CodeQL 2.26.2 (2026-07-23)¶

This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.

Security Coverage¶

CodeQL 2.26.2 runs a total of 497 security queries when configured with the Default suite (covering 170 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).

CodeQL CLI¶

Breaking Changes¶

Removed support for parsing [[-style links in alert messages. This was an undocumented legacy feature that allowed query authors to embed links inline in select clause message strings using [["text"|"url"]] syntax. Queries should use $@ placeholder pairs instead.

Query Packs¶

Minor Analysis Improvements¶

C#¶

System.Web.HttpRequest.RawUrl is no longer treated as a sanitizer for cs/web/unvalidated-url-redirection, since it contains the un-normalized request line. This may lead to more results.

Query Metadata Changes¶

C/C++¶

Added the tag external/cwe/cwe-762 to cpp/new-free-mismatch, and removed the tag external/cwe/cwe-401. This better matches the behavior of the query.

C#¶

The query cs/useless-assignment-to-local has been removed from the code-quality suite, but it remains in the code-quality-extended suite.

Language Libraries¶

Major Analysis Improvements¶

Swift¶

Upgraded to allow analysis of Swift 6.3.3.

Minor Analysis Improvements¶

Golang¶

The function Rel in path/filepath was incorrectly considered a sanitizer for go/path-injection and go/zipslip. This has now been fixed, which may lead to more results for those queries.

Java/Kotlin¶

Kotlin versions up to 2.4.10 are now supported.
java.io.File.getName() is no longer treated as a complete sanitizer for java/path-injection, since it does not remove a .. path component (for example new File("..").getName() returns ".."). It is now only recognized as a sanitizer when combined with a subsequent check for .. components, which may result in new alerts.

GitHub Actions¶

Altered the logic of EnvironmentCheck to make sure it is a check that protects only for non-toctou. This change will result in more results being found by the queries: actions/untrusted-checkout-toctou/high and actions/untrusted-checkout-toctou/critical.

© GitHub, Inc.
Terms
Privacy