GitHub Describes CodeQL 2.27.3: Python 3.15 Syntax and JSON Data Extensions, but a Shared Actions Control Flow Graph Can Break Custom Queries, and the Release Is Dated October 20
On November 3, 2026, GitHub described CodeQL 2.27.3: Python 3.15 syntax (unary plus in match literals, Unicode 17 identifiers) and the frozendict and sentinel builtins, data extensions writable in JSON, an opt-in 'ai' threat model with no built-in sources, C23 bit-precise integers, and several false-positive reductions. The full release notes list two breaking changes: compiled-language autobuild and manual build are unsupported on macOS 27 with any Xcode or macOS 26 with Xcode 27; the GitHub Actions control flow graph moves to the shared CFG library, so related custom queries may need updating. The legacy Completion classes are removed. Note that the release notes date 2.27.3 to October 20, and the same page already lists 2.27.4 on November 2. The post gives no measured false-positive rates.
On November 3, 2026, GitHub published a changelog post about CodeQL 2.27.3, the static analysis engine behind GitHub code scanning. The post says it supports new Python 3.15 language features, adds a JSON syntax for data extensions, adds C23 bit-precise integers, and improves accuracy across languages. One date needs care. The CodeQL release notes list version 2.27.3 as released on October 20, 2026, and the same page already lists 2.27.4 dated November 2. So the post of November 3 describes a version about two weeks old, and a newer patch release exists.
For the CLI, data extension files can now be written in JSON, with the same structure as the YAML form, and Java-style comments are allowed. Files with a .json extension are parsed as JSON and all other files are still parsed as YAML. This matters for teams that generate extension files from other tools, since JSON is easier to produce and check by machine. The release also adds an opt-in "ai" threat model for LLM-generated data. It has no built-in source models, so a team that wants it to find anything must define its own sources with data extensions.
For Python, the extractor now accepts Python 3.15 syntax, including unary plus in match literal patterns and Unicode 17 identifiers. CodeQL also supports the new frozendict and sentinel builtins, with data flow modeling for how a frozendict is built. The full release notes list more than the post does, such as taint flow for the new grapheme iterator in unicodedata and for new encoding functions in binascii. Support for new syntax means the code can be parsed and analyzed. It does not mean every query has been tuned for the new idioms.
Other languages get smaller changes. C and C++ gain support for C23 _BitInt(N) types and flow summaries for some BlazingMQ message classes. C# gains data flow through positional patterns in is expressions and switch cases, and passes proxy and certificate environment variables to the NuGet command-line tool when private registries are configured. Ruby treats the request sub-accessors of Grape::API, such as params, cookies, body.read and env, as remote flow sources. These additions can change results: a new remote source can produce new alerts on code that was clean before.
Several queries were adjusted to cut false positives. The C++ resource-not-released-in-destructor query now recognizes resources released through local aliases. The C# simplifiable-boolean-expression query is quieter when type information is incomplete. The Java and Kotlin SSRF and unvalidated-redirect queries now recognize case-insensitive comparisons of the URI host against a fixed allowlist, including when the host is held in a local variable. In Python, the xxe, xml-bomb and nosql-injection queries now respect the configured threat model when choosing untrusted sources, still default to remote sources, and now also include sources modeled with data extensions. That last change can add alerts for teams that already model local sources.
The full release notes also list a CLI breaking change: autobuild and manual build for compiled languages are unsupported on macOS 27 with any Xcode, and on macOS 26 with Xcode 27. Another breaking change affects GitHub Actions analysis. The Actions control flow graph now uses the shared CFG library, so custom queries that depend on particular CFG nodes, edges or basic block boundaries may need updating. The legacy Completion classes are removed, and authors should use edge labels such as DirectSuccessor, BooleanSuccessor and ReturnSuccessor. GitHub says every new CodeQL version is deployed automatically to code scanning on github.com, and that this functionality will be in the GitHub Enterprise Server 3.24 release, while older GHES users can upgrade CodeQL manually. The post gives no measured false-positive rates, so teams should rerun scans on a branch and compare alerts before treating the changes as pure improvements.
Sources
FAQ
Which CodeQL 2.27.3 change could break existing queries?
The GitHub Actions control flow graph now uses the shared CFG library. Custom queries that depend on particular CFG nodes, edges or basic block boundaries may need updating, and the legacy Completion classes are removed, so use edge labels such as DirectSuccessor, BooleanSuccessor and ReturnSuccessor.
Does Python 3.15 support mean every query is tuned for new syntax?
No. The post says the extractor can parse the new syntax and models builtins such as frozendict and sentinel, so the code can be analyzed. It does not say each query was tuned for new idioms, and it gives no false-positive or detection rates, so compare alerts on a branch after upgrading.
When was this version actually released?
GitHub's post is dated November 3, 2026 and says it was released recently. The CodeQL release notes, however, date 2.27.3 to October 20, 2026, and the same page already lists 2.27.4 on November 2. So this is about a two-week-old version, and a newer patch release exists.