GitHub

Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is now generally available for GitHub Ente...

You can now use the generally available Xcode 27 runner image to build and test your Apple applications in GitHub Actions. Previously in public preview, this GitHub-hosted image runs on… The post Xcode 27 runner im...

GitHub has updated its Slack and Microsoft Teams integrations to allow users to interact with multiple repositories within a single conversation thread. Users can now create issues and open pull requests across different repositories without switching contexts.

GitHub Copilot integrations for Slack and Microsoft Teams now support querying across multiple repositories within a single conversation thread. This update removes the previous restriction that limited AI-assisted context retrieval to a single repository per session.

Multi-repo support in Slack and Teams GitHub Copilot in Slack and Teams now supports working across multiple repositories in a single conversation. Whether you’re tracking pull requests, investigating issues, or&#8...

You can now download a CSV report of your GitHub Code Quality license usage to reconcile your license count with your own records. The report includes: Each active committer who… The post Download GitHub Code Quali...

Code scanning AI Scan for pull requests is now generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently… The post AI ...

Agentic autofix for code scanning alerts is now generally available. It remediates alerts by working across your codebase the way a developer would: it explores relevant files, proposes a fix,… The post Agentic aut...

As of October 15, 2026, email notifications for repository push events have been retired and are no longer sent. We shut down this feature to help prevent spam and abuse.… The post Email notifications for repositor...

GitHub has updated the HydraFusion model pool and orchestration workflows. The company has also introduced a new tier called HydraFusion Max across VS Code, the GitHub Copilot app, and GitHub Copilot.

GitHub has introduced workflow dependency lockfiles for GitHub Actions, currently available in public preview. This feature is restricted to GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency.

GitHub has introduced new granular permission controls and management workflows for GitHub Apps. These updates are designed to facilitate the migration from classic Personal Access Tokens (PATs) to more secure, scoped GitHub App authentication.

Google's Gemini 4 Argon model is now generally available for use within the GitHub Copilot platform. This integration enables users to leverage the model for complex coding, agentic workflows, and advanced reasoning tasks.

GitHub has updated its audit log to include tracking for the manual dismissal and reopening of Code Quality findings. This change provides visibility into the lifecycle management of security and quality alerts within organization and enterprise environments.

Secret scanning now detects new secret types from Salesforce, Anthropic, and Cloudsmith, with the new Anthropic secret types blocked with push protection by default. New secret scanning partner Salesforce is… The p...

Enterprise administrators can now mandate that GitHub Copilot clients fetch server-managed settings at startup rather than using cached policies. The update also introduces a minimum client version requirement for GitHub Copilot.

GitHub has introduced two specific mechanisms to identify when Dependabot alerts are withdrawn due to invalidation of the underlying advisory. These changes allow users to programmatically or manually track the lifecycle of security alerts that are no longer applicable.

GitHub has introduced a new telemetry setting that allows enterprise administrators to attribute Copilot activity to specific users. This feature enables identity tracking without the collection of prompts, responses, or tool content.

GitHub now records the authenticated identity of the user who pushed a commit to a repository. This pusher identity is now exposed alongside existing author and committer metadata in both the web UI and the API.

GitHub now allows users to configure organization-level private registries to use an anonymous authentication method. This enables Dependabot to access internal package mirrors that do not require explicit credentials.

GitHub Copilot for JetBrains now includes user-configurable settings for default LLM selection and Model Context Protocol (MCP) server integration. The update also introduces refined diagnostic tools and enhanced navigation controls within the chat interface.

GitHub has integrated the Claude 3.5 Haiku model into the GitHub Copilot platform. The update introduces granular access controls for agents and improved multi-account environment management.

GitHub released CodeQL version 2.27.2, which introduces a dedicated regular-expression parser for C++. The update also includes specific analysis logic refinements for Go, Rust, and JavaScript.

GitHub has introduced new billing and license management controls for Copilot code review features. Organization owners can now consolidate the billing for Copilot code reviews performed by members directly to the organization's account.

GitHub has expanded the ability to archive and unarchive pull requests to users with the 'Triage' role or higher. This change removes the previous requirement that only repository administrators could perform these actions.

GitHub has updated the DOM structure of issue and pull request timelines to be semantically recognized as list elements. Assistive technology now provides users with item counts, list structure, and current position markers while navigating these timelines.

Maintainers are seeing more low-quality contributions in their repositories and need better ways to manage them. You can now configure pull request limits to also include draft pull requests. Previously,… The post ...

Anthropic's Claude Haiku 5.5 model is now generally available for use within the GitHub Copilot ecosystem. This integration specifically targets high-volume, low-latency tasks such as terminal command generation, subagent operations, and rapid code edits.

GitHub has introduced a new purpose-built machine learning model specifically designed for the detection of leaked secrets in codebases. This model provides context-aware scanning capabilities to identify sensitive information more accurately than previous methods.

GitHub has moved local sandboxing for Copilot from beta to general availability across the Copilot CLI, Copilot app, and VS Code Agent Host. This feature allows developers to execute AI-generated code within a secure, isolated local environment.

GitHub Copilot CLI version 1.0.94-0 introduces the '/model' command to allow users to identify and select supported local models. This update enables model discovery directly within the command-line interface workflow.

GitHub identified a telemetry bug causing underreporting of agent activity and agent-generated lines of code in Copilot usage metrics. Users must update their IDE extensions to restore accurate tracking of these specific metrics.

GitHub has officially moved the stacked pull requests feature out of public beta and into general availability. This functionality allows developers to decompose large code changes into a series of smaller, dependent pull requests that can be reviewed and merged sequentially.

Organization and enterprise administrators can now view the enablement status of AI Scan for pull requests within the security overview coverage dashboard. This update provides a centralized summary identifying which repositories have AI-powered code scanning active and which do not.

GitHub has expanded its secret scanning service to include automated detection for credentials associated with Lovable Labs, Pydantic Services Inc., and Supabase. This update integrates these specific providers into the GitHub secret scanning partnership program.

GitHub has completed the transition to a stateless format for all newly minted GitHub App installation tokens. This change eliminates the need for GitHub to maintain a server-side database record for every active installation token.

GitHub Copilot code review functionality is now accessible via REST and GraphQL APIs. The default review effort level for these requests has been updated to 'Balanced'.

GitHub has introduced a 48-hour expiration window for unvalidated npm trusted publishing configurations. Configurations that remain unvalidated beyond this timeframe are automatically invalidated and lose authorization to publish packages.

The npm staged publishing workflow now allows for the initialization and creation of entirely new packages. This capability is supported via local sessions or granular access tokens, including stage-only tokens.

As of today, October 2, 2026, we have deprecated the following models across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions). Model… The post Selecte...

GitHub has expanded the SecurityAdvisory object within its GraphQL API by adding five new fields. This update allows developers to retrieve comprehensive data from the GitHub Advisory Database directly through GraphQL queries.

GitHub has introduced a confidential commenting feature for repository security advisories. These comments are restricted to users with repository write access to facilitate private vulnerability discussions.

GitHub has introduced a new REST API endpoint allowing developers to programmatically read, add, and edit comments on repository security advisories. This functionality extends to advisories generated via private vulnerability reports.

Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit… The post Rate li...

GitHub has introduced structured forms for private vulnerability reporting to replace unstructured free-text submissions. These forms mandate specific fields, including a reproducible proof of concept, to streamline the assessment process.

GitHub Copilot has introduced 'computer use' capabilities in public preview for the CLI and desktop applications on macOS and Windows. This feature enables the AI to actively interact with desktop software on behalf of the user.

GitHub introduced agent-driven development workflows for VS Code versions 1.136 through 1.140. The update adds automated handling for repeatable tasks and a new agent-assisted pull request merge capability.

GitHub now automatically detects and highlights ACCESSIBILITY.md files located in the repository root, .github/, or docs/ directories. This feature surfaces accessibility documentation directly on the repository overview page for improved visibility.

GitHub has unified the retention policy for workflow metadata, including checks, runs, and statuses, under the existing GitHub Actions retention settings. These records will now be automatically purged based on the same duration configured for artifacts and logs.

GitHub has introduced an opt-in capability allowing npm trusted publishing configurations to manage dist-tags via OIDC credentials. This update enables automated workflows to promote versions to 'latest' or update 'next' and 'beta' pointers without static tokens.

GitHub Team customers can now initiate self-serve trials for GitHub Advanced Security. This trial provides access to GitHub Code Security and GitHub Secret Protection features directly via the organization's billing and overview settings.

The HydraFusion research model is now accessible within the Visual Studio Code editor and the standalone GitHub Copilot mobile application. This release expands the model's availability beyond its previous restriction to the Copilot CLI environment.

Beginning October 7, 2026, GitHub Enterprise Cloud with data residency will no longer accept TLS connections from clients that offer only X25519 for key agreement. Most customers don’t need to… The post X2551...

Repository administrators can now specify custom runner types, labels, and runner groups for Dependabot version and security updates. This update allows Dependabot to execute within private or specialized infrastructure environments rather than relying solely on GitHub-hosted runners.

GitHub now allows users to programmatically sync repository metadata from external systems of record into custom repository properties. This integration enables the automated population of repository-level attributes using data from CMDBs or internal developer portals.

GitHub has integrated the OpenAI GPT-6.1 Sol model into the GitHub Copilot platform. This update enables agentic coding capabilities and supports complex multistep terminal workflows.

The enforcement date for GitHub Actions minimum version requirements for self-hosted runners on GitHub Enterprise Cloud has changed. The change ships Monday, September 28, 2026, and full enforcement now begins… The...

Anthropic's Claude Sonnet 5.5 model is now generally available for use within the GitHub Copilot interface. This integration allows developers to select the model specifically for tasks such as feature development and bug remediation.

GitHub unveiled Copilot Workspace, an agentic environment where developers can turn a GitHub issue into a complete multi-file pull request plan and tested code diff.

GitHub has introduced an in-product validation tool for GitHub Copilot enterprise managed settings. This tool automatically identifies malformed JSON, unsupported configurations, and invalid team mappings during the configuration process.

The GitHub Usage metrics API now includes a pull_request_review_times array for repository-level Copilot metrics. This addition provides granular data on the duration pull requests spend in specific review stages.

GitHub has introduced private saved views for repository issues, allowing users to store personalized filter configurations. Additionally, a new 'Relates to' relationship type is now available for linking GitHub issues.

GitHub has modified the counting mechanism for workflow run queries within the Actions API and UI. The system now prioritizes query accuracy over exact record precision when filtering by workflow, event, status, or branch.

Agentic autofix now uses Copilot Memory for customers who’ve enabled it. When you use agentic autofix, it reviews existing memories for context that can help resolve security alerts. When it… The post Agentic...

This week’s releases add new models to Copilot, local sandboxing in the Copilot app, and updates to Copilot in Slack, Microsoft Teams, JetBrains, and VS Code. GitHub Copilot Claude Opus… The post GitHub Copil...

GitHub Copilot integration for Slack and Microsoft Teams now supports expanded context sharing for files. The update introduces refined user controls to bridge the gap between chat-based discussions and GitHub repository workflows.

CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find… The post CodeQL 2...

GitHub is transitioning to a global default policy that automatically enables all generally available Copilot features and supported client capabilities for Business and Enterprise organizations. Administrators are granted a 28-day window to review and adjust these settings before the new default policy takes effect.

You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub’s sudo&#8230...

GitHub has removed expired artifacts from the Actions run summary UI and the REST API response. These items are now completely hidden rather than being marked with an 'Expired' status indicator.

GitHub has expanded Copilot code review configuration options to a broader range of subscription plans. Enterprise administrators can now set default code review configurations at the organization level.

This is the final notification that Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no… The...

Local sandboxing helps reduce the potential impact of unintended commands by limiting access to files, network resources, and credentials on your machine. In the GitHub Copilot app, you configure it… The post Local...

GitHub Copilot has expanded its model selection to include GPT-6 Sol for agentic coding and GPT-6 Luna for cost-efficient, lightweight tasks. These models are now available across the Copilot ecosystem, including VS Code, JetBrains, and the Copilot CLI.

GitHub Copilot now supports OpenTelemetry (OTel) configuration for observability. This integration allows enterprise administrators to monitor agent performance and interactions with models and tools.

GitHub Copilot for JetBrains version 1.18.0 introduces AI-assisted tool approvals and granular control over agent conversations. The update also enables the sharing of custom skills and instructions across organizational accounts.

GitHub Copilot now supports whole codebase indexing specifically for C++ repositories. This update enables the AI to process and reference millions of lines of code across deeply connected source files.

GitHub has integrated Anthropic's Claude Opus 5.5 model into the GitHub Copilot platform. Users can now select this specific model for agentic coding workflows and long-running knowledge tasks.

GitHub has integrated two new models, GPT-6 Sol and GPT-6 Luna, into the GitHub Copilot platform. These models join the existing GPT-6 Astra to expand the available model selection for users.

GitHub is deprecating support for legacy SSH algorithms and increasing the minimum RSA key size requirement. These changes enforce stronger cryptographic standards for all SSH-based authentication to the platform.

Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as deprecated....

The new repository pull requests page is now generally available to all GitHub users. Highlights The new page makes it easier to find and act on pull requests in a… The post Refreshed repository pull requests page ...

GitHub Enterprise now allows owners to export a comprehensive inventory of all credentials authorized to access their enterprise environment. This includes SSH keys, classic personal access tokens, fine-grained personal access tokens, and OAuth App access tokens.

GitHub has integrated xAI's Grok 4.7 reasoning model into the Copilot platform. This update replaces the previous Grok 4.6 model to support agentic coding and complex, multistep workflows.

GitHub Copilot code review now tracks review history chronologically and includes automated resolution of its own suggestions. The system now automatically generates commit messages upon the acceptance of suggested code changes.

GitHub has extended the 'Restrict code coverage' repository ruleset condition to be fully manageable via the REST API. This update enables programmatic configuration of code coverage enforcement policies previously restricted to the web UI.

This week, GitHub Copilot adds new model selection options, code review updates, and Sentry integration in the Copilot app. There are also updates for admins, plus new agent features in… The post GitHub Copilot wee...

We will deprecate the following models across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions) on October 19th, 2026: Model Deprecation date… The post...

GitHub has introduced a new 'Read and write (stage only)' permission level for npm granular access tokens. This feature allows automated workflows to stage package versions for review without granting full publishing privileges.

The GitHub Copilot impact dashboard has been updated to display granular engagement metrics for specific Copilot features. Enterprise administrators can now track active user adoption rates across individual feature sets.

GitHub has updated the Copilot usage metrics API to include granular telemetry for agentic CLI activities. The API now tracks usage data for skills, custom agents, Model Context Protocol (MCP) servers, slash commands, and plugins.

The Ubuntu 26.04 runner image for GitHub Actions has transitioned from public preview to general availability. This release provides full production support for both x64 and arm64 architectures.

GitHub has moved workflow execution protections from public preview to general availability for all Enterprise, organization, and repository levels. This feature enables administrators to enforce allowlists that restrict which users can trigger specific GitHub Actions workflows.

Enterprise administrators can now programmatically authorize existing classic personal access tokens and SSH keys for organizations within GitHub Enterprise Cloud. This capability eliminates the requirement for individual developers to manually authorize these credentials on a per-organization basis.

GitHub has updated its SCIM API responses to include the 'profileUrl' attribute as defined by RFC 7643. This attribute provides the absolute URL for the GitHub account associated with an external identity.

GitHub has introduced a formal workflow allowing users to request additional Copilot AI credits once their initial allocation is exhausted. This feature removes the hard block previously imposed on users who reached their credit limit.

GitHub has decoupled the AI Scan feature for pull requests from the mandatory requirement of CodeQL default setup. Users can now execute AI-driven security vulnerability detection on repositories without configuring the standard CodeQL analysis pipeline.

Enterprise administrators can now mandate specific GitHub Advanced Security settings across all organizations within an enterprise. This capability prevents organization and repository-level administrators from overriding security configurations defined at the enterprise level.

GitHub Copilot now provides AI-driven suggestions for allowed values when defining custom repository properties. This feature is currently available in public preview for GitHub Copilot Business and Copilot Enterprise users.

GitHub has officially disabled support for the SHA-1 cryptographic hash algorithm within HTTPS connections for github.com and partner services. This change enforces the use of more secure hashing algorithms for all incoming web traffic.

GitHub Copilot now allows users to select between three distinct tiers—efficiency, balance, and intelligence—for auto model selection. This configuration enables users to prioritize specific trade-offs between computational cost, code quality, and response latency.

GitHub profile achievement displays have been updated to prioritize the highest earned tier for multi-level badges. Previously, the profile UI defaulted to displaying the initial tier earned regardless of subsequent progress.

GitHub Copilot usage metrics now include activity data from the dedicated VS Code Agents window. This update enables administrators to track adoption and engagement metrics specifically for agent-based interactions within the VS Code environment.

GitHub Copilot code review now automatically resolves comments upon user remediation and generates automated commit messages for applied code suggestions. These updates streamline the pull request workflow by reducing manual interaction with the Copilot interface.

GitHub Copilot has integrated Jira support into its application and introduced Project HydraFusion for adaptive model orchestration within the Copilot CLI. Additionally, new agent automation capabilities have been deployed for the Visual Studio Code extension.

GitHub has introduced a redesigned repository-level pull request listing page currently available in public preview. The update adds advanced filtering capabilities and a new compact presentation mode for managing pull requests.

GitHub has introduced new REST API endpoints to programmatically manage AI Scan for pull requests. These endpoints allow for configuration at both the organization and repository levels.

GitHub has introduced a new 'cache-mode' parameter for GitHub Actions workflows. This feature allows users to enforce least-privilege access controls on cache resources at the individual workflow or job level.

GitHub has released the Xcode 27 runner image for GitHub-hosted macOS runners into public preview. This update enables developers to validate Apple applications specifically against the macOS 27 environment.

npm has implemented a mandatory 72-hour security hold on all accounts following a successful sign-in via recovery codes. This policy replaces the previous restriction that limited such holds exclusively to high-impact accounts.

CodeQL 2.27.0 introduces native support for the Linux ARM64 architecture. The release also adds a new security query for Rust and expands framework coverage for Java, Kotlin, and C#.

GitHub has introduced centralized policy controls for Copilot agent operations within Copilot Business and Enterprise plans. Administrators can now configure specific agent actions to be blocked, require human approval, or execute automatically.

GitHub has transitioned the GitHub Advanced Security (GHAS) trial process to a self-serve model for a broader segment of GitHub Enterprise Cloud customers. This update removes the requirement for manual sales intervention to initiate evaluations of Code Security and Secret Protection features.

GitHub has integrated secret scanning alerts directly into repository rulesets to prevent the merging of pull requests containing exposed secrets. This feature allows administrators to enforce automated blocking of code contributions that fail secret scanning checks.

GitHub has introduced an agentic autofix capability that allows users to automatically remediate code quality findings. Users can now select up to 25 standard findings simultaneously to trigger automated remediation workflows.

GitHub Copilot for JetBrains now supports enterprise-managed sandbox policies and cross-file cursor jumps for edit suggestions. The update also introduces global project context for chat, enterprise policy diagnostics, and integrated terminal connectivity.

GitHub has consolidated its support, documentation, learning, community, and account management resources into a single centralized portal at help.github.com. The new interface integrates a Copilot-powered search engine to assist users in navigating these resources.

Dependabot can now authenticate to private GitHub Packages registries using the repository's built-in GITHUB_TOKEN instead of requiring a manual personal access token. This functionality is enabled when the repository is explicitly granted access via the 'Manage Actions access' settings within the package configuration.

GitHub Copilot has integrated the Claude 3.5 Sonnet model and introduced expanded content protection features. VS Code users now have access to new session management tools and automated pull request preparation workflows.

OpenAI's GPT-6 Astra model is now integrated into the GitHub Copilot platform. This model is specifically optimized for long-horizon autonomous coding and agentic workflows.

GitHub has introduced a new REST API endpoint that allows users to retrieve repository star growth data over time. This endpoint provides historical star counts without exposing the individual identities of the users who starred the repository.

npm now supports multiple trusted publishing configurations for a single package. This update allows maintainers to define multiple OIDC-based publishing workflows for one npm package.

GitHub has introduced a new REST API that provides programmatic access to runner version deprecation schedules. This update enables developers to monitor and manage runner lifecycle transitions through automated workflows.

GitHub opened Copilot Workspace, an agentic development environment where developers brainstorm, plan, build, and test software from GitHub Issues in natural language.