Summary
On October 9, 2026, GitHub released CodeQL 2.27.2, adding a C++ regular-expression parser for ECMAScript-grammar std::regex patterns and analysis improvements across C/C++, Go, Rust, and JavaScript/TypeScript, including new taint models and framework support.
What changed
CodeQL 2.27.2 parses std::regex ECMAScript patterns and adds SQL-injection sink models for the Comdb2 C API plus flow summaries for Bloomberg BDE codecs; recognizes the github.com/coder/websocket import for Go; adds Rust extractor support for AnyAttr and DocComment, better data flow through await in async blocks, and flow summaries for native-tls, async-native-tls, and tokio-native-tls; and for JavaScript/TypeScript recognizes the Workflow SDK's 'use workflow' and 'use step' directives and improves Hapi route-handler and request-input tracking. The Default suite runs 498 security queries across 170 CWEs; the Extended suite adds 131 queries across 32 more CWEs.
Why it matters
Keeping CodeQL's language extractors and taint models current with real frameworks (coder/websocket, Hapi, the Workflow SDK, native-tls) directly affects how many true vulnerabilities code scanning catches versus misses, which matters to every GitHub Advanced Security customer relying on CodeQL in CI.
Evidence excerpt
"CodeQL 2.27.2 is now available, adding a C++ regular-expression parser and analysis improvements across several languages." Adds std::regex ECMAScript parsing and Comdb2 SQL-injection sinks (C/C++), coder/websocket recognition (Go), AnyAttr/DocComment and await data flow (Rust), and 'use workflow'/'use step' plus Hapi tracking (JS/TS).