Releasesby GlyphCodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.
Also shipped Sep 25, 2026GitHub in September 2026 →
Tags for dashboards, notebooks, Databricks apps, and Genie Agents are now generally available
You can now apply tags to dashboards, notebooks, Databricks apps, and Genie Agents to organize and categorize your workspace assets. This capability is now generally available. Both governed and ungoverned key-value tags are supported. See Apply tags to Unity Catalog securable objects .
CLI v0.8.1 | CLI
CLI v0.8.1 Continue local work in the cloud: Use cr code handoff --summary to start a new cloud Coding Agent task with your session summary, an optional plan, and an automatically discovered transcript when available. Clearer handoff results: See transfer progress, the branch and commit, transferred filenames, and a direct link to the cloud task.
Free VMs without an account, tracing, OpenCode on Cloud Agents
Your next project can start with an SSH command. This week, we're opening up free VMs with no account required, introducing tracing in Priority Boarding, and bringing OpenCode to Cloud Agents. Let's get into it!
[In preview] Public Preview: Azure HorizonDB supports PostgreSQL 18
Azure HorizonDB is a fully managed, PostgreSQL-compatible, cloud-native database service designed for scalable, high-performance workloads.Azure HorizonDB, now in public preview, includes PostgreSQL 18 support.Learn more.
What's new in Sigma
AI Assistant in build mode: pivot table styling In workbooks, Sigma Assistant in build mode now creates pivot tables with automatic heatmap and matrix styling based on the type of measures.
Sleeping Sessions Wake on Preview or SSH Traffic
Opening a preview URL or SSHing into a session whose machine has gone to sleep now wakes the machine and completes the request instead of showing "not running". Browser previews come back automatically after a session wakes, and the "Wake Devin up" button on a sleeping preview now shows live progress.
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Security improvements for SSH
We’re removing several SSH algorithms, adding a new algorithm, and requiring larger RSA SSH keys to improve security. The changes are as follows: We’re removing the ability to use RSA keys using SHA-1 in SSH (i.e., the ssh-rsa signature type, including ssh-rsa-cert-v01@openssh.com certificates using SHA-1).
Deprecation notice: All-platform CodeQL bundle
Starting with CodeQL CLI 2.27.0 , the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst ), which includes the binaries for all supported platforms up to this release, is marked as deprecated. In mid-March 2027, we will remove the all-platform CodeQL bundle.
GitHub Enterprise adds credential inventory exports
Enterprise owners can now export a complete inventory of every credential that can access their enterprise (e.g., SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens).
Rate limits for private vulnerability reports
Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit in a day, both to your repository and across GitHub. This helps protect you from bulk and automated submissions, while legitimate researchers can still reach you.
Structured forms for private vulnerability reports
Private vulnerability reports can now use a structured form that asks reporters for the details you need to assess a vulnerability, including a reproducible proof of concept. A single free-text box made it easy to submit low-quality or AI-generated reports and hard for you to find the signal in them.
New fields for SecurityAdvisory GraphQL API
You can now read more of the GitHub Advisory Database directly from the GraphQL API without falling back to the REST API. The SecurityAdvisory object gained five new fields: cveId : The advisory’s CVE identifier. sourceCodeLocation : A link to the affected source code relevant to the advisory. githubReviewedAt : When GitHub reviewed the advisory.
Confidential comments on repository security advisories
You can now post confidential comments on repository security advisories. Confidential comments are visible only to people with write access to the repository, so you can discuss a report with your team without the reporter or other invited collaborators seeing it.
Repository security advisory comments API in public preview
You can now read, add, and edit comments on repository security advisories using the REST API, including advisories created from private vulnerability reports. Until now, the discussion on an advisory was only reachable in the web UI, even though it often holds the most useful triage context on a vulnerability report.