CodeQL 2.26.3 rewrites how the engine reasons about GitHub Actions workflows and how it walks modern JavaScript flow. Per the DevOps.com writeup dated August 19, the release itself shipped on August 12 and rolls out automatically to code scanning on github.com. Practical read for pipeline owners: the next full analysis may quietly change what your workflows get flagged for, both up and down, before Enterprise Server users see any of it.
What moved in the Actions queries
The changes cluster around the queries that catch pipeline abuse. The output-clobbering query now delivers tailored messages per output channel and stops flagging simple jq path filters that already emit JSON-encoded output, per the DevOps.com summary. Cache-poisoning and untrusted-checkout queries anchor their alert paths at the controlling expression rather than the sink, and cache poisoning now accounts for read-only cache access in low-trust triggers. Environment-variable injection fires only when the untrusted source and the privileged context sit inside the same trigger. The schedule event is now classified correctly for external triggerability.
One breaking change ships with the release: the codeql.actions.security.SelfHostedQuery module has been removed, because the analyzer could not reliably distinguish self-hosted from GitHub-hosted runners. Custom query suites that import it will fail until the reference is pulled.
Where this bites, and the JavaScript side
Alert counts will move on the next scan, and neither direction is a bug. Teams heavy on jq-based workflows get a noise reduction; teams that relied on the self-hosted query lose it outright; cache-poisoning findings may surface on workflows that were quiet last week. Rerun full analyses on protected branches before the next release cut. That is the cheapest way to see what changed on your repo without arguing with the alert history afterwards.
On the language side, 2.26.3 adds flow models for the Vue Composition API (ref, shallowRef, toRef, reactive, computed) and treats Vue Router's useRoute() as a client-side remote source. Sails Action2 controllers and @fastify/rate-limit are now recognised, and promise-wrapped client responses are tracked into their fulfillment values, per the DevOps.com summary. The default suite lists 497 queries across 170 CWE categories; the extended suite adds 131 more across 32 additional CWEs. If your scanning report tracks CWE coverage over time, expect a step in the graph.
