<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o" -->

---
title: CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt...
description: CodeQL 2.26.0 has been released with several notable additions: Kotlin 2.4.0 support, a new JavaScript/TypeScript query (js/system-prompt-injection) to detect...
canonical: https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection | daily.dev
og:description: CodeQL 2.26.0 has been released with several notable additions: Kotlin 2.4.0 support, a new JavaScript/TypeScript query (js/system-prompt-injection) to detect...
og:url: https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o
og:image: https://api.daily.dev/og/posts/ezD4sCi6o.png
og:image:alt: CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection

**[GitHub Changelog](https://daily.dev/sources/github_updates)** · 3 min read · 0 upvotes · 1 comments

## Summary

CodeQL 2.26.0 has been released with several notable additions: Kotlin 2.4.0 support, a new JavaScript/TypeScript query (js/system-prompt-injection) to detect AI system prompt injection attacks, expanded prompt injection sinks for OpenAI, Anthropic, and Google GenAI SDKs, C# Razor Page handler parameters as remote flow sources, Go slog package models, and various false-positive reductions across Python, Swift, and GitHub Actions queries. The update is automatically deployed to GitHub code scanning users on github.com.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://github.blog/changelog/2026-07-10-codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection>

## Questions this post answers

### Does CodeQL 2.26.0 support Kotlin 2.4.0?

Yes, CodeQL 2.26.0 adds support for Kotlin versions up to 2.4.0. This lets code scanning analyze Kotlin codebases written against the newer language version without falling back to unsupported or partial parsing.

_Teams tracking CodeQL language support updates can follow release notes like this on daily.dev._

### How does CodeQL detect AI system prompt injection in JavaScript and TypeScript code?

CodeQL 2.26.0 introduces the js/system-prompt-injection query, which flags cases where untrusted, user-provided values flow into an AI model's system prompt, potentially letting an attacker manipulate model behavior. It also adds prompt injection sinks for additional OpenAI, Anthropic, and Google GenAI SDK APIs, including Sora prompts, OpenAI Realtime session instructions, Anthropic legacy completion prompts, and Google GenAI cached content and system instructions.

_Developers securing AI-integrated apps can track new prompt injection detection queries on daily.dev._

### What did CodeQL 2.26.0 change for Go log injection detection?

CodeQL 2.26.0 adds models for the log/slog package introduced in Go 1.21, so the go/log-injection and go/clear-text-logging queries can now detect issues in code using slog package functions and slog.Logger methods, closing a gap for codebases that adopted the newer structured logging package.

_Go developers hardening logging code can keep up with CodeQL query updates via daily.dev._

## Community discussion

Top comments from developers on daily.dev.

**@d4rkr0n1n** · 0 upvotes

> Can't wait to try.

## Similar posts on daily.dev

- [CodeQL 2.26.2 adds Swift 6.3.3 and Kotlin 2.4.10 support](https://daily.dev/posts/codeql-2-26-2-adds-swift-6-3-3-and-kotlin-2-4-10-support-rjxpchh6g) · GitHub Changelog · 0 upvotes · 0 comments
- [CodeQL 2.26.1 improves analysis accuracy and framework coverage](https://daily.dev/posts/codeql-2-26-1-improves-analysis-accuracy-and-framework-coverage-wwknpo6q8) · GitHub Changelog · 0 upvotes · 0 comments
- [CodeQL 2.27.1 adds C and C\+\+ query and Kotlin 2.4.20 support](https://daily.dev/posts/codeql-2-27-1-adds-c-and-c-query-and-kotlin-2-4-20-support-4xuqmruem) · GitHub Changelog · 0 upvotes · 0 comments
- [CodeQL 2.25.2 adds Kotlin 2.3.20 support and other updates](https://daily.dev/posts/codeql-2-25-2-adds-kotlin-2-3-20-support-and-other-updates-ortwd96jn) · GitHub Changelog · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#kotlin](https://daily.dev/tags/kotlin), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#codeql](https://daily.dev/tags/codeql)

[View this post on daily.dev](https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection","url":"https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o"},"datePublished":"2026-07-10T20:57:17.446Z","dateModified":"2026-09-14T08:31:12.045Z","description":"CodeQL 2.26.0 has been released with several notable additions: Kotlin 2.4.0 support, a new JavaScript/TypeScript query (js/system-prompt-injection) to detect...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f50a55bb0049267a2212aef067d93dc0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f50a55bb0049267a2212aef067d93dc0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,kotlin,prompt-injection,codeql","timeRequired":"PT3M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection"}]}
{"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o","comment":[{"@type":"Comment","text":"Can’t wait to try.","datePublished":"2026-07-11T01:12:26.572Z","url":"https://daily.dev/posts/ezD4sCi6o#c-MG1Et0YEE","author":{"@type":"Person","name":"Mridul Roy","url":"https://daily.dev/d4rkr0n1n","image":"https://lh3.googleusercontent.com/a/ACg8ocL5TBDVnqhk8jN8p9oJYAIo9XHIk1jzPqkEqswVQI_yr8h5PTUv=s96-c"}}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/codeql-2-26-0-adds-kotlin-2-4-0-support-and-ai-prompt-injection-detection-ezd4sci6o#faq","mainEntity":[{"@type":"Question","name":"Does CodeQL 2.26.0 support Kotlin 2.4.0?","acceptedAnswer":{"@type":"Answer","text":"Yes, CodeQL 2.26.0 adds support for Kotlin versions up to 2.4.0. This lets code scanning analyze Kotlin codebases written against the newer language version without falling back to unsupported or partial parsing. Teams tracking CodeQL language support updates can follow release notes like this on daily.dev."}},{"@type":"Question","name":"How does CodeQL detect AI system prompt injection in JavaScript and TypeScript code?","acceptedAnswer":{"@type":"Answer","text":"CodeQL 2.26.0 introduces the js/system-prompt-injection query, which flags cases where untrusted, user-provided values flow into an AI model's system prompt, potentially letting an attacker manipulate model behavior. It also adds prompt injection sinks for additional OpenAI, Anthropic, and Google GenAI SDK APIs, including Sora prompts, OpenAI Realtime session instructions, Anthropic legacy completion prompts, and Google GenAI cached content and system instructions. Developers securing AI-integrated apps can track new prompt injection detection queries on daily.dev."}},{"@type":"Question","name":"What did CodeQL 2.26.0 change for Go log injection detection?","acceptedAnswer":{"@type":"Answer","text":"CodeQL 2.26.0 adds models for the log/slog package introduced in Go 1.21, so the go/log-injection and go/clear-text-logging queries can now detect issues in code using slog package functions and slog.Logger methods, closing a gap for codebases that adopted the newer structured logging package. Go developers hardening logging code can keep up with CodeQL query updates via daily.dev."}}]}
```