ReleaseBytes
github GitHub Changelog · · 2.26.2

CodeQL 2.26.2 Adds Swift and Kotlin Support, Improves Query Accuracy

securityinfraengineer
patch breaking

CodeQL version 2.26.2 introduces support for Swift 6.3.3 and Kotlin 2.4.10, enhancing static analysis capabilities for developers using these languages. This update also refines existing queries for path injection, URL redirection, and GitHub Actions, aiming to improve detection accuracy. The release impacts users of GitHub code scanning, with updates automatically deployed to github.com users and slated for future GHES releases.

  • →Support for Swift 6.3.3 added
  • →Support for Kotlin 2.4.10 added
  • →CodeQL no longer parses [[-style links in alert messages
  • →Improved path injection and URL redirection query accuracy
  • →GitHub Actions query logic updated
Breaking changes (1) ›
  • CodeQL no longer parses [[-style links in alert messages

    A breaking change removes support for the undocumented legacy feature of [[-style links within CodeQL alert messages. Query authors should now use $@placeholder pairs instead for inline links.

Features (2) ›
  • Support for Swift 6.3.3 added

    CodeQL now supports the analysis of applications built with Swift 6.3.3.

  • Support for Kotlin 2.4.10 added

    CodeQL now supports analysis for Kotlin versions up to 2.4.10.

Enhancements (2) ›
  • Improved path injection and URL redirection query accuracy

    The accuracy of queries related to path injection and URL redirection has been improved by adjusting sanitizer definitions for Go and Java/Kotlin.

  • GitHub Actions query logic updated

    The EnvironmentCheck logic for GitHub Actions queries has been updated to better protect against non-TOCTOU scenarios, potentially surfacing more results in untrusted checkout queries.

Notes (1) ›
  • CodeQL 2.26.2 automatically deployed for GitHub.com users

    Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. This new functionality will also be included in a future GitHub Enterprise Server (GHES) release, or can be manually upgraded on older GHES versions.

Read the original announcement →

https://github.blog/changelog/2026-08-04-codeql-2-26-2-adds-swift-6-3-3-and-kotlin-2-4-10-support

Related releases