CodeQL adds Go 1.27 support and refines alerts

GitHub announced CodeQL 2.26.4 on September 3, adding Go 1.27 support and security-detection refinements. In Rust, data-flow alert locations became more precise; some alerts may appear as new while earlier ones close.

That detail helps developers avoid misreading a project’s security dashboard. A tool may improve how it points to a problem that already existed. A change in the count needs investigation before becoming a conclusion about the quality of an application update.

Our editorial advice is to compare the affected code, data path and analyzer version. Read the alert’s context and record why it was fixed or dismissed. An isolated count makes a poor security score, especially when the detector is changing too.

We did not run CodeQL against a repository for this report. The news matters because automated analysis is itself evolving software. If you maintain a library or a game with online services, follow changes both in your code and in the tool inspecting it. This helps distinguish a newly discovered issue, a newly located alert and a defect actually introduced by a recent change.

Sources: GitHub. Checked September 10, 2026. Document-based reporting; no hands-on test.