New Features

• CodeQL now supports native Linux arm64 (linux-arm64) as a first-class platform. The per-platform CLI (codeql-linux-arm64.zip) and CodeQL bundle (codeql-bundle-linux-arm64.tar.gz and codeql-bundle-linux-arm64.tar.zst) are available as release assets. Arm64 binaries are provided as a per-platform download only, and are not included in the combined codeql.zip, codeql-bundle.tar.gz, or codeql-bundle.tar.zst.
• CodeQL can now take advantage of an organization's private registry configurations in Code Scanning Default Setup to authenticate to container registries or the GitHub API when trying to fetch custom queries or packs. This allows custom queries or packs to be accessed from private locations in Code Scanning Default Setup as long as suitable "Git Source" or "Docker Registry" private registry configurations are set up for the organization.

Deprecations

• Language support for Java 9 and 10 has been deprecated and will be removed in January 2027. Java 7 and 8 will continue to be supported.
• The generic multi-platform codeql.zip CLI distribution is deprecated and will be removed in a future release. Download the per-platform codeql-PLATFORM.zip for your platform instead. The CLI now emits a warning when it is run from an all-platforms distribution; set CODEQL_ALLOW_ALL_PLATFORMS_DIST=true to suppress it.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which covers Linux x64, Windows x64 and macOS (including Apple Silicon). Linux arm64 binaries are available as a per-platform codeql-linux-arm64.zip only. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.27.0.

New Features

• codeql test run now supports the --reuse-dataset option, which reuses an existing test database from a previous run when available, skipping database extraction. This can speed up repeated test runs when only the query under test has changed. The option implies --keep-databases.

Bug Fixes

• The Java Autobuilder now expands project properties, such as ${maven.version}, when determining Maven version requirements specified by the Maven Enforcer Plugin. The Java Autobuilder now also supports Maven versions through 3.9.16.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported x86-64 platforms (Linux, Windows and macOS). Arm64 binaries are available as a per-platform codeql-PLATFORM.zip only. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.4.

Improvements

• Commands that accept a --ram option now report a clear error when given a value that is far too large to be a sensible amount of memory in megabytes (for example, a number of bytes passed by mistake), instead of failing with a cryptic "is not an int" message.

Bug Fixes

• Fixed the pack upload format to comply with the OCI-image-manifest specification, by ensuring that all required fields are present/valid, and that no extraneous/non-compliant fields are included.
• Fixed path canonicalization on Windows so that paths located on substed drives are always resolved to their underlying target paths. Previously, substed drives were not handled consistently by the CodeQL CLI and the language-specific extractors.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported x86-64 platforms (Linux, Windows and macOS). Arm64 binaries are available as a per-platform codeql-PLATFORM.zip only. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.3.

Release 2.26.2 (2026-07-23)

Breaking Changes

• Removed support for parsing [[-style links in alert messages. This was an undocumented legacy feature that allowed query authors to embed links inline in select clause message strings using [["text"|"url"]] syntax. Queries should use $@ placeholder pairs instead.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.2.

Release 2.26.1 (2026-07-15)

• There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.1.

Improvements

• Improved the performance of commands that interact with Git repositories by checking whether the git command-line tool is available at most once per CodeQL CLI invocation.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.26.0.

Improvements

• When the git executable is available, CodeQL can now obtain configuration and queries from SHA-256 Git repositories, and infer Git metadata about them.

Miscellaneous

• The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.11.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.6.

Release 2.25.5 (2026-05-21)

• There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.5.

• There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.4.

Improvements

• The codeql database finalize command now accepts the --working-dir
  flag. When specified, any extractor pre-finalize scripts will be run in
  that directory. If the flag is not used, the scripts will run in the source
  root directory (maintaining existing behavior). The flag will also be
  automatically passed through when running the higher-level
  codeql database create command.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.3.