GitHub deprecated the all-platform CodeQL bundle in CodeQL CLI 2.27.0 and set mid-March 2027 as the date the download disappears
GitHub marked the all-platform CodeQL bundle deprecated starting with CodeQL CLI 2.27.0, told users to move to the platform-specific bundle for their operating system and architecture, and said the all-platform download will be removed in mid-March 2027.
Image: GitHub
Why it mattersA CI job pinned to codeql-bundle.tar.gz or codeql-bundle.tar.zst passes today, breaks in mid-March 2027, and every action or script that fetches CodeQL by that filename has to name a specific platform first.
A build agent that pulls CodeQL by a pinned URL has a working script today and a broken one in mid-March 2027. GitHub deprecated the all-platform CodeQL bundle in CodeQL CLI version 2.27.0, released on 22 September 2026, and told users to download the platform-specific bundle for their operating system and architecture instead.
Which files are going away
GitHub says two files are being retired: codeql-bundle.tar.gz and codeql-bundle.tar.zst. These are the bundles that pack binaries for every supported platform into a single archive. The company writes that the bundle is "marked as deprecated" from CodeQL CLI 2.27.0 onwards and will be "removed in mid-March 2027".
The replacement is the platform-specific bundle. GitHub lists the supported platforms on its system-requirements page, and each has its own archive named for the operating system and CPU architecture. Linux ARM64 CodeQL binaries have moved and are now available only through the platform-specific downloads, which is the other reason the all-platform bundle is being retired: keeping it would double its size to include the new architecture.
What has to change, and what does not
The CodeQL CLI itself is unchanged, so the analysis command lines, the query packs, the SARIF output, and the way results feed into Advanced Security or a third-party dashboard all work the same. What changes is the URL in the install step. A GitHub Action that fetches the bundle at a fixed release tag has to swap the filename, a Dockerfile has to name the architecture, and a shell script installing CodeQL on a build runner has to pick a specific archive rather than the universal one.
GitHub recommends consulting its supported-platforms documentation for the exact list. A team running CodeQL on both x86_64 and ARM64 runners now downloads two bundles, one per architecture, rather than one shared archive that carried both.
Where the failure will actually show up
The most likely place a run fails after the removal is a homegrown install step that predates the platform-specific bundle. GitHub's own github/codeql-action and the setup-codeql helpers pin to platform-specific downloads already, so users of those actions do not need to act on this deprecation. A hand-rolled installer that reads the latest release's codeql-bundle.tar.gz from GitHub's release API is the one that stops working in mid-March 2027.
The honest test for a team on the older bundle is a grep across the CI configuration for codeql-bundle.tar.gz, codeql-bundle.tar.zst, and the release URL that produces them. Any match points at a pipeline that will fail in April 2027, so the migration is one line per pipeline: replace the filename with the platform-specific archive that matches the runner. The version pin stays; the file it points at moves.
Source
GitHub Changelog, Deprecation notice: All-platform CodeQL bundle, 22 September 2026.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
