{"id":99433,"date":"2026-10-09T14:32:54","date_gmt":"2026-10-09T21:32:54","guid":{"rendered":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis"},"modified":"2026-10-09T14:36:19","modified_gmt":"2026-10-09T21:36:19","slug":"codeql-2-27-2-improves-c-go-rust-and-javascript-analysis","status":"publish","type":[3522],"link":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis","title":{"rendered":"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis"},"content":{"rendered":"<!DOCTYPE html PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/REC-html40\/loose.dtd\">\n<html><body><p><a href=\"https:\/\/codeql.github.com\/docs\/codeql-overview\/codeql-changelog\/codeql-cli-2.27.2\/\">CodeQL 2.27.2<\/a> is now available, adding a C++ regular-expression parser and analysis improvements across several languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code. The Default suite runs 498 security queries covering 170 CWEs. The Extended suite adds 131 queries covering 32 more CWEs.<\/p>\n<h2 id=\"language-and-framework-support\" id=\"language-and-framework-support\" ><a class=\"heading-link\" href=\"#language-and-framework-support\">Language and framework support<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<p><strong>C\/C++<\/strong><\/p>\n<ul>\n<li>CodeQL now parses regular expressions that use the ECMAScript grammar in <code>std::regex<\/code>.<\/li>\n<li>We&rsquo;ve added SQL-injection sink models for the Comdb2 C API as well as flow summaries for Bloomberg BDE codecs and byte-stream deserializers.<\/li>\n<\/ul>\n<p><strong>Go<\/strong><\/p>\n<ul>\n<li>CodeQL now models the <code>github.com\/coder\/websocket<\/code> import path, in addition to <code>nhooyr.io\/websocket<\/code>.<\/li>\n<\/ul>\n<p><strong>Rust<\/strong><\/p>\n<ul>\n<li>The Rust extractor now supports the <code>AnyAttr<\/code> and <code>DocComment<\/code> classes.<\/li>\n<li>We&rsquo;ve improved data flow for async blocks used with <code>await<\/code> as well as added flow summaries for <code>native-tls<\/code>, <code>async-native-tls<\/code>, and <code>tokio-native-tls<\/code>.<\/li>\n<\/ul>\n<p><strong>JavaScript\/TypeScript<\/strong><\/p>\n<ul>\n<li>CodeQL now recognizes the Workflow SDK&rsquo;s <code>\"use workflow\"<\/code> and <code>\"use step\"<\/code> directives.<\/li>\n<li>We&rsquo;ve improved Hapi route-handler and request-input tracking through custom route-registration helpers and higher-order functions.<\/li>\n<\/ul>\n<h2 id=\"macos-27-compatibility\" id=\"macos-27-compatibility\" ><a class=\"heading-link\" href=\"#macos-27-compatibility\">macOS 27 compatibility<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<ul>\n<li>With the release of macOS 27 and Xcode 27, Apple stopped shipping multi-architecture x86-64\/arm64 binaries. These binaries are required by CodeQL to perform traced analysis. For this reason, CodeQL&rsquo;s <code>autobuild<\/code> and <code>manual<\/code> build modes will not be supported for compiled languages on macOS 27 with any Xcode version, and on macOS 26 when Xcode 27 is selected. When using these build modes, please use at most macOS 26 and Xcode 26. We are also working on improving support for build mode <code>none<\/code> on macOS to help mitigate this limitation.<\/li>\n<\/ul>\n<h2 id=\"query-changes\" id=\"query-changes\" ><a class=\"heading-link\" href=\"#query-changes\">Query changes<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<p><strong>C#<\/strong><\/p>\n<ul>\n<li>The <code>cs\/web\/missing-x-frame-options<\/code> query now recognizes ASP.NET Core response headers and Content Security Policy <code>frame-ancestors<\/code> directives as clickjacking protections.<\/li>\n<li>The <code>cs\/web\/xss<\/code> query no longer treats Razor tag-helper attribute values written with <code>WriteLiteral<\/code> as XSS sinks.<\/li>\n<\/ul>\n<p><strong>GitHub Actions<\/strong><\/p>\n<ul>\n<li>You can now remove owners from the trusted set used by the <code>actions\/unpinned-tag<\/code> query by adding an entry prefixed with <code>!<\/code>, such as <code>!github<\/code>. This lets you report unpinned tags for first-party owners.<\/li>\n<\/ul>\n<h2 id=\"codeql-cli\" id=\"codeql-cli\" ><a class=\"heading-link\" href=\"#codeql-cli\">CodeQL CLI<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<ul>\n<li>The CLI now reports invalid <code>qlpack:<\/code> and <code>from:<\/code> values in query suites as clear errors instead of crashing.<\/li>\n<li>CodeQL now rejects YAML data-extension integers outside the signed 32-bit range instead of silently truncating some values.<\/li>\n<li>Error and warning messages on standard error now include <code>ERROR:<\/code> and <code>WARNING:<\/code> prefixes. Structured output, including logs and SARIF, remains unchanged.<\/li>\n<li><code>codeql query compile<\/code> now accepts <code>--dil-constants<\/code> with <code>--dump-dil<\/code> to include optimized constant tuple sets in emitted DIL.<\/li>\n<li>Commands that load data extensions now only warn when none of the patterns in a pack&rsquo;s <code>dataExtensions<\/code> list match any files.<\/li>\n<\/ul>\n<h2 id=\"go-library-breaking-change\" id=\"go-library-breaking-change\" ><a class=\"heading-link\" href=\"#go-library-breaking-change\">Go library breaking change<span class=\"heading-hash pl-2 text-italic text-bold\" aria-hidden=\"true\"><\/span><\/a><\/h2>\n<p>The Go control-flow graph (CFG) now uses the shared CFG library. It includes additional nodes for constructs such as assignments, parameters and results, range statements, and deferred calls, and excludes nodes that aren&rsquo;t reachable from the entry point. This changes CFG nodes, edges, locations, textual representations, and basic-block boundaries, so you may need to update queries that rely on the previous representation.<\/p>\n<p>The update:<\/p>\n<ul>\n<li>Removes <code>BasicBlocks::Cfg<\/code>.<\/li>\n<li>Adds <code>ControlFlow::EntryNode<\/code>, <code>ControlFlow::ExitNode<\/code>, and <code>SwitchStmt.getExpr<\/code>.<\/li>\n<li>Deprecates <code>IfStmt.getCond<\/code> in favor of <code>IfStmt.getCondition<\/code>.<\/li>\n<li>Changes the return types of <code>IfStmt.getThen<\/code> and <code>LoopStmt.getBody<\/code> to <code>Stmt<\/code>.<\/li>\n<li>Consolidates several IR instruction classes. <\/li>\n<\/ul>\n<p>For full details, see the <a href=\"https:\/\/codeql.github.com\/docs\/codeql-overview\/codeql-changelog\/codeql-cli-2.27.2\/\">CodeQL 2.27.2 changelog<\/a>. GitHub automatically deploys every new CodeQL version to users of GitHub code scanning on github.com. A future GitHub Enterprise Server (GHES) release will also include the new functionality in CodeQL 2.27.2. If you use an older version of GHES, you can <a href=\"https:\/\/docs.github.com\/enterprise-server@3.20\/admin\/managing-code-security\/managing-github-advanced-security-for-your-enterprise\/configuring-code-scanning-for-your-appliance#configuring-codeql-analysis-on-a-server-without-internet-access\">manually upgrade your CodeQL version<\/a>.<\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"<p>CodeQL 2.27.2 is now available, adding a C++ regular-expression parser and analysis improvements across several languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find&hellip;<\/p>\n","protected":false},"author":2106,"featured_media":0,"template":"","meta":{"_gh_post_show_toc":"","_gh_post_is_no_robots":"","_gh_post_is_featured":"","_gh_post_is_excluded":"","_gh_post_is_unlisted":"","_gh_post_related_link_1":"","_gh_post_related_link_2":"","_gh_post_related_link_3":"","_gh_post_sq_img":"","_gh_post_sq_img_id":"","_gh_post_cta_title":"","_gh_post_cta_text":"","_gh_post_cta_link":"","_gh_post_cta_button":"","_gh_post_recirc_hide":"","_gh_post_recirc_col_1":"","_gh_post_recirc_col_2":"","_gh_post_recirc_col_3":"","_gh_post_recirc_col_4":"","_featured_video":"","_gh_post_additional_query_params":"","footnotes":"","_links_to":"","_links_to_target":"","primary_cta":"","primary_cta_url":"","secondary_cta":"","secondary_cta_url":""},"label":[3627],"group":[3925],"coauthors":[3100],"class_list":["post-99433","changelog","type-changelog","status-publish","hentry","changelog-type-improvements","changelog-label-application-security","changelog-group-10-2026"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.6 (Yoast SEO v28.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis - GitHub Changelog<\/title>\n<meta name=\"description\" content=\"CodeQL 2.27.2 is now available\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis \u00b7 GitHub Changelog\" \/>\n<meta property=\"og:description\" content=\"CodeQL 2.27.2 is now available\" \/>\n<meta property=\"og:url\" content=\"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/\" \/>\n<meta property=\"og:site_name\" content=\"The GitHub Blog\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-09T21:36:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/github.blog\/wp-content\/uploads\/2026\/10\/668903893-93ffbd51-7b0a-4115-84e2-0568b87d6977.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Allison\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\\\/\",\"url\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\\\/\",\"name\":\"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis - The GitHub Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/github.blog\\\/#website\"},\"datePublished\":\"2026-10-09T21:32:54+00:00\",\"dateModified\":\"2026-10-09T21:36:19+00:00\",\"description\":\"CodeQL 2.27.2 is now available\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/github.blog\\\/changelog\\\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/github.blog\\\/changelog\\\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/github.blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Changelogs\",\"item\":\"https:\\\/\\\/github.blog\\\/changelog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/github.blog\\\/#website\",\"url\":\"https:\\\/\\\/github.blog\\\/\",\"name\":\"The GitHub Blog\",\"description\":\"Updates, ideas, and inspiration from GitHub to help developers build and design software.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/github.blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis - GitHub Changelog","description":"CodeQL 2.27.2 is now available","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/","og_locale":"en_US","og_type":"article","og_title":"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis \u00b7 GitHub Changelog","og_description":"CodeQL 2.27.2 is now available","og_url":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/","og_site_name":"The GitHub Blog","article_modified_time":"2026-10-09T21:36:19+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/github.blog\/wp-content\/uploads\/2026\/10\/668903893-93ffbd51-7b0a-4115-84e2-0568b87d6977.jpeg","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes","Written by":"Allison"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/","url":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/","name":"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis - The GitHub Blog","isPartOf":{"@id":"https:\/\/github.blog\/#website"},"datePublished":"2026-10-09T21:32:54+00:00","dateModified":"2026-10-09T21:36:19+00:00","description":"CodeQL 2.27.2 is now available","breadcrumb":{"@id":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/github.blog\/changelog\/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/github.blog\/"},{"@type":"ListItem","position":2,"name":"Changelogs","item":"https:\/\/github.blog\/changelog\/"},{"@type":"ListItem","position":3,"name":"CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis"}]},{"@type":"WebSite","@id":"https:\/\/github.blog\/#website","url":"https:\/\/github.blog\/","name":"The GitHub Blog","description":"Updates, ideas, and inspiration from GitHub to help developers build and design software.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/github.blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/99433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs"}],"about":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/types\/changelog"}],"author":[{"embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/users\/2106"}],"version-history":[{"count":1,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/99433\/revisions"}],"predecessor-version":[{"id":99435,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/changelogs\/99433\/revisions\/99435"}],"wp:attachment":[{"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/media?parent=99433"}],"wp:term":[{"taxonomy":"changelog-type","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/type?post=99433"},{"taxonomy":"changelog-label","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/label?post=99433"},{"taxonomy":"changelog-group","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/group?post=99433"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/github.blog\/wp-json\/wp\/v2\/coauthors?post=99433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}