CodeQL 2.26.1 enhances analysis accuracy and framework coverage
CodeQL version 2.26.1 improves static analysis accuracy and expands framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, while reducing false positives in Rust analysis. These enhancements aim to improve security issue detection for users of GitHub code scanning. The update is automatically deployed to GitHub.com users and will be included in a future GHES release.
- →Improved C/C++ models-as-data flow summaries
- →Enhanced Go structured logging analysis
- →Added Java/Kotlin models for Apache POI
- →Added Angular @HostListener support for JavaScript/TypeScript
- →Reduced false positives in Rust cryptographic value analysis
Enhancements (5) ›
- Improved C/C++ models-as-data flow summaries
C/C++ analysis now uses fully qualified field names in models-as-data flow summaries, such as MyNamespace::MyStruct::myField. Unqualified field names are still supported but will be removed in 12 months.
- Enhanced Go structured logging analysis
Go analysis now includes improved modeling for the log/slog package, covering methods like slog.Logger, With, WithGroup, Attr, and Value. This expansion enhances coverage for applications using structured logging.
- Added Java/Kotlin models for Apache POI
Summary models for source, sink, and flow have been added for the org.apache.poi package in Java/Kotlin analysis.
- Added Angular @HostListener support for JavaScript/TypeScript
JavaScript/TypeScript analysis now supports Angular's @HostListener decorators for 'window:message' and 'document:message', recognizing decorated method parameters as client-side remote flow sources.
- Reduced false positives in Rust cryptographic value analysis
The rust/hard-coded-cryptographic-value query now treats arithmetic, bitwise, and string append operations as barriers, reducing false positives when code combines constants with non-constant data.
Notes (1) ›
- CodeQL 2.26.1 deployment and availability
CodeQL version 2.26.1 is automatically deployed to GitHub code scanning users on github.com. The new functionality will be included in a future GitHub Enterprise Server (GHES) release, with options for manual upgrades on older GHES versions.
https://github.blog/changelog/2026-07-29-codeql-2-26-1-improves-analysis-accuracy-and-framework-coverage
Related releases
- GitHub Copilot App Usage Metrics Expanded in API GitHub Changelog ·
- npm Adds Publish-Time Malware Scanning and Dual-Use Metadata GitHub Changelog ·
- Grok 4.5 reasoning model available in GitHub Copilot GitHub Changelog ·
- GitHub Actions holds workflows for approval to prevent attacks GitHub Changelog ·
- Dependabot alerts expand to cover malicious packages from OpenSSF GitHub Changelog ·
- GitHub Actions holds potentially malicious workflows for approval GitHub Changelog ·