#static-analysis
Tagged “static-analysis”
2 articlesSecurity
CodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module
CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.
Aug 23, 2026 · Maya OkonkwoSecurityCodeQL 2.26.2 trims what counts as safe: fresh alerts incoming
GitHub's static analysis engine adds Swift 6.3.3 and Kotlin 2.4.10 support in CodeQL 2.26.2, and quietly removes a batch of sanitizers that used to make path injection and URL redirection findings disappear.
Aug 10, 2026 · Tomás Vega