v2.26.3

Immutable release. Only release title and notes can be modified.

Improvements

Commands that accept a --ram option now report a clear error when given a value that is far too large to be a sensible amount of memory in megabytes (for example, a number of bytes passed by mistake), instead of failing with a cryptic "is not an int" message.

Bug Fixes

Fixed the pack upload format to comply with the OCI-image-manifest specification, by ensuring that all required fields are present/valid, and that no extraneous/non-compliant fields are included.
Fixed path canonicalization on Windows so that paths located on substed drives are always resolved to their underlying target paths. Previously, substed drives were not handled consistently by the CodeQL CLI and the language-specific extractors.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported x86-64 platforms (Linux, Windows and macOS). Arm64 binaries are available as a per-platform codeql-PLATFORM.zip only. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.3.

v2.26.2

Immutable release. Only release title and notes can be modified.

Release 2.26.2 (2026-07-23)

Breaking Changes

Removed support for parsing [[-style links in alert messages. This was an undocumented legacy feature that allowed query authors to embed links inline in select clause message strings using [["text"|"url"]] syntax. Queries should use $@ placeholder pairs instead.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.2.

v2.26.1

Immutable release. Only release title and notes can be modified.

Release 2.26.1 (2026-07-15)

There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.1.

v2.26.0

Immutable release. Only release title and notes can be modified.

Improvements

Improved the performance of commands that interact with Git repositories by checking whether the git command-line tool is available at most once per CodeQL CLI invocation.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.0.

v2.25.6

Immutable release. Only release title and notes can be modified.

09b86de

Improvements

When the git executable is available, CodeQL can now obtain configuration and queries from SHA-256 Git repositories, and infer Git metadata about them.

Miscellaneous

The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.11.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.6.

v2.25.5

Immutable release. Only release title and notes can be modified.

Release 2.25.5 (2026-05-21)

There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.5.

v2.25.4

Immutable release. Only release title and notes can be modified.

caa8208

There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.4.

v2.25.3

Immutable release. Only release title and notes can be modified.

Improvements

The codeql database finalize command now accepts the --working-dir
flag. When specified, any extractor pre-finalize scripts will be run in
that directory. If the flag is not used, the scripts will run in the source
root directory (maintaining existing behavior). The flag will also be
automatically passed through when running the higher-level
codeql database create command.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.3.

v2.25.2

Immutable release. Only release title and notes can be modified.

2c725ac

Miscellaneous

The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.10.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.2.

v2.25.1

Immutable release. Only release title and notes can be modified.

Release 2.25.1 (2026-03-27)

Bug Fixes

Fixed a bug where extraction could fail on YAML files containing emoji.

Miscellaneous

Upgraded snakeyaml (which is a dependency of jackson-dataformat-yaml) from 2.3 to 2.6.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.1.