For most teams using GitHub code scanning on github.com, GitHub deploys new CodeQL versions automatically. The release still deserves a review if you run Advanced Setup, publish custom query packs, parse CLI output, or operate CodeQL on GitHub Enterprise Server.
The biggest change is better signal
Java and Kotlin log-injection queries now recognize more sanitizers and sanitizer guards from common libraries and frameworks, including Spring and OWASP Java Encoder. Path-injection queries also understand more substring guards and string replacement or removal operations from Apache Commons Lang and Guava.
Rust analysis reduces false positives in uncontrolled allocation size, log injection, and cleartext logging queries. C and C++ analysis stops reporting intentional pointer arithmetic on std::byte* buffers and respects the C++17 [[maybe_unused]] attribute for unused-variable queries. JavaScript and TypeScript also receive a smaller fix for computed __proto__ properties in object literals.
Review changed metadata before changing policy
CodeQL no longer applies CWE-730 to a group of regular-expression and denial-of-service queries across C#, Java and Kotlin, JavaScript and TypeScript, Python, Ruby, and Swift. If your dashboards group findings by CWE, expect those labels to change even when the underlying query names remain familiar.
The current Default suite runs 498 security queries covering 169 CWE categories. The Extended suite adds 131 queries covering 32 additional CWE categories. Treat those figures as a release baseline, not as a promise that every repository will produce the same number of alerts.
A new C and C++ code-quality suite
The release adds a cpp-code-quality query suite for maintainability and reliability issues in C and C++ code. That is separate from security coverage, so decide deliberately whether your workflow should run it, report it, or keep it out of a security-gate status check.
Two CLI changes that can break scripts
The CLI now writes Java virtual machine warnings and initialization errors to standard error. This prevents warnings from corrupting JSON and other machine-readable output on standard output. If a wrapper reads stdout as JSON, this is the desired behavior, but it is worth testing any script that merged both streams.
When you bundle or publish a query pack, the CLI now resolves symbolic links and omits files that land outside the pack root, with a warning. This closes a path-boundary problem in pack assembly. Keep pack contents inside the repository or pack directory and make warnings visible in CI logs.
Check your CodeQL Action version
The CodeQL Action changelog records the default bundle update to 2.27.4 in CodeQL Action 4.39.2. If your workflow pins the action or supplies a custom tools input, inspect that configuration instead of assuming the default bundle is in use. Keep the action on a supported major version and test the next scan on a representative repository.
What GHES operators should know
GitHub says the new functionality will be included in GitHub Enterprise Server 3.24. Older GHES releases can use a manually upgraded CodeQL version, but verify compatibility with the installed CodeQL Action and your runner image before making that change.
A short upgrade checklist
First, run one scan and compare alert counts, query names, and CWE labels with the previous run. Next, validate any JSON parser against separated stdout and stderr. Then review custom pack workflows for symbolic links and make sure bundle warnings fail loudly enough for your team to notice. Finally, decide whether the new C and C++ quality suite belongs in your normal reporting path.
CodeQL 2.27.4 is mostly a quality and maintenance release, but those details matter in production security programs. Better sanitizer modeling can reduce review noise, corrected metadata can change dashboards, and safer pack handling protects CI supply chains. Make the release visible in your next scan review instead of treating a quiet automatic update as a no-op.