CodeQL 2.26.2 が Swift 6.3.3 と Kotlin 2.4.10 のサポートを追加CodeQL 2.26.2 adds Swift 6.3.3 and Kotlin 2.4.10 support

GitHub has released CodeQL 2.26.2, the newest update to the static analysis engine that underpins the platform's code scanning feature, adding support for Swift 6.3.3 and Kotlin 2.4.10. The change matters because it allows teams working with these recent language releases to run security analysis against their code without waiting for their tooling to catch up, keeping vulnerability detection aligned with the compilers and language features that developers are already using in production.

CodeQL is the analysis engine behind GitHub code scanning, a capability designed to find and help remediate security issues in source code. Rather than inspecting text directly, CodeQL builds a relational database that represents the structure and semantics of a codebase, then runs queries against that database to surface patterns associated with vulnerabilities, such as injection flaws, insecure data handling, or unsafe API usage. Because the database mirrors how a program actually behaves, the quality of results depends on the engine being able to parse and model the specific language version in use.

That dependency is precisely why version support updates like this one are meaningful. When a language ships a new release, changes to syntax, additions to the standard library, or altered compilation behavior can prevent older analysis tooling from constructing a complete database. That can reduce coverage or, in some cases, cause the extraction step to fail entirely. By extending support to Swift 6.3.3 and Kotlin 2.4.10, CodeQL 2.26.2 is intended to ensure that projects targeting those versions can be scanned reliably rather than being left on unsupported toolchains.

Swift is Apple's primary language for iOS, macOS, and related platform development, while Kotlin is widely used for Android applications and server-side JVM projects, and increasingly in multiplatform scenarios. Both languages maintain active release cycles, and CodeQL has historically tracked new versions through its own regular update cadence. Staying current with these ecosystems is particularly relevant for organizations that maintain mobile and cross-platform codebases, since it lets them fold security scanning into workflows they already run without introducing compatibility gaps.

Beyond these two languages, CodeQL supports a broad set of ecosystems, including C and C++, C#, Go, Java, JavaScript and TypeScript, Python, and Ruby. Analysis is typically enabled through GitHub Actions using either a default configuration or a more customizable advanced setup, and it can also be run via the CodeQL command-line interface for local or CI use. Findings are reported in the SARIF format and surfaced in a repository's security tab, where they can be triaged, dismissed, or tracked as they are resolved. Code scanning is available at no cost for public repositories, while private repositories generally require the appropriate GitHub security licensing.

The 2.26.2 label reflects CodeQL's incremental release pattern, in which point updates arrive frequently to refine queries, improve extractor accuracy, and add or extend language version support. Updates of this kind are usually adopted automatically for users on GitHub-hosted runners with default setup, meaning many teams will likely receive the new Swift and Kotlin support without manual intervention. Those running pinned versions of the CodeQL CLI or bundle, however, will probably need to upgrade explicitly to take advantage of the expanded coverage.

For development teams, the practical effect appears to be modest but useful: continued assurance that adopting the latest Swift and Kotlin releases will not leave their static analysis behind. Language version support is an area where lag can quietly erode the value of a scan