GitHub Releases
GitHub changelog, platform updates, and Copilot coding-assistant releases. New features, breaking changes, security advisories and deprecations - each summarised in plain English and updated continuously.
Tracking 199 GitHub releases · Updated
- GitHub Changelog securitypreviewengineer ·
GitHub Secret Scanning Public Monitoring for Enterprises Now in Preview
GitHub Secret Scanning now offers public monitoring in public preview for enterprises, at no additional cost, to detect secret leaks across the entire public surface of GitHub.com. This feature attributes leaks back to your enterprise based on committer identity and verified domains, helping organizations respond to vulnerabilities exposed beyond their own repositories. Public monitoring is enabled by default for enterprise owners and security managers, providing real-time insights without requiring setup.
feature announcement - GitHub Changelog securityengineer ·
GitHub Secret Scanning Adds Validity Checks for Asana, IBM, MessageBird Secrets
GitHub's secret scanning now includes validity checks for Asana, IBM, and MessageBird secrets, allowing users to determine if leaked credentials are still active. This enhancement improves the security posture by reducing the risk of using compromised tokens. The feature is available for specific secret types across these providers. Further details and a full list of supported secrets can be found in the documentation.
feature - GitHub Changelog securitygovernanceengineer ·
GitHub to restrict access to public API endpoints and UI views
GitHub is restricting access to several public API endpoints and UI views, including the stargazers, watchers, and user subscriptions endpoints. This change aims to prevent misuse of public data for spam and enhance platform security. Admins and collaborators will retain access, while some users may encounter empty responses or 403 errors.
patch deprecation security - GitHub Changelog securitypreviewengineer ·
GitHub Open Source License Compliance now in public preview
GitHub is launching its Open Source License Compliance feature in public preview, enabling enterprises to enforce license policies at scale. This feature integrates with dependency review to block noncompliant dependencies before they reach production, requiring specific roles for policy management. It is available for GitHub Enterprise Cloud customers with GitHub Advanced Security Code Security licenses.
feature announcement - GitHub Changelog securitydeprecationengineer ·
GitHub to implement data retention for closed security alerts
GitHub will introduce a data retention policy for closed Dependabot security alerts starting August 25, 2026, affecting GitHub Enterprise Cloud users. This policy will move alerts closed over two years ago to archival storage, accessible via CSV download, while open and recently closed alerts remain in the UI/API. Users should review their current queries and plan for the archival change.
announcement - GitHub Changelog securityinfraengineer ·
GitHub Actions limits cache access for untrusted triggers
GitHub Actions now issues read-only cache tokens for untrusted triggers targeting the default branch, mitigating privilege escalation via cache poisoning. Previously, read-write tokens were issued for all events, allowing malicious actors to compromise trusted workflows. This change primarily affects untrusted workflows that write to the default-branch cache, which will now receive warnings and fail to save cache entries. To maintain caching benefits, a separate workflow with read-write access (e.g., 'push') should be used for cache saves.
security feature - GitHub Changelog securitypreviewengineer ·
GitHub Copilot CLI and VS Code restrict plugin installs
Enterprises can now control which plugins users can install in GitHub Copilot CLI and VS Code via new enterprise-managed settings. This feature, currently in public preview, helps enforce client governance by allowing plugins only from explicitly defined marketplaces. This applies to users licensed through Copilot Business or Copilot Enterprise accounts.
feature announcement - GitHub Changelog securityinfraengineer ·
npm adds preventive account protection for high-impact accounts
npm has introduced a new preventive safeguard for accounts managing critical packages, adding a 72-hour read-only state after detecting sensitive changes like email updates or 2FA recovery code usage. This measure aims to block account-takeover attacks that have been exploited in recent supply chain incidents, ensuring package availability and user security.
feature security - GitHub Changelog securitygovernanceengineer ·
GitHub Enterprise: Self-service credential revocation for incident response
GitHub Enterprise owners can now instantly revoke all credentials for a given user to speed up incident response. This feature allows enterprise owners and specific members to revoke SSO authorizations and delete user tokens/SSH keys programmatically or through a new self-service portal for individual users. Enterprise members can also manage their own credentials via a new self-service experience. The changes aim to improve security incident response times and provide better control over enterprise credentials.
feature security - GitHub Changelog securityengineer ·
GitHub Secret Scanning adds metadata for Replicate secrets
GitHub's Secret Scanning now includes extended metadata for detected Replicate API tokens. This enhancement provides richer context about leaked credentials, aiding security analysis. The feature is available now and supports Replicate API tokens.
patch - GitHub Changelog securitypreviewengineer ·
GitHub Code Quality API now in public preview
GitHub has released repository-level REST APIs for Code Quality findings in public preview. These new read-only endpoints allow programmatic access to CodeQL findings, enabling integrations for tooling and remediation workflows. This feature is available today on github.com and is not yet on GitHub Enterprise Server.
feature announcement - GitHub Changelog securityinfraengineer ·
GitHub Actions checkout v7 enhances security for pull_request_target
GitHub Actions checkout v7 now defaults to refusing common 'pwn request' patterns, preventing vulnerabilities in workflows triggered by pull_request_target events from forks. This change is crucial for supply-chain security, affecting users who rely on checking out unreviewed pull request code. The update is available now for workflows pinned to floating major tags, with enforcement backported to supported major versions by July 2026.
feature security - GitHub Changelog securitypreviewengineer ·
GitHub Actions workflow execution protections now in public preview
GitHub Actions workflow execution protections are now in public preview, allowing administrators to define allow lists for workflow triggers. This feature enhances security by preventing unauthorized users or events from initiating workflows, which could otherwise be exploited to run malicious code. Initially available for GitHub Enterprise, organizations, and repositories, it helps mitigate common attack patterns like poisoned pipeline execution and manual-trigger abuse.
feature announcement - GitHub Changelog securityinfraengineer ·
GitHub Secret Scanning Enhancements in June 2026
GitHub has updated its secret scanning capabilities with expanded detection coverage, including new partners like Cloudsmith and Meraki, and enhanced GitLab token support. Push protection now defaults to blocking more secret types, improving security for all repositories. Additionally, validity checks and richer metadata have been added for certain leaked credentials, aiding faster remediation for affected users.
feature patch - GitHub Changelog securityinfraengineer ·
Copilot code review: Enhanced configuration and content controls
GitHub Copilot code review now offers expanded configuration options, including organization-level runner controls and content exclusion support for specified files or directories. These updates aim to simplify setup and provide greater control over how Copilot analyzes code within repositories and organizations. Previously, custom instructions were limited by a character count, which has now been removed, allowing for more extensive customization.
feature - GitHub Changelog securityinfraengineer ·
Bot-created pull requests can run workflows with approval
Pull requests created by github-actions[bot] can now trigger CI/CD workflows upon user approval. This security enhancement prevents unreviewed generated code from automatically executing potentially sensitive workflows. The behavior now aligns with Copilot-generated pull requests, addressing a previous gap where bot-generated changes could be merged without CI checks.
feature - GitHub Changelog securitypreviewengineer ·
GitHub Copilot CLI adds experimental security review command
GitHub Copilot CLI now includes a new `/security-review` slash command for local code changes, shipping as an experimental public preview feature. This AI-driven command analyzes code to find high-confidence security vulnerabilities and offers actionable suggestions directly within the terminal. It complements existing GitHub security tools by providing a lightweight, on-demand scan focused on common vulnerability classes, accessible to engineers using Copilot CLI.
feature announcement - GitHub Changelog securitygaengineer ·
GitHub EMU IP Allow List Now Generally Available
GitHub Enterprise Cloud now offers general availability for IP allow list configuration within Enterprise Managed User (EMU) namespaces. This enhancement allows organizations to enforce network access policies directly within their managed user environments. The feature is now production-ready for all EMU customers.
feature announcement - GitHub Changelog aisecuritygaengineer ·
GitHub Security Validation for Third-Party Coding Agents GA
GitHub's security validation for third-party coding agents is now generally available, allowing external tools like Claude and OpenAI Codex to integrate directly with repositories. This feature enhances security by validating the actions of these AI agents before they modify code. The general availability means this capability is production-ready for all users.
feature announcement - GitHub Changelog securityengineer ·
GitHub adds scheduled code scanning for inactive repos
GitHub code scanning now offers scheduled security scans for repositories that have been inactive for six months. This feature helps organizations maintain continuous security posture by ensuring even dormant codebases are regularly checked for vulnerabilities. It is available for organizations seeking to enhance their security practices on the platform.
feature
About GitHub release tracking on ReleaseBytes
The GitHub changelog covers Actions, Copilot, code security, the API and the platform itself — dozens of entries a week. ReleaseBytes summarises each changelog entry and tags breaking changes and deprecations (like Actions runner image retirements and API sunsets) so platform teams catch them before workflows break.
Frequently asked questions
How often are GitHub release notes updated on ReleaseBytes? ›
Continuously. ReleaseBytes monitors the official GitHub release channels around the clock and publishes a plain-English summary of each announcement shortly after it lands.
What kinds of GitHub changes does ReleaseBytes track? ›
New features, enhancements, bug fixes, security advisories, breaking changes, deprecations and end-of-life announcements. Every item is tagged by type so you can filter to just the changes that need action.
How can I get alerts for new GitHub releases? ›
Set up a free email or Slack alert filtered to GitHub, subscribe to the weekly digest, or follow the RSS feed. Teams can also install the ReleaseBytes GitHub App or connect via MCP.
Where does the GitHub release data come from? ›
From the official sources: GitHub changelog, platform updates, and Copilot coding-assistant releases. Every item links back to the original vendor announcement.