CodeQL 2.27.1 changes C/C++, C#, and Kotlin analysis in different ways. For C/C++, the release adds a correctness query and new flow models for specific APIs. For C#, it adds a new code-quality recommendation and adjusts two existing query areas to reduce false positives. For Java/Kotlin, the main changes are support for Kotlin 2.4.20 and a K2 extractor fix for references such as Foo::class.java. For teams operating code scanning, the key configuration question is which query suite is actually enabled, because not every new query belongs to the security suites that run by default.
The technical documentation dates CodeQL 2.27.1 to September 22, 2026, while GitHub published its public update summary on September 25. Across the release, CodeQL reports 498 security queries in the Default suite covering 170 CWEs, with 131 additional queries in the Extended suite covering 32 more CWEs. Those totals provide context, but the changes below do not mean every repository will receive the same new results.
Summary by language and configuration risk
| Language | What changed in 2.27.1 | Likely effect | Configuration risk |
|---|---|---|---|
| C/C++ | New cpp/ambiguous-assignment-of-comparison query; new models for Boost.Asio resolver, BDE Blob, and Protocol Buffers MessageLite. | May flag ambiguous assignment/comparison expressions and improve flow tracking in projects that use those APIs. | The new query is classified for quality, reliability, and correctness and is listed in cpp-code-quality and cpp-security-and-quality. Teams using only Default or Extended should not assume it will run. |
| C# | New cs/linq/missed-firstordefault query; changes to cs/linq/missed-* and cs/web/missing-token-validation; change to private NuGet registries using Replaces base. | A new readability recommendation may appear in quality analysis. Two fixes are intended to remove incorrect findings in specific cases. | The new query is a quality rule and should not be treated as a new Default-suite security rule. Advanced configurations and custom packs should be reviewed. |
| Kotlin | Support for Kotlin 2.4.20 and a fix for extracting Foo::class.java arguments under the K2 compiler. | Projects already adopting Kotlin 2.4.20 gain documented support. The K2 fix can reduce false positives, including Android queries affected by incomplete extraction. | No new Kotlin-specific query is announced in this release. The effect mainly depends on extractor version and the language/compiler used in the build. |
C/C++: a new correctness query and more flow context
The new cpp/ambiguous-assignment-of-comparison query looks for expressions where a comparison result is assigned to a variable and the assignment itself is then used as a truth value. The pattern can be intentional, but it can also hide an operator-precedence mistake. The query documentation classifies it as high precision, warning severity, with quality, reliability, and correctness tags.
The suite placement matters for AppSec teams. Official query help lists the rule in cpp-code-quality.qls and cpp-security-and-quality.qls. Updating the engine alone therefore does not imply a new finding in repositories configured only with Default or security-extended. An advanced configuration that includes security-and-quality, a custom suite, or a pack that contains the query can start reporting new results after the corresponding pack is updated.
Version 2.27.1 also expands C/C++ analysis models. It adds taint-flow models for boost::asio::ip::basic_resolver::resolve, flow summaries for BloombergLP::bdlbb::Blob, and flow summaries for the C++ google::protobuf::MessageLite API. In practice, these library changes can alter data paths recognized by existing queries in projects that rely on those APIs. That may produce newly correct findings or different path explanations even without enabling the new quality query.
C#: one new recommendation and fewer false positives in specific cases
For C#, the new query is cs/linq/missed-firstordefault. It detects foreach loops that search for the first matching element and then return a default value, a pattern that can be expressed more directly with LINQ FirstOrDefault. The query documentation treats it as a high-precision code-quality recommendation focused on maintainability, readability, and language features.
That distinction is important: the new rule should not be read as a newly added vulnerability detector in the default security suite. Environments that load quality queries may see new recommendations. Environments that run only the standard security selection are more likely to notice the precision improvements in existing queries.
The first improvement affects the cs/linq/missed-* family. CodeQL no longer suggests lambda rewrites that would capture in, out, or ref parameters, avoiding suggestions that would not compile. The second affects cs/web/missing-token-validation: it now recognizes AutoValidateAntiforgeryTokenAttribute when registered as a global MVC filter through AddControllersWithViews and related methods. The intent is to avoid false positives for actions already protected by that global configuration.
There is also an operational dependency-resolution change. Private NuGet registries with Replaces base enabled at the organization-level private registry configuration now replace default NuGet feeds when CodeQL downloads dependencies, including when a project explicitly configures default feeds. Organizations that depend on private registries should test this behavior because the effective package source can change.
Kotlin: 2.4.20 support and a K2 extractor fix
CodeQL 2.27.1 adds support for Kotlin 2.4.20. For teams that have already moved to that compiler release or are preparing to do so, this is the clearest compatibility milestone: the Java/Kotlin analyzer now documents support for version 2.4.20.
The second change fixes extraction of Foo::class.java arguments when the Kotlin K2 compiler is used. Before the fix, those arguments could be dropped during extraction and could cause false positives in queries that depended on that context. The changelog cites java/android/implicit-pendingintents as an example. After the update, some previous alerts may disappear or carry different context even when application code has not changed.
The 2.27.1 changelog does not announce a new Kotlin-specific query. The main changes are language compatibility and extractor fidelity, which is different from simply increasing the number of rules executed.
How to tell whether the upgrade can change your results
GitHub maintains three main built-in suites: default, security-extended, and security-and-quality. Default focuses on highly precise security queries; security-extended adds lower-severity or lower-precision security queries; security-and-quality adds maintainability and reliability queries on top and is available with advanced setup.
Before comparing a 2.27.1 scan with an earlier one, verify the effective configuration. In GitHub Actions workflows, the queries input on github/codeql-action/init can add suites such as security-extended or security-and-quality. Custom configuration files can also disable default queries, include or exclude rules, and load extra packs. Two repositories running the same CodeQL version can therefore produce different result sets.
- If you use only Default: do not expect the two new quality queries themselves to be the cause of new alerts. Modeling and extraction improvements can still change existing findings.
- If you use security-extended: the suite is larger than Default but remains security-focused. Check query metadata before attributing any new alert to the release.
- If you use security-and-quality or custom suites: there is a greater chance of seeing new quality recommendations, especially the C/C++ query explicitly listed in cpp-security-and-quality.
- If you pin pack versions or use custom packs: record the effective pack version when comparing runs. Updating only the CLI does not guarantee every custom selection changed in the same way.
Practical checklist after upgrading
- Record the CodeQL CLI or Action version used for the scan and the query-pack versions when they are manually pinned.
- Confirm the active suite: default, security-extended, security-and-quality, or a custom configuration.
- For C/C++, look for new cpp/ambiguous-assignment-of-comparison results only if your query selection includes that rule.
- If the project uses Boost.Asio resolver, BDE Blob, or protobuf MessageLite, compare taint-flow paths and query results after the upgrade.
- For C#, review changes in cs/linq/missed-* and cs/web/missing-token-validation before treating fewer alerts as a regression.
- If the organization uses a private NuGet registry with Replaces base, validate dependency restoration and the package source used in analysis.
- For Kotlin 2.4.20 with K2, rerun cases that use Foo::class.java and compare previous false positives, especially in Android analysis.
Availability on GitHub.com and GHES
GitHub states that new CodeQL versions are automatically deployed to code scanning users on GitHub.com. For GitHub Enterprise Server, the release announcement says GHES 3.24 will include CodeQL 2.27.1 functionality and points to manual CodeQL upgrades as an option for older compatible releases. In enterprise environments, confirm the version actually running on the runner or appliance before expecting the same results seen on GitHub.com.
What CodeQL 2.27.1 changes in one sentence
For C/C++, the release expands flow modeling and adds a correctness rule; for C#, it adds a quality recommendation and reduces false positives in existing queries; for Kotlin, it adds 2.4.20 support and improves K2 extraction. The real impact on findings depends on the suite, packs, and libraries present in the project.
Sources and references
- GitHub Changelog: CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
- CodeQL changelog: CodeQL 2.27.1 (2026-09-22)
- CodeQL query help: cpp/ambiguous-assignment-of-comparison
- CodeQL query help: cs/linq/missed-firstordefault
- GitHub Docs: CodeQL query suites
- GitHub Docs: Workflow configuration options for code scanning
