Releasesby GlyphCustomize code scanning default setup at scale
You can now apply your own configuration file to code scanning default setup, using the new github-codeql-config-file repository property. This gives you control over how CodeQL scans your code for security vulnerabilities, whether that’s on one repository or across your whole organization.
Also shipped Aug 4, 2026GitHub in August 2026 →
Workspace sharing in Declarative Native Apps (Public Preview)
Workspace sharing is now available in public preview for Declarative Native Apps. Providers can share a whole directory of files and folders by declaring a workspace in the application package manifest. Consumers get a read-only workspace when they install the app, and can browse the folder structure and open the files.
Gateway Monitoring & A/B Testing (General availability)
Gateway Monitoring & A/B Testing is now generally available. Use gateway model monitors to track drift and performance for inference services behind a Snowflake Gateway, compare baseline and challenger services during live traffic splits, and evaluate results in Snowsight or with SQL. For more information, see Gateway monitoring & A/B testing .
Multi-party Approval (General availability)
Multi-party Approval (MPA) is now generally available. When a Multi-party Approval policy is attached to your account, MPA enforces a mandatory second-person (“four-eyes”) verification step for critical account operations. A Multi-party Approval policy defines which operations require approval and who can approve them.
Unity Gateway is now generally available
Unity Gateway is now generally available. Unity Gateway is the Databricks governance solution for enterprise AI, part of Unity Catalog. With Unity Gateway you can: Control which AI services teams can use. Route and manage AI traffic across providers. Govern MCP servers to control access and costs. Monitor usage, cost, access, and lineage from one place.
Sharing Delta tables with Iceberg reads enabled is now generally available
Sharing Delta tables with Iceberg reads enabled is now generally available. See Delta Lake feature support matrix .
Sharing Delta tables with deletion vectors and column mapping is now generally available
Sharing Delta tables with deletion vectors or column mapping enabled is now generally available. See Add tables with deletion vectors or column mapping to a share .
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Customize Dependabot pull request branch names
You can now customize the branch names Dependabot creates for pull requests. New pull-request-branch-name options in .github/dependabot.yml let you set a prefix and maximum length, choose segment and word separators, set letter case, or define a custom template using placeholders.
Code coverage automatic enablement in Code Quality settings
We’re making code coverage setup faster and simpler. You’ll now see a new option in your repository’s Code Quality settings that lets GitHub generate your coverage workflow automatically with AI. We’ll open a pull request so you can review the changes before you merge them. Setting up code coverage has traditionally felt disconnected and manual.
CodeQL 2.26.2 adds Swift 6.3.3 and Kotlin 2.4.10 support
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.2, which adds support for Swift 6.3.3 and Kotlin 2.4.10, and improves the accuracy of path injection, URL redirection, and GitHub Actions queries.
Secret scanning coverage updates
This release expands secret scanning’s coverage with more secrets blocked by push protection, one new secret scanning partner, and richer metadata on alerts. Secret scanning partnership program Lovable Labs is now a GitHub secret scanning partner. Secret scanning now automatically detects the following new secret type in your repositories.
Restricting npm bypass-2FA granular access tokens
npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of the largest credential-based attack surfaces on the registry. This only impacts npm granular access tokens.
CodeQL 2.26.1 improves analysis accuracy and framework coverage
CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1 , which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis.
npm publish-time malware scanning and dual-use metadata
As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time . This changelog covers what publishers can expect and a new metadata requirement for dual-use content.
Dependabot alerts on malicious packages across more ecosystems
The GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, significantly expanding the breadth of malware data available to you through Dependabot alerts.