--- title: CodeQL 2.26.4 improves GitHub actions security detections description: GitHub released CodeQL 2.26.4, the static analysis engine behind GitHub code scanning. The update adds Go 1.27 support, improves alert location precision for... canonical: https://daily.dev/posts/codeql-2-26-4-improves-github-actions-security-detections-2xug4do8x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CodeQL 2.26.4 improves GitHub actions security detections | daily.dev og:description: GitHub released CodeQL 2.26.4, the static analysis engine behind GitHub code scanning. The update adds Go 1.27 support, improves alert location precision for... og:url: https://daily.dev/posts/codeql-2-26-4-improves-github-actions-security-detections-2xug4do8x og:image: https://api.daily.dev/og/posts/2xuG4do8X.png og:image:alt: CodeQL 2.26.4 improves GitHub actions security detections og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CodeQL 2.26.4 improves GitHub actions security detections **[GitHub Changelog](https://daily.dev/sources/github_updates)** · 2 min read · 0 upvotes · 0 comments ## Summary GitHub released CodeQL 2.26.4, the static analysis engine behind GitHub code scanning. The update adds Go 1.27 support, improves alert location precision for Rust data flow queries, and includes accuracy improvements for C#, Java/Kotlin, JavaScript/TypeScript, Python, and GitHub Actions. Notable changes include new SQL injection sink models for Spring R2DBC, taint tracking through additional Java and Python methods, and refinements to GitHub Actions security checks such as actor field validation and detection of mutable references to reusable workflows in the actions/unpinned-tag query. The update is automatically deployed to github.com code scanning users, with GHES support coming in a future release. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What changed in CodeQL 2.26.4 for GitHub Actions security queries? CodeQL 2.26.4 refines how it detects insufficient protections in GitHub Actions workflows. Checks on actor fields like github.event.pull_request.user.login now only count as protection for events that actually populate that field, which may surface more alerts for queries using the ControlCheck class. The actions/unpinned-tag query now also detects mutable references to reusable workflows, and EnvironmentCheck can be specified via a models-as-data model. _Teams hardening CI/CD pipelines can track CodeQL Actions query updates like this on daily.dev._ ### Does CodeQL support Go 1.27? Yes, CodeQL 2.26.4 added support for analyzing Go 1.27 code. This release also improved alert location precision for Rust data flow queries, meaning some existing alerts will close and reappear at more accurate source and sink locations rather than representing new vulnerabilities. _Developers rolling out new Go versions can follow tooling compatibility updates like this on daily.dev._ ### What Java security detection improvements were added in CodeQL 2.26.4? CodeQL 2.26.4 added SQL injection sink models for Spring R2DBC's DatabaseClient and the R2DBC SPI, plus improved taint propagation through String.valueOf(Object) calls when the argument is a CharSequence such as a String or StringBuilder. These changes help the scanner catch more real injection vulnerabilities in Java and Kotlin codebases. _Java teams tightening SQL injection coverage can keep up with scanner updates like this on daily.dev._ ## Similar posts on daily.dev - [CodeQL 2.25.5 improves query accuracy for GitHub Actions](https://daily.dev/posts/codeql-2-25-5-improves-query-accuracy-for-github-actions-febgcvxj0) · GitHub Changelog · 0 upvotes · 0 comments - [CodeQL 2.26.1 improves analysis accuracy and framework coverage](https://daily.dev/posts/codeql-2-26-1-improves-analysis-accuracy-and-framework-coverage-wwknpo6q8) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#golang](https://daily.dev/tags/golang), [#github-actions](https://daily.dev/tags/github-actions), [#appsec](https://daily.dev/tags/appsec), [#codeql](https://daily.dev/tags/codeql) [View this post on daily.dev](https://daily.dev/posts/codeql-2-26-4-improves-github-actions-security-detections-2xug4do8x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CodeQL 2.26.4 improves GitHub actions security detections","url":"https://daily.dev/posts/codeql-2-26-4-improves-github-actions-security-detections-2xug4do8x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/codeql-2-26-4-improves-github-actions-security-detections-2xug4do8x"},"datePublished":"2026-09-03T14:23:10.547Z","dateModified":"2026-09-03T14:25:53.620Z","description":"GitHub released CodeQL 2.26.4, the static analysis engine behind GitHub code scanning. The update adds Go 1.27 support, improves alert location precision for...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c30928ad61d90951feafcb8c6fea4ef?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1c30928ad61d90951feafcb8c6fea4ef?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Changelog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Changelog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/15004b7835da4d89b02b115871f0f6dc","url":"https://daily.dev/sources/github_updates"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/codeql-2-26-4-improves-github-actions-security-detections-2xug4do8x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,github-actions,appsec,codeql","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Changelog","item":"https://daily.dev/sources/github_updates"},{"@type":"ListItem","position":3,"name":"CodeQL 2.26.4 improves GitHub actions security detections"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/codeql-2-26-4-improves-github-actions-security-detections-2xug4do8x#faq","mainEntity":[{"@type":"Question","name":"What changed in CodeQL 2.26.4 for GitHub Actions security queries?","acceptedAnswer":{"@type":"Answer","text":"CodeQL 2.26.4 refines how it detects insufficient protections in GitHub Actions workflows. Checks on actor fields like github.event.pull_request.user.login now only count as protection for events that actually populate that field, which may surface more alerts for queries using the ControlCheck class. The actions/unpinned-tag query now also detects mutable references to reusable workflows, and EnvironmentCheck can be specified via a models-as-data model. Teams hardening CI/CD pipelines can track CodeQL Actions query updates like this on daily.dev."}},{"@type":"Question","name":"Does CodeQL support Go 1.27?","acceptedAnswer":{"@type":"Answer","text":"Yes, CodeQL 2.26.4 added support for analyzing Go 1.27 code. This release also improved alert location precision for Rust data flow queries, meaning some existing alerts will close and reappear at more accurate source and sink locations rather than representing new vulnerabilities. Developers rolling out new Go versions can follow tooling compatibility updates like this on daily.dev."}},{"@type":"Question","name":"What Java security detection improvements were added in CodeQL 2.26.4?","acceptedAnswer":{"@type":"Answer","text":"CodeQL 2.26.4 added SQL injection sink models for Spring R2DBC's DatabaseClient and the R2DBC SPI, plus improved taint propagation through String.valueOf(Object) calls when the argument is a CharSequence such as a String or StringBuilder. These changes help the scanner catch more real injection vulnerabilities in Java and Kotlin codebases. Java teams tightening SQL injection coverage can keep up with scanner updates like this on daily.dev."}}]} ```