GitHub has released CodeQL version 2.27.1, introducing several updates to its static analysis engine. This version expands the tool’s capabilities by adding new queries for C, C++, and C#, alongside general improvements to query accuracy. Additionally, the engine now supports Kotlin version 2.4.20. CodeQL serves as the foundational technology for GitHub’s automated code scanning features, which are designed to help developers identify security vulnerabilities and logic errors during the development lifecycle.
Language Coverage and Accuracy
The addition of new queries for C and C++ is particularly relevant for developers working on systems-level software, where identifying memory management issues and safety flaws is a primary concern. By updating the engine to support Kotlin 2.4.20, GitHub ensures that mobile and backend developers utilizing the latest version of the language can continue to integrate automated security checks into their workflows. Improving query accuracy is a standard goal for static analysis tools, as it helps reduce the number of false positives that developers must manually review, thereby streamlining the path from code submission to production.
Technical Specifics and Unknowns
While the report from the GitHub Changelog confirms the expansion of the query library, the announcement did not specify the exact types of vulnerabilities or coding patterns these new C, C++, and C# queries are built to detect. Furthermore, the technical details regarding the accuracy improvements were not disclosed, leaving it unclear whether these changes affect scan speed or the depth of the data-flow analysis. It is also unknown if these updates address specific Common Weakness Enumerations (CWEs) or if they are focused on general code quality. Developers will need to observe the tool’s performance on existing repositories to gauge the practical impact of these refinements.
CodeQL 2.27.1 is now available for integration. Organizations using GitHub’s native security tools should see these updates reflected in their automated scanning results.
Lead image: Daniil Komov / Pexels
