CodeQL 2.26.4 improves GitHub actions security detections
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code.
CodeQL 2.26.4 tightens how the static analysis engine checks GitHub Actions workflows. Checks on actor fields read from the event payload, such as github.event.pull_request.user.login, now only count as protection for events that actually populate that field, which may surface more alerts for queries using the ControlCheck class. The actions/unpinned-tag query now also detects mutable references to reusable workflows, and environments can now be specified through a models-as-data model.
The release also adds Go 1.27 support, more precise alert locations for Rust data flow queries, and accuracy improvements for C# and Java/Kotlin, including new SQL injection sink models for Spring R2DBC. It ships automatically to GitHub code scanning on github.com, with the changes reaching GitHub Enterprise Server in a future release. Details are in the full changelog.
