Illustrative image: a terminal window — CodeQL's CLI is how many teams run scans locally. This is not a GitHub product screenshot. Image: Wikimedia Commons.
TL;DR — GitHub CodeQL 2.27.3 explained in one line: GitHub's code-scanning engine now understands Python 3.15, lets teams write data extensions in JSON, and handles C23 bit-precise integers — and if you scan on github.com, you already have it, because new CodeQL versions roll out automatically.
📌 KEY HIGHLIGHTS
- The release: CodeQL 2.27.3, announced by GitHub on 3 November 2026 — the static-analysis engine behind GitHub code scanning.
- Python 3.15 support: the Python extractor now parses Python 3.15 syntax, including unary plus in
matchliteral patterns and Unicode 17 identifiers, plus the newfrozendictandsentinelbuiltins. - JSON data extensions: data extension files can now be written in JSON as well as YAML, with Java-style comments supported.
- C23 integers: C/C++ analysis now supports bit-precise integers (
_BitInt(N)), and C# data flow now tracks positional patterns. - What you do: nothing on github.com (automatic rollout); CLI users download the 2.27.3 bundle; GitHub Enterprise Server gets it in GHES 3.24.
GitHub CodeQL 2.27.3 explained: what changed?
CodeQL is GitHub's semantic code-analysis engine: it turns a codebase into a queryable database of code structure and data flow, then runs security queries over it to find vulnerabilities such as SQL injection, cross-site scripting and path traversal before code ships. It is the engine behind GitHub code scanning, which surfaces findings as alerts and pull-request annotations. Version 2.27.3 is a language-coverage and accuracy release, not a new product — its job is to keep the scanner in step with the languages developers actually write today.
Here is the release, area by area, from GitHub's changelog:
| Area | What is new in 2.27.3 |
|---|---|
| Python | Python 3.15 syntax support (unary plus in match literals, Unicode 17 identifiers); data-flow modelling for the new frozendict and sentinel builtins |
| Data extensions | JSON syntax now supported alongside YAML; // and /* */ comments work in JSON files |
| C/C++ | C23 bit-precise integers (_BitInt(N)); flow summaries for BlazingMQ message classes; fewer false positives from the resource-not-released-in-destructor query |
| C# | Data flow through positional patterns in is expressions and switch cases; proxy/certificate variables now passed to the NuGet CLI for private registries |
| Ruby | Grape::API request sub-accessors (params, cookies, body, query_string and more) now treated as remote flow sources |
| Java/Kotlin | SSRF and unvalidated-URL-redirection queries now recognise case-insensitive allowlist host checks, including hosts stored in local variables — fewer false positives |
| GitHub Actions | Actions control-flow graph moves to the shared CFG library; legacy Completion classes removed — custom queries relying on specific CFG nodes may need updating |
Illustrative image: a data-centre server room — code scanning runs on GitHub's hosted infrastructure for github.com users. Image: Wikimedia Commons / BalticServers, CC BY-SA 3.0.
Why Python 3.15 support matters right now
The Python half of this release is the most time-sensitive. Python 3.15 shipped on 9 October 2026, and our Python 3.15 upgrade explainer covered what changed for developers — lazy imports, a built-in frozendict, UTF-8 by default. Until now, teams that had already moved to 3.15 had a gap: the scanner behind their code scanning did not fully understand the new syntax, which risks parse problems or missed findings. CodeQL 2.27.3 closes that gap, including data-flow modelling for frozendict construction, so taint tracking follows values through the new builtin.
The same logic applies to the C23 change: as codebases adopt bit-precise integers, the scanner must model them or its results quietly degrade. Neither change is glamorous; both are the kind of maintenance that decides whether a security tool stays trustworthy as languages evolve.
The opt-in "ai" threat model and JSON data extensions
Two smaller items point at where code scanning is heading. First, 2.27.3 adds an opt-in ai threat model for LLM-generated data. It ships with no built-in source models — teams define their own sources with data extensions — but the direction is clear: in a year when AI writes much of the code being scanned, treating model output as untrusted input is becoming a first-class concern. Relatedly, the Python XXE, XML-bomb and NoSQL-injection queries now respect the configured threat model and include sources modelled with data extensions.
Second, data extensions in JSON lower the authoring barrier. Teams that model their own frameworks and libraries — the custom sources and sinks that make CodeQL useful beyond its default queries — can now write those models in JSON with comments, instead of YAML only. A summary of the release notes puts the default suite at 498 security queries mapping to 170 CWE entries, with the extended suite adding 131 more queries.
Why it matters for World Tech readers
No India-specific data is attached to this release, and this post does not invent any. The relevance is read-across: Indian engineering teams are among the world's heaviest users of GitHub and of AI coding tools, and every team that lets an agent write code inherits the same question this release answers — does the scanner still understand the code being produced? Code scanning is free on public repositories, so the upgrade path for open-source maintainers costs nothing, and private repositories get it through GitHub Code Security. The same week's measurement story — our Node.js 27 alpha explainer and the Momentic QA Bench results — points the same way: verification tooling is racing to keep up with AI-written code, and staying on a current scanner version is the cheapest part of that race.
Should you care?
✅ Yes if you scan code on GitHub; ⏳ no action needed if you only use github.com. This is a keeping-current release, not a reason to redesign anything — but if you run the CLI or maintain custom queries, the Actions CFG change is the one item to check before you upgrade.
Availability: what to do now
On github.com, every new CodeQL version is deployed automatically to code scanning, so repositories using default setup pick up 2.27.3 with no action. CLI users can download the 2.27.3 bundle from the CodeQL releases and should re-run test suites for any custom Actions queries, because of the CFG library change. GitHub Enterprise Server customers get the new functionality in GHES 3.24; older GHES versions can upgrade their CodeQL version manually. One note for completeness: the CodeQL Action's changelog already lists bundle 2.27.4 as its default from 3 November — github.com users get whichever bundle the Action pins, while the feature set described here is the 2.27.3 release.
Separately — from GitHub's October changelog, not the 2.27.3 notes — teams on Apple hardware should note that traced builds for compiled languages are unsupported on macOS 27 and on macOS 26 with Xcode 27, because Apple no longer ships the multi-architecture binaries CodeQL needs. That affects build planning more than this release, but it is the kind of footnote that bites during an upgrade week.
FAQs
What is GitHub CodeQL? CodeQL is GitHub's semantic code-analysis engine. It converts source code into a relational database of code structure and data flow, then runs queries written in its QL language to find vulnerability patterns — for example, user input reaching a database query without sanitisation. It powers GitHub code scanning and is free on public repositories.
Do I need to do anything to get CodeQL 2.27.3 on github.com? No. GitHub deploys each new CodeQL version automatically to code scanning on github.com. Only CLI users need to download the new bundle, and only GitHub Enterprise Server customers need to wait for GHES 3.24 or upgrade manually.
What does the new opt-in "ai" threat model do? It lets teams treat data produced by large language models as untrusted input in their analyses. It includes no built-in source models, so teams define their own LLM-data sources using data extensions, and queries such as the Python XXE and NoSQL-injection checks then respect that model.
What could break for custom CodeQL queries in 2.27.3? The GitHub Actions control-flow graph now uses the shared CFG library, and the legacy Completion classes are removed. If your custom queries depend on specific CFG nodes, edges or basic-block boundaries for Actions workflows, update them to use CFG edge labels such as DirectSuccessor, BooleanSuccessor and ReturnSuccessor.
TAKEAWAY: CodeQL 2.27.3 is maintenance with a message — scanners must evolve as fast as the languages and the AI tools writing the code. Update the CLI, check custom Actions queries, and otherwise let github.com handle it.
Follow World Tech on TechByCountry for tomorrow's update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Comments
Post a Comment