CodeQL 2.27.0 Adds Linux ARM64 Support, New Rust Security Query, and Expanded Framework Coverage
CodeQL 2.27.0 is now available, introducing native support for Linux ARM64, a new Rust security query, and expanded framework coverage for Java/Kotlin and C#. These enhancements improve static analysis for security issues across a wider range of platforms and popular frameworks like Micronaut and ASP.NET Core. The release also includes various analysis accuracy improvements and upcoming deprecations for Java 9/10 support and the generic `codeql.zip` CLI distribution. Users of GitHub code scanning will receive this version automatically, with manual upgrades available for GitHub Enterprise Server.
- →CodeQL CLI now supports Linux ARM64 natively and private registry configs
- →New Rust security query for command-line injection and query refinements
- →Upcoming deprecations for Java 9/10 support and generic CLI distribution
- →Expanded language and framework coverage for C#, Java/Kotlin, and C/C++
- →Refined CodeQL evaluation for GitHub Actions author-association checks
Deprecations (1) ›
- Upcoming deprecations for Java 9/10 support and generic CLI distribution
Language support for Java 9 and 10 will be removed in January 2027, though Java 7 and 8 will continue to be supported. Additionally, the generic multi-platform `codeql.zip` CLI distribution will be removed in a future release; users are advised to download the per-platform `.zip` instead.
Features (2) ›
- CodeQL CLI now supports Linux ARM64 natively and private registry configs
CodeQL 2.27.0 introduces native execution for the CodeQL CLI on Linux ARM64, with platform-specific downloads available. GitHub code scanning's default setup can now also use private registry configurations to authenticate with container registries or the GitHub API when fetching custom queries or packs.
- New Rust security query for command-line injection and query refinements
A new `rust/command-line-injection` query has been added to detect uncontrolled command lines. Updates to existing Rust queries, such as `rust/hard-coded-cryptographic-value` and `rust/unused-variable`, aim to reduce duplicate results and improve accuracy.
Enhancements (2) ›
- Expanded language and framework coverage for C#, Java/Kotlin, and C/C++
C# analysis includes improved ASP.NET Core MVC controller and action discovery, along with taint tracking support for OData action parameter binding. Java/Kotlin gains new modeling for the Micronaut framework, covering HTTP controllers, WebSocket endpoints, and security annotations. C/C++ analysis now identifies PostgreSQL libpq query-execution functions as SQL injection sinks.
- Refined CodeQL evaluation for GitHub Actions author-association checks
CodeQL has improved how it evaluates author-association fields from event payloads in GitHub Actions, treating these checks as protection only when the relevant field is provided. This change may produce additional alerts for workflows that currently rely on ineffective checks.
https://github.blog/changelog/2026-09-09-codeql-2-27-0-adds-support-for-linux-arm64
Related releases
- GitHub Copilot now offers enterprise-managed permissions for agent operations GitHub Changelog ·
- GitHub introduces rulesets to block PRs with exposed secrets from merging GitHub Changelog ·
- GitHub Advanced Security trial expands to more Enterprise Cloud customers GitHub Changelog ·
- GitHub Copilot Introduces Agentic Autofix for Code Quality Findings GitHub Changelog ·
- GitHub Copilot for JetBrains Adds Enterprise Sandbox Controls and CLI Integration GitHub Changelog ·
- GitHub Enterprise Server 3.22 Now Generally Available GitHub Changelog ·