CodeQL 2.21.0 supports TypeScript 5.8 and expands language coverage

CodeQL version 2.21.0 has been released and includes TypeScript 5.8 support, a new Java query to detect exposed Spring Boot actuators, and support for new JavaScript libraries.

TypeScript 5.8 support

CodeQL can now analyze code written in TypeScript version 5.8, helping you find and automatically remediate security issues in the latest TypeScript projects, all without additional configuration.

Improved Java analysis

The community-contributed query java/spring-boot-exposed-actuators by @ggolawski has been promoted out of experimental status and is now included in the default code scanning query pack. This query helps you identify publicly accessible Spring Boot actuators, preventing unintended information disclosure.

Expanded JavaScript framework coverage

We’ve extended our JavaScript analysis to include popular modern frameworks and libraries:

  • Apollo Server: Added support for analyzing data coming from GraphQL when using @apollo/server.
  • React Relay: Added analysis support for React applications using the react-relay library.
  • SAP ecosystem: Added CodeQL support for analysis of SAP packages, including @sap/hana-client, @sap/hdbext, and hdb.
  • TanStack: Added support for analyzing applications using the @tanstack/angular-query-experimental package.

For a full list of changes, please refer to the complete changelog for version 2.21.0. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com. The new functionality in CodeQL 2.21.0 will also be included in GitHub Enterprise Server (GHES) version 3.18. If you use an older version of GHES, you can manually upgrade your CodeQL version.

Sunset notice for automatic watching of repositories and teams

Highlight of the automatic watching section within Notification Settings

On May 18, 2025, we’re deprecating the automatic watching of repositories and teams. We’re making this change in order to:

  • Reduce notification noise: You’ll receive fewer unexpected notifications, especially when joining large organizations with many repositories.
  • Improve efficiency: You’ll be able to focus on the notifications that matter most, without unnecessary subscriptions.
  • Minimize confusion: You won’t have automatic watching behavior that some users found unclear or overwhelming.

Existing repository subscriptions created through auto-watching will not be impacted. Users will remain subscribed to repositories or teams they were previously watching.

To review or adjust your current repository subscriptions, visit the Watching section. For more detailed notification preferences, head to Notification Settings.

See more

OpenAI GPT-4.1-mini and GPT-4.1-nano are now generally available in GitHub Models

GPT-4.1-mini and GPT-4.1-nano release on GitHub Models

Alongside the launch of GPT-4.1 in GitHub Models, we’re introducing GPT-4.1-mini and GPT-4.1-nano—lightweight variants of OpenAI’s latest model. Designed for high performance with lower cost and latency, these models are ideal for real-time applications and workloads that involve parallel or chained model calls.

Both inherit the core strengths of the GPT-4.1 series, including enhanced coding capabilities, improved instruction following, long-context understanding, and multimodal support (text and image). With features like parallel function calling and structured output generation, GitHub Models users can now choose the right-sized model for their specific needs—whether building chatbots, coding copilots, or AI-powered agents.

  • GPT-4.1-mini: Combines strong general-purpose reasoning with low cost and latency, supporting both text and vision use cases.

  • GPT-4.1-nano: Offers even lower cost and latency, ideal for lightweight tasks and high-frequency usage at scale.

Try, compare, and implement these models in your code for free in the playground (GPT-4.1-mini and GPT-4.1-nano) or through the GitHub API.

To learn more, visit the GitHub Models documentation, and join the community discussions to share feedback and connect with other developers.

See more
View all changes