Просмотр новости
Найдите то, что Вас интересует
Спутники
РН
SpaceX
Роскосмос
NASA
СпутникиРНSpaceXРоскосмосNASACodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0, which adds support for Kotlin 2.4.0,…
The post CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection appeared first on The GitHub Blog.
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0, which adds support for Kotlin 2.4.0, introduces a JavaScript and TypeScript query for system prompt injection, and improves analysis accuracy across multiple languages.
Kotlin: CodeQL now supports Kotlin versions up to 2.4.0.
C#: We’ve added Razor Page handler method parameters, such as parameters for OnGet, OnPost, and OnPostAsync, as remote flow sources. Security queries such as cs/sql-injection can now detect vulnerabilities involving these parameters in PageModel subclasses.
Go: We’ve added models for the log/slog package introduced in Go 1.21. The go/log-injection and go/clear-text-logging queries can now detect issues in code that uses slog package functions and slog.Logger methods.
JavaScript/TypeScript: We’ve added prompt injection sinks for additional OpenAI, Anthropic, and Google GenAI SDK APIs, including Sora prompts, OpenAI Realtime session instructions, Anthropic legacy completion prompts, and Google GenAI cached content and system instructions.
JavaScript/TypeScript
js/system-prompt-injection query to detect when untrusted, user-provided values flow into an AI model’s system prompt, allowing an attacker to manipulate the model’s behavior.javascript/ssrf-ipv6-transition-incomplete-guard query to detect server-side request forgery (SSRF) guards that reject private IPv4 ranges but can be bypassed with IPv6 transition address formats.Go
go/unhandled-writable-file-close query now produces fewer false positives. It no longer flags a deferred call to Close when every execution path first handles a call to Sync on the same file handle.Python
py/modification-of-locals query no longer flags modifications to a locals() dictionary after it has passed out of the scope where it was created, reducing false positives.Swift
swift/weak-sensitive-data-hashing and swift/weak-password-hashing queries. These queries may now detect additional results.GitHub Actions
actions/pr-on-self-hosted-runner query to recognize the latest standard runner labels, reducing false positives.actions/untrusted-checkout/medium to clarify that it applies to a nonprivileged context.For a full list of changes, please refer to the complete changelog for version 2.26.0. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.26.0 will also be included in a future GitHub Enterprise Server (GHES) release. If you use an older version of GHES, you can manually upgrade your CodeQL version.
| # | Наименование новости | Тональность | Информативность | Дата публикации |
|---|---|---|---|---|
| 1 | Organization-level targeting for GitHub Code Quality | 5 | 7 | 09-07-2026 |
| 2 | Ask Copilot for a repository overview | 0 | 5 | 09-07-2026 |
| 3 | GitHub Mobile: Improved filters and sorting for Copilot sessions | 0 | 5 | 10-07-2026 |
| 4 | Enterprise-managed OpenTelemetry export for VS Code and CLI | 0 | 5 | 08-07-2026 |
| 5 | Kotlin исполнилось 15 лет: что принесут 2.4.0, toolchain и AI-агенты | 0 | 5 | 01-07-2026 |
| 6 | Clearer names for secret scanning detector types | 0 | 3 | 10-07-2026 |
| 7 | Innersource security advisories are generally available | 0 | 5 | 08-07-2026 |
| 8 | New pull requests dashboard is now generally available | 5 | 7 | 09-07-2026 |
| 9 | The Hidden Cost of AI Security Scanners | 0 | 7 | 20-05-2026 |
| 10 | 1. Stellantis продаёт электромобиль Fiat Topolino за $13 995, а ... | 0 | 8 | 13-07-2026 |