Code hosting and collaboration platform. Product changelog covering Actions, Copilot, repos, and more.
REST API endpoints now available to retrieve and update Copilot model policies for enterprises, teams, apps, and organizations, enabling centralized policy management at scale.
GitHub has deprecated certain models across GitHub Copilot experiences including Chat, inline edits, and code completions, effective October 19, 2026. Users may need to migrate to supported models.
GitHub may temporarily require authentication for clones and fetches of public repositories over HTTPS during periods of unusual traffic to protect service availability.
CodeQL is making changes to support macOS 27 and Xcode 27, where Apple no longer includes Intel x86_64 code in certain system binaries and libraries that CodeQL relies on for build tracing.
GitHub Enterprise Cloud now offers general availability of open source license compliance, enabling enterprises to manage dependencies' licenses at scale with ruleset-based checks that enforce centralized policies.
The Xcode 27 runner image is now generally available for GitHub Actions, allowing you to build and test Apple applications using this GitHub-hosted environment that was previously in public preview.
GitHub Copilot now supports working across multiple repositories in a single conversation within Slack and Microsoft Teams, enabling easier tracking of pull requests and investigation workflows across codebases.
Users can now export a CSV report of their GitHub Code Quality license usage to reconcile license counts with internal records, with details for each active committer.
GitHub will deprecate selected Copilot models across all experiences including Chat, inline edits, ask and agent modes, and code completions on November 16th, 2026.
Code scanning AI Scan for pull requests is now generally available, complementing CodeQL by identifying vulnerabilities in pull request changes for languages and frameworks not currently covered by CodeQL.
Agentic autofix for code scanning alerts is now generally available, automatically remediating alerts by exploring relevant files and proposing fixes across your codebase like a developer would.
Email notifications for repository push events have been discontinued as of October 15, 2026 to prevent spam and abuse.
HydraFusion now features an updated model pool and improved orchestration workflows, with a new HydraFusion Max tier available across VS Code, GitHub Copilot app, and GitHub Copilot.
GitHub Actions workflow dependency lockfiles are now available in public preview for GitHub Enterprise Cloud. These lockfiles help ensure workflow reproducibility by pinning action versions.
GitHub has released improvements to GitHub Apps that enable developers to migrate away from classic personal access tokens, enhance app management capabilities, and request fewer sensitive permissions for better security.
Google's Gemini 4 Argon frontier model is now generally available in GitHub Copilot, designed for complex coding, agentic, and reasoning tasks to enhance developer productivity.
Users can now review manual dismissals and reopenings of GitHub Code Quality findings in their organization or enterprise audit log, enabling better tracking and governance of code quality decisions.
Secret scanning has been expanded to detect new secret types from Salesforce, Anthropic, and Cloudsmith, with Anthropic secrets now blocked by default via push protection. This helps prevent accidental exposure of third-party credentials in repositories.
Enterprise administrators can now require GitHub Copilot clients to retrieve current server-managed settings at startup instead of using cached policy, with new minimum client version requirements.
Dependabot now provides improved detection for withdrawn alerts that are no longer valid due to advisory or vulnerability changes. This makes it easier to identify and manage alerts that have been removed.
The Budgets and alerts page in GitHub billing settings now displays all budgets in a single searchable and filterable list, making it easier to manage multiple budgets.
Organization and enterprise administrators can now view metrics showing AI Scan findings generated and resolved in the security overview dashboard, providing visibility into the impact of AI-powered code scanning on pull requests.
Enterprise administrators can now attribute GitHub Copilot activity to specific users through managed telemetry settings without collecting prompts, responses, or tool content. The telemetry.capture.identity setting provides granular control over data capture.
GitHub now records the authenticated user who pushed each commit and displays the pusher identity in the UI and API alongside author and committer information.
Dependabot now supports anonymous authentication for organization-level private registries, enabling access to internal package mirrors and other registries that don't require credentials.
GitHub Copilot for JetBrains now offers more control over default models and MCP server configuration, improved diagnostics handling, and enhanced chat navigation and account controls.
Weekly updates to GitHub Copilot improve cross-account and cross-environment usability while enhancing control over agent access and work management.
CodeQL 2.27.2 adds a C++ regular-expression parser and improves static analysis capabilities across C++, Go, Rust, and JavaScript languages for better code scanning detection.
GitHub Copilot code review now includes new organization-level billing and license controls, allowing organization owners to manage how Copilot code reviews are billed to the organization.
Users with triage role or higher permissions in a repository can now archive and unarchive pull requests, expanding access beyond repository administrators to allow more team members to manage inactive pull requests.
Screen readers can now navigate issue and pull request timelines as a list, with assistive technology announcing list structure, item count, and current position for improved accessibility.
Draft pull requests now count toward repository pull request limits, giving maintainers better control over managing incoming contributions and reducing low-quality submissions.
Claude Haiku 5.5, Anthropic's lightweight model, is now generally available in GitHub Copilot for fast, high-volume tasks like subagents, quick edits, and terminal operations.
GitHub introduced a new purpose-built model for detecting leaked secrets that provides context-aware detection to keep pace with modern software development practices, including AI-assisted coding.
GitHub Copilot's local sandboxing feature is now generally available across GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host, providing developers with a secure environment for testing and development.
GitHub Copilot CLI version 1.0.94-0 adds the /model command to discover and select supported local models without leaving your existing workflow.
A bug causing agent activity and agent lines of code metrics to fall inaccurately while overall Copilot usage grew has been identified and fixed. Users should update their IDE to restore accurate metrics reporting.
Stacked pull requests are now generally available, allowing users to break large changes into smaller, focused pull requests that can be reviewed independently and merged together.
Organization and enterprise administrators can now view AI Scan for pull requests enablement status in the security overview coverage view, showing which repositories have the feature enabled.
GitHub's secret scanning now detects additional secret types from Lovable Labs, Pydantic Services Inc., and Supabase, expanding coverage for partner integrations.
GitHub has completed the rollout of stateless GitHub App installation token format. All newly created GitHub App installation tokens now use the stateless format by default.
GitHub Copilot code review is now available through REST and GraphQL APIs, allowing users to set review effort level per request. Balanced is now the default effort level.
Unvalidated npm trusted publishing configurations now expire after 48 hours and can no longer authorize publishing, reducing the risk from repository or project name changes.
npm staged publishing now allows you to create new packages using local sessions or granular access tokens, including stage-only tokens, streamlining the package creation workflow.
GitHub has deprecated certain language models across all GitHub Copilot experiences including Chat, inline edits, and code completions as of October 2, 2026.
GitHub Copilot introduces new models including Claude Sonnet 5.5, reusable workflows and desktop app automation, Azure canvases, and VS Code improvements to enhance developer productivity.
The SecurityAdvisory object in the GraphQL API now includes five new fields, allowing you to read more of the GitHub Advisory Database directly from GraphQL without needing the REST API.
You can now post confidential comments on repository security advisories that are visible only to people with write access to the repository, enabling secure discussion of vulnerability reports.
The REST API now supports reading, adding, and editing comments on repository security advisories, including those created from private vulnerability reports. This enables programmatic management of advisory discussions.
Rate limits now cap how many new vulnerability reports a single account can submit, helping maintainers avoid being overwhelmed by low-quality and automated reports.
Private vulnerability reports now support structured forms that guide reporters to provide essential assessment details including reproducible proof of concept examples, replacing free-text submission.
GitHub Copilot now has computer use capabilities available in public preview on macOS and Windows, allowing it to interact with and control desktop applications on your behalf.
The macOS 14 runner image for GitHub Actions will be retired on November 2, 2026. Jobs using macOS 14 will temporarily fail during scheduled maintenance periods to raise awareness of the upcoming removal.
September 2026 releases (v1.136-v1.140) streamline agent-driven development with automations for repeatable tasks and improvements to agent merge workflows.
Repositories can now display ACCESSIBILITY.md files from the root, .github/, or docs/ directory on the repository overview page, making accessibility commitments more visible to users and contributors.
Checks, workflow runs, and statuses are now governed by the same GitHub Actions retention setting that controls artifact and log retention, providing unified retention management across all Actions data.
Weekly scheduled scans for code scanning default setup and GitHub Code Quality now activate only after a push or pull request triggers an analysis, rather than running on all repositories regardless of activity.
The GitHub Code Quality upload-code-coverage action now successfully processes coverage uploads on new branches without open pull requests, fixing a previous issue that caused CI failures in this scenario.
Dynamic workflows are now available in Copilot CLI, the GitHub Copilot app, and the GitHub Copilot SDK, enabling you to define orchestrations in code for improved reliability and control.
The redesigned dashboard, previously available as a preview feature, is now the default view for all users to help focus on priority work.
The GitHub async merge API is now generally available, allowing users to merge individual or stacked pull requests, add pull requests to merge queues, or merge pull requests directly.
This release improves reliability, scalability, and observability for runner scale sets, enabling more stable operation of larger runner fleets with fewer disruptions during upgrades and Kubernetes events.
Trusted publishing configurations for npm can now grant permission to manage dist-tags such as promoting versions to latest or updating next and beta pointers using short-lived OIDC credentials instead of permanent tokens.
GitHub Team customers can now start self-serve trials of GitHub Advanced Security to evaluate Code Security and Secret Protection features directly from their organization's Overview or Billing page.
HydraFusion research preview is now available in Visual Studio Code and the GitHub Copilot app, expanding beyond Copilot CLI. Users can access HydraFusion through the model picker.
GitHub Enterprise Cloud with data residency will no longer accept TLS connections from clients that offer only X25519 for key agreement starting October 7, 2026. Customers should ensure their clients support additional key agreement algorithms.
Repository administrators can now configure the runner type, custom labels, and runner groups for Dependabot version and security updates, extending existing runner configuration capabilities.
GitHub now allows you to seamlessly integrate business context about your repositories from external systems of record like configuration management databases, internal developer portals, or in-house systems. This enables you to enrich your repository metadata with organization-specific information.
OpenAI's GPT-6.1 Sol model is now generally available in GitHub Copilot, enabling agentic coding and terminal workflows with improved multistep reasoning capabilities.
GitHub Actions minimum version requirements enforcement for self-hosted runners on GitHub Enterprise Cloud has been rescheduled. The new enforcement begins Monday, September 28, 2026.
Claude Sonnet 5.5, Anthropic's newest Sonnet model, is now generally available in GitHub Copilot. It is optimized for everyday development tasks like building features and fixing bugs.
GitHub Copilot now includes an in-product validator for enterprise managed settings that detects malformed JSON, unsupported configurations, invalid team mappings, and other errors to prevent configuration failures.
The Copilot usage metrics API now provides breakdown of how long pull requests spend in each review stage at the enterprise and organization repository level, with a new pull_request_review_times array for detailed analytics.
Repository issues now support private saved views for personalized filtering, and the "Relates to" issue relationship type is now generally available.
Workflow run queries in the GitHub Actions API and UI now return a less precise but more accurate count of records when searching by workflow, event, status, or branch.
Agentic autofix now integrates with Copilot Memory for enabled customers, using stored context to better resolve security alerts and improve fix quality.
This week's release adds new AI models to Copilot, introduces local sandboxing in the Copilot app, and delivers updates across Slack, Microsoft Teams, JetBrains, and VS Code integrations.
GitHub Copilot integration with Slack and Microsoft Teams has been enhanced with improved context, better user control, and simplified workflows for connecting conversations to GitHub work items and repositories.
CodeQL 2.27.1 introduces new queries for C/C++ and C#, adds support for Kotlin 2.4.20, and improves query accuracy. These enhancements expand static analysis capabilities for GitHub code scanning.
GitHub is introducing a new global default policy for generally available Copilot features and supported client capabilities in enterprise and organization settings, with a 28-day transition period.
GitHub Enterprise Cloud now supports proof of presence, requiring interactive re-authentication or multi-factor challenges before members perform high-impact actions on accounts, expanding existing sudo capabilities.
Expired artifacts are no longer displayed in the GitHub Actions run summary or returned by the REST API. Previously, expired artifacts remained visible with an "Expired" pill indicator.
GitHub Copilot code review now offers additional personal configurations across an expanded set of plans and enterprise-level default settings, enabling teams to customize code review workflows to their needs.
Node 20 has reached end of availability on GitHub Actions runners, which now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available.
Local sandboxing feature now available in the GitHub Copilot app to limit access to files, network resources, and credentials on your machine, reducing the potential impact of unintended commands.
GitHub Copilot app now supports OpenTelemetry configuration through enterprise-managed settings, enabling visibility into how Copilot agents perform and interact with models and tools.
Copilot for JetBrains 1.18.0 adds AI-assisted tool approvals, enhanced control over agent conversations, and organizational shared skills and instructions, improving team collaboration and code generation capabilities.
GitHub Copilot CLI now supports whole codebase indexing for C++, enabling faster code intelligence analysis across large repositories with millions of lines of code and deeply connected source files.
Claude Opus 5.5, Anthropic's latest model, is now available in GitHub Copilot for agentic coding, long-running tasks, and knowledge work applications.
GitHub Copilot now supports two new OpenAI GPT-6 models: Sol and Luna, expanding the model selection options available to users alongside the previously released Astra model.
GitHub is removing legacy SSH algorithms, adding a new algorithm, and requiring larger RSA SSH keys to strengthen SSH security and reduce vulnerability to attacks.
The all-platform CodeQL bundle (codeql-bundle.tar.gz and codeql-bundle.tar.zst) is deprecated starting with CodeQL CLI 2.27.0. Users should migrate to platform-specific bundles.
GitHub's redesigned pull requests page is now generally available to all users, making it easier to find and act on pull requests.
Enterprise owners can now export a complete inventory of all credentials that can access their enterprise, including SSH keys, personal access tokens, and OAuth App access tokens.
xAI's Grok 4.7 reasoning model is now rolling out in GitHub Copilot, with improvements over Grok 4.6 designed for agentic coding and complex multistep workflows.
Copilot code review now provides a clearer timeline of review changes, intelligently auto-resolves its own suggestions, and automatically generates useful commit messages when accepting changes.
The REST API now supports managing the Restrict code coverage repository ruleset option, providing programmatic control over code coverage enforcement in addition to UI support.
GitHub Copilot adds new model selection options, code review updates, and Sentry integration in the Copilot app, plus updates for admins and new agent features.
Selected GitHub Copilot models will be deprecated across all Copilot experiences including Chat, inline edits, and code completions on October 19th, 2026. Users should plan to migrate to newer models before the deprecation date.
GitHub now supports creating npm granular access tokens with Read and write (stage only) permissions, allowing automated workflows to stage package versions for review without requiring full publish access.
97 more changes from GitHub. Sign up to read the whole changelog.
Sign up freeGitHub or email — no card needed.