CodeQL 2.27.0：支持 Linux ARM64，弃用 Java 9/10
CodeQL 2.27.0 adds support for Linux ARM64
使用 GitHub Code Scanning 或自托管 CodeQL 的开发者请注意：Java 9/10 支持将于 2027 年 1 月彻底移除，且通用 zip 包将被弃用。请提前规划迁移至按平台分发的 CLI 版本，避免未来升级受阻。
CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
CodeQL 2.27.0 现已在 Linux ARM64 上可用，新增了 Rust 安全查询，扩展了 Java/Kotlin 和 C# 的框架覆盖范围，并提升了多种语言的分析准确性。CodeQL 是 GitHub 代码扫描背后的静态分析引擎，可帮助您发现并修复代码中的安全问题。
Language and framework support
语言和框架支持
CodeQL CLI
CodeQL CLI
- You can now run CodeQL natively on Linux arm64. Download the CodeQL CLI and CodeQL bundle from the linux-arm64 per-platform release assets.
- GitHub code scanning default setup can now use your organization’s private registry configurations to authenticate with container registries or the GitHub API when fetching custom queries or packs. This lets you use custom content from private Git sources and Docker registries.
- 您现在可以在 Linux arm64 上原生运行 CodeQL。从 linux-arm64 每平台发布资产中下载 CodeQL CLI 和 CodeQL bundle。
- GitHub 代码扫描默认设置现在可以使用组织的私有注册表配置，在获取自定义查询或包时与容器注册表或 GitHub API 进行身份验证。这使您能够使用来自私有 Git 源和 Docker 注册表的自定义内容。
C#
C#
- We’ve improved ASP.NET Core MVC controller and action discovery to more closely match runtime behavior. This improves coverage for application parts, endpoint mappings, inherited actions, as well as controller and action exclusions.
- We’ve added taint tracking support for OData action parameter binding. This improves detection coverage for vulnerabilities involving values extracted from ODataActionParameters and entities tracked by Delta.
- In build-mode: none, CodeQL now always attempts to restore projects and solutions using available NuGet feeds. CodeQL also reports explicitly configured feeds that aren’t reachable, making it easier to identify dependencies that may be missing from analysis.
- 我们改进了 ASP.NET Core MVC 控制器和操作发现功能，使其更贴近运行时行为。这提高了对应用部分、端点映射、继承操作以及控制器和操作排除项的覆盖范围。
- 我们为 OData 操作参数绑定添加了污点跟踪支持。这提高了对涉及从 ODataActionParameters 提取的值以及由 Delta 跟踪的实体的漏洞的检测覆盖率。
- 在 build-mode: none 模式下，CodeQL 现在始终尝试使用可用的 NuGet feed 还原项目和解决方案。CodeQL 还会报告无法访问的显式配置的 feed，从而更容易识别可能缺失于分析中的依赖项。
Java/Kotlin
Java/Kotlin
- We’ve added modeling for the Micronaut framework, including HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.
- 我们添加了对 Micronaut 框架的建模，包括 HTTP 控制器、WebSocket 端点、配置注入、数据访问、安全注解和 HTTP 客户端接收器。
Query changes
查询变更
C/C++
C/C++
- We’ve added PostgreSQL libpq query-execution and prepared-statement functions as SQL injection sinks. Queries such as cpp/sql-injection can now identify vulnerabilities involving PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare.
- 我们将 PostgreSQL libpq 查询执行和预准备语句函数添加为 SQL 注入接收器。cpp/sql-injection 等查询现在可以识别涉及 PQexec、PQexecParams、PQprepare、PQsendQuery、PQsendQueryParams 和 PQsendPrepare 的漏洞。
GitHub Actions
GitHub Actions
- We’ve improved how CodeQL evaluates checks of author-association fields from event payloads. CodeQL now treats these checks as protection only when the event payload provides the relevant field. This may produce additional alerts for workflows that rely on ineffective checks.
- 我们改进了 CodeQL 评估事件负载中 author-association 字段检查的方式。仅当事件负载提供相关字段时，CodeQL 才会将这些检查视为保护措施。这可能会导致依赖无效检查的工作流产生额外的警报。
Rust
Rust
- We’ve added the rust/command-line-injection query to detect uncontrolled command lines.
- We’ve updated the rust/hard-coded-cryptographic-value query to reduce duplicate results with very similar source locations.
- The rust/unused-variable query no longer reports variables in functions that contain the standard todo!() or unimplemented!() macros.
- 我们添加了 rust/command-line-injection 查询以检测不受控制的命令行。
- 我们更新了 rust/hard-coded-cryptographic-value 查询，以减少具有非常相似源代码位置的重复结果。
- rust/unused-variable 查询不再报告包含标准 todo!() 或 unimplemented!() 宏的函数中的变量。
Upcoming Deprecations
即将弃用的功能
- Language support for Java 9 and 10 has been deprecated and will be removed in January 2027. Java 7 and 8 will continue to be supported.
- The generic multi-platform codeql.zip CLI distribution will be removed in a future release. Download the per-platform .zip for your platform instead. The CLI now emits a warning when it is run from an all-platforms distribution; set CODEQL_ALLOW_ALL_PLATFORMS_DIST=true to suppress it.
- Java 9 和 10 的语言支持已被弃用，并将于 2027 年 1 月移除。Java 7 和 8 将继续获得支持。
- 通用的多平台 codeql.zip CLI 发行版将在未来的版本中移除。请改为下载适用于您平台的特定平台 .zip 文件。当从全平台发行版运行 CLI 时，现在会发出警告；设置 CODEQL_ALLOW_ALL_PLATFORMS_DIST=true 以抑制该警告。
For full details, see the CodeQL 2.27.0 changelog. GitHub automatically deploys every new CodeQL version to users of GitHub code scanning on github.com. A future GitHub Enterprise Server (GHES) release will also include the new functionality in CodeQL 2.27.0. If you use an older version of GHES, you can manually upgrade your CodeQL version.
如需完整详情，请参阅 CodeQL 2.27.0 变更日志。GitHub 会自动将每个新的 CodeQL 版本部署给 github.com 上 GitHub 代码扫描的用户。未来的 GitHub Enterprise Server (GHES) 版本也将包含 CodeQL 2.27.0 中的新功能。如果您使用的是旧版本的 GHES，可以手动升级您的 CodeQL 版本。
The post CodeQL 2.27.0 adds support for Linux ARM64 appeared first on The GitHub Blog.
CodeQL 2.27.0 发布后新增对 Linux ARM64 的支持，最初发布于 GitHub 博客。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力