CodeQL 2.27.4 Reduces False Positives, Removes CWE-730 Tags and Tightens Pack Security

Release timing and what's in the box​

The CodeQL CLI binaries release for v2.27.4 was published on 2 November, according to its release page. GitHub's own CodeQL changelog also dates the version to 2026-11-02. GitHub's changelog post announcing it appeared on 4 November. If you see two dates floating around, that's why.

GitHub describes CodeQL as the static analysis engine behind code scanning. Per the version changelog, 2.27.4 ships with the Default suite running 498 security queries covering 169 CWEs. The Extended suite adds another 131 queries covering 32 more CWEs. Those are suite-level figures. They don't mean every installation runs the Extended suite.

Query accuracy changes​

The headline promises "improved accuracy". The changelog backs that with specific cases, not an aggregate accuracy figure. GitHub publishes no measured false-positive or false-negative rates, so treat this as targeted cleanup.

Java and Kotlin​

• java/log-injection now recognizes more sanitizers and sanitizer guards. They come from the JDK, Apache Commons Lang and Text, Guava, OWASP Java Encoder, and Spring Framework.
• Queries that use path-injection sanitizers now recognize extra substring guards. They also recognize string replacement and removal operations from Apache Commons Lang and Guava.

In practice, if your code already cleans log input or file paths with these libraries, CodeQL is more likely to see the protection and stay quiet. The changelog doesn't list individual methods. Don't assume a particular drop in findings for your repository. Compare your alert counts before and after the update.

Rust​

GitHub reports fewer false positives in rust/uncontrolled-allocation-size, rust/log-injection, and rust/cleartext-logging. The language-library notes explain the mechanics:

• The early return taken by the ? operator no longer makes the unwrapped value of x? flow out of the enclosing function. This had caused false positives such as in rust/cleartext-logging. A sensitive value read with ? was being reported as part of an unrelated return value.
• Neutral models now suppress spurious generated sink models for actix_web::HttpRequest::connection_info and methods built on it, such as full_url and url_for.
• Similar neutral models cover Vec and VecDeque methods such as insert, remove and push_back.

C and C++​

• cpp/suspicious-pointer-scaling no longer flags intentional pointer arithmetic on std::byte* buffers.
• cpp/unused-local-variable and cpp/unused-static-variable now skip variables marked with the C++17 [[maybe_unused]] attribute.

These are narrow exclusions for code that is already explicit about its intent. Other pointer-arithmetic and unused-variable findings still apply.

JavaScript and TypeScript​

The version changelog lists more than the blog post does:

• js/invalid-prototype-value no longer reports computed __proto__ properties in object literals.
• New taint steps cover String.prototype.trimStart, trimEnd and normalize.
• The flow summary for Array.prototype.flatMap is fixed, so thisArg now flows to the callback's this instead of its index parameter.

The CWE-730 tag removal​

CodeQL no longer applies the CWE-730 tag (external/cwe/cwe-730) to a group of regex and denial-of-service-style queries. The changelog's reason is that MITRE has marked CWE-730 as prohibited for vulnerability mapping. The queries keep their other CWE tags.

Affected queries by language:

GitHub credits CodeQL issue #22318 and the user @wiggin15 for the original report.

This is metadata only. The queries still run and still find what they found before. The practical impact is for anyone who filters, reports, or builds compliance dashboards on CWE tags. If a SARIF consumer, query filter, or internal report keys off CWE-730 for these rules, that mapping will quietly stop matching. Check those pipelines.

CLI changes that matter to automation​

JVM messages go to stderr​

The CLI now writes Java virtual machine messages, such as warnings and initialization errors, to standard error instead of standard output. Previously, per the changelog, they could corrupt the output of commands that print JSON or other machine-readable formats. If your scripts parse CLI output with jq or similar, this should remove a class of intermittent parse failures. One side effect: if you captured stderr and stdout together, JVM messages will still show up in the combined stream.

Symlink checks when bundling or publishing packs​

codeql pack bundle and codeql pack publish now check that each file added to the archive is still inside the pack root after symbolic links are resolved. Files that resolve outside the root are omitted, and the CLI prints a warning.

GitHub's documentation says a CodeQL pack must have a qlpack.yml file in its root directory. That root is the boundary being enforced. Here is why this matters:

• A symlink inside a pack that points elsewhere on the build machine could previously pull outside content into an archive. This is general security reasoning, not something the changelog spells out.
• If a pack legitimately depended on a symlink to a file outside the root, expect it to be missing from the archive. Watch for the new warning in publish logs.
• The changelog doesn't claim this blocks every possible publication problem. It also doesn't say it touches the external target.

Other changes in the version changelog​

• Go: The extractor no longer modifies global Git configuration when private git_source registries are configured. It passes the registry proxy certificate to Git via GIT_SSL_CAINFO. That only affects Git processes spawned by go.
• JavaScript/TypeScript, breaking change: SEMMLE_TYPESCRIPT_HOME is no longer supported. The extractor ignores it and always uses its bundled TypeScript compiler. If any workflow sets this variable, it will no longer have an effect.
• C#: A change that set proxy and certificate environment variables for the NuGet CLI subprocess was rolled back. The target process only partially respected them in some cases.
• C/C++: A new cpp-code-quality query suite targets maintainability and reliability issues. There is also support for several new builtin operations.
• Go, deprecation: ControlFlow::ConditionGuardNode is deprecated in favor of the API from semmle.go.controlflow.Guards.

Also worth a note from the CLI binaries release page: the generic codeql.zip is deprecated. It will be removed in a future release, so download the per-platform zip instead. The arm64 binaries are only available as codeql-linux-arm64.zip.

Rollout: who gets it, and when​

GitHub says it automatically deploys each new CodeQL version to code scanning users on github.com. The same functionality will be included in GitHub Enterprise Server 3.24. On older GHES versions, you can manually upgrade your CodeQL version.

The CodeQL Action changelog adds some context on how versions reach workflows. The Action's default bundle moves with its own releases, and the changelog warns that CodeQL 2.22.3 and earlier were discontinued on 16 October 2026 alongside GHES 3.18. Self-managed CLI installs, such as the Chocolatey package that updated from 2.27.3 to 2.27.4, only change when you update them.

What to do now​

1. Check your pinning. Self-managed CLI or pinned bundles won't move on their own. Confirm which version your pipelines run.
2. Watch alert deltas. After the update, expect fewer Java log-injection and path-injection alerts where the listed libraries are used. The same applies to the Rust queries and the C++ cases above. Closed alerts here are likely stale false positives, but verify a sample.
3. Audit CWE-730 filters. Update any dashboards, policies, or SARIF post-processing that depend on that tag for the affected queries.
4. Re-test JSON parsing. Confirm scripts that consume CLI output behave correctly now that JVM messages go to stderr.
5. Review pack publishing. If you maintain custom packs, rerun the bundle and look for omitted-file warnings from the symlink check.
6. Search for SEMMLE_TYPESCRIPT_HOME. Remove it from workflows. It's now ignored.

Bottom line​

Nothing here is dramatic, and GitHub quantifies none of the accuracy gains. But for anyone who triages code scanning alerts or scripts CodeQL in CI, it's a useful release. The false-positive reductions are specific, the CWE tag change is a quiet compatibility trap for reporting, and the stdout/stderr and symlink fixes make the CLI more predictable.