Skip to content

Re-enable blocking CodeQL java-kotlin analysis once CodeQL supports Kotlin 2.4.0 #26

Description

@WolfTasks

The Kotlin 2.4 / Gradle 9 toolchain migration (PR #25) bumps Kotlin to 2.4.0, which the current CodeQL Kotlin extractor does not support:

KotlinInterceptor$KotlinVersionTooRecentError: Kotlin version 2.4.0 is too recent.
CodeQL currently supports versions below 2.3.30

CodeQL 2.25.2 (Apr 2026) supports Kotlin only up to 2.3.20. Upstream tracking: github/codeql#21938 (fix PR github/codeql#21970, unreleased).

Temporary mitigation (in this repo)

.github/workflows/codeql.yml marks the java-kotlin analysis job continue-on-error so it no longer blocks merges. Kotlin CodeQL scanning is effectively disabled while this is in place. The javascript-typescript analysis remains fully enforced.

Action to take when CodeQL ships Kotlin 2.4.0 support

  1. Bump github/codeql-action in codeql.yml to the version whose CodeQL bundle supports Kotlin 2.4.0.
  2. Remove the continue-on-error from the java-kotlin job.
  3. Confirm the analyze (java-kotlin, manual) check runs a real analysis and passes on main.
  4. Close this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions