Releasesby GlyphBlock users directly from security advisories
You can now block a user directly from a security advisory page in public repositories owned by either an organization or a personal account. This brings the streamlined moderation experience available for issues and pull requests to security advisories.
Also shipped Aug 25, 2026GitHub in August 2026 →
BigQuery data governance tags are supported in Terraform
BigQuery data governance tags are supported in Terraform. This feature is in Preview .
Multi-value tags (General availability)
With this release, multi-value tags are generally available. You can assign more than one string value to the same tag.
Remote app operations for Snowflake Native Apps (Preview)
Remote app operations are now available in public preview for Snowflake Native Apps. Providers can perform on-demand operations on consumer apps, including running SQL statements ( run_sql ), retrying a failed upgrade ( retry_upgrade ), and disabling/enabling the app ( disable / enable ), all through a new system function SYSTEM$REMOTE_APP_OPERATION .
Remote Development with the Snowflake Extension for Visual Studio Code (Preview)
Remote Development with the Snowflake Extension for Visual Studio Code is now available in public preview.
Stable egress IP addresses on Azure (Preview)
Stable egress IP addresses are now available in preview on Azure. You can generate Snowflake egress IP address ranges (as CIDR addresses) and add them to an external server's allowlist so that Snowflake can make requests to that server.
LTAP Direct Writes accelerates synced table loads (Beta)
LTAP Direct Writes speeds up how synced tables load into Lakebase. When you create a synced table, Lakebase loads a full copy of your Unity Catalog data into your Postgres branch.
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Code scanning adds a mitigated alert dismissal reason
You can now dismiss a code scanning alert with the reason Mitigated when a vulnerability remains in the code but external controls, such as a web application firewall or network policy, mitigate its risk.
Track GitHub Code Quality enablement changes in the audit log
GitHub Code Quality now writes an audit log event whenever someone enables, disables, or changes its settings on a repository. Three new events give you that history: repo.code_quality_enabled records when someone turns on Code Quality for a repository. repo.code_quality_disabled records when someone turns it off.
Track organization code quality trends
The organization-level Code Quality dashboard now includes a Trends tab that shows how code quality has changed across your repositories over time. Instead of a point-in-time snapshot, you can see whether open findings are trending up or down and which repositories are driving the change.
Credential revocation and deauthorization by token type
Building on our self-service credential revocation experiences for incident response, you can now take token-type and user-specific actions to deauthorize and revoke user credentials during a security incident. This gives you finer-grained control when responding to a compromise.
Multiple trusted publishing configurations for npm
We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback. Three updates to npm publishing are now generally available: Multiple trusted publishing configurations per package Staged packages can only be approved after malware scanning is complete Maintainers can see their staged history in the package versions...
License data quality improvements
GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown in dependency insights, software bills of materials (SBOMs), the open source license compliance feature in GitHub Advanced Security, and the dependency...
Automatic Dependabot access to GitHub-hosted registries
Dependabot can now read from private GitHub Packages registries without a personal access token. If a package has granted your repository access through “Manage Actions access” in the package settings, Dependabot reuses that grant.
npm extends recovery-code security holds to all accounts
npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.