GitHub announced CodeQL 2.27.3 on November 3, 2026. The new version of the engine behind GitHub code scanning understands the latest Python 3.15 syntax and builtins, lets teams write data extension files in JSON, and brings C23 bit-precise integers to its C and C++ analysis.
The update matters because CodeQL is rolled out automatically to every repository that uses code scanning on github.com. Most teams will get the new checks without doing anything, but people who maintain custom queries for GitHub Actions workflows, or who build compiled code on new Apple tooling, have breaking changes to review.
What Is New in CodeQL 2.27.3
The headline items in this release cover the CLI, several language extractors and the shared threat model library:
- Data extension files can now be written in JSON as well as YAML, using the same structure, with support for // and /* */ style comments.
- Python code written for version 3.15 now parses cleanly, covering Unicode 17 names and a leading plus sign inside match case literals.
- C and C++ analysis supports the _BitInt(N) bit-precise integer types from the C23 standard.
- An optional threat model named ai lets you treat data produced by large language models as untrusted input.
- Accuracy work trims false positives in queries for C/C++, C# and Java/Kotlin.
According to the release notes, the Default suite now runs 498 security queries that map to 170 CWE entries. Switching to the Extended suite adds 131 more queries and 32 further CWE categories.
Python 3.15 Coverage in Detail
Python gets the largest share of new modeling. CodeQL now recognizes the frozendict and sentinel builtins that arrive in Python 3.15, and it tracks data as it flows into a newly built frozendict. That means taint analysis keeps working when code adopts these new types.
The engine also models several other additions to the standard library in the new Python version:
- unicodedata.iter_graphemes, plus threading.serialize_iterator and threading.concurrent_tee.
- Base32, Base85 and Ascii85 helpers in the binascii module, including custom alphabets.
- re.prefixmatch and its pattern method, handled like the existing match calls.
- The extra_response_headers option on http.server.SimpleHTTPRequestHandler and the bytearray.take_bytes method.
Separately, three Python security checks (py/xxe, py/xml-bomb and py/nosql-injection) now honor whichever threat model you set when deciding what counts as untrusted. The default still uses remote flow sources, but sources you add through data extensions are now included.
Other Language Changes
In C#, data flow is now tracked through positional patterns, whether they appear in a switch case or an is check. When private package registries are set up, CodeQL hands the needed proxy and certificate variables to the NuGet CLI, which should help builds behind corporate proxies.
Ruby projects built on the Grape framework benefit from new modeling of request accessors such as params, cookies, body and query_string as remote sources. Java and Kotlin users should see fewer false alarms from the SSRF and open redirect queries when code compares a host name against a fixed allowlist, even without regard to case.
For Rust, the extractor moves to a newer rust-analyzer release, which exposes two new AST classes for cfg predicates. C/C++ users also get flow summaries for message classes from the BlazingMQ library.
Breaking Changes to Review
Two changes could affect existing setups. First, the control flow graph used for GitHub Actions workflow analysis now sits on the shared CFG library. Older completion classes are gone, so custom queries that read them should move to the DirectSuccessor, BooleanSuccessor and ReturnSuccessor edge labels.
Second, the full changelog notes that Apple no longer ships the multi-architecture binaries CodeQL needs for traced builds. As a result, autobuild and manual build modes for compiled languages are not supported on macOS 27 at all, nor on macOS 26 if a team picks Xcode 27.
What It Means for Developers
If your team is already testing Python 3.15, this release closes a gap where newer syntax could cause parse problems or missed findings. It is a good moment to let code scanning run on branches that try out the new builtins.
JSON data extensions are a practical win for teams that generate models from scripts. Most tools can write JSON without extra libraries, and comments make the files easier to review. The ai threat model is worth a look if your service passes LLM output into SQL queries, shell commands or templates, though you must define the sources yourself.
Teams that run macOS build agents for Swift, Objective-C or C++ should check their Xcode version before upgrading runners. Keeping traced builds on a supported toolchain avoids surprise failures in security workflows. Readers following GitHub supply chain changes may also want our coverage of workflow lockfiles reaching general availability and reachability analysis for Dependabot alerts.
How to Upgrade
On github.com, code scanning picks up each new CodeQL release automatically, so no action is needed there. GitHub says the same features will ship with GitHub Enterprise Server 3.24.
Administrators on older Enterprise Server versions can upgrade the CodeQL bundle by hand, following the GitHub documentation for servers without internet access. Local CLI users can download the 2.27.3 bundle from the CodeQL releases and re-run their test suites, especially any custom Actions queries.
Conclusion
CodeQL 2.27.3 keeps GitHub's static analysis in step with Python 3.15 and C23 while making data extensions easier to author. The release is automatic for most users, but anyone with custom Actions queries or macOS traced builds should check the breaking changes before relying on the results.
Sources
- GitHub Changelog: CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions
- CodeQL Docs: CodeQL 2.27.3 changelog
See my articles more often when you search Google.
