Releasesby IbisOpen source license compliance generally available
GA8 days agoUnverifiedAdded Oct 17, 2026
Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled.
Topics: Governance, Security, Developer tools
More GitHub Advanced Security releases
Every GitHub Advanced Security releaseDownload GitHub Code Quality license usage as a CSV
You can now download a CSV report of your GitHub Code Quality license usage to reconcile your license count with your own records. The report includes: Each active committer who consumes a Code Quality license. The repositories that received their commits in the last 90 days. Whether each committer is unique to a single repository or organization.
AI Scan for pull requests generally available
Code scanning AI Scan for pull requests is now generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more.
CodeQL changes for macOS 27, Xcode 27, and Swift 6.4
Starting with macOS 27 and Xcode 27, Apple no longer includes Intel (x86_64) code in some of the system binaries and libraries that CodeQL relies on to trace builds. As a result, CodeQL can’t support traced scans on these versions or analyze Swift 6.4.
Audit GitHub Code Quality finding dismissals and reopenings
You can now review manual dismissals and reopenings of GitHub Code Quality findings in your organization or enterprise audit log. Findings may appear in either your repository’s default-branch backlog or pull requests. Two new events record these actions: repo.code_quality_findings_dismissed records a dismissal of one or more backlog findings.
Secret scanning blocks Anthropic keys by default, adds Salesforce
Secret scanning now detects new secret types from Salesforce, Anthropic, and Cloudsmith, with the new Anthropic secret types blocked with push protection by default. New secret scanning partner Salesforce is now a secret scanning partner.
Improved detection for withdrawn Dependabot alerts
You can now more easily detect withdrawn Dependabot alerts. Dependabot withdraws and removes an alert when the advisory or vulnerability that produced it is no longer valid. Two changes help you detect these withdrawals: Webhooks: The dependabot_alert webhook event now includes a withdrawn action.
Code scanning AI Scan metrics in security overview
Organization and enterprise administrators can now observe the impact of AI Scan for pull requests in security overview. New metrics show how many AI Scan findings were generated, resolved, the remediation rate, which repositories generated findings, trends over the selected reporting period, and how often developers applied autofix suggestions.
Updates to GitHub secret scanning
This update covers improvements and bug fixes for GitHub secret scanning. Update to audit log events On November 12, 2026 , the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events will change from the enterprise display name to the enterprise slug .
Also shipped on Oct 16, 2026
GitHub in October 20262026.10.08
Make a voice you already have speak another language or accent, with the same speaker. Call POST /voice-generator/localize on a flagship or custom voice, pick an accent, and get candidates back in seconds to audition and convert like Voice Design candidates. GET /voice-generator/available-accents lists the accents you can target.
Neon Realtime in public beta, new AI Gateway models, Stripe real-time sync, CJK search in Lakebase Search, and more release - Oct 16, 2026
Neon Realtime is in public beta. Neon now has realtime, built by the team behind Electric. Neon Realtime turns any SQL query into a live query. Subscribe to it ...
TypeSafe AI Jev 1.14.0 is now available on Unity Gateway
TypeSafe AI Jev 1.14.0 is now available on Unity Gateway. TypeSafe AI hosts it, and an account admin must enable the Externally-hosted TypeSafe AI Models preview. TypeSafe's terms govern its use.
Gemini Enterprise: Configure citations for custom MCP data stores
You can configure the citation_mappings parameter for custom Model Context Protocol (MCP) data stores using the REST API to display source citation chips when Gemini Enterprise answers questions using tools on your custom MCP server. This feature is generally available (GA). For more information, see Configure citations for custom MCP data stores .
[In preview] Public Preview: Azure Databricks Private network gateway
Private network gateway for Azure Databricks is now in Public Preview, enabling serverless compute to connect to resources in your virtual network (VNet) and transitively connected networks through a single managed gateway. Customers can use the gateway t
Cloud Agent Canvases and Environment Improvements
Canvases from cloud agents Cloud agents can now build interactive canvases as part of their work. Share a finished canvas with your team by sending its link. Learn more about sharing canvases . Environments API The Environments API is now available in beta. Use it to programmatically create and manage the cloud environments your agents run in.