Summary
On September 3, 2026, GitHub released CodeQL 2.26.4, adding improved static-analysis security detections for GitHub Actions workflows and support for analyzing Go 1.27 codebases.
What changed
CodeQL 2.26.4 expanded its GitHub Actions security queries and added Go 1.27 language support, strengthening code-scanning coverage for CI/CD workflow vulnerabilities and newer Go code.
Why it matters
Actions workflows are a frequent supply-chain attack surface, so better default detections raise the security baseline for any repo using code scanning, and day-one Go 1.27 support keeps scanning current with the language. It is routine but security-relevant hardening for the dominant code host.
Evidence excerpt
CodeQL 2.26.4 improves GitHub Actions security detections — enhanced static analysis adds support for Go 1.27 and improved security detection capabilities.