NewsBite analysis · Programming, Security, Tools · Software Release
GitHub Blog
CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling
The release of CodeQL 2.26.3 introduces significant improvements in GitHub Actions queries and JavaScript modeling. It adds support for JavaScript, TypeScript, and Vue source modeling, enhancing the static analysis engine's capabilities to identify security vulnerabilities. Notable improvements include better recognition of untrusted data and updated flow source modeling, which is expected to refine results for common vulnerability queries.
Act nowConfidence: HighImmediate horizon
Published 19 Aug 2026, 21:45 UTC2 min read
Visit original article ↗Lead image — GitHub Blog
Summary
TL;DR
- Introduces support for JavaScript, TypeScript, and Vue source modeling
- Improves accuracy of GitHub Actions security queries
- Recognizes untrusted data in workflows triggered by the merge group event
- Removes the codeql.actions.security.SelfHostedQuery module
- Enhances tracking of promise-wrapped client response data in queries
Interesting facts
- Custom models can now reference specific files using package names
- The update aims to reduce false positives in security queries
- Improvements to flow source models enhance vulnerability identification accuracy