Releasesby IbisDependabot alerts REST API now includes dependency versions
Update4 days agoUnverifiedAdded Oct 21, 2026
You can now get the version of a vulnerable dependency directly from Dependabot alert responses in the REST API. Each alert’s dependency object includes a new version_requirement field with the version or version constraint that Dependabot last recorded for the alert.
Topics: Security, Developer tools
More GitHub Advanced Security releases
Every GitHub Advanced Security releaseUpdates to GitHub secret scanning
This update covers improvements and bug fixes for GitHub secret scanning. Update to audit log events On November 12, 2026 , the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events will change from the enterprise display name to the enterprise slug .
GitHub package firewall in public preview
An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code. To stem this tide of attacks, GitHub is introducing a new package firewall capability.
Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4
You can now upgrade your projects to npm 12, pnpm 11 or 12, or Bun 1.4 and keep receiving Dependabot updates. Support for these package manager versions is available to all github.com users and will be included in GitHub Enterprise Server 3.24.
GitHub CLI: Opt in to expiring, auto-refreshing OAuth tokens
You can now use expiring, automatically refreshing OAuth credentials in GitHub CLI as part of a public preview. When you opt in, gh stores an expiring access token alongside a rotating refresh token and automatically refreshes the token whenever it is needed.
CodeQL changes for macOS 27, Xcode 27, and Swift 6.4
Starting with macOS 27 and Xcode 27, Apple no longer includes Intel (x86_64) code in some of the system binaries and libraries that CodeQL relies on to trace builds. As a result, CodeQL can’t support traced scans on these versions or analyze Swift 6.4.
Public monitoring now available with data residency
Public monitoring is now available in public preview for GitHub Enterprise Cloud with data residency (GHEC DR). Public monitoring with data residency Public monitoring extends secret scanning beyond internal repositories by monitoring public commits across github.com, attributing exposed credentials back to your enterprise in real time.
Open source license compliance generally available
Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled.
Download GitHub Code Quality license usage as a CSV
You can now download a CSV report of your GitHub Code Quality license usage to reconcile your license count with your own records. The report includes: Each active committer who consumes a Code Quality license. The repositories that received their commits in the last 90 days. Whether each committer is unique to a single repository or organization.
Also shipped on Oct 20, 2026
GitHub in October 2026Cloudflare One Client for Windows (version 2026.8.2115.0)
A new GA release for the Windows Cloudflare One Client is now available on the stable releases downloads page . This hotfix addresses an issue building trusted certificate chains.
Cloudflare One Client for macOS (version 2026.8.2115.0)
A new GA release for the macOS Cloudflare One Client is now available on the stable releases downloads page . This hotfix addresses an issue building trusted certificate chains.
Online Feature Store (General availability)
Online Feature Store is now generally available and is no longer in Preview .
Cloudflare One Client for Linux (version 2026.8.2115.0)
A new GA release for the Linux Cloudflare One Client is now available on the stable releases downloads page . This hotfix addresses an issue building trusted certificate chains.
SurveyMonkey connector is available in Beta
The managed SurveyMonkey connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. Use the connector to ingest surveys, survey structure, collectors, survey responses, and contacts from SurveyMonkey into Databricks.
Oracle Eloqua connector is available in Beta
The managed Oracle Eloqua connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. Use the connector to ingest marketing data such as contacts, accounts, campaigns, email and form assets, form submissions, events, and website visitors from Oracle Eloqua into Databricks.