GitHub Releases
GitHub changelog, platform updates, and Copilot coding-assistant releases. New features, breaking changes, security advisories and deprecations - each summarised in plain English and updated continuously.
Tracking 199 GitHub releases · Updated
- GitHub Changelog securitygaengineer ·
GitHub Secret Scanning adds extended metadata and multipart validation
GitHub Secret Scanning now offers enriched metadata for supported secret types, including owner details, creation/expiry dates, and project context. These generally available enhancements allow development and security teams to assess exposure and prioritize remediation faster. Multipart validity checks are also expanded to cover key credential formats across major providers like Alibaba Cloud and Azure, with GitHub continually adding more support.
feature patch - GitHub Changelog aiengineer ·
GitHub Copilot usage metrics API improvements
GitHub has enhanced its Copilot usage metrics API with three key improvements for greater accuracy and coverage. These updates include reporting suggested lines of code from Copilot CLI, identifying IDEs for users previously seen only via server-side telemetry, and more complete AI credit attribution. These changes provide enterprise administrators and organization owners with more trustworthy data for analyzing Copilot adoption and consumption.
patch - GitHub Changelog governancegaengineer ·
GitHub Issue Fields Generally Available, Edit History Limited
GitHub Issue Fields are now generally available across all plans, offering structured, typed metadata for better issue tracking. Key enhancements since preview include issue list integration, public project support, and MCP integration for AI tools. Additionally, GitHub is now limiting stored edit history for issues and pull requests to 100 entries to align with usage patterns. These changes impact all GitHub users, with some features shipping in Enterprise Server 3.23.
feature patch - GitHub Changelog securitygovernanceengineer ·
GitHub to restrict access to public API endpoints and UI views
GitHub is restricting access to several public API endpoints and UI views, including the stargazers, watchers, and user subscriptions endpoints. This change aims to prevent misuse of public data for spam and enhance platform security. Admins and collaborators will retain access, while some users may encounter empty responses or 403 errors.
patch deprecation security - GitHub Changelog infraengineer ·
Dependabot stops inferring .npmrc, uses dependabot.yml scope instead
Dependabot will no longer infer .npmrc configuration for npm private registries, resolving frequent authentication failures caused by lockfile inconsistencies. Instead, users can now define a `scope` property in their `dependabot.yml`, which becomes the authoritative source for registry configuration and takes precedence over committed .npmrc files. This enhancement is available for all github.com users and will ship in GHES 3.23.
patch - GitHub Changelog securityinfraengineer ·
GitHub Actions limits cache access for untrusted triggers
GitHub Actions now issues read-only cache tokens for untrusted triggers targeting the default branch, mitigating privilege escalation via cache poisoning. Previously, read-write tokens were issued for all events, allowing malicious actors to compromise trusted workflows. This change primarily affects untrusted workflows that write to the default-branch cache, which will now receive warnings and fail to save cache entries. To maintain caching benefits, a separate workflow with read-write access (e.g., 'push') should be used for cache saves.
security feature - GitHub Changelog aiengineer ·
Copilot Code Review: Deeper Analysis and Efficiency Gains
Copilot code review now leverages built-in CLI file exploration tools for improved cost efficiency without workflow changes. Users in the Medium analysis depth public preview gain new configurability and visibility options, including attribution in PR comments and organization-level default level settings. These enhancements reduce review costs by approximately 20% while maintaining review quality, benefiting developers and architects using Copilot for code reviews.
feature patch - GitHub Changelog securityinfraengineer ·
npm adds preventive account protection for high-impact accounts
npm has introduced a new preventive safeguard for accounts managing critical packages, adding a 72-hour read-only state after detecting sensitive changes like email updates or 2FA recovery code usage. This measure aims to block account-takeover attacks that have been exploited in recent supply chain incidents, ensuring package availability and user security.
feature security - GitHub Changelog securitygovernanceengineer ·
GitHub Enterprise: Self-service credential revocation for incident response
GitHub Enterprise owners can now instantly revoke all credentials for a given user to speed up incident response. This feature allows enterprise owners and specific members to revoke SSO authorizations and delete user tokens/SSH keys programmatically or through a new self-service portal for individual users. Enterprise members can also manage their own credentials via a new self-service experience. The changes aim to improve security incident response times and provide better control over enterprise credentials.
feature security - GitHub Changelog aigaengineereducation ·
Copilot Free/Student Plans Default to Auto Model Selection
GitHub Copilot's Free and Student plans now default to automatic model selection, simplifying the user experience by dynamically choosing the best model for tasks. This change provides access to multiple model families while removing manual choice and the 'Preview' label for Microsoft-released models. Users can find more details in the documentation, and discussions are available on the GitHub Community.
feature patch - GitHub Changelog securityengineer ·
GitHub Secret Scanning adds metadata for Replicate secrets
GitHub's Secret Scanning now includes extended metadata for detected Replicate API tokens. This enhancement provides richer context about leaked credentials, aiding security analysis. The feature is available now and supports Replicate API tokens.
patch - GitHub Changelog aigaengineer ·
GitHub Copilot CLI terminal interface now GA
GitHub Copilot CLI's redesigned terminal interface is now generally available, offering a tabbed layout for interacting with issues, pull requests, and gists directly from the command line. The update includes a guided, in-session experience for configuring tools like MCP servers, skills, and plugins, along with a cleaner, more accessible UI with theme-aware colors and screen reader support. Users can update the CLI by running `copilot update` in their terminal.
feature patch - GitHub Changelog aigaengineer ·
Copilot code review adds AGENTS.md support and UI improvements
GitHub Copilot code review now supports AGENTS.md files at the repository root, allowing users to shape feedback based on project conventions. UI enhancements include an easier way to request reviews on draft pull requests and collapsed timeline events for a cleaner pull request conversation view. These updates are generally available and aimed at improving the code review experience for developers.
feature patch - GitHub Changelog securityinfraengineer ·
GitHub Actions checkout v7 enhances security for pull_request_target
GitHub Actions checkout v7 now defaults to refusing common 'pwn request' patterns, preventing vulnerabilities in workflows triggered by pull_request_target events from forks. This change is crucial for supply-chain security, affecting users who rely on checking out unreviewed pull request code. The update is available now for workflows pinned to floating major tags, with enforcement backported to supported major versions by July 2026.
feature security - GitHub Changelog securityinfraengineer ·
GitHub Secret Scanning Enhancements in June 2026
GitHub has updated its secret scanning capabilities with expanded detection coverage, including new partners like Cloudsmith and Meraki, and enhanced GitLab token support. Push protection now defaults to blocking more secret types, improving security for all repositories. Additionally, validity checks and richer metadata have been added for certain leaked credentials, aiding faster remediation for affected users.
feature patch - GitHub Changelog governancegapreviewengineer ·
GitHub Code Quality Moves to General Availability
GitHub Code Quality will transition from public preview to general availability on July 20, 2026, becoming a purchasable product for enterprises. This change introduces new capabilities like organization-wide deployment and enhanced dashboards, alongside a new pricing model that includes a per-committer license and usage-based charges for AI features. Customers on GitHub Enterprise Cloud and Team plans will be affected, with options to disable the feature before the transition.
announcement feature patch - GitHub Changelog governanceinfragaengineer ·
GitHub Enterprise Server 3.21 Released
GitHub Enterprise Server 3.21 is now generally available, bringing enhancements to deployment efficiency, monitoring, code security, and policy management. Key updates include the general availability of organization custom properties and hierarchy view for GitHub Projects, alongside a new REST API version with breaking changes. These updates benefit enterprise administrators and developers by improving metadata tagging, project visualization, and workflow management.
feature patch breaking - GitHub Changelog aigaengineer ·
GitHub AI Usage Reports Updated
GitHub AI usage reports have been updated to reflect native AI credit billing, replacing preview fields with standard ones. This change clarifies how to monitor AI credit usage going forward using quantity and gross_amount. A bug that caused incorrect values in preview fields has been fixed and retroactively applied for usage from June 1. This update is available for GitHub Enterprise Cloud customers.
patch feature - GitHub Changelog infraengineer ·
npm v12 to enforce stricter security defaults for package installation
npm v12, slated for July 2026, introduces security enhancements by defaulting to stricter controls for package installation scripts and Git/remote dependencies. These changes aim to mitigate code execution risks by requiring explicit user opt-in for potentially risky operations. Users on npm 11.16.0 or newer can prepare by reviewing warnings and using `npm approve-scripts` to manage trusted packages.
breaking feature security - GitHub Changelog securityengineer ·
CodeQL 2.25.6 adds Swift 6.3.2 support, improves C# coverage
CodeQL, GitHub's static analysis engine, has released version 2.25.6. This update introduces support for Swift 6.3.2 and enhances existing C# coverage. The release is part of ongoing efforts to improve code scanning capabilities for security issue detection. It impacts developers and security engineers using GitHub code scanning.
patch
About GitHub release tracking on ReleaseBytes
The GitHub changelog covers Actions, Copilot, code security, the API and the platform itself — dozens of entries a week. ReleaseBytes summarises each changelog entry and tags breaking changes and deprecations (like Actions runner image retirements and API sunsets) so platform teams catch them before workflows break.
Frequently asked questions
How often are GitHub release notes updated on ReleaseBytes? ›
Continuously. ReleaseBytes monitors the official GitHub release channels around the clock and publishes a plain-English summary of each announcement shortly after it lands.
What kinds of GitHub changes does ReleaseBytes track? ›
New features, enhancements, bug fixes, security advisories, breaking changes, deprecations and end-of-life announcements. Every item is tagged by type so you can filter to just the changes that need action.
How can I get alerts for new GitHub releases? ›
Set up a free email or Slack alert filtered to GitHub, subscribe to the weekly digest, or follow the RSS feed. Teams can also install the ReleaseBytes GitHub App or connect via MCP.
Where does the GitHub release data come from? ›
From the official sources: GitHub changelog, platform updates, and Copilot coding-assistant releases. Every item links back to the original vendor announcement.