GitHub has released CodeQL 2.27.0 with native Linux ARM64 support as a first-class platform. The September 9, 2026 release gives teams running analysis on Linux ARM64 dedicated CLI and bundle archives, while also expanding analysis for Rust, Java, Kotlin, C#, C/C++, and GitHub Actions.
The release matters most to security engineering and platform teams that run CodeQL outside GitHub.com’s managed code scanning environment. Those teams may need to change how their automation downloads CodeQL, validate analysis on ARM64 hosts, and review changes in alert coverage. GitHub.com code scanning users receive new CodeQL versions automatically, but self-managed environments have platform and distribution decisions to make.
What changed in CodeQL 2.27.0
The central change is support for native Linux ARM64 execution. According to the GitHub release announcement, the CodeQL CLI and CodeQL bundle can now be downloaded as Linux ARM64 per-platform release assets.
The supporting CodeQL CLI 2.27.0 documentation identifies the relevant files:
codeql-linux-arm64.zipfor the Linux ARM64 CLI.codeql-bundle-linux-arm64.tar.gzfor the Linux ARM64 bundle.codeql-bundle-linux-arm64.tar.zstfor the alternative compressed bundle format.
These ARM64 binaries are distributed separately. They are not included in the combined codeql.zip, codeql-bundle.tar.gz, or codeql-bundle.tar.zst archives. This packaging distinction is important for build images, CI jobs, and provisioning scripts that currently assume the combined archives contain every supported platform.
Analysis coverage is also expanding
ARM64 support is not the only change in the release. CodeQL 2.27.0 adds the Rust rust/command-line-injection query, which detects uncontrolled command lines. The release’s Default suite contains 498 security queries covering 170 CWE, while the Extended suite adds 131 queries covering 32 additional CWE. One security query was added in this release.
Several language and framework models have also been updated:
- Java and Kotlin: Micronaut modeling now covers HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.
- C#: ASP.NET Core MVC controller and action discovery now accounts for application parts, endpoint mappings, inherited actions, and controller or action exclusions.
- C# taint analysis: OData action parameter binding is modeled for
ODataActionParametersand entities tracked byDelta<T>. - C/C++: PostgreSQL libpq functions including
PQexec,PQexecParams,PQprepare,PQsendQuery,PQsendQueryParams, andPQsendPrepareare added as SQL query-execution or prepared-statement sinks.
These changes can alter the results produced by analysis. In particular, teams should expect to review new or newly reachable findings in the affected languages and frameworks rather than assuming that an upgrade will produce an identical alert set.
GitHub Actions checks may produce additional alerts
CodeQL’s GitHub Actions analysis now treats author-association checks as protection only when the event payload actually provides the relevant field. Workflows that rely on an author-association condition that is not populated in the relevant event may therefore receive additional alerts.
This is an analysis behavior change, not a statement that CodeQL 2.27.0 itself fixes a vulnerability. Administrators should inspect the workflow events and fields used by their checks, then assess any new results in the context of the workflow’s actual authorization logic.
Distribution and language support changes to plan for
The generic multi-platform CodeQL CLI distribution is deprecated and will be removed in a future release. CodeQL emits a warning when it runs from an all-platforms distribution. Teams that need to suppress that warning can set CODEQL_ALLOW_ALL_PLATFORMS_DIST=true, but the setting does not change the announced deprecation.
For new Linux ARM64 deployments, the documented direction is to use the corresponding per-platform CLI or bundle rather than depending on the deprecated generic distribution. Existing automation should be reviewed for hard-coded archive names, download URLs, extraction paths, and assumptions about which platform binaries are present.
Java 9 and Java 10 language support is also deprecated and scheduled for removal in January 2027. Java 7 and Java 8 remain supported. Organizations that still analyze Java 9 or Java 10 code should account for that date in their upgrade planning instead of treating the current support as permanent.
What developers and administrators should do
- Choose the ARM64 artifact deliberately. On a Linux ARM64 environment, use
codeql-linux-arm64.zipor one of the Linux ARM64 bundle archives. The supplied documentation does not define a complete operating-system compatibility matrix, minimum hardware requirements, or runtime dependency list, so those details should not be assumed from the platform announcement alone. - Test the analysis workflow. Run the organization’s normal database creation and analysis process on the target Linux ARM64 environment, then compare operational behavior and results with the existing workflow. The release confirms first-class native support but does not publish performance expectations.
- Update distribution automation. Locate jobs that fetch
codeql.zipor another all-platforms archive and plan a transition to the appropriate per-platform distribution. The generic archive warning can be suppressed temporarily withCODEQL_ALLOW_ALL_PLATFORMS_DIST=true, but the generic distribution is still scheduled for removal in a future release. - Review changed alert coverage. Pay particular attention to Rust command-line injection, PostgreSQL libpq usage, Micronaut applications, ASP.NET Core MVC code, OData bindings, and GitHub Actions author-association checks.
- Check Java requirements. If the organization analyzes Java 9 or Java 10, plan for their scheduled removal in January 2027. Java 7 and Java 8 support continues under the release information provided.
- Verify private query and pack access. Organizations using private custom queries or packs with Code Scanning Default Setup should ensure that suitable private registry configurations exist for the relevant Git source or Docker registry locations. These configurations support authentication when fetching custom queries or packs.
Availability and GitHub Enterprise Server timing
CodeQL 2.27.0 is dated September 9, 2026, and its Linux ARM64 CLI and bundle assets are available as per-platform downloads. GitHub.com automatically deploys each new CodeQL version to users of GitHub code scanning.
The release announcement says that a future GitHub Enterprise Server release will include the new functionality. It does not identify that release or provide an availability date. Older GHES versions can be manually upgraded according to GitHub’s linked instructions, but the supplied release information does not provide a specific compatibility matrix or detailed upgrade procedure.
For teams operating their own runners or CodeQL tooling, the immediate work is therefore clear: select the Linux ARM64 artifact, test the analysis pipeline, and remove dependence on the generic multi-platform distribution before its future removal.
