Releasesby GlyphAutomatic Dependabot access to GitHub-hosted registries
Dependabot can now read from private GitHub Packages registries without a personal access token. If a package has granted your repository access through “Manage Actions access” in the package settings, Dependabot reuses that grant.
Also shipped Sep 8, 2026GitHub in September 2026 →
Conversational analytics now supports predictive modeling questions using the AI.PREDICT function
Conversational analytics now supports predictive modeling questions using the AI.PREDICT function . This feature is in Preview .
Add and drop hybrid table constraints online (General availability)
With this release, you can add and drop UNIQUE and FOREIGN KEY constraints on an existing hybrid table by using alter table . Previously, you had to define these constraints when you created the table, so adding a foreign key to a table that was already serving a workload meant recreating and reloading the table.
Shadow traffic for gateways (Preview)
With this preview release, you can use a shadow traffic gateway to send all production requests to a primary service endpoint while mirroring a percentage of those requests to one or more shadow endpoints. Responses from shadow endpoints aren't returned to clients.
The partner-powered AI features setting will be removed
On November 1, 2026, Databricks will remove the account- and workspace-level toggle for partner-powered AI features. Each workspace will keep its current setting value: if the setting is enabled, it stays enabled, and if it's disabled, it stays disabled. Removing the toggle doesn't change any setting values.
Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available
Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available. Today, Lakeflow Connect ingests formula fields by taking a full snapshot on each pipeline run by default. When incremental formula field ingestion is generally available, full snapshots will no longer be the default.
ABAC DENY policies are in Beta
ABAC DENY policies are in Beta in Unity Catalog. DENY policies can be used to explicitly deny the MANAGE ACCESS CONTROL privilege to prevent specified principals, including object owners, from performing access-management operations. They always take precedence over any grant. For details, see ABAC DENY policies (Beta) .
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
npm extends recovery-code security holds to all accounts
npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.
CodeQL 2.27.0 adds support for Linux ARM64
CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
GitHub Advanced Security expands trial availability
More GitHub Enterprise Cloud customers can now start a self-serve GitHub Advanced Security trial to evaluate GitHub Code Security and GitHub Secret Protection. Eligibility has expanded from enterprises with up to 100 licenses to enterprises with up to 300 licenses.
Block pull requests with exposed secrets from merging
Repository rulesets allow you to easily add scalable protections across your repositories. Starting today, you can use repository rulesets to block pull requests from merging when the pull request introduces secret scanning alerts. What’s new You can enable the new rule require secret scanning alerts are resolved on pull requests for selected repositories.
Remediate Code Quality findings with agentic autofix
Agentic autofix is now available to help you burn down findings in your code quality backlog. You can select up to 25 standard findings on a page and assign the whole set to Copilot in one action. Copilot starts fixing them agentically on a branch, validates its own changes, then opens a pull request for you to review and merge.
AI Scan for pull request APIs in public preview
You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI.
Multiple trusted publishing configurations for npm
We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback. Three updates to npm publishing are now generally available: Multiple trusted publishing configurations per package Staged packages can only be approved after malware scanning is complete Maintainers can see their staged history in the package versions...
Enforce GitHub Advanced Security configurations
Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.