Version 2.27.3 of CodeQL introduces a suite of language extensions and query tweaks that directly affect how security scanning fits into modern development workflows. The release adds full Python 3.15 syntax support, enables JSON‑formatted data extension files, brings C23 bit‑precise integer handling, and refines several built‑in queries to reduce noise. For AI engineers, cloud/platform teams, DevOps/SREs, and security practitioners, the changes translate into more accurate static analysis of contemporary codebases and smoother automation in CI pipelines.
CodeQL language extensions
The Python extractor now recognises the latest language features introduced in Python 3.15, such as unary plus in match literal patterns, Unicode 17 identifiers, and the new frozendict and sentinel built‑ins. Data‑flow modeling for frozendict construction is also included, allowing the engine to track immutable mappings through the code.
Data extension files can now be written in JSON, using the same structural conventions as the existing YAML format. Files ending in .json are parsed as JSON, while all other extensions continue to be treated as YAML. Java‑style comments (// … and /* … */) are accepted inside these JSON files, simplifying reuse of existing comment styles.
C/C++ analysis now understands the C23 _BitInt(N) type, providing bit‑precise integer modeling for code that targets the newest C standard. The C# extractor adds flow tracking through positional patterns in is expressions and switch cases, and the Ruby extractor treats several Grape::API request sub‑accessors as remote flow sources.
Query accuracy improvements
Several built‑in queries have been tuned to lower false‑positive rates. The C++ cpp/resource-not-released-in-destructor query now recognises resources released via local aliases. The C# cs/simplifiable-boolean-expression query produces fewer warnings when type information is incomplete. Java/Kotlin SSRF and URL‑redirection queries now handle case‑insensitive host comparisons and variable‑stored hosts, reducing spurious alerts.
Python security queries (py/xxe, py/xml-bomb, py/nosql-injection) now respect a configurable threat model for untrusted data sources. By default they continue to use remote flow sources, but they also incorporate any custom sources defined via data extensions.
Operational considerations
CI/CD pipelines that invoke the CodeQL CLI must be aware of the new JSON data‑extension handling and the updated proxy/certificate propagation for private NuGet registries. The GitHub Actions control‑flow graph now relies on a shared CFG library; custom queries that depend on legacy CFG node types may need adjustments to use the new edge labels (DirectSuccessor, BooleanSuccessor, ReturnSuccessor).
All CodeQL versions are automatically rolled out to GitHub code scanning users, and the same binaries are bundled with GitHub Enterprise Server 3.24. Teams on older GHES releases can manually upgrade the CodeQL version if they need the new capabilities.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Evaluate your code‑scanning configuration to ensure that any custom queries are compatible with the shared CFG library and the new edge labels. If you rely on data extensions, consider migrating existing YAML files to JSON where it simplifies tooling or aligns with project standards. Update your threat‑model definitions to take advantage of the opt‑in LLM‑generated data model, especially for Python projects that use the newly supported frozendict or sentinel built‑ins. Finally, verify that your CI pipelines pass the required proxy and certificate environment variables when accessing private NuGet feeds, to avoid unexpected authentication failures.
