CodeQL 2.26.4 Is Already Scanning Your Repo — Expect New Actions Alerts That Aren't New Bugs

CodeQL is the static analysis engine behind GitHub code scanning — the thing producing the security alerts in your repo’s Security tab. GitHub shipped CodeQL 2.26.4 on 2026-09-03, and the announcement is explicit that every new version is automatically deployed to code scanning users on github.com.

You do nothing; your next scan already runs the new engine. Here is the plain-language version, focused on which changes will make existing projects sprout alerts. Verified 2026-09-07.

1. Language support: Go 1.27 lands

The headline support item is Go 1.27. Projects that just upgraded will no longer have analysis silently miss code the parser did not recognise.

The rest:

• Rust: alert locations for data flow queries are now more precise, based on the actual source and sink nodes. The announcement flags the side effect directly — some alerts change location, so they appear as new alerts while the previous ones close. It looks like new findings; it is the same finding relabelled.
• Java/Kotlin: new SQL injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI, plus taint propagation through String.valueOf(Object) when the argument is a CharSequence. In plain terms: injection paths that used to slip through are now caught.
• JavaScript/TypeScript: support for regular expressions using the d flag and for the React Native Worklets worklet directive.
• Python: taint now flows through list.extend and list.insert, matching existing support for list.append.

2. The Actions changes affect the most people

Almost every team has workflows, so read these three:

1. Actor fields read from the event payload no longer count automatically.

Per the announcement, checks on actor fields such as github.event.pull_request.user.login now only count as protection for events that actually populate that field.

Plainly: many workflows gate on “only run if the actor is X”. Some event types never populate that field, which makes the gate meaningless. The new version sees through that, so queries using the ControlCheck class may produce more alerts.

2. actions/unpinned-tag now detects mutable references to reusable workflows.

Plainly: if you reference someone else’s workflow by branch or a movable tag rather than a pinned commit SHA, you inherit whatever they push next. That is a supply-chain exposure, and reusable workflows are now in scope for the check.

3. EnvironmentCheck can now be specified through a models-as-data model — and the announcement warns that queries using ControlCheck may find more results because an environment is no longer a sufficient sanitiser.

Plainly: using a GitHub Environment with required reviewers used to be accepted as protection outright. It no longer is.

3. More alerts usually means a stricter scanner, not worse code

That distinction matters this week. Three common cases:

• Rust projects: old alerts close, new ones open, same underlying issue.
• Projects with workflows: pre-existing weak gates get exposed — actor checks, unpinned reusable workflows, environments treated as a universal guardrail.
• Java projects using R2DBC: newly modelled injection paths appear.

Triage order: take the Actions findings first. A workflow permissions weakness reaches your repository secrets and your release pipeline, which outranks most application-layer alerts.

4. GitHub Enterprise Server users have to act

The announcement states that the new functionality will be included in a future GHES release, and that users on an older GHES can upgrade CodeQL manually. Self-hosted teams do not get these detection improvements automatically.

Teams on github.com get no choice — it is already running.

If runner version deprecations are on your list this week, GitHub also opened a REST API for them; we covered it in the GitHub Actions runner deprecation API.

Source: GitHub’s changelog entry, CodeQL 2.26.4 improves GitHub actions security detections (2026-09-03), read directly. Verified 2026-09-07. See the CodeQL changelog for the complete list of changes. Plan pricing is summarised on our GitHub Copilot tool page.