CodeQL 2.26.4 Adds Go 1.27 Support and Sharper Rust Data Flow Alerts

What shipped

CodeQL 2.26.4 is out — the static analysis engine behind GitHub code scanning for finding and remediating security issues in code.

What changed

Per-language highlights:

• Go: support for Go 1.27
• Rust: data flow alert locations now point at the actual source and sink nodes — more precise, but some alerts move and reappear as new ones
• Java/Kotlin: new SQL injection sink models for Spring R2DBC DatabaseClient and R2DBC SPI; taint propagates through String.valueOf(Object) for CharSequence arguments
• Python: taint flow through list.extend and list.insert, matching existing list.append coverage
• JavaScript/TypeScript: support for d-flag regexes and React Native Worklets directives
• C#: the missing-token-validation query now recognizes RequireAntiforgeryToken attributes with antiforgery middleware

Why a builder cares

Coverage just landed where injection bugs hide: Go 1.27 codebases, Spring R2DBC reactive SQL, and Python list-mutation flows. The Rust alert-location change makes triage more actionable — expect a one-time churn of old alerts being closed and re-raised at the true sink.