CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions

GitHub released CodeQL 2.27.3, the static analysis engine behind GitHub code scanning, adding Python 3.15 syntax and builtin support, JSON syntax for data extensions, C23 bit-precise integers (_BitInt(N)), and an opt-in `ai` threat model for LLM-generated data that ships with no built-in source models. The release also includes query accuracy fixes across C/C++, C#, Java/Kotlin and Python, and a breaking change for GitHub Actions queries: the control flow graph now uses the shared CFG library and the legacy `Completion` classes were removed in favor of edge labels such as `DirectSuccessor`, `BooleanSuccessor` and `ReturnSuccessor`. CodeQL 2.27.3 is automatically deployed to GitHub code scanning users on github.com and will ship in the GitHub Enterprise Server 3.24 release.

CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.27.3 https://codeql.github.com/docs/codeql-overview/codeql-changelog/codeql-cli-2.27.3/ . It supports new Python 3.15 language features, adds JSON syntax for data extensions, adds C23 bit-precise integers, and includes accuracy improvements across languages. Language and framework support language-and-framework-support CodeQL CLI - Data extension files now support JSON syntax, using the same structure as YAML data extensions. Java-style comments // ... and / ... / also work. CodeQL parses files with the .json extension as JSON and continues to parse all other files as YAML. - We’ve added an opt-in ai threat model for LLM-generated data. It doesn’t include any built-in source models, so you can define your own sources with data extensions. Python - The Python extractor now supports Python 3.15 syntax, including unary plus in match literal patterns and Unicode 17 identifiers. - We’ve added support for the new frozendict and sentinel builtins introduced in Python 3.15, including data flow modeling for frozendict construction. C/C++ - We’ve added support for C23 bit-precise integers BitInt N . - We’ve added flow summaries for the BlazingMQ BloombergLP::bmqa::Message and MessageProperties classes and their iterators. C - We’ve added support for data flow through positional patterns in is expressions and switch cases. - When you configure private registries, CodeQL now passes the required proxy and certificate environment variables to the NuGet CLI. Ruby - CodeQL now treats Grape::API request sub-accessors as remote flow sources. These include body.read , body.string , params , GET , POST , cookies , env , query string , and path info . Query changes query-changes C/C++ - The cpp/resource-not-released-in-destructor query now recognizes resources released through local aliases, reducing false positives. C - The cs/simplifiable-boolean-expression query now produces fewer false positives when type information is incomplete. Java/Kotlin - The java/ssrf and java/unvalidated-url-redirection queries now recognize case-insensitive comparisons of URI.getHost with fixed allowlist entries. They also recognize these checks when code stores the host in a local variable, which reduces false positives. Python - The py/xxe , py/xml-bomb , and py/nosql-injection queries now respect your configured threat model when selecting untrusted data sources. By default, they still use remote flow sources. These queries now also include sources you model with data extensions. Breaking changes breaking-changes - GitHub Actions: The GitHub Actions control flow graph CFG now uses the shared CFG library. If your custom queries rely on specific CFG nodes, edges, or basic block boundaries, you may need to update them. We’ve removed the legacy Completion classes, so use CFG edge labels such as DirectSuccessor , BooleanSuccessor , and ReturnSuccessor instead. For a full list of changes, please refer to the complete changelog for version 2.27.3 https://codeql.github.com/docs/codeql-overview/codeql-changelog/codeql-cli-2.27.3/ . Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.27.3 will also be included in GitHub Enterprise Server GHES 3.24 release. If you use an older version of GHES, you can manually upgrade your CodeQL version https://docs.github.com/enterprise-server@3.20/admin/managing-code-security/managing-github-advanced-security-for-your-enterprise/configuring-code-scanning-for-your-appliance configuring-codeql-analysis-on-a-server-without-internet-access .