GitHub detailed new CodeQL 2.27.3 security-scanning capabilities on November 3, 2026, expanding support for Python 3.15 syntax, C23 integers and JSON-formatted data extensions while adding an opt-in threat model for content generated by large language models. The underlying CodeQL CLI release was dated October 20; the November announcement summarized its implications for GitHub code scanning. The changes target developers maintaining custom queries, application-security rules and automated repository analysis.

CodeQL converts source code into queryable databases so security teams can search for dangerous data flows, unsafe APIs and programming mistakes. Unlike a runtime intrusion-detection system, static analysis examines code without executing the target application. GitHub says CodeQL 2.27.3 is deployed automatically to GitHub.com code-scanning users, while GitHub Enterprise Server 3.24 will include the functionality.

Python 3.15 and new language models

The Python extractor now recognizes Python 3.15 features including Unicode 17 identifiers and unary plus in literal patterns used by match. GitHub also added data-flow modeling for the new frozendict built-in and support for sentinel. Such changes matter because unsupported syntax or missing library models can hide paths from a security query or produce misleading results.

For C and C++, CodeQL adds C23 bit-precise integer support using _BitInt(N) and flow summaries for Bloomberg’s BlazingMQ messaging classes. C# receives improved handling of positional patterns; Ruby’s Grape framework gains additional remote-input sources. Java and Kotlin server-side request forgery and redirect queries now better recognize case-insensitive hostname allowlists, reducing some false positives.

AI-generated content becomes an optional taint source

The new ai threat model gives query authors a way to treat large-language-model output as potentially untrusted data. GitHub explicitly notes that the model has no built-in source definitions; developers must supply their own data extensions. Enabling the switch alone does not automatically discover every AI output or prove an application vulnerable. The practical benefit is a mechanism to trace model-generated strings when they enter commands, database queries, templates or parsers.

Data extensions can now be written in JSON as well as YAML, with support for JavaScript-style comments in JSON files. The codeql test run command also recognizes matching .ext.json test extensions. Teams migrating custom packs should validate both parsing and query outcomes rather than assuming the two formats always produce equivalent behavior in every environment.

Migration risks for custom queries

The release changes GitHub Actions control-flow graph internals, removing legacy Completion classes. Custom queries depending on previous node or edge structures may need migration to labels such as DirectSuccessor and ReturnSuccessor. The GitHub changelog documents the compatibility boundary; its CLI release notes also warn about unsupported traced compiled-language builds on certain macOS and Xcode combinations.

BitcoinVersus.Tech previously covered CodeQL 2.27.2, AI coding agents and review bottlenecks, critical PHP patching and rising GitHub activity. The new release is a distinct follow-up focused on language compatibility and configurable analysis rules.

GitHub has not provided an independently reproduced benchmark proving that CodeQL 2.27.3 finds more vulnerabilities across all projects. Engineering teams should compare alert quality, false-positive rates and query compatibility on representative repositories before treating the upgrade as a security improvement in production.

Editor’s Note: The November 3 GitHub announcement and October 20 CodeQL CLI release notes are primary sources. Product illustrations are original conceptual renderings, not screenshots of GitHub software. Performance and vulnerability-detection improvements require project-specific validation.

Scan the donation QR from a laptop or larger screen to donate 5,000 sats. Bitcoin address: 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb.

We volunteer daily to improve the credibility of the information on this platform. If you would like to support the research, please donate here: 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb

BitcoinVersus.tech is not a financial advisor. This media platform reports on technical and financial subjects purely for informational purposes.