CodeQL documentation
CodeQL resources

CodeQL 2.25.6 (2026-06-04)

This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the code scanning section on the GitHub blog, relevant GitHub Changelog updates, changes in the CodeQL extension for Visual Studio Code, and the CodeQL Action changelog.

Security Coverage

CodeQL 2.25.6 runs a total of 496 security queries when configured with the Default suite (covering 169 CWE). The Extended suite enables an additional 131 queries (covering 32 more CWE).

CodeQL CLI

Improvements

  • When the git executable is available, CodeQL can now obtain configuration and queries from SHA-256 Git repositories, and infer Git metadata about them.

Miscellaneous

  • The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.11.

Query Packs

Bug Fixes

GitHub Actions

  • Adjusted (minor) help file descriptions for queries: actions/untrusted-checkout/critical, actions/untrusted-checkout/high, actions/untrusted-checkout/medium. Clarified wording on a minor point, added one more listed resource and added one more recommendation for things to check.

Major Analysis Improvements

GitHub Actions

  • Adjusted actions/untrusted-checkout/critical to align more with other untrusted resource queries, where the alert location is the location where the artifact is obtained from (the checkout point). This aligns with the other 2 related queries. This will cause the same alerts to re-open for closed alerts of this query.

Minor Analysis Improvements

GitHub Actions

  • Altered the alert message for clarity for queries: actions/untrusted-checkout/critical, actions/untrusted-checkout/high.

  • The actions/unpinned-tag query now recognizes 64-character SHA-256 commit hashes as properly pinned references, in addition to 40-character SHA-1 hashes.

Query Metadata Changes

GitHub Actions

  • Reversed adjustment of the name of actions/untrusted-checkout/high, but kept the portion of the previous change for the word “trusted” to “privileged”. Added a missing “a” to phrasing in actions/untrusted-checkout/high and actions/untrusted-checkout/medium.

Language Libraries

Major Analysis Improvements

Swift

  • Upgraded to allow analysis of Swift 6.3.2.

Minor Analysis Improvements

C/C++

  • Added flow source models for scanf_s and related functions.

  • Added a Call column to LocalFlowSourceFunction::hasLocalFlowSource and RemoteFlowSourceFunction::hasRemoteFlowSource. The old predicates without a Call column continue to be supported.

C#