CodeQL 2.27.2 Improves C++, Go, Rust, and JavaScript Analysis
The latest version of GitHub's static analysis engine introduces important language updates, security query refinements, and macOS compatibility notes.
Radwan AbdulhadiEditor and technology writer
Overview of CodeQL 2.27.2
CodeQL 2.27.2 is now available, bringing a C++ regular-expression parser alongside broader analysis improvements across several programming languages. Functioning as the static analysis engine behind GitHub code scanning, CodeQL helps developers find and remediate security vulnerabilities in their codebases. According to the official release details found in the CodeQL 2.27.2 changelog, the default security suite executes 498 queries spanning 170 Common Weakness Enumerations (CWEs), while the extended suite introduces an additional 131 queries covering 32 more CWEs.
GitHub automatically deploys every new CodeQL version to users who utilize GitHub code scanning on github.com. Furthermore, a future release of GitHub Enterprise Server (GHES) will incorporate the functionality introduced in CodeQL 2.27.2. Teams utilizing an older version of GHES can choose to manually upgrade your CodeQL version to leverage these latest features and bug fixes.
C++, Go, and Rust Language Enhancements
The C++ analyzer in this release now parses regular expressions that utilize the ECMAScript grammar within std::regex. Additionally, the update adds SQL-injection sink models for the Comdb2 C API, alongside flow summaries for Bloomberg BDE codecs and byte-stream deserializers. CodeQL also expands networking visibility by modeling the github.com/coder/websocket import path alongside the existing nhooyr.io/websocket support.
For Rust developers, the extractor now supports the AnyAttr and DocComment classes. Data flow tracking has been improved for async blocks utilized with await, and new flow summaries have been incorporated for native-tls, async-native-tls, and tokio-native-tls. In the JavaScript and web domain, the engine recognizes the Workflow SDK's 'use workflow' and 'use step' directives while improving Hapi route-handler and request-input tracking through higher-order functions and custom route-registration helpers.
Go Control-Flow Graph Adjustments
The Go control-flow graph (CFG) has transitioned to use the shared CFG library in this update. This restructuring includes additional nodes for language constructs such as parameters and results, range statements, assignments, and deferred calls, while excluding nodes that are unreachable from the entry point.
Because these changes modify CFG nodes, edges, textual representations, locations, and basic-block boundaries, developers may need to update existing queries that rely on the previous representation. The update also adds ControlFlow::EntryNode, ControlFlow::ExitNode, and SwitchStmt.getExpr, while deprecating IfStmt.getCond in favor of IfStmt.getCondition and changing the return types of IfStmt.getThen and LoopStmt.getBody to Stmt.
Security Queries and Platform Updates
Security queries received several refinements. The cs/web/missing-x-frame-options query now recognizes Content Security Policy frame-ancestors directives and ASP.NET Core response headers as valid clickjacking protections. Meanwhile, the cs/web/xss query no longer treats Razor tag-helper attribute values written with WriteLiteral as cross-site scripting sinks.
Users can now remove specific owners from the trusted set used by the actions/unpinned-tag query by appending an entry prefixed with an exclamation mark, such as !github. This modification allows teams to report unpinned tags for first-party owners. In addition, the actions/unpinned-tag query adjustments coordinate with broader platform changes visible in historical updates found via the GitHub Changelog.
macOS Compatibility and CLI Improvements
With the release of macOS 27 and Xcode 27, Apple has discontinued shipping multi-architecture x86-64/arm64 binaries, which are required by CodeQL to perform traced analysis. Consequently, CodeQL's manual build modes and autobuild will not be supported for compiled languages on macOS 27 regardless of the Xcode version, nor on macOS 26 when Xcode 27 is chosen. Engineers utilizing these build modes are advised to use at most macOS 26 and Xcode 26, while the team works on enhancing support for build mode none on macOS to alleviate the restriction.
The command-line interface now outputs clear error messages when encountering invalid qlpack: and from: values in query suites instead of crashing. CodeQL now rejects YAML data-extension integers falling outside the signed 32-bit range rather than silently truncating them. Standard error streams now feature explicit ERROR: and WARNING: prefixes, while structured outputs such as logs and SARIF files remain unchanged.
Sources
- GitHub ChangelogCodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis
Continue chronologically
Related entity coverage
Related stories
CodeQL Changes for macOS 27, Xcode 27, and Swift 6.4
Read the latest GitHub Changelog regarding CodeQL updates for macOS 27, Xcode 27, and Swift 6.4, including impacts on traced builds and Intel Macs.
CodeQL 2.27.1 Released With Kotlin 2.4.20 Support and New Queries
GitHub has released CodeQL 2.27.1, introducing support for Kotlin 2.4.20, new queries for C/C++ and C#, and various accuracy improvements.
CodeQL 2.27.3 Released With Python 3.15 and JSON Support
GitHub has released CodeQL 2.27.3, introducing support for Python 3.15 features, JSON data extensions, C23 bit-precise integers, and query improvements.
AI Scan for Pull Requests Generally Available on GitHub
GitHub announces general availability of AI Scan for pull requests, complementing CodeQL by finding vulnerabilities in additional frameworks and languages.
