Support Kotlin 2.3.0

Description of the issue
Kotlin 2.3.0-Beta1 was released on 2025-10-07: https://github.com/JetBrains/kotlin/releases/tag/v2.3.0-Beta1
Kotlin 2.3.0 was released on 2025-12-16: https://github.com/JetBrains/kotlin/releases/tag/v2.3.0

CodeQL does not support Kotlin 2.3.0 yet, due to changes in the Kotlin compiler plugin api.

ci(gh): disable codeql until support kotlin 2.3.0

The CodeQL version 2.24.0 has been released, but no Kotlin 2.3.0 support to be seen. Any plans on adding it soon?

@Zordid

Where did you get the information from @Zordid ? I can't find release notes or change documentation.
But I found the following commit on main: 07e5479
Is Kotlin 2.3.0 now supported?

... but you seem to be right. Running CodeQL Action in my repo again still gives me:

Caused by: com.semmle.extractor.java.interceptors.KotlinInterceptor$KotlinVersionTooRecentError: Kotlin version 2.3.0 is too recent. CodeQL currently supports versions below 2.2.30

I can verify that version 2.24.0 was picked up to run the action:

  Did not find CodeQL tools version 2.24.0 in the toolcache.
  Using CodeQL CLI version 2.24.0 sourced from https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.24.0/codeql-bundle-linux64.tar.zst .

The release notes of the upcoming 2.24.1 mention Kotlin 2.3.0 support: #21250

Support is indeed in 2.24.1 (estimated 5th Feb), not in 2.24.0.

I can't find release notes or change documentation.

Answer to myself. Here are the changelogs:
https://codeql.github.com/docs/codeql-overview/codeql-changelog/codeql-cli-2.24.0/

Where did you get the information from @Zordid ? I can't find release notes or change documentation. But I found the following commit on main: 07e5479 Is Kotlin 2.3.0 now supported?

Found that last year in December in one comment somewhere... :-( Sorry, did not store the link back than, but was eagerly waiting for it... Me going to use Kotlin 2.3.0 productively was only hindered by that... ;-) Sorry!

@smowton

@smowton 2.24.1 was released, same as the action 4.32.2. But the action still uses 2.24.0 binaries, so I still can't use Kotlin 2.3.0:

https://github.com/hfhbd/github-releases/actions/runs/21728835185/job/62677919701?pr=7

hfhbd/github-releases#7

Any reason why the GitHub action still uses 2.24.0?

Edit: found the reason, codeql is preinstalled on GitHub runners and it still uses the old version actions/runner-images#13593. Thats strange, what's the purpose of the init action/update if not really updating the version?

It sounds like that is the default behavior of the action:

inputs:
  tools:
    description: >-
      By default, the Action will use the recommended version of the CodeQL
      Bundle to analyze your project. You can override this choice using this
      input. One of:

      - A local path to a CodeQL Bundle tarball, or
      - The URL of a CodeQL Bundle tarball GitHub release asset, or
      - A special value `linked` which uses the version of the CodeQL tools
        that the Action has been bundled with.
      - A special value `nightly` which uses the latest nightly version of the
        CodeQL tools. Note that this is unstable and not recommended for
        production use.

      If not specified, the Action will check in several places until it finds
      the CodeQL tools.

Maybe linked will use the newer version?

@hfhbd

I have the same issue as @hfhbd

Setup CodeQL tools /usr/bin/tar --version tar (GNU tar) 1.35 Copyright (C) 2023 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by John Gilmore and Jay Fenlason. Found gnu tar version 1.35. Found CodeQL tools version 2.24.0 in the toolcache. Using CodeQL CLI version 2.24.0 from toolcache at /opt/hostedtoolcache/CodeQL/2.24.0/x64 /opt/hostedtoolcache/CodeQL/2.24.0/x64/codeql/codeql version --format=json { "productName" : "CodeQL", "vendor" : "GitHub", "version" : "2.24.0", "sha" : "fc7468b26353cf53a397a848603698c355879cb2", "branches" : [ "codeql-cli-2.24.0" ], "copyright" : "Copyright (C) 2019-2026 GitHub, Inc.", "unpackedLocation" : "/opt/hostedtoolcache/CodeQL/2.24.0/x64/codeql", "configFileLocation" : "/home/runner/.config/codeql/config", "configFileFound" : false, "overlayVersion" : 4, "features" : { "analysisSummaryV2Default" : true, "buildModeOption" : true, "bundleSupportsIncludeDiagnostics" : true, "bundleSupportsIncludeLogs" : true, "bundleSupportsOverlay" : true, "databaseInterpretResultsSupportsSarifRunProperty" : true, "featuresInVersionResult" : true, "indirectTracingSupportsStaticBinaries" : false, "informsAboutUnsupportedPathFilters" : true, "supportsPython312" : true, "mrvaPackCreate" : true, "threatModelOption" : true, "traceCommandUseBuildMode" : true, "v2ramSizing" : true, "mrvaPackCreateMultipleQueries" : true, "setsCodeqlRunnerEnvVar" : true, "sarifMergeRunsFromEqualCategory" : true, "forceOverwrite" : true, "generateSummarySymbolMap" : true, "pythonDefaultIsToNotExtractStdlib" : true, "queryServerRunQueries" : true, "queryServerTrimCacheWithMode" : true, "builtinExtractorsSpecifyDefaultQueries" : true, "bqrsDiffResultSets" : true, "bundleSupportsIncludeOption" : true } }

github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7

Maybe linked will use the newer version?

Yes, that did the trick. Not sure, why linked is not the default.

Now my repos using the stable version of Kotlin (2.3.0 only) don't fail anymore, since mid December.

But 2.3.20 is already in Beta2:
2.3.20-Beta1: released at 2026-01-08
2.3.20-Beta2: released at 2026-01-29

Normally, there are 4 weeks between Beta1 and Beta2, 4 weeks between Beta2 and RC1 and two weeks between RC1, RC2 and release.
So 2.3.20 will be released around mid/end of March. I really hope, codeql will support 2.3.20 faster this time.

What you mean? Should i update my kotlin("jvm") version "2.3.0" to 2.3.10?

@mudasar187

@mudasar187 No, you can use any stable version starting Kotlin 1.8 up to 2.3.0.

https://github.com/navikt/sokos-spk-mottak/actions/runs/21743813855/job/62724777857

I dont understand why this is failing then?

I got this error:

Caused by: com.semmle.extractor.java.interceptors.KotlinInterceptor$KotlinVersionTooRecentError: Kotlin version 2.3.0 is too recent. CodeQL currently supports versions below 2.2.30

Well, now that you've released CodeQL 2.24.1 with Kotlin 2.3.0 support, JetBrains have released Kotlin 2.3.10 today - and CodeQL fails to work with this again. This race is a little bit tedious....

@mudasar187

Oh yeah, not supporting 2.3.10 is annoying. JetBrains also did release 2 RCs.

@mudasar187 like I said, you need to use tools: linked in the github/codeql-action/init action using 4.32.2: https://github.com/hfhbd/github-releases/pull/7/changes

@hfhbd

@hfhbd Ah! Sorry, i did not catch up your previous message hehe :) But thank! It works now, but as you said and comment @Zordid post.. not supporting 2.3.10 is annoying.

I am wondering why, though. The compiler plugin API didn't change again, or did it? 2.3.10 is just a minor update...

You don't need to use tools: linked; this is just an incremental rollout. We're in the brief period between a CLI release going public, and the action incrementally starting to default people to the new version. tools: latest can be used to hard-force picking the new version the very instant it's available.

2.3.10 is indeed an 'easy' update, so support will be in the next release, ETA two weeks.

@smowton

@smowton So you mean that is a better approach to set tools: latest instead of tools: linked ? Because as you said then it will always hard-force picking the new version?

I see that there is options:

const CODEQL_BUNDLE_VERSION_ALIAS: string[] = ["linked", "latest"]; So yeah. Maybe should use latest instead.

Yes, that's the best way to get latest -- or wait ~24hrs and the rollout will complete regardless (except in the unlikely event the rollout shows a problem requiring a rollback)

Perhaps useful bit of context here-- we have in the past tried to implement support based on release candidate versions, only to find there are breaking changes in the plugin API between the RC and the full release, necessitating a repeat of the upgrade process (and no effective support, since our plugin would load with the RC but not the GA version). This isn't a hard policy or anything, just an idea as to why the practice lately has been to implement support once there's a GA version to work with.

TIL latest and linked are synonyms in this context :D

One final option -- if you're in a rush for the new version, there's the option to use nightly. 2.3.10 support isn't in the current nightly, but it's likely in the next 1-2 working days. Since this is unstable and not recommended for production use you should definitely set a reminder to revert to a release version ASAP.

Yes, that's the best way to get latest -- or wait ~24hrs and the rollout will complete regardless (except in the unlikely event the rollout shows a problem requiring a rollback)

What rollout do you mean exactly? Rollout of a new runner image? If so, what's the purpose of the update of the GitHub action if not using the version mentioned in the release notes/linked in the action?

Not an image, no, a policy implemented by the action which gradually transitions from "newest version only for tools: latest people" to "newest version for everyone" over 24-48 hrs.

@smowton

@smowton I get a warning when using tools: latest -> Warning: tools: latesthas been renamed totools: linked, but the old name is still supported. No action is required.

Also TIL :) Go ahead and use linked then if that's the result you want.

Just confirming here that we've merged 2.3.10 #21286 so should go into the next nightly.

ci(github): Use CodeQL nightly for Kotlin 2.3.10 support

fix: skip CodeQL analysis when Kotlin extractor fails (github/codeql#…

FWIW - the changelog says that 2.24.1 has the Kotlin 2.3 support in it, and I re-enabled our GH Action and it worked. So is this issue complete?

Yes!

How so? I just ran a check with 2.24.1 and it failed

@marcphilipp

@marcphilipp please file a fresh issue with the particulars, including excerpts from the logs showing what happened?

Here you go:

CodeQL 2.24.1 doesn't support Kotlin 2.3.10 #21345

Downgrade Kotlin to 2.2.20 for CodeQL compatibility

Update dependencies: GitHub Actions and Gradle libraries (#12)

fix: use CodeQL tools: linked for Kotlin 2.3.x support

fix: add visible warning when CodeQL build fails

chore: update all GitHub Actions to latest SHA-pinned versions (#155)

fix: add Play Console production signing key to assetlinks.json (#159)

Kotlin 2.3.20 is out: #21484

Use linked CodeQL CLI for Kotlin 2.3.x support

Use linked CodeQL CLI for Kotlin 2.3.x support (#197)

Pipelines failing again:

Kotlin version 2.3.20 is too recent. CodeQL currently supports versions below 2.3.20

Please don't repeat this with every single patch version. These are often automatically updated by Dependabot & Co. and should not break CodeQL at all. It should just work with all 2.3.X versions and not break again at 2.3.30.

+1 on that, and the issue should probably be reopened as the issue persists

Navigation Menu

Repository navigation

Support Kotlin 2.3.0 #20661

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support Kotlin 2.3.0 #20661

Description

Activity

Zordid commented on Feb 3, 2026

ccudennec-otto commented on Feb 3, 2026

ccudennec-otto commented on Feb 3, 2026

hfhbd commented on Feb 3, 2026

smowton commented on Feb 3, 2026

ccudennec-otto commented on Feb 3, 2026

Zordid commented on Feb 4, 2026

hfhbd commented on Feb 5, 2026

ccudennec-otto commented on Feb 6, 2026

mudasar187 commented on Feb 6, 2026

hfhbd commented on Feb 6, 2026

mudasar187 commented on Feb 6, 2026

hfhbd commented on Feb 6, 2026

mudasar187 commented on Feb 6, 2026

Zordid commented on Feb 6, 2026

hfhbd commented on Feb 6, 2026

mudasar187 commented on Feb 6, 2026

Zordid commented on Feb 6, 2026

smowton commented on Feb 6, 2026

mudasar187 commented on Feb 6, 2026

smowton commented on Feb 6, 2026

hfhbd commented on Feb 6, 2026

smowton commented on Feb 6, 2026

mudasar187 commented on Feb 6, 2026

smowton commented on Feb 6, 2026

miketsprague commented on Feb 9, 2026

dptsolutions commented on Feb 18, 2026

smowton commented on Feb 18, 2026

marcphilipp commented on Feb 18, 2026

smowton commented on Feb 18, 2026

marcphilipp commented on Feb 18, 2026

hfhbd commented on Mar 16, 2026

rupert-jung-mw commented on Mar 25, 2026

yonatankarp commented on Mar 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions