Supported languages and frameworks¶
View the languages, libraries, and frameworks supported in the latest version ofCodeQL.
Languages and compilers¶
The current versions of the CodeQL CLI (changelog,releases),CodeQL library packs (source),and CodeQL bundle (releases)support the following languages and compilers.
Language | Variants | Compilers | Extensions |
|---|---|---|---|
C/C++ | C89, C99, C11, C17, C23, C++98, C++03, C++11, C++14, C++17, C++20, C++23[1][2][3] | Clang (including clang-cl[4] and armclang) extensions (up to Clang 19.1.0), GNU extensions (up to GCC 15.0), Microsoft extensions (up to VS 2022), Arm Compiler 5[5] |
|
C# | C# up to 13 | Microsoft Visual Studio up to 2019 with .NET up to 4.8, .NET Core up to 3.1 .NET 5, .NET 6, .NET 7, .NET 8, .NET 9 |
|
GitHub Actions | Not applicable | Not applicable |
|
Go (aka Golang) | Go up to 1.25 | Go 1.11 or more recent |
|
Java | Java 7 to 25[6] | javac (OpenJDK and Oracle JDK), Eclipse compiler for Java (ECJ)[7] |
|
Kotlin | Kotlin 1.6.0 to 2.2.2x | kotlinc |
|
JavaScript | ECMAScript 2022 or lower | Not applicable |
|
Python[9] | 2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13 | Not applicable |
|
Ruby[10] | up to 3.3 | Not applicable |
|
Rust[11] | Rust editions 2021 and 2024 | Rust compiler |
|
Swift[12] | Swift 5.4-6.1 | Swift compiler |
|
TypeScript[13] | 2.6-5.9 | Standard TypeScript compiler |
|
C++20 modules arenot supported.
[2]C23 and C++23 support is currently in beta.
[3]Objective-C, Objective-C++, C++/CLI, and C++/CX are not supported.
[4]Support for the clang-cl compiler is preliminary.
[5]Support for the Arm Compiler (armcc) is preliminary.
[6]Builds that execute on Java 7 to 25 can be analyzed. The analysis understands standard language features in Java 8 to 25; “preview” and “incubator” features are not supported. Source code using Java language versions older than Java 8 are analyzed as Java 8 code.
[7]ECJ is supported when the build invokes it via the Maven Compiler plugin or the Takari Lifecycle plugin.
[8]JSX and Flow code, YAML, JSON, HTML, and XML files may also be analyzed with JavaScript files.
[9]The extractor requires Python 3 to run. To analyze Python 2.7 you should install both versions of Python.
[10]Requires glibc 2.17.
[11]Requiresrustup andcargo to be installed. Features from nightly toolchains are not supported.
Support for the analysis of Swift requires macOS.
[13]TypeScript analysis is performed by running the JavaScript extractor with TypeScript enabled. This is the default.
Frameworks and libraries¶
The current versions of the CodeQL library and query packs (source) have been explicitly checked against the libraries and frameworks listed below.
Tip
If you’re interested in other libraries or frameworks, you can extend the analysis to cover them.For example, by extending the data flow libraries to include data sourcesand sinks for additional libraries or frameworks.
C and C++ built-in support¶
Provided by the current versions of theCodeQL query packcodeql/cpp-queries (changelog,source)and the CodeQL library packcodeql/cpp-all (changelog,source).
Name | Category |
|---|---|
Network communicator | |
Utility library | |
string.h | String library |
C# built-in support¶
Provided by the current versions of theCodeQL query packcodeql/csharp-queries (changelog,source)and the CodeQL library packcodeql/csharp-all (changelog,source).
Name | Category |
|---|---|
ASP.NET | Web application framework |
ASP.NET Core | Web application framework |
ASP.NET Razor templates | Web application framework |
Dapper | Database ORM |
EntityFramework | Database ORM |
EntityFramework Core | Database ORM |
Json.NET | Serialization |
NHibernate | Database ORM |
WinForms | User interface |
GitHub Actions built-in support¶
Provided by the current versions of theCodeQL query packcodeql/actions-queries (changelog,source)and the CodeQL library packcodeql/actions-all (changelog,source).
Name | Category |
|---|---|
Workflows | |
Actions |
Go built-in support¶
Provided by the current versions of theCodeQL query packcodeql/go-queries (changelog,source)and the CodeQL library packcodeql/go-all (changelog,source).
Name | Category |
|---|---|
Serverless framework | |
Web/logging/database framework | |
Web framework | |
Couchbase (gocb andgo-couchbase) | Database |
Web framework | |
Web framework | |
Logging library | |
Database | |
Web application framework | |
Utility library | |
Logging library | |
Microservice toolkit | |
XPath library | |
Network communicator | |
Network communicator | |
HTTP proxy library | |
HTTP request router and dispatcher | |
Network communicator | |
Database | |
Network communicator | |
XPath library | |
XPath library | |
Serialization | |
Serialization | |
XPath library | |
Logging library | |
Logging library | |
Web framework | |
Database | |
Network communicator | |
Serialization | |
Web framework | |
Email library | |
Database | |
Database | |
Network communicator | |
XPath library | |
XPath library | |
XPath library | |
XPath library | |
Serialization | |
Logging library |
Java and Kotlin built-in support¶
Provided by the current versions of theCodeQL query packcodeql/java-queries (changelog,source)and the CodeQL library packcodeql/java-all (changelog,source).
Name | Category |
|---|---|
Apache Commons Collections | Data structure utility library |
Apache Commons Lang | Utility library |
Apache HTTP components | Network communicator |
Guava | Utility and collections library |
Hibernate | Database |
iBatis / MyBatis | Database |
Jackson | Serialization |
Java Persistence API (JPA) | Database |
JaxRS | Jakarta EE API specification |
JDBC | Database |
JSON-java | Serialization |
Kryo deserialization | Serialization |
Project Lombok | Utility library |
Protobuf | Serialization |
SnakeYaml | Serialization |
Spring JDBC | Database |
Spring MVC | Web application framework |
Struts | Web application framework |
Thrift | RPC framework |
XStream | Serialization |
JavaScript and TypeScript built-in support¶
Provided by the current versions of theCodeQL query packcodeql/javascript-queries (changelog,source)and the CodeQL library packcodeql/javascript-all (changelog,source).
Name | Category |
|---|---|
angular (modern version) | HTML framework |
angular.js (legacy version) | HTML framework |
AWS Lambda | Serverless framework |
axios | Network communicator |
browser | Runtime environment |
EJS | templating language |
electron | Runtime environment |
express | Server |
Fastify | Server |
handlebars | templating language |
hapi | Server |
hogan | templating language |
jquery | Utility library |
koa | Server |
lodash | Utility library |
mongodb | Database |
mssql | Database |
mustache | templating language |
mysql | Database |
nest.js | Server |
node | Runtime environment |
nunjucks | templating language |
postgres | Database |
ramda | Utility library |
react | HTML framework |
react native | HTML framework |
request | Network communicator |
restify | Server |
sequelize | Database |
socket.io | Network communicator |
sqlite3 | Database |
superagent | Network communicator |
swig | templating language |
underscore | Utility library |
vue | HTML framework |
Python built-in support¶
Provided by the current versions of theCodeQL query packcodeql/python-queries (changelog,source)and the CodeQL library packcodeql/python-all (changelog,source).
Name | Category |
|---|---|
AWS Lambda | Serverless framework |
aiohttp.web | Web framework |
Django | Web framework |
djangorestframework | Web framework |
FastAPI | Web framework |
Flask | Web framework |
Flask-Admin | Web framework |
Tornado | Web framework |
Twisted | Web framework |
Gradio | Web framework |
starlette | Asynchronous Server Gateway Interface (ASGI) |
ldap3 | Lightweight Directory Access Protocol (LDAP) |
python-ldap | Lightweight Directory Access Protocol (LDAP) |
httpx | HTTP client |
pycurl | HTTP client |
requests | HTTP client |
urllib | HTTP client |
urllib2 | HTTP client |
urllib3 | HTTP client |
dill | Serialization |
PyYAML | Serialization |
ruamel.yaml | Serialization |
simplejson | Serialization |
toml | Serialization |
ujson | Serialization |
fabric | Utility library |
idna | Utility library |
invoke | Utility library |
jmespath | Utility library |
multidict | Utility library |
pydantic | Utility library |
yarl | Utility library |
aioch | Database |
aiomysql | Database |
aiopg | Database |
aiosqlite | Database |
asyncpg | Database |
cassandra-driver | Database |
clickhouse-driver | Database |
cx_Oracle | Database |
hdbcli | Database |
mysql-connector | Database |
mysql-connector-python | Database |
MySQL-python | Database |
mysqlclient | Database |
oracledb | Database |
phoenixdb | Database |
psycopg2 | Database |
pymssql | Database |
PyMySQL | Database |
pyodbc | Database |
sqlite3 | Database |
Flask-SQLAlchemy | Database ORM |
peewee | Database ORM |
SQLAlchemy | Database ORM |
cryptography | Cryptography library |
pycryptodome | Cryptography library |
pycryptodomex | Cryptography library |
rsa | Cryptography library |
MarkupSafe | Escaping Library |
libtaxii | TAXII utility library |
libxml2 | XML processing library |
lxml | XML processing library |
xmltodict | XML processing library |
Ruby built-in support¶
Provided by the current versions of theCodeQL query packcodeql/ruby-queries (changelog,source)and the CodeQL library packcodeql/ruby-all (changelog,source).
Name | Category |
|---|---|
excon | HTTP client |
faraday | HTTP client |
http_client | HTTP client |
httparty | HTTP client |
libxml-ruby | XML processing library |
nokogiri | XML processing library |
open-uri | HTTP client |
posix-spawn | Utility library |
rest-client | HTTP client |
Ruby on Rails | Web framework |
rubyzip | Compression library |
typhoeus | HTTP client |
Rust built-in support¶
Provided by the current versions of theCodeQL query packcodeql/rust-queries (changelog,source)and the CodeQL library packcodeql/rust-all (changelog,source).All support is experimental.
Name | Category |
|---|---|
Web framework | |
alloc | Standard library |
Utility library | |
core | Standard library |
Cryptography library | |
Utility library | |
HTTP library | |
HTTP library | |
Utility library | |
Logging library | |
Utility library | |
Utility library | |
Utility library | |
Web framework | |
Database | |
proc_macro | Standard library |
Utility library | |
Utility library | |
HTTP client | |
Web framework | |
Database | |
std | Standard library |
Cryptography library | |
Serialization | |
Utility library | |
Database | |
Asynchronous IO | |
Database | |
Utility library |
Swift built-in support¶
Provided by the current versions of theCodeQL query packcodeql/swift-queries (changelog,source)and the CodeQL library packcodeql/swift-all (changelog,source).
Name | Category |
|---|---|
XML processing library | |
Network communicator | |
Database | |
Cryptography library | |
Cryptography library | |
Utility library | |
Database | |
Scripting library | |
XML processing library | |
Network communicator | |
Database | |
Cryptography library | |
Database | |
Database | |
User interface library | |
User interface library |