Releasesby IbisAI Scan for pull requests generally available
GAyesterdayUnverifiedAdded Oct 16, 2026
Code scanning AI Scan for pull requests is now generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more.
Topics: Security, Pricing, Developer tools, Coding agents
More GitHub Advanced Security releases
Every GitHub Advanced Security releaseDownload GitHub Code Quality license usage as a CSV
You can now download a CSV report of your GitHub Code Quality license usage to reconcile your license count with your own records. The report includes: Each active committer who consumes a Code Quality license. The repositories that received their commits in the last 90 days. Whether each committer is unique to a single repository or organization.
Audit GitHub Code Quality finding dismissals and reopenings
You can now review manual dismissals and reopenings of GitHub Code Quality findings in your organization or enterprise audit log. Findings may appear in either your repository’s default-branch backlog or pull requests. Two new events record these actions: repo.code_quality_findings_dismissed records a dismissal of one or more backlog findings.
Secret scanning blocks Anthropic keys by default, adds Salesforce
Secret scanning now detects new secret types from Salesforce, Anthropic, and Cloudsmith, with the new Anthropic secret types blocked with push protection by default. New secret scanning partner Salesforce is now a secret scanning partner.
Improved detection for withdrawn Dependabot alerts
You can now more easily detect withdrawn Dependabot alerts. Dependabot withdraws and removes an alert when the advisory or vulnerability that produced it is no longer valid. Two changes help you detect these withdrawals: Webhooks: The dependabot_alert webhook event now includes a withdrawn action.
Code scanning AI Scan metrics in security overview
Organization and enterprise administrators can now observe the impact of AI Scan for pull requests in security overview. New metrics show how many AI Scan findings were generated, resolved, the remediation rate, which repositories generated findings, trends over the selected reporting period, and how often developers applied autofix suggestions.
Push attribution for commits in limited public preview
GitHub now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside the existing author and committer fields. Commit author and committer fields are just strings that the pushing client supplies, so anyone with write access to a repository can set them to any name and email they choose.
Anonymous organization-level registries for Dependabot
You can now select Anonymous as the authentication method for an organization-level private registry. Use it for registries that Dependabot can reach without credentials, such as an internal package mirror that allows anonymous reads. On github.com, Dependabot update jobs can only reach hosts on the egress allowlist and the private registries you configure.
CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis
CodeQL 2.27.2 is now available, adding a C++ regular-expression parser and analysis improvements across several languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code. The Default suite runs 498 security queries covering 170 CWEs.
Also shipped on Oct 15, 2026
GitHub in October 2026Checkout footer visibility now applies to merchant-configurable content
The visibility fields on CheckoutBrandingFooterContent and CheckoutAndAccountsConfigurationBrandingFooterContent now control only merchant-configurable footer content. Checkout can display Shopify-provided transaction information in the footer regardless of this setting.
ShopifyYou can copy tables across regions
You can copy tables across regions . This feature is now generally available (GA).
You can now use column aliases in GoogleSQL
You can now use column aliases in GoogleSQL. This feature lets you define an alias for an expression in the SELECT clause of a SQL query and immediately reference that alias within the same SELECT list or in the WHERE clause of the same query block.
You can export a conversational analytics agent's answer , including text, visualizations, tables, and...
You can export a conversational analytics agent's answer , including text, visualizations, tables, and citations, to a PDF or CSV file. This feature is generally available (GA).
ADBC driver for Power BI is now generally available
The Arrow Database Connectivity (ADBC) driver for the Databricks connector for Power BI is now generally available. ADBC is the default driver for new connections in Power BI Desktop and the Power BI service. See Configure ADBC or ODBC driver for Power BI .
Gemini Enterprise: Anthropic models are available in the Gemini Enterprise app
Administrators can make Anthropic models, Claude Opus 5.5 and Claude Sonnet 5.5, available to users in the Gemini Enterprise app. After an administrator turns on a model in the Enable third-party models section of the Feature Management tab, users can select the model in the model selector.