GitHub / Copilot CodeQL 2.26.1 improves analysis accuracy and framework coverage

CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1 , which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis. Language and framework support C/C++ Models-as-data flow summaries now use fully qualified field names, such as MyNamespace::MyStruct::myField . Unqualified field names remain supported but will be removed in 12 months. Go We’ve improved modeling for the log/slog package, including slog.Logger methods, With , WithGroup , Attr , and Value . This expands coverage for applications using structured logging. Java/Kotlin We’ve added source, sink, and flow summary models for org.apache.poi . JavaScript/TypeScript We’ve added support for Angular’s @HostListener('window:message', ...) and @HostListener('document:message', ...) decorators. CodeQL now recognizes the decorated method’s event parameter as a client-side remote flow source. Query changes Go The improved log/slog modeling expands coverage for the go/log-injection and go/clear-text-logging queries. Java/Kotlin The java/path-injection query now recognizes input validated with @javax.validation.constraints.Pattern as sanitized, reducing false positives. The java/ssrf query now treats the first argument of Spring WebFlux’s WebClient.UriSpec.uri method as a request forgery sink, which may produce additional valid alerts. JavaScript/TypeScript The js/missing-origin-check query now analyzes Angular message event handlers declared with @HostListener . Rust The rust/hard-coded-cryptographic-value query now treats arithmetic, bitwise, and string append operations as barriers. This reduces false positives when code combines hard-coded constants with nonconstant data, such as when incrementing a nonce or appending variable data to a constant prefix. For a full list of changes, please refer to the complete changelog for version 2.26.1 . Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.26.1 will also be included in a future GitHub Enterprise Server (GHES) release. If you use an older version of GHES, you can manually upgrade your CodeQL version . The post CodeQL 2.26.1 improves analysis accuracy and framework coverage appeared first on The GitHub Blog .