Releases · github/codeql-action

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
Add support for SHA-256 Git object IDs. #3893
Update default CodeQL bundle version to 2.25.5. #3926

Assets 3

22 May 11:28

Immutable

v3.36.0

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
Add support for SHA-256 Git object IDs. #3893
Update default CodeQL bundle version to 2.25.5. #3926

Assets 3

22 May 10:16

codeql-ci

Immutable

CodeQL Bundle v2.25.5 Latest

Latest

Bundles CodeQL CLI v2.25.5

Includes the following CodeQL language packs from github/codeql@codeql-cli/v2.25.5:

Assets 23

cli-version-2.25.5.txt

sha256:c51964d8d5d1d95dca909835528c02e777776ea420e29383cb3065b8a83a659c

7 Bytes 2026-05-18T16:02:43Z
codeql-bundle-linux64.tar.gz

sha256:24717f939f1bef659f893ff4a9c99ba8c056fbaca9640f877c4dc74cf96486d7

772 MB 2026-05-18T16:02:43Z
codeql-bundle-linux64.tar.gz.checksum.txt

sha256:9e70262e1c0e274c058e9e51814641af1cfb497798efd090c9ce73de3490a336

95 Bytes 2026-05-18T16:02:44Z
codeql-bundle-linux64.tar.zst

sha256:76cd9d785940da0a5876676136be0c2803baa116304af5265052b74f1ec46258

548 MB 2026-05-18T16:02:44Z
codeql-bundle-linux64.tar.zst.checksum.txt

sha256:980ab4803c8846d31b416ea787c93d1254fb70d3a8c6d009a9b7457fc5b1e20a

96 Bytes 2026-05-18T16:02:44Z
codeql-bundle-osx64.tar.gz

sha256:c365f6c41145b97150c32026f72df1d02060b15c560588785e764eec10be945e

1.25 GB 2026-05-18T16:03:09Z
codeql-bundle-osx64.tar.gz.checksum.txt

sha256:1da03c9a49a34f59574f4633fccc572ecdac903f238b99b8f37c11a3298db799

93 Bytes 2026-05-18T16:03:11Z
codeql-bundle-osx64.tar.zst

sha256:87b574827b895669ee676b88626b4f2f89fe8876ffe75b21b9d5099e984b8231

898 MB 2026-05-18T16:03:12Z
codeql-bundle-osx64.tar.zst.checksum.txt

sha256:2586b5b5b090889c9deeb7bc805f656c85a94f1d94cd78f50fa001a4ec2e6fb7

94 Bytes 2026-05-18T16:03:23Z
codeql-bundle-win64.tar.gz

sha256:6bef9bd2e61a7b3bca91c19637e5607a5fc887b2cf8b73e7c202516f4df773e1

626 MB 2026-05-18T16:02:45Z
Source code (zip)

2026-05-21T10:29:33Z
Source code (tar.gz)

2026-05-21T10:29:33Z
Release attestation (json)

2026-05-21T10:29:33Z

15 May 11:24

Immutable

v4.35.5

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

Assets 3

15 May 12:42

Immutable

v3.35.5

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880