GitHub deprecates the all-platform CodeQL bundle with a March 2027 removal
Serguey Asael Shinder1 min readGitHub has marked the all-platform CodeQL bundle as deprecated, starting with CodeQL CLI 2.27.0. The notice, dated 22 September 2026, covers codeql-bundle.tar.gz and codeql-bundle.tar.zst, the archives that carry binaries for every supported platform up to a given release.
The removal date is stated: mid-March 2027. Until then the advice is to download the platform-specific bundle for the operating system and architecture in use.
One detail is easy to miss and changes the shape of the migration: Linux ARM64 binaries are available only through the platform-specific downloads and were never part of the all-platform bundle in the first place.
What it means
This is a build-pipeline change rather than a scanning change, and it lands in the place where such changes usually hide — a pinned URL in a workflow file or a Dockerfile, written once and never revisited. Nothing breaks today, which is exactly why this is the moment to grep for the bundle filenames rather than in March 2027.
The ARM64 line is the useful part of the announcement. Anyone who moved CI runners to ARM and found CodeQL missing from the all-platform archive has already solved this by hand; everyone else now has a documented reason why the single-archive habit does not survive a mixed- architecture fleet. If the bundle is fetched in more than one repository, the migration is worth doing as a single sweep, because the failure mode after removal is a 404 in every job at once.