CodeQL 2.27.1 adds a C++ query, reads Actions lock files

GitHub announced CodeQL 2.27.1 on September 25, 2026. It adds a new C and C++ query, supports Kotlin 2.4.20 and changes how it judges GitHub Actions workflows. The Actions change matters most day to day. CodeQL now counts an action as safely pinned when a valid lock file entry covers it. Teams that pin that way should see fewer false alarms.

CodeQL is the static analysis engine behind GitHub code scanning. Static analysis means reading source code for bugs and security flaws without running it. Code scanning runs those checks on pull requests and shows the results as alerts.

What is new in CodeQL 2.27.1

The CodeQL CLI changelog lists the release under September 22, 2026. The GitHub changelog post followed three days later. Both describe the same set of changes.

The documentation also gives the size of the query packs. The default suite holds 498 security queries covering 170 CWEs. A CWE is an entry in the Common Weakness Enumeration, a public catalog of bug types. The extended suite adds 131 more queries covering 32 more CWEs.

The new C and C++ query

The C/C++ addition targets a quiet kind of bug. It flags code that assigns the result of a comparison to a variable, where that variable is then used as a true-or-false value. According to GitHub, such expressions are potentially ambiguous.

The classic case is a line that mixes = and ==. A reader cannot always tell whether the author meant to store a comparison or to test a value. A compiler usually accepts both readings, which is why a dedicated check helps.

The C# side gains a code-quality query too. cs/linq/missed-firstordefault points out foreach loops that could be written with LINQ's FirstOrDefault method. LINQ is C#'s built-in query syntax for collections. The changelog adds that its rewrite suggestions no longer capture in, out or ref parameters.

Why the Actions lock file change matters

Pinning an action means referring to it by an exact commit instead of a tag like v4. A tag can be moved to different code after you adopt it. A commit cannot. CodeQL's actions/unpinned-tag query warns when a workflow uses a tag.

In 2.27.1 that query now accepts references backed by structurally valid entries in .github/workflows/actions.lock. It also treats $/ references, which point at the repository itself, as pinned by nature. Code in your own repository cannot be swapped by a third party the way an outside tag can.

When self-hosted users get it

GitHub Enterprise Server is the version of GitHub that companies run on their own machines. GitHub says Enterprise Server 3.24 will include CodeQL 2.27.1. The Java-side tooling moved too: the documentation lists an update to Eclipse Temurin OpenJDK 25.0.4.1.

What this means for developers

Check your code scanning alerts for actions/unpinned-tag after the upgrade. If you already record actions in .github/workflows/actions.lock, alerts on those references should close. Any that stay open point at a reference the lock file does not cover, or an entry the query does not consider valid. Either way, it is worth a look.

C and C++ teams should expect a first wave of cpp/ambiguous-assignment-of-comparison results on older code. Triage them rather than bulk-dismissing. Some will be intentional style. Others may be a real typo that has survived review for years.

Kotlin teams on the K2 compiler get two fixes at once. Support for 2.4.20 means you can upgrade the compiler without losing analysis. The Foo::class.java fix should also remove some false positives.

Go teams on 1.27 get data flow models for new standard library functions. Taint tracking follows untrusted input through a program to a risky spot. It can now follow data through bytes.CutLast and strings.Clone instead of losing the trail there.

If you run GitHub Enterprise Server, plan the 3.24 upgrade to get these changes. Until then, your code scanning keeps the older query behavior.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Sources

• CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support - GitHub Changelog
• CodeQL 2.27.1 (2026-09-22) - CodeQL documentation