Thanks for the report! At a brief glance I agree this looks like a false positive. The code you link to implements operator= using a templated move_assign function, which appears to return *this in all code paths, but the analysis used by this particular query has not taken that fact into account.

I have passed your suggestion on to the CodeQL C/C++ analysis team. Our current focus is on improving our security analysis. Because your report does not relate to a security query, we will put this on our backlog and prioritize it if we get enough reports of the same underlying issue in other projects. (If you think that your report is related to our security analysis, please clarify that in a comment.) We'll let you know here as soon as it's fixed.

In the meantime, GitHub Code Scanning and lgtm.com have facilities for suppressing individual alerts or disabling a query: please feel free to use those features as appropriate in your codebase, particularly if these alerts are proving noisy.

Thanks a lot for the quick response! Well, gaps in code analysis are always a security risk, no? ;)
Thanks again - I'll check how to suppress these gracefully as I don't want to cheat the system. :)