CodeQL 2.27.3 Adds Python 3.15 Support and AI Threat Model, Breaks Custom Actions Queries

Release timing: two dates, one version​

The GitHub Changelog announcement is dated November 3, 2026. The release itself is older. The CodeQL CLI changelog dates 2.27.3 to October 20, 2026. The CodeQL Action's bundle release for 2.27.3 was published on 20 October. That combined bundle covers Linux x64, Windows x64 and macOS, including Apple Silicon. Linux arm64 is available only as a per-platform bundle.

Package managers followed quickly. A community Chocolatey package moved from 2.27.2 to 2.27.3. Homebrew's CodeQL cask also lists 2.27.3 as current. Windows developers who install the CLI through a package manager can already be on this version, whatever the blog post date suggests.

JSON data extensions​

Data extensions are the way CodeQL users teach the engine about frameworks and libraries without rewriting queries. Until now they were written in YAML. In 2.27.3:

• Data extension files can use JSON syntax with the same structure as the existing YAML extensions.
• Java-style comments (// and /* ... */) are accepted in those JSON files.
• Files ending in .json are parsed as JSON. Everything else is still parsed as YAML.
• The test runner now also loads <test>.ext.json automatically when it runs a matching <test>.ql or <test>.qlref. It already did this for <test>.ext.yml.

Practical impact: Teams that generate extension files from build scripts, inventories or internal tooling can now emit JSON directly. Nothing forces a migration. Existing YAML files keep working. The one rule to remember is that the file extension decides the parser. A JSON payload in a file that doesn't end in .json will be read as YAML.

The opt-in ai threat model​

The release adds an opt-in ai threat model for LLM-generated data. It ships with no built-in source models. Turning it on doesn't make CodeQL recognize AI output on its own. You have to define your own sources through data extensions, such as the functions in your codebase that return model responses.

That fits a wider pattern. Model output is untrusted input, and it can reach an SQL query, a shell command or an HTML page as easily as user input can. Whether the empty default is a sensible start or an unfinished feature depends on your view. It avoids false confidence. It also means no coverage until you do the modeling work.

A related change affects Python. The py/xxe, py/xml-bomb and py/nosql-injection queries now respect the configured threat model when choosing untrusted sources. The default behavior is unchanged and still uses remote flow sources. The changelog says that, as a side effect, these queries now correctly include sources modeled with data extensions. Together, the two changes mean you can model an LLM source once and have it reach those Python queries.

Python 3.15 support​

The Python additions come in three groups.

Extractor (syntax):

• Unary plus in match literal patterns.
• Unicode 17 identifiers.

Builtins:

• Support for the frozendict and sentinel builtins, plus data-flow modeling for frozendict construction.

Library modeling:

• Taint flow for unicodedata.iter_graphemes.
• Data flow for threading.serialize_iterator and threading.concurrent_tee.
• The new Base32, Base85 and Ascii85 functions in binascii, including taint flow through custom alphabets.
• The extra_response_headers constructor argument and instance attribute on http.server.SimpleHTTPRequestHandler.
• re.prefixmatch and re.Pattern.prefixmatch, matching the existing support for their match counterparts.
• Taint flow through bytearray construction and bytearray.take_bytes.

These are improvements to the analyzer, not changes to Python. The practical result is that code using these 3.15 features should no longer be an analysis blind spot. Syntax the extractor can't parse can mean files that don't analyze properly. Library calls that aren't modeled can break the trail from a tainted source to a dangerous sink.

Other language changes​

The C# registry fix matters for corporate environments. Builds behind a proxy or using internal certificate authorities have often failed on package restore. In 2.27.3 CodeQL passes the required settings to the NuGet subprocess. The CLI changelog also notes that warnings are no longer logged when there are no explicit or inherited feeds to check.

Fewer false positives​

Several queries were tuned:

• cpp/resource-not-released-in-destructor now recognizes resources released through local aliases.
• cs/simplifiable-boolean-expression produces fewer false positives when type information is incomplete.
• java/ssrf and java/unvalidated-url-redirection now recognize case-insensitive comparisons of URI.getHost() against fixed allowlist entries. They also recognize equality and case-insensitive comparisons when the host is stored in a local variable.

Hostnames are case-insensitive, so code that lowercases or compares ignoring case before checking an allowlist is doing the right thing. Flagging it was noise. Expect a few alerts to disappear, which is the intended effect.

The breaking change: GitHub Actions CFG​

This is the item that can break existing work. The CLI changelog is clear about the scope. The GitHub Actions control flow graph now uses the shared CFG library. It includes explicit before and after nodes and uses the shared entry and exit node representations. Existing code that depends on specific nodes, edges, textual representations or basic-block boundaries may need updating.

The legacy Completion, NormalCompletion, SimpleCompletion, BooleanCompletion and ReturnCompletion classes are removed. Completions are no longer part of the Actions CFG API.

What to do if you maintain custom Actions queries:

1. Search your query packs for any use of the removed Completion classes.
2. Replace those checks with CFG edge labels such as DirectSuccessor, BooleanSuccessor and ReturnSuccessor.
3. Review any logic that relies on node text, edge shape or basic-block boundaries.
4. Run your query tests against 2.27.3 before the update lands in your pipelines.

Anyone using only GitHub's standard query suites shouldn't need to act. The 2.27.2 release made a similar CFG move for Go, so this is a recurring migration pattern. If you maintain custom queries for several languages, expect more of it.

macOS 27 and Xcode 27​

The CLI changelog also lists a breaking platform limitation. Apple stopped shipping multi-architecture x86-64/arm64 binaries with macOS 27 and Xcode 27, and CodeQL needs those binaries for traced analysis. As a result, autobuild and manual build modes are unsupported for compiled languages on macOS 27 with any Xcode version, and on macOS 26 when Xcode 27 is selected.

This limit applies only to those build modes, operating system versions and Xcode versions. It isn't a general CodeQL limitation on macOS. The 2.27.2 announcement told users of these modes to stay on macOS 26 with Xcode 26 at most. It also said GitHub is working on better support for build mode none on macOS.

Other details​

• The release fixes a bug that caused database downgrades to fail for GitHub Actions databases.
• The generic codeql.zip for all x86-64 platforms is deprecated and will be removed in a future release. Download the platform-specific codeql-PLATFORM.zip instead. Update any scripts that fetch the generic archive.
• The Rust extractor now uses rust-analyzer 0.0.357. The Rust libraries' AST therefore includes the new CfgPredExpr and CfgPredPat classes.
• The Default suite runs 498 security queries covering 170 CWEs. The Extended suite adds 131 queries covering 32 more CWEs. These are suite totals, not new queries added in this release.

Availability​

GitHub says every new CodeQL version is deployed automatically to code scanning users on github.com. Its announcement says the 2.27.3 functionality will also be in GitHub Enterprise Server 3.24. Users of older GHES versions can upgrade the CodeQL version manually.

Bottom line​

Most users will see nothing beyond a quieter alert list and better coverage of Python 3.15 code. A few groups have real work to do:

• Custom Actions query authors: migrate away from Completion classes.
• macOS compiled-language users: check your OS and Xcode combination.
• Teams adopting the ai threat model: budget time to write your own source models.
• Script maintainers: stop fetching the generic CodeQL zip.

None of these is dramatic, but all of them are easier to deal with before a pipeline fails than after.