GitHub released CodeQL 2.27.1 on September 25, 2026 with Kotlin 2.4.20 support, a Kotlin K2 extraction fix, improved Fastify route attribution, new C/C++ and C# queries, expanded Go/Rust data-flow models, and GitHub Actions unpinned-tag accuracy changes. These changes can legitimately add findings, remove false positives, or change which routes and dependencies are modeled. Treat the upgrade as an analyzer change: capture the pre-upgrade alert baseline, upgrade CodeQL in a controlled branch or runner, compare added/removed alerts by query and language, run the application's own tests and security checks, and only then promote the new analyzer version. Do not bulk-dismiss changed results as 'version noise' or assume a quieter scan proves the code became safer.
A Kotlin 2.4.20 or K2 project produces unsupported-version behavior or false positives before the analyzer update
Fastify routes configured through chainable methods are misattributed, causing missing-rate-limiting results to appear or disappear unexpectedly
GitHub Actions actions/unpinned-tag findings remain for references that are actually covered by a structurally valid actions.lock file
A CodeQL upgrade suddenly adds or removes findings in C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript or Rust and the team cannot tell whether the code changed
Possible causes
CodeQL 2.27.1 changes language extraction and data-flow models, so analysis behavior can change even when application source is unchanged
The release adds cpp/ambiguous-assignment-of-comparison and cs/linq/missed-firstordefault queries
Fastify route attribution now recognizes chainable server configuration such as withTypeProvider and setValidatorCompiler
The actions/unpinned-tag query now recognizes structurally valid .github/workflows/actions.lock entries and same-repository $/ references
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Record the current CodeQL version, language matrix, query suites and alert counts before changing the analyzer. Save enough metadata to compare query IDs rather than only total alert count.
Step 2. Read the GitHub 2.27.1 release notes for the languages present in the repository. Do not assume every listed change affects every codebase.
Step 3. For Kotlin 2.4.20 or K2 projects, rerun database creation and analysis after the upgrade and specifically review findings previously affected by Foo::class.java extraction. GitHub says the extraction fix can reduce false positives such as java/android/implicit-pendingintents.
Step 4. For Fastify applications, include routes created through chainable setup such as fastify().withTypeProvider() and fastify().setValidatorCompiler(...) in regression fixtures. Recheck missing-rate-limiting and other route-sensitive findings because improved attribution may add real results or remove false positives.
Step 5. For GitHub Actions, verify .github/workflows/actions.lock is structurally valid and covers the enclosing workflow before expecting actions/unpinned-tag findings to disappear. Treat any remaining external action reference independently instead of blanket-suppressing the query.
Step 6. For C/C++, triage the new cpp/ambiguous-assignment-of-comparison results as code findings, not as an automatic breaking change. Confirm whether each assignment/comparison expression is intentional and covered by tests.
Step 7. For C#, review the new LINQ suggestion query separately from security findings, and recheck antiforgery-token alerts where AutoValidateAntiforgeryTokenAttribute is registered globally because 2.27.1 improves that recognition.
Step 8. For Go and Rust, rerun representative taint/data-flow fixtures after the new standard-library and core::fmt::Write models. Added paths may be expected because the analyzer now follows flows it previously missed.
Step 9. Compare the before/after alert set by query ID, file and path. Classify each delta as new query coverage, improved modeling, false-positive reduction, application regression or unresolved behavior.
Step 10. Run typecheck/build/tests and any independent SAST/DAST or framework security tests used by the project. Promote the analyzer only after the application and CI gates remain clean.
Step 11. If you run GitHub Enterprise Server, verify your actual CodeQL delivery path. GitHub says GHES 3.24 includes the 2.27.1 functionality; older GHES versions can manually upgrade CodeQL, so do not infer server support from github.com rollout alone.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
1. Did the application source change? If yes, separate code diffs from analyzer-version diffs before attributing alert changes.
2. Did a finding disappear after 2.27.1? Check the release notes for an extraction or accuracy fix and verify the underlying control still exists.
3. Did a finding appear after 2.27.1? Check whether it comes from a new query or improved data-flow/route modeling before deciding whether it is a regression.
4. Is the behavior specific to github.com or GHES? Confirm the deployed CodeQL version and server release before troubleshooting the query itself.
5. Do representative tests and independent controls still pass after triage? If no, stop rollout and resolve the application or CI regression first.
REPAIR FLOW
A visual path from symptom to verified production.
Observe→
Protect→
Isolate→
Repair→
Test→
Publish→
Verify live
BEFORE YOU PASTE CODE
Protect the working site first.
Upgrade the analyzer on a controlled branch or representative repository before broad rollout.
Keep security query changes reviewable and preserve the previous working CodeQL version as a rollback point.
Use synthetic or non-sensitive fixtures when reproducing taint-flow and route-attribution behavior.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not bulk-dismiss every new alert merely because it appeared after the analyzer upgrade.
Do not treat removed alerts as proof the underlying code was fixed; confirm whether query modeling or extraction changed.
Do not pin an obsolete analyzer indefinitely just to preserve a quieter dashboard when the supported upgrade path is available.
Do not change production authentication, rate-limiting or workflow-pinning controls solely to satisfy a static-analysis result without verifying runtime behavior.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Yes. GitHub says CodeQL 2.27.1 supports Kotlin 2.4.20 and fixes Foo::class.java extraction when using the Kotlin K2 compiler.
Why might Fastify alerts change after the upgrade?
CodeQL now recognizes Fastify servers configured through chainable methods such as withTypeProvider and setValidatorCompiler. Better route attribution can add findings for unprotected routes and remove false positives where global plugins protect routes.
Will actions.lock always remove unpinned-tag alerts?
No. GitHub says the query recognizes actions pinned by a structurally valid .github/workflows/actions.lock entry for the enclosing workflow. A missing, invalid or unrelated lock entry should not be assumed to suppress the finding.
Is CodeQL 2.27.1 automatically on GitHub code scanning?
GitHub says new CodeQL versions are automatically deployed to GitHub code scanning on github.com. GHES release timing is separate; GitHub says GHES 3.24 includes this functionality.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
