CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support

GitHub's CodeQL 2.27.1 adds new security queries and extends language support for the code scanning engine.

• New queries: cpp/ambiguous-assignment-of-comparison flags C/C++ expressions where a comparison result is assigned to a variable and used as a truth value, and cs/linq/missed-firstordefault flags C# foreach loops that could use LINQ's FirstOrDefault.
• CodeQL now supports Kotlin 2.4.20, and a fix to extraction under the Kotlin K2 compiler reduces false positives in queries such as java/android/implicit-pendingintents.
• C/C++ gets new taint flow models for boost::asio::ip::basic_resolver::resolve, Bloomberg's BloombergLP::bdlbb::Blob, and the Protocol Buffers google::protobuf::MessageLite API.
• Go data flow models are added or improved for several Go 1.27 standard-library APIs, including bytes.CutLast, net/url.URL.Clone, and the new encoding/json/jsontext package.
• JavaScript/TypeScript: Fastify servers configured through chainable methods like withTypeProvider() are now recognised as the same server instance, improving route attribution for queries such as js/missing-rate-limiting.
• Rust: fixed path resolution for m::{self} paths, added data flow models for core::fmt::Write, and upgraded the Rust extractor to rust-analyzer 0.0.347.

GitHub

Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.

View GitHub →

Read the original announcement →