Releasesby GlyphSecurity improvements for SSH
We’re removing several SSH algorithms, adding a new algorithm, and requiring larger RSA SSH keys to improve security. The changes are as follows: We’re removing the ability to use RSA keys using SHA-1 in SSH (i.e., the ssh-rsa signature type, including ssh-rsa-cert-v01@openssh.com certificates using SHA-1).
Also shipped Sep 22, 2026GitHub in September 2026 →
Shopify connector (Beta)
The Shopify connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests e-commerce data such as products, orders, customers, inventory, fulfillments, and discounts from Shopify into Databricks. Authentication uses the Shopify OAuth client credentials grant.
Lakebase backup schedule API (Beta)
You can now manage Lakebase backup schedules programmatically. The snapshot schedule API lets you read and set a root branch's automated snapshot cadences (daily, weekly, or monthly) and how long each cadence's snapshots are retained. This API is in Beta and available to all Lakebase workspaces. See Create a backup schedule .
OpenAI GPT-6 Sol and GPT-6 Luna are now generally available on Amazon Bedrock
Today, AWS announces the general availability of GPT-6 Sol and GPT-6 Luna from OpenAI on Amazon Bedrock. Expanding the GPT-6 family alongside Astra, these two models give teams more ways to balance intelligence, speed, and cost across every workload. Sol is the daily model for recurring complex tasks and software development.
Claude Opus 5.5 launches with a 1M token context window and 128k output
Anthropic released Claude Opus 5.5 for long-running agentic coding and knowledge work, with a default 1M token context, 128k max output and always-on adaptive thinking. It costs $4 / $20 per MTok, below Claude Opus 5, and is on the Claude API, Bedrock, Google Cloud and Microsoft Foundry.
Fast mode research preview available for Claude Opus 5.5 on the Claude API
Fast mode, in research preview, can now be used with Claude Opus 5.5 on the Claude API.
Claude API beta lets tools be defined inside mid-conversation system messages
With the inline-tools-2026-09-15 beta header, a tool_addition block can carry a full tool definition, so agents can add tools, change schemas or upgrade server tools mid-conversation without invalidating the prompt cache. The same header covers adding and removing tools by reference.
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Deprecation notice: All-platform CodeQL bundle
Starting with CodeQL CLI 2.27.0 , the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst ), which includes the binaries for all supported platforms up to this release, is marked as deprecated. In mid-March 2027, we will remove the all-platform CodeQL bundle.
GitHub Enterprise adds credential inventory exports
Enterprise owners can now export a complete inventory of every credential that can access their enterprise (e.g., SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens).
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
Manage the code coverage ruleset condition with the REST API
You can now use the generally available REST API to manage the Restrict code coverage repository ruleset option, in addition to the existing UI support. This ruleset lets you enforce a minimum code coverage percentage based on line coverage or set a maximum tolerable coverage drop for a pull request.
Stage-only npm tokens for safer automation
You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token permission to publish new versions directly to the npm registry. Your workflow uses npm stage publish to submit a version.
Code scanning AI Scan no longer requires CodeQL default setup
You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.
Enforce GitHub Advanced Security configurations
Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.
Rate limits for private vulnerability reports
Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit in a day, both to your repository and across GitHub. This helps protect you from bulk and automated submissions, while legitimate researchers can still reach you.