CodeQL 2.27.2 Learns to Parse Regular Expressions in C++ and Improves Analysis for Go, Rust and JavaScript

GitHub has released CodeQL 2.27.2. The main change in this version is a regular expression parser for C++. In addition, analysis has been improved for several languages at once, including Go, Rust and JavaScript. CodeQL underpins GitHub code scanning, so updates like this directly affect which vulnerabilities and bugs the platform finds in repositories. The changelog entry is dated October 9, 2026, and is very short: it does not list specific queries, rules or fixes.

What we know about the release

GitHub's wording is terse: a regular expression parser for C++ was added, along with "analysis improvements" for several languages. The announcement gives no per-language breakdown. Anything beyond these two facts therefore remains speculation for now, and the exact list of changes should be sought in the full CodeQL release notes.

Key release data:

• version: CodeQL 2.27.2;
• publication date: October 9, 2026;
• new: regular expression parser for C++;
• affected languages: C++, Go, Rust, JavaScript (the announcement refers to "several languages");
• purpose: static analysis engine behind GitHub code scanning.

Why a static analyzer needs a regex parser

CodeQL represents code as a database, which you query using a dedicated language, QL. For a query to reason about a regex string, the analyzer has to understand its structure: groups, quantifiers, alternations, character classes. Without parsing, a string literal is just text to it.

A parser provides that structure. Checks such as detecting regexes prone to catastrophic backtracking (ReDoS) or unsafe embedding of user input in a pattern are typically built on top of it. For JavaScript and a number of other languages, this infrastructure already exists in CodeQL. A C++ counterpart closes a gap for a language where regexes are used through the standard library and third-party packages. A caveat: GitHub's announcement does not say which queries will use the new parser. The link to ReDoS and similar checks is a logical inference here, not a stated fact.

What about the other languages

The fact that Go, Rust and JavaScript are listed in the headline indicates that the update was not limited to C++. Rust stands out on that list: language support in CodeQL is relatively recent, and the accuracy of library and data-flow modeling there directly affects the number of findings and false positives. The announcement does not say what exactly changed, so you will have to judge the effect from your own scan results.

What to check after updating

Where CodeQL runs through standard code scanning on GitHub-hosted infrastructure, the version is usually pulled in on the platform side. If you pin a CodeQL CLI version or use your own pipelines, you will have to update manually.

A practical sequence of steps:

• check the 2.27.2 release notes and find the changes for the languages you use;
• run a scan on a branch of a test repository and compare the number and makeup of alerts with the previous version;
• in C++ projects that use regexes heavily, review the new findings separately: that is where differences are most likely to appear;
• do not automatically dismiss previously closed alerts; instead, check whether they disappeared because of changes in the analysis model;
• if you use custom QL queries, make sure they compile on the new version and do not change behavior.

The release itself is small and technical. Its real value will become clear when GitHub discloses the list of changes or when teams see the difference in reports on their own code.