Releasesby GlyphGitHub Code Quality license estimate in public preview
You can now see the number of active committers on repositories using GitHub Code Quality across your enterprise, giving you an estimate of your Code Quality license cost before it becomes a paid product on July 20, 2026. Code Quality is free during the public preview, so this usage isn’t billed today.
Also shipped Jul 13, 2026GitHub in July 2026 →
BigQuery Apache Iceberg managed tables get partitioning and transactions GA
Table partitioning, multi-statement transactions and advanced runtime are now generally available for Apache Iceberg managed tables in BigQuery.
Cross-cloud Lakehouse now supports Snowflake as a remote catalog provider (Preview)
Cross-cloud Lakehouse now supports Snowflake as a remote catalog provider (Preview). You can configure federated catalogs to query data stored in Snowflake directly from Google Cloud using BigQuery or Apache Spark without migrating data or building complex ETL pipelines. For more information, see Set up cross-cloud Lakehouse for Snowflake .
BigQuery project caps limit slots and concurrency per project in preview
Project caps, also called scheduling policies, limit maximum slots and concurrency for each project within a BigQuery reservation, helping control shared capacity.
BigQuery Overview page is generally available
The BigQuery Overview page is a hub for tutorials, features and resources, with guided paths for users of all skill levels.
BigQuery Migration Service MCP server for SQL translation is GA
The MCP server translates SQL queries into GoogleSQL, generates DDL from input queries and explains SQL translations, letting AI tools drive warehouse migrations.
BigQuery Data Transfer Service incremental Salesforce transfers are GA
Incremental data transfers from Salesforce in the BigQuery Data Transfer Service are now generally available.
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Manage secret scanning custom patterns via REST API
Starting today, security teams can create, edit, and manage secret scanning custom patterns with the REST API. What’s new The following endpoints are generally available: GET .../secret-scanning/custom-patterns list patterns POST .../secret-scanning/custom-patterns create patterns PATCH .../secret-scanning/custom-patterns/{id} update patterns DELETE...
Code scanning shows AI security detections on pull requests
GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. These detections help teams identify and address potential issues in parts of the codebase that previously had no native scanning coverage, all before code is merged.
Dependabot version updates introduce default package cooldown
Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration.
Improvements to secret scanning and public monitoring
This week, we’re rolling out several improvements to secret scanning and public monitoring: Resend is now a GitHub secret scanning partner. Secret scanning now detects new secret types from APIclub and Resend. Secret scanning now blocks VolcEngine secrets with push protection by default.
CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection
CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0 , which adds support for Kotlin 2.4.0, introduces a JavaScript and TypeScript query for system prompt injection, and improves analysis accuracy across multiple languages.
Clearer names for secret scanning detector types
To make secret scanning easier to understand, we’re updating the names we use for our detector types to better reflect how each one finds secrets. This is a naming change only; detection behavior is exactly the same.
Organization-level targeting for GitHub Code Quality
Organization owners can now target a subset of repositories when enabling or disabling GitHub Code Quality, rather than applying it to every repository at once. This gives you more granular control on where you enable or disable Code Quality across your organization.
Innersource security advisories are generally available
GitHub Advanced Security enterprise customers can now publish internal security advisories. Innersource advisories work similarly to GitHub’s open source advisories, but their visibility is restricted to repositories owned by the enterprise.