Security
Vendor-neutral coverage of security.
Articles
3 articlesCodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module
CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.
Aug 23, 2026 · Maya OkonkwoSecurityCodeQL 2.26.2 trims what counts as safe: fresh alerts incoming
GitHub's static analysis engine adds Swift 6.3.3 and Kotlin 2.4.10 support in CodeQL 2.26.2, and quietly removes a batch of sanitizers that used to make path injection and URL redirection findings disappear.
Aug 10, 2026 · Tomás VegaSecurityactions/checkout v7 refuses fork PR code in pull_request_target
GitHub shipped actions/checkout v7, which fails by default when a workflow triggered by pull_request_target or workflow_run tries to fetch the head of a fork's pull request. Same-repo PRs and the standard pull_request event are unaffected; a deliberately conspicuous opt-out exists for teams who really mean it.
Jun 18, 2026 · Tomás Vega