Live
Long‑Context Coding Agents: Grok 4.7 Gains Self‑Verification via Extended RL TrainingSystem One decision model Jev reshapes AI integration for production codeCodeQL CLI 2.27.0 deprecates the universal bundle – switch to platform‑specific downloadsGranular Worker Access Control via Dashboard InvitationDecision‑only models like Kev cut token waste in AI agent pipelinesGitLab API Rate Limits Tighten for AI‑Driven AutomationOn‑prem AI factories reshape deployment pipelines for engineers in Egypt and AfricaRunning Positron on SageMaker Studio: Architecture, Ops, and Security ImplicationsLong‑Context Coding Agents: Grok 4.7 Gains Self‑Verification via Extended RL TrainingSystem One decision model Jev reshapes AI integration for production codeCodeQL CLI 2.27.0 deprecates the universal bundle – switch to platform‑specific downloadsGranular Worker Access Control via Dashboard InvitationDecision‑only models like Kev cut token waste in AI agent pipelinesGitLab API Rate Limits Tighten for AI‑Driven AutomationOn‑prem AI factories reshape deployment pipelines for engineers in Egypt and AfricaRunning Positron on SageMaker Studio: Architecture, Ops, and Security Implications
GitHub

CodeQL CLI 2.27.0 deprecates the universal bundle – switch to platform‑specific downloads

Ninja·September 22, 2026·2 min read·via GitHub Changelog
AI SummaryPowered by AI

The all‑platform CodeQL bundle is deprecated as of CodeQL CLI 2.27.0 and will be removed in mid‑March 2027. Engineers must switch to platform‑specific bundles to stay current and avoid missing ARM64 binaries.

The release of CodeQL CLI 2.27.0 marks the deprecation of the universal codeql-bundle.tar.gz and codeql-bundle.tar.zst packages that previously contained binaries for every supported OS and architecture. The bundle will be removed in mid‑March 2027, and users are instructed to download the platform‑specific bundle that matches their operating system and CPU architecture. This shift matters because the all‑platform bundle will no longer receive updates, and ARM64 Linux binaries are already excluded from it.

What changed in the CodeQL bundle

Starting with the 2.27.0 CLI, GitHub labels the combined bundle as deprecated and announces a hard removal date. The only supported distribution method moving forward is the per‑platform archive, which is the same format but limited to a single OS/arch pair. Documentation now points to a list of supported platforms for each download.

Impact on architecture and operations

Teams that scripted the download of the all‑platform bundle for CI pipelines will need to adjust their automation to select the correct platform archive. This may require adding logic to detect the runner’s OS and architecture, then fetching the matching codeql-bundle file. For environments that run on Linux ARM64, the change is immediate: the binaries are only available via the platform‑specific channel, so any existing reliance on the universal bundle will break once the deprecation takes effect.

Security and compliance considerations

Using a supported, platform‑specific bundle ensures that you receive the latest security patches and analysis rules released with each CLI version. Continuing to use an outdated universal bundle after its removal could leave analysis tools out of sync with the latest vulnerability definitions, which may affect compliance reporting that depends on CodeQL findings.

Related CloudNinjas coverage: security.

What This Means For Practitioners

  • Audit your build and analysis scripts for references to codeql-bundle.tar.gz or .tar.zst and replace them with the appropriate platform‑specific URL.
  • Validate that your CI runners correctly report their OS and architecture before downloading the bundle.
  • For Linux ARM64 workloads, verify that the new download path provides the required binaries now, rather than waiting for the universal bundle’s removal.
  • Monitor GitHub’s supported‑platform documentation for any future additions or removals that could affect your environment.
Tags: #codeql#cli#deprecation#platform#security
Originally published atGitHub Changelog
Related Articles
GitHub

GitHub Enterprise introduces credential inventory export for enterprise-wide token visibility

3 min read

Beyond Tokens: Applying the DPACT Model to AI Agent Authorization

2 min read

Supply‑Chain Threat Intel Gains Inside Access to TeamPCP, What Engineers Must Do

3 min read