CodeQL on macOS 27 and Xcode 27: Swift 6.4 Limits

GitHub issued an October 19, 2026 compatibility notice for CodeQL on macOS 27, Xcode 27 and Swift 6.4. It says changes to Intel code included in Apple system components prevent supported traced scans in these environments. This is a scanner-compatibility warning, not evidence that a successful Apple application build still received the same security analysis as before.

Installed Xcode matters as well as the operating system

The notice says installing Xcode 27 removes traced extraction for C/C++, C#, Go, Java, Kotlin and Swift. It says macOS 27 may also prevent traced extraction and that Swift 6.4 is unsupported on every platform. Intel-Mac support is separately scheduled for deprecation in mid-December 2026.

GitHub advises affected traced-build and Swift users to pin macOS 26 or earlier and Xcode 26 or earlier, including explicit runner-image and toolchain selection in Actions. Those are compatibility instructions at this announcement date, not a recommendation to freeze a machine indefinitely or ignore security updates.

A buildless scan is not an identical substitute

GitHub identifies build mode none as an alternative for C/C++, C# and Java. Its compiled-language documentation adds an important Java/Kotlin boundary: Kotlin requires a build, and Kotlin files are not analyzed in Java’s none mode. Buildless extraction can also be less accurate when generated code or dependency information depends on the normal build.

AI Speed’s assessment is to compare the code that was actually extracted, not merely whether the workflow turned green. A team changing modes should keep a list of intended languages and generated sources, then inspect warnings and resulting analysis coverage. Do not label a mixed Java/Kotlin repository fully scanned just because the Java portion completed.

Review the application build and security job independently

Canadian teams shipping Apple software can inventory runner labels, installed Xcode versions, Swift versions and CodeQL build modes as separate fields. A floating latest label can conceal more than one change. Record the last working configuration and decide who owns the compatibility exception and its review date.

Keep application testing distinct from scanner validation: passing unit tests does not repair missing extraction, while a supported scan does not establish application correctness. Watch the official support documentation for a supported upgrade path. This article covers the new Apple-toolchain limitation, not a republication of the earlier CodeQL 2.27.2 release or a claim that AI Speed reproduced every affected compiler combination.

Sources and editorial method

We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.

GitHub: CodeQL Apple-toolchain compatibility notice ↗ — October 19, 2026 notice; current extraction limits and separate future Intel-Mac deprecation.
GitHub Docs: CodeQL for compiled languages ↗ — Build modes, generated-code limitations and Java/Kotlin boundary; checked October 20.