CodeQL’s Latest Round of Updates: New Languages, More Queries, and Faster Scans
CodeQL, the semantic analysis engine behind GitHub code scanning, has seen a steady stream of improvements over the past year. The updates span new language support, expanded vulnerability coverage, and several usability tweaks that make the tool easier to integrate into existing workflows. Here’s a rundown of what’s changed and how it affects your scanning setup.
Language Coverage Expands
The headline addition is the general availability of Ruby support, which was announced at GitHub Universe 2022. Since the beta period, the number of default queries has doubled, and the query set now covers all Ruby-related OWASP categories out of the box. Performance has also been tuned: 90% of beta users saw their tests complete in under five minutes. The uptake has been significant, with users fixing over 4,000 alerts so far and GitHub running nearly 5,000 Ruby analyses on an average day.
Ruby has been a vital part of our SDLC for many years, as it allows us to build flexible applications to meet our evolving needs. The ability to scan Ruby codebases and identify and remediate vulnerabilities all within GitHub means that our developers are able to secure their code without disrupting their workflow.
For mobile developers, Kotlin support is now available in beta. CodeQL natively handles Kotlin as well as mixed Java and Kotlin projects. Because Kotlin support builds on the existing Java implementation, it inherits all current Java queries for both mobile and server-side code. This marks GitHub’s first push into mobile application security, with Swift support in beta expected later this year.
Existing language support has also been brought up to date. The engine now offers full support for Java 19, Go 1.19, and Python 3.11, along with build support for C# 11. That means teams can scan more of their current codebases without waiting for tooling to catch up.
Deeper Analysis With an Expanded Query Library
CodeQL’s default query set has grown to 318 security queries, a 27% increase year over year. If you need broader coverage, an extended query pack can push that number up to 432. These queries are written and maintained by GitHub’s security researchers and community contributors, and they can be supplemented with custom queries for project-specific issues.
Together with Dependabot alerts, the current query coverage spans all applicable OWASP categories, the full SANS CWE Top 25, and every applicable WASC category. That gives security teams confidence that scans are catching the most critical vulnerabilities, while developers can review findings directly within the pull request. A dedicated CWE coverage page details exactly which weaknesses are addressed, and the supported languages and frameworks page tracks library and framework updates with links to per-language query changelogs.
A Smoother, Faster User Experience
A few workflow improvements are worth noting. CodeQL pack support is now available for code scanning on both GitHub.com and GitHub Enterprise, making it easier to manage and share queries. Query filters have also been introduced, letting you exclude specific checks that don’t apply to your codebase. The result is a more focused alert list that highlights the security checks most relevant to your project.
Performance has gotten a boost as well: CodeQL now runs analyses 16% faster, according to GitHub, without sacrificing precision or altering the false-positive rate.
Security researchers benefit from a new convenience: CodeQL databases for popular open source projects are now pre-built and stored, ready to be pulled down through the CodeQL extension for VS Code. That removes a chunk of setup work when writing and testing custom queries.
Community contributions have played a role in expanding the out-of-the-box query set, with users actively helping to add new checks for security risks this year.
Getting Started
For repos on GitHub, code scanning with CodeQL can be enabled via the new default setup option. CodeQL remains free for open source projects. Private repositories require GitHub Advanced Security as an add-on to a GitHub Enterprise subscription.
