Releasesby GlyphDependabot alerts will pause on inactive repositories
Starting December 8, 2026, GitHub will archive Dependabot alerts for repositories with no activity in the past year. Alerts are automatically restored if the repository becomes active again or if security configurations enforce them.
Also shipped Nov 10, 2026GitHub in November 2026 →
Amazon Bedrock AgentCore now offers a Web Search API
AWS launched the InvokeWebSearch API on Amazon Bedrock AgentCore, enabling direct web search execution billed at $7 per 1,000 queries.
Flagship - Evaluate Flagship feature flags from Rust
Cloudflare released an official Rust SDK (`cloudflare-flagship`) for Flagship, enabling async Rust applications to evaluate feature flags via OpenFeature with remote or in-process local evaluation.
BigQuery generative AI functions support gemini-4-carbon
Google Cloud announced general availability for the gemini-4-carbon model across BigQuery generative AI functions.
Amazon OpenSearch Service announces managed cross-Region disaster recovery
AWS introduced managed cross-Region disaster recovery for Amazon OpenSearch Service, providing continuous data replication with an RPO under one minute and RTO under 20 minutes.
Amazon Bedrock adds bedrock-runtime endpoint support for Daybreak models
AWS added support for OpenAI Daybreak Red and Daybreak Blue cybersecurity models on Amazon Bedrock runtime endpoints via US and Global cross-Region inference profiles.
Gemini Enterprise: Gemini 4 Carbon available in web app, mobile app, Workflow Builder, and AI developer tools
Google Cloud generally released Gemini 4 Carbon across Gemini Enterprise web and mobile apps, Workflow Builder, and AI developer tools with multi-region availability.
More from GitHub Advanced SecurityEvery GitHub Advanced Security release →
Secret scanning upgrades detectors, adds SpaceX as partner
GitHub secret scanning now supports SpaceX as a partner and includes a new detector for Starlink public API secrets. Additionally, existing detectors for AWS, Google, and other providers have been updated to reduce false positives.
CodeQL 2.27.4 improves accuracy and query metadata
CodeQL 2.27.4 improves query accuracy for Java, Kotlin, Rust, and C/C++ and updates CWE metadata.
Dependabot version updates support Agent Package Manager
You can now keep your AI agent skills, prompts, and instructions up to date with Dependabot version updates for Agent Package Manager (APM) . Dependabot opens pull requests to update supported git dependencies declared in apm.yml and regenerates apm.lock.yaml when it’s present. This support covers version updates, not security updates.
CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.27.3 . It supports new Python 3.15 language features, adds JSON syntax for data extensions, adds C23 bit-precise integers, and includes accuracy improvements across languages.
Dependabot now supports Python 3.15
You can now upgrade your projects to Python 3.15 and keep receiving Dependabot updates. Support for Python 3.15 is available to all github.com users and will be included in GitHub Enterprise Server 3.24. For the full list of ecosystems that Dependabot supports, see Dependabot supported ecosystems and repositories .
GitHub Desktop adds short-lived authentication tokens
When you sign in to GitHub Desktop 3.6.10 or later, eligible accounts can now use short-lived, automatically refreshing authentication tokens. Short-lived access tokens reduce how long a leaked token can be used. Desktop automatically refreshes them for GitHub API requests and Git operations, keeping token renewal out of your everyday workflow.
Security risk assessments include repository protection status
The GitHub code security risk assessment and secret risk assessment now show whether findings are in protected or unprotected repositories, helping you identify where to extend your security coverage. Organization admins and security managers can start an assessment by going to Assessments under their organization’s Security tab.
Public monitoring adds triage, validity, API, and webhooks
GitHub Advanced Security's public monitoring now includes alert management, validity checks, and API/webhook support for remediating leaked secrets.