CodeQL 2.26.2 adds Swift 6.3.3 and Kotlin 2.4.10 support

GitHub has released CodeQL 2.26.2, the latest version of the static analysis engine that powers GitHub code scanning. The release adds language support for Swift 6.3.3 and Kotlin 2.4.10 so projects on those toolchains can be analyzed with the same engine used to find and remediate security issues in code.

CodeQL works as a queryable model of source code: it extracts a database from a project and runs security queries against that model rather than relying only on pattern matching or linters. Version support matters because the extractor and query pack must understand the language surface of the compiler or toolchain under test. By extending coverage to Swift 6.3.3 and Kotlin 2.4.10, GitHub is aligning the analyzer with current Swift and Kotlin releases so scans stay valid as teams upgrade dependencies and language versions.

For engineers, outdated language support is a practical gap, not a theoretical one. If the scanner cannot parse or model a newer Swift or Kotlin version, either the scan fails, coverage drops, or teams delay upgrades to stay inside the supported window. Aligning CodeQL with these language versions reduces that friction for mobile, server, and multiplatform codebases that already use GitHub code scanning as part of CI.

In the market for application security tooling, first-party integration with the host platform is a durable advantage. CodeQL sits inside GitHub’s scanning product, so language support updates land where many teams already enable security checks. Competing SAST products still need to match the same language versions if they want parity on Swift and Kotlin shops; this release is a reminder that analyzer coverage tracks language release cadence, not only new query packs.

What to watch next is whether your repos that use Swift or Kotlin are already on 6.3.3 or 2.4.10 (or will move there soon), and whether your code scanning workflow is pinned to a CodeQL version that includes 2.26.2. Teams that pin the action or CLI should plan a controlled bump so the new language support is actually in use rather than sitting unused behind an older pack.