Release notes from codeql-cli-binaries

v2.25.6

2026-06-04T11:04:24Z

Improvements

When the git executable is available, CodeQL can now obtain configuration and queries from SHA-256 Git repositories, and infer Git metadata about them.

Miscellaneous

The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.11.

For more information about the changes included in this release, see the CodeQL CLI changelog.

You can download either the codeql-PLATFORM.zip for your platform, or the generic codeql.zip which contains binaries for all supported platforms. Please ignore the additional "source code" downloads below the .zip artifacts.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.6.

v2.25.5

2026-05-22T10:33:40Z

Release 2.25.5 (2026-05-21)

There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.5.

v2.25.4

2026-05-07T14:05:46Z

There are no user-facing changes in this release.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.4.

v2.25.3

2026-05-01T12:07:16Z

Improvements

The codeql database finalize command now accepts the --working-dir
flag. When specified, any extractor pre-finalize scripts will be run in
that directory. If the flag is not used, the scripts will run in the source
root directory (maintaining existing behavior). The flag will also be
automatically passed through when running the higher-level
codeql database create command.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.3.

v2.25.2

2026-04-15T10:45:34Z

Miscellaneous

The build of Eclipse Temurin OpenJDK that is used to run the CodeQL CLI has been updated to version 21.0.10.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.2.

v2.25.1

2026-03-27T09:48:38Z

Release 2.25.1 (2026-03-27)

Bug Fixes

Fixed a bug where extraction could fail on YAML files containing emoji.

Miscellaneous

Upgraded snakeyaml (which is a dependency of jackson-dataformat-yaml) from 2.3 to 2.6.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.1.

v2.25.0

2026-03-19T12:16:17Z

Release 2.25.0 (2026-03-19)

Breaking Changes

codeql database interpret-results and codeql database analyze no longer attempt to reconstruct file baseline information from databases created with CLI versions before 2.11.2.

Bug Fixes

Upgraded Jackson library from 2.16.1 to 2.18.6 to address a high-severity denial of service vulnerability (GHSA-72hv-8253-57qq) in jackson-core's async JSON parser.
Upgraded snakeyaml (which is a dependency of jackson-dataformat-yaml) from 2.2 to 2.3.

Release 2.24.4 (2026-03-16)

This release was skipped.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.25.0.

v2.24.3

2026-03-05T16:13:02Z

Release 2.24.3 (2026-03-05)

Bug Fixes

Fixed a race condition that could cause flaky failures in overlay CodeQL tests. Test extraction now skips *.testproj directories by name, preventing interference from concurrently cleaned-up test databases.
Fixed spurious "OOPS" warnings that could appear in help output for commands using mutually exclusive option groups, such as codeql query run.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.24.3.

v2.24.2

2026-02-20T11:23:39Z

Bug Fixes

Fixed SARIF output to generate RFC 1738 compatible file URIs. File URIs now always use the file:/// format instead of file:/ for better interoperability with SARIF consumers.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.24.2.

v2.24.1

2026-02-05T15:58:04Z

Miscellaneous

The vulnerable xwork-core 2.3.37 test dependency (CVE-2025-68493) has been removed. The CodeQL Java library has been updated to support both legacy Struts 2.x-6.x package names and Struts 7.x package names for analyzing user code.

For more information about the changes included in this release, see the CodeQL CLI changelog.

This release is compatible with the CodeQL language packs from github/codeql@codeql-cli/v2.24.1.