Issues

• java/unused-reference-type and java/unused-container: silenced by any annotation, even an empty one

  github/codeql#22984 · Filter by author MarkLee131 opened on Nov 2, 2026

• java/unused-reference-type: an unused private enum is not reported

  github/codeql#22983 · Filter by author MarkLee131 opened on Nov 2, 2026

• java/unchecked-cast-in-equals: missed when the argument is passed to any library method first

  github/codeql#22982 · Filter by author MarkLee131 opened on Nov 2, 2026

• java/non-final-call-in-constructor: a call made inside a lambda in the constructor is not reported

  github/codeql#22970 · Filter by author MarkLee131 opened on Nov 1, 2026

• java/local-shadows-field: a local declared inside a lambda or anonymous class body is not reported

  github/codeql#22969 · Filter by author MarkLee131 opened on Nov 1, 2026

• java/unsafe-double-checked-locking: missed when the field is re-read through a call that returns it

  github/codeql#22968 · Filter by author MarkLee131 opened on Oct 31, 2026

• java/unsafe-double-checked-locking: not reported when the outer guard is written as !(!(x == null))

  github/codeql#22967 · Filter by author MarkLee131 opened on Oct 31, 2026

• JS: Some sanitizer guards no longer apply after if (!check(x)) x = default (false positives since 2.20.2)

  false-positive
  github/codeql#22848 · Filter by author wildoranges opened on Oct 20, 2026
  3

• Python: Should an empty netloc count as a py/url-redirection sanitizer when ///evil.com passes the check?

  question
  github/codeql#22846 · Filter by author wildoranges opened on Oct 20, 2026
  1

• JS: Why does SanitizingRegExpTest treat /^...$/m as a whole-string check?

  question
  github/codeql#22845 · Filter by author wildoranges opened on Oct 20, 2026
  2

• Swift extractor: lazy declaration TRAP file name exceeds 255 bytes for C++ template specializations

  bugSwift
  github/codeql#22843 · Filter by author hyochan opened on Oct 19, 2026
  2

• JS: js/command-line-injection misses child_process argument arrays when the shell option is set

  question
  github/codeql#22825 · Filter by author wildoranges opened on Oct 15, 2026
  3

• Swift extraction reports ambiguous NSAccessibilityElement for valid PDFKit source

  bugSwift
  github/codeql#22803 · Filter by author aspenas opened on Oct 10, 2026
  1

• Actions: uses: $/… self-repository references are not resolved to local reusable workflows or composite actions (false positives and downgraded severity)

  Actions
  github/codeql#22755 · Filter by author WilliamBerryiii opened on Oct 5, 2026
  1

• Swift: macro plugin host fails with "Bad CPU type in executable" when tracing an Xcode 27 build on Apple Silicon

  bug
  github/codeql#22742 · Filter by author nicktoumpelis opened on Oct 2, 2026
  6

• Python: model MCP server handler parameters (mcp, fastmcp) as remote sources

  github/codeql#22702 · Filter by author Alex-Hofer opened on Sep 30, 2026
  3

• actions/unpinned-tag: recognize GitHub Immutable Releases per-tag instead of a static repo allow-list

  Actions
  github/codeql#22674 · Filter by author jessehouwing opened on Sep 24, 2026
  8

• C++ extractor crashes with coordinates_of_template_param_symbol assertion on a dependent default non-type template parameter used through a libc++ alias over a pack

  bugC++
  github/codeql#22658 · Filter by author jaf0rk opened on Sep 23, 2026
  5

• JavaScript externs model StorageEvent() with no type argument

  false-positivejavascript
  github/codeql#22632 · Filter by author jmcerda opened on Sep 20, 2026
  3

  

• Python: isType treats any object in a module named *typing as a type, corrupting points-to for unrelated containers

  false-positive
  github/codeql#22621 · Filter by author mauvilsa opened on Sep 18, 2026
  3

• [False Negative/Question] Taint steps added by isAdditionalFlowStep ignore tainted content

  question
  github/codeql#22596 · Filter by author UpsideDownFoxxo opened on Sep 16, 2026
  4

• Python extractor reports parse errors for files no longer in the scanned commit

  question
  github/codeql#22579 · Filter by author mosbasik opened on Sep 15, 2026
  3

• False positive: js/incomplete-hostname-regexp treats LinkifyIt.match(text) as a regex call

  github/codeql#22546 · Filter by author MaksymShostak opened on Sep 11, 2026
  1

• Rust: query evaluation ~15× slower on 2.26.4 vs 2.26.3 (4 min → 45–60 min, type-inference/data-flow stage)

  github/codeql#22463 · Filter by author tanmaysolanki95 opened on Aug 28, 2026
  3

• Unpinned floating tags (e.g. v4) on immutable Actions are not flagged by actions/unpinned-tag

  Actions
  github/codeql#22414 · Filter by author redsun82 opened on Aug 24, 2026
  1