GitHub CodeQL 2.26.2 adds Swift and Kotlin coverage while tightening security queries

GitHub has released CodeQL 2.26.2, a security-analysis update that broadens language coverage and changes several query assumptions that affect how code scanning flags risky patterns. The release adds support for analyzing Swift 6.3.3 applications and Kotlin versions up to 2.4.10, giving teams on newer mobile and backend stacks a path to keep GitHub code scanning aligned with their current toolchains.

The more consequential part of the update is in the query behavior. GitHub says CodeQL is changing how it treats several values that had previously been considered sanitizers in path injection, zip slip and URL redirection checks. In practice, that means some repositories may see new findings after the engine update, not because fresh bugs were introduced, but because CodeQL is taking a stricter view of inputs that can still carry unsafe path or request data.

Why it matters

Code scanning tools are only useful when their models keep pace with the languages, frameworks and exploit techniques developers actually use. Swift 6.3.3 support matters for teams shipping Apple-platform apps, while Kotlin 2.4.10 coverage is relevant to Android, JVM service and multiplatform projects. The query changes also point to a common secure-coding problem: helper functions that look like they normalize input may not remove every dangerous component.

Among the examples GitHub listed, Java and Kotlin analysis no longer treats java.io.File.getName() as a complete sanitizer for path-injection checks because a .. path component can remain significant. Go analysis also changes how path/filepath.Rel is handled for path-injection and zip-slip queries. For C# projects, System.Web.HttpRequest.RawUrl is no longer treated as a sanitizer for an unvalidated redirect query because it contains the unnormalized request line.

The release also updates GitHub Actions analysis so untrusted-checkout queries can surface more results, and it includes a breaking change for CodeQL query authors: alert messages no longer parse undocumented [[-style inline links. GitHub says every new CodeQL version is automatically deployed to users of code scanning on github.com, with the new functionality planned for a future GitHub Enterprise Server release. Older GHES users can manually upgrade their CodeQL version when they need the latest checks.

Sources

• github.blog

Cover photo by Daniil Komov on Pexels, used under the Pexels License.