Apple’s shift in macOS 27 and Xcode 27 to ship system binaries without Intel (x86_64) code means CodeQL cannot trace builds on these versions, and it also lacks support for Swift 6.4 on any platform. Practitioners who rely on traced scans for security analysis need to adjust their pipelines now.
What changed in the Apple toolchain
Starting with macOS 27 and Xcode 27, the operating system and IDE no longer include the Intel‑only components that CodeQL uses to instrument compilation. The removal applies to the languages that CodeQL normally traces: C/C++, C#, Go, Java, Kotlin, and Swift. Swift 6.4 is explicitly unsupported for tracing on all platforms.
Immediate impact on CodeQL workflows
When Xcode 27 is present, traced extraction is unavailable for the listed languages. On macOS 27 the same limitation applies. For Swift projects, the lack of support is absolute. For other languages, users can either:
- Pin the CI environment to macOS 26 or earlier and Xcode 26 or earlier.
- In GitHub Actions, fix the runner image and toolchain versions rather than using the latest defaults.
- Switch to
build mode nonefor C/C++, C#, and Java, which bypasses the need for tracing.
Operational considerations
Intel‑based Macs will lose official CodeQL support in mid‑December 2026, so teams should anticipate a broader migration away from those machines. CI configurations that automatically pull the newest macOS or Xcode images must be updated to reference specific versions. Failure to do so will result in missing trace data and potentially incomplete security findings.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Review all pipelines that invoke CodeQL with traced extraction. Add explicit version constraints for macOS and Xcode, or enable build mode none where appropriate. Track the deprecation timeline for Intel‑based Macs and plan migration to Apple‑silicon or alternative analysis approaches before the December 2026 cutoff.