macOS 27 turned up in two release notes on the same day, and neither can fix it alone
Serguey Asael Shinder2 min readOn 9 October two unrelated projects published release notes with the same operating system in them. Neither note was about a bug in the project itself.
Python 3.15.0. The release page carries a warning that on macOS 27.0, applications built on Tk — IDLE and anything using tkinter — may hang when a menu command opens a dialog, ending in Force Quit. The Python team attributes it to a behaviour change in the operating system that is believed to affect all current Tk versions, and therefore tkinter in every current Python, not only the new one. Their advice is to hold off on macOS 27.0 or test the workflow first.
CodeQL 2.27.2. GitHub's changelog says that with macOS 27 and Xcode 27, Apple stopped shipping multi-architecture x86-64/arm64 binaries, which CodeQL's traced analysis depends on. Autobuild and manual build modes for compiled languages are therefore unsupported on macOS 27 with any Xcode, and on macOS 26 with Xcode 27 selected. The advice: stay on macOS 26 with Xcode 26.
What the two have in common. In both cases the project's own code is not where the fix lives. Python cannot patch Tk's interaction with the window server from the interpreter; CodeQL cannot ship Apple's universal binaries. Both projects did the one thing available to them — they wrote the limitation into the release note and named the safe version. That shifts the work to whoever controls the version of the operating system: a developer deciding when to click Update, or a CI configuration deciding what a runner label resolves to.
Where this bites unnoticed. A developer upgrading a laptop will see an IDLE hang and connect it to the upgrade. A CI pipeline is different. A workflow that asks for a floating label such as macos-latest changes operating system when the provider moves the label, without a commit in the repository. If that pipeline runs CodeQL with autobuild for a Swift or C++ project, the first sign may be a failing or empty analysis on a day nobody changed anything.
The practical rule from both notes is the same: pin it. For macOS runners that run traced CodeQL builds, request macOS 26 explicitly and keep Xcode 26 selected until GitHub's work on build-mode: none for macOS lands. For machines that depend on Tk tooling, treat macOS 27.0 as a change to test, not a routine update, and follow CPython issue #158053. And when the pin is eventually lifted, lift it deliberately, with a note saying which upstream change made it safe — otherwise the pin outlives the reason and becomes the next unexplained constraint.
The general lesson is older than either release: when a dependency outside your repository changes, your release notes can describe the problem, but only a version you control can contain it.
Sources: Python 3.15.0 release page — https://www.python.org/downloads/release/python-3150/ ; GitHub Changelog, CodeQL 2.27.2, 9 October 2026 — https://github.blog/changelog/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis