CodeQL Version : TypeScript Support, Improved Java Analysis, and New JavaScript Framework Coverage

CodeQL, GitHub’s powerful query language for code scanning, has released its latest version 2.21.0, bringing a wealth of new features and enhancements. From robust TypeScript 5.8 support to the promotion of important security queries and extended JavaScript framework coverage, this update promises to streamline security scanning across various languages and frameworks. Here’s an in-depth look at what’s new.

CodeQL 2.21.0: A Glimpse at Key Updates

TypeScript 5.8 Support: The most anticipated feature in this release is the full support for TypeScript 5.8. This allows developers to scan and automatically detect security issues in the latest TypeScript projects, offering improved security and enhanced developer experience.
Enhanced Java Analysis: A new Java query, developed by @ggolawski, has been moved out of the experimental phase and is now included in the default query pack. This query focuses on identifying exposed Spring Boot actuators, preventing accidental data leaks and improving the overall security posture of Java applications.
Expanded JavaScript Framework Support: CodeQL’s JavaScript analysis has been broadened to support popular frameworks and libraries, including Apollo Server, React Relay, and the SAP ecosystem. The update also includes support for TanStack, a set of utilities for handling data in modern JavaScript applications.

What Undercode Says:

The release of CodeQL version 2.21.0 is a significant milestone for developers working with TypeScript, Java, and JavaScript. Here’s a closer look at what each of these updates means for developers and security professionals alike.

TypeScript 5.8 Support: TypeScript has become one of the most widely used languages in modern web development. With its growing adoption, it is crucial to ensure that security vulnerabilities are detected early. The addition of TypeScript 5.8 support in CodeQL provides developers with the latest tools to automatically identify security flaws without needing to adjust the existing codebase. This enhancement positions CodeQL as an essential tool in the developer’s security arsenal, ensuring that the newest features of TypeScript are properly covered for security risks.
Promoted Java Query for Exposed Spring Boot Actuators: One of the more impactful features in this release is the promotion of the java/spring-boot-exposed-actuators query. For organizations using Spring Boot, it’s vital to monitor which endpoints are exposed to the public. Exposed actuators can inadvertently leak sensitive information about an application, such as server health status and configuration details, which could be exploited by malicious actors. By adding this query to the default CodeQL scanning pack, GitHub makes it easier for Java developers to catch these vulnerabilities before they become a security issue. The shift from experimental to default status underscores the importance of this query in maintaining secure Java applications.
Expanded JavaScript Framework Coverage: CodeQL’s extension of support for modern JavaScript frameworks reflects the growing importance of these technologies in the development ecosystem. Frameworks like Apollo Server and React Relay enable efficient and scalable applications, but they can introduce their own set of security risks. The addition of support for these libraries ensures that security checks can be seamlessly integrated into projects using these tools, offering peace of mind to developers who rely on them. Furthermore, the inclusion of SAP ecosystem support and TanStack demonstrates GitHub’s commitment to ensuring that enterprise-level applications and cutting-edge libraries are covered by its security features.
Automatic Updates and Integration: Another critical update in version 2.21.0 is the automatic deployment of these features to users of GitHub code scanning. This ensures that organizations using GitHub for continuous integration and deployment won’t need to worry about manually updating their security tools, as the latest version of CodeQL is immediately available to them. For GitHub Enterprise Server (GHES) users, these updates will be included in version 3.18, with the option to manually upgrade for those still using older versions.

Overall, the release of CodeQL version 2.21.0 highlights GitHub’s ongoing efforts to empower developers to write secure code with minimal effort. By automating the detection of vulnerabilities across multiple programming languages and frameworks, this update simplifies the process of securing modern applications and reducing the likelihood of security breaches.

Fact Checker Results:

Accuracy of TypeScript 5.8 Support: The addition of TypeScript 5.8 support in CodeQL 2.21.0 is confirmed and aligns with the TypeScript community’s focus on improving developer tools for security.
Java Query Promotion: The promotion of the java/spring-boot-exposed-actuators query to the default query pack has been confirmed by GitHub, emphasizing its importance in securing Spring Boot applications.
JavaScript Framework Coverage: CodeQL’s expanded support for modern JavaScript frameworks, including Apollo Server and React Relay, aligns with the increasing use of these technologies in production environments. The new support for SAP and TanStack is also verified.