CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling

What happened

CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling

GitHub has released CodeQL 2.26.3, an update to the static analysis engine that powers GitHub code scanning. This release focuses on two specific areas: expanded source modeling for JavaScript, TypeScript, and Vue, and improved accuracy across several GitHub Actions queries.

This article walks through exactly what shipped in CodeQL 2.26.3, how it affects developers writing or maintaining CodeQL queries, and what to verify after upgrading. It is aimed at security engineers, developer tooling teams, and anyone who maintains custom CodeQL configurations in their CI pipelines.

What shipped

How it works

CodeQL 2.26.3 delivers new source modeling for JavaScript, TypeScript, and Vue. Source modeling tells CodeQL where attacker-controlled data can enter an application, which is the foundation for tracking taint flows that lead to vulnerabilities. Adding Vue to that list means projects built on Vue components now benefit from more complete data-flow analysis out of the box. The release also addresses accuracy issues in several GitHub Actions queries, which are used to detect misconfigurations and potential supply chain risks in workflow files.

The GitHub Actions query improvements are specifically about accuracy rather than coverage. That means some queries were previously producing false positives or missing certain patterns, and 2.26.3 corrects those behaviors. The combination of better source modeling and more accurate workflow analysis makes this a meaningful maintenance release for teams running code scanning at scale.

What changed for builders

If you maintain custom CodeQL query packs or rely on the standard query suites for JavaScript or TypeScript projects, the new source modeling may surface findings that were not previously reported. This is expected behavior. The sources added cover entry points that CodeQL did not previously track, so any taint flows originating from those sources will now appear in scan results for the first time.

Why it matters

For teams with GitHub Actions workflows that run CodeQL analysis, the improved GitHub Actions queries mean your workflow scans may produce different results compared to prior versions. Queries that previously flagged certain patterns may stop doing so if the behavior was a false positive, and queries that missed patterns may now catch them. Either way, a baseline review of your scan results after upgrading is a reasonable precaution before treating new findings as regressions or dismissing resolved ones as fixed.

How to install or upgrade

If you use GitHub code scanning through GitHub Actions with the default setup or the CodeQL action, GitHub manages the CodeQL version automatically. In most cases your scans will pick up 2.26.3 without any manual intervention on your part. You can confirm which version is running by checking the workflow run logs for the CodeQL initialization step, which reports the engine version being used.

Who is affected

For teams running CodeQL in self-hosted or offline environments, you will need to download the updated CodeQL bundle directly from the CodeQL release assets and update your runner configuration to point to the new version. If you use the CodeQL CLI directly for local analysis or custom automation, update it through your standard package management or download mechanism. The CodeQL documentation on the GitHub repository covers the specific steps for each deployment model.

Gotchas and compatibility

The most common friction point after a CodeQL source modeling expansion is a spike in new findings. Because 2.26.3 adds source coverage for JavaScript, TypeScript, and Vue, any team with alert baseline tracking or suppression rules tied to specific source patterns should audit those configurations after upgrading. A previously suppressed alert may reappear with a slightly different trace if the source node has changed.

On the GitHub Actions query side, if your team uses query result counts as a quality gate or tracks alert trends over time, expect some movement in those numbers immediately after the upgrade. Changes to query accuracy intentionally shift which results are reported, so a sudden drop or rise in GitHub Actions alerts is not necessarily a sign that your workflow configurations changed. Cross-check the specific alerts against the query changes described in the release notes before escalating or closing findings in bulk.

What to watch next

What to watch next

CodeQL's expansion into Vue source modeling is part of a broader pattern of improving coverage for frontend JavaScript ecosystems. Developers working with other Vue-adjacent tools or framework-specific data sources should monitor upcoming releases to see whether that modeling work extends further. The GitHub Actions query improvements also suggest continued investment in workflow security analysis, an area that has grown more prominent as supply chain attacks targeting CI systems have increased in frequency.

For teams building on CodeQL's query libraries, the 2.26.3 release is a good prompt to review your query dependency declarations and ensure you are pulling from a pinned version. Automatic upgrades that change source modeling can affect custom queries that extend or override standard library models. Keeping a documented baseline of expected query results and running a comparison against each CodeQL release is a low-overhead practice that saves debugging time when a future release introduces a similar round of accuracy improvements.