Summary
GitHub rolled CodeQL 2.26.4 into code scanning on github.com with Go 1.27 support, more precise Rust data-flow locations, new Spring R2DBC SQL-injection sinks and expanded Java, Kotlin, JavaScript, TypeScript and Python taint modelling. The release also adds GitHub Actions detections for mutable references to reusable workflows and improves checks on workflow actor fields.
Why it matters
The update improves automated detection across application code and CI configuration. The reusable-workflow checks are particularly relevant to software supply-chain and build-pipeline security.
Related coverage
- NVIDIA agrees to acquire Hugging Face for $12.93 billion
- Meta releases Muse Spark 1.3 for coding and agentic workflows
- GitHub details cost reductions in AI coding without reported quality loss