|
| 1 | +.. _codeql-cli-2.24.1: |
| 2 | + |
| 3 | +========================== |
| 4 | +CodeQL 2.24.1 (2026-02-05) |
| 5 | +========================== |
| 6 | + |
| 7 | +.. contents:: Contents |
| 8 | + :depth: 2 |
| 9 | + :local: |
| 10 | + :backlinks: none |
| 11 | + |
| 12 | +This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/application-security/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__. |
| 13 | + |
| 14 | +Security Coverage |
| 15 | +----------------- |
| 16 | + |
| 17 | +CodeQL 2.24.1 runs a total of 491 security queries when configured with the Default suite (covering 166 CWE). The Extended suite enables an additional 135 queries (covering 35 more CWE). |
| 18 | + |
| 19 | +CodeQL CLI |
| 20 | +---------- |
| 21 | + |
| 22 | +Miscellaneous |
| 23 | +~~~~~~~~~~~~~ |
| 24 | + |
| 25 | +* The vulnerable xwork-core 2.3.37 test dependency (CVE-2025-68493) has been removed. The CodeQL Java library has been updated to support both legacy Struts 2.x-6.x package names and Struts 7.x package names for analyzing user code. |
| 26 | + |
| 27 | +Language Libraries |
| 28 | +------------------ |
| 29 | + |
| 30 | +Bug Fixes |
| 31 | +~~~~~~~~~ |
| 32 | + |
| 33 | +C/C++ |
| 34 | +""""" |
| 35 | + |
| 36 | +* Fixed a bug in the :code:`GuardCondition` library which sometimes prevented binary logical operators from being recognized as guard conditions. As a result, queries using :code:`GuardCondition` may see improved results. |
| 37 | +* Fixed a bug which caused :code:`Node.asDefinition()` to not have a result for certain assignments. |
| 38 | + |
| 39 | +Java/Kotlin |
| 40 | +""""""""""" |
| 41 | + |
| 42 | +* Kotlin: The Kotlin extractor now registers as the last IR generation extension, ensuring that code generated by other compiler plugins (such as kotlinx.serialization) is correctly captured. |
| 43 | + |
| 44 | +GitHub Actions |
| 45 | +"""""""""""""" |
| 46 | + |
| 47 | +* Fixed a crash when analysing a :code:`${{ ... }}` expression over around 300 characters in length. |
| 48 | + |
| 49 | +Breaking Changes |
| 50 | +~~~~~~~~~~~~~~~~ |
| 51 | + |
| 52 | +Java/Kotlin |
| 53 | +""""""""""" |
| 54 | + |
| 55 | +* Support for Kotlin 1.6.x and 1.7.x series has been dropped |
| 56 | + |
| 57 | +Minor Analysis Improvements |
| 58 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 59 | + |
| 60 | +C/C++ |
| 61 | +""""" |
| 62 | + |
| 63 | +* The :code:`Buffer.qll` library will no longer report incorrect buffer sizes on certain malformed databases. As a result, the queries :code:`cpp/static-buffer-overflow`, :code:`cpp/overflow-buffer`, :code:`cpp/badly-bounded-write`, :code:`cpp/overrunning-write`, :code:`cpp/overrunning-write-with-float`, and :code:`cpp/very-likely-overrunning-write` will report fewer false positives on such databases. |
| 64 | +* Added :code:`taint` summary models and :code:`sql-injection` barrier models for the MySQL :code:`mysql_real_escape_string` and :code:`mysql_real_escape_string_quote` escaping functions. |
| 65 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 66 | + |
| 67 | +C# |
| 68 | +"" |
| 69 | + |
| 70 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 71 | +* C# 14: Support for null-conditional assignments (such as :code:`c?.Prop = p`). Furthermore, the :code:`MaybeNullExpr` class now takes null-conditional access (such as :code:`?.`) into account when modeling potential null values. |
| 72 | + |
| 73 | +Golang |
| 74 | +"""""" |
| 75 | + |
| 76 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 77 | + |
| 78 | +Java/Kotlin |
| 79 | +""""""""""" |
| 80 | + |
| 81 | +* Added support for Struts 7.x package names in the Struts framework library. The library now recognizes both the legacy :code:`com.opensymphony.xwork2` package names (Struts 2.x-6.x) and the new :code:`org.apache.struts2` package names (Struts 7.x+), maintaining backward compatibility while enabling analysis of code using the latest Struts versions. |
| 82 | +* The query :code:`java/unreleased-lock` no longer applies to lock types with names ending in "Pool", as these typically manage a collection of resources and the :code:`lock` and :code:`unlock` methods typically only lock one resource at a time. This may lead to a reduction in false positives. |
| 83 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 84 | +* When Maven-compatible private package registries are configured for an organisation for Default Setup, CodeQL will now configure Maven to also use these as plugin repositories. CodeQL previously already configured Maven to use them as regular package repositories. This should now allow Maven plugins to be obtained from private registries. |
| 85 | + |
| 86 | +JavaScript/TypeScript |
| 87 | +""""""""""""""""""""" |
| 88 | + |
| 89 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 90 | + |
| 91 | +Python |
| 92 | +"""""" |
| 93 | + |
| 94 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 95 | +* Added experimental query :code:`py/prompt-injection` to detect potential prompt injection vulnerabilities in code using LLMs. |
| 96 | +* Added taint flow model and type model for :code:`agents` and :code:`openai` modules. |
| 97 | +* Remote flow sources for the :code:`websockets` package have been modeled. |
| 98 | + |
| 99 | +Ruby |
| 100 | +"""" |
| 101 | + |
| 102 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 103 | + |
| 104 | +Swift |
| 105 | +""""" |
| 106 | + |
| 107 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 108 | + |
| 109 | +Rust |
| 110 | +"""" |
| 111 | + |
| 112 | +* The predicate :code:`SummarizedCallable.propagatesFlow` has been extended with the columns :code:`Provenance p` and :code:`boolean isExact`, and as a consequence the predicates :code:`SummarizedCallable.hasProvenance` and :code:`SummarizedCallable.hasExactModel` have been removed. |
| 113 | +* Added type inference support for the :code:`FnMut(..) -> ..` and :code:`Fn(..) -> ..` traits. They now work in type parameter bounds and are implemented by closures. |
| 114 | + |
| 115 | +New Features |
| 116 | +~~~~~~~~~~~~ |
| 117 | + |
| 118 | +C/C++ |
| 119 | +""""" |
| 120 | + |
| 121 | +* Added a subclass :code:`Embed` of :code:`PreprocessorDirective` for C23 and C++26 :code:`#embed` preprocessor directives. |
| 122 | +* Added modules :code:`DataFlow::ParameterizedBarrierGuard` and :code:`DataFlow::ParameterizedInstructionBarrierGuard`. These modules provide the same features as :code:`DataFlow::BarrierGuard` and :code:`DataFlow::InstructionBarrierGuard`, but allow for an additional parameter to support properly using them in dataflow configurations that uses flow states. |
| 123 | + |
| 124 | +Java/Kotlin |
| 125 | +""""""""""" |
| 126 | + |
| 127 | +* Kotlin versions up to 2.3.0 are now supported. |
| 128 | + |
| 129 | +Python |
| 130 | +"""""" |
| 131 | + |
| 132 | +* It is now possible to refer to list elements in the Python models-as-data language, via the :code:`ListElement` path. |
0 commit comments