Currently we're using v1, and there have been some important changes since then.
In particular, the latest version, v2.14.4, contains an important security patch:
> The CodeQL CLI no longer supports the `SEMMLE_JAVA_ARGS` environment variable. All previous versions of the CodeQL CLI perform command substitution on the `SEMMLE_JAVA_ARGS` value (for example, replacing `'$(echo foo)'` with `'foo'`) when starting a new Java virtual machine, which, depending on the execution environment, may have security implications. Users are advised to check their environments for possible `SEMMLE_JAVA_ARGS` misuse.
See the [codeql-action release notes](https://github.com/github/codeql-cli-binaries/releases/tag/v2.14.4) for full details.
Patrick Ellis