CodeQL 2.27.3 破坏性变更：CFG迁移与Completion类移除
CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions
如果你维护 GitHub Code Scanning 的自定义查询，必须立即检查是否使用了被移除的 Completion 类或旧版 CFG 结构，否则扫描将失效。
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.27.3. It supports new Python 3.15 language features, adds JSON syntax for data extensions, adds C23 bit-precise integers, and includes accuracy improvements across languages.
CodeQL 是 GitHub 代码扫描背后的静态分析引擎，用于发现和修复代码中的安全问题。我们最近发布了 CodeQL 2.27.3。它支持新的 Python 3.15 语言特性，为数据扩展添加了 JSON 语法，增加了 C23 位精确整数，并包含跨语言的准确性改进。
Language and framework support
语言和框架支持
CodeQL CLI
- Data extension files now support JSON syntax, using the same structure as YAML data extensions. Java-style comments (// ... and /* ... */) also work. CodeQL parses files with the .json extension as JSON and continues to parse all other files as YAML.
- We’ve added an opt-in ai threat model for LLM-generated data. It doesn’t include any built-in source models, so you can define your own sources with data extensions.
- 数据扩展文件现在支持 JSON 语法，使用与 YAML 数据扩展相同的结构。Java 风格的注释（// ... 和 /* ... */）也可以使用。CodeQL 将 .json 扩展名的文件解析为 JSON，并继续将所有其他文件解析为 YAML。
- 我们为 LLM 生成的数据添加了一个可选的 ai 威胁模型。它不包含任何内置的源模型，因此您可以使用数据扩展定义自己的源。
Python
- The Python extractor now supports Python 3.15 syntax, including unary plus in match literal patterns and Unicode 17 identifiers.
- We’ve added support for the new frozendict and sentinel builtins introduced in Python 3.15, including data flow modeling for frozendict construction.
- Python 提取器现在支持 Python 3.15 语法，包括匹配字面量模式中的前缀加号和 Unicode 17 标识符。
- 我们新增了对 Python 3.15 中引入的新内置函数 frozendict 和 sentinel 的支持，包括对 frozendict 构造的数据流建模。
C/C++
- We’ve added support for C23 bit-precise integers (_BitInt(N)).
- We’ve added flow summaries for the BlazingMQ BloombergLP::bmqa::Message and MessageProperties classes and their iterators.
- 我们新增了对 C23 位精确整数 (_BitInt(N)) 的支持。
- 我们为 BlazingMQ BloombergLP::bmqa::Message 和 MessageProperties 类及其迭代器添加了流程摘要。
C#
- We’ve added support for data flow through positional patterns in is expressions and switch cases.
- When you configure private registries, CodeQL now passes the required proxy and certificate environment variables to the NuGet CLI.
- 我们新增了对 is 表达式和 switch 案例中位置模式数据流的支持。
- 当您配置私有注册表时，CodeQL 现在会将所需的代理和证书环境变量传递给 NuGet CLI。
Ruby
- CodeQL now treats Grape::API request sub-accessors as remote flow sources. These include body.read, body.string, params, GET, POST, cookies, env, query_string, and path_info.
- CodeQL 现在将 Grape::API 请求子访问器视为远程流程源。这些包括 body.read、body.string、params、GET、POST、cookies、env、query_string 和 path_info。
Query changes
查询更改
C/C++
- The cpp/resource-not-released-in-destructor query now recognizes resources released through local aliases, reducing false positives.
- cpp/resource-not-released-in-destructor 查询现在识别通过局部别名释放的资源，从而减少误报。
C#
- The cs/simplifiable-boolean-expression query now produces fewer false positives when type information is incomplete.
- 当类型信息不完整时，cs/simplifiable-boolean-expression 查询现在产生的误报更少。
Java/Kotlin
- The java/ssrf and java/unvalidated-url-redirection queries now recognize case-insensitive comparisons of URI.getHost with fixed allowlist entries. They also recognize these checks when code stores the host in a local variable, which reduces false positives.
- java/ssrf 和 java/unvalidated-url-redirection 查询现在识别 URI.getHost 与固定白名单条目的不区分大小写的比较。当代码将主机存储在局部变量中时，它们也能识别这些检查，从而减少误报。
Python
- The py/xxe, py/xml-bomb, and py/nosql-injection queries now respect your configured threat model when selecting untrusted data sources. By default, they still use remote flow sources. These queries now also include sources you model with data extensions.
- py/xxe、py/xml-bomb 和 py/nosql-injection 查询在选择不受信任的数据源时，现在会尊重您配置的威胁模型。默认情况下，它们仍使用远程流源。这些查询现在也包含您通过数据扩展建模的来源。
Breaking changes
破坏性变更
- GitHub Actions: The GitHub Actions control flow graph (CFG) now uses the shared CFG library. If your custom queries rely on specific CFG nodes, edges, or basic block boundaries, you may need to update them. We’ve removed the legacy Completion classes, so use CFG edge labels such as DirectSuccessor, BooleanSuccessor, and ReturnSuccessor instead.
- GitHub Actions：GitHub Actions 控制流图（CFG）现在使用共享 CFG 库。如果您的自定义查询依赖于特定的 CFG 节点、边或基本块边界，您可能需要更新它们。我们已移除旧的 Completion 类，因此请改用 CFG 边标签，如 DirectSuccessor、BooleanSuccessor 和 ReturnSuccessor。
For a full list of changes, please refer to the complete changelog for version 2.27.3. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.27.3 will also be included in GitHub Enterprise Server (GHES) 3.24 release. If you use an older version of GHES, you can manually upgrade your CodeQL version.
有关所有变更的完整列表，请参阅版本 2.27.3 的完整更改日志。CodeQL 的每个新版本都会自动部署到 github.com 上使用 GitHub 代码扫描的用户。CodeQL 2.27.3 中的新功能也将包含在 GitHub Enterprise Server (GHES) 3.24 版本中。如果您使用的是旧版本的 GHES，可以手动升级您的 CodeQL 版本。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力