ST-2026-216 · SDKs & toolchains
CodeQL 2.26.3 removes the SelfHostedQuery module from GitHub Actions queries
GitHub CodeQL 2.26.3 removes the codeql.actions.security.SelfHostedQuery module because runner labels do not reliably distinguish self-hosted from managed runners, requiring custom queries that depend on the module to be updated.
Previous state
Custom CodeQL queries could depend on the codeql.actions.security.SelfHostedQuery module when reasoning about GitHub Actions runners.
Current state
CodeQL 2.26.3 removes SelfHostedQuery; custom queries that depend on it must use supported query logic that does not rely on runner labels to classify hosting type.
Affected users
Who needs to care
CodeQL custom-query maintainers whose GitHub Actions security queries import or depend on codeql.actions.security.SelfHostedQuery.
Required response
What to do
Search custom CodeQL query packs for SelfHostedQuery, remove or replace that dependency, and validate the updated queries against CodeQL 2.26.3 before relying on them in code scanning.
Evidence boundary
What the source does not prove
GitHub proves removal of the CodeQL SelfHostedQuery module in CodeQL 2.26.3. It does not remove GitHub Actions self-hosted runners, disable all runner analysis, or imply every custom CodeQL query requires changes.
Lifecycle history
Dated event sequence
- CodeQL 2.26.3 released
GitHub announced CodeQL 2.26.3 and removal of SelfHostedQuery.
Evidence ledger
First-party sources
- 01GitHub — CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling
Official GitHub Changelog · 2026-08-19
Open official source ↗