GitHub

Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit… The post Rate li...

GitHub has introduced structured forms for private vulnerability reporting to replace unstructured free-text submissions. These forms mandate specific fields, including a reproducible proof of concept, to streamline the assessment process.

GitHub Copilot has introduced 'computer use' capabilities in public preview for the CLI and desktop applications on macOS and Windows. This feature enables the AI to actively interact with desktop software on behalf of the user.

GitHub introduced agent-driven development workflows for VS Code versions 1.136 through 1.140. The update adds automated handling for repeatable tasks and a new agent-assisted pull request merge capability.

GitHub now automatically detects and highlights ACCESSIBILITY.md files located in the repository root, .github/, or docs/ directories. This feature surfaces accessibility documentation directly on the repository overview page for improved visibility.

GitHub has unified the retention policy for workflow metadata, including checks, runs, and statuses, under the existing GitHub Actions retention settings. These records will now be automatically purged based on the same duration configured for artifacts and logs.

GitHub has introduced an opt-in capability allowing npm trusted publishing configurations to manage dist-tags via OIDC credentials. This update enables automated workflows to promote versions to 'latest' or update 'next' and 'beta' pointers without static tokens.

GitHub Team customers can now initiate self-serve trials for GitHub Advanced Security. This trial provides access to GitHub Code Security and GitHub Secret Protection features directly via the organization's billing and overview settings.

The HydraFusion research model is now accessible within the Visual Studio Code editor and the standalone GitHub Copilot mobile application. This release expands the model's availability beyond its previous restriction to the Copilot CLI environment.

Beginning October 7, 2026, GitHub Enterprise Cloud with data residency will no longer accept TLS connections from clients that offer only X25519 for key agreement. Most customers don’t need to… The post X2551...

Repository administrators can now specify custom runner types, labels, and runner groups for Dependabot version and security updates. This update allows Dependabot to execute within private or specialized infrastructure environments rather than relying solely on GitHub-hosted runners.

GitHub now allows users to programmatically sync repository metadata from external systems of record into custom repository properties. This integration enables the automated population of repository-level attributes using data from CMDBs or internal developer portals.

GitHub has integrated the OpenAI GPT-6.1 Sol model into the GitHub Copilot platform. This update enables agentic coding capabilities and supports complex multistep terminal workflows.

The enforcement date for GitHub Actions minimum version requirements for self-hosted runners on GitHub Enterprise Cloud has changed. The change ships Monday, September 28, 2026, and full enforcement now begins… The...

Anthropic's Claude Sonnet 5.5 model is now generally available for use within the GitHub Copilot interface. This integration allows developers to select the model specifically for tasks such as feature development and bug remediation.

GitHub unveiled Copilot Workspace, an agentic environment where developers can turn a GitHub issue into a complete multi-file pull request plan and tested code diff.

GitHub has introduced an in-product validation tool for GitHub Copilot enterprise managed settings. This tool automatically identifies malformed JSON, unsupported configurations, and invalid team mappings during the configuration process.

The GitHub Usage metrics API now includes a pull_request_review_times array for repository-level Copilot metrics. This addition provides granular data on the duration pull requests spend in specific review stages.

GitHub has introduced private saved views for repository issues, allowing users to store personalized filter configurations. Additionally, a new 'Relates to' relationship type is now available for linking GitHub issues.

GitHub has modified the counting mechanism for workflow run queries within the Actions API and UI. The system now prioritizes query accuracy over exact record precision when filtering by workflow, event, status, or branch.

Agentic autofix now uses Copilot Memory for customers who’ve enabled it. When you use agentic autofix, it reviews existing memories for context that can help resolve security alerts. When it… The post Agentic...

This week’s releases add new models to Copilot, local sandboxing in the Copilot app, and updates to Copilot in Slack, Microsoft Teams, JetBrains, and VS Code. GitHub Copilot Claude Opus… The post GitHub Copil...

GitHub Copilot integration for Slack and Microsoft Teams now supports expanded context sharing for files. The update introduces refined user controls to bridge the gap between chat-based discussions and GitHub repository workflows.

CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find… The post CodeQL 2...

GitHub is transitioning to a global default policy that automatically enables all generally available Copilot features and supported client capabilities for Business and Enterprise organizations. Administrators are granted a 28-day window to review and adjust these settings before the new default policy takes effect.

You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub’s sudo&#8230...

GitHub has removed expired artifacts from the Actions run summary UI and the REST API response. These items are now completely hidden rather than being marked with an 'Expired' status indicator.

GitHub has expanded Copilot code review configuration options to a broader range of subscription plans. Enterprise administrators can now set default code review configurations at the organization level.

This is the final notification that Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no… The...

Local sandboxing helps reduce the potential impact of unintended commands by limiting access to files, network resources, and credentials on your machine. In the GitHub Copilot app, you configure it… The post Local...

GitHub Copilot has expanded its model selection to include GPT-6 Sol for agentic coding and GPT-6 Luna for cost-efficient, lightweight tasks. These models are now available across the Copilot ecosystem, including VS Code, JetBrains, and the Copilot CLI.

GitHub Copilot now supports OpenTelemetry (OTel) configuration for observability. This integration allows enterprise administrators to monitor agent performance and interactions with models and tools.

GitHub Copilot for JetBrains version 1.18.0 introduces AI-assisted tool approvals and granular control over agent conversations. The update also enables the sharing of custom skills and instructions across organizational accounts.

GitHub Copilot now supports whole codebase indexing specifically for C++ repositories. This update enables the AI to process and reference millions of lines of code across deeply connected source files.

GitHub has integrated Anthropic's Claude Opus 5.5 model into the GitHub Copilot platform. Users can now select this specific model for agentic coding workflows and long-running knowledge tasks.

GitHub has integrated two new models, GPT-6 Sol and GPT-6 Luna, into the GitHub Copilot platform. These models join the existing GPT-6 Astra to expand the available model selection for users.

GitHub is deprecating support for legacy SSH algorithms and increasing the minimum RSA key size requirement. These changes enforce stronger cryptographic standards for all SSH-based authentication to the platform.

Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as deprecated....

The new repository pull requests page is now generally available to all GitHub users. Highlights The new page makes it easier to find and act on pull requests in a… The post Refreshed repository pull requests page ...

GitHub Enterprise now allows owners to export a comprehensive inventory of all credentials authorized to access their enterprise environment. This includes SSH keys, classic personal access tokens, fine-grained personal access tokens, and OAuth App access tokens.

GitHub has integrated xAI's Grok 4.7 reasoning model into the Copilot platform. This update replaces the previous Grok 4.6 model to support agentic coding and complex, multistep workflows.

GitHub Copilot code review now tracks review history chronologically and includes automated resolution of its own suggestions. The system now automatically generates commit messages upon the acceptance of suggested code changes.

GitHub has extended the 'Restrict code coverage' repository ruleset condition to be fully manageable via the REST API. This update enables programmatic configuration of code coverage enforcement policies previously restricted to the web UI.

This week, GitHub Copilot adds new model selection options, code review updates, and Sentry integration in the Copilot app. There are also updates for admins, plus new agent features in… The post GitHub Copilot wee...

We will deprecate the following models across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions) on October 19th, 2026: Model Deprecation date… The post...

GitHub has introduced a new 'Read and write (stage only)' permission level for npm granular access tokens. This feature allows automated workflows to stage package versions for review without granting full publishing privileges.

The GitHub Copilot impact dashboard has been updated to display granular engagement metrics for specific Copilot features. Enterprise administrators can now track active user adoption rates across individual feature sets.

GitHub has updated the Copilot usage metrics API to include granular telemetry for agentic CLI activities. The API now tracks usage data for skills, custom agents, Model Context Protocol (MCP) servers, slash commands, and plugins.

The Ubuntu 26.04 runner image for GitHub Actions has transitioned from public preview to general availability. This release provides full production support for both x64 and arm64 architectures.

GitHub has moved workflow execution protections from public preview to general availability for all Enterprise, organization, and repository levels. This feature enables administrators to enforce allowlists that restrict which users can trigger specific GitHub Actions workflows.

Enterprise administrators can now programmatically authorize existing classic personal access tokens and SSH keys for organizations within GitHub Enterprise Cloud. This capability eliminates the requirement for individual developers to manually authorize these credentials on a per-organization basis.

GitHub has updated its SCIM API responses to include the 'profileUrl' attribute as defined by RFC 7643. This attribute provides the absolute URL for the GitHub account associated with an external identity.

GitHub has introduced a formal workflow allowing users to request additional Copilot AI credits once their initial allocation is exhausted. This feature removes the hard block previously imposed on users who reached their credit limit.

GitHub has decoupled the AI Scan feature for pull requests from the mandatory requirement of CodeQL default setup. Users can now execute AI-driven security vulnerability detection on repositories without configuring the standard CodeQL analysis pipeline.

Enterprise administrators can now mandate specific GitHub Advanced Security settings across all organizations within an enterprise. This capability prevents organization and repository-level administrators from overriding security configurations defined at the enterprise level.

GitHub Copilot now provides AI-driven suggestions for allowed values when defining custom repository properties. This feature is currently available in public preview for GitHub Copilot Business and Copilot Enterprise users.

GitHub has officially disabled support for the SHA-1 cryptographic hash algorithm within HTTPS connections for github.com and partner services. This change enforces the use of more secure hashing algorithms for all incoming web traffic.

GitHub Copilot now allows users to select between three distinct tiers—efficiency, balance, and intelligence—for auto model selection. This configuration enables users to prioritize specific trade-offs between computational cost, code quality, and response latency.

GitHub profile achievement displays have been updated to prioritize the highest earned tier for multi-level badges. Previously, the profile UI defaulted to displaying the initial tier earned regardless of subsequent progress.

GitHub Copilot usage metrics now include activity data from the dedicated VS Code Agents window. This update enables administrators to track adoption and engagement metrics specifically for agent-based interactions within the VS Code environment.

GitHub Copilot code review now automatically resolves comments upon user remediation and generates automated commit messages for applied code suggestions. These updates streamline the pull request workflow by reducing manual interaction with the Copilot interface.

GitHub Copilot has integrated Jira support into its application and introduced Project HydraFusion for adaptive model orchestration within the Copilot CLI. Additionally, new agent automation capabilities have been deployed for the Visual Studio Code extension.

GitHub has introduced a redesigned repository-level pull request listing page currently available in public preview. The update adds advanced filtering capabilities and a new compact presentation mode for managing pull requests.

GitHub has introduced new REST API endpoints to programmatically manage AI Scan for pull requests. These endpoints allow for configuration at both the organization and repository levels.

GitHub has introduced a new 'cache-mode' parameter for GitHub Actions workflows. This feature allows users to enforce least-privilege access controls on cache resources at the individual workflow or job level.

GitHub has released the Xcode 27 runner image for GitHub-hosted macOS runners into public preview. This update enables developers to validate Apple applications specifically against the macOS 27 environment.

npm has implemented a mandatory 72-hour security hold on all accounts following a successful sign-in via recovery codes. This policy replaces the previous restriction that limited such holds exclusively to high-impact accounts.

CodeQL 2.27.0 introduces native support for the Linux ARM64 architecture. The release also adds a new security query for Rust and expands framework coverage for Java, Kotlin, and C#.

GitHub has introduced centralized policy controls for Copilot agent operations within Copilot Business and Enterprise plans. Administrators can now configure specific agent actions to be blocked, require human approval, or execute automatically.

GitHub has transitioned the GitHub Advanced Security (GHAS) trial process to a self-serve model for a broader segment of GitHub Enterprise Cloud customers. This update removes the requirement for manual sales intervention to initiate evaluations of Code Security and Secret Protection features.

GitHub has integrated secret scanning alerts directly into repository rulesets to prevent the merging of pull requests containing exposed secrets. This feature allows administrators to enforce automated blocking of code contributions that fail secret scanning checks.

GitHub has introduced an agentic autofix capability that allows users to automatically remediate code quality findings. Users can now select up to 25 standard findings simultaneously to trigger automated remediation workflows.

GitHub Copilot for JetBrains now supports enterprise-managed sandbox policies and cross-file cursor jumps for edit suggestions. The update also introduces global project context for chat, enterprise policy diagnostics, and integrated terminal connectivity.

GitHub has consolidated its support, documentation, learning, community, and account management resources into a single centralized portal at help.github.com. The new interface integrates a Copilot-powered search engine to assist users in navigating these resources.

Dependabot can now authenticate to private GitHub Packages registries using the repository's built-in GITHUB_TOKEN instead of requiring a manual personal access token. This functionality is enabled when the repository is explicitly granted access via the 'Manage Actions access' settings within the package configuration.

GitHub Copilot has integrated the Claude 3.5 Sonnet model and introduced expanded content protection features. VS Code users now have access to new session management tools and automated pull request preparation workflows.

OpenAI's GPT-6 Astra model is now integrated into the GitHub Copilot platform. This model is specifically optimized for long-horizon autonomous coding and agentic workflows.

GitHub has introduced a new REST API endpoint that allows users to retrieve repository star growth data over time. This endpoint provides historical star counts without exposing the individual identities of the users who starred the repository.

npm now supports multiple trusted publishing configurations for a single package. This update allows maintainers to define multiple OIDC-based publishing workflows for one npm package.

GitHub has introduced a new REST API that provides programmatic access to runner version deprecation schedules. This update enables developers to monitor and manage runner lifecycle transitions through automated workflows.

GitHub opened Copilot Workspace, an agentic development environment where developers brainstorm, plan, build, and test software from GitHub Issues in natural language.