CodeQL 2.26.4 Tightens GitHub Actions Security and Expands Language Support

CodeQL 2.26.4 adds Go 1.27 support, refines Rust data‑flow alert locations, and tightens GitHub Actions security checks while delivering a series of language‑specific accuracy tweaks. Practitioners who rely on automated code scanning need to understand the new alert patterns, the expanded language coverage, and the operational impact on CI/CD pipelines.

Key Language and Query Updates

• Go 1.27 is now a supported target, allowing projects that have migrated to the latest compiler to be analyzed without custom workarounds.
• Rust data‑flow queries now pinpoint the exact source and sink nodes, which means some existing alerts will close and new ones will appear at more precise locations.
• Java/Kotlin receives new SQL‑injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI. Taint also propagates through String.valueOf(Object) when the argument implements CharSequence.
• JavaScript/TypeScript support now includes regular expressions with the d flag and the React Native worklet directive.
• Python taint flow is extended to cover list.extend and list.insert, matching the existing handling of list.append.
• C# queries have been refined: missing‑token‑validation now recognises enabled RequireAntiforgeryToken attributes, virtual‑call‑in‑constructor no longer flags nameof expressions, and false positives in build‑mode none databases are reduced for several boolean‑expression checks.

GitHub Actions Security Enhancements

• Actor fields read from the event payload (e.g., github.event.pull_request.user.login) are counted as protection only for events that actually populate those fields, potentially surfacing more alerts for existing ControlCheck queries.
• The actions/unpinned-tag query now detects mutable references to reusable workflows, helping to flag scenarios where a workflow could be altered after initial approval.
• Environment checks can be expressed through a models‑as‑data construct, and queries using ControlCheck may produce additional findings when an environment no longer serves as a sufficient sanitizer.

Operational Considerations

All GitHub.com code‑scanning users receive the new version automatically, and the functionality will be bundled into a future GitHub Enterprise Server (GHES) release. Teams on older GHES versions must perform a manual upgrade to benefit from the improvements.

Because alert locations for Rust have shifted, CI pipelines that treat alert IDs as immutable may need to adjust their tracking logic. The expanded Go support eliminates the need for custom analysis scripts that previously excluded Go 1.27 code.

Related CloudNinjas coverage: security.

What This Means For Practitioners

Upgrade to CodeQL 2.26.4 as soon as possible to capture the refined GitHub Actions checks and the new language models. Review recent alerts for location changes, especially in Rust projects, and verify that any custom alert‑handling tooling accommodates the updated identifiers. For CI/CD owners, validate that workflow permissions and environment sanitizers still meet the stricter criteria introduced by the ControlCheck and actions/unpinned-tag queries. Finally, monitor the next GHES release notes to plan any required manual upgrades on self‑hosted instances.