Trending:
OpenAI admin controls GitHub Issues agent approvals Gemini in Chrome UK expansion Developer tools coverage
TECHSTAGED Better software. Smarter business.

CodeQL 2.27.3 expands Python 3.15 features and JSON data extensions: what it means for developers

By TechStaged

· 2 min read

Prepared with AI assistance from source material. Automated editorial review recorded . Automated checks can miss errors and do not represent human approval. Editorial policy and corrections.

CodeQL 2.27.3 feature overview: Python 3.15 and JSON data extensions
TechStaged-owned

Summary

  • CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions.
  • Data extension files now support JSON syntax, using the same structure as YAML data extensions, and JSON is parsed as JSON while other files are parsed as YAML.
  • The Python extractor now supports Python 3.15 syntax, including unary plus in match literal patterns and Unicode 17 identifiers.
  • An opt-in AI threat model for LLM-generated data is available, with no built-in source models and the ability to define custom sources with data extensions.

CodeQL 2.27.3 introduces Python 3.15 language feature support and JSON data extensions. It also adds new built-ins and data-flow capabilities to improve analysis coverage across languages.

JSON DATA EXTENSIONS AND JSON SYNTAX

Data extension files now support JSON syntax, using the same structure as YAML data extensions. Java-style comments are supported. CodeQL parses files with the .json extension as JSON and continues to parse all other files as YAML.

PYTHON 3.15 FEATURES AND PYTHON EXTRACTOR

The Python extractor now supports Python 3.15 syntax, including unary plus in match literal patterns and Unicode 17 identifiers. The changelog also mentions new built-ins such as frozendict and sentinel, with data-flow modeling for frozendict construction.

QUALITY IMPROVEMENTS AND FALSE POSITIVES

The update includes targeted improvements that reduce false positives in several queries (e.g., cpp/resource-not-released-in-destructor, cs/simplifiable-boolean-expression, java/ssrf, java/unvalidated-url-redirection). These changes may improve accuracy, though the announcement does not provide empirical metrics.

OPERATIONAL NOTES AND GOVERNANCE

An opt-in AI threat model for LLM-generated data is introduced, and the changelog notes that users can define their own sources with data extensions. When configuring private registries, CodeQL now passes required proxy and certificate environment variables to the NuGet CLI.

BROADER IMPACT AND NEXT STEPS

The release includes broader language coverage updates, data extension capabilities, and workflow considerations for CodeQL users. The changelog points readers to a complete changelog for version 2.27.3 for a full list of changes and notes that this functionality will be included in GHES 3.24.

SOURCES

Developer Tools CodeQL 2.27.2 Adds C++ Regex Parsing and Broader Language Improvements • 3 min read Developer Tools Xcode 27 runner image GA on GitHub Actions: arm64-only macOS runners with one-Xcode-version-per-image • 2 min read Developer Tools SHIFT in Game Off 2026: what the announcement signals for developers • 1 min read Developer Tools GA for Enterprise GitHub Apps: What the Evidence Shows Beyond the Announcement • 3 min read Security CVE-2026-119085 in Virtual Engineering Workbench: what readers can understand beyond the announcement • 2 min read Developer Tools Broad security patch across multiple MPS versions and Toolkit enhancements signal a new phase for JetBrains MPS • 2 min read Software Explainer: What the NAACP v. xAI ruling actually changes about data-center pollution and permits • 4 min read Developer Tools Compromised eMudhra Certificates: What readers can understand and decide beyond the JetBrains announcement • 3 min read