ReleaseBytes
github GitHub Changelog · · 2.26.3

CodeQL 2.26.3 Improves GitHub Actions Queries and JavaScript Modeling

securitygaengineer
feature patch breaking

CodeQL 2.26.3 introduces new source modeling capabilities for JavaScript, TypeScript, and Vue, alongside significant improvements to GitHub Actions queries. These updates enhance the accuracy of static analysis, helping developers more effectively identify and remediate security vulnerabilities in their code. The release specifically adds flow models for Vue's Composition API and improves recognition of untrusted data in GitHub Actions workflows. CodeQL 2.26.3 is automatically deployed to GitHub.com code scanning users, with a future GitHub Enterprise Server release to follow.

  • →Improved GitHub Actions Queries and JS/TS/Vue Modeling
  • →Breaking Change: GitHub Actions Self-Hosted Query Module Removed
  • →Expanded JavaScript/TypeScript Flow Analysis
  • →C/C++ and Ruby Analysis Enhancements
Breaking changes (1) ›
  • Breaking Change: GitHub Actions Self-Hosted Query Module Removed

    The `codeql.actions.security.SelfHostedQuery` module has been removed because runner labels do not reliably distinguish self-hosted from managed runners. Any custom queries that rely on this module will need to be updated.

Features (1) ›
  • Improved GitHub Actions Queries and JS/TS/Vue Modeling

    CodeQL 2.26.3 enhances GitHub Actions queries, recognizing untrusted data in `merge_group` events and improving the accuracy and clarity of various security checks. It also adds new JavaScript, TypeScript, and Vue source modeling, including flow models for Vue's Composition API helpers like `ref`, `shallowRef`, and `toRef`.

Enhancements (2) ›
  • Expanded JavaScript/TypeScript Flow Analysis

    Custom models can now reference specific files using package names for defining sources and sinks based on public exports. CodeQL now recognizes Vue Router's `useRoute()` and declared `inputs` properties in Sails Action2 controller files as remote flow sources, alongside improved tracking of promise-wrapped client response data.

  • C/C++ and Ruby Analysis Enhancements

    Flow source models for Windows `winreg.h` functions such as `RegQueryValue` have been added for C/C++. For Ruby, library input to vendored gems is no longer treated as a taint source, reducing false positives in several queries when using vendoring.

Read the original announcement →

https://github.blog/changelog/2026-08-19-codeql-2-26-3-improves-github-actions-queries-and-javascript-modeling

Related releases