CodeQL 2.26.4 improves GitHub actions security detections

GitHub released CodeQL 2.26.4, the static analysis engine behind GitHub code scanning. The update adds Go 1.27 support, improves alert location precision for Rust data flow queries, and includes accuracy improvements for C#, Java/Kotlin, JavaScript/TypeScript, Python, and GitHub Actions. Notable changes include new SQL injection sink models for Spring R2DBC, taint tracking through additional Java and Python methods, and refinements to GitHub Actions security checks such as actor field validation and detection of mutable references to reusable workflows in the actions/unpinned-tag query. The update is automatically deployed to github.com code scanning users, with GHES support coming in a future release.

Source: https://github.blog/changelog/2026-09-03-codeql-2-26-4-improves-github-actions-security-detections. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.