Releasesby GlyphGemini 2.5 Pro and Gemini 3 Flash deprecated
As of today, July 31, 2026, we have deprecated the following models across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions).
Restricting npm bypass-2FA granular access tokens
npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of the largest credential-based attack surfaces on the registry. This only impacts npm granular access tokens.
GitHub CLI 2.97.0
Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version v2.97.0 as soon as possible. Several commands (including gh gist view , gh api , gh pr diff , gh release download --output - , gh codespace logs , gh skills preview , and gh agent-task view / create ) printed externally...
GitHub Copilot in Visual Studio , July update
July 2026 brought a new agent based on the Copilot SDK, built-in expertise from the .NET and Azure teams, and more ways to tailor GitHub Copilot to how you and your team work. Highlights Here’s what’s new with GitHub Copilot in Visual Studio 2026.
Stacked pull requests are now in public preview
Stacked pull requests break large changes into small, reviewable pull requests. They’re an ordered series of pull requests that each represent focused layers of your change. With stacks, you can independently review and check each pull request, then merge everything together in one click.
Reference same-repository actions with self-repository syntax
You can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your workflow’s own repository at the exact commit that is running, with no checkout required.
Copilot code review: Agent skills and MCP now generally available
Copilot code review support for agent skills and MCP servers is now generally available for all Copilot Pro, Pro+, Business, and Enterprise users. Previously announced in public preview , these capabilities let you bring your team’s tools, standards, and external context directly into every code review.
CodeQL 2.26.1 improves analysis accuracy and framework coverage
CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1 , which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis.
Dependabot alerts on malicious packages across more ecosystems
The GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, significantly expanding the breadth of malware data available to you through Dependabot alerts.
GitHub Actions holds potentially malicious workflows for approval
Recent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these attacks, GitHub Actions now holds certain workflow runs for approval before they start.
GitHub Copilot app usage metrics now expand across report rollups
Copilot app usage is now reported across much more of the Copilot usage metrics API. Individual Copilot app activity is now attributed to users in the enterprise-user and organization-user reports. In addition, Copilot app coding activity is now broken out in the feature, model, and language rollups alongside every other Copilot surface.
Enterprise managed settings in the GitHub Copilot app and Copilot cloud agent
You can now govern the GitHub Copilot app and Copilot cloud agent with enterprise managed settings, the same centrally managed policies you use to control Copilot across your enterprise.
Claude Opus 5 is now available in GitHub Copilot
Claude Opus 5, Anthropic’s newest Opus model, is now available in GitHub Copilot. It is designed for complex, long-running coding tasks that require careful reasoning, effective tool use, and reliable execution across multiple steps.
Agent automation controls in GitHub Issues in public preview
Agent automations increasingly label, type, assign, and close issues for you. GitHub Issues now shows the reason behind each change and lets you review them before they’re applied, so you decide how much to automate and when to stay in the loop.
Multi-select fields for Projects and Issues in public preview
You can now create multi-select fields in Projects and Issue fields so a single field can hold more than one value. Tag an item with everything it relates to (e.g., multiple teams, modules, or categories) instead of picking just one. Issue Fields Projects Fields To try it, create or edit a field and choose the multi-select type.
New Copilot usage metrics impact dashboard
We’ve released a new Copilot metrics impact dashboard for enterprise administrators and organization owners. This dashboard helps you tell a deeper Copilot impact story by sharing not just who is active, but how they’re using Copilot.
Upcoming GHES change impacting uploading support bundles
We want to give you advance notice of an upcoming security change that may affect GitHub Enterprise Server (GHES) support bundle uploads. Beginning August 18, 2026, GitHub will start rejecting command-line support bundle uploads from older GHES appliances that have not been updated with the required security patches.
Gemini 3.6 Flash is now available in GitHub Copilot
Gemini 3.6 Flash, Google’s latest Flash model, is now rolling out in GitHub Copilot. It is designed for web and app development, coding, and longer-horizon agentic tasks. It has configurable reasoning effort and support for parallel tool use across complex workflows.
AI credit pools for cost centers in the billing UI
You can now manage a cost center’s AI credit pool directly in the billing UI where you create and edit cost centers. Previously, you could only manage this through the GitHub REST API. This feature is available for Copilot Business and Copilot Enterprise on GitHub Enterprise Cloud. Toggle the AI credit pool on when you create or edit a cost center.
GitHub Code Quality is now generally available
GitHub Code Quality is now generally available on GitHub Enterprise Cloud and GitHub Team. It solves an emerging challenge for software development: AI accelerates code output, and Code Quality helps teams ship code they trust.
Repository-level GitHub Copilot usage metrics generally available
The Copilot usage metrics REST API now reports repository-level activity. Two new endpoints return a daily, per-repository breakdown of pull request activity for Copilot coding agent and Copilot code review. They do this for both enterprise and organization reports.
Advanced search for Projects is generally available
The filter bar in GitHub Projects views now supports advanced search, so you can build the exact view you need with logical AND and OR instead of maintaining a separate view for every question. Just type an expression using OR , AND in the filter bar of any project view.
Xcode 27 runner image now in public preview
You can now build and test your Apple applications against Xcode 27 on GitHub-hosted macOS runners. This is now available in public preview. With early access to the latest Xcode toolchain and Apple SDKs, you can validate your apps against the newest tools, catch compatibility issues sooner, and keep your CI/CD pipelines current.
GitHub Copilot in Visual Studio , June update
June 2026 is about visibility and trust with a clearer view of your GitHub Copilot usage, a new trust layer for MCP servers, and the first C++ scenarios for the modernization agent reaching general availability. Highlights Here’s what’s new with GitHub Copilot in Visual Studio 2026.
Improvements to secret scanning and public monitoring
This week, we’re rolling out several improvements to secret scanning and public monitoring: Resend is now a GitHub secret scanning partner. Secret scanning now detects new secret types from APIclub and Resend. Secret scanning now blocks VolcEngine secrets with push protection by default.
GitHub Copilot for JetBrains expands BYOK capabilities
This update brings major advances in customization and model provider flexibility to all tiers of GitHub Copilot for JetBrains IDEs. With richer plugin and provider experiences, improved conversational interactions, and stronger reliability, teams can more confidently tailor Copilot to how they build software.
Code scanning shows AI security detections on pull requests
GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. These detections help teams identify and address potential issues in parts of the codebase that previously had no native scanning coverage, all before code is merged.
GitHub Code Quality license estimate in public preview
You can now see the number of active committers on repositories using GitHub Code Quality across your enterprise, giving you an estimate of your Code Quality license cost before it becomes a paid product on July 20, 2026. Code Quality is free during the public preview, so this usage isn’t billed today.
Separate SSO and Organizations pages in Settings
We’ve separated the combined SSO & Organizations page in your user settings into two distinct pages: SSO and Organizations . This update makes it easier to find and manage these settings independently, with a clearer experience in your account settings.
Agentic autofix for code scanning alerts in public preview
Agentic autofix is now in public preview for all code scanning alerts. It remediates alerts generated by CodeQL and third-party scanning tools by working across your codebase the way a developer would, it explores relevant files, proposes a fix, and reruns the original analysis to confirm the fix closes the alert before opening a pull request for your...
CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection
CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0 , which adds support for Kotlin 2.4.0, introduces a JavaScript and TypeScript query for system prompt injection, and improves analysis accuracy across multiple languages.
Per-user states for multi-user budgets in the REST API
You can now retrieve every user’s progress against a multi-user budget from a single REST API endpoint. This makes it much faster to find who is close to their limit across a large enterprise. Previously, you had to make one API call per user to check per-user consumption, and you couldn’t filter by how much of the budget someone had used.
New pull requests dashboard is now generally available
The refreshed pull requests dashboard is now generally available at github.com/pulls . It gives you a single home to track, prioritize, and act on the pull requests that need your attention, whether you’re an individual contributor or a manager working across many teams and projects. This experience was previously in public preview.
Organization-level targeting for GitHub Code Quality
Organization owners can now target a subset of repositories when enabling or disabling GitHub Code Quality, rather than applying it to every repository at once. This gives you more granular control on where you enable or disable Code Quality across your organization.
OpenAI’s GPT-5.6 Sol, Terra, and Luna are now available in GitHub Copilot
OpenAI’s GPT-5.6 family is now rolling out in GitHub Copilot. GPT-5.6 comes in three variants, Sol, Terra, and Luna, so you can match the model to the job, whether that’s reasoning over a large codebase, everyday agentic coding, or fast, cost-efficient assistance. GPT-5.6 Sol: The highest reasoning ceiling in the family.
Codex as agent provider and agentic enhancements in JetBrains IDEs
This update brings Codex as a new agent provider in public preview, expands the Customizations editor with Hooks support and richer MCP server management, and introduces custom model support configured by GitHub Copilot Business and Enterprise administrators.
Innersource security advisories are generally available
GitHub Advanced Security enterprise customers can now publish internal security advisories. Innersource advisories work similarly to GitHub’s open source advisories, but their visibility is restricted to repositories owned by the enterprise.
setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes
The actions/setup-java v5.5.0 release adds cryptographic signature verification for downloaded JDKs, support for a new distribution, and several quality-of-life improvements for Maven users. Here’s what changed since v5.4.0.
Copilot Billing Preview app will be retired on August 3
The Copilot Billing Preview app will be retired on August 3, 2026. If you use it to review your GitHub Copilot spend, you can get even greater visibility directly in your GitHub billing settings. The app was built to help you understand your bill as Copilot moved to usage-based billing.
Restrict who can dismiss reviews in rulesets
You can now restrict who can dismiss pull request reviews directly in GitHub repository rulesets. This capability is generally available and gives you precise control over who can clear an approval before changes merge. The setting lives alongside the other review options in the Require a pull request before merging rule.
Secret scanning extended metadata and multipart validation
To help you understand ownership and impact of a leaked secret, GitHub secret scanning surfaces enriched metadata for supported secret types. Extended metadata checks are now generally available, including support for multipart validators with supplementary metadata. What’s new?
4 products
Upcoming deprecation of Gemini 2.5 Pro and Gemini 3 Flash
We will deprecate Gemini 2.5 Pro and Gemini 3 Flash across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions) on July 31st, 2026: Model Deprecation date Suggested alternative Gemini 2.5 Pro 7-31-2026 Gemini 3.1 Pro Gemini 3 Flash 7-31-2026 Gemini 3.5 Flash Please update your workflows and...
Browser tools for GitHub Copilot in VS Code are generally available
Editor’s note (July 1, 2026): Added more detail about which permissions stay under your control and the existing network domain controls. Browser tools for GitHub Copilot in VS Code are now generally available. Agents can now drive a real browser, navigate live web apps, and feed what they find back into the chat.
Secret scanning adds validators for Asana, IBM, and MessageBird
Secret scanning now runs validity checks on Asana, IBM, and MessageBird secrets so you can tell whether a leaked credential is still active. Validity checks added These patterns now support validity checks.