CodeQL 2.27.2 adds parser and data-flow updates, with Go query migration limits
GitHub released CodeQL 2.27.2 on October 9 with a C++ regular-expression parser and analysis changes across Go, Rust and JavaScript. The Default suite runs 498 security queries covering 170 common weakness enumerations; the Extended suite adds 131 queries covering 32 more CWEs.
For C++, the update parses regular expressions using the ECMAScript grammar in std::regex. It also adds SQL-injection sink models for the Comdb2 C API and flow summaries for Bloomberg BDE codecs and byte-stream deserializers. These specific additions do not establish detection of every possible vulnerability.
Go modeling now includes github.com/coder/websocket alongside nhooyr.io/websocket. Rust changes include extractor classes, async-block data flow and summaries for native-tls-related libraries. JavaScript and TypeScript updates recognize Workflow SDK directives and improve Hapi route-handler and request-input tracking.
The release also changes the Go control-flow graph to use a shared library. Nodes, edges, locations and basic-block boundaries can change, and custom queries relying on the previous representation may need updates. GitHub lists removed, added and deprecated APIs rather than promising all existing queries work unchanged.
CLI changes include clearer errors for invalid query-suite values and rejection of data-extension integers outside the signed 32-bit range. Error and warning prefixes change on standard error, while structured logs and SARIF remain unchanged. Teams should distinguish human-readable output changes from structured-output compatibility.
GitHub automatically deploys new CodeQL versions to code-scanning users on github.com; its notice says a future Enterprise Server release will include this version. The source also documents macOS and Xcode traced-build limitations, covered separately on this site. Parser improvements are not a guarantee that a clean scan proves an application is vulnerability-free.