CodeQL 2.27.0 introduces a native Linux ARM64 binary, adds a Rust command‑line‑injection query, and expands framework modeling for C#, Java/Kotlin, and C/C++. These changes let teams run static analysis on ARM‑based runners, detect more framework‑specific issues, and tighten CI/CD security checks.
Native Linux ARM64 Support
The release ships a per‑platform linux‑arm64 CLI bundle that can be downloaded directly from the release assets. Practitioners using self‑hosted ARM64 runners, cloud instances such as AWS Graviton or Azure Arm64 VMs, or edge devices can now execute CodeQL without emulation layers. The operational impact is limited to updating the CI step that installs CodeQL to point at the new binary; no configuration flags change otherwise. Performance may improve because the analysis runs on the native instruction set, and the binary size matches the platform, reducing download time.
Framework and Language Enhancements
C#: The MVC controller and action discovery logic now mirrors runtime behavior more closely, covering inherited actions, endpoint mappings, and exclusion rules. Taint tracking for OData action parameters adds detection for values flowing through ODataActionParameters and Delta entities. In build‑mode none, CodeQL always attempts NuGet feed restoration and flags unreachable feeds, helping teams spot missing dependencies early.
Java/Kotlin: Micronaut framework components—HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks—are now modeled. This widens the surface area for static checks in microservice stacks that rely on Micronaut.
C/C++: PostgreSQL libpq functions such as PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare are marked as SQL‑injection sinks. Existing cpp/sql-injection queries can now flag vulnerabilities that pass through these APIs.
Rust: A new rust/command-line-injection query detects uncontrolled command‑line construction. The rust/hard-coded-cryptographic-value query is refined to reduce duplicate findings, and the rust/unused-variable query now ignores variables inside functions that contain the standard todo!() or unimplemented!() macros.
CI/CD and GitHub Actions Adjustments
GitHub code scanning can now use an organization’s private registry configuration to authenticate when pulling custom queries or packs from container registries or the GitHub API. This enables secure consumption of proprietary query sets without exposing credentials publicly. Additionally, the evaluation of author‑association fields in workflow event payloads has been tightened: checks are considered protective only when the payload actually includes the field. Teams relying on weak author‑association checks may see new alerts, prompting a review of workflow security logic.
Deprecations and Distribution Changes
Support for Java 9 and 10 is slated for removal in January 2027; Java 7 and 8 remain supported. The generic multi‑platform codeql.zip distribution will be retired, requiring users to download the per‑platform zip for their environment. Running the CLI from an all‑platforms bundle now emits a warning, which can be suppressed with the environment variable CODEQL_ALLOW_ALL_PLATFORMS_DIST=true. Automation scripts that previously fetched the generic zip must be updated to target the platform‑specific asset.
Related CloudNinjas coverage: security.
What This Means For Practitioners
- Update CI pipelines to install the
linux‑arm64CLI when targeting ARM runners. - Review private registry credentials and ensure they are available to the code‑scanning step for custom query retrieval.
- Validate that new C# MVC and OData taint tracking rules align with your application’s routing patterns.
- Confirm Micronaut services are covered by the new Java/Kotlin models; add custom queries if needed.
- Check for new SQL‑injection alerts from libpq usage in C/C++ codebases.
- Audit GitHub Actions workflows for reliance on author‑association checks and adjust logic to avoid false‑positive alerts.
- Replace any use of the generic
codeql.zipwith the per‑platform download and plan for Java 9/10 deprecation in upcoming releases.
