Application security · Static analysis · Original analysis

CodeQL 2.27.4 reduces selected false positives and hardens pack publishing

GitHub.com receives the release automatically; GHES 3.24 will include it, while older server users can upgrade CodeQL separately.

By AI Speed Canada · Published · Sources listed below

GitHub wordmark above updated security query, pack-root validation and reviewed finding panels in an illustrative CodeQL workflow
GitHub wordmark with query-update, pack-root and reviewed-finding stages. Illustrative editorial layout; it is not a CodeQL alert or measured result. Credit: GitHub, Inc.; editorial layout by AI Speed Canada · Public-domain text logo; trademark rights retained. Wordmark placed in a distinct original 1280×720 editorial composition and converted to optimized WebP.

GitHub released CodeQL 2.27.4 on November 4, 2026 with query-accuracy updates across Java/Kotlin, Rust and C/C++, corrections to CWE metadata, and an added security check when bundling or publishing CodeQL packs. GitHub deploys new CodeQL versions automatically to code-scanning users on github.com. The changes will be included in GitHub Enterprise Server 3.24; older server deployments can upgrade CodeQL separately.

Several updates reduce known false-positive patterns

Java and Kotlin log-injection analysis recognizes more sanitizers and guards from major libraries, while path-injection queries understand additional substring and replacement patterns. Rust updates target uncontrolled-allocation, log-injection and cleartext-logging reports.

C and C++ queries stop treating intentional std::byte pointer arithmetic and maybe_unused variables as suspicious in specified cases. These changes can improve precision, but a suppressed result is not proof that the surrounding code is safe.

Related sources: GitHub: CodeQL 2.27.4 release ↗

CWE corrections change classification, not code behavior

The release removes CWE-730 from several regular-expression and loop-related queries across supported languages. Accurate metadata helps reporting and triage, but a tag correction does not fix a vulnerability or change exploitability.

Teams using dashboards, policies or exports keyed to CWE should check whether metrics move because classifications changed. Preserve raw query identifiers and version information for comparisons over time.

Related sources: GitHub: CodeQL 2.27.4 release ↗

Pack publishing now checks resolved symlink paths

The CLI verifies that files remain inside the pack root after symlinks are resolved. Files escaping the root are omitted and a warning is displayed. This reduces the risk of unintentionally packaging outside content.

Build logs must surface the warning; otherwise an omitted file may become a confusing downstream failure. Treat third-party packs as code dependencies, pin versions and review source and permissions.

Related sources: GitHub: CodeQL 2.27.4 release ↗

Canadian teams should compare results on a labelled repository set

Run the new version against repositories containing confirmed findings and known clean controls. Measure true positives, false positives, newly missing alerts and triage time before changing policy thresholds.

GitHub.com and GHES timelines differ. Record the CodeQL and query-pack version behind each result so regulated or audited teams can reproduce why an alert appeared or disappeared.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

  1. GitHub: CodeQL 2.27.4 release ↗ — Official November 4 changelog; query, metadata, CLI and deployment details.