Releasesby GlyphCode scanning AI Scan no longer requires CodeQL default setup
You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.
Also shipped Sep 16, 2026GitHub in September 2026 →
BigQuery migration lineage service enters preview
The migration lineage service visualizes data flow and connections in a source database to help plan a BigQuery data warehouse migration.
Cortex Agents object enhancements (General availability)
The following Cortex Agents object enhancements are now generally available:
Include and exclude per-user quota users by name (General availability)
Per-user quotas now accept individual user names, so you can add or remove specific users alongside the quota's tag scope. INCLUDE_USERS is new and takes user names directly, and EXCLUDE_USERS accepts a 'USER' argument alongside its existing 'TAG' form:
Weekly per-user quota limits (General availability)
Per-user quotas now support a weekly credit limit alongside the existing monthly and daily limits. Pass 'WEEKLY' as the cycle argument to SET_PER_USER_LIMIT :
Anthropic models will be removed from AWS GovCloud IL5 workspaces
On September 19, 2026, Anthropic models will be removed from Databricks on AWS GovCloud and AWS GovCloud DoD workspaces that have the DoD Impact Level 5 (IL5) compliance standard selected. After this date, IL5 workspaces can't create or use endpoints that serve Anthropic models.
Unity Gateway API and developer tools are generally available
The Unity Gateway API for managing model services, model provider services, and MCP services is now generally available, with create, read, update, list, and delete support across Databricks developer tools: Terraform provider : 1.132.0 and later Databricks CLI : v1.17.0 and later Python SDK : databricks-sdk 0.136.0 and later Go SDK : databricks-sdk-go...
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Enforce GitHub Advanced Security configurations
Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.
Manage the code coverage ruleset condition with the REST API
You can now use the generally available REST API to manage the Restrict code coverage repository ruleset option, in addition to the existing UI support. This ruleset lets you enforce a minimum code coverage percentage based on line coverage or set a maximum tolerable coverage drop for a pull request.
Stage-only npm tokens for safer automation
You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token permission to publish new versions directly to the npm registry. Your workflow uses npm stage publish to submit a version.
GitHub Enterprise adds credential inventory exports
Enterprise owners can now export a complete inventory of every credential that can access their enterprise (e.g., SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens).
Security improvements for SSH
We’re removing several SSH algorithms, adding a new algorithm, and requiring larger RSA SSH keys to improve security. The changes are as follows: We’re removing the ability to use RSA keys using SHA-1 in SSH (i.e., the ssh-rsa signature type, including ssh-rsa-cert-v01@openssh.com certificates using SHA-1).
Deprecation notice: All-platform CodeQL bundle
Starting with CodeQL CLI 2.27.0 , the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst ), which includes the binaries for all supported platforms up to this release, is marked as deprecated. In mid-March 2027, we will remove the all-platform CodeQL bundle.
AI Scan for pull request APIs in public preview
You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI.
npm extends recovery-code security holds to all accounts
npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.