GitHub
CodeQL 2.27.1 expands language and security coverage
New C/C++ and C# queries arrive alongside Kotlin 2.4.20 support and more accurate data-flow models.
Share this news
GitHub's CodeQL 2.27.1 release adds queries for C/C++ and C#, support for Kotlin 2.4.20, and improvements to its analysis models. It also updates data-flow handling for newer Go standard-library APIs.
For teams that rely on code scanning, the release is worth checking for both new findings and reduced false positives. GitHub deploys new CodeQL versions automatically to code scanning users on github.com.
What changed in the analyzer
The release notes describe a new C/C++ query for assignments of comparison results that can be read ambiguously, plus a C# query for loops that could use FirstOrDefault. The update also adds library-flow models, updates the Rust extractor's rust-analyzer, and improves handling of some GitHub Actions references. Not every change is a new alert: better models and fewer false positives matter too.
The CodeQL overview explains that findings appear as code scanning alerts, while query suites determine which checks run. A new query only affects your repository when it belongs to the suite you use. That detail is easy to miss when a release headline lists a long menu of languages.
What to do with it
Check the next scan for changed findings and confirm the configured suite before treating a quiet scan as proof that every new query ran. If you pin a CodeQL CLI or bundle version outside GitHub's hosted scanning, plan an update instead of assuming you received the hosted rollout.
Sources and further reading
Share this news
Related Items
- NewsGitHub explores AI agents for the hard parts of fuzzingA Security Lab taskflow agent targets coverage gaps, new harnesses, and crash triage in continuous fuzzing.
- NewsAnthropic says small open models may be months from copying themselves onto TV boxes and smart ovensAnthropic's Frontier Red Team ran a 26B model split across 15 cheap Android TV boxes and watched GLM-5.2 replicate itself across an emulated eight-device network. The hacking step was made trivial on purpose, so the results are an upper bound, but the trend puts models of 30B parameters or less at that level by the end of 2026.
- NewsAnthropic says open-weight GLM-5.3 builds exploits almost as well as Claude Mythos PreviewIn Anthropic's tests, Z.ai's model turned known bugs in Chrome's V8 engine into working exploits in 12% of attempts, against 14% for Mythos Preview and close to zero for earlier models. Telling it that it was a red-team agent got past its refusals 64% of the time, and anyone can download the weights.
Comments
Questions, corrections, or your own take are all welcome. Sign in with GitHub to join in.