--- url: "https://www.xcademia.com/news/github-strengthens-code-security-analysis-with-codeql-2-27-2" title: GitHub Strengthens Code Security Analysis With CodeQL 2.27.2 description: "GitHub CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis, updates security queries, and introduces macOS compatibility limitations." publishedAt: "2026-10-10T10:46:31.938+00:00" updatedAt: "2026-10-12T00:04:26.568799+00:00" type: news category: cybersecurity source_name: GitHub Changelog source_url: "https://github.blog/changelog/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis/ " tags: - "#GitHub" - "#CodeQL" - "#StaticCodeAnalysis" - "#ApplicationSecurity" - "#DevSecOps" - "#SoftwareSecurity" - "#VulnerabilityDetection" - "#SecureCoding" --- # GitHub Strengthens Code Security Analysis With CodeQL 2.27.2 > GitHub has released CodeQL 2.27.2 with improved security analysis across C++, Go, Rust, and JavaScript. The update also introduces changes to Go control-flow analysis and clarifies macOS compatibility limitations for compiled-language scanning. Source: **GitHub Changelog** · 10 October 2026 ## GitHub CodeQL 2.27.2 Expands Code Analysis Across Four Programming Languages GitHub has released CodeQL 2.27.2, an update to its static analysis engine that powers GitHub code scanning. Announced on October 9, 2026, the release introduces improvements to C++, Go, Rust, and JavaScript analysis, alongside updates to security queries, command-line behavior, and platform compatibility. The release focuses on helping CodeQL interpret code patterns more accurately, track data flows through supported libraries and frameworks, and identify potential security issues in applications. GitHub also introduced changes to Go's control-flow graph implementation that could require developers to update custom CodeQL queries. In addition, the release documents limitations affecting compiled-language analysis on macOS 27 and macOS 26 when using Xcode 27. ## What Is CodeQL? CodeQL is GitHub's code analysis technology for identifying potential security vulnerabilities in software. Rather than treating source code only as text, CodeQL represents code in a form that can be queried to investigate relationships between program elements and how data moves through an application. Security teams can use CodeQL through GitHub code scanning to identify potential vulnerabilities during software development. According to GitHub, the Default query suite includes **498 security queries covering 170 Common Weakness Enumerations (CWEs)**. The Extended suite adds another 131 queries covering 32 additional CWEs. CWEs provide a common classification system for software weaknesses. ![source-code](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791627652589-source-code.webp) ## C++ Analysis Gains Regular Expression Support One of the key changes in CodeQL 2.27.2 is the addition of support for parsing regular expressions that use the ECMAScript grammar in C++'s `std::regex`. Regular expressions are commonly used to match, validate, and process text. Supporting their grammar helps CodeQL interpret these expressions as part of its analysis. GitHub has also added SQL injection sink models for the Comdb2 C API. These models help CodeQL identify relevant points where potentially unsafe data may reach SQL operations. Additionally, the release includes data-flow summaries for Bloomberg BDE codecs and byte-stream deserializers. These updates expand CodeQL's understanding of selected C++ code patterns and data-processing components. They are particularly relevant to teams maintaining C++ applications that use these libraries and interfaces. ## Go Analysis Adds WebSocket Support The Go improvements include support for the `github.com/coder/websocket` import path. Previously, CodeQL modeled the `nhooyr.io/websocket` import path. The update adds the newer import path to its existing coverage. This matters for projects using the supported WebSocket package because static analysis depends partly on understanding how application code interacts with libraries. The release also introduces a significant internal change to Go's control-flow graph, which represents the possible execution paths through a program. The revised graph includes additional nodes for constructs such as assignments, function parameters and results, range statements, and deferred calls. It also excludes nodes that are unreachable from the entry point. These changes affect graph nodes, edges, source locations, textual representations, and basic-block boundaries. Developers who maintain custom CodeQL queries that depend on the previous graph representation may need to update them. ![program-execution](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791627674089-program-execution.webp) ## Rust Analysis Improves Async Data-Flow Tracking CodeQL 2.27.2 includes several changes to Rust analysis. The Rust extractor now supports the `AnyAttr` and `DocComment` classes. GitHub has also improved data-flow analysis for asynchronous blocks used with `await`. In addition, the release introduces flow summaries for three Rust crates: - `native-tls` - `async-native-tls` - `tokio-native-tls` Data-flow analysis examines how information moves through a program. This can help security analysis identify relationships between input sources, intermediate processing steps, and operations that may introduce security risks. The async-related changes are relevant to Rust applications that use asynchronous execution and the listed TLS libraries. However, the release notes do not provide a quantified measurement of improvements in vulnerability detection or analysis performance. ## JavaScript and TypeScript Analysis Recognizes More Code Patterns The update also improves CodeQL's understanding of JavaScript and TypeScript applications. **Workflow SDK directives** CodeQL now recognizes the Workflow SDK directives `"use workflow"` and `"use step"`. These directives will no longer be flagged by the `js/unknown-directive` query as unknown directives. This change helps align the analysis with these recognized coding patterns. **Improved Hapi request tracking** GitHub has also improved tracking of Hapi route handlers and request inputs when applications use custom route-registration helpers and higher-order functions. Hapi is a framework used to build Node.js applications and APIs. Route handlers process requests, while request inputs can include data supplied by external users. Tracking how request data moves through these application structures is important for identifying potentially unsafe data flows. The improvements could be useful for developers maintaining JavaScript and TypeScript applications that use Hapi and more complex route-registration patterns. GitHub has not disclosed specific detection-rate or performance figures for these changes. ![analysis-improvements](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1791627704632-analysis-improvements.webp) ## macOS 27 Introduces a Compatibility Limitation Alongside the analysis improvements, GitHub has documented an important compatibility issue affecting compiled-language analysis on macOS. According to the release notes, Apple stopped shipping the multi-architecture x86-64 and arm64 binaries required by CodeQL for traced analysis with the release of macOS 27 and Xcode 27. As a result, CodeQL's `autobuild` and `manual` build modes are not supported for compiled languages in these environments: - **macOS 27:** These build modes are unsupported with any Xcode version. - **macOS 26 with Xcode 27:** These build modes are also unsupported. GitHub advises users relying on these build modes to use macOS 26 or earlier with Xcode 26 or earlier, respectively, within the stated compatibility guidance. The company also says it is working to improve support for CodeQL's `none` build mode on macOS to help mitigate the limitation. **What Developers Should Do** Teams running CodeQL analysis on macOS should review their current operating system, Xcode version, and build-mode configuration. If a project uses compiled-language analysis with `autobuild` or `manual`, developers should verify that their environment matches GitHub's documented compatibility guidance before upgrading their development systems. Teams using custom build configurations should review the relevant CodeQL documentation to determine whether their existing setup is affected. ## Additional Security Query and CLI Changes CodeQL 2.27.2 also includes changes beyond the four highlighted programming languages. **C# security queries** The `cs/web/missing-x-frame-options` query now recognizes [ASP.NET](http://ASP.NET) Core response headers and Content Security Policy `frame-ancestors` directives as protections against clickjacking. This helps the query account for these alternative protections when evaluating relevant web application configurations. The `cs/web/xss` query has also changed. It no longer treats Razor tag-helper attribute values written with `WriteLiteral` as cross-site scripting sinks. **GitHub Actions security** The `actions/unpinned-tag` query now allows users to remove owners from its trusted set by adding an entry prefixed with `!`. For example, adding `!github` allows users to flag unpinned GitHub Actions from that owner rather than automatically trusting it. This provides teams with more control over how the query evaluates unpinned action references. **CodeQL CLI improvements** The command-line interface now reports invalid `qlpack:` and `from:` values in query suites as clear errors instead of crashing. Other changes include rejecting YAML data-extension integers outside the signed 32-bit range instead of silently truncating certain values. Error and warning messages written to standard error now include the prefixes `ERROR:` and `WARNING:`. Structured outputs, including logs and SARIF, remain unchanged. These changes improve error reporting and make certain configuration problems easier to identify. ## What the Update Means for Security Teams CodeQL 2.27.2 combines language-specific analysis improvements with changes to query behavior, platform compatibility, and internal representations. For development and security teams, three areas deserve particular attention. **First, review language and framework coverage.** Teams using the affected C++, Go, Rust, JavaScript, and TypeScript patterns should examine whether the changes apply to their applications. **Second, validate custom queries.** The Go control-flow graph changes are especially important for organizations that maintain their own CodeQL queries. Existing queries that rely on the previous graph structure may need adjustments. **Third, verify scanning environments.** Teams running compiled-language analysis on macOS should check the documented restrictions involving macOS 26, macOS 27, and Xcode 27. These are practical implications of the documented changes, rather than claims that the update will eliminate vulnerabilities or improve security outcomes by a specific amount. **Availability and Upgrade Information** GitHub states that new CodeQL versions are automatically deployed to users of GitHub code scanning on [GitHub.com.](http://GitHub.com) A future GitHub Enterprise Server release will also include the functionality introduced in CodeQL 2.27.2. Organizations using older GitHub Enterprise Server versions can manually upgrade their CodeQL version, according to the release announcement. Developers can review the complete release details in the official resources: - **Original announcement:** [GitHub Changelog: CodeQL 2.27.2](https://github.blog/changelog/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis) - **Technical release notes:** [CodeQL 2.27.2 documentation](https://codeql.github.com/docs/codeql-overview/codeql-changelog/codeql-cli-2.27.2) ## Conclusion CodeQL 2.27.2 expands static analysis support across several programming languages while refining security queries and command-line behavior. The release brings targeted improvements to C++ regular-expression parsing, Go WebSocket modeling, Rust asynchronous data-flow analysis, and JavaScript and TypeScript framework recognition. For teams maintaining custom Go queries, the revised control-flow graph deserves particular attention. Developers running compiled-language analysis on macOS should also review the updated compatibility guidance. The release reinforces the importance of keeping static analysis tools, custom queries, and development environments aligned with changes in programming languages and build platforms. ## Original source https://github.blog/changelog/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis/ ## Tags `#GitHub` · `#CodeQL` · `#StaticCodeAnalysis` · `#ApplicationSecurity` · `#DevSecOps` · `#SoftwareSecurity` · `#VulnerabilityDetection` · `#SecureCoding` --- ## About this content This Markdown news article is the citation-grade twin of [GitHub Strengthens Code Security Analysis With CodeQL 2.27.2](https://www.xcademia.com/news/github-strengthens-code-security-analysis-with-codeql-2-27-2). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/github-strengthens-code-security-analysis-with-codeql-2-27-2 - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt