CodeQL 2.27.2 is available with broader analysis support, but two compatibility changes matter before teams update self-managed scanners or custom query packs. GitHub says traced autobuild and manual analysis for compiled languages will not work on macOS 27 with any Xcode version, or on macOS 26 when Xcode 27 is selected. The release also replaces the Go control-flow graph implementation with CodeQL’s shared CFG library.
The October 9 release notice says GitHub.com code scanning receives the new version automatically. Teams running the CLI directly, maintaining custom Go queries, or pinning their own macOS runners have the larger migration task.
The macOS boundary is about traced builds
GitHub attributes the limit to Apple no longer shipping the multi-architecture x86-64/arm64 binaries that CodeQL requires for traced analysis. The unsupported combinations are specific: compiled-language autobuild and manual modes on macOS 27, plus macOS 26 paired with Xcode 27. GitHub’s stated supported ceiling for those modes is macOS 26 with Xcode 26.
This does not mean every CodeQL job on macOS stops working. It means workflow owners should distinguish traced compiled-language extraction from build-mode: none and from interpreted-language analysis. A runner image that floats to the newest Xcode can cross the boundary without a query-pack change, so the operating-system and Xcode versions belong in the same upgrade review as the CodeQL bundle.
Custom Go queries may see different nodes and blocks
The rewritten Go CFG adds nodes for assignments, parameters and results, range statements, and deferred calls. It also excludes nodes unreachable from the entry point. GitHub warns that nodes, edges, source locations, textual representations and basic-block boundaries can change, which is more consequential than a renamed class for queries that assert an exact graph shape.
The API changes include removal of BasicBlocks::Cfg, new ControlFlow::EntryNode and ControlFlow::ExitNode classes, and a new SwitchStmt.getExpr. IfStmt.getCond is deprecated in favor of IfStmt.getCondition; return types for IfStmt.getThen and LoopStmt.getBody change to Stmt.
The release also expands modeled behavior
CodeQL now parses the ECMAScript grammar used by C++ std::regex, adds Comdb2 C API SQL-injection sinks, improves Rust data flow through async blocks used with await, and recognizes Workflow SDK directives in JavaScript and TypeScript. The published changelog counts 498 queries covering 170 CWEs in the Default suite; the Extended suite adds 131 queries covering 32 more CWEs.
For an upgrade, the immediate checks are therefore narrow: pin or inspect macOS/Xcode runner versions for traced compiled-language jobs, compile custom Go query packs against 2.27.2, and review tests that compare exact CFG shapes or basic-block boundaries. The open question is how quickly build-mode: none can cover more macOS compiled-language projects; GitHub says work is underway but gives no release date.
