GitHub Releases
GitHub changelog, platform updates, and Copilot coding-assistant releases. New features, breaking changes, security advisories and deprecations - each summarised in plain English and updated continuously.
Tracking 199 GitHub releases · Updated
- GitHub Changelog securityinfraengineer ·
GitHub Actions limits cache access for untrusted triggers
GitHub Actions now issues read-only cache tokens for untrusted triggers targeting the default branch, mitigating privilege escalation via cache poisoning. Previously, read-write tokens were issued for all events, allowing malicious actors to compromise trusted workflows. This change primarily affects untrusted workflows that write to the default-branch cache, which will now receive warnings and fail to save cache entries. To maintain caching benefits, a separate workflow with read-write access (e.g., 'push') should be used for cache saves.
security feature - GitHub Changelog infragaengineer ·
GitHub Actions: More Control Over Hosted Runners
GitHub Actions now offers organizations enhanced control over their hosted runners. Administrators can disable default runner labels and manage macOS runners through groups, improving security and capacity management. This feature is available for Team and Enterprise plans, providing granular control over runner access and concurrency.
feature - GitHub Changelog infragaengineer ·
GitHub Actions supports running workflow steps in parallel
GitHub Actions now supports running workflow steps concurrently using the `background` keyword, allowing steps to execute in parallel while maintaining distinct logs. This enhancement enables more efficient job execution by handling patterns like parallel builds or starting background services without interleaved logs. Previously, developers relied on shell backgrounding which complicated log management. This feature is available now with new keywords `background`, `wait`, `wait-all`, and `cancel`.
feature - GitHub Changelog securityinfraengineer ·
npm adds preventive account protection for high-impact accounts
npm has introduced a new preventive safeguard for accounts managing critical packages, adding a 72-hour read-only state after detecting sensitive changes like email updates or 2FA recovery code usage. This measure aims to block account-takeover attacks that have been exploited in recent supply chain incidents, ensuring package availability and user security.
feature security - GitHub Changelog infrapreviewengineer ·
GitHub Actions RHEL runner images in public preview
GitHub Actions now offers Red Hat Enterprise Linux (RHEL) 9 and RHEL 10 images for larger runners in public preview, developed in partnership with Red Hat. These images provide a foundation for organizations to build custom runner environments with their specific tools and configurations. The RHEL images are available for Linux x64 larger runners, and users can select them as partner images when creating a new runner.
announcement - GitHub Changelog infraengineer ·
Dependabot gains automatic access to GitHub Packages registries
Dependabot can now access private GitHub Packages registries without requiring personal access tokens (PATs). This enhances security by leveraging the repository's existing Actions access grants, simplifying dependency management for supported ecosystems. To enable this, repository owners must grant Dependabot read access to the relevant packages via the package settings.
feature - GitHub Changelog infragaengineer ·
GitHub Repository Switcher GA in Global Navigation
The repository switcher in GitHub's global navigation is now generally available, allowing users to seamlessly transition between repositories without leaving their current page. This feature is designed to significantly reduce the time spent navigating across multiple codebases, benefiting engineers who manage numerous projects. Users can access it by clicking the chevron next to the repository name in the navigation breadcrumb.
feature announcement - GitHub Changelog infraengineer ·
GitHub Actions custom images gain layered build support
GitHub Actions now allows building custom runner images on top of other custom images, enabling layered image workflows. This feature offers teams greater flexibility in managing image-generation pipelines, reducing duplication, and speeding up builds. It also introduces conditional logic for the snapshot keyword, giving more control over image version generation. These enhancements are available now for teams using GitHub-hosted runners with custom images.
feature - GitHub Changelog securityinfraengineer ·
GitHub Actions checkout v7 enhances security for pull_request_target
GitHub Actions checkout v7 now defaults to refusing common 'pwn request' patterns, preventing vulnerabilities in workflows triggered by pull_request_target events from forks. This change is crucial for supply-chain security, affecting users who rely on checking out unreviewed pull request code. The update is available now for workflows pinned to floating major tags, with enforcement backported to supported major versions by July 2026.
feature security - GitHub Changelog securityinfraengineer ·
GitHub Secret Scanning Enhancements in June 2026
GitHub has updated its secret scanning capabilities with expanded detection coverage, including new partners like Cloudsmith and Meraki, and enhanced GitLab token support. Push protection now defaults to blocking more secret types, improving security for all repositories. Additionally, validity checks and richer metadata have been added for certain leaked credentials, aiding faster remediation for affected users.
feature patch - GitHub Changelog governanceinfraengineer ·
GitHub Copilot Enterprise Admins Can Now Disable Permission Bypass
Enterprise administrators can now disable automatic permission bypass (yolo mode) for GitHub Copilot CLI and VS Code using the new `disableBypassPermissionsMode` setting in enterprise-managed settings. This provides enhanced governance for AI features, ensuring users adhere to permission prompts. This capability is available for GitHub Copilot Business and Enterprise licenses and requires VS Code v1.122+.
feature - GitHub Changelog governanceinfraengineer ·
GitHub: Limit open PRs for users without write access
GitHub now allows repository maintainers to set a maximum number of open pull requests for users without write access, helping to manage contribution volume and reduce noise. This feature enables maintainers to proactively control the influx of contributions, with options to bypass the limit for trusted users. Draft PRs are excluded from the limit, and the change aims to reduce review and CI overhead for busy repositories.
feature - GitHub Changelog securityinfraengineer ·
Copilot code review: Enhanced configuration and content controls
GitHub Copilot code review now offers expanded configuration options, including organization-level runner controls and content exclusion support for specified files or directories. These updates aim to simplify setup and provide greater control over how Copilot analyzes code within repositories and organizations. Previously, custom instructions were limited by a character count, which has now been removed, allowing for more extensive customization.
feature - GitHub Changelog infra ·
GitHub Actions enforces minimum self-hosted runner versions starting July/September 2026
GitHub Actions is resuming enforcement of minimum version requirements for self-hosted runners on github.com and GitHub Enterprise Cloud. This change is necessary to support the new backend architecture that has increased reliability and performance. Users must ensure runners are on version 2.329.0 or later for registration and updated within 30 days of new releases to continue executing jobs. Enforcement begins with brownouts in July/August 2026, with full enforcement on July 31, 2026, for Data Residency instances and September 25, 2026, for others.
breaking announcement - GitHub Changelog governanceinfragaengineer ·
GitHub Enterprise Server 3.21 Released
GitHub Enterprise Server 3.21 is now generally available, bringing enhancements to deployment efficiency, monitoring, code security, and policy management. Key updates include the general availability of organization custom properties and hierarchy view for GitHub Projects, alongside a new REST API version with breaking changes. These updates benefit enterprise administrators and developers by improving metadata tagging, project visualization, and workflow management.
feature patch breaking - GitHub Changelog infrapreviewengineer ·
GitHub Actions runner images in public preview
GitHub Actions is releasing new Ubuntu 26.04 and Windows 11 arm64 runner images in public preview for all users. This allows early testing of workflows on the latest platforms before general availability, with Ubuntu 26.04 supporting both x64 and arm64 architectures. Users should update their workflow files to use the new image labels and may observe differences in tool versions.
feature announcement - GitHub Changelog securityinfraengineer ·
Bot-created pull requests can run workflows with approval
Pull requests created by github-actions[bot] can now trigger CI/CD workflows upon user approval. This security enhancement prevents unreviewed generated code from automatically executing potentially sensitive workflows. The behavior now aligns with Copilot-generated pull requests, addressing a previous gap where bot-generated changes could be merged without CI checks.
feature - GitHub Changelog aiinfraengineer ·
GitHub Agentic Workflows now use GITHUB_TOKEN, no PAT needed
GitHub Agentic Workflows have been updated to use GitHub Actions' built-in GITHUB_TOKEN, eliminating the need for personal access tokens (PATs). This change simplifies management, reduces security risks, and allows AI credit consumption to be billed directly to organizations. Configuration requires enabling a Copilot policy and updating workflow permissions, with cost management options available for organizations.
feature - GitHub Changelog infraengineer ·
CodeQL incremental analysis speeds up C/C++ and Go scans
CodeQL scans for C/C++ and Go now run incrementally, significantly reducing analysis time for pull requests. This feature, previously released for other languages, is now available for C/C++ and Go, and also integrated into the CodeQL CLI. Incremental analysis is enabled by default for projects using the default CodeQL query suite and the build mode none extraction mechanism on GitHub.com, and is available in the CodeQL CLI starting with version 2.25.5.
feature - GitHub Changelog infraengineer ·
GitHub CLI adds commands for managing Discussions
GitHub CLI version 2.94.0 introduces a new `gh discussion` command group, allowing users to list, view, create, edit, and comment on repository discussions directly from the terminal. This feature aims to integrate discussions into developers' existing workflows, reducing the need for direct API calls. The new commands are available for any repository with GitHub Discussions enabled.
feature
About GitHub release tracking on ReleaseBytes
The GitHub changelog covers Actions, Copilot, code security, the API and the platform itself — dozens of entries a week. ReleaseBytes summarises each changelog entry and tags breaking changes and deprecations (like Actions runner image retirements and API sunsets) so platform teams catch them before workflows break.
Frequently asked questions
How often are GitHub release notes updated on ReleaseBytes? ›
Continuously. ReleaseBytes monitors the official GitHub release channels around the clock and publishes a plain-English summary of each announcement shortly after it lands.
What kinds of GitHub changes does ReleaseBytes track? ›
New features, enhancements, bug fixes, security advisories, breaking changes, deprecations and end-of-life announcements. Every item is tagged by type so you can filter to just the changes that need action.
How can I get alerts for new GitHub releases? ›
Set up a free email or Slack alert filtered to GitHub, subscribe to the weekly digest, or follow the RSS feed. Teams can also install the ReleaseBytes GitHub App or connect via MCP.
Where does the GitHub release data come from? ›
From the official sources: GitHub changelog, platform updates, and Copilot coding-assistant releases. Every item links back to the original vendor announcement.