GitHub ships CodeQL 2.26.1 with broader framework coverage and fewer Rust false positives

GitHub has released CodeQL 2.26.1, a static analysis update aimed less at headline-grabbing new features and more at a practical problem for security teams: getting useful alerts from the frameworks developers actually use. The July 29 changelog says the release expands analysis coverage for Go, Java/Kotlin, and JavaScript/TypeScript, while refining a Rust query to reduce noisy findings.

CodeQL powers GitHub code scanning, so the update matters beyond users who run the standalone CLI. GitHub says every new CodeQL version is automatically deployed to code scanning users on github.com, with the same functionality planned for a future GitHub Enterprise Server release. Organizations on older GHES installations can still manually upgrade CodeQL if they need the changes sooner.

What Changed

For Go projects, GitHub improved modeling for the standard library's structured logging package, log/slog. That includes methods and helpers such as slog.Logger, With, WithGroup, Attr, and Value. The immediate security impact is broader coverage for the go/log-injection and go/clear-text-logging queries, two checks that can help teams catch unsafe logging patterns before they reach production.

Java and Kotlin analysis also gets new source, sink, and flow summary models for org.apache.poi, the widely used library for Microsoft Office file formats. GitHub also changed its path injection query so values validated with @javax.validation.constraints.Pattern can be treated as sanitized, reducing false positives when code already applies regular-expression validation. At the same time, the java/ssrf query now treats the first argument of Spring WebFlux's WebClient.UriSpec.uri method as a server-side request forgery sink, which may surface additional legitimate alerts.

• JavaScript and TypeScript scanning now recognizes Angular @HostListener message handlers as client-side remote flow sources.
• The js/missing-origin-check query can analyze those Angular message event handlers.
• Rust analysis now treats arithmetic, bitwise, and string append operations as barriers in the hard-coded cryptographic value query.

The Rust change is a reminder that static analysis tools are only useful when developers trust the signal. GitHub says the adjustment reduces false positives in cases where constant values are combined with nonconstant data, such as incrementing a nonce or appending variable data to a constant prefix. For teams that keep CodeQL findings in pull requests, that kind of tuning can be as important as adding new detections, because it lowers the chance that valid warnings are ignored in a flood of marginal ones.

Sources

• github.blog

Cover photo by Саша Алалыкин on Pexels, used under the Pexels License.