GitHub Releases
GitHub changelog, platform updates, and Copilot coding-assistant releases. New features, breaking changes, security advisories and deprecations - each summarised in plain English and updated continuously.
Tracking 198 GitHub releases · Updated
- GitHub Changelog securitygovernanceengineer ·
npm restricts granular access token ability to bypass 2FA for sensitive actions
npm granular access tokens (GATs) configured to bypass two-factor authentication (2FA) can no longer perform sensitive account, organization, and package management actions. This change closes a significant attack vector where leaked tokens could be used for account takeovers. The restriction impacts only npm granular access tokens and requires users to perform these actions interactively with a 2FA challenge.
security patch - GitHub Changelog securityinfraengineer ·
GitHub Copilot restricts remote control to managed devices
GitHub Copilot now allows enterprises to limit remote control sessions to specific managed devices, enhancing administrative control. This new `remoteControl` enterprise setting allows administrators to mandate SSO authorization or tailor access per device, complementing existing policies. The feature is available via server-managed, MDM-managed, or file-based deployment mechanisms for users in enterprises.
feature - GitHub Changelog securityinfraengineer ·
CodeQL 2.26.1 enhances analysis accuracy and framework coverage
CodeQL version 2.26.1 improves static analysis accuracy and expands framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, while reducing false positives in Rust analysis. These enhancements aim to improve security issue detection for users of GitHub code scanning. The update is automatically deployed to GitHub.com users and will be included in a future GHES release.
patch - GitHub Changelog securityengineermedia ·
npm Adds Publish-Time Malware Scanning and Dual-Use Metadata
npm now automatically scans packages for malware at publish time, introducing a brief delay before packages are available. This enhances supply-chain security for all users but may require automation updates to tolerate the delay. A new metadata requirement, `contentPolicy` in `package.json` and a `DISCLOSURE` file, is introduced for dual-use content to aid automated scanning and manual review. Publishers of dual-use packages must also enforce two-factor authentication during publishing.
feature security - GitHub Changelog securityinfraengineer ·
GitHub Actions holds workflows for approval to prevent attacks
GitHub Actions now automatically holds potentially malicious workflows for approval before execution to prevent supply chain attacks. This measure requires a repository collaborator with write access to review and approve the workflow run through an authenticated web session. This protection is active for public repositories on GitHub.com and is not configurable by users. GitHub Enterprise Server is not affected by this change.
security announcement - GitHub Changelog securitygaengineer ·
Dependabot alerts expand to cover malicious packages from OpenSSF
GitHub's Dependabot alerts now incorporate malware advisories from the OpenSSF malicious-packages repository, broadening detection across ecosystems like npm and PyPI. This enhancement means users with malware alerting enabled will automatically benefit from expanded coverage, identifying risks from newly published malicious packages. To leverage this, users can enable malware alerting in repository settings or browse advisories directly on GitHub.
feature announcement - GitHub Changelog securityinfraengineer ·
GitHub Actions holds potentially malicious workflows for approval
GitHub Actions now holds certain workflow runs for approval to protect public repositories from supply chain attacks. This feature automatically prevents malicious workflows from executing until a collaborator with write access reviews and approves them via an authenticated web session. This protection is applied automatically and currently only affects public repositories on github.com, not GitHub Enterprise Server.
security announcement - GitHub Changelog securitygovernanceengineer ·
GitHub Copilot enterprise managed settings expand to app and cloud agent
GitHub Copilot enterprise managed settings now extend to the Copilot app and cloud agent, allowing unified policy enforcement across multiple clients. This enables enterprise owners to control plugin usage, marketplace access, and prompt bypasses via a `managed-settings.json` file. This enhancement ensures consistent governance for developers using Copilot in various environments, including the app and cloud agent, mitigating security and compliance risks. The feature is available immediately for existing users of enterprise managed settings for CLI and VS Code.
feature - GitHub Changelog aisecuritygaengineer ·
GitHub Code Quality GA for Enterprise Cloud and Team
GitHub Code Quality is now generally available for Enterprise Cloud and Team, offering AI-accelerated code analysis to detect maintainability and reliability issues. This feature pairs CodeQL with AI-assisted detection and Copilot Autofix, helping teams ship more trustworthy code with improved maintainability and reliability scores. New capabilities include organization-wide enablement, code coverage metrics, quality gates, and APIs, with billing commencing July 20, 2026, for active committers and AI usage.
feature announcement - GitHub Changelog security ·
GitHub Secret Scanning and Public Monitoring Updates
GitHub has enhanced its secret scanning capabilities with new partner integrations and expanded detection for APIclub and Resend secrets, along with default push protection for VolcEngine secrets. These updates aim to improve security by preventing data leaks for all users, including those in public repositories. The secret scanning alert webhook now includes a `secret_category` field for better alert differentiation, and the public monitoring alert list features new insight cards providing enterprise-level context.
feature - GitHub Changelog securitygaengineer ·
GitHub REST API now supports managing secret scanning custom patterns
GitHub has introduced REST API endpoints for managing secret scanning custom patterns, allowing security teams to create, edit, and delete these rules programmatically. This feature is now generally available at the repository, organization, and enterprise levels for secret scanning customers. While core CRUD operations are available via API, dry runs and publishing still require the UI.
feature patch - GitHub Changelog securitypreviewengineer ·
GitHub Code Scanning adds AI security detections to PRs
GitHub Code Scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to new languages and frameworks. This helps teams identify potential issues earlier in the development workflow before merging code. The feature is available in public preview for customers with GitHub Code Security, requires a GitHub Copilot license, and uses AI credits.
feature announcement - GitHub Changelog securityengineer ·
Dependabot adds default cooldown for version updates
Dependabot now defaults to a three-day cooldown period before opening pull requests for new package versions, helping to mitigate supply chain attacks. This change is automatically enabled for all users on GitHub.com and will be available in GHES 3.23. Users can customize or disable this cooldown via their dependabot.yml configuration.
feature security - GitHub Changelog securitypreviewengineer ·
GitHub Agentic Autofix for Code Scanning Alerts in Public Preview
GitHub is launching agentic autofix for code scanning alerts in public preview, allowing Copilot to automatically suggest and validate fixes for security vulnerabilities. This feature aims to streamline the remediation process by replicating developer workflows, enhancing security response times for affected engineers and architects. Access requires GitHub Code Security or Advanced Security and a Copilot license with the cloud agent enabled, with fixes taking 2-4 minutes and consuming AI credits and GitHub Actions minutes.
feature announcement - GitHub Changelog securitypreviewengineer ·
GitHub Copilot app adds security reviews in public preview
GitHub Copilot app now offers AI-driven security reviews for code changes using the `/security-review` command, currently in public preview. This feature aims to catch high-impact vulnerabilities and provide actionable suggestions before code is committed, complementing existing GitHub security tools. It is available to all Copilot users during the preview period.
feature announcement - GitHub Changelog securityengineer ·
GitHub Settings: Separate SSO and Organizations pages
GitHub has separated the combined SSO and Organizations settings page into two distinct pages: SSO and Organizations. This change improves usability by making it easier for users to find and manage these settings independently. Users who utilize SSO or are members of organizations on GitHub will now experience a clearer separation of these options within their account settings.
feature - GitHub Changelog securityengineer ·
GitHub Secret Scanning Detector Types Renamed
GitHub has renamed several secret scanning detector types to improve clarity and better reflect their detection methods. This is a non-breaking naming update, affecting only the terminology used in the UI and documentation, not the detection behavior itself. The changes aim to make it easier for users to understand how specific secrets are identified, particularly distinguishing between pattern-based and AI-driven detection. All existing documentation links will continue to work due to added redirects.
patch - GitHub Changelog securitygaengineer ·
GitHub Advanced Security: Innersource security advisories GA
GitHub Advanced Security is launching Innersource security advisories, allowing enterprises to publish internal security advisories restricted to their own repositories. This feature, now generally available, aims to enhance internal vulnerability management and leverage Dependabot for automated remediation. Enterprise customers can manage these advisories via a new REST API endpoint, which triggers Dependabot to notify and create pull requests for vulnerable component usage within the enterprise.
feature announcement - GitHub Changelog securitygadeprecationengineer ·
npm v12 Introduces Install-Time Security Defaults and Deprecates 2FA-Bypass GATs
npm v12 is now generally available, enforcing stricter install-time security defaults that require explicit opt-in for scripts, Git dependencies, and remote URLs. This release also begins deprecating granular access tokens (GATs) configured to bypass 2FA for sensitive account and package management actions. These changes aim to enhance security for all npm users, particularly those managing critical infrastructure. Users should review and approve trusted scripts and plan to migrate automated publishing workflows.
feature deprecation patch - GitHub Changelog securitygaengineer ·
GitHub Secret Scanning adds extended metadata and multipart validation
GitHub Secret Scanning now offers enriched metadata for supported secret types, including owner details, creation/expiry dates, and project context. These generally available enhancements allow development and security teams to assess exposure and prioritize remediation faster. Multipart validity checks are also expanded to cover key credential formats across major providers like Alibaba Cloud and Azure, with GitHub continually adding more support.
feature patch
About GitHub release tracking on ReleaseBytes
The GitHub changelog covers Actions, Copilot, code security, the API and the platform itself — dozens of entries a week. ReleaseBytes summarises each changelog entry and tags breaking changes and deprecations (like Actions runner image retirements and API sunsets) so platform teams catch them before workflows break.
Frequently asked questions
How often are GitHub release notes updated on ReleaseBytes? ›
Continuously. ReleaseBytes monitors the official GitHub release channels around the clock and publishes a plain-English summary of each announcement shortly after it lands.
What kinds of GitHub changes does ReleaseBytes track? ›
New features, enhancements, bug fixes, security advisories, breaking changes, deprecations and end-of-life announcements. Every item is tagged by type so you can filter to just the changes that need action.
How can I get alerts for new GitHub releases? ›
Set up a free email or Slack alert filtered to GitHub, subscribe to the weekly digest, or follow the RSS feed. Teams can also install the ReleaseBytes GitHub App or connect via MCP.
Where does the GitHub release data come from? ›
From the official sources: GitHub changelog, platform updates, and Copilot coding-assistant releases. Every item links back to the original vendor announcement.