---
title: "GitHub CodeQL Go control-flow graph changes may break custom queries: 2026-10-09 | Harbyn"
description: "GitHub CodeQL Go control-flow graph changes may break custom queries, announced Oct 9, 2026."
canonical: "https://harbyn.com/changes/github/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis-5"
last-updated: 2026-10-09
---

# GitHub CodeQL Go control-flow graph changes may break custom queries

Markdown version of <https://harbyn.com/changes/github/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis-5>.

Breaking change - GitHub. medium severity. In effect.

CodeQL 2.27.2 moves the Go control-flow graph to the shared CFG library, changing CFG nodes, edges, locations, textual representations and basic-block boundaries, so queries relying on the previous representation may need updates. BasicBlocks::Cfg is removed, IfStmt.getThen and LoopStmt.getBody now return Stmt, and several IR instruction classes are consolidated.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [GitHub](https://harbyn.com/vendors/github.md) |
| Kind | Breaking change |
| Severity | medium |
| Status | In effect |
| Announced | Oct 9, 2026 |
| Added to Harbyn | Oct 9, 2026 |
| Lead time | No dated deadline |
| Symbols | `BasicBlocks::Cfg`, `IfStmt.getThen`, `LoopStmt.getBody` |
| Vendor page | <https://github.blog/changelog/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis> |
| Review | Reviewed by a person, extracted by a model |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses GitHub, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://github.blog/changelog/feed/> (changelog, fetched 2026-10-09 22:43 UTC, sha256 `ae8354e61e4221bbe8b3135190028a8f59bcaecefaa7015365abe8775554520a`)

## Related changes

### More from GitHub

- [CodeQL Go library deprecates IfStmt.getCond](https://harbyn.com/changes/github/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis-2.md) (Deprecation, announced Oct 9, 2026)
- [CodeQL CLI error handling and output changes](https://harbyn.com/changes/github/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis-3.md) (Behavior change, announced Oct 9, 2026)
- [CodeQL build modes unsupported on macOS 27 and Xcode 27](https://harbyn.com/changes/github/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis-4.md) (Breaking change, announced Oct 9, 2026)
- [Triage role users or higher can now archive pull requests](https://harbyn.com/changes/github/2026-10-08-triage-role-users-or-higher-can-now-archive-pull-requests.md) (Behavior change, announced Oct 8, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: October listing attribute usage and enumeration value updates](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-2.md) (effective Oct 26, 2026)
- [Supabase: four CBC-mode TLS 1.2 cipher suites will be removed from project HTTP APIs](https://harbyn.com/changes/supabase/2026-10-12-an-outdated-subset-of-tls-1-2-ciphers-will-be-disabled-on-project-http-apis.md) (effective Nov 10, 2026)
- [Google Workspace APIs: OAuth clients must be marked as agentic to call Google Workspace MCP servers](https://harbyn.com/changes/google-workspace/2026-10-12-oauth-clients-must-be-marked-as-agentic-to-call-google-workspace-mcp-servers.md) (effective Nov 11, 2026)
- [Bitbucket Cloud API: Git Credential Manager upgrade required for OAuth 2.0 Git authentication](https://harbyn.com/changes/bitbucket/2026-10-13-git-credential-manager-upgrade-required-for-oauth-2-0-git-authentication.md) (effective Nov 30, 2026)

[All upcoming deadlines](https://harbyn.com/deadlines.md)