go, Rust, and JavaScript Analysis
CodeQL 2.27.2 arrives with a new C++ regular-expression parser, updated Go control-flow graphs, and analysis improvements across multiple languages.
GitHub Deprecates All-Platform CodeQL Bundle
GitHub has officially deprecated the all-platform CodeQL bundle, directing users to adopt platform-specific binaries starting with version 2.27.0.
GitHub Introduces Dependabot Reachability Analysis Preview
GitHub launches reachability analysis for Dependabot alerts in public preview, helping teams prioritize JavaScript and TypeScript vulnerabilities.
