Issues

• Python: model MCP server handler parameters (mcp, fastmcp) as remote sources

  github/codeql#22702 · Filter by author Alex-Hofer opened on Sep 30, 2026
  1

• actions/unpinned-tag: recognize GitHub Immutable Releases per-tag instead of a static repo allow-list

  github/codeql#22674 · Filter by author jessehouwing opened on Sep 24, 2026
  4

• C++ extractor crashes with coordinates_of_template_param_symbol assertion on a dependent default non-type template parameter used through a libc++ alias over a pack

  bugC++
  github/codeql#22658 · Filter by author jaf0rk opened on Sep 23, 2026
  5

• [aw] Detection Runs

  agentic-workflows
  github/codeql#22642 · Filter by author github-actions opened on Sep 22, 2026
  1

• JavaScript externs model StorageEvent() with no type argument

  false-positivejavascript
  github/codeql#22632 · Filter by author jmcerda opened on Sep 20, 2026
  1

• Python: isType treats any object in a module named *typing as a type, corrupting points-to for unrelated containers

  false-positive
  github/codeql#22621 · Filter by author mauvilsa opened on Sep 18, 2026
  3

• barrierModel arity mismatch: "Expected 4, but was 3" on documented-correct 3-column rows (python-all, javascript-all)

  awaiting-responsequestion
  github/codeql#22597 · Filter by author mukul-ram opened on Sep 16, 2026
  1

• [False Negative/Question] Taint steps added by isAdditionalFlowStep ignore tainted content

  question
  github/codeql#22596 · Filter by author UpsideDownFoxxo opened on Sep 16, 2026
  2

• Python extractor reports parse errors for files no longer in the scanned commit

  question
  github/codeql#22579 · Filter by author mosbasik opened on Sep 15, 2026
  2

• C#: cs/simplifiable-boolean-expression false positive on Nullable<bool> compared with a literal

  C#
  github/codeql#22556 · Filter by author altwohill opened on Sep 14, 2026
  2

  

• False positive: js/incomplete-hostname-regexp treats LinkifyIt.match(text) as a regex call

  github/codeql#22546 · Filter by author MaksymShostak opened on Sep 11, 2026
  1

• Rust: query evaluation ~15× slower on 2.26.4 vs 2.26.3 (4 min → 45–60 min, type-inference/data-flow stage)

  github/codeql#22463 · Filter by author tanmaysolanki95 opened on Aug 28, 2026
  3

• Unpinned floating tags (e.g. v4) on immutable Actions are not flagged by actions/unpinned-tag

  github/codeql#22414 · Filter by author redsun82 opened on Aug 24, 2026
  1

• Whether there are Python SDK for Programmatic Access to CodeQL Database Facts

  question
  github/codeql#22411 · Filter by author for-just-we opened on Aug 23, 2026
  2

• False positive: java/field-masks-super-field triggered on Kotlin sealed class with open val constructor parameters

  github/codeql#22361 · Filter by author shreyasingh824 opened on Aug 17, 2026
  5

• Rust: False positive for unused variable names

  false-positive
  github/codeql#22342 · Filter by author brawer opened on Aug 13, 2026
  1

• CodeQL maps CWE-730, which MITRE prohibits from being used for mapping

  question
  github/codeql#22318 · Filter by author wiggin15 opened on Aug 11, 2026
  2

• [Python] tsg-parser fails to extract generic base class relations

  question
  github/codeql#22298 · Filter by author maxfischer2781 opened on Aug 7, 2026
  2

• Java: Should these sanitizer heuristics completely stop taint in five security queries?

  question
  github/codeql#22262 · Filter by author wildoranges opened on Jul 31, 2026
  2

• java/ssrf: allowlist guard not recognized when expressed via Stream/lambda (anyMatch), only via plain equals()/for-loop

  github/codeql#22259 · Filter by author richard-alun-williams opened on Jul 30, 2026
  1

• Java: PQC API misuse queries for experimental/quantum - wanted, and against which layer?

  github/codeql#22253 · Filter by author Arpan0995 opened on Jul 29, 2026
  1

• Consider testing CodeQL also against Kotlin EA versions

  question
  github/codeql#22219 · Filter by author scordio opened on Jul 21, 2026
  2

• False positive: "Missing cross-site request forgery token validation" should not apply to Web API Controller Actions sharing a project with Browser-based actions

  false-positive
  github/codeql#22215 · Filter by author daiplusplus opened on Jul 21, 2026
  1

• Go: Why is DotDotCheck modeled as a complete path-injection barrier?

  question
  github/codeql#22214 · Filter by author wildoranges opened on Jul 20, 2026
  3

• [actions] Alternate actions/checkout paths suppress untrusted-checkout alerts

  github/codeql#22213 · Filter by author 1sgtpepper opened on Jul 19, 2026
  2