CodeQL 2.26.4 Enhances GitHub Actions Security Detections and Language Support
CodeQL 2.26.4 has been released, providing significant improvements to GitHub's static analysis capabilities. This update enhances security detections for GitHub Actions, refines alert locations for Rust, and improves query accuracy across C# and Java/Kotlin. It also adds support for Go 1.27, JavaScript/TypeScript regex features, and Python taint flow through list methods. The release is automatically deployed to GitHub code scanning users and will be included in a future GitHub Enterprise Server release, with manual upgrade options available for older GHES versions.
- →Expanded Language and Framework Support
- →CodeQL 2.26.4 Release Overview
- →Enhanced GitHub Actions Security Detections
- →Improved Query Accuracy Across Languages
Features (1) ›
- Expanded Language and Framework Support
This release adds support for Go 1.27 and new JavaScript/TypeScript features like the 'd' flag for regular expressions and React Native Worklets. It also introduces SQL injection sink models for Spring R2DBC and R2DBC SPI in Java/Kotlin, along with improved taint flow through Python's list.extend and list.insert methods.
Enhancements (2) ›
- Enhanced GitHub Actions Security Detections
Security detections for GitHub Actions have been improved, with checks on actor fields now more accurately accounting for event payloads. The actions/unpinned-tag query can now detect mutable references in reusable workflows, and EnvironmentCheck can be specified via models-as-data for more effective sanitization checks.
- Improved Query Accuracy Across Languages
Alert locations for Rust data flow queries are now more precise, based on actual source and sink nodes. Query accuracy has been improved for C#, including better recognition of ASP.NET Core antiforgery attributes and fewer false positives in specific queries, alongside refined taint propagation in Java/Kotlin through String.valueOf(Object).
Notes (1) ›
- CodeQL 2.26.4 Release Overview
CodeQL 2.26.4 is now available, delivering enhancements to the static analysis engine that powers GitHub code scanning. This version focuses on improving security issue detection and remediation across various languages and frameworks.
https://github.blog/changelog/2026-09-03-codeql-2-26-4-improves-github-actions-security-detections
Related releases
- GitHub Reopens Copilot Business & Enterprise Sign-ups with Billing Updates GitHub Changelog ·
- Content Exclusions Generally Available for GitHub Copilot App and CLI GitHub Changelog ·
- GitHub Copilot: Enterprise settings for default AI model GitHub Changelog ·
- Selected GitHub Copilot AI Models Deprecated GitHub Changelog ·
- Claude Fable 5.1 now generally available in GitHub Copilot GitHub Changelog ·
- GitHub Enterprise Live Migrations (ELM) Now GA for GHES to Cloud GitHub Changelog ·