CodeQL 2.26.4 Tightens GitHub Actions and Data-Flow Detection
The latest CodeQL release recognizes more mutable workflow references and improves language-specific analysis. Some teams should expect alerts to move or newly appear.
GitHub released CodeQL 2.26.4 on September 3, 2026 with updates across Go, Rust, Java and Kotlin, JavaScript and TypeScript, Python, C# and GitHub Actions.
What changed
For GitHub Actions, the unpinned-tag query can now detect mutable references to reusable workflows. Actor-field checks only count as protection for events that actually populate that field, which may reveal paths previously treated as sanitized. CodeQL also added an EnvironmentCheck option to its models-as-data system.
Language changes include Go 1.27 support, more precise Rust data-flow alert locations and SQL-injection sink models for Spring R2DBC. JavaScript and TypeScript analysis now recognizes regular expressions using the d flag and the React Native Worklets directive. Python gained additional taint propagation through list operations.
GitHub says the release is deployed automatically for code scanning on github.com. Older GitHub Enterprise Server installations may need a manual CodeQL upgrade.
Why it matters
Reusable workflows are executable supply-chain dependencies. A mutable tag can point to different code later even if the calling repository does not change. Better detection gives teams a chance to pin trusted revisions and review update mechanisms deliberately.
More precise models can also change alert identity. A corrected Rust source or sink location may close an old alert and open a new one. That does not necessarily mean a vulnerability appeared overnight.
What teams should do
- Review new and moved alerts after the analyzer update before adjusting baselines.
- Pin reusable workflows to immutable commit identifiers where the risk warrants it.
- Check event-specific assumptions in privileged GitHub Actions workflows.
- Confirm the CodeQL version used by self-hosted or enterprise environments.
- Treat model changes as a reason to re-evaluate suppressions, not to copy them forward automatically.
Primary source
GitHub Changelog: CodeQL 2.26.4 improves GitHub Actions security detections
