Releasesby GlyphOrganization-level targeting for GitHub Code Quality
Organization owners can now target a subset of repositories when enabling or disabling GitHub Code Quality, rather than applying it to every repository at once. This gives you more granular control on where you enable or disable Code Quality across your organization.
Also shipped Jul 9, 2026GitHub in July 2026 →
Change to default pipeline editor for workspaces with the compliance security profile enabled
The Lakeflow Pipelines Editor has been generally available since May 2026. In August, it will become the default editor for developing and debugging pipelines in workspaces with the compliance security profile enabled. At that time the legacy editor will be removed.
Strac connector (Beta)
The Strac connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests data-security audit events from your Strac instance into Databricks. Authentication uses a Strac API key. See Strac connector .
Protobuf tensor input for custom model serving endpoints (Public Preview)
For custom model serving endpoints with a tensor-based input signature, you can now send the request body as a serialized KServe v2 ModelInferRequest with Content-Type: application/x-protobuf , instead of JSON. This feature is in Public Preview and is only available on endpoints deployed after July 9, 2026. See Protobuf tensor input .
Genie One enhancements
- Document citations : Documents now show citations that link content back to the data and sources Genie One used to generate the document. See View citations . Document version history : Documents now keep a version history so you can review earlier versions. See View version history .
Front-end Private Link for account-level Genie One (Beta)
You can now configure front-end Private Link for account-level Genie One. Turn on the Front-end Private Link for Custom URLs and Account preview to get started. See Configure inbound Private Link for account-level resources .
Dashboard enhancements and bug fixes
- Import BI files is in Public Preview : Importing Power BI and Tableau reports as AI/BI dashboards with Genie Code is in Public Preview. You can also start an import directly from the dashboard list page. See Import BI files using Genie Code .
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection
CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0 , which adds support for Kotlin 2.4.0, introduces a JavaScript and TypeScript query for system prompt injection, and improves analysis accuracy across multiple languages.
Clearer names for secret scanning detector types
To make secret scanning easier to understand, we’re updating the names we use for our detector types to better reflect how each one finds secrets. This is a naming change only; detection behavior is exactly the same.
Innersource security advisories are generally available
GitHub Advanced Security enterprise customers can now publish internal security advisories. Innersource advisories work similarly to GitHub’s open source advisories, but their visibility is restricted to repositories owned by the enterprise.
npm install-time security and GAT bypass2fa deprecation
npm v12 is now generally available and tagged latest . This major release turns on the install-time security defaults we announced in June , and it’s also where we begin a deprecation of the most sensitive uses of 2FA-bypass granular access tokens (GATs).
Secret scanning extended metadata and multipart validation
To help you understand ownership and impact of a leaked secret, GitHub secret scanning surfaces enriched metadata for supported secret types. Extended metadata checks are now generally available, including support for multipart validators with supplementary metadata. What’s new?
Manage secret scanning custom patterns via REST API
Starting today, security teams can create, edit, and manage secret scanning custom patterns with the REST API. What’s new The following endpoints are generally available: GET .../secret-scanning/custom-patterns list patterns POST .../secret-scanning/custom-patterns create patterns PATCH .../secret-scanning/custom-patterns/{id} update patterns DELETE...
GitHub Code Quality license estimate in public preview
You can now see the number of active committers on repositories using GitHub Code Quality across your enterprise, giving you an estimate of your Code Quality license cost before it becomes a paid product on July 20, 2026. Code Quality is free during the public preview, so this usage isn’t billed today.
Code scanning shows AI security detections on pull requests
GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. These detections help teams identify and address potential issues in parts of the codebase that previously had no native scanning coverage, all before code is merged.