CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.27.3. It supports new Python 3.15 language features, adds JSON syntax for data extensions, adds C23 bit-precise integers, and includes accuracy improvements across languages.

Language and framework support #

CodeQL CLI

• Data extension files now support JSON syntax, using the same structure as YAML data extensions. Java-style comments (// ... and/* ... */ ) also work. CodeQL parses files with the.json extension as JSON and continues to parse all other files as YAML.
• We’ve added an opt-in ai threat model for LLM-generated data. It doesn’t include any built-in source models, so you can define your own sources with data extensions.

Python

• The Python extractor now supports Python 3.15 syntax, including unary plus in match literal patterns and Unicode 17 identifiers.
• We’ve added support for the new frozendict andsentinel builtins introduced in Python 3.15, including data flow modeling forfrozendict construction.

C/C++

• We’ve added support for C23 bit-precise integers (_BitInt(N) ).
• We’ve added flow summaries for the BlazingMQ BloombergLP::bmqa::Message andMessageProperties classes and their iterators.

C#

• We’ve added support for data flow through positional patterns in is expressions andswitch cases.
• When you configure private registries, CodeQL now passes the required proxy and certificate environment variables to the NuGet CLI.

Ruby

• CodeQL now treats Grape::API request sub-accessors as remote flow sources. These includebody.read ,body.string ,params ,GET ,POST ,cookies ,env ,query_string , andpath_info .

Query changes #

C/C++

• The cpp/resource-not-released-in-destructor query now recognizes resources released through local aliases, reducing false positives.

C#

• The cs/simplifiable-boolean-expression query now produces fewer false positives when type information is incomplete.

Java/Kotlin

• The java/ssrf andjava/unvalidated-url-redirection queries now recognize case-insensitive comparisons ofURI.getHost() with fixed allowlist entries. They also recognize these checks when code stores the host in a local variable, which reduces false positives.

Python

• The py/xxe ,py/xml-bomb , andpy/nosql-injection queries now respect your configured threat model when selecting untrusted data sources. By default, they still use remote flow sources. These queries now also include sources you model with data extensions.

Breaking changes #

• GitHub Actions: The GitHub Actions control flow graph (CFG) now uses the shared CFG library. If your custom queries rely on specific CFG nodes, edges, or basic block boundaries, you may need to update them. We’ve removed the legacyCompletion classes, so use CFG edge labels such asDirectSuccessor ,BooleanSuccessor , andReturnSuccessor instead.

For a full list of changes, please refer to the complete changelog for version 2.27.3. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.27.3 will also be included in GitHub Enterprise Server (GHES) 3.24 release. If you use an older version of GHES, you can manually upgrade your CodeQL version.