Also onPaydays(Pay schedule)
Users can now manage GitHub Copilot code review settings through REST and GraphQL APIs, including enterprise policies and repository-level configurations. The update also adds explicit attribution for Copilot-generated reviews and provides visibility into the skills and instructions used for comments.
@GitHub in Slack and Teams is now generally available, allowing users to investigate bugs, create issues, and open pull requests directly from chat. It also includes Canvas integration for reviewing code and implementation plans.
GitHub introduced an opt-in overview page for pull requests that displays merge status and next actions in a compact summary at the top of the page. This feature aims to reduce scrolling and clarify the state of pull requests.
GitHub secret scanning now supports SpaceX as a partner and includes a new detector for Starlink public API secrets. Additionally, existing detectors for AWS, Google, and other providers have been updated to reduce false positives.
GitHub Copilot is now available in public preview within Xcode's built-in coding assistant, starting with Xcode 27.3 beta.
CodeQL 2.27.4 improves query accuracy for Java, Kotlin, Rust, and C/C++ and updates CWE metadata.
You can now keep your AI agent skills, prompts, and instructions up to date with Dependabot version updates for Agent Package Manager (APM) . Dependabot opens pull requests to update supported git dependencies declared in apm.yml and regenerates apm.lock.yaml when it’s present. This support covers version updates, not security updates.
You can now delegate coding tasks, guide execution, and review results with GitHub Copilot in JetBrains Air . The integration uses the Agent Client Protocol (ACP) and supports tasks in your JetBrains IDE or in the cloud. Use Copilot in Air alongside the GitHub Copilot plugin and choose the workflow that works best for you.
You can now use the GitHub REST API to find which cost center a user, organization, repository, or enterprise team belongs to. Previously, you had to list every cost center and scan its resources. Pass the resource type and name to the new endpoint. The response includes the cost center’s ID and name.
Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories, unless an applicable Actions event policy explicitly allows them. Enforcement was previously scheduled for November 2, 2026. GitHub introduced this default rule through workflow execution protections.
The GitHub code security risk assessment and secret risk assessment now show whether findings are in protected or unprotected repositories, helping you identify where to extend your security coverage. Organization admins and security managers can start an assessment by going to Assessments under their organization’s Security tab.
GitHub added new webhook delivery IP ranges to the Meta API hooks field for github.com and GitHub Enterprise Cloud.
GitHub Copilot repository plugin defaults and enterprise-managed plugin controls are generally available across VS Code, Copilot CLI, and the Copilot app.
GitHub Copilot now supports server-to-server authentication for GitHub Apps in public preview. This allows automated services and agents to make requests on behalf of an organization without requiring individual user credentials.
OpenAI's GPT-6.1 Terra model is now available in GitHub Copilot for coding and terminal tasks, offering a balance of performance and cost.
GitHub CLI v2.103.3 fixes an issue in gh auth status to properly explain expired and expiring tokens when using the --no-refresh flag.
GitHub Apps can now be installed at the enterprise level, providing expanded API support for governance, security, and administrative tasks.
GitHub is rolling out a global default policy for Copilot features. Unconfigured features will be set to a default state of Enabled, Disabled, or Let organizations decide, depending on the enterprise configuration.
GitHub introduced a public preview in GitHub CLI allowing developers to opt in to expiring, automatically refreshed OAuth tokens using the --expiring flag or configuration settings.
Expiring, auto-refreshing OAuth tokens (preview) gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.
GitHub released Copilot CLI 1.0.102, introducing support for managed Auto model selection, subagent MCP tool approvals, git-subdir marketplace sources, and improved proxy and sandboxing reliability.
An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code. To stem this tide of attacks, GitHub is introducing a new package firewall capability.
You can now use the REST API to retrieve and update Copilot model policies for enterprises, enterprise teams, enterprise apps, and organizations. What’s new GET and PATCH endpoints are now generally available for model policies at four levels: Enterprise: /enterprises/{enterprise}/copilot/model-policies Enterprise teams...
Starting with macOS 27 and Xcode 27, Apple no longer includes Intel (x86_64) code in some of the system binaries and libraries that CodeQL relies on to trace builds. As a result, CodeQL can’t support traced scans on these versions or analyze Swift 6.4.
During periods of unusual traffic, GitHub may temporarily require authentication for some clones and fetches of public repositories over HTTPS to help protect github.com’s availability. If an operation is affected, it will fail with a message indicating that authentication is required. To continue, authenticate and retry the operation.
Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled.
You can now use the generally available Xcode 27 runner image to build and test your Apple applications in GitHub Actions. Previously in public preview, this GitHub-hosted image runs on macOS 27 and includes the Xcode 27 toolchain and Apple SDKs.
Multi-repo support in Slack and Microsoft Teams GitHub Copilot in Slack and Microsoft Teams now supports working across multiple repositories in a single conversation.
Agentic autofix for code scanning alerts is now generally available. It remediates alerts by working across your codebase the way a developer would: it explores relevant files, proposes a fix, and reruns CodeQL to confirm the fix closes the alert before opening a pull request for your review.
As of October 15, 2026, email notifications for repository push events have been retired and are no longer sent. We shut down this feature to help prevent spam and abuse. Because recipients didn’t have to consent before receiving these emails, the feature could be misused to send unwanted messages through GitHub’s email infrastructure.
Code scanning AI Scan for pull requests is now generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more.
HydraFusion has an updated model pool, improved orchestration workflows, and introduces HydraFusion Max. Both HydraFusion and HydraFusion Max are available across VS Code, the GitHub Copilot app, and GitHub Copilot CLI and remain in research preview.
GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency, Team, and Free plans. Tags and branches can move after you review a workflow, so a later run might execute different code.
Gemini 4 Argon, Google’s newest frontier model, is now generally available in GitHub Copilot. It is designed for complex coding, agentic, and reasoning tasks. In early testing, Gemini 4 Argon solved more tasks than previous Gemini models on every coding benchmark, with its largest gains in Copilot CLI.
Organization and enterprise administrators can now observe the impact of AI Scan for pull requests in security overview. New metrics show how many AI Scan findings were generated, resolved, the remediation rate, which repositories generated findings, trends over the selected reporting period, and how often developers applied autofix suggestions.
The “Budgets and alerts” page in your GitHub billing settings now shows all of your budgets in one list that you can search and filter. Whether you manage budgets for a personal account, enterprise or organization, you can find a specific budget without paginating through the full list.
You can now select Anonymous as the authentication method for an organization-level private registry. Use it for registries that Dependabot can reach without credentials, such as an internal package mirror that allows anonymous reads. On github.com, Dependabot update jobs can only reach hosts on the egress allowlist and the private registries you configure.
Enterprise administrators can now use telemetry in managed settings to attribute GitHub Copilot activity to a user without collecting their prompts, responses, or tool content. The telemetry.capture.identity setting adds three attributes to OpenTelemetry (OTel) data: user.name : The authenticated Copilot account name, currently the GitHub login.
This update brings more control over default models and MCP server in GitHub Copilot for JetBrains. It also makes diagnostics easier to address, improves chat navigation and account controls, and strengthens reliability across agent sessions, customizations, and worktrees.
This week’s updates make Copilot easier to use across accounts and environments, with more control over what agents can access and how you manage their work. GitHub Copilot Claude Haiku 5.5 is available to Copilot Pro, Pro+, Max, Business, and Enterprise users.
CodeQL 2.27.2 is now available, adding a C++ regular-expression parser and analysis improvements across several languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code. The Default suite runs 498 security queries covering 170 CWEs.
This release adds new billing and license controls for Copilot code review admins: Billing: Organization owners can bill Copilot code reviews from members with a Copilot license to the organization’s cost center instead of using up those members’ Copilot quotas.
Maintainers are seeing more low-quality contributions in their repositories and need better ways to manage them. You can now configure pull request limits to also include draft pull requests. Previously, draft pull requests didn’t count toward a user’s limit.
Claude Haiku 5.5, Anthropic’s newest lightweight model, is now generally available in GitHub Copilot. It is designed for fast, high-volume work like subagents, quick edits, and terminal tasks. In early testing, Haiku 5.5 matched Claude Sonnet 5 on many coding tasks while using significantly fewer tokens and steps.
GitHub stacked pull requests are now generally available. Break large changes into smaller, focused pull requests that you can review independently and merge together. Since the feature went into public preview , repositories using stacks have seen a 9% increase in merged code compared to peers.
Organization and enterprise administrators can now see AI Scan for pull requests enablement status in the security overview coverage view. The code scanning summary shows enabled and not enabled repository counts, while repository rows show each repository’s effective AI Scan enablement.
If your Copilot usage metrics have shown agent activity or agent lines of code falling while Copilot usage kept growing, we’ve found the cause, and a fix is rolling out to each IDE. Several IDEs recently moved Copilot agent sessions to the Copilot SDK.
Secret scanning now detects new secret types from Lovable Labs, Pydantic Services Inc., and Supabase. New secret scanning partner The following provider joined the secret scanning partnership program.
You can now read, add, and edit comments on repository security advisories using the REST API, including advisories created from private vulnerability reports. Until now, the discussion on an advisory was only reachable in the web UI, even though it often holds the most useful triage context on a vulnerability report.
You can now request a GitHub Copilot code review through the REST and GraphQL APIs and set the review effort level for each request. Balanced is also now the default review effort level. These changes are generally available to Copilot Pro, Pro+, Max, Business, and Enterprise plans.
The staged rollout of the stateless GitHub App installation token format, which began on April 27, 2026, is complete. By default, all newly minted GitHub App installation tokens will be in the stateless ghs_APPID_JWT format, which makes token issuance and validation faster and improves the reliability of the GitHub API.
The macOS 14 runner image will be retired on November 2, 2026. To raise awareness of the upcoming removal, jobs using macOS 14 will temporarily fail during the following scheduled brownout periods: October 5, 14:00 UTC to October 6, 00:00 UTC October 12, 14:00 UTC to October 13, 00:00 UTC October 16, 14:00 UTC to October 17, 00:00 UTC October 19, 14:00 UTC...
Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.102.0 as soon as possible. gh release download, gh run download, gh repo read-file --output, and gh attestation download could write remote content to an unintended local file when the destination contained symbolic links.
2026-09-30 Add support for GPT-6.1 Sol in model selection Add --mcp-github-auth to scope GitHub account auth to approved MCP server origins Add session-scoped read-only directory approvals to path access prompts Permission prompts remain answerable after resuming interrupted sessions.
2026-09-28 Left-clicking supported ask_user and elicitation form inputs focuses them and places the cursor at the clicked position Add support for Claude Code rule files in .claude/rules as custom instructions Sessions in the sidebar show a blue dot when they finished a turn you have not opened yet Auto suggests a routing tier and lets you switch with a...
Agentic autofix now uses Copilot Memory for customers who’ve enabled it. When you use agentic autofix, it reviews existing memories for context that can help resolve security alerts. When it creates a fix, it stores the fix pattern as a memory for future use.
You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub’s sudo mode for enterprises, enforcing a higher security bar when it’s needed.
GitHub Copilot code review now offers additional personal configurations to an expanded set of Copilot plans and an enterprise-level default setting. These improvements are now generally available: A dedicated personal settings page for automatic review and your default review effort An enterprise-wide default review effort setting for organization-owned...
This is the final notification that Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available. If you maintain a JavaScript action, update its runs.using value to node24 and publish a new release as soon as possible.
Starting with CodeQL CLI 2.27.0 , the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst ), which includes the binaries for all supported platforms up to this release, is marked as deprecated. In mid-March 2027, we will remove the all-platform CodeQL bundle.
| Release-notes page | Site | Feed |
|---|---|---|
| Actions changelog github.blog | github.blog | RSS |
| Changelog github.blog | github.blog | RSS |
| Copilot changelog github.blog | github.blog | RSS |
| Copilot CLI releases github.com | github.com | RSS |
| Desktop release notes desktop.github.com | desktop.github.com | None |
| Enterprise Server release notes docs.github.com | docs.github.com | None |
| GitHub CLI releases github.com | github.com | RSS |
| Security changelog github.blog | github.blog | RSS |
Releasesby Glyph