Static code analysis is most useful when it aligns with the languages, frameworks, and patterns that development teams actually use. The new CodeQL release extends that alignment with support for recent versions of Swift, .NET, and C#, alongside improvements for JavaScript, TypeScript, Python, Java, Kotlin, C, and Rust.
Notably, there is a focus on modern web development. The analysis includes, among other things, refinements for data flows in React and Next.js. This allows checks to better align with the way data moves through contemporary applications, without developers having to model every deviation themselves.
The quality of security alerts also receives attention. New and tightened rules help detect, among other things, missing CSRF validation, SQL injection risks, SSRF patterns, and hard-coded cryptographic values. At the same time, there are corrections intended to reduce unnecessary notifications.
For teams, the lesson is simple: security analysis should evolve along with the technical stack. Installing a tool alone is not enough; regular updates, solid configuration, and reviewing relevant alerts remain necessary to truly make analysis part of the development process. In this way, security checks become an ongoing conversation between developers, reviewers, and administrators.