CodeQL 2.27.2 adds regex parsing for C++ and improves Go, Rust, and JavaScript analysis

CodeQL 2.27.2 expands the capabilities of GitHub's code scanning static analyzer, adding a regular expression parser for C++ and improving support for Go, Rust, and JavaScript/TypeScript. The tool continues to evolve toward broader vulnerability coverage and more precise data-flow analysis.

The Default suite now includes 498 security queries, covering 170 Common Weakness Enumeration (CWE) types. The Extended suite adds 131 more queries for 32 additional CWE types.

Expanded language support

C/C++

CodeQL now includes a parser for regular expressions that use ECMAScript grammar in std::regex. This expands its ability to detect security issues tied to regular expression handling.

For SQL injection, new sink models have been added for the Comdb2 C API. Flow summaries for Bloomberg BDE codecs and byte-stream deserializers have also been improved, boosting the quality of data-flow analysis through these popular libraries.

Go

CodeQL now models github.com/coder/websocket in addition to nhooyr.io/websocket, making it possible to detect vulnerabilities in code using either WebSocket library variant.

Rust

The Rust extractor has added support for the AnyAttr and DocComment classes, improving analysis of attributes and documentation.

Handling of async blocks with await has been improved, enabling better tracking of data flow in asynchronous code. Flow summaries have been added for native-tls, async-native-tls, and tokio-native-tls.

JavaScript/TypeScript

CodeQL now recognizes the Workflow SDK's "use workflow" and "use step" directives.

Tracking of Hapi route handlers and request input through custom route-registration helpers and higher-order functions has been improved, helping detect web application vulnerabilities.

Breaking change: macOS 27 and Xcode 27

Apple has stopped distributing the multi-architecture (x86-64/arm64) binaries that CodeQL requires for traced analysis. On macOS 27 (with any Xcode version) and macOS 26 (with Xcode 27), the autobuild and manual build modes will be unavailable for compiled languages.

Recommendation: use macOS 26 and Xcode 26 at most for these modes. GitHub is working on improving build mode "none" support on macOS.

Query and CLI changes

Query updates (C# and GitHub Actions)

The cs/web/missing-x-frame-options query now recognizes ASP.NET Core response headers and Content Security Policy frame-ancestors directives as clickjacking protection.

The cs/web/xss query no longer treats Razor tag-helper attribute values using WriteLiteral as XSS sinks.

In the actions/unpinned-tag query, owners can now be removed from the trusted set using a "!" prefix (for example, "!github"), making it possible to flag unpinned tags from first-party owners.

CodeQL CLI improvements

The command-line interface now outputs clear errors for invalid qlpack and "from" values instead of crashing.

YAML data-extension integers outside the signed 32-bit range are now rejected rather than silently truncated.

Error and warning messages on stderr now get ERROR: and WARNING: prefixes. Structured output (logs and SARIF) remains unchanged.

The codeql query compile command now accepts --dil-constants with --dump-dil to include optimized constant tuples in the emitted DIL.

Commands that load data extensions now print a warning only when none of the patterns in the dataExtensions list match any files.

Breaking change in the Go library

The control-flow graph (CFG) for Go now uses a shared CFG library that includes additional nodes for assignments, parameters, results, range statements, and deferred calls. Nodes unreachable from the entry point have been excluded.

This affects nodes, edges, locations, textual representations, and basic block boundaries, so queries relying on the old representation will need to be updated.

Specific changes:

• Removed: BasicBlocks::Cfg • Added: ControlFlow::EntryNode, ControlFlow::ExitNode, SwitchStmt.getExpr • Deprecated: IfStmt.getCond → IfStmt.getCondition • Changed return types: IfStmt.getThen and LoopStmt.getBody now return Stmt • Consolidated: several IR instruction classes

GitHub automatically rolls out new CodeQL versions for github.com code scanning. Future GitHub Enterprise Server (GHES) releases will also include CodeQL 2.27.2 functionality. Users on older GHES versions can update their CodeQL version manually.