From a487c20bcacf847fee9198f3cce9d11b146d0df2 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Wed, 9 Sep 2026 12:53:19 +0100 Subject: [PATCH 1/5] Update changelog for 2.27.0 --- CHANGELOG.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 528064b..08668a5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,33 @@ you know what to do). --> +## Release 2.27.0 (2026-09-09) + +### New Features + +- CodeQL now supports native Linux arm64 (`linux-arm64`) as a first-class + platform. The per-platform CLI (`codeql-linux-arm64.zip`) and CodeQL bundle + (`codeql-bundle-linux-arm64.tar.gz` and `codeql-bundle-linux-arm64.tar.zst`) + are available as release assets. Arm64 binaries are provided as a per-platform + download only, and are not included in the combined `codeql.zip`, + `codeql-bundle.tar.gz`, or `codeql-bundle.tar.zst`. +- CodeQL can now take advantage of an organization's private registry + configurations in Code Scanning Default Setup to authenticate to container + registries or the GitHub API when trying to fetch custom queries or packs. + This allows custom queries or packs to be accessed from private locations in + Code Scanning Default Setup as long as suitable "Git Source" or "Docker + Registry" private registry configurations are set up for the organization. + +### Deprecations + +- Language support for Java 9 and 10 has been deprecated and will be removed in + January 2027. Java 7 and 8 will continue to be supported. +- The generic multi-platform `codeql.zip` CLI distribution is deprecated and + will be removed in a future release. Download the per-platform + `codeql-PLATFORM.zip` for your platform instead. The CLI now emits a warning + when it is run from an all-platforms distribution; set + `CODEQL_ALLOW_ALL_PLATFORMS_DIST=true` to suppress it. + ## Release 2.26.4 (2026-08-26) ### New Features From 778dd2254be47d7d9e039a8c412032ad18126941 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Tue, 22 Sep 2026 19:03:09 +0100 Subject: [PATCH 2/5] Update changelog for 2.27.1 --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 08668a5..3c92ea5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,18 @@ you know what to do). --> +## Release 2.27.1 (2026-09-22) + +### Miscellaneous + +- The build of Eclipse Temurin OpenJDK that is used to run the CodeQL + CLI has been updated to version 25.0.4.1. + + New Java releases may not be completely backwards compatible. For example, + Java 25 has a known issue that affects symlink resolution on mapped drives + on Windows (JDK-8355342). Users impacted by such regressions can run CodeQL + with an alternative JDK using the CODEQL_JAVA_HOME environment variable. + ## Release 2.27.0 (2026-09-09) ### New Features From be2e13da582056f1e5f7854b361e4aac241eddb8 Mon Sep 17 00:00:00 2001 From: Mads Navntoft Date: Wed, 7 Oct 2026 12:08:10 +0200 Subject: [PATCH 3/5] Update CHANGELOG for release 2.27.2 Added release notes for version 2.27.2, detailing improvements, bug fixes, and miscellaneous changes. --- CHANGELOG.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3c92ea5..a7ac1df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,42 @@ you know what to do). --> +## Release 2.27.2 (2026-10-07) + +### Improvements + +- Error and warning messages printed to standard error are now labelled with an + `ERROR: ` or `WARNING: ` prefix. Previously only diagnostics carried such a + label, so the severity of other messages was not apparent in plain-text + output. Structured output is unaffected: log files, SARIF, and stored + diagnostics continue to record severity without the prefix. +- The `codeql query compile` command now accepts the `--dil-constants` + flag. When specified along with `--dump-dil`, the emitted DIL + will include the values of predicates that have been optimized into + constant tuple sets. Otherwise, these constants are omitted. This flag + also enables pretty-printing of constant tuple sets for higher-level + commands that involve query compilation. + +### Bug Fixes + +- Fixed a crash in `codeql resolve queries` (and other commands that + resolve query suites) that reported a fatal internal error when a suite + entry's `qlpack:` or `from:` value was not a valid QL pack name. Such + input now produces a clear, user-facing error instead. +- Fixed a bug in the handling of YAML data extensions that would quietly accept integers outside of + the signed 64-bit range, truncating them to smaller values. (Values outside of the signed 32-bit + range, but inside the signed 64-bit range, were correctly rejected.) Now, all integers outside of + the signed 32-bit range are rejected and will cause evaluation to fail. + +### Miscellaneous + +- CLI commands that load data extensions, such as `codeql database run-queries`, + previously emitted a warning for each file-pattern from the `dataExtensions` + list of a `qlpack.yml` manifest that failed to match any extension files. + This check has been relaxed, and will now only emit a warning if none of the + patterns match any files (i.e. when there is at least one pattern but no + extensions are found). + ## Release 2.27.1 (2026-09-22) ### Miscellaneous From b8920d6194a72a8c567808f64943929acbd9a3d9 Mon Sep 17 00:00:00 2001 From: Mario Campos Date: Tue, 20 Oct 2026 13:44:37 -0500 Subject: [PATCH 4/5] Update CHANGELOG for release 2.27.3 Added release notes for version 2.27.3, including breaking changes, improvements, and bug fixes. --- CHANGELOG.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a7ac1df..d0da00c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,27 @@ you know what to do). --> +## Release 2.27.3 (2026-10-20) + +### Breaking Changes + +- With the release of macOS 27 and Xcode 27, Apple stopped shipping multi-architecture x86-64/arm64 binaries. These binaries are required by CodeQL to perform traced analysis. For this reason, CodeQL's `autobuild` and `manual` build modes will not be supported for compiled languages on macOS 27 with any Xcode version, and on macOS 26 when Xcode 27 is selected. + +### Improvements + +- Data extension files now support JSON syntax, with the same structure as + existing YAML data extensions. Java-style comments (`// ...` and `/* ... */`) + are also supported. Files using the `.json` extension will be parsed as JSON, + while all other files will continue to be parsed as YAML. +- The `codeql test run` feature to load a data extension named `.ext.yml` + when running `.ql` or `.qlref` has been updated to support JSON + data extensions, and files named `.ext.json` will now also be loaded + automatically. + +### Bug Fixes + +- Fixed a bug that caused database downgrades to fail for GitHub Actions databases. + ## Release 2.27.2 (2026-10-07) ### Improvements From 3899e53b0d39b9dfac529c0061332fa39c2de686 Mon Sep 17 00:00:00 2001 From: Henry Mercer Date: Mon, 2 Nov 2026 16:48:36 +0000 Subject: [PATCH 5/5] Update changelog for 2.27.4 --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index d0da00c..1e627f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,18 @@ you know what to do). --> +## Release 2.27.4 (2026-11-02) + +### Security Fixes + +- `codeql pack bundle` and `codeql pack publish` now check that each file added to the pack archive + is still inside the pack root after symbolic links are resolved. Files that resolve to a location + outside the pack root are omitted from the archive with a warning. + +### Bug Fixes + +- The CodeQL CLI now writes messages from the Java virtual machine, such as warnings and initialization errors, to standard error instead of standard output. Previously, these messages could corrupt the output of commands that print JSON or other machine-readable output. + ## Release 2.27.3 (2026-10-20) ### Breaking Changes