CodeQL 2.26.0 has been released, adding support for Kotlin 2.4.0 and introducing a JavaScript and TypeScript query for system prompt injection. For C#, Razor Page handler method parameters, such as parameters for OnGet, OnPost, and OnPostAsync, have been added as remote flow sources. For Go, models for the log/slog package introduced in Go 1.21 have been added. For JavaScript/TypeScript, prompt injection sinks for additional OpenAI, Anthropic, and Google GenAI SDK APIs have been added, along with the new js/system-prompt-injection query to detect untrusted values flowing into an AI model’s system prompt, and the experimental javascript/ssrf-ipv6-transition-incomplete-guard query. The go/unhandled-writable-file-close query now produces fewer false positives. The py/modification-of-locals query no longer flags modifications to a locals() dictionary after it has passed out of scope. CryptoKit modeling for the swift/weak-sensitive-data-hashing and swift/weak-password-hashing queries has been improved. GitHub Actions queries have been updated to recognize the latest standard runner labels and correct the name, description, and alert message for actions/untrusted-checkout/medium. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on github.com, and the new functionality will be included in a future GitHub Enterprise Server release.