Issues · github/codeql · GitHub

Labels Milestones New issue

How can you tie git blame information to CodeQL violations

#21733

· chri7325 opened

on Apr 17, 2026

GHAS-managed workflows reference mutable action versions, incompatible with required SHA-pinning policies

#21732

· kyleburnsdev opened

on Apr 17, 2026

[feat] comments that enable/disable LSP formatting

#21730

· k4lizen opened

on Apr 17, 2026

`--format=csv` in `codeql database interpret-results` can produce a malformed `.csv`

#21729

· k4lizen opened

on Apr 17, 2026

False negative: unzip using subprocess or `shutil.unpack_archive` is not covered in py/tarslip

#21712

· 9iang22 opened

on Apr 15, 2026

False positive: support `os.path.basename` as a sanitizer in py/path-injection

#21711

· 9iang22 opened

on Apr 15, 2026

Support lazy imports coming with Python 3.15 (`lazy` keyword)

#21682

· p- opened

on Apr 9, 2026

[question?] counterintuitive class method behaviour

#21670

· k4lizen opened

on Apr 8, 2026

False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure

#21669

· tacu22 opened

on Apr 8, 2026

py/insecure-protocol missing urllib3 ssl_version tracking & false positive on secure defaults

#21666

· 9iang22 opened

on Apr 8, 2026

False positive: "Missing cross-site request forgery token validation" in C# API for endpoint with no cookie/session tokens

#21665

· joepvtl opened

on Apr 8, 2026

Can the location of the disk cache be customised, and does CodeQL gracefully handle missing cache?

#21663

· gsutherland-trailofbits opened

on Apr 7, 2026