The all-platform CodeQL bundle is deprecated and goes away in March 2027

The all-platform CodeQL bundle is deprecated and goes away in March 2027

22 September 2026: GitHub marked the all-platform CodeQL bundle deprecated on 22 September 2026, starting with CodeQL CLI 2.27.0, and said it will remove it in mid-March 2027. The files in question are codeql-bundle.tar.gz and codeql-bundle.tar.zst - the downloads that carry the binaries for every supported platform in one archive.

Who this actually affects

Not people using the CodeQL action with its default setup: that resolves its own download and will follow the change. The teams affected are the ones who fetch the bundle themselves, by that exact filename, in a script - typically because they run CodeQL in an air-gapped or mirrored environment, or cache the bundle in an internal artifact store to avoid pulling it from the internet on every build, or run the CLI outside Actions entirely.

Those pipelines are the ones that will break, and they will break in March 2027 with a 404 rather than with a warning. Six months is a generous notice period; it is also long enough for the person who wrote the script to have moved on.

Why it is going, and the detail worth knowing

The all-platform bundle exists so one download works everywhere, at the cost of shipping binaries for platforms the downloader will never run. GitHub's replacement is the platform-specific bundle for your operating system and architecture.

There is a practical detail buried in the notice that is worth more than the deprecation itself: Linux ARM64 binaries are only available in the platform-specific downloads and were never in the all-platform bundle at all. Anyone who assumed "all-platform" meant all platforms and has been trying to run CodeQL on ARM64 Linux build agents has been hitting that gap already.

What to do about it

Search your CI configuration and any internal mirroring scripts for codeql-bundle and see whether the name appears. If it does, change the fetch to the platform-specific artifact for the runner it lands on, and - if you cache it internally - update whatever pulls it into the cache, which is usually a separate job that nobody looks at.

If you are on CodeQL CLI 2.27.0 or later, you can make the change today; the platform-specific bundles are already what GitHub publishes. There is no reason to wait for March, and every reason not to: a deprecation with a six-month runway is the easiest kind of migration to do and the easiest kind to forget.

Not yet independently verified. This rests entirely on GitHub’s own changelog entry. No independent report of it was found, so every date here comes from the vendor's own page and is only as reliable as that page. We will update this when it can be confirmed, and remove this note.

Sources

• GitHub Changelog: Deprecation notice, all-platform CodeQL bundle - 22 September 2026