Code hosting and collaboration platform. Product changelog covering Actions, Copilot, repos, and more.
GitHub has released improvements to GitHub Apps that enable developers to migrate away from classic personal access tokens, enhance app management capabilities, and request fewer sensitive permissions for better security.
Google's Gemini 4 Argon frontier model is now generally available in GitHub Copilot, designed for complex coding, agentic, and reasoning tasks to enhance developer productivity.
Users can now review manual dismissals and reopenings of GitHub Code Quality findings in their organization or enterprise audit log, enabling better tracking and governance of code quality decisions.
Secret scanning has been expanded to detect new secret types from Salesforce, Anthropic, and Cloudsmith, with Anthropic secrets now blocked by default via push protection. This helps prevent accidental exposure of third-party credentials in repositories.
Enterprise administrators can now require GitHub Copilot clients to retrieve current server-managed settings at startup instead of using cached policy, with new minimum client version requirements.
Dependabot now provides improved detection for withdrawn alerts that are no longer valid due to advisory or vulnerability changes. This makes it easier to identify and manage alerts that have been removed.
The Budgets and alerts page in GitHub billing settings now displays all budgets in a single searchable and filterable list, making it easier to manage multiple budgets.
Organization and enterprise administrators can now view metrics showing AI Scan findings generated and resolved in the security overview dashboard, providing visibility into the impact of AI-powered code scanning on pull requests.
Enterprise administrators can now attribute GitHub Copilot activity to specific users through managed telemetry settings without collecting prompts, responses, or tool content. The telemetry.capture.identity setting provides granular control over data capture.
GitHub now records the authenticated user who pushed each commit and displays the pusher identity in the UI and API alongside author and committer information.
Dependabot now supports anonymous authentication for organization-level private registries, enabling access to internal package mirrors and other registries that don't require credentials.
GitHub Copilot for JetBrains now offers more control over default models and MCP server configuration, improved diagnostics handling, and enhanced chat navigation and account controls.
Weekly updates to GitHub Copilot improve cross-account and cross-environment usability while enhancing control over agent access and work management.
CodeQL 2.27.2 adds a C++ regular-expression parser and improves static analysis capabilities across C++, Go, Rust, and JavaScript languages for better code scanning detection.
GitHub Copilot code review now includes new organization-level billing and license controls, allowing organization owners to manage how Copilot code reviews are billed to the organization.
Users with triage role or higher permissions in a repository can now archive and unarchive pull requests, expanding access beyond repository administrators to allow more team members to manage inactive pull requests.
Screen readers can now navigate issue and pull request timelines as a list, with assistive technology announcing list structure, item count, and current position for improved accessibility.
Draft pull requests now count toward repository pull request limits, giving maintainers better control over managing incoming contributions and reducing low-quality submissions.
Claude Haiku 5.5, Anthropic's lightweight model, is now generally available in GitHub Copilot for fast, high-volume tasks like subagents, quick edits, and terminal operations.
GitHub introduced a new purpose-built model for detecting leaked secrets that provides context-aware detection to keep pace with modern software development practices, including AI-assisted coding.
GitHub Copilot's local sandboxing feature is now generally available across GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host, providing developers with a secure environment for testing and development.
GitHub Copilot CLI version 1.0.94-0 adds the /model command to discover and select supported local models without leaving your existing workflow.
A bug causing agent activity and agent lines of code metrics to fall inaccurately while overall Copilot usage grew has been identified and fixed. Users should update their IDE to restore accurate metrics reporting.
Stacked pull requests are now generally available, allowing users to break large changes into smaller, focused pull requests that can be reviewed independently and merged together.
Organization and enterprise administrators can now view AI Scan for pull requests enablement status in the security overview coverage view, showing which repositories have the feature enabled.
GitHub's secret scanning now detects additional secret types from Lovable Labs, Pydantic Services Inc., and Supabase, expanding coverage for partner integrations.
GitHub has completed the rollout of stateless GitHub App installation token format. All newly created GitHub App installation tokens now use the stateless format by default.
GitHub Copilot code review is now available through REST and GraphQL APIs, allowing users to set review effort level per request. Balanced is now the default effort level.
Unvalidated npm trusted publishing configurations now expire after 48 hours and can no longer authorize publishing, reducing the risk from repository or project name changes.
npm staged publishing now allows you to create new packages using local sessions or granular access tokens, including stage-only tokens, streamlining the package creation workflow.
GitHub has deprecated certain language models across all GitHub Copilot experiences including Chat, inline edits, and code completions as of October 2, 2026.
GitHub Copilot introduces new models including Claude Sonnet 5.5, reusable workflows and desktop app automation, Azure canvases, and VS Code improvements to enhance developer productivity.
The SecurityAdvisory object in the GraphQL API now includes five new fields, allowing you to read more of the GitHub Advisory Database directly from GraphQL without needing the REST API.
You can now post confidential comments on repository security advisories that are visible only to people with write access to the repository, enabling secure discussion of vulnerability reports.
The REST API now supports reading, adding, and editing comments on repository security advisories, including those created from private vulnerability reports. This enables programmatic management of advisory discussions.
Rate limits now cap how many new vulnerability reports a single account can submit, helping maintainers avoid being overwhelmed by low-quality and automated reports.
Private vulnerability reports now support structured forms that guide reporters to provide essential assessment details including reproducible proof of concept examples, replacing free-text submission.
GitHub Copilot now has computer use capabilities available in public preview on macOS and Windows, allowing it to interact with and control desktop applications on your behalf.
The macOS 14 runner image for GitHub Actions will be retired on November 2, 2026. Jobs using macOS 14 will temporarily fail during scheduled maintenance periods to raise awareness of the upcoming removal.
September 2026 releases (v1.136-v1.140) streamline agent-driven development with automations for repeatable tasks and improvements to agent merge workflows.
Repositories can now display ACCESSIBILITY.md files from the root, .github/, or docs/ directory on the repository overview page, making accessibility commitments more visible to users and contributors.
Checks, workflow runs, and statuses are now governed by the same GitHub Actions retention setting that controls artifact and log retention, providing unified retention management across all Actions data.
Weekly scheduled scans for code scanning default setup and GitHub Code Quality now activate only after a push or pull request triggers an analysis, rather than running on all repositories regardless of activity.
The GitHub Code Quality upload-code-coverage action now successfully processes coverage uploads on new branches without open pull requests, fixing a previous issue that caused CI failures in this scenario.
Dynamic workflows are now available in Copilot CLI, the GitHub Copilot app, and the GitHub Copilot SDK, enabling you to define orchestrations in code for improved reliability and control.
The redesigned dashboard, previously available as a preview feature, is now the default view for all users to help focus on priority work.
The GitHub async merge API is now generally available, allowing users to merge individual or stacked pull requests, add pull requests to merge queues, or merge pull requests directly.
This release improves reliability, scalability, and observability for runner scale sets, enabling more stable operation of larger runner fleets with fewer disruptions during upgrades and Kubernetes events.
Trusted publishing configurations for npm can now grant permission to manage dist-tags such as promoting versions to latest or updating next and beta pointers using short-lived OIDC credentials instead of permanent tokens.
GitHub Team customers can now start self-serve trials of GitHub Advanced Security to evaluate Code Security and Secret Protection features directly from their organization's Overview or Billing page.
HydraFusion research preview is now available in Visual Studio Code and the GitHub Copilot app, expanding beyond Copilot CLI. Users can access HydraFusion through the model picker.
GitHub Enterprise Cloud with data residency will no longer accept TLS connections from clients that offer only X25519 for key agreement starting October 7, 2026. Customers should ensure their clients support additional key agreement algorithms.
Repository administrators can now configure the runner type, custom labels, and runner groups for Dependabot version and security updates, extending existing runner configuration capabilities.
GitHub now allows you to seamlessly integrate business context about your repositories from external systems of record like configuration management databases, internal developer portals, or in-house systems. This enables you to enrich your repository metadata with organization-specific information.
OpenAI's GPT-6.1 Sol model is now generally available in GitHub Copilot, enabling agentic coding and terminal workflows with improved multistep reasoning capabilities.
GitHub Actions minimum version requirements enforcement for self-hosted runners on GitHub Enterprise Cloud has been rescheduled. The new enforcement begins Monday, September 28, 2026.
Claude Sonnet 5.5, Anthropic's newest Sonnet model, is now generally available in GitHub Copilot. It is optimized for everyday development tasks like building features and fixing bugs.
GitHub Copilot now includes an in-product validator for enterprise managed settings that detects malformed JSON, unsupported configurations, invalid team mappings, and other errors to prevent configuration failures.
The Copilot usage metrics API now provides breakdown of how long pull requests spend in each review stage at the enterprise and organization repository level, with a new pull_request_review_times array for detailed analytics.
Repository issues now support private saved views for personalized filtering, and the "Relates to" issue relationship type is now generally available.
Workflow run queries in the GitHub Actions API and UI now return a less precise but more accurate count of records when searching by workflow, event, status, or branch.
Agentic autofix now integrates with Copilot Memory for enabled customers, using stored context to better resolve security alerts and improve fix quality.
This week's release adds new AI models to Copilot, introduces local sandboxing in the Copilot app, and delivers updates across Slack, Microsoft Teams, JetBrains, and VS Code integrations.
GitHub Copilot integration with Slack and Microsoft Teams has been enhanced with improved context, better user control, and simplified workflows for connecting conversations to GitHub work items and repositories.
CodeQL 2.27.1 introduces new queries for C/C++ and C#, adds support for Kotlin 2.4.20, and improves query accuracy. These enhancements expand static analysis capabilities for GitHub code scanning.
GitHub is introducing a new global default policy for generally available Copilot features and supported client capabilities in enterprise and organization settings, with a 28-day transition period.
GitHub Enterprise Cloud now supports proof of presence, requiring interactive re-authentication or multi-factor challenges before members perform high-impact actions on accounts, expanding existing sudo capabilities.
Expired artifacts are no longer displayed in the GitHub Actions run summary or returned by the REST API. Previously, expired artifacts remained visible with an "Expired" pill indicator.
GitHub Copilot code review now offers additional personal configurations across an expanded set of plans and enterprise-level default settings, enabling teams to customize code review workflows to their needs.
Node 20 has reached end of availability on GitHub Actions runners, which now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available.
Local sandboxing feature now available in the GitHub Copilot app to limit access to files, network resources, and credentials on your machine, reducing the potential impact of unintended commands.
GitHub Copilot app now supports OpenTelemetry configuration through enterprise-managed settings, enabling visibility into how Copilot agents perform and interact with models and tools.
Copilot for JetBrains 1.18.0 adds AI-assisted tool approvals, enhanced control over agent conversations, and organizational shared skills and instructions, improving team collaboration and code generation capabilities.
GitHub Copilot CLI now supports whole codebase indexing for C++, enabling faster code intelligence analysis across large repositories with millions of lines of code and deeply connected source files.
Claude Opus 5.5, Anthropic's latest model, is now available in GitHub Copilot for agentic coding, long-running tasks, and knowledge work applications.
GitHub Copilot now supports two new OpenAI GPT-6 models: Sol and Luna, expanding the model selection options available to users alongside the previously released Astra model.
GitHub is removing legacy SSH algorithms, adding a new algorithm, and requiring larger RSA SSH keys to strengthen SSH security and reduce vulnerability to attacks.
The all-platform CodeQL bundle (codeql-bundle.tar.gz and codeql-bundle.tar.zst) is deprecated starting with CodeQL CLI 2.27.0. Users should migrate to platform-specific bundles.
GitHub's redesigned pull requests page is now generally available to all users, making it easier to find and act on pull requests.
Enterprise owners can now export a complete inventory of all credentials that can access their enterprise, including SSH keys, personal access tokens, and OAuth App access tokens.
xAI's Grok 4.7 reasoning model is now rolling out in GitHub Copilot, with improvements over Grok 4.6 designed for agentic coding and complex multistep workflows.
Copilot code review now provides a clearer timeline of review changes, intelligently auto-resolves its own suggestions, and automatically generates useful commit messages when accepting changes.
The REST API now supports managing the Restrict code coverage repository ruleset option, providing programmatic control over code coverage enforcement in addition to UI support.
GitHub Copilot adds new model selection options, code review updates, and Sentry integration in the Copilot app, plus updates for admins and new agent features.
Selected GitHub Copilot models will be deprecated across all Copilot experiences including Chat, inline edits, and code completions on October 19th, 2026. Users should plan to migrate to newer models before the deprecation date.
GitHub now supports creating npm granular access tokens with Read and write (stage only) permissions, allowing automated workflows to stage package versions for review without requiring full publish access.
The Copilot impact dashboard now displays metrics on how many active users regularly use key Copilot features, enabling enterprise administrators to quickly identify which experiences are widely adopted and which may need additional attention.
GitHub Copilot's usage metrics API now includes agentic activity metrics for skills, custom agents, Model Context Protocol servers, slash commands, and plugins, expanding CLI report coverage.
Ubuntu 26.04 runner image for GitHub Actions is now fully supported for production workflows on x64 and arm64 architectures, graduating from public preview.
Workflow execution protections, previously in public preview, are now generally available for GitHub Enterprise, organizations, and repositories. This feature lets you define an allowlist that controls who can execute workflows.
Enterprise admins can now automate SSO authorization for existing classic personal access tokens and SSH keys across organizations in GitHub Enterprise Cloud, eliminating the need for manual per-organization authorization by developers.
SCIM user responses from GitHub now include the standard profileUrl attribute defined by RFC 7643, containing the absolute URL of the GitHub account linked to the external identity.
Members who exhaust their Copilot AI credits can now request budget increases instead of being blocked from Copilot features. This provides a smoother workflow for users who need additional credit allocation.
AI Scan for pull requests can now find security vulnerabilities without requiring CodeQL default setup to be enabled on a repository, expanding its accessibility for security scanning workflows.
Enterprise administrators can now enforce GitHub Advanced Security configurations across organizations, preventing organization and repository administrators from overriding enterprise-level security settings.
GitHub Copilot can now suggest allowed values when creating custom properties for repositories in your organization. This feature is in public preview for GitHub Copilot Business.
GitHub has disabled SHA-1 in HTTPS for github.com and partner services as previously announced. Users must update their systems to use modern TLS cipher suites to maintain connectivity.
GitHub Copilot auto model selection now offers three tiers—efficiency, balance, and intelligence—allowing users to configure how auto weighs cost, quality, and response time based on their preferences.
GitHub profiles now display the highest tier earned for multi-level achievements instead of showing only the first tier, improving how your progress is reflected on your profile.
GitHub Copilot usage metrics reports now include metrics for activity in the VS Code Agents window, enabling enterprises and organizations to measure adoption and engagement with agents.
97 more changes from GitHub. Sign up to read the whole changelog.
Sign up freeGitHub or email — no card needed.