CodeQL 2.27.3 Adds Python 3.15 Syntax And C23 Bit-Precise Integer Support

CodeQL 2.27.3 is available with Python 3.15 syntax support, C23 bit-precise integer handling, and JSON support for data extension files.

The CodeQL CLI now parses files with a .json extension as JSON, allowing Java-style comments alongside the existing YAML format structure. You also get an opt-in "ai" threat model for LLM-generated data that ships with no built-in source models, requiring teams to define sources through data extensions.

Python analysis handles Python 3.15 syntax, including Unicode 17 identifiers and unary plus in match literal patterns, while recognizing frozendict and sentinel builtins. The py/xxe, py/xml-bomb, and py/nosql-injection queries use remote flow sources by default and include data extension sources based on the configured threat model.

C and C++ analysis adds support for C23 _BitInt(N) types, BlazingMQ flow summaries, and reduced false positives in cpp/resource-not-released-in-destructor. C# passes proxy and certificate environment variables to the NuGet CLI for private registries and tracks data flow through positional patterns in is expressions and switch cases. Java and Kotlin recognize case-insensitive URI.getHost() allowlist comparisons. Ruby treats Grape::API request sub-accessors as remote flow sources.

A breaking change affects custom GitHub Actions queries, as the control flow graph now uses the shared CFG library. Legacy Completion classes are gone, requiring authors to update queries that depend on specific CFG nodes, edges, or basic block boundaries by switching to edge labels like DirectSuccessor, BooleanSuccessor, and ReturnSuccessor.