CodeQL 2.27.4 (2026-11-02)¶

The cpp/suspicious-pointer-scaling query no longer reports false positives for intentional pointer arithmetic from std::byte* buffers.

The cpp/unused-local-variable and cpp/unused-static-variable queries no longer report variables marked with the C++17 [[maybe_unused]] attribute.

The js/invalid-prototype-value query no longer reports computed __proto__ properties in object literals.

Added a new cpp-code-quality query suite containing queries that identify maintainability and reliability issues in C and C++ code.

The external/cwe/cwe-730 tag has been removed from cs/redos and cs/regex-injection, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.

The external/cwe/cwe-730 tag has been removed from java/redos, java/polynomial-redos and java/regex-injection, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.

The external/cwe/cwe-730 tag has been removed from js/redos, js/polynomial-redos, js/regex-injection, js/regex-injection-more-sources, js/server-crash and js/loop-bound-injection, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.

The external/cwe/cwe-730 tag has been removed from py/redos, py/polynomial-redos and py/regex-injection, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.

The external/cwe/cwe-730 tag has been removed from rb/redos, rb/polynomial-redos and rb/regexp-injection, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.

The external/cwe/cwe-730 tag has been removed from swift/redos and swift/regex-injection, because MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries retain their other CWE tags.

The Go extractor no longer modifies the global Git configuration when private git_source registries are configured. The registry proxy certificate is now passed to Git through the GIT_SSL_CAINFO environment variable instead, which only affects the Git processes spawned by go.

The SEMMLE_TYPESCRIPT_HOME environment variable is no longer supported. The JavaScript/TypeScript extractor now ignores the environment variable and always uses its bundled TypeScript compiler.

Rolled back the change that set proxy and certificate environment variables for the subprocess that invokes the NuGet CLI because the environment variables were only partially respected by the target process in some cases.

The java/log-injection query now recognizes additional sanitizers and sanitizer guards from the JDK, Apache Commons Lang and Text, Guava, OWASP Java Encoder, and Spring Framework.

Queries that use path-injection sanitizers now recognize additional substring guards and string replacement and removal operations from Apache Commons Lang and Guava.

Added taint steps for String.prototype.trimStart, trimEnd, and normalize.

Fixed the flow summary for Array.prototype.flatMap. The thisArg argument now flows to the callback’s this instead of its index parameter.

The early return taken by the ? operator no longer makes the unwrapped value of x? flow out of the enclosing function. This fixes false positive results from queries such as rust/cleartext-logging, where a sensitive value read with ? was reported as part of an unrelated return value.

Added neutral models to inhibit spurious generated sink models for actix_web::HttpRequest::connection_info and the methods built on it, such as full_url and url_for. This fixes some false positive results from queries such as rust/uncontrolled-allocation-size and rust/log-injection.

Added neutral models to inhibit spurious generated sink models for Vec and VecDeque methods such as insert, remove and push_back. This fixes some false positive results from queries such as rust/cleartext-logging.

ControlFlow::ConditionGuardNode is now deprecated. Use the API from semmle.go.controlflow.Guards instead.

Added support for the __builtin_lt_synthesizes_from_spaceship, __builtin_gt_synthesizes_from_spaceship, __builtin_le_synthesizes_from_spaceship, __builtin_ge_synthesizes_from_spaceship, __builtin_is_implicit_lifetime, __builtin_is_structural, and __builtin_is_virtual_base_of builtin operations.

Added a new predicate getBitWidth to the Type class, which yields the bit-width of the type.

The Go language library now instantiates the shared library semmle.go.controlflow.Guards, including the Guard and GuardValue classes and the guardEnsures, guardEnsuresEq, guardEnsuresNeq, and guardEnsuresLeq predicates.