CodeQL Enhancements: Kotlin, React, And Rust Support Expanded

Hey guys! Exciting news in the world of code security! The latest GitHub Changelog highlights significant improvements to CodeQL, the static analysis engine that powers GitHub code scanning. Let's dive into the details of the CodeQL 2.22.2 and 2.22.3 releases and see how they enhance support for Kotlin, React, and Rust, while also bringing important query updates. This update not only expands language support but also significantly improves the accuracy of security issue detection. Let’s explore these enhancements and understand how they can benefit your development workflow. This comprehensive update underscores GitHub's commitment to providing robust tools for secure coding practices.

Language & Framework Support

Enhanced Kotlin Support

For all you Kotlin developers out there, this is huge! CodeQL now fully supports Kotlin 2.2.2x, meaning you can leverage its powerful static analysis to identify potential security vulnerabilities in your Kotlin code. This expansion ensures that your Kotlin projects benefit from the same rigorous security checks as projects written in other supported languages. The improved support includes more accurate detection of common Kotlin-specific issues, providing developers with clearer insights and actionable feedback. This enhancement is particularly crucial for projects utilizing Kotlin in backend services and Android applications, where security is paramount. By integrating CodeQL into your workflow, you can proactively address vulnerabilities and maintain a higher standard of code quality and security.

React Improvements

React developers, you're not left out! The updates include improved taint tracing through the React use function. This means CodeQL can now better track how potentially malicious data flows through your React components, helping you prevent injection attacks and other security flaws. Additionally, parameters of React server functions are now recognized as taint sources, further enhancing the accuracy of vulnerability detection in server-side rendering contexts. These improvements are essential for building secure and robust React applications. By accurately tracing taint sources and sinks, CodeQL helps developers identify and mitigate potential security risks early in the development process. This proactive approach to security is vital for maintaining the integrity and reliability of React-based applications.

Rust in Public Preview

The public preview of Rust language support in CodeQL continues to grow stronger. With these releases, support has been expanded to cover additional security issues and language features. This ongoing development signifies GitHub's dedication to supporting the Rust community and ensuring the security of Rust-based projects. Rust, known for its memory safety and performance, benefits significantly from static analysis tools like CodeQL, which can identify subtle security vulnerabilities that might otherwise go unnoticed. The expanded support includes more comprehensive analysis of Rust's unique features, providing developers with detailed insights and actionable recommendations for improving code security. As Rust gains popularity in critical systems and applications, robust security analysis becomes increasingly important, making CodeQL an invaluable tool for Rust developers.

Query Changes

JavaScript Query Updates

A few older JavaScript queries have been retired, but don't worry, it's for a good reason! They've been superseded by newer, more comprehensive queries in the actions QL pack. Specifically:

• js/actions/pull-request-target has been replaced by actions/untrusted-checkout
• js/actions/actions-artifact-leak has been replaced by actions/secrets-in-artifacts
• js/actions/command-injection has been replaced by actions/command-injection

These changes reflect the continuous evolution of CodeQL and its queries to provide the most accurate and relevant security analysis. The newer queries offer improved detection capabilities and are designed to address emerging security threats more effectively. By consolidating and updating the query set, CodeQL ensures that developers have access to the most advanced tools for identifying and mitigating vulnerabilities in their JavaScript code. This proactive approach to query management is essential for maintaining the effectiveness of static analysis and keeping pace with the ever-changing landscape of web security.

Comprehensive Changelogs

For a deep dive into all the changes, you can check out the full change logs for CodeQL 2.22.2 and CodeQL 2.22.3. These logs provide a detailed breakdown of every update, bug fix, and new feature included in these releases. By reviewing the changelogs, developers can gain a comprehensive understanding of the enhancements and how they can leverage them to improve their code security. The detailed information provided in the changelogs is invaluable for ensuring that CodeQL is used effectively and that its capabilities are fully utilized.

Automatic Deployment and Manual Upgrades

The best part? Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. For those using GitHub Enterprise Server (GHES), these features will be included in GHES 3.19. If you're on an older version of GHES, you can manually upgrade your CodeQL version. This ensures that all users have access to the latest security analysis capabilities, regardless of their deployment environment. The automatic deployment process simplifies the adoption of new features and improvements, while the manual upgrade option provides flexibility for organizations with specific deployment requirements. By keeping CodeQL up-to-date, developers can ensure that they are benefiting from the most advanced security analysis technology available.

Conclusion

The CodeQL updates are a significant step forward in enhancing code security across various languages and frameworks. With improved Kotlin support, React enhancements, and continued advancements in Rust analysis, CodeQL is becoming an indispensable tool for developers. The query updates and automatic deployment further solidify its position as a leading static analysis engine. By leveraging these improvements, developers can build more secure and reliable applications, reducing the risk of vulnerabilities and enhancing overall code quality. So, stay tuned for more updates and keep coding securely!

The original post can be found on The GitHub Blog.

🔗 View original changelog entry

📅 Published: Thu, 14 Aug 2025 21:54:44 +0000