Releasesby GlyphEnforce GitHub Advanced Security configurations
Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.
Also shipped Sep 15, 2026GitHub in September 2026 →
Predict dynamic table refresh behavior with EXPLAIN CHANGES (General availability)
You can now use EXPLAIN CHANGES to predict a dynamic table's refresh behavior before it happens, either for a manual refresh or as part of a DDL change, without applying the change.
Horizon Catalog Explorer UI (Preview)
With this release, the Horizon Catalog Explorer is the default experience for browsing Snowflake objects in Snowsight, replacing Database Explorer. The Horizon Catalog Explorer provides consistent navigation and object detail pages while preserving the tabs and actions that you already use.
Embedding Streamlit in Snowflake apps in external pages (General availability)
Embedding Streamlit in Snowflake apps in external pages is now generally available. You can render a container-runtime app inside a page you host, such as a customer portal or an internal dashboard, using a single tag.
Elastic Channels for Snowpipe Streaming (General availability)
Elastic Channels for Snowpipe Streaming are now generally available. Elastic Channels provide one implicit, server-scaled ingestion path per pipe, so concurrent producers can stream directly to Snowflake tables and supported Snowflake-managed Iceberg tables without managing channel names, lifecycle, ordering, or offset tokens.
Webhook-triggered deployments for Databricks Apps will soon be generally available
Starting in October 2026, webhook-triggered deployments for Databricks Apps will be generally available. Automatically deploy your app when changes are pushed to a connected GitHub or Azure DevOps repository, so your deployed app stays in sync with your repository without manual redeployment. See Deploy a Databricks app .
Sharing foreign Delta tables with OpenSharing is now generally available
Sharing and reading foreign Delta tables with OpenSharing is now generally available. Providers can share Delta-format tables federated from OneLake, a Hive metastore, or AWS Glue, without copying data into Databricks. See Add foreign Delta tables to a share .
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Code scanning AI Scan no longer requires CodeQL default setup
You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.
Manage the code coverage ruleset condition with the REST API
You can now use the generally available REST API to manage the Restrict code coverage repository ruleset option, in addition to the existing UI support. This ruleset lets you enforce a minimum code coverage percentage based on line coverage or set a maximum tolerable coverage drop for a pull request.
Stage-only npm tokens for safer automation
You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token permission to publish new versions directly to the npm registry. Your workflow uses npm stage publish to submit a version.
AI Scan for pull request APIs in public preview
You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI.
GitHub Enterprise adds credential inventory exports
Enterprise owners can now export a complete inventory of every credential that can access their enterprise (e.g., SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens).
npm extends recovery-code security holds to all accounts
npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.
CodeQL 2.27.0 adds support for Linux ARM64
CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
GitHub Advanced Security expands trial availability
More GitHub Enterprise Cloud customers can now start a self-serve GitHub Advanced Security trial to evaluate GitHub Code Security and GitHub Secret Protection. Eligibility has expanded from enterprises with up to 100 licenses to enterprises with up to 300 licenses.