Releasesby IbisAnonymous organization-level registries for Dependabot
GAyesterdayUnverifiedAdded Oct 13, 2026
You can now select Anonymous as the authentication method for an organization-level private registry. Use it for registries that Dependabot can reach without credentials, such as an internal package mirror that allows anonymous reads. On github.com, Dependabot update jobs can only reach hosts on the egress allowlist and the private registries you configure.
Topics: Security, Observability
More GitHub Advanced Security releases
Every GitHub Advanced Security releasePush attribution for commits in limited public preview
GitHub now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside the existing author and committer fields. Commit author and committer fields are just strings that the pushing client supplies, so anyone with write access to a repository can set them to any name and email they choose.
CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis
CodeQL 2.27.2 is now available, adding a C++ regular-expression parser and analysis improvements across several languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code. The Default suite runs 498 security queries covering 170 CWEs.
Code scanning AI Scan enablement status in security overview
Organization and enterprise administrators can now see AI Scan for pull requests enablement status in the security overview coverage view. The code scanning summary shows enabled and not enabled repository counts, while repository rows show each repository’s effective AI Scan enablement.
Secret scanning adds detectors for Lovable, Supabase, and more
Secret scanning now detects new secret types from Lovable Labs, Pydantic Services Inc., and Supabase. New secret scanning partner The following provider joined the secret scanning partnership program.
New fields for SecurityAdvisory GraphQL API
You can now read more of the GitHub Advisory Database directly from the GraphQL API without falling back to the REST API. The SecurityAdvisory object gained five new fields: cveId : The advisory’s CVE identifier. sourceCodeLocation : A link to the affected source code relevant to the advisory. githubReviewedAt : When GitHub reviewed the advisory.
Confidential comments on repository security advisories
You can now post confidential comments on repository security advisories. Confidential comments are visible only to people with write access to the repository, so you can discuss a report with your team without the reporter or other invited collaborators seeing it.
Repository security advisory comments API in public preview
You can now read, add, and edit comments on repository security advisories using the REST API, including advisories created from private vulnerability reports. Until now, the discussion on an advisory was only reachable in the web UI, even though it often holds the most useful triage context on a vulnerability report.
Unvalidated npm trusted publishing configurations now expire
Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing. This limits the risk of trusting a repository or project name that changes ownership. Your configuration becomes validated and exempt from expiry after its first successful publish.
Also shipped on Oct 12, 2026
GitHub in October 2026Change an incident’s conference bridge without leaving Slack with /pd meeting now Generally Available
Run /pd meeting during an incident, paste the new link, and PagerDuty updates the incident card instantly with a Join meeting button in the channel. Scribe Agent follows along to the new meeting on its own, so you keep the transcript for your post-incident review. Available to customers using the Pa...
New Incident Workflow action: Get Slack Mentions for Incident Participants now Generally Available
This new Incident Workflow action pulls the assignees, acknowledgers, and role holders on an incident and turns them into Slack @mentions. Pair it with Send Slack Message to tag everyone involved without hard-coding names, so the same workflow works across every team and rotation. Available to Pager...
Conference bridge selection in the Slack declare modal now Generally Available
Declare an incident with /pd declare and choose one of your pre-configured PagerDuty conference bridges from a dropdown, or paste a meeting URL if you don't have one set up. The bridge is on the incident from the moment it's declared, so responders can join from Slack in one click. Available to cust...
Incremental data transfers for the BigQuery Data Transfer Service for PostgreSQL and ServiceNow are now...
Incremental data transfers for the BigQuery Data Transfer Service for PostgreSQL and ServiceNow are now generally available (GA).
Support for Budget spend caps to pause your Cloud Run workloads is in General Availability (GA)
Support for Budget spend caps to pause your Cloud Run workloads is in General Availability (GA) .
Unity Gateway Skills API and developer tools are available in Beta
The Unity Gateway Skills REST API is now available in Beta , with create, read, update, list, delete, and finalize support across Databricks developer tools: Databricks CLI Python SDK Go SDK Go Modular SDK Java SDK JavaScript SDK See the Skills API and SDK reference .