CodeQL 2.26.3 adds JavaScript, TypeScript, and Vue source modeling and improves the accuracy of several GitHub Actions queries. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
Language and framework support
GitHub Actions
Analysis now recognizes untrusted data in github.event.merge_group for workflows triggered by the merge_group event.
Breaking change: We’ve removed the codeql.actions.security.SelfHostedQuery module because runner labels don’t reliably distinguish self-hosted runners from managed runners. You’ll need to update any custom queries that rely on this module.
