Releasesby GlyphAI Scan for pull request APIs in public preview
You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI.
Also shipped Sep 10, 2026GitHub in September 2026 →
BigQuery conversational analytics adds ML.CORRELATION in preview
Conversational analytics can now use ML.CORRELATION to calculate statistical correlations between a target column and one or more metric columns in a table.
BigQuery ML.METRICS evaluates predictions without a stored model
The preview ML.METRICS function computes classification or regression evaluation metrics on any table or query with actual and predicted values, with no need to create or reference a stored model.
You can use the AI.CAUSAL_EFFECT function to quantify the impact of specific interventions on time series data
You can use the AI.CAUSAL_EFFECT function to quantify the impact of specific interventions on time series data. This feature is in Preview .
BigQuery Data Engineering Agent integrates with BigQuery Graph
The Data Engineering Agent now uses BigQuery Graph for extra context between source and destination schemas, improving schema mapping accuracy in data engineering pipelines. It is generally available.
Using dbt artifacts for Slim CI and defer to production in dbt Projects on Snowflake (General availability)
Slim CI, defer to production, failed-execution recovery, and concurrent execution are now generally available for dbt Projects on Snowflake. Reuse dbt artifacts from recent production executions to accelerate development, streamline CI/CD workflows, and recover from failed production runs without maintaining a separate artifact store.
External secret providers (Preview)
External secret providers are now in preview. If your organization already keeps API keys, database passwords, and similar values in AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager, Snowflake can read those values when a query needs them, so you don't have to maintain a second copy in a Snowflake secret .
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
npm extends recovery-code security holds to all accounts
npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.
CodeQL 2.27.0 adds support for Linux ARM64
CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
GitHub Advanced Security expands trial availability
More GitHub Enterprise Cloud customers can now start a self-serve GitHub Advanced Security trial to evaluate GitHub Code Security and GitHub Secret Protection. Eligibility has expanded from enterprises with up to 100 licenses to enterprises with up to 300 licenses.
Block pull requests with exposed secrets from merging
Repository rulesets allow you to easily add scalable protections across your repositories. Starting today, you can use repository rulesets to block pull requests from merging when the pull request introduces secret scanning alerts. What’s new You can enable the new rule require secret scanning alerts are resolved on pull requests for selected repositories.
Remediate Code Quality findings with agentic autofix
Agentic autofix is now available to help you burn down findings in your code quality backlog. You can select up to 25 standard findings on a page and assign the whole set to Copilot in one action. Copilot starts fixing them agentically on a branch, validates its own changes, then opens a pull request for you to review and merge.
Automatic Dependabot access to GitHub-hosted registries
Dependabot can now read from private GitHub Packages registries without a personal access token. If a package has granted your repository access through “Manage Actions access” in the package settings, Dependabot reuses that grant.
Enforce GitHub Advanced Security configurations
Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.
Code scanning AI Scan no longer requires CodeQL default setup
You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.