CodeQL 2.27.0: Linux ARM64 Support, Rust Query, and Java Deprecations

GitHub shipped CodeQL 2.27.0 on September 9, 2026, bringing native Linux ARM64 support for the first time. The release also adds a new Rust security query for command-line injection, expanded framework coverage for Java and Kotlin via Micronaut modeling, taint tracking improvements for C# OData parameters, and several PostgreSQL SQL injection sinks for C and C++. Java 9 and 10 support is now deprecated with a January 2027 removal date.

What happened

Detail	Value
Release	CodeQL 2.27.0
Release date	September 9, 2026
New platform	Linux ARM64 (native CLI and bundle)
New Rust query	rust/command-line-injection
Java deprecation deadline	January 2027 (Java 9 and 10 removed)
Auto-deployed to	github.com code scanning users

CodeQL is the static analysis engine behind GitHub code scanning, which automatically flags security issues in your repository. Version 2.27.0 is a broad update touching platform support, language coverage, and query accuracy across six language ecosystems.

Platform and infrastructure changes

The biggest infrastructure news is Linux ARM64 support. You can now download the CodeQL CLI and the CodeQL bundle from the linux-arm64 per-platform release assets and run analysis natively, without emulation. This matters for teams running ARM-based CI servers or cloud instances, where emulated x86 analysis carries a real performance cost.

GitHub code scanning’s default setup also gains the ability to use an organization’s private registry configurations. That means it can authenticate with container registries or the GitHub API when fetching custom queries or packs from private Git sources and Docker registries, a gap that previously forced workarounds for teams with internal packs.

One thing to watch: the generic multi-platform codeql.zip distribution will be removed in a future release. The CLI already emits a warning when run from an all-platforms distribution. Switch to the per-platform .zip for your architecture now to avoid a forced migration later. Set CODEQL_ALLOW_ALL_PLATFORMS_DIST=true if you need to suppress the warning temporarily.

Language and framework coverage

Rust

CodeQL now ships a rust/command-line-injection query to catch uncontrolled command execution in Rust code. The rust/hard-coded-cryptographic-value query was also tightened to cut duplicate results with very similar source locations. And the rust/unused-variable query no longer fires on variables inside functions that contain the standard todo!() or unimplemented!() macros, reducing noise during active development.

Java and Kotlin

Micronaut framework support arrives with this release. CodeQL now models HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks. For teams running Micronaut microservices, this means previously invisible attack surfaces, like unsanitized values flowing through HTTP controllers, are now detectable without custom modeling.

C#

ASP.NET Core MVC controller and action discovery has been improved to match actual runtime behavior more closely. The update covers application parts, endpoint mappings, inherited actions, and controller or action exclusions. CodeQL also adds taint tracking for OData action parameter binding, specifically values from ODataActionParameters and entities tracked by Delta, which extends injection detection to OData-based APIs.

In build-mode: none, CodeQL now always tries to restore projects and solutions using available NuGet feeds. It also reports any configured feeds that are unreachable, making it easier to spot missing dependencies that could cause incomplete analysis.

C and C++

PostgreSQL’s libpq library functions are now recognized as SQL injection sinks. The cpp/sql-injection query can identify vulnerabilities involving PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare. Projects using libpq directly will see new alerts if untrusted input reaches any of these functions.

GitHub Actions

CodeQL’s handling of author-association field checks in event payloads has been corrected. These checks are now treated as protection only when the event payload actually provides the relevant field. Teams relying on author-association checks for workflow security should expect additional alerts, because some checks that appeared protective were not.

Upcoming deprecations to act on now

• Java 9 and 10 support will be removed in January 2027. Java 7 and 8 remain supported.
• The generic multi-platform codeql.zip will be removed in a future release. Move to per-platform downloads.

Why it matters

The ARM64 addition is the most operationally significant change for many teams. As ARM-based cloud instances become a cost-effective default (AWS Graviton, Ampere on GCP, Azure Cobalt), running analysis natively rather than under emulation removes a meaningful friction point from security pipelines.

The Micronaut and OData additions close gaps that previously required hand-written CodeQL models or external tools. For teams using these frameworks, out-of-the-box coverage for injection and data-flow vulnerabilities just got broader without any configuration work.

If you use AI-assisted code generation to accelerate development, static analysis coverage like this becomes more important, not less. Generated code often uses popular frameworks correctly but can miss subtle injection paths that a query like rust/command-line-injection is built to catch.

Our take

The GitHub Actions author-association fix is the one most teams will feel immediately. It is a quiet but meaningful correction: workflows that appeared secure because they checked author-association fields may have been offering no real protection. Expect those new alerts and treat them as genuine findings rather than noise.

The January 2027 Java 9/10 deprecation is a fair warning window, but it catches teams that maintain legacy services and forgot to check CodeQL’s supported-version list. Put that deadline in your backlog now. And if you ship anything that touches AI-assisted code pipelines or security tooling, review whether your CodeQL setup is on the per-platform distribution and whether you are pulling from any private registries that now need registry config support.

What to do about it

1. Check whether your CI runners are on Linux ARM64. If so, switch to the linux-arm64 per-platform CLI assets.
2. Move off the generic multi-platform codeql.zip now, before it is removed. Download the correct per-platform .zip for each environment.
3. If you use private query packs or registries, configure your organization’s registry settings so default setup can authenticate properly.
4. Review any GitHub Actions workflows that rely on author-association field checks. New CodeQL alerts in those workflows should be triaged as real security gaps.
5. If your Java codebase runs on Java 9 or 10, plan the migration path before January 2027.

The safest move right now: update your CodeQL CLI, run a scan, and triage the new alerts before they pile up.

Source: GitHub Changelog