Releasesby GlyphSelf-service credential revocation for incident response
For a timely response to security incidents involving compromised accounts or stolen credentials, GitHub Enterprise owners can now use new “break-glass” capabilities to instantly revoke all credentials for a given user. This builds on the enterprise-wide credential management tools for incident response released earlier.
Also shipped Jun 24, 2026GitHub in June 2026 →
Computer Use
Launched public preview support for the Computer Use tool in Gemini 3.5 Flash. This release includes simplified actions with intents, built-in support for browser, mobile, and desktop environments, configurable safety policies, and advanced prompt injection detection.
Cloudflare One Client for macOS (version 2026.6.782.1)
A new Beta release for the macOS Cloudflare One Client is now available on the beta releases downloads page . This beta release introduces upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation.
Single sign-on (SSO) with OIDC for DigitalOcean Kubernetes (DOKS) clusters is now in general availability
Single sign-on (SSO) with OIDC for DigitalOcean Kubernetes (DOKS) clusters is now in general availability. You can authenticate users to your Kubernetes clusters through an identity provider like Auth0, authentik, JumpCloud, Keycloak, or …
Storefront MCP cart tools are being deprecated in favour of UCP Cart MCP
What's changing The cart tools on the Storefront MCP server are being deprecated in favour of the UCP-conforming Cart MCP tools: get_cart and update_cart on https://{shop}.myshopify.com/api/mcp are deprecated.
OpenAI updates chat-latest to the latest ChatGPT Instant model
The chat-latest snapshot now points to the latest Instant model used in ChatGPT and will be updated regularly. OpenAI recommends GPT-5.5 for production API usage.
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
npm adds preventive account protection for high-impact accounts
npm now adds a temporary, preventive safeguard for high-impact accounts , those responsible for the registry’s most widely used packages, whenever it detects a sensitive account change, strengthening protection against account-takeover attacks.
GitHub code coverage merge protection for pull requests
You can now use branch rulesets to block pull requests from merging when test coverage drops below thresholds you set. You can set a minimum coverage percentage, a maximum allowed drop from the default branch, or both. You can start in evaluate mode to understand impact first, then switch to active mode when you’re ready to enforce merge protection.
Open source license compliance is in public preview
Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is in public preview, letting you block noncompliant dependencies before they reach production.
Dependabot no longer infers .npmrc
Dependabot will no longer attempt to infer .npmrc configuration for npm private registries. Previously, Dependabot tried to reconstruct .npmrc contents from lockfile resolved URLs, but incorrect lockfile URLs, lockfile format differences across npm, Yarn v1, Yarn Berry, and pnpm, and other edge cases regularly caused registry authentication failures.
Upcoming cloud data retention policy for closed security alerts
Starting September 25, 2026, GitHub will introduce a data retention policy for closed Dependabot security alerts. This policy gives you a clear commitment for how long your alert data stays accessible and where you can find it. It applies to Dependabot security alerts on github.com, including GitHub Enterprise Cloud (GHEC).
Upcoming access restrictions to public API endpoints and UI views
As part of our ongoing commitment to protect our users and ensure responsible use of our platform, the Notifications team will soon introduce access restrictions to several public API endpoints and related UI views.
Secret scanning adds validators for Asana, IBM, and MessageBird
Secret scanning now runs validity checks on Asana, IBM, and MessageBird secrets so you can tell whether a leaked credential is still active. Validity checks added These patterns now support validity checks.
Secret scanning public monitoring for enterprises
GitHub is committed to empowering the developer community by helping organizations recognize and address the risks of secret leaks wherever they happen. We believe every enterprise should know the moment its secrets leak in public, no matter where it happens on GitHub.