GitHub Releases
GitHub changelog, platform updates, and Copilot coding-assistant releases. New features, breaking changes, security advisories and deprecations - each summarised in plain English and updated continuously.
Tracking 199 GitHub releases · Updated
- GitHub Changelog securitygovernanceengineer ·
npm restricts granular access token ability to bypass 2FA for sensitive actions
npm granular access tokens (GATs) configured to bypass two-factor authentication (2FA) can no longer perform sensitive account, organization, and package management actions. This change closes a significant attack vector where leaked tokens could be used for account takeovers. The restriction impacts only npm granular access tokens and requires users to perform these actions interactively with a 2FA challenge.
security patch - GitHub Changelog aiengineer ·
GitHub Copilot VS Code Updates: Agents, Chat, UI, and Accessibility
GitHub Copilot for VS Code received significant updates in July 2026, enhancing agent interactions, code review, and chat capabilities. These improvements aim to streamline developer workflows, offering features like multi-chat sessions, faster review tools, and better session management. The releases also introduce a modernized UI preview, improved editor and terminal navigation, and new accessibility features including built-in dictation. These changes affect developers and architects using Copilot within Visual Studio Code.
feature patch - GitHub Changelog aigapreviewengineer ·
GitHub Copilot Code Review: Agent Skills and MCP Now Generally Available
GitHub Copilot code review now offers generally available support for agent skills and MCP servers, enhancing reviews with team tools and external context. This feature, previously in public preview, integrates custom tools and data from third-party platforms directly into the review process. It is available to Copilot Pro, Pro+, Business, and Enterprise users, with existing preview configurations carrying over.
feature patch - GitHub Changelog securityinfraengineer ·
CodeQL 2.26.1 enhances analysis accuracy and framework coverage
CodeQL version 2.26.1 improves static analysis accuracy and expands framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, while reducing false positives in Rust analysis. These enhancements aim to improve security issue detection for users of GitHub code scanning. The update is automatically deployed to GitHub.com users and will be included in a future GHES release.
patch - GitHub Changelog securityengineermedia ·
npm Adds Publish-Time Malware Scanning and Dual-Use Metadata
npm now automatically scans packages for malware at publish time, introducing a brief delay before packages are available. This enhances supply-chain security for all users but may require automation updates to tolerate the delay. A new metadata requirement, `contentPolicy` in `package.json` and a `DISCLOSURE` file, is introduced for dual-use content to aid automated scanning and manual review. Publishers of dual-use packages must also enforce two-factor authentication during publishing.
feature security - GitHub Changelog securityinfraengineer ·
GitHub Actions holds workflows for approval to prevent attacks
GitHub Actions now automatically holds potentially malicious workflows for approval before execution to prevent supply chain attacks. This measure requires a repository collaborator with write access to review and approve the workflow run through an authenticated web session. This protection is active for public repositories on GitHub.com and is not configurable by users. GitHub Enterprise Server is not affected by this change.
security announcement - GitHub Changelog securityinfraengineer ·
GitHub Actions holds potentially malicious workflows for approval
GitHub Actions now holds certain workflow runs for approval to protect public repositories from supply chain attacks. This feature automatically prevents malicious workflows from executing until a collaborator with write access reviews and approves them via an authenticated web session. This protection is applied automatically and currently only affects public repositories on github.com, not GitHub Enterprise Server.
security announcement - GitHub Changelog aiinfraengineer ·
GitHub Copilot for JetBrains: Enhanced Config & Model Management
GitHub Copilot for JetBrains has been updated with improved OpenTelemetry configuration and model management, offering greater control over agent workflows and cost. This release introduces new options for token limits, disabling/enabling models, and integrating MCP servers and custom agents in Claude flows. The enhancements benefit engineers and architects managing observability, cost control, and custom IDE workflows.
feature patch - GitHub Changelog governanceinfraengineer ·
GHES appliance update required for support bundle uploads
GitHub Enterprise Server (GHES) will reject command-line support bundle uploads from unpatched appliances starting August 18, 2026. This change impacts users submitting support bundles via specific command-line tools. To avoid disruption, administrators must update their GHES instances to the latest available patch release for their version line or contact GitHub Support if an update is not feasible by the deadline.
security deprecation - GitHub Changelog aiengineer ·
GitHub Copilot shows AI credit usage per billing cycle
GitHub Copilot Business and Enterprise users can now track their AI credit usage directly on the Copilot usage page, regardless of whether an individual budget is set. This change provides clearer visibility into monthly token consumption, addressing a previous limitation where usage was only shown as a percentage of a budget. The updated page now reflects actual usage against the total budgeted amount or total used if no budget is configured.
feature patch - GitHub Changelog aiengineer ·
GitHub Copilot code review gets more configurable and secure
GitHub Copilot's code review functionality has been significantly enhanced with new customization options, including custom instructions from the head branch and support for multiple instruction file types. Administrators can now define custom setup steps and leverage a firewall for enhanced security, giving them greater control over the review process. These improvements are available now for most users, though self-hosted runners currently do not support the firewall feature.
feature security - GitHub Changelog aiengineer ·
GitHub Mobile: Fix PR comments using Copilot
GitHub Mobile now allows users to initiate Copilot-assisted fixes for pull request comments directly from the app. This feature leverages the Copilot cloud agent to automatically generate responses to review feedback, simplifying the process of addressing comments. Available on the latest iOS and Android builds, this enhancement aims to help users resolve issues faster while on the go.
feature patch - GitHub Changelog aiengineer ·
GitHub Copilot for Visual Studio: June Update Includes Usage Tracking and C++ Modernization
GitHub Copilot in Visual Studio receives a June update focused on visibility and trust, introducing real-time usage tracking with proactive alerts and a trust validation layer for MCP servers. The modernization agent for C++ is now generally available, and extended range suggestions enhance code editing. This update benefits all GitHub Copilot plan users, including free and student tiers, and requires Visual Studio 2026.
feature patch - GitHub Changelog securitygaengineer ·
GitHub REST API now supports managing secret scanning custom patterns
GitHub has introduced REST API endpoints for managing secret scanning custom patterns, allowing security teams to create, edit, and delete these rules programmatically. This feature is now generally available at the repository, organization, and enterprise levels for secret scanning customers. While core CRUD operations are available via API, dry runs and publishing still require the UI.
feature patch - GitHub Changelog securityengineer ·
Dependabot adds default cooldown for version updates
Dependabot now defaults to a three-day cooldown period before opening pull requests for new package versions, helping to mitigate supply chain attacks. This change is automatically enabled for all users on GitHub.com and will be available in GHES 3.23. Users can customize or disable this cooldown via their dependabot.yml configuration.
feature security - GitHub Changelog aiengineer ·
CodeQL 2.26.0 adds Kotlin support, AI prompt injection detection
CodeQL 2.26.0 enhances static analysis by adding support for Kotlin 2.4.0 and introducing new queries for AI prompt injection detection across JavaScript and TypeScript. This release aims to improve security by identifying vulnerabilities in how user-provided data interacts with AI models and system prompts. The update is automatically available for GitHub code scanning users on github.com, with a future inclusion planned for GitHub Enterprise Server releases.
feature patch security - GitHub Changelog securityengineer ·
GitHub Secret Scanning Detector Types Renamed
GitHub has renamed several secret scanning detector types to improve clarity and better reflect their detection methods. This is a non-breaking naming update, affecting only the terminology used in the UI and documentation, not the detection behavior itself. The changes aim to make it easier for users to understand how specific secrets are identified, particularly distinguishing between pattern-based and AI-driven detection. All existing documentation links will continue to work due to added redirects.
patch - GitHub Changelog aipreviewengineer ·
JetBrains IDEs: Codex preview, agent customization, and Inline Chat GA
JetBrains IDEs now offer Codex as a new agent provider in public preview, enhancing flexibility for developers. This update also expands agent customization with Hooks and MCP server management, and introduces custom model support for Business and Enterprise users. Inline Chat has reached general availability, alongside performance improvements and bug fixes, affecting developers using GitHub Copilot.
feature patch announcement - GitHub Changelog ·
setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes
This release of actions/setup-java adds cryptographic signature verification for downloaded JDKs, support for Tencent Kona JDK, and several quality-of-life improvements for Maven users. Signature verification enhances build security by validating JDK archives before installation. The changes impact developers using the setup-java action, particularly those prioritizing build integrity and streamlined Maven workflows. Version 5.5.0 is now available, with specific fixes and features noted from previous versions as well.
feature patch - GitHub Changelog securitygadeprecationengineer ·
npm v12 Introduces Install-Time Security Defaults and Deprecates 2FA-Bypass GATs
npm v12 is now generally available, enforcing stricter install-time security defaults that require explicit opt-in for scripts, Git dependencies, and remote URLs. This release also begins deprecating granular access tokens (GATs) configured to bypass 2FA for sensitive account and package management actions. These changes aim to enhance security for all npm users, particularly those managing critical infrastructure. Users should review and approve trusted scripts and plan to migrate automated publishing workflows.
feature deprecation patch
About GitHub release tracking on ReleaseBytes
The GitHub changelog covers Actions, Copilot, code security, the API and the platform itself — dozens of entries a week. ReleaseBytes summarises each changelog entry and tags breaking changes and deprecations (like Actions runner image retirements and API sunsets) so platform teams catch them before workflows break.
Frequently asked questions
How often are GitHub release notes updated on ReleaseBytes? ›
Continuously. ReleaseBytes monitors the official GitHub release channels around the clock and publishes a plain-English summary of each announcement shortly after it lands.
What kinds of GitHub changes does ReleaseBytes track? ›
New features, enhancements, bug fixes, security advisories, breaking changes, deprecations and end-of-life announcements. Every item is tagged by type so you can filter to just the changes that need action.
How can I get alerts for new GitHub releases? ›
Set up a free email or Slack alert filtered to GitHub, subscribe to the weekly digest, or follow the RSS feed. Teams can also install the ReleaseBytes GitHub App or connect via MCP.
Where does the GitHub release data come from? ›
From the official sources: GitHub changelog, platform updates, and Copilot coding-assistant releases. Every item links back to the original vendor announcement.