Releasesby IbisGitHub CLI: Opt in to expiring, auto-refreshing OAuth tokens
Preview3 days agoUnverifiedAdded Oct 22, 2026
You can now use expiring, automatically refreshing OAuth credentials in GitHub CLI as part of a public preview. When you opt in, gh stores an expiring access token alongside a rotating refresh token and automatically refreshes the token whenever it is needed.
Topics: Security, Observability, Developer tools
More GitHub Advanced Security releases
Every GitHub Advanced Security releasePublic monitoring now available with data residency
Public monitoring is now available in public preview for GitHub Enterprise Cloud with data residency (GHEC DR). Public monitoring with data residency Public monitoring extends secret scanning beyond internal repositories by monitoring public commits across github.com, attributing exposed credentials back to your enterprise in real time.
Updates to GitHub secret scanning
This update covers improvements and bug fixes for GitHub secret scanning. Update to audit log events On November 12, 2026 , the business field in affected secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events will change from the enterprise display name to the enterprise slug .
Dependabot alerts REST API now includes dependency versions
You can now get the version of a vulnerable dependency directly from Dependabot alert responses in the REST API. Each alert’s dependency object includes a new version_requirement field with the version or version constraint that Dependabot last recorded for the alert.
GitHub package firewall in public preview
An increasing number of malware attacks exploit systems at package installation time, harvesting credentials on CI/CD hosts or developer workstations without even running the package’s code. To stem this tide of attacks, GitHub is introducing a new package firewall capability.
Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4
You can now upgrade your projects to npm 12, pnpm 11 or 12, or Bun 1.4 and keep receiving Dependabot updates. Support for these package manager versions is available to all github.com users and will be included in GitHub Enterprise Server 3.24.
CodeQL changes for macOS 27, Xcode 27, and Swift 6.4
Starting with macOS 27 and Xcode 27, Apple no longer includes Intel (x86_64) code in some of the system binaries and libraries that CodeQL relies on to trace builds. As a result, CodeQL can’t support traced scans on these versions or analyze Swift 6.4.
Open source license compliance generally available
Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled.
Download GitHub Code Quality license usage as a CSV
You can now download a CSV report of your GitHub Code Quality license usage to reconcile your license count with your own records. The report includes: Each active committer who consumes a Code Quality license. The repositories that received their commits in the last 90 days. Whether each committer is unique to a single repository or organization.
Also shipped on Oct 21, 2026
GitHub in October 20262026.10.09
The voice catalog grows from about 390 to more than 1,400 voices. The 1,035 new voices span all five languages and 29 accents, for use cases from customer service to characters. Browse them in the Studio voice library or read the announcement . Also new in Studio : Preview samples: a voice can have several preview samples, each reading a different sentence.
The AI.CHUNK_DOCUMENT function is a table-valued function that splits unstructured documents into...
The AI.CHUNK_DOCUMENT function is a table-valued function that splits unstructured documents into semantically coherent text chunks optimized for vector embeddings and Retrieval-Augmented Generation (RAG) workflows. This function is generally available (GA).
Automated cataloging and ingestion of Looker (Google Cloud core) metadata with Knowledge Catalog is now...
Automated cataloging and ingestion of Looker (Google Cloud core) metadata with Knowledge Catalog is now generally available (GA). This includes support for additional granular metadata (including dimension/measure definitions, default queries, and relationships) and new asset types: LookML dashboards, LookML dashboard elements, and agents.
Screen MCP tool calls and results for jailbreaks (Beta)
You can now screen MCP tool calls and their results in Unity Gateway for jailbreak and prompt injection attempts. Apply the Jailbreak guardrail on input, output, or both. See Attach a built-in policy .
[Launched] Generally Available: Azure Cosmos DB Safe Key Rotation
Safe Key Rotation for Azure Cosmos DB is now generally available. You can view timestamp metadata showing when each account key was last used, helping you identify active keys before rotating or retiring credentials.This visibility helps reduce the risk o
OpenAI models are coming to Google Cloud
OpenAI frontier models and Codex workflows are now available in Google Cloud's Model Garden via the Google Cloud Marketplace.