GitHub Releases
GitHub changelog, platform updates, and Copilot coding-assistant releases. New features, breaking changes, security advisories and deprecations - each summarised in plain English and updated continuously.
Tracking 199 GitHub releases · Updated
- GitHub Changelog aideprecationengineer ·
GitHub Copilot Deprecates Gemini 2.5 Pro and 3 Flash Models
GitHub Copilot is deprecating Gemini 2.5 Pro and Gemini 3 Flash models as of July 31, 2026. This change affects all Copilot experiences, including chat and code completions. Users are advised to update workflows to supported alternatives like Gemini 3.1 Pro and 3.6 Flash, with administrators needing to enable these via Copilot settings.
deprecation - GitHub Changelog securitygovernanceengineer ·
npm restricts granular access token ability to bypass 2FA for sensitive actions
npm granular access tokens (GATs) configured to bypass two-factor authentication (2FA) can no longer perform sensitive account, organization, and package management actions. This change closes a significant attack vector where leaked tokens could be used for account takeovers. The restriction impacts only npm granular access tokens and requires users to perform these actions interactively with a 2FA challenge.
security patch - GitHub Changelog aideprecationengineer ·
GitHub Models officially retired
GitHub Models has been officially retired as of July 30, 2026, making its playground, catalog, and APIs unavailable. Existing customers with active usage are impacted. For AI model access, Microsoft Foundry and GitHub Copilot are recommended alternatives. Further details are available in the documentation and community forums.
deprecation - GitHub Changelog securityengineermedia ·
npm Adds Publish-Time Malware Scanning and Dual-Use Metadata
npm now automatically scans packages for malware at publish time, introducing a brief delay before packages are available. This enhances supply-chain security for all users but may require automation updates to tolerate the delay. A new metadata requirement, `contentPolicy` in `package.json` and a `DISCLOSURE` file, is introduced for dual-use content to aid automated scanning and manual review. Publishers of dual-use packages must also enforce two-factor authentication during publishing.
feature security - GitHub Changelog securityinfraengineer ·
GitHub Actions holds workflows for approval to prevent attacks
GitHub Actions now automatically holds potentially malicious workflows for approval before execution to prevent supply chain attacks. This measure requires a repository collaborator with write access to review and approve the workflow run through an authenticated web session. This protection is active for public repositories on GitHub.com and is not configurable by users. GitHub Enterprise Server is not affected by this change.
security announcement - GitHub Changelog securityinfraengineer ·
GitHub Actions holds potentially malicious workflows for approval
GitHub Actions now holds certain workflow runs for approval to protect public repositories from supply chain attacks. This feature automatically prevents malicious workflows from executing until a collaborator with write access reviews and approves them via an authenticated web session. This protection is applied automatically and currently only affects public repositories on github.com, not GitHub Enterprise Server.
security announcement - GitHub Changelog governanceinfraengineer ·
GHES appliance update required for support bundle uploads
GitHub Enterprise Server (GHES) will reject command-line support bundle uploads from unpatched appliances starting August 18, 2026. This change impacts users submitting support bundles via specific command-line tools. To avoid disruption, administrators must update their GHES instances to the latest available patch release for their version line or contact GitHub Support if an update is not feasible by the deadline.
security deprecation - GitHub Changelog aiengineer ·
GitHub Copilot code review gets more configurable and secure
GitHub Copilot's code review functionality has been significantly enhanced with new customization options, including custom instructions from the head branch and support for multiple instruction file types. Administrators can now define custom setup steps and leverage a firewall for enhanced security, giving them greater control over the review process. These improvements are available now for most users, though self-hosted runners currently do not support the firewall feature.
feature security - GitHub Changelog securityengineer ·
Dependabot adds default cooldown for version updates
Dependabot now defaults to a three-day cooldown period before opening pull requests for new package versions, helping to mitigate supply chain attacks. This change is automatically enabled for all users on GitHub.com and will be available in GHES 3.23. Users can customize or disable this cooldown via their dependabot.yml configuration.
feature security - GitHub Changelog aiengineer ·
CodeQL 2.26.0 adds Kotlin support, AI prompt injection detection
CodeQL 2.26.0 enhances static analysis by adding support for Kotlin 2.4.0 and introducing new queries for AI prompt injection detection across JavaScript and TypeScript. This release aims to improve security by identifying vulnerabilities in how user-provided data interacts with AI models and system prompts. The update is automatically available for GitHub code scanning users on github.com, with a future inclusion planned for GitHub Enterprise Server releases.
feature patch security - GitHub Changelog securitygadeprecationengineer ·
npm v12 Introduces Install-Time Security Defaults and Deprecates 2FA-Bypass GATs
npm v12 is now generally available, enforcing stricter install-time security defaults that require explicit opt-in for scripts, Git dependencies, and remote URLs. This release also begins deprecating granular access tokens (GATs) configured to bypass 2FA for sensitive account and package management actions. These changes aim to enhance security for all npm users, particularly those managing critical infrastructure. Users should review and approve trusted scripts and plan to migrate automated publishing workflows.
feature deprecation patch - GitHub Changelog aipreviewengineer ·
GitHub Copilot Billing Preview app to be retired
GitHub is retiring the Copilot Billing Preview app on August 3, 2026, as its functionality is now superseded by enhanced built-in billing settings. Users who relied on the app for spend visibility can now access more comprehensive features like user-level budgets and cost center allocation within their GitHub billing settings. This change aims to provide a more complete and integrated view of GitHub Copilot expenses for organizations and enterprises.
deprecation announcement - GitHub Changelog aideprecationengineer ·
GitHub Copilot deprecates Gemini 2.5 Pro and 3 Flash
GitHub Copilot will deprecate Gemini 2.5 Pro and Gemini 3 Flash models on July 31st, 2026, across all its experiences. Users are advised to update workflows to the suggested alternatives, Gemini 3.1 Pro and Gemini 3.5 Flash, respectively. Administrators must enable these new models in Copilot settings before the deprecation date.
deprecation - GitHub Changelog aideprecationengineer ·
GitHub Models to be fully retired July 30, 2026
GitHub is fully retiring its GitHub Models service on July 30, 2026, affecting all customers including those with active usage. The retirement will render the playground, model catalog, inference API, and BYOK endpoints unavailable. Customers are advised to migrate to alternatives like Azure AI Foundry or GitHub Copilot for AI model access.
deprecation announcement - GitHub Changelog securitygovernanceengineer ·
GitHub to restrict access to public API endpoints and UI views
GitHub is restricting access to several public API endpoints and UI views, including the stargazers, watchers, and user subscriptions endpoints. This change aims to prevent misuse of public data for spam and enhance platform security. Admins and collaborators will retain access, while some users may encounter empty responses or 403 errors.
patch deprecation security - GitHub Changelog securityinfraengineer ·
GitHub Actions limits cache access for untrusted triggers
GitHub Actions now issues read-only cache tokens for untrusted triggers targeting the default branch, mitigating privilege escalation via cache poisoning. Previously, read-write tokens were issued for all events, allowing malicious actors to compromise trusted workflows. This change primarily affects untrusted workflows that write to the default-branch cache, which will now receive warnings and fail to save cache entries. To maintain caching benefits, a separate workflow with read-write access (e.g., 'push') should be used for cache saves.
security feature - GitHub Changelog securityinfraengineer ·
npm adds preventive account protection for high-impact accounts
npm has introduced a new preventive safeguard for accounts managing critical packages, adding a 72-hour read-only state after detecting sensitive changes like email updates or 2FA recovery code usage. This measure aims to block account-takeover attacks that have been exploited in recent supply chain incidents, ensuring package availability and user security.
feature security - GitHub Changelog securitygovernanceengineer ·
GitHub Enterprise: Self-service credential revocation for incident response
GitHub Enterprise owners can now instantly revoke all credentials for a given user to speed up incident response. This feature allows enterprise owners and specific members to revoke SSO authorizations and delete user tokens/SSH keys programmatically or through a new self-service portal for individual users. Enterprise members can also manage their own credentials via a new self-service experience. The changes aim to improve security incident response times and provide better control over enterprise credentials.
feature security - GitHub Changelog deprecationeolengineer ·
Dependabot drops support for Python 3.9
Dependabot has officially ended support for Python 3.9, aligning with Python's own end-of-life for the version. This change means users still on Python 3.9 may encounter issues with Dependabot creating dependency update pull requests. Engineers are advised to upgrade to a supported Python release to ensure continued functionality.
deprecation announcement - GitHub Changelog aideprecationengineer ·
GitHub Copilot deprecates Opus 4.6 (fast) model
GitHub Copilot will deprecate the Opus 4.6 (fast) model across all its experiences on June 29th, 2026. Users should migrate to the Opus 4.8 (fast) model to avoid disruption. Administrators may need to enable the new model in Copilot settings.
deprecation
About GitHub release tracking on ReleaseBytes
The GitHub changelog covers Actions, Copilot, code security, the API and the platform itself — dozens of entries a week. ReleaseBytes summarises each changelog entry and tags breaking changes and deprecations (like Actions runner image retirements and API sunsets) so platform teams catch them before workflows break.
Frequently asked questions
How often are GitHub release notes updated on ReleaseBytes? ›
Continuously. ReleaseBytes monitors the official GitHub release channels around the clock and publishes a plain-English summary of each announcement shortly after it lands.
What kinds of GitHub changes does ReleaseBytes track? ›
New features, enhancements, bug fixes, security advisories, breaking changes, deprecations and end-of-life announcements. Every item is tagged by type so you can filter to just the changes that need action.
How can I get alerts for new GitHub releases? ›
Set up a free email or Slack alert filtered to GitHub, subscribe to the weekly digest, or follow the RSS feed. Teams can also install the ReleaseBytes GitHub App or connect via MCP.
Where does the GitHub release data come from? ›
From the official sources: GitHub changelog, platform updates, and Copilot coding-assistant releases. Every item links back to the original vendor announcement.