Code Scanning - 1

2026 (11)

November (1)

github: CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions

GitHub

2026-11-03

CodeQL 2.27.3 has been released. The update adds support for new Python 3.15 language features and JSON data extensions.

October (6)

github: Security extension for the GitHub Copilot app

GitHub

2026-10-28

A new GitHub security extension is available in public preview for the GitHub Copilot app. It lets you review and work through repository code scanning alerts without leaving the app.

github: AI Scan for pull requests generally available

GitHub

2026-10-15

AI Scan for pull requests is now generally available in code scanning. It complements CodeQL by detecting vulnerabilities in pull request changes for languages and frameworks not currently covered by CodeQL.

github: Agentic autofix for code scanning alerts general availability

GitHub

2026-10-15

Agentic autofix for code scanning alerts is now generally available. It can investigate relevant files across a codebase and propose fixes for alerts in a developer-like workflow.

github: Code scanning AI Scan metrics in security overview

GitHub

2026-10-13

Organization and enterprise administrators can now view AI Scan for pull request metrics in the security overview. The new metrics track how many AI Scan findings were generated and resolved, along with related status data.

github: Code scanning AI Scan enablement status in security overview

GitHub

2026-10-06

GitHub added AI Scan for pull requests enablement status to the security overview coverage view for organizations and enterprises. The code scanning summary now indicates which repositories have AI Scan enabled or not enabled.

github: Scheduled code scanning skips inactive repositories

GitHub

2026-10-01

Weekly scheduled scans for code scanning default setup and GitHub Code Quality now run only after a repository has had an analysis triggered by a push or pull request. Repositories with no recent activity no longer count toward scheduled scanning.

September (2)

github: Code scanning AI Scan no longer requires CodeQL default setup

GitHub

2026-09-16

AI Scan for pull requests can now find security vulnerabilities even when CodeQL default setup is not enabled on a repository. Previously, AI Scan for pull requests required CodeQL default setup.

github: AI Scan for pull request APIs in public preview

GitHub

2026-09-10

GitHub code scanning’s AI Scan for pull request feature can now be enabled and managed via REST API at both the organization and repository levels. The APIs are in public preview.

August (2)

github: Code scanning adds a mitigated alert dismissal reason

GitHub

2026-08-20

Code scanning now supports dismissing alerts with the reason "Mitigated" when the vulnerability still exists in code but is offset by external controls, such as a web application firewall or network protections.

github: CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling

GitHub

2026-08-19

CodeQL 2.26.3 adds source modeling for JavaScript, TypeScript, and Vue, and updates several GitHub Actions queries for better accuracy. It is a CodeQL release used by GitHub code scanning.