CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.25.5, which includes accuracy improvements across C/C++, Java/Kotlin, and GitHub Actions queries.
Language and framework support
Java/Kotlin
We’ve introduced a new sink kind, path-injection[read], for Models-as-Data rows that only read from a path (such as ClassLoader.getResource, FileInputStream, and FileReader). This helps queries distinguish read-only path sinks from more dangerous ones.
GitHub Actions
