Which of my OAuth apps are still handing out long-lived tokens instead of short-lived ones?

checks whether an app has opted into the short-lived token setting or been switched to always issue them, and flags older SDKs still relying on long-lived flows by their incompatibility with the forced refresh flow

Have I actually cut off a compromised credential everywhere it was used?

runs a bulk revocation by credential type across the enterprise or a single user, and confirms completion through an audit log entry and an email notification to the affected user

Can my organization admins respond to a credential leak without escalating to enterprise owners?

gives organization-level REST API and UI access to the same bulk deauthorization and revocation actions previously restricted to the enterprise level

Which MCP servers and plugins are my developers actually allowed to connect to?

enforces an allowed/denied MCP server list and a restricted marketplace setting centrally, so any unlisted server or plugin source is blocked in the IDE regardless of developer preference

Is my code quality trending in the wrong direction before it becomes a bigger problem?

plots open findings over a chosen date range grouped by health score or severity on the organization dashboard, showing direction of change rather than a single point-in-time count

GitHub release history — The Cyber Toolchain

BYOK and enterprise custom models in the Copilot usage API (2026-11-04) Nov 4, 2026 · issue 130

GitHub's Copilot usage metrics API now exposes bring-your-own-key and enterprise custom model usage in separate, queryable fields⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pull a 1-day enterprise usage report and check which users made at least one local BYOK request — useful for auditing BYOK policy compliance.

$ curl -H 'Authorization: Bearer <token>' \
  'https://api.github.com/enterprises/<enterprise>/copilot/usage?days=1' \
  | jq '[.[] | select(.used_local_byok == true) | {login, used_local_byok, totals_by_local_byok}]'

Separate enterprise custom model token usage from Copilot-hosted model usage across all clients to understand true provider spend.

$ curl -H 'Authorization: Bearer <token>' \
  'https://api.github.com/enterprises/<enterprise>/copilot/usage?days=28' \
  | jq '[.[] | .totals_by_client[] | .totals_by_model[] | select(.is_custom_enterprise_model == true)]'

Track per-user local BYOK activity with the new used_local_byok field in user-level Copilot usage reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Break down local BYOK session, request, prompt, and token counts by byok_kind (local_managed, local_user, local_auto, or remote_user) and surface (copilot_cli or copilot_app) using the new totals_by_local_byok field.
Count distinct users running local BYOK models per day, calendar week, and calendar month with the new daily_active_local_byok_users, weekly_active_local_byok_users, and monthly_active_local_byok_users aggregate fields.
Identify enterprise custom model requests across all clients — including IDEs — with the new boolean is_custom_enterprise_model field on each totals_by_client[].totals_by_model[] entry.
GitHub's Copilot usage metrics API now surfaces all four new BYOK and custom-model fields in both enterprise and organization reports, at user and aggregate level, in 1-day and 28-day reports.

Track per-user local BYOK activity with the new used_local_byok field in user-level Copilot usage reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Break down local BYOK session, request, prompt, and token counts by byok_kind (local_managed, local_user, local_auto, or remote_user) and surface (copilot_cli or copilot_app) using the new totals_by_local_byok field.
Count distinct users running local BYOK models per day, calendar week, and calendar month with the new daily_active_local_byok_users, weekly_active_local_byok_users, and monthly_active_local_byok_users aggregate fields.
Identify enterprise custom model requests across all clients — including IDEs — with the new boolean is_custom_enterprise_model field on each totals_by_client[].totals_by_model[] entry.

1 more in Everything

Dependabot version updates support Agent Package Manager (2026-11-03) Nov 3, 2026 · issue 130

GitHub Dependabot adds Agent Package Manager (APM) support to keep AI agent skills, prompts, and instructions up to date⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Keep AI agent skills and prompts current by having Dependabot open PRs for outdated APM git dependencies on a weekly schedule.

.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: "apm"
    directory: "/"
    schedule:
      interval: "weekly"

Add an apm entry to .github/dependabot.yml, specifying the directory containing apm.yml and an update schedule, to have Dependabot open pull requests updating git dependencies declared in apm.yml and regenerating apm.lock.yaml when present.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Dependabot now supports version updates for Agent Package Manager (APM) dependencies — covering AI agent skills, prompts, and instructions — available on github.com for all GitHub plans and in GitHub Enterprise Server 3.24.

2 details in Everything

Look up a resource’s cost center with the GitHub REST API (2026-11-03) Nov 3, 2026 · issue 130

GitHub adds a REST API endpoint to look up which cost center a user, organization, repository, or enterprise team belongs to⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

GitHub Copilot is now available in JetBrains Air (2026-11-03) Nov 3, 2026 · issue 130

GitHub Copilot now works inside JetBrains Air via ACP, supporting parallel agent sessions, in-context review, and cloud tasks billed to your Copilot plan.

New integrationConnect GitHub Copilot to JetBrains Air via the Agent Client Protocol (ACP) to delegate coding tasks, track parallel agent sessions, and review changes in-context inside your JetBrains IDE.
New supported platformRun Copilot cloud tasks in isolated Docker containers on fresh virtual machines through Air Teams, billed to your existing Copilot plan rather than JetBrains AI credits.
Link your GitHub account for cloud tasks from the browser by navigating to Settings > VCS Providers in JetBrains Air, then selecting a repository, remote branch, and GitHub Copilot as the agent.

3 details in Everything

CodeQL 2.27.3 adds Python 3.15 features and JSON data extensions (2026-11-03) Nov 3, 2026 · issue 130

CodeQL 2.27.3 adds JSON syntax for data extension files and an opt-in AI threat model for LLM-generated data sources, with C# NuGet proxy/cert passthrough and a changed GitHub Actions CFG library.

Data extension files now accept JSON syntax (.json extension) using the same structure as YAML, including Java-style // and /* ... */ comments.
Updated detectionEnable an opt-in ai threat model for LLM-generated data sources, letting you define your own sources via data extensions without any built-in source models.
When private registries are configured, CodeQL now passes proxy and certificate environment variables to the NuGet CLI for C# projects.

3 details in Everything

New supported platform Python 3.15 syntax support
New supported platform C23 bit-precise integer support
Updated detection BlazingMQ flow summaries for C/C++
Updated detection Grape::API remote flow sources for Ruby
Updated detection Java SSRF and URL-redirection queries recognize case-insensitive URI host comparisons

└──▷ BREAKING ON UPGRADE

!The GitHub Actions control flow graph (CFG) now uses the shared CFG library; custom queries that rely on specific CFG nodes, edges, or basic block boundaries may need updates.
!The legacy Completion classes have been removed from the GitHub Actions CFG; use CFG edge labels DirectSuccessor, BooleanSuccessor, and ReturnSuccessor instead.

Dependabot now supports Python 3.15 (2026-11-03) Nov 3, 2026 · issue 130

New supported platform Python 3.15 support for Dependabot

GitHub Desktop adds short-lived authentication tokens (2026-11-03) Nov 3, 2026 · issue 130

GitHub Desktop adds short-lived, automatically refreshing authentication tokens to reduce leaked-token exposure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Token renewal happens automatically for GitHub API requests and Git operations, so no manual re-authentication is needed during normal use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Short-lived tokens are available on github.com and GitHub Enterprise Cloud via a gradual rollout; GitHub Enterprise Server is not included in this rollout.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Existing sessions remain signed in after upgrading to 3.6.10, but existing tokens are not automatically migrated to short-lived tokens — new short-lived tokens are only issued at the next sign-in once the rollout reaches your installation.

Security risk assessments include repository protection status (2026-11-02) Nov 2, 2026 · issue 129

GitHub's security risk assessments now show whether findings come from protected or unprotected repositories⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Identify unprotected repositories with active findings so you can prioritize where to extend branch protection or code security policies.

📍In your organization, go to Security › Assessments, then open the code security risk assessment or secret risk assessment — each finding now shows a protected or unprotected status for its repository.

Access updated code security and secret risk assessments that now show whether each finding is in a protected or unprotected repository, helping identify where to extend coverage — available to organization admins and security managers under the organization's Security tab > Assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

pull_request_target blocked by default December 2 (2026-11-02) Nov 2, 2026 · issue 129

GitHub Actions now blocks pull_request_target events by default in public repositories starting December 2, 2026⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

GitHub Actions now blocks pull_request_target events by default in all public repositories via a new workflow execution protection rule, preventing fork-sourced untrusted code from accessing base-repository secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Use workflow file targeting inside an Actions event policy to explicitly allow pull_request_target for specific workflows rather than the entire repository.
Review which workflow runs the default rule would block before enforcement by checking the Insights view while the rule runs in evaluate mode.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Starting December 2, 2026, pull_request_target workflow runs in public repositories will be blocked by default and will fail unless an Actions event policy explicitly allows them. Brownout enforcement windows on November 9 (16:00–18:00 UTC) and November 16 (16:00–18:00 UTC) will surface affected workflows early.

Webhook IP ranges added to the Meta API (2026-10-29) Oct 29, 2026 · issue 125

GitHub's Meta API now includes three new CIDR ranges in the hooks field for webhook delivery allowlists⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pull the current webhook IP ranges from the Meta API to update a static network allowlist before the new CIDRs go live.

$ curl -s https://api.github.com/meta | jq '.hooks'

└──▷ BREAKING ON UPGRADE

!Static network allowlists for incoming webhook deliveries will reject traffic from 9.234.98.160/28, 9.234.98.176/28, and 9.234.106.48/28 unless those CIDR prefixes are added manually.

Route and orchestrate models with GitHub Copilot Fusion (2026-10-28) Oct 28, 2026 · issue 124

GitHub Copilot adds Fusion, a multi-model routing and orchestration system with three effort levels available across VS Code, JetBrains, CLI, and the Copilot app⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

When you want Copilot to handle model selection automatically for a demanding refactor or architecture task without manually switching models.

📍Open the model picker in Visual Studio Code or JetBrains, select Copilot Fusion, then choose Fusion Max as the effort level to apply the most capable models to complex reasoning tasks.

Select Copilot Fusion in the model picker to let Copilot automatically route and orchestrate which models handle each prompt, choosing from Single (one model), Cascade (draft-then-escalate), or Critique (draft-review-revise) workflows without manual model switching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Choose an effort level — Fusion Standard, Fusion High, or Fusion Max — to control whether Copilot Fusion prioritizes versatile, capable, or the most capable models for a given task.
Enterprise administrators can independently set each model's effective policy state for Copilot Fusion, disabling a model for Fusion without disabling it for all users, via enterprise and organization model policies.
Enterprise administrators can set Copilot Fusion, at any effort level, as the default model for all Copilot users via Enterprise managed settings.
Users on paid Copilot plans receive a 30% discount on model costs when using Copilot Fusion for a limited time.

+1 more show less

Copilot Fusion is available in Visual Studio Code, the GitHub Copilot app, GitHub Copilot CLI, and JetBrains IDEs on all Copilot plans.

6 details in Everything

GitHub Copilot app, Universe releases (2026-10-28) Oct 28, 2026 · issue 124

GitHub Copilot app adds Projects (multi-repo orchestration), computer use for desktop apps, and image generation in chat⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

▶ Watch video

└──▷ HOW TO FIND IT

Enable Copilot to control desktop apps (such as expense-report workflows) on a managed macOS machine without requiring an API or MCP integration.

📍In the GitHub Copilot app, go to Settings › Computer Use and turn on Enable Computer Use. When prompted by macOS, grant Accessibility and Screen Recording permissions.

Enable computer use for desktop app automation by going to Settings > Computer Use and turning on Enable Computer Use; grant Accessibility and Screen Recording permissions on macOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
GitHub Copilot app now supports Projects, a workspace that spans multiple repositories and sessions, coordinating multiple agents in parallel and returning results such as pull requests for review — now in public preview.
GitHub Copilot Projects now support automations for repeatable tasks, such as triggering a workflow whenever a specific event occurs.
GitHub Copilot chat now supports image generation and editing using natural language.
GitHub Copilot app now supports computer use (public preview on macOS and Windows), letting Copilot read content, click controls, enter text, and navigate across desktop apps — including those with no API, CLI, or MCP integration.

5 details in Everything

GitHub Enterprise now includes access to GitHub Copilot (2026-10-28) Oct 28, 2026 · issue 124

GitHub Enterprise now includes Copilot access for every licensed user, billed against an enterprise budget instead of per-seat AI usage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

GitHub Enterprise now includes Copilot access for every licensed user, replacing separate seat and usage tracking with a single enterprise budget model where AI usage is metered from the first request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Code completion and next edit suggestions remain available even when the enterprise budget is exhausted, while Copilot Chat, Copilot code review, and Copilot in the cloud require available budget.
Users in an enterprise account without a GitHub Enterprise license get Copilot access through Copilot Standalone at $10 per user per month, with the same features and models as Copilot Enterprise but no monthly AI credits per seat.

3 details in Everything

Security extension for the GitHub Copilot app (2026-10-28) Oct 28, 2026 · issue 124

GitHub adds a security extension for the Copilot app that surfaces code scanning alerts and lets you explain, fix, or dismiss them without leaving the app⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Install the GitHub security extension from the terminal so you can immediately browse code scanning alerts in the Copilot app.

$ copilot plugin install github-security@awesome-copilot

Scan your uncommitted changes for new issues before opening a pull request, without waiting for CI to run code scanning.

$ /security-review

Install the security extension with copilot plugin install github-security@awesome-copilot in the terminal, or search for github-security in the Copilot app's Customize panel and click Install.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Run /security-review on your current local changes to catch new issues before opening a pull request, with the extension flagging when code has changed since the last review.
Ask Copilot about alerts in chat using the security extension's tools, governed by your existing tool permission settings.
The security extension is available in public preview on github.com and GitHub Enterprise Cloud with data residency; GitHub Enterprise Server is not supported.

4 details in Everything

GitHub intelligence puts your code, context, and history to work (2026-10-28) Oct 28, 2026 · issue 124

GitHub adds Copilot Memory, Copilot Dreaming, and cross-repository code search to carry context across agent sessions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Trace retry behavior scattered across a payments service, shared library, and background workers before making changes.

$ /research How do these components retry failed charges, and where could retries overlap?

Plan a cross-repository API migration by finding all callers and implementations of the old API before writing any code.

$ /research Identify all repositories still calling the old payment API and list the changes each service needs to migrate.

Enable Copilot Dreaming for your organization so agents continuously refine repository memories and propose instruction updates via pull requests.

📍In GitHub, go to Organization Settings › Copilot › Policies, then enable Dreaming to allow agents to update memories and propose skill and custom instruction file changes in pull requests.

Use /research in Copilot to search for exact text, symbols, regex patterns, or natural-language descriptions across multiple repositories without a local clone, narrowing results by repository, path, or language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
GitHub Copilot Memory is now generally available on paid Copilot plans, letting Copilot remember personal preferences and repository conventions across sessions in the Copilot app, Copilot CLI, VS Code, Copilot cloud agent, Copilot code review, Slack, Teams, and GitHub Mobile.
Copilot Dreaming is now in public preview — opt in through Copilot settings (individuals) or Copilot policies (organizations and enterprises) — letting Copilot reflect on past sessions to update personal memories, propose changes to repository skills and custom instruction files via pull requests, and turn recurring accepted code-review feedback into standing guidance.
Dreaming runs three dream types: personal memory curation, repository customization (which proposes skill and instruction updates in pull requests), and code review customization that converts recurring accepted feedback into Copilot code review guidance.

4 details in Everything

Build shared workflows for your team with Copilot Automations (2026-10-28) Oct 28, 2026 · issue 124

GitHub adds shared Copilot Automations so teams can collaboratively build, own, and maintain AI-powered workflows billed to the repository owner⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Let an org admin gate shared automations to prevent unintended AI credit usage against the organization budget.

📍In your organization settings, go to Copilot › Policies and enable 'Allow use of Copilot cloud agent billed to the organization'.

Create a team-owned automation — for example, to automatically investigate production incidents — so it survives individual team members leaving.

📍On github.com, open a repository where you have write access, navigate to Copilot Automations › New automation, set triggers and tools, then under Type select Shared before saving.

Create shared Copilot Automations by choosing Shared under Type when creating an automation on github.com, the GitHub Copilot app, or Visual Studio Code — making the workflow visible to all readers and editable by anyone with write access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Shared automations are billed to the organization or user that owns the repository rather than to the creator, and actions are attributed to Copilot rather than an individual user.
Shared automations belong to the repository and persist if the creator leaves the team, with a change history showing how tools, triggers, and prompts have evolved.
Organization administrators must enable the 'Allow use of Copilot cloud agent billed to the organization' policy for shared automations to run in organization-owned repositories.
Shared Copilot Automations are available on Copilot Pro, Pro+, Max, Business, and Enterprise plans.

5 details in Everything

Repository plugin defaults and enterprise plugin controls generally available (2026-10-28) Oct 28, 2026 · issue 125

GitHub Copilot adds repository plugin defaults and enterprise-managed plugin controls across VS Code, Copilot CLI, and the GitHub Copilot app⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Repository maintainers can now define default plugins and a plugin marketplace so contributors get consistent Copilot plugin setup without repeating configuration per project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Contributors can turn off repository-default plugins where enterprise policy permits.
Enterprise administrators can now require plugins (auto-installed and user-locked), block plugins, and restrict installation to approved marketplaces through managed settings that override repository and personal choices.
Managed plugin controls are available on GitHub Enterprise Cloud for Copilot Business and Copilot Enterprise license holders; repository defaults are available to individual Copilot users as well.

4 details in Everything

GitHub Copilot in VS Code, Universe releases (2026-10-28) Oct 28, 2026 · issue 124

GitHub Copilot in VS Code adds cloud agent sessions, Agent Host, computer use, model comparison, connectors, and an open Agent Host Protocol for custom clients⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Start a remote agent host so you can control a long-running coding task from your phone or another device while your development machine keeps working.

$ code agent host --github-environment

Let Copilot interact with desktop apps — filling forms, clicking UI controls — by enabling computer use in VS Code settings and activating it in the current session.

$ # 1. In VS Code Settings, enable chat.agentHost.computerUse.enabled and restart VS Code
# 2. In a Copilot session panel, run:
/computer on

Introduces the new Agent Host, which isolates Copilot sessions from individual VS Code windows: it powers session continuity across VS Code, the GitHub Copilot app, GitHub Mobile, github.com, Copilot CLI, Slack, and Microsoft Teams DMs; lets you control an agent running on your development machine from GitHub Mobile by starting it with code agent host --github-environment from your project folder; keeps sessions alive after closing a VS Code window or project folder; extends agent sessions to remote machines using VS Code's Remote SSH and dev tunnels from the Agents window so the agent keeps running when you disconnect; and exposes an open Agent Host Protocol (AHP) for building custom clients that share live sessions with VS Code, with client libraries for TypeScript, Rust, Go, Kotlin, and Swift via code agent host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enable computer use so Copilot can interact with desktop apps (clicking controls, editing text) by enabling chat.agentHost.computerUse.enabled in VS Code Settings, restarting VS Code, then running /computer on in a Copilot session.
Run models and harnesses in parallel in the Agents window, review results side by side, ask a Judge model to recommend a solution, or choose Synthesize to combine ideas — model comparison is in preview.
Bring context from services such as Slack, Notion, and Microsoft Learn into agent sessions without an MCP server using Copilot connectors, available in preview from the Browse page on all Copilot plans.
Discover, create, and manage agent customizations — skills, MCP servers, plugins — from the Customizations Marketplace in the Agents window sidebar or via the Chat: Open Customizations command (enabled by default in preview), and register plugin marketplaces and enable default plugins at the repository level via .github/copilot/settings.json.

+2 more show less

Install GitHub Copilot CLI through the VS Code installer on Windows, when adding VS Code to your path on macOS, or by running copilot on Linux.
Switch between the editor and the Agents window without losing context — both views stay in sync with the same live Copilot session.

Introduces the new Agent Host, which isolates Copilot sessions from individual VS Code windows: it powers session continuity across VS Code, the GitHub Copilot app, GitHub Mobile, github.com, Copilot CLI, Slack, and Microsoft Teams DMs; lets you control an agent running on your development machine from GitHub Mobile by starting it with code agent host --github-environment from your project folder; keeps sessions alive after closing a VS Code window or project folder; extends agent sessions to remote machines using VS Code's Remote SSH and dev tunnels from the Agents window so the agent keeps running when you disconnect; and exposes an open Agent Host Protocol (AHP) for building custom clients that share live sessions with VS Code, with client libraries for TypeScript, Rust, Go, Kotlin, and Swift via code agent host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enable computer use so Copilot can interact with desktop apps (clicking controls, editing text) by enabling chat.agentHost.computerUse.enabled in VS Code Settings, restarting VS Code, then running /computer on in a Copilot session.
Run models and harnesses in parallel in the Agents window, review results side by side, ask a Judge model to recommend a solution, or choose Synthesize to combine ideas — model comparison is in preview.
Bring context from services such as Slack, Notion, and Microsoft Learn into agent sessions without an MCP server using Copilot connectors, available in preview from the Browse page on all Copilot plans.
Discover, create, and manage agent customizations — skills, MCP servers, plugins — from the Customizations Marketplace in the Agents window sidebar or via the Chat: Open Customizations command (enabled by default in preview), and register plugin marketplaces and enable default plugins at the repository level via .github/copilot/settings.json.

2 more in Everything

Generate and edit images directly in Copilot (2026-10-28) Oct 28, 2026 · issue 124

GitHub Copilot adds image generation and editing from natural language in chat, powered by GPT Image 2.5 Flare⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Disable image generation for your organization to prevent AI-generated images from being produced by Copilot users.

📍In GitHub: go to Organization Settings › Copilot › Policies › Model policies, then disable the image generation model.

Generate and edit images using natural language in any Copilot chat session in VS Code, the GitHub Copilot app, or Copilot CLI; results preview inline and save directly to your workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Organization and enterprise owners can turn off image generation by disabling the image generation model using Copilot model policies.
Opt in to a visible Made with AI watermark on Copilot-generated and edited images; watermarking is off by default.

3 details in Everything

GitHub Copilot Fusion now supports selection of local models (2026-10-28) Oct 28, 2026 · issue 124

GitHub Copilot Fusion adds intelligent routing between on-device and cloud models in CLI, the Copilot app, and VS Code⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enable local model routing in VS Code so Copilot Fusion can automatically pick between your on-device model and cloud models without manual switching.

yaml

chat.copilot.localModel.enabled: true

Enable local model routing in VS Code by setting chat.copilot.localModel.enabled, then select Standard in Copilot Fusion to let Copilot choose between local and cloud models automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Configure MAI Code 1.1 Flash or Qwen3.8 Flash Next through a local OpenAI-compatible server on Windows, macOS, or Linux for bring-your-own local model routing in Copilot CLI.
Download and configure MAI Code 1.1 Flash through the Windows ML provider on supported Windows devices via Settings > Model providers, then enable Local model auto routing under Settings > Experiments in the Copilot app.
Enable experimental mode and open /model in Copilot CLI to follow the managed setup prompts for local model download and configuration on Windows.
GitHub Copilot Fusion now routes requests between eligible on-device and cloud models in Copilot CLI, the Copilot app, and VS Code without requiring manual model switching per request.

5 details in Everything

GitHub Agentic Workflows generally available (2026-10-28) Oct 28, 2026 · issue 124

GitHub adds Agentic Workflows as a generally available Actions extension for automating issue triage, CI analysis, and code changes via natural language definitions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Check projected AI credit spend, including threat detection costs, before committing to a new agentic workflow rollout.

$ gh aw forecast

Bootstrap a new agentic workflow from a prebuilt template — such as triage or dependency management — without writing Actions YAML by hand.

$ gh aw add-wizard

Run agentic workflows on self-hosted Actions Runner Controller runners with Docker-in-Docker support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Get a fuller AI credit spend picture using gh aw forecast, which now includes threat detection credits and monthly ranges and is no longer experimental.
Add new workflow templates to a repository using gh aw add-wizard.
GitHub adds Agentic Workflows, letting you define automation in natural language Markdown files that compile to standard Actions YAML and run inside GitHub Actions with existing runner groups and policies.
Route model selection automatically per workflow using a model router that optimizes for task type and difficulty.

+2 more show less

Pick model providers per workflow from a refreshed model inventory.
Agents run with read-only permissions by default, execute inside a sandboxed container behind the Agent Workflow Firewall, and have all proposed changes scanned by a dedicated threat detection job before they are applied.

Run agentic workflows on self-hosted Actions Runner Controller runners with Docker-in-Docker support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Add new workflow templates to a repository using gh aw add-wizard.
GitHub adds Agentic Workflows, letting you define automation in natural language Markdown files that compile to standard Actions YAML and run inside GitHub Actions with existing runner groups and policies.
Route model selection automatically per workflow using a model router that optimizes for task type and difficulty.
Agents run with read-only permissions by default, execute inside a sandboxed container behind the Agent Workflow Firewall, and have all proposed changes scanned by a dedicated threat detection job before they are applied.

2 more in Everything

GitHub Copilot supports server-to-server authentication (2026-10-27) Oct 27, 2026 · issue 123

GitHub Copilot SDK gains server-to-server auth for GitHub Apps, letting agents call Copilot under an org identity without a signed-in user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds server-to-server authentication (public preview) for GitHub Apps installed on organizations, enabling agents and automated services to call the Copilot SDK using a short-lived installation access token instead of a user's credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces a read-only Copilot Requests organization permission for GitHub Apps, scoping what an app can do when authenticating as a workload identity against the Copilot SDK.
Attributes app-driven Copilot usage to the installing organization — including model policies, budgets, and spending controls — with app traffic identifiable in AI usage CSV reports via the app_client_id field.

Adds server-to-server authentication (public preview) for GitHub Apps installed on organizations, enabling agents and automated services to call the Copilot SDK using a short-lived installation access token instead of a user's credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces a read-only Copilot Requests organization permission for GitHub Apps, scoping what an app can do when authenticating as a workload identity against the Copilot SDK.

1 more in Everything

GitHub Copilot assisted permissions generally available (2026-10-26) Oct 26, 2026 · issue 122

GitHub Copilot assisted permissions reach GA, letting an LLM auto-approve safe commands across CLI, app, and VS Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Switch to assisted permissions in the Copilot CLI so safe commands run without interrupting your workflow.

$ /permissions
# Then select: assisted

Enable assisted permissions in VS Code's Copilot permissions picker to reduce approval prompts during agentic tasks.

📍Open the permissions picker in VS Code › Select Assisted permissions

Enables Assisted permission mode in GitHub Copilot CLI via /permissions command — select assisted to let an LLM auto-approve clearly safe commands, file-system access, and URL opens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Assisted permissions mode in the GitHub Copilot app via Tool permissions in the mode picker.
Adds Assisted permissions mode in Visual Studio Code via the permissions picker.
Provides enterprise-managed settings to block Allow All while keeping Assisted available, disable Assisted separately, and set the default permission mode for new sessions.

4 details in Everything

GPT-6.1 Terra in GitHub Copilot (2026-10-26) Oct 26, 2026 · issue 122

GPT-6.1 Terra is now generally available in GitHub Copilot for agentic coding and terminal work across all major IDEs and platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Restrict GPT-6.1 Terra from being used org-wide until your team has evaluated it — useful for Enterprise admins who want controlled rollout.

📍In GitHub Copilot settings, go to Policies › Model policy, find GPT-6.1 Terra, and set it to Disabled to prevent automatic enablement for your organization.

Adds GPT-6.1 Terra model selection in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Copilot Enterprise and Business administrators can manage access to GPT-6.1 Terra via the model policy in Copilot settings, with new models auto-enabled by default unless the global default is turned off or the model is explicitly disabled.

2 details in Everything

Usage metrics API adds usage from tools like OpenCode (2026-10-23) Oct 23, 2026 · issue 119

Copilot usage metrics API gains totals_by_client array, breaking down model requests, sessions, and tokens by tool (OpenCode, Zed, VS Code, etc.)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Compare model request and token volume across all Copilot-connected tools in your org to inform tool support and governance decisions.

$ curl -H 'Authorization: Bearer <token>' -H 'Accept: application/vnd.github+json' 'https://api.github.com/orgs/<org>/copilot/metrics?report=1-day' | jq '.totals_by_client[] | {client: .client, requests: .request_count, sessions: .session_count}'

Break down per-tool usage by model and selection mode across the 28-day enterprise report to see whether developers are using auto-selected or user-chosen models in each tool.

$ curl -H 'Authorization: Bearer <token>' -H 'Accept: application/vnd.github+json' 'https://api.github.com/enterprises/<enterprise>/copilot/metrics?report=28-day' | jq '.day_totals[] | {date: .date, by_client: [.totals_by_client[] | {client: .client, models: [.totals_by_model[] | {model: .model, mode: .model_selection_mode, requests: .request_count}]}]}'

Adds totals_by_client array to the Copilot usage metrics API for enterprise, organization, enterprise-user, and organization-user 1-day and 28-day reports, exposing per-tool model traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Each totals_by_client entry includes client (tool identifier such as opencode, claude_code, codex, zed, copilot_cli, github_app, cloud_agent, code_review, vscode, or jetbrains; unrecognized clients grouped as other), request_count, session_count, and token_usage (prompt tokens, output tokens, and average tokens per request).
Each totals_by_client entry also includes totals_by_model, which breaks down request and token metrics by model and adds a model_selection_mode field with values user_selected, auto, product_selected, other, or unknown.
In 28-day aggregated reports, totals_by_client appears inside each day_totals entry, enabling day-level per-client breakdowns.

4 details in Everything

Turn notifications into code with GitHub Copilot in Teams (2026-10-23) Oct 23, 2026 · issue 119

GitHub's new Teams app merges notifications and Copilot so you can @mention GitHub to investigate issues and open PRs without leaving Teams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

▶ Watch video

└──▷ HOW TO FIND IT

Turn a bug-report notification into a pull request without leaving a Teams channel.

📍In the Teams channel where the bug notification appeared, type: @github fix the issue in <repo> and create a pull request, then follow the prompts to connect your GitHub account and select a repository.

Adds @github mention support in Microsoft Teams channels, group chats, and private chats to trigger Copilot actions — such as investigating an issue, fixing a bug, and opening a pull request — directly from a notification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Consolidates the former GitHub notifications Teams app and Copilot capabilities into a single unified GitHub app for Microsoft Teams.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The legacy GitHub app in Microsoft Teams will be renamed GitHub (deprecated) and retired on November 16; users must install the consolidated GitHub app to retain Copilot in Teams functionality.

Public monitoring adds triage, validity, API, and webhooks (2026-10-23) Oct 23, 2026 · issue 119

GitHub Public Monitoring gains alert triage, validity checks, a REST API endpoint, and enterprise webhooks for leaked-secret response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pull all open public monitoring alerts attributed to your enterprise into an incident response script or SIEM.

$ curl -H "Authorization: Bearer <token>" -H "Accept: application/vnd.github+json" "https://api.github.com/enterprises/<enterprise>/secret-scanning/public-monitoring-alerts?state=open"

Subscribe your enterprise to real-time leak notifications so your pipeline is triggered the moment a new secret is attributed to your org.

📍In the enterprise security dashboard, go to Settings › Webhooks › Add webhook, set the payload URL to your endpoint, and select the secret_scanning_public_monitoring_alert event.

Adds GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts REST API endpoint for enterprise admins and security managers to query attributed public monitoring findings programmatically, returning alert metadata, secret type, attribution, and exposed locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds secret_scanning_public_monitoring_alert enterprise webhook event to receive real-time notifications whenever a newly detected leak is attributed to your organization.
Adds always-on validity checks for supported secret types that continuously display whether a credential is Active, Inactive, or Unknown, enabling teams to prioritize response for live tokens.
Adds alert management for public monitoring: dismiss alerts as Dismissed or Fixed with an optional comment, reopen closed alerts, and review a full activity timeline of state changes.
Adds filtering and sorting on the enterprise security dashboard by repository, committer, secret type, attribution method (membership or verified domain), and state (open or closed).

5 details in Everything

Enterprise installations for GitHub Apps generally available (2026-10-23) Oct 23, 2026 · issue 119

GitHub Apps can now be installed at the enterprise level GA, replacing classic PATs for governance, security, and admin automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Grant a GitHub App the permissions needed to manage enterprise rulesets and IP allowlists, replacing classic PAT-based automation.

📍Settings › Developer settings › GitHub Apps › <your app> › Permissions & events Enterprise repository rulesets: Write Enterprise IP allowlist: Read and write Enterprise organization and repository policies: Read and write

Adds a set of new Enterprise/Organization GitHub App permissions: Enterprise organization and repository policies permission (read/write) exposing EnterpriseOwnerInfo policy fields and REST APIs to update private repository forking, default repository permissions, repository visibility changes, repository creation, repository deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, dependency insights setting, organization projects setting, and repository projects; Enterprise bypass requests permission (read) to read push-rule and repository-policy bypass requests via GitHub Apps; Enterprise settings permission (read/write) to read enterprise data through EnterpriseOwnerInfo (including server installations and organization invitations) and update the enterprise profile; Enterprise two-factor authentication permission (read/write) to read two-factor fields on EnterpriseOwnerInfo and update two-factor requirements and disallowed authentication methods; Enterprise verifiable domains and Organization verifiable domains permissions (write) to access VerifiableDomain objects for enterprises or organizations; Enterprise IP allowlist and Organization IP allowlist permissions (read/write) to access IpAllowListEntry and associated mutations to create, update, and delete entries, and toggle allowlist enforcement, trust of GitHub Apps, and user-level enforcement for Enterprise Managed Users; Enterprise access restrictions permission (write) to enable or disable enterprise access restrictions; and Enterprise repository rulesets permission (write) to manage rulesets through enterprise rules REST APIs and RepositoryRuleset in GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Expands Enterprise people permission (read/write) to read EnterpriseRepositoryInfo including repository details through EnterpriseOwnerInfo.outsideCollaborators and add the app to an organization with the owner or member role, and expands Enterprise billing permission (write) to update the member purchasing setting for the Marketplace.
Enterprise-level GitHub App installations arrive in GHES 3.24.

Adds a set of new Enterprise/Organization GitHub App permissions: Enterprise organization and repository policies permission (read/write) exposing EnterpriseOwnerInfo policy fields and REST APIs to update private repository forking, default repository permissions, repository visibility changes, repository creation, repository deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, dependency insights setting, organization projects setting, and repository projects; Enterprise bypass requests permission (read) to read push-rule and repository-policy bypass requests via GitHub Apps; Enterprise settings permission (read/write) to read enterprise data through EnterpriseOwnerInfo (including server installations and organization invitations) and update the enterprise profile; Enterprise two-factor authentication permission (read/write) to read two-factor fields on EnterpriseOwnerInfo and update two-factor requirements and disallowed authentication methods; Enterprise verifiable domains and Organization verifiable domains permissions (write) to access VerifiableDomain objects for enterprises or organizations; Enterprise IP allowlist and Organization IP allowlist permissions (read/write) to access IpAllowListEntry and associated mutations to create, update, and delete entries, and toggle allowlist enforcement, trust of GitHub Apps, and user-level enforcement for Enterprise Managed Users; Enterprise access restrictions permission (write) to enable or disable enterprise access restrictions; and Enterprise repository rulesets permission (write) to manage rulesets through enterprise rules REST APIs and RepositoryRuleset in GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enterprise-level GitHub App installations arrive in GHES 3.24.

1 more in Everything

GitHub Copilot in Visual Studio — September update (2026-10-23) Oct 23, 2026 · issue 117

GitHub Copilot in Visual Studio gains PR exploration via Git agent, Bring Your Own Model preview, and one-click NuGet vulnerability fixing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Surface a summary of an open pull request — with links to its comments and files — without leaving Visual Studio.

📍1. Open GitHub Copilot Chat. 2. Select the Git agent. 3. In the Git Repository window, right-click the pull request and choose Attach as context. 4. Ask: 'Summarize this pull request and list the files changed.'

Trigger an AI-assisted fix for a vulnerable NuGet package the moment Visual Studio flags it in the Error List.

📍1. In the Error List, locate a NuGet Audit warning for a vulnerable package. 2. Click the fixer action on the warning. 3. Copilot Chat opens in agent mode with the NuGet MCP server and proposes a remediation — review and apply.

Adds Git agent support for exploring pull requests in Copilot Chat by attaching a PR as context from the Git Repository window, returning a summary with navigable links to comments and files — requires connecting GitHub or Azure DevOps MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces Bring Your Own Model (BYOM) in preview, enabled by default across Community, Professional, and Enterprise editions, supporting Microsoft Foundry, OpenAI, Anthropic, and Ollama providers — works with or without a GitHub sign-in.
Adds a fixer action on NuGet Audit warnings in the Error List that opens Copilot Chat in agent mode and uses the NuGet MCP server to fix vulnerable packages — requires signing in to GitHub Copilot and enabling the NuGet MCP server from the Copilot Chat tools menu.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!BYOM now requires the new Agent (Preview) harness built on the GitHub Copilot SDK; the previous Ask and Agent modes no longer support BYOM, and previously configured Ollama models must be re-added after updating.

Custom skills, agents, and MCP servers in usage metrics API (2026-10-22) Oct 22, 2026 · issue 117

Copilot usage metrics API now surfaces named custom skills, agents, MCP servers, slash commands, and plugins — up to 25 entries each.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin arrays in enterprise and organization usage reports now show the configured name of each customer-defined item instead of grouping them under other or custom.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Each totals_by_* array now returns up to 25 named entries per record, up from 5, with remaining activity collapsed into a trailing other entry.
Named entries appear in all report scopes: per-user 1-day and 28-day reports, aggregated 1-day reports, and day_totals inside aggregated 28-day reports.
Name reporting is supported from Copilot CLI (interactive and prompt mode), the GitHub Copilot app, and ACP integrations (e.g. JetBrains) when running Copilot CLI 1.0.97 or later, and from the Copilot SDK v1.0.21 or later.

The totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin arrays in enterprise and organization usage reports now show the configured name of each customer-defined item instead of grouping them under other or custom.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3 more in Everything

Global default for Copilot features generally available (2026-10-22) Oct 22, 2026 · issue 117

GitHub rolls out enforcement of the global default policy for Copilot features on Business and Enterprise plans through October 26.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Review and set the global default before the October 26 rollout completes, to ensure unconfigured Copilot features land in the state your organization requires.

📍In the enterprise or organization console, go to AI Controls → Copilot → Default policy for new features and choose Enabled, Disabled, or Let organizations decide before the rollout takes effect for your account.

Introduces a global default policy for generally available Copilot features, reachable via AI Controls → Copilot → Default policy for new features, that sets unconfigured eligible settings to Enabled, Disabled, or Let organizations decide on Copilot Business and Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Applies the global default policy to eligible settings on the Features & clients and MCP servers in Copilot configuration surfaces.

Introduces a global default policy for generally available Copilot features, reachable via AI Controls → Copilot → Default policy for new features, that sets unconfigured eligible settings to Enabled, Disabled, or Let organizations decide on Copilot Business and Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

└──▷ BREAKING ON UPGRADE

!Eligible generally available Copilot features and capabilities left Unconfigured will be automatically set to Enabled, Disabled, or Let organizations decide according to the selected global default — this is a one-time irreversible change; subsequent changes to the default policy will not revert features already set by the rollout.

Meta API endpoints updated for Actions blob storage (2026-10-22) Oct 22, 2026 · issue 117

GitHub meta API now lists new Actions blob storage endpoints; network allowlists must add the new host ranges to avoid broken job logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds productionresultssa30.blob.core.windows.net through productionresultssa49.blob.core.windows.net and productionresultssa100.blob.core.windows.net through productionresultssa199.blob.core.windows.net as new GitHub Actions blob storage hosts, retrievable via the REST meta data API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!Organizations using per-host network allowlists for GitHub Actions blob storage must add productionresultssa30 through productionresultssa49 and productionresultssa100 through productionresultssa199 (all under .blob.core.windows.net) or job summaries and logs will be interrupted.

Public monitoring now available with data residency (2026-10-22) Oct 22, 2026 · issue 117

Public monitoring for GHEC DR uses verified domain matching to attribute exposed secrets and deliver encrypted alerts within the enterprise's designated geography.

New detectionEnables public monitoring for GitHub Enterprise Cloud with data residency (GHEC DR), extending secret scanning to public commits across github.com with attribution via verified domain matching.
Delivers secret scanning alerts encrypted directly to the enterprise dashboard, keeping data within the designated geography through tenant isolation.
Enterprise admins and enterprise security managers can enable public monitoring under enterprise security settings, included at no additional cost with an active GitHub Advanced Security or GitHub Secret Protection license.

3 details in Everything

Pull requests: Saved whitespace preferences and improved split view (2026-10-22) Oct 22, 2026 · issue 117

GitHub PR review gains persistent whitespace preferences and full-width split view for new/deleted files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Set a personal whitespace preference that persists across all PRs so you never have to re-hide noisy formatting changes.

📍In a pull request, go to the Files changed tab → open Settings → Whitespace changes → select Always hide. Your preference is saved and applied to all future PRs automatically.

Temporarily reveal whitespace on a specific diff without losing your saved Always hide preference.

📍When reviewing a PR with whitespace hidden, locate the Hide whitespace filter badge beside All commits and click its X to show whitespace for the current diff only.

Adds a persistent whitespace visibility preference under Settings → Whitespace changes with options Always show, Always hide, or Hide for this diff only, applied per user across all pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Displays an active Hide whitespace filter badge beside All commits when whitespace is hidden, with an X to temporarily reveal whitespace without changing the saved preference.
In split view, new and deleted files now span both columns (full width), matching unified view behavior to reduce line wrapping.

Adds a persistent whitespace visibility preference under Settings → Whitespace changes with options Always show, Always hide, or Hide for this diff only, applied per user across all pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Displays an active Hide whitespace filter badge beside All commits when whitespace is hidden, with an X to temporarily reveal whitespace without changing the saved preference.

1 more in Everything

Industry comparisons in the Copilot impact dashboard (2026-10-22) Oct 22, 2026 · issue 117

Copilot impact dashboard gains opt-in industry benchmarking, letting enterprises compare agentic adoption against peer medians and top deciles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Opt your enterprise into industry comparisons so leaders can benchmark agentic Copilot adoption against peers of the same size and sector.

📍In the Copilot impact dashboard, go to the Industry comparison section and enable the Copilot metrics industry comparison policy. Alternatively, navigate to your enterprise or organization Copilot policies and enable the same policy there. Then select your company size (e.g., 1,000–4,999) and one of the ten available industries to set your peer group.

Adds an Industry comparison section to the Copilot impact dashboard showing agentic adoption and leverage benchmarks ranked against a peer median and top decile for the 28-day reporting period.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables peer group filtering by company size (1–999, 1,000–4,999, or 5,000+ employees) and one of ten industries, with automatic widening to all industries when a selected industry's peer group is too small.
Adds a Copilot metrics industry comparison policy — opt in from the dashboard or centrally from enterprise or organization Copilot policies — that controls both data contribution and visibility with a single toggle.
Industry comparisons are excluded from the Copilot usage metrics API, NDJSON exports, and downloads; they appear only in the dashboard UI.

4 details in Everything

GitHub CLI: Opt in to expiring, auto-refreshing OAuth tokens (2026-10-21) Oct 21, 2026 · issue 116

GitHub CLI v2.103.0 adds opt-in expiring, auto-refreshing OAuth tokens via --expiring flag and expiring_credentials config key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Opt in to expiring tokens for a single login so a leaked access token expires within hours rather than lasting indefinitely.

$ gh auth login --expiring

Make expiring tokens the default for every future sign-in on this machine without passing --expiring each time.

$ gh config set expiring_credentials enabled

Configure gh as the git credential helper so expiring tokens are served and refreshed automatically for HTTPS git operations.

$ gh auth setup-git

Adds --expiring flag to gh auth login to request short-lived, automatically rotating OAuth tokens that become useless within hours if leaked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds expiring_credentials enabled to gh config set so every future sign-in uses expiring tokens without passing --expiring each time.
Extends gh auth status to show the expiration time of the current access token when expiring credentials are active.
Supports GitHub Enterprise Server starting with GHES 3.23; falls back to non-expiring behavior on earlier versions.

Adds --expiring flag to gh auth login to request short-lived, automatically rotating OAuth tokens that become useless within hours if leaked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds expiring_credentials enabled to gh config set so every future sign-in uses expiring tokens without passing --expiring each time.
Supports GitHub Enterprise Server starting with GHES 3.23; falls back to non-expiring behavior on earlier versions.

1 more in Everything

└──▷ BREAKING ON UPGRADE

!Scripts or extensions that run gh auth token, store the result, and reuse it later will eventually hold an expired token — read it fresh each time with gh auth token instead of caching it.

docs update Oct 21, 2026 · issue 115

GitHub Copilot CLI gains MCP server support, tool allow/deny controls, agent skills, and enterprise administration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds MCP (Model Context Protocol) server integration to Copilot CLI, enabling additional tools and context to be connected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds allow/deny controls for Copilot CLI tool use, letting users restrict which tools Copilot CLI can invoke.
Adds agent skills to Copilot CLI, supporting repeatable workflows with task-specific instructions, scripts, and resources.
Adds enterprise-level administration controls for Copilot CLI.

4 details in Everything

Bulk migrate branch protections to rulesets for a repository (2026-10-20) Oct 20, 2026 · issue 115

GitHub now lets you bulk-convert all branch protection rules in a repository to rulesets in a single action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Migrate all branch protection rules to rulesets at once, previewing what will be created before committing.

📍1. Go to your repository's Settings → Rulesets. 2. Click Import branch protection rules. 3. In the Review import dialog, preview rulesets to be created, check which rules are already covered, and note any branch protection rules that produce multiple rulesets. 4. Choose an enforcement status: Active, Evaluate, or Disabled, then select which rulesets to create. 5. Click Create rulesets, then choose whether to keep or delete the original branch protection rules.

Adds bulk import of all branch protection rules to rulesets via Settings → Rulesets → Import branch protection rules, with preview, enforcement-status selection (Active, Evaluate, or Disabled), and a choice to keep or delete the original rules after conversion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Updates to GitHub secret scanning (2026-10-20) Oct 20, 2026 · issue 115

GitHub secret scanning: business audit-log field changes to enterprise slug on Nov 12; dismissal webhooks gain exemption_request.number⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Dismissal-request webhook payloads now include exemption_request.number, the repository-scoped request number also available in the REST API, enabling correlation of bypass requests across integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Custom pattern API now returns 422 instead of 500 for requests rejected due to invalid arguments, letting integrations distinguish input errors from server failures.
Expands base64-encoded token revocation (public preview) in private and internal repositories on github.com to support encoded personal access tokens (classic), fine-grained personal access tokens, OAuth access tokens, and GitHub App user access tokens — GitHub automatically decodes the value.

Dismissal-request webhook payloads now include exemption_request.number, the repository-scoped request number also available in the REST API, enabling correlation of bypass requests across integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!On November 12, 2026, the business field in secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events will change from the enterprise display name to the enterprise slug. Integrations that filter by display name must be updated before rollout to accept both formats or switch to business_id.

Dependabot alerts REST API now includes dependency versions (2026-10-20) Oct 20, 2026 · issue 115

Dependabot alert REST API responses now include a version_requirement field with the vulnerable dependency's recorded version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Pull a single Dependabot alert and inspect the new version_requirement field to see exactly which version of a vulnerable dependency is in your repo — no lockfile parsing needed.

$ curl -H 'Authorization: Bearer <token>' \
  'https://api.github.com/repos/<owner>/<repo>/dependabot/alerts/<alert_number>' \
  | jq '.dependency.version_requirement'

List all open Dependabot alerts for a repo and export each dependency name alongside its recorded version constraint for triage or SIEM ingestion.

$ curl -H 'Authorization: Bearer <token>' \
  'https://api.github.com/repos/<owner>/<repo>/dependabot/alerts?state=open&per_page=100' \
  | jq '.[] | {package: .dependency.package.name, version_requirement: .dependency.version_requirement, severity: .security_advisory.severity}'

Adds version_requirement field to Dependabot alert dependency objects in REST API responses — returns the resolved version (lockfiles, Dependency submission API) or declared constraint (manifests without a lockfile), eliminating the need to parse lockfiles or make a separate GraphQL vulnerableRequirements request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
The version_requirement field is present in individual alert responses, repository/organization/enterprise alert list responses, and dependabot_alert webhook payloads.

Adds version_requirement field to Dependabot alert dependency objects in REST API responses — returns the resolved version (lockfiles, Dependency submission API) or declared constraint (manifests without a lockfile), eliminating the need to parse lockfiles or make a separate GraphQL vulnerableRequirements request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

GitHub package firewall in public preview (2026-10-20) Oct 20, 2026 · issue 115

GitHub package firewall (public preview) intercepts npm package requests on CI/CD and coding agents, blocking malicious downloads for Enterprise Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Route an Actions runner's npm traffic through the package firewall instead of pointing directly at the npm registry — blocks malicious packages at install time on CI/CD hosts.

📍In your GitHub Enterprise Cloud admin console, go to Settings › Package firewall, configure the cooldown period and advisory/attestation policies, then follow Protecting endpoints with package firewall to point your runners at the firewall proxy instead of registry.npmjs.org.

Introduces GitHub package firewall for GitHub Enterprise Cloud, sitting between endpoints (Actions runners, coding agents) and upstream package registries to inspect metadata requests and package downloads for malicious activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Checks packages against the GitHub Advisory Database for malware or vulnerability alerts as a policy control.
Performs supply-chain checks including attestation downgrades as a policy control.
Provides an exception request workflow for packages blocked erroneously, consistent with other GitHub Advanced Security flows.
Currently supports npm packages through the firewall.

5 details in Everything

Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4 (2026-10-20) Oct 20, 2026 · issue 115

New supported platform npm 12, pnpm 11, pnpm 12, and Bun 1.4 support in Dependabot

Copilot model policy API for enterprise, orgs, and teams (2026-10-19) Oct 19, 2026 · issue 114

New REST API endpoints let you GET and PATCH Copilot model policies at enterprise, team, app, and org levels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Audit which Copilot models are currently permitted across your entire enterprise before rolling out a policy change.

$ curl -L \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/enterprises/{enterprise}/copilot/model-policies

Delegate Copilot model control to individual organizations so each org can manage its own allowed models.

$ curl -L \
  -X PATCH \
  -H "Authorization: Bearer <token>" \
  -H "Accept: application/vnd.github+json" \
  -H "Content-Type: application/json" \
  https://api.github.com/enterprises/{enterprise}/copilot/model-policies \
  -d '{"mode": "organization"}'

Adds GET and PATCH endpoints at /enterprises/{enterprise}/copilot/model-policies to retrieve and update Copilot model policies at the enterprise level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GET and PATCH endpoints at /enterprises/{enterprise}/teams/{team_slug}/copilot/model-policies to manage Copilot model policies per enterprise team.
Adds GET and PATCH endpoints at /enterprises/{enterprise}/copilot/apps/model-policies to manage Copilot model policies for enterprise apps.
Adds GET and PATCH endpoints at /orgs/{org}/copilot/model-policies to retrieve and update Copilot model policies at the organization level.
Supports delegating model control from enterprise policies to organizations via organization mode, or to teams and apps via enterprise teams mode.

5 details in Everything

Open source license compliance generally available (2026-10-16) Oct 16, 2026 · issue 111

GitHub Enterprise Cloud adds GA open-source license compliance with rulesets, API endpoints, and a new Enterprise Open-Source License Manager role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds new API endpoints for downloading, updating, and replacing the enterprise license policy, plus a separate endpoint for checking whether individual packages comply with policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces a Require license compliance results before merging ruleset condition that enforces an enterprise-wide license policy on pull requests adding or modifying dependencies.
Adds a new predefined enterprise role, Enterprise Open-Source License Manager, for individuals or teams who review and approve license closure requests.
License policy changes now emit audit log events for integration with external systems of record.
Populates the dependency graph and Software Bill of Materials (SBOM) exports with license data for GitHub Enterprise Cloud data-residency customers.

+1 more show less

Enables coding agents to avoid recommending packages that violate an organization's license policy via the new package compliance check endpoint.

Adds new API endpoints for downloading, updating, and replacing the enterprise license policy, plus a separate endpoint for checking whether individual packages comply with policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces a Require license compliance results before merging ruleset condition that enforces an enterprise-wide license policy on pull requests adding or modifying dependencies.
Adds a new predefined enterprise role, Enterprise Open-Source License Manager, for individuals or teams who review and approve license closure requests.
Enables coding agents to avoid recommending packages that violate an organization's license policy via the new package compliance check endpoint.

2 more in Everything

Xcode 27 runner image generally available (2026-10-16) Oct 16, 2026 · issue 111

GitHub Actions introduces a new Xcode-based image model where each image targets one major Xcode version via runs-on: labels rather than an OS version.

New supported platformAdds xcode-27 and xcode-27-xlarge as runs-on: labels for GitHub-hosted Apple Silicon (arm64) runners shipping macOS 27 with the Xcode 27 toolchain and Apple SDKs.

1 detail in Everything

Multi-repository support and other improvements for GitHub in Slack and Teams (2026-10-16) Oct 16, 2026 · issue 111

GitHub: Work across multiple repositories in one @GitHub conversation in Slack or Teams, creating issues, opening PRs, and investigating bugs without switching contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Triage a bug across frontend and backend repos in one Slack thread without opening GitHub.

📍Steps: 1. In any Slack thread, type: '@GitHub Investigate this issue using the code in our frontend and backend repositories.' 2. @GitHub will pull context from both repositories and the current thread to surface relevant code and findings inline.

Get a cross-repo PR review queue from Slack to prioritise your review work each morning.

📍Steps: 1. In any Slack channel or DM, type: '@GitHub Show me all my open PRs across repositories and highlight which ones need my attention.' 2. @GitHub responds with a consolidated list grouped by urgency, without leaving Slack.

Adds support for shared Slack messages and threads as context for @GitHub, reducing the need to copy and paste discussion details.
Improves repository switching so users can move between repositories more easily mid-conversation.

2 more in Everything

Multi-repo support and other improvements for GitHub Copilot in Slack and Microsoft Teams (2026-10-16) Oct 16, 2026 · issue 110

GitHub Copilot in Slack and Teams gains multi-repo conversation support and richer Slack thread context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Get a cross-repo PR status summary without leaving Slack — useful at the start of a team standup.

📍@GitHub Show me all my open pull requests across repositories and highlight which ones need my attention.

Investigate a bug that touches multiple services by asking Copilot in the context of an existing Slack thread about the incident.

📍@GitHub Help me investigate an issue that spans our frontend and backend repositories.

Supports querying across multiple repositories in a single Copilot conversation in Slack and Microsoft Teams, enabling PR tracking, issue investigation, and activity summaries without switching conversations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Allows @GitHub to be mentioned anywhere in a message, not just at the beginning.
Uses shared Slack messages and threads as context so Copilot can reference discussions without manual copy-paste.
Enables smoother repository switching mid-conversation in Slack and Microsoft Teams.

Supports querying across multiple repositories in a single Copilot conversation in Slack and Microsoft Teams, enabling PR tracking, issue investigation, and activity summaries without switching conversations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3 more in Everything

Download GitHub Code Quality license usage as a CSV (2026-10-15) Oct 15, 2026 · issue 110

GitHub now lets org and enterprise admins download a CSV of Code Quality license usage for reconciliation and cost management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Download a Code Quality license usage report to identify committers unique to a single repo where disabling Code Quality could free up licenses.

📍In your organization or enterprise, go to Billing and licensing › Licensing › Code Quality card › Download CSV.

Adds CSV download of GitHub Code Quality license usage from the Licensing section of the Billing and licensing page, available on GitHub Team and GitHub Enterprise Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
CSV report includes each active committer consuming a Code Quality license, the repositories receiving their commits in the last 90 days, and whether each committer is unique to a single repository or organization.

2 details in Everything

AI Scan for pull requests generally available (2026-10-15) Oct 15, 2026 · issue 110

AI Scan for PRs is GA: auto-runs on PRs, shows findings with autofix suggestions, requires Code Security or Advanced Security for private repos.

AI Scan runs automatically on pull requests when code scanning and the repository's effective AI Scan setting are enabled — no GitHub Copilot license required.
AI Scan findings appear alongside CodeQL results on the Conversation and Files changed tabs with an AI indicator, and can include an explanation of the security risk and a suggested autofix.
AI Scan for pull requests consumes Code Security AI Credits, with usage visible in the AI usage section of enterprise billing under the Advanced Security product; SKU-level budgets for Code Security AI Credits can also be set.
AI Scan is available for public repositories owned by organizations or personal accounts; private and internal organization-owned repositories require GitHub Code Security or GitHub Advanced Security.
AI Scan findings are advisory — they do not fail the code scanning check and cannot block pull request merges through ruleset requirements.

+1 more show less

AI Scan does not run on pull requests from forks or pull requests created by Dependabot.

6 details in Everything

New supported platform AI Scan language and framework coverage

Agentic autofix for code scanning alerts general availability (2026-10-15) Oct 15, 2026 · issue 110

GitHub's agentic autofix for code scanning alerts is now GA, using Copilot to explore, fix, validate, and PR-open remediations autonomously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Assign a specific code scanning alert to Copilot for autonomous remediation via the REST API, triggering file exploration, fix generation, CodeQL validation, and a draft PR.

$ curl -X PATCH \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  https://api.github.com/repos/<owner>/<repo>/code-scanning/alerts/<alert_number> \
  -d '{"assignees": ["copilot-swe-agent[bot]"]}'

Enable agentic autofix for an organization after the enterprise administrator has turned on the Agentic autofix policy, so Copilot can begin remediating code scanning alerts.

📍In GitHub Enterprise Cloud, go to Enterprise Settings › Advanced Security policies › Agentic autofix and enable the policy. Then navigate to Organization Settings › Code Security and turn on Agentic autofix.

Enables agentic autofix via the Update a Code Scanning Alert REST API by setting assignees to ["copilot-swe-agent[bot]"] on alerts on the default branch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds an Agentic autofix policy under Advanced Security policies for enterprise administrators to control access.
Introduces the Assign to Copilot button on individual code scanning alerts, replacing the previous Generate Fix option for eligible customers.
Supports bulk remediation of up to 25 alerts at once from the security alerts list or a security campaign, consolidated into a single pull request.

4 details in Everything

HydraFusion updates and new Max option (2026-10-14) Oct 14, 2026 · issue 109

HydraFusion gains Claude Opus 5.5, GPT-6 models, and a new HydraFusion Max tier for demanding agentic tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Introduces HydraFusion Max, a new model-orchestration option tuned for frontier capability on demanding tasks with higher reasoning effort and token-efficiency orchestration, available in VS Code, GitHub Copilot app, and GitHub Copilot CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Expands the HydraFusion model pool to include Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna.
Adds per-stage reasoning-effort tuning to HydraFusion orchestration, using medium effort for initial drafts and high effort for review steps.
Upgrades the Critique workflow to use tool-based workspace inspection instead of text summaries, and adds parallel critic models.

Introduces HydraFusion Max, a new model-orchestration option tuned for frontier capability on demanding tasks with higher reasoning effort and token-efficiency orchestration, available in VS Code, GitHub Copilot app, and GitHub Copilot CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3 more in Everything

announced Oct 14, 2026 · issue 109

GitHub adds GET /repos/{owner}/{repo}/stats/star_history returning up to 30 weeks of daily star counts without user identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Restricts the existing GET /repos/{owner}/{repo}/stargazers endpoint so that callers without repository administrator or collaborator access receive an empty response or a 403 Forbidden response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The GET /repos/{owner}/{repo}/stargazers endpoint now returns an empty response or 403 Forbidden for callers who are not repository administrators or collaborators — tools that used it to reconstruct star history without displaying usernames will stop receiving data.

GitHub Actions workflow lockfiles in public preview (2026-10-14) Oct 14, 2026 · issue 109

GitHub Actions workflow lockfiles hit public preview — pin action commits via gh actions-lock and enforce with a Require lockfile policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds the gh actions-lock CLI extension to generate and maintain .github/workflows/actions.lock, pinning actions and their transitive dependencies (including reusable workflows) to exact commits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports gradual onboarding: individual workflows can be opted in, after which GitHub Actions enforces that every dependency of that workflow has a lockfile entry and runs its recorded commit.
Introduces the Require lockfile policy (public preview) allowing Enterprise, organization, and repository administrators to mandate lockfile use across their scope.
Integrates with Dependabot so that version-update PRs for onboarded workflows automatically regenerate the matching lockfile entry in the same pull request.

Adds the gh actions-lock CLI extension to generate and maintain .github/workflows/actions.lock, pinning actions and their transitive dependencies (including reusable workflows) to exact commits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports gradual onboarding: individual workflows can be opted in, after which GitHub Actions enforces that every dependency of that workflow has a lockfile entry and runs its recorded commit.
Introduces the Require lockfile policy (public preview) allowing Enterprise, organization, and repository administrators to mandate lockfile use across their scope.

1 more in Everything

GitHub App improvements for least privilege and management (2026-10-13) Oct 13, 2026 · issue 108

GitHub Apps gain two new fine-grained permissions, offline_access support, cross-app visibility, and a dedicated Credentials tab.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Create a repository in an org using only the new least-privilege permission, avoiding the need to grant repository_administration:write.

$ curl -X POST https://api.github.com/orgs/{org}/repos \
  -H 'Authorization: Bearer <installation_token>' \
  -H 'Accept: application/vnd.github+json' \
  -d '{"name": "my-new-repo", "private": true}'

Add a repository to a specific app installation using installation_repositories:write, replacing broad admin-PAT automation with a scoped credential.

$ curl -X PUT https://api.github.com/orgs/{org}/installations/{installation_id}/repositories/{repository_id} \
  -H 'Authorization: Bearer <installation_token>' \
  -H 'Accept: application/vnd.github+json'

Audit private or internal GitHub Apps across your enterprise by fetching their details from a peer app that shares the same enterprise.

$ curl -X GET https://api.github.com/apps/{app_slug} \
  -H 'Authorization: Bearer <jwt_or_installation_token>' \
  -H 'Accept: application/vnd.github+json'

Adds repository_creation:write fine-grained permission for GitHub Apps and fine-grained PATs, allowing repository creation without the broader repository_administration:write permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds installation_repositories:write repository-level fine-grained permission, allowing GitHub Apps and fine-grained PATs to add or remove a repository from any installation in the organization via the Add/Remove a repository to an installation APIs (previously only the coarse-grained repo scope was supported).
Supports the offline_access scope for GitHub Apps, enabling gradual migration to short-lived rotating tokens by issuing a refresh token alongside the expiring access token without forcing all users to switch simultaneously.
Expands the Get an app API so GitHub Apps can fetch details about private and internal apps that share ownership (same organization, same enterprise, or enterprise-to-organization).
Repository administrators can now add their repositories to already-installed (organization-owner-approved) GitHub Apps without requiring additional organization owner approval.

+1 more show less

Moves GitHub App credential management to a dedicated Credentials tab in the app configuration UI, separate from general app settings.

Adds repository_creation:write fine-grained permission for GitHub Apps and fine-grained PATs, allowing repository creation without the broader repository_administration:write permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds installation_repositories:write repository-level fine-grained permission, allowing GitHub Apps and fine-grained PATs to add or remove a repository from any installation in the organization via the Add/Remove a repository to an installation APIs (previously only the coarse-grained repo scope was supported).
Supports the offline_access scope for GitHub Apps, enabling gradual migration to short-lived rotating tokens by issuing a refresh token alongside the expiring access token without forcing all users to switch simultaneously.

3 more in Everything

Gemini 4 Argon in GitHub Copilot (2026-10-13) Oct 13, 2026 · issue 108

Gemini 4 Argon is now generally available in GitHub Copilot for complex coding, agentic, and reasoning tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Select Gemini 4 Argon for an agentic coding task in Copilot CLI where its edge-case verification gives higher confidence in generated scripts.

📍In Copilot CLI, open the model picker and select Gemini 4 Argon, then run your prompt as normal.

As a Copilot Business or Enterprise admin, restrict access to Gemini 4 Argon for your organisation while keeping other models available.

📍In GitHub org settings, go to Copilot › Policies › Model policy, find Gemini 4 Argon, and set it to Disabled.

Adds Gemini 4 Argon to the GitHub Copilot model picker, available to Copilot Pro+, Max, Business, and Enterprise users across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, GitHub Copilot app, JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Copilot Enterprise and Business administrators can manage access to Gemini 4 Argon via the model policy in Copilot settings, with new models automatically enabled under the default model enablement policy unless the global default is off or the model is explicitly disabled.

Adds Gemini 4 Argon to the GitHub Copilot model picker, available to Copilot Pro+, Max, Business, and Enterprise users across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, GitHub Copilot app, JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Audit GitHub Code Quality finding dismissals and reopenings (2026-10-13) Oct 13, 2026 · issue 108

GitHub audit log gains two new events for Code Quality finding dismissals and reopenings, queryable via API on Enterprise Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Filter your organization audit log to see all Code Quality finding dismissals across repositories — useful for compliance reviews or investigating when sensitive findings were suppressed.

📍In the organization audit log, filter by action name repo.code_quality_findings_dismissed to list all dismissal events with actor, timestamp, repository, rule, and affected finding IDs.

Adds repo.code_quality_findings_dismissed audit log event, recording who dismissed one or more backlog Code Quality findings, when, the repository and rule, and the identifiers and count of affected findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds repo.code_quality_findings_reopened audit log event with the same metadata for reopened backlog findings.
Enables retrieval of both new events via the audit log API on GitHub Enterprise Cloud.

Adds repo.code_quality_findings_dismissed audit log event, recording who dismissed one or more backlog Code Quality findings, when, the repository and rule, and the identifiers and count of affected findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds repo.code_quality_findings_reopened audit log event with the same metadata for reopened backlog findings.

1 more in Everything

Secret scanning blocks Anthropic keys by default, adds Salesforce (2026-10-13) Oct 13, 2026 · issue 108

GitHub secret scanning adds Salesforce as a partner, detects Anthropic and Cloudsmith keys, and blocks Anthropic keys by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds salesforce_marketing_cloud_api_oauth2_token detection via a new Salesforce secret scanning partnership, automatically forwarding found secrets to Salesforce for revocation in public repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds detection of anthropic_service_api_key and anthropic_user_api_key secret types, generating alerts in both public and private repositories.
Adds detection of cloudsmith_api_key, generating alerts in public and private repositories.
Expands push protection defaults to block commits containing anthropic_service_api_key and anthropic_user_api_key on all repositories with secret scanning enabled, including free public repositories.

Adds salesforce_marketing_cloud_api_oauth2_token detection via a new Salesforce secret scanning partnership, automatically forwarding found secrets to Salesforce for revocation in public repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds detection of anthropic_service_api_key and anthropic_user_api_key secret types, generating alerts in both public and private repositories.
Adds detection of cloudsmith_api_key, generating alerts in public and private repositories.

1 more in Everything

Enterprise managed settings enforcement updates (2026-10-13) Oct 13, 2026 · issue 108

GitHub Copilot enterprise managed settings gain force-refresh on startup and minimum client version enforcement for the sandbox key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Ensure a freshly pushed policy change takes effect before any Copilot client starts — useful after revoking access or changing sandbox rules in a compliance-sensitive environment.

yaml

forceRemoteSettingsRefresh: true

Adds forceRemoteSettingsRefresh setting (supported in server-managed, MDM-managed, and file-based delivery) to require Copilot clients to fetch current server-managed settings at startup rather than using a cached policy, failing closed if current policy cannot be confirmed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enforces a minimum required client version on the sandbox managed settings key, forcing users pinned to older Copilot client versions to update before Copilot will run.

Adds forceRemoteSettingsRefresh setting (supported in server-managed, MDM-managed, and file-based delivery) to require Copilot clients to fetch current server-managed settings at startup rather than using a cached policy, failing closed if current policy cannot be confirmed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Improved detection for withdrawn Dependabot alerts (2026-10-13) Oct 13, 2026 · issue 108

Dependabot alert webhooks gain a withdrawn action and the REST API now returns 410 Gone for withdrawn alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Poll the REST API and branch on 410 Gone to identify withdrawn Dependabot alerts rather than treating them as unknown.

$ curl -i -H 'Authorization: Bearer <token>' \
  https://api.github.com/repos/<owner>/<repo>/dependabot/alerts/<alert_number>
# HTTP/2 410 Gone  →  alert was withdrawn (advisory no longer valid)
# HTTP/2 404 Not Found  →  alert number never existed

Adds a withdrawn action to the dependabot_alert webhook event, with a payload containing the alert number, GHSA and CVE IDs, package, and manifest path captured before removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
REST API requests to get or update a withdrawn Dependabot alert now return 410 Gone instead of 404 Not Found, allowing callers to distinguish withdrawn alerts from alerts that never existed.

Adds a withdrawn action to the dependabot_alert webhook event, with a payload containing the alert number, GHSA and CVE IDs, package, and manifest path captured before removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Search and filter for budgets now available (2026-10-13) Oct 13, 2026 · issue 108

GitHub billing Budgets and alerts page gains search and filter by scope, product, SKU, and user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Find the budget covering a specific user in a large enterprise without scrolling through every entry.

📍In GitHub billing settings, go to Budgets and alerts, type the user's name in the search box, and use the Scope menu to select Organizations to confirm which budget applies.

Adds search and filter to the Budgets and alerts billing page, letting you find budgets by scope, product, or SKU without paginating through the full list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds user-level budget search in enterprises and organizations, so you can look up which budget applies to a specific user.
Adds a Scope menu to narrow the budget list to a single scope, such as organizations or cost centers.

Adds search and filter to the Budgets and alerts billing page, letting you find budgets by scope, product, or SKU without paginating through the full list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

Code scanning AI Scan metrics in security overview (2026-10-13) Oct 13, 2026 · issue 107

Security overview gains AI Scan metrics for pull requests, with a dedicated tab showing findings, autofix rates, and remediation trends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Review AI Scan effectiveness across your organization before deciding on a broader rollout.

📍In Security Overview, go to Code scanning on pull requests › AI Scan tab, then filter by reporting period to see total findings, remediation rate, and how often developers applied autofix suggestions per repository.

Adds an AI Scan tab to the Code scanning on pull requests page in security overview, showing total findings, autofix suggestion coverage, remediation rate, and developer adoption of autofix across repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Renames the CodeQL pull requests page to Code scanning on pull requests and splits existing CodeQL metrics into a separate CodeQL tab alongside the new AI Scan tab.

Adds an AI Scan tab to the Code scanning on pull requests page in security overview, showing total findings, autofix suggestion coverage, remediation rate, and developer adoption of autofix across repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Client telemetry user attribution and configurable capture (2026-10-12) Oct 12, 2026 · issue 106

GitHub Copilot enterprise telemetry gains user attribution and five independently toggleable OTel capture classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enable user attribution plus tool-argument capture for an audit pipeline — without collecting prompts or responses — in your enterprise managed settings.

yaml

telemetry:
  capture:
    identity: true
    toolArguments: true
    prompts: false
    responses: false
    toolOutput: false
    policyDetail: false

Adds telemetry.capture.identity setting to attribute Copilot activity to a user, appending user.name, process.user.name, and host.name to OpenTelemetry data — off by default, separate from existing pseudonymous identifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds five independently controllable capture classes — prompts, responses, toolArguments, toolOutput, and policyDetail — each off by default, available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.
Retains captureContent as a legacy shorthand covering all five content capture classes, but explicitly never enables identity capture.
Explicit managed values take precedence over local settings, SDK configuration, and environment variables.

Adds telemetry.capture.identity setting to attribute Copilot activity to a user, appending user.name, process.user.name, and host.name to OpenTelemetry data — off by default, separate from existing pseudonymous identifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds five independently controllable capture classes — prompts, responses, toolArguments, toolOutput, and policyDetail — each off by default, available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.
Explicit managed values take precedence over local settings, SDK configuration, and environment variables.

1 more in Everything

Push attribution for commits in limited public preview (2026-10-12) Oct 12, 2026 · issue 106

GitHub adds durable push attribution to commits, exposing the authenticated pusher in the UI, API, and a new Committer must match pusher ruleset condition.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a new repository rule condition, Committer must match pusher, that blocks pushes where the committer metadata does not match any verified email address of the authenticated pusher.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Every commit pushed to a repository now has a durable, authenticated pusher identity attached to it, independent of author and committer metadata.
Surfaces the authenticated pusher identity in the UI and API alongside the existing author and committer fields, enabling spot-checks of suspicious activity and faster security investigations.

Adds a new repository rule condition, Committer must match pusher, that blocks pushes where the committer metadata does not match any verified email address of the authenticated pusher.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Every commit pushed to a repository now has a durable, authenticated pusher identity attached to it, independent of author and committer metadata.

1 more in Everything

Anonymous organization-level registries for Dependabot (2026-10-12) Oct 12, 2026 · issue 106

Dependabot now supports Anonymous authentication for organization-level private registries, enabling credential-free internal package mirrors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Add a credential-free internal package mirror as an organization-level Dependabot registry so all granted repos can reach it without a token.

📍In your organization, go to Settings › Secrets and variables › Private registries › New private registry, enter the registry URL, and set the authentication method to Anonymous.

Adds Anonymous as a selectable authentication method for organization-level private registries in Dependabot, enabling registries that allow unauthenticated reads (such as internal package mirrors) without requiring a placeholder token workaround.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Organization-level private registries configured with Anonymous authentication apply to every granted repository, including those using only Dependabot security updates with no dependabot.yml file.

Adds Anonymous as a selectable authentication method for organization-level private registries in Dependabot, enabling registries that allow unauthenticated reads (such as internal package mirrors) without requiring a placeholder token workaround.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

└──▷ BREAKING ON UPGRADE

!You cannot change the authentication method of an existing registry — to switch a placeholder-token registry to Anonymous, you must delete it and re-create it via Settings > Secrets and variables > Private registries > New private registry.

New controls and chat improvements in Copilot for JetBrains (2026-10-10) Oct 10, 2026 · issue 102

Copilot for JetBrains adds enterprise default-model controls, an MCP startup toggle, an inline Fix action from diagnostics, and richer chat and account UX.

Adds a new MCP setting to disable automatic server startup for Copilot and Claude, giving administrators control over when configured tools become active.
Enterprise administrators can now select any available Copilot agent model as the organization-wide default for new conversations via managed settings.
Diagnostic intention menus now include a Fix action that opens inline chat in agent mode (or ask mode when agent is unavailable) to repair the reported issue.
Adds a Switch Account action to signed-in Copilot account controls, along with clearer labels, a simpler status display, and better navigation for long account lists.
Chat messages are now grouped by turn with controls for moving quickly between turns.

+3 more show less

User messages in chat now include actions to copy or edit their content.
A one-time reminder helps new users discover Chat, with a reworked sign-in page featuring a responsive layout, clearer headings, improved provider choices, a direct Copilot plans link, and cancellable browser-authorization progress.
The Copilot agent placeholder now highlights questions, edits, context, and commands to guide agent interactions.

8 details in Everything

Retired supported platform JetBrains IDE 2025.1 support ended

└──▷ BREAKING ON UPGRADE

!GitHub Copilot has ended support for JetBrains IDE 2025.1; JetBrains IDE 2025.2 or later is now required to use the plugin.

GitHub Copilot weekly releases — October 5 (2026-10-09) Oct 9, 2026 · issue 100

Copilot gains Claude Haiku 5.5, local sandboxing GA, multi-account app support, and /model discovery in CLI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Switch to a locally-running model mid-workflow without leaving the CLI — useful when you want lower-latency or offline inference via Ollama.

$ /model

Adds /model command in GitHub Copilot CLI to discover and select supported models from a running local Ollama instance alongside configured and cloud models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces local sandboxing — now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host — to limit agents' access to files, networks, and credentials at no extra cost.
Enables use of separate GitHub accounts for a Copilot license and repository access in the Copilot app (e.g. enterprise-provided license paired with a personal repository account).
Makes Claude Haiku 5.5 available to Copilot Pro, Pro+, Max, Business, and Enterprise users.
Adds side-by-side agent session viewing in the VS Code Agents window with grid layout to compare results or follow multiple tasks.

+1 more show less

Adds Open worktree cleanup in VS Code chat to surface disk usage of inactive session worktrees and remove selected ones.

6 details in Everything

CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis (2026-10-09) Oct 9, 2026 · issue 100

CodeQL 2.27.2 adds a C++ regex parser, Rust extractor classes, new sink/flow models, and a macOS 27 build-mode restriction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Inspect optimized constant tuple sets during query development to understand how the compiler resolves constants.

$ codeql query compile --dump-dil --dil-constants my-query.ql

Report unpinned tags from first-party GitHub-owned Actions (owner github) by removing them from the default trusted set.

text

!github

Adds --dil-constants flag to codeql query compile (used with --dump-dil) to include optimized constant tuple sets in emitted DIL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds !-prefixed entries (e.g. !github) to the trusted-owner set of the actions/unpinned-tag query so first-party unpinned tags are reportable.
Adds ControlFlow::EntryNode, ControlFlow::ExitNode, and SwitchStmt.getExpr to the Go control-flow graph via the shared CFG library.
Adds SQL-injection sink models for the Comdb2 C API and flow summaries for Bloomberg BDE codecs and byte-stream deserializers in C/C++ analysis.
Adds flow summaries for native-tls, async-native-tls, and tokio-native-tls in Rust analysis.

+5 more show less

Adds support for AnyAttr and DocComment classes in the Rust extractor.
Adds modeling of the github.com/coder/websocket import path in Go analysis (alongside the existing nhooyr.io/websocket path).
Adds recognition of the Workflow SDK's 'use workflow' and 'use step' directives in JavaScript/TypeScript analysis.
Adds C++ parsing of regular expressions that use the ECMAScript grammar in std::regex.
Improves the cs/web/missing-x-frame-options query to recognize ASP.NET Core response headers and Content Security Policy frame-ancestors directives as clickjacking protections.

Adds --dil-constants flag to codeql query compile (used with --dump-dil) to include optimized constant tuple sets in emitted DIL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds support for AnyAttr and DocComment classes in the Rust extractor.
Adds C++ parsing of regular expressions that use the ECMAScript grammar in std::regex.

7 more in Everything

└──▷ BREAKING ON UPGRADE

!CodeQL autobuild and manual build modes are not supported for compiled languages on macOS 27 (any Xcode version) or on macOS 26 with Xcode 27 selected; use at most macOS 26 and Xcode 26.
!The Go CFG now uses the shared CFG library: BasicBlocks::Cfg is removed; CFG nodes, edges, locations, textual representations, and basic-block boundaries have changed — queries relying on the previous representation must be updated.
!IfStmt.getCond is deprecated in favor of IfStmt.getCondition; the return types of IfStmt.getThen and LoopStmt.getBody change to Stmt; several IR instruction classes are consolidated.
!The cs/web/xss query no longer treats Razor tag-helper attribute values written with WriteLiteral as XSS sinks, which may remove previously reported findings.

Copilot code review: New organization billing options and controls (2026-10-08) Oct 8, 2026 · issue 100

GitHub Copilot code review gains org-level billing controls and an external-license gating toggle for review requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Switch Copilot code review billing to the organization cost center so member quotas are never consumed or exhausted.

📍In your organization settings, go to Copilot -> Policies, locate 'Choose how members with a Copilot license are billed', and select Organization. Ensure AI Credits paid usage is enabled for the org, then optionally set a budget.

Restrict Copilot code review requests to users holding an org- or enterprise-issued license, blocking personal or external licenses org-wide.

📍In your organization settings, go to Copilot -> Policies and enable 'Only allow Copilot code review to be triggered by authorized users'. Once set at the org level, repository admins cannot override it.

Adds Choose how members with a Copilot license are billed setting under organization Copilot -> Policies, with options Member (default, bills member's own entitlement) and Organization (bills the repository-owning org via AI Credits paid usage, with optional budget).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Only allow Copilot code review to be triggered by authorized users toggle at the organization and repository level to block review requests made with external (e.g. personal) Copilot licenses.

2 details in Everything

Triage role users or higher can now archive pull requests (2026-10-08) Oct 8, 2026 · issue 098

GitHub expands pull request archiving to triage-role users and makes archived PRs fully read-only for everyone.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Triagers handling spam or abandoned PRs can now archive them directly in the UI without escalating to an admin.

📍In the pull request page, open the pull request actions menu and select Archive pull request. The PR will be closed and its conversation made read-only immediately.

Extends pull request archive and unarchive permissions to users with the triage, write, maintain, or admin role — previously only admins could archive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Archiving a pull request now makes its conversation fully read-only: new comments, reactions, and automated comments are blocked for all users, including admins.
Archived pull requests are hidden from public view but remain visible to repository administrators.

Extends pull request archive and unarchive permissions to users with the triage, write, maintain, or admin role — previously only admins could archive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Archiving a pull request now blocks all new activity (comments, reactions, automated comments) for every role including admins — previously admins could still comment on a locked/archived PR.

Triage role users or higher can now archive pull requests (2026-10-08) Oct 8, 2026 · issue 015

GitHub expands pull request archiving to triage-role users and makes archived PRs fully read-only for everyone.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Triagers handling spam or abandoned PRs can now archive them directly in the UI without escalating to an admin.

📍In the pull request page, open the pull request actions menu and select Archive pull request. The PR will be closed and its conversation made read-only immediately.

Extends pull request archive and unarchive permissions to users with the triage, write, maintain, or admin role — previously only admins could archive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Archiving a pull request now makes its conversation fully read-only: new comments, reactions, and automated comments are blocked for all users, including admins.
Archived pull requests are hidden from public view but remain visible to repository administrators.

Extends pull request archive and unarchive permissions to users with the triage, write, maintain, or admin role — previously only admins could archive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Archiving a pull request now blocks all new activity (comments, reactions, automated comments) for every role including admins — previously admins could still comment on a locked/archived PR.

Claude Haiku 5.5 in GitHub Copilot (2026-10-07) Oct 7, 2026 · issue 097

Claude Haiku 5.5 is now generally available in GitHub Copilot across all major IDEs and surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Select Claude Haiku 5.5 for fast, token-efficient coding tasks like quick edits or terminal work in VS Code.

📍In GitHub Copilot, open the model picker and select Claude Haiku 5.5 from the available models list.

Adds Claude Haiku 5.5 as a selectable model in GitHub Copilot's model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Copilot Enterprise and Business administrators can manage Claude Haiku 5.5 access via the model policy in Copilot settings, with automatic enablement under the default model enablement policy unless explicitly disabled.

Adds Claude Haiku 5.5 as a selectable model in GitHub Copilot's model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Claude Haiku 5.5 in GitHub Copilot (2026-10-07) Oct 7, 2026 · issue 015

Claude Haiku 5.5 is now generally available in GitHub Copilot across all major IDEs and surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Select Claude Haiku 5.5 for fast, token-efficient coding tasks like quick edits or terminal work in VS Code.

📍In GitHub Copilot, open the model picker and select Claude Haiku 5.5 from the available models list.

Adds Claude Haiku 5.5 as a selectable model in GitHub Copilot's model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Copilot Enterprise and Business administrators can manage Claude Haiku 5.5 access via the model policy in Copilot settings, with automatic enablement under the default model enablement policy unless explicitly disabled.

Adds Claude Haiku 5.5 as a selectable model in GitHub Copilot's model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Purpose-built model for leaked secret detection (2026-10-07) Oct 7, 2026 · issue 097

GitHub adds a purpose-built AI model for secret detection, extending coverage to push protection and the Copilot /security-review command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Run an AI-powered security review of active changes — including the new secret-classifier checks — before committing or opening a pull request.

$ /security-review

Cap spending on AI push protection and secret-classifier checks before opting into the public preview.

📍In the GitHub UI: Billing and licensing › Budgets and alerts › New budget › SKU-level budget › Product: Advanced Security › SKU: Secret Protection AI Credits › Enable 'Stop usage when budget limit is reached'.

Adds AI-detected secret scanning to the GitHub Copilot /security-review command in supported Copilot CLI and Copilot App sessions, flagging unstructured credentials alongside existing LLM-based findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds AI push protection that checks for unstructured credentials at push time, before a secret enters repository history, available in private preview for GitHub Enterprise Cloud and GitHub Teams with GHSP or GHAS.
Upgrades existing AI-detected Password alert scans to the new purpose-built fine-tuned model automatically, at no additional charge for GHSP and GHAS customers.
Brings AI-detected secret alerts to GitHub Enterprise Server 3.23 in public preview, included with existing GHSP and GHAS purchases.
Introduces a dedicated Secret Protection AI Credits SKU visible under AI usage insights, with opt-in budget controls available at Billing and licensing > Budgets and alerts using a SKU-level budget set to Advanced Security and Secret Protection AI Credits.

Adds AI-detected secret scanning to the GitHub Copilot /security-review command in supported Copilot CLI and Copilot App sessions, flagging unstructured credentials alongside existing LLM-based findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds AI push protection that checks for unstructured credentials at push time, before a secret enters repository history, available in private preview for GitHub Enterprise Cloud and GitHub Teams with GHSP or GHAS.
Brings AI-detected secret alerts to GitHub Enterprise Server 3.23 in public preview, included with existing GHSP and GHAS purchases.
Introduces a dedicated Secret Protection AI Credits SKU visible under AI usage insights, with opt-in budget controls available at Billing and licensing > Budgets and alerts using a SKU-level budget set to Advanced Security and Secret Protection AI Credits.

1 more in Everything

Purpose-built model for leaked secret detection (2026-10-07) Oct 7, 2026 · issue 015

GitHub adds a purpose-built AI model for secret detection, extending coverage to push protection and the Copilot /security-review command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Run an AI-powered security review of active changes — including the new secret-classifier checks — before committing or opening a pull request.

$ /security-review

Cap spending on AI push protection and secret-classifier checks before opting into the public preview.

📍In the GitHub UI: Billing and licensing › Budgets and alerts › New budget › SKU-level budget › Product: Advanced Security › SKU: Secret Protection AI Credits › Enable 'Stop usage when budget limit is reached'.

Adds AI-detected secret scanning to the GitHub Copilot /security-review command in supported Copilot CLI and Copilot App sessions, flagging unstructured credentials alongside existing LLM-based findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds AI push protection that checks for unstructured credentials at push time, before a secret enters repository history, available in private preview for GitHub Enterprise Cloud and GitHub Teams with GHSP or GHAS.
Upgrades existing AI-detected Password alert scans to the new purpose-built fine-tuned model automatically, at no additional charge for GHSP and GHAS customers.
Brings AI-detected secret alerts to GitHub Enterprise Server 3.23 in public preview, included with existing GHSP and GHAS purchases.
Introduces a dedicated Secret Protection AI Credits SKU visible under AI usage insights, with opt-in budget controls available at Billing and licensing > Budgets and alerts using a SKU-level budget set to Advanced Security and Secret Protection AI Credits.

Adds AI-detected secret scanning to the GitHub Copilot /security-review command in supported Copilot CLI and Copilot App sessions, flagging unstructured credentials alongside existing LLM-based findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds AI push protection that checks for unstructured credentials at push time, before a secret enters repository history, available in private preview for GitHub Enterprise Cloud and GitHub Teams with GHSP or GHAS.
Brings AI-detected secret alerts to GitHub Enterprise Server 3.23 in public preview, included with existing GHSP and GHAS purchases.
Introduces a dedicated Secret Protection AI Credits SKU visible under AI usage insights, with opt-in budget controls available at Billing and licensing > Budgets and alerts using a SKU-level budget set to Advanced Security and Secret Protection AI Credits.

1 more in Everything

Local sandboxing for GitHub Copilot now generally available (2026-10-07) Oct 7, 2026 · issue 097

GitHub Copilot gains GA local sandboxing via MXC, enforcing filesystem, network, and credential boundaries for agentic workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds local sandboxing for GitHub Copilot (powered by Microsoft eXecution Container, MXC) in GitHub Copilot CLI, the GitHub Copilot app, and VS Code Agent Host sessions, restricting agentic tool and command access to the filesystem, network, and credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables per-policy control over which files and directories agent-run commands can read or modify, and over access to the internet, local networks, Git credentials, and GitHub CLI credentials.
Supports sandboxing of local MCP and language servers where supported.
Enables enterprise-managed settings to require sandboxing and enforce policies that developers cannot weaken.

4 details in Everything

Local sandboxing for GitHub Copilot now generally available (2026-10-07) Oct 7, 2026 · issue 015

GitHub Copilot gains GA local sandboxing via MXC, enforcing filesystem, network, and credential boundaries for agentic workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds local sandboxing for GitHub Copilot (powered by Microsoft eXecution Container, MXC) in GitHub Copilot CLI, the GitHub Copilot app, and VS Code Agent Host sessions, restricting agentic tool and command access to the filesystem, network, and credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables per-policy control over which files and directories agent-run commands can read or modify, and over access to the internet, local networks, Git credentials, and GitHub CLI credentials.
Supports sandboxing of local MCP and language servers where supported.
Enables enterprise-managed settings to require sandboxing and enforce policies that developers cannot weaken.

4 details in Everything

Discover local models in GitHub Copilot CLI (2026-10-07) Oct 7, 2026 · issue 097

GitHub Copilot CLI v1.0.94-0 adds /model picker to discover and add local Ollama models without restarting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Discover and add a local Ollama model to your Copilot CLI session without restarting — useful when you want to test a locally hosted model mid-workflow.

$ /model

Add a supported local model provider in the GitHub Copilot app so it appears in the model picker alongside cloud models.

📍In the GitHub Copilot app, go to Settings › Model providers and add your local Ollama provider.

Adds /model command in GitHub Copilot CLI (v1.0.94-0+) to discover models from a running local Ollama instance alongside configured and cloud models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables adding a discovered local model for the current session — with provider and endpoint review — via Add and use for this session or Add without switching, without restarting the CLI.
Surfaces provider connection failures directly in the /model picker with explanations so you can identify misconfigured providers immediately.
Supports enabling offline mode explicitly via the COPILOT_OFFLINE=true environment variable, keeping offline mode separate from local model selection.
Adds local model provider configuration in the GitHub Copilot app at Settings > Model providers.

Adds /model command in GitHub Copilot CLI (v1.0.94-0+) to discover models from a running local Ollama instance alongside configured and cloud models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables adding a discovered local model for the current session — with provider and endpoint review — via Add and use for this session or Add without switching, without restarting the CLI.
Supports enabling offline mode explicitly via the COPILOT_OFFLINE=true environment variable, keeping offline mode separate from local model selection.
Adds local model provider configuration in the GitHub Copilot app at Settings > Model providers.

1 more in Everything

Discover local models in GitHub Copilot CLI (2026-10-07) Oct 7, 2026 · issue 015

GitHub Copilot CLI v1.0.94-0 adds /model picker to discover and add local Ollama models without restarting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Discover and add a local Ollama model to your Copilot CLI session without restarting — useful when you want to test a locally hosted model mid-workflow.

$ /model

Add a supported local model provider in the GitHub Copilot app so it appears in the model picker alongside cloud models.

📍In the GitHub Copilot app, go to Settings › Model providers and add your local Ollama provider.

Adds /model command in GitHub Copilot CLI (v1.0.94-0+) to discover models from a running local Ollama instance alongside configured and cloud models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables adding a discovered local model for the current session — with provider and endpoint review — via Add and use for this session or Add without switching, without restarting the CLI.
Surfaces provider connection failures directly in the /model picker with explanations so you can identify misconfigured providers immediately.
Supports enabling offline mode explicitly via the COPILOT_OFFLINE=true environment variable, keeping offline mode separate from local model selection.
Adds local model provider configuration in the GitHub Copilot app at Settings > Model providers.

Adds /model command in GitHub Copilot CLI (v1.0.94-0+) to discover models from a running local Ollama instance alongside configured and cloud models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables adding a discovered local model for the current session — with provider and endpoint review — via Add and use for this session or Add without switching, without restarting the CLI.
Supports enabling offline mode explicitly via the COPILOT_OFFLINE=true environment variable, keeping offline mode separate from local model selection.
Adds local model provider configuration in the GitHub Copilot app at Settings > Model providers.

1 more in Everything

Code scanning AI Scan enablement status in security overview (2026-10-06) Oct 6, 2026 · issue 096

GitHub security overview gains AI Scan PR enablement status, filters, and a new CSV export column for org/enterprise admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Filter the security overview coverage view to find all repositories that have NOT yet enabled AI Scan for pull requests, so you can target rollout gaps across your org.

📍In the GitHub security overview coverage view, enter code-scanning-ai-scan-pr-scan:not-enabled in the filter bar to list all repositories where AI Scan for pull requests is not enabled.

Adds code-scanning-ai-scan-pr-scan:enabled and code-scanning-ai-scan-pr-scan:not-enabled filter qualifiers to the security overview coverage view to isolate repositories by AI Scan for pull requests status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a Code Scanning AI Scan for pull requests column (values: enabled, not-enabled) to the coverage CSV export.
Shows AI Scan for pull requests enablement status in the security overview coverage view, including per-repository rows and summary counts of enabled and not-enabled repositories.

Adds code-scanning-ai-scan-pr-scan:enabled and code-scanning-ai-scan-pr-scan:not-enabled filter qualifiers to the security overview coverage view to isolate repositories by AI Scan for pull requests status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

Code scanning AI Scan enablement status in security overview (2026-10-06) Oct 6, 2026 · issue 015

GitHub security overview gains AI Scan PR enablement status, filters, and a new CSV export column for org/enterprise admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Filter the security overview coverage view to find all repositories that have NOT yet enabled AI Scan for pull requests, so you can target rollout gaps across your org.

📍In the GitHub security overview coverage view, enter code-scanning-ai-scan-pr-scan:not-enabled in the filter bar to list all repositories where AI Scan for pull requests is not enabled.

Adds code-scanning-ai-scan-pr-scan:enabled and code-scanning-ai-scan-pr-scan:not-enabled filter qualifiers to the security overview coverage view to isolate repositories by AI Scan for pull requests status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a Code Scanning AI Scan for pull requests column (values: enabled, not-enabled) to the coverage CSV export.
Shows AI Scan for pull requests enablement status in the security overview coverage view, including per-repository rows and summary counts of enabled and not-enabled repositories.

Adds code-scanning-ai-scan-pr-scan:enabled and code-scanning-ai-scan-pr-scan:not-enabled filter qualifiers to the security overview coverage view to isolate repositories by AI Scan for pull requests status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

docs update Oct 6, 2026 · issue 096

GitHub Copilot CLI now supports custom instructions to give it project-specific context for building, testing, and validating changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds custom instructions for GitHub Copilot CLI, letting you provide project-specific context about how to build, test, and validate changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Secret scanning adds detectors for Lovable, Supabase, and more (2026-10-05) Oct 5, 2026 · issue 096

New detection Lovable Labs secret scanning partner and detector
New detection Pydantic Services Inc. secret detectors
New detection Supabase secret detectors

Secret scanning adds detectors for Lovable, Supabase, and more (2026-10-05) Oct 5, 2026 · issue 015

New detection Lovable Labs secret scanning partner and detector
New detection Pydantic Services Inc. secret detectors
New detection Supabase secret detectors

Copilot code review: API support and new default effort level (2026-10-02) Oct 2, 2026 · issue 093

GitHub Copilot code review is now accessible via REST and GraphQL APIs with configurable effort levels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Override the default effort level back to Lite for a specific repository whose reviewers prefer lighter feedback.

📍In your repository settings, go to Copilot -> Code review and set the review effort level to Lite.

Adds REST and GraphQL API support for requesting GitHub Copilot code reviews, with an optional review effort level per request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Changes the default review effort level from Lite to Balanced for new and existing repositories and organizations.
Adds per-level UI controls to set the review effort level (Lite, Balanced) at the enterprise, organization, repository, or personal scope via settings pages.

Adds REST and GraphQL API support for requesting GitHub Copilot code reviews, with an optional review effort level per request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!The default review effort level changed from Lite to Balanced on September 28, 2026 — repositories and organizations that relied on Lite as the default will now receive Balanced reviews unless Lite was explicitly selected in settings.

Copilot code review: API support and new default effort level (2026-10-02) Oct 2, 2026 · issue 015

GitHub Copilot code review is now accessible via REST and GraphQL APIs with configurable effort levels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Override the default effort level back to Lite for a specific repository whose reviewers prefer lighter feedback.

📍In your repository settings, go to Copilot -> Code review and set the review effort level to Lite.

Adds REST and GraphQL API support for requesting GitHub Copilot code reviews, with an optional review effort level per request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Changes the default review effort level from Lite to Balanced for new and existing repositories and organizations.
Adds per-level UI controls to set the review effort level (Lite, Balanced) at the enterprise, organization, repository, or personal scope via settings pages.

Adds REST and GraphQL API support for requesting GitHub Copilot code reviews, with an optional review effort level per request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

└──▷ BREAKING ON UPGRADE

!The default review effort level changed from Lite to Balanced on September 28, 2026 — repositories and organizations that relied on Lite as the default will now receive Balanced reviews unless Lite was explicitly selected in settings.

Unvalidated npm trusted publishing configurations now expire (2026-10-02) Oct 2, 2026 · issue 096

npm trusted publishing configurations now expire after 48 hours if unvalidated, and tokens from issue_comment events are rejected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Unvalidated npm trusted publishing configurations expire 48 hours after creation and can no longer authorize publishing until a successful publish validates them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
npm now rejects trusted publishing tokens from GitHub Actions issue_comment events; move publishing to push, release, or workflow_dispatch instead.
Changing the repository or project identity resets the trust relationship with a fresh 48-hour validation window; ordinary edits do not restart the deadline.
Expired configurations remain visible in trusted publisher settings but do not count toward per-package limits.

Unvalidated npm trusted publishing configurations expire 48 hours after creation and can no longer authorize publishing until a successful publish validates them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
npm now rejects trusted publishing tokens from GitHub Actions issue_comment events; move publishing to push, release, or workflow_dispatch instead.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Trusted publishing tokens issued from GitHub Actions issue_comment events are now rejected by npm; workflows that publish on issue_comment must be moved to a permitted event (push, release, or workflow_dispatch).
!Unvalidated trusted publishing configurations older than 48 hours can no longer authorize publishing; affected configurations must be recreated to start a new 48-hour window.

Unvalidated npm trusted publishing configurations now expire (2026-10-02) Oct 2, 2026 · issue 015

npm trusted publishing configurations now expire after 48 hours if unvalidated, and tokens from issue_comment events are rejected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Unvalidated npm trusted publishing configurations expire 48 hours after creation and can no longer authorize publishing until a successful publish validates them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
npm now rejects trusted publishing tokens from GitHub Actions issue_comment events; move publishing to push, release, or workflow_dispatch instead.
Changing the repository or project identity resets the trust relationship with a fresh 48-hour validation window; ordinary edits do not restart the deadline.
Expired configurations remain visible in trusted publisher settings but do not count toward per-package limits.

Unvalidated npm trusted publishing configurations expire 48 hours after creation and can no longer authorize publishing until a successful publish validates them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
npm now rejects trusted publishing tokens from GitHub Actions issue_comment events; move publishing to push, release, or workflow_dispatch instead.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Trusted publishing tokens issued from GitHub Actions issue_comment events are now rejected by npm; workflows that publish on issue_comment must be moved to a permitted event (push, release, or workflow_dispatch).
!Unvalidated trusted publishing configurations older than 48 hours can no longer authorize publishing; affected configurations must be recreated to start a new 48-hour window.

npm staged publishing now supports creating new packages (2026-10-02) Oct 2, 2026 · issue 096

npm staged publishing now supports creating brand-new packages via npm stage publish, including from stage-only tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Bootstrap a brand-new npm package from CI without a manual first publish — the version enters the staged queue awaiting maintainer promotion.

$ npm stage publish

Enables npm stage publish to create new npm packages (public scoped, unscoped, and private scoped) without a manual first publish, using a local session or a granular access token including a stage-only token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
First-version publishes via staged workflow enter a queue and require a maintainer to promote before the version becomes installable.
After package creation via staged publish, package settings and trusted publishing can be configured immediately.

Enables npm stage publish to create new npm packages (public scoped, unscoped, and private scoped) without a manual first publish, using a local session or a granular access token including a stage-only token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

npm staged publishing now supports creating new packages (2026-10-02) Oct 2, 2026 · issue 015

npm staged publishing now supports creating brand-new packages via npm stage publish, including from stage-only tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Bootstrap a brand-new npm package from CI without a manual first publish — the version enters the staged queue awaiting maintainer promotion.

$ npm stage publish

Enables npm stage publish to create new npm packages (public scoped, unscoped, and private scoped) without a manual first publish, using a local session or a granular access token including a stage-only token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
First-version publishes via staged workflow enter a queue and require a maintainer to promote before the version becomes installable.
After package creation via staged publish, package settings and trusted publishing can be configured immediately.

Enables npm stage publish to create new npm packages (public scoped, unscoped, and private scoped) without a manual first publish, using a local session or a granular access token including a stage-only token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

New fields for SecurityAdvisory GraphQL API (2026-10-02) Oct 2, 2026 · issue 093

GitHub's SecurityAdvisory GraphQL API gains five new fields and two new server-side filters for advisory triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds severities and isWithdrawn filters to the securityAdvisories GraphQL query, enabling server-side narrowing of advisory results without downloading and filtering client-side.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds sourceCodeLocation field to the SecurityAdvisory GraphQL object linking to affected source code relevant to the advisory.
Adds githubReviewedAt field to the SecurityAdvisory GraphQL object exposing when GitHub reviewed the advisory.
Adds nvdPublishedAt field to the SecurityAdvisory GraphQL object exposing when the NVD published its record.
Adds repositoryAdvisoryUrl field to the SecurityAdvisory GraphQL object linking to the associated repository security advisory when one exists.

Adds severities and isWithdrawn filters to the securityAdvisories GraphQL query, enabling server-side narrowing of advisory results without downloading and filtering client-side.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

4 more in Everything

New fields for SecurityAdvisory GraphQL API (2026-10-02) Oct 2, 2026 · issue 015

GitHub's SecurityAdvisory GraphQL API gains five new fields and two new server-side filters for advisory triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds severities and isWithdrawn filters to the securityAdvisories GraphQL query, enabling server-side narrowing of advisory results without downloading and filtering client-side.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds sourceCodeLocation field to the SecurityAdvisory GraphQL object linking to affected source code relevant to the advisory.
Adds githubReviewedAt field to the SecurityAdvisory GraphQL object exposing when GitHub reviewed the advisory.
Adds nvdPublishedAt field to the SecurityAdvisory GraphQL object exposing when the NVD published its record.
Adds repositoryAdvisoryUrl field to the SecurityAdvisory GraphQL object linking to the associated repository security advisory when one exists.

Adds severities and isWithdrawn filters to the securityAdvisories GraphQL query, enabling server-side narrowing of advisory results without downloading and filtering client-side.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

4 more in Everything

Confidential comments on repository security advisories (2026-10-02) Oct 2, 2026 · issue 092

GitHub security advisories gain confidential comments — visible only to write-access maintainers, logged in the audit log, and available via GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Post a confidential internal note on an advisory — e.g. to record investigation details without exposing them to the reporter or invited collaborators.

📍In the security advisory, type your comment, select Confidential below the comment box, then click Submit. The comment will appear with a confidential marker visible only to maintainers with write access.

Adds confidential comments to repository security advisories, accessible in the GraphQL API but not returned by the REST API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Confidential comments are clearly marked in the advisory timeline and views are recorded in the audit log.
Access to confidential comments follows repository write permissions — if someone loses write access, they can no longer read existing confidential comments.
Post a confidential comment by selecting Confidential below the comment box before posting; the setting cannot be changed after posting.

4 details in Everything

Confidential comments on repository security advisories (2026-10-02) Oct 2, 2026 · issue 015

GitHub security advisories gain confidential comments — visible only to write-access maintainers, logged in the audit log, and available via GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Post a confidential internal note on an advisory — e.g. to record investigation details without exposing them to the reporter or invited collaborators.

📍In the security advisory, type your comment, select Confidential below the comment box, then click Submit. The comment will appear with a confidential marker visible only to maintainers with write access.

Adds confidential comments to repository security advisories, accessible in the GraphQL API but not returned by the REST API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Confidential comments are clearly marked in the advisory timeline and views are recorded in the audit log.
Access to confidential comments follows repository write permissions — if someone loses write access, they can no longer read existing confidential comments.
Post a confidential comment by selecting Confidential below the comment box before posting; the setting cannot be changed after posting.

4 details in Everything

Repository security advisory comments API in public preview (2026-10-02) Oct 2, 2026 · issue 093

GitHub adds REST API endpoints to list, get, add, and edit comments on repository security advisories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Automatically post a triage note to a security advisory when your pipeline finishes analysis — keeping advisory discussion out of the web UI and in your toolchain.

$ curl -X POST \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  https://api.github.com/repos/<owner>/<repo>/security-advisories/<ghsa_id>/comments \
  -d '{"body": "Triage complete: exploitability confirmed on v2.3.1. Patch queued for next release."}'

Check which open advisories already have discussion before pulling full comment threads — useful when triaging a backlog.

$ curl -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  'https://api.github.com/repos/<owner>/<repo>/security-advisories' \
  | jq '[.[] | select(.comments_count > 0) | {ghsa_id, summary, comments_count}]'

Export all advisory comments updated since a given date for an audit trail or migration to another system.

$ curl -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  'https://api.github.com/repos/<owner>/<repo>/security-advisories/<ghsa_id>/comments?since=2026-01-01T00:00:00Z'

Adds GET endpoint to list comments on a repository security advisory, with optional filtering by last-updated time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GET endpoint to retrieve a single comment on a repository security advisory.
Adds POST endpoint to add a comment to a repository security advisory.
Adds PATCH endpoint to edit a comment on a repository security advisory.
Repository security advisory responses now include a comments_count field so callers can identify advisories with discussion before fetching comments.

+1 more show less

Global advisory responses now include the comments_count from their linked repository advisory.

Adds GET endpoint to list comments on a repository security advisory, with optional filtering by last-updated time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GET endpoint to retrieve a single comment on a repository security advisory.
Adds POST endpoint to add a comment to a repository security advisory.
Adds PATCH endpoint to edit a comment on a repository security advisory.

2 more in Everything

Repository security advisory comments API in public preview (2026-10-02) Oct 2, 2026 · issue 015

GitHub adds REST API endpoints to list, get, add, and edit comments on repository security advisories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Automatically post a triage note to a security advisory when your pipeline finishes analysis — keeping advisory discussion out of the web UI and in your toolchain.

$ curl -X POST \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  https://api.github.com/repos/<owner>/<repo>/security-advisories/<ghsa_id>/comments \
  -d '{"body": "Triage complete: exploitability confirmed on v2.3.1. Patch queued for next release."}'

Check which open advisories already have discussion before pulling full comment threads — useful when triaging a backlog.

$ curl -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  'https://api.github.com/repos/<owner>/<repo>/security-advisories' \
  | jq '[.[] | select(.comments_count > 0) | {ghsa_id, summary, comments_count}]'

Export all advisory comments updated since a given date for an audit trail or migration to another system.

$ curl -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  'https://api.github.com/repos/<owner>/<repo>/security-advisories/<ghsa_id>/comments?since=2026-01-01T00:00:00Z'

Adds GET endpoint to list comments on a repository security advisory, with optional filtering by last-updated time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GET endpoint to retrieve a single comment on a repository security advisory.
Adds POST endpoint to add a comment to a repository security advisory.
Adds PATCH endpoint to edit a comment on a repository security advisory.
Repository security advisory responses now include a comments_count field so callers can identify advisories with discussion before fetching comments.

+1 more show less

Global advisory responses now include the comments_count from their linked repository advisory.

Adds GET endpoint to list comments on a repository security advisory, with optional filtering by last-updated time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GET endpoint to retrieve a single comment on a repository security advisory.
Adds POST endpoint to add a comment to a repository security advisory.
Adds PATCH endpoint to edit a comment on a repository security advisory.

2 more in Everything

docs update Oct 2, 2026 · issue 092

GitHub Copilot gains computer use capability to automate desktop application tasks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Rate limits for private vulnerability reports (2026-10-01) Oct 1, 2026 · issue 092

GitHub adds daily rate limits, custom caps, and allow-lists to private vulnerability reporting to block bulk submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Add a trusted security researcher to the allow list so their reports are never blocked by rate limits.

📍1. Go to your repository on GitHub. 2. Click Settings › Advanced Security. 3. Click Settings next to Private vulnerability reporting. 4. Under the allow list section, add the trusted reporter's GitHub account. 5. Save changes.

Set a custom daily reporting cap for your repository to throttle bulk submissions while still accepting legitimate reports.

📍1. Go to your repository on GitHub. 2. Click Settings › Advanced Security. 3. Click Settings next to Private vulnerability reporting. 4. Enter your desired daily overall reporting limit. 5. Save changes.

Applies daily per-user rate limits to new private vulnerability reports, with reporters who hit the limit shown a try again later message; limits do not affect comments on existing advisories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Lets repository administrators set a custom daily overall reporting limit for their repository via the Advanced Security settings.
Lets repository administrators add trusted reporters to an allow list so they are never rate limited, configurable under repository Settings > Advanced Security > Private vulnerability reporting.

3 details in Everything

Rate limits for private vulnerability reports (2026-10-01) Oct 1, 2026 · issue 015

GitHub adds daily rate limits, custom caps, and allow-lists to private vulnerability reporting to block bulk submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Add a trusted security researcher to the allow list so their reports are never blocked by rate limits.

📍1. Go to your repository on GitHub. 2. Click Settings › Advanced Security. 3. Click Settings next to Private vulnerability reporting. 4. Under the allow list section, add the trusted reporter's GitHub account. 5. Save changes.

Set a custom daily reporting cap for your repository to throttle bulk submissions while still accepting legitimate reports.

📍1. Go to your repository on GitHub. 2. Click Settings › Advanced Security. 3. Click Settings next to Private vulnerability reporting. 4. Enter your desired daily overall reporting limit. 5. Save changes.

Applies daily per-user rate limits to new private vulnerability reports, with reporters who hit the limit shown a try again later message; limits do not affect comments on existing advisories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Lets repository administrators set a custom daily overall reporting limit for their repository via the Advanced Security settings.
Lets repository administrators add trusted reporters to an allow list so they are never rate limited, configurable under repository Settings > Advanced Security > Private vulnerability reporting.

3 details in Everything

Structured forms for private vulnerability reports (2026-10-01) Oct 1, 2026 · issue 092

GitHub adds structured, customizable forms for private vulnerability reports, with CWE enforcement, AI-disclosure, and a new API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enforce a structured vulnerability report form with minimum detail requirements across all repositories in your organization.

.github/VULNERABILITY_REPORT.yml

# .github/VULNERABILITY_REPORT.yml in your org's .github repo
name: Vulnerability Report
description: Report a security vulnerability
body:
  - type: textarea
    id: summary
    attributes:
      label: Summary
    validations:
      required: true
      min_length: 50
  - type: textarea
    id: details
    attributes:
      label: Details
    validations:
      required: true
      min_length: 100
  - type: textarea
    id: poc
    attributes:
      label: Proof of Concept
    validations:
      required: true
      min_length: 150
  - type: textarea
    id: impact
    attributes:
      label: Impact
    validations:
      required: true

Require reporters to assign a CWE before submitting, and enforce the setting across your organization via policy.

📍In the repository, go to Settings › Advanced Security › Private vulnerability reporting and enable the option to require a CWE. Organization and enterprise owners can then enforce this setting via a policy applied across all repositories.

Adds .github/VULNERABILITY_REPORT.yml to configure a custom structured form for private vulnerability reports; place the file in your org or account's .github repository to apply it across all repos you own.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Form fields support min_length (issue form syntax) so maintainers can enforce a minimum level of detail per field.
Adds a new REST API endpoint that returns the form a repository enforces, surfaced in error responses when an API submission does not match the custom form.
Default structured form now requires four fields from reporters: summary, details, proof of concept (minimum 150 characters), and impact.
Enables a 'I used AI assistance to find or write up this report' disclosure checkbox for reporters.

+2 more show less

Allows requiring reporters to assign a CWE before submission, configurable from Settings > Advanced Security > Private vulnerability reporting, with enforcement available to organization and enterprise owners via policy.
Repositories with a SECURITY.md security policy now show reporters a banner linking to it before they submit a private vulnerability report.

Adds .github/VULNERABILITY_REPORT.yml to configure a custom structured form for private vulnerability reports; place the file in your org or account's .github repository to apply it across all repos you own.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Form fields support min_length (issue form syntax) so maintainers can enforce a minimum level of detail per field.
Adds a new REST API endpoint that returns the form a repository enforces, surfaced in error responses when an API submission does not match the custom form.
Enables a 'I used AI assistance to find or write up this report' disclosure checkbox for reporters.
Allows requiring reporters to assign a CWE before submission, configurable from Settings > Advanced Security > Private vulnerability reporting, with enforcement available to organization and enterprise owners via policy.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!If you add a custom VULNERABILITY_REPORT.yml form, reports submitted through the REST API must match it — API submissions that do not match will receive an error.

Structured forms for private vulnerability reports (2026-10-01) Oct 1, 2026 · issue 015

GitHub adds structured, customizable forms for private vulnerability reports, with CWE enforcement, AI-disclosure, and a new API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enforce a structured vulnerability report form with minimum detail requirements across all repositories in your organization.

.github/VULNERABILITY_REPORT.yml

# .github/VULNERABILITY_REPORT.yml in your org's .github repo
name: Vulnerability Report
description: Report a security vulnerability
body:
  - type: textarea
    id: summary
    attributes:
      label: Summary
    validations:
      required: true
      min_length: 50
  - type: textarea
    id: details
    attributes:
      label: Details
    validations:
      required: true
      min_length: 100
  - type: textarea
    id: poc
    attributes:
      label: Proof of Concept
    validations:
      required: true
      min_length: 150
  - type: textarea
    id: impact
    attributes:
      label: Impact
    validations:
      required: true

Require reporters to assign a CWE before submitting, and enforce the setting across your organization via policy.

📍In the repository, go to Settings › Advanced Security › Private vulnerability reporting and enable the option to require a CWE. Organization and enterprise owners can then enforce this setting via a policy applied across all repositories.

Adds .github/VULNERABILITY_REPORT.yml to configure a custom structured form for private vulnerability reports; place the file in your org or account's .github repository to apply it across all repos you own.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Form fields support min_length (issue form syntax) so maintainers can enforce a minimum level of detail per field.
Adds a new REST API endpoint that returns the form a repository enforces, surfaced in error responses when an API submission does not match the custom form.
Default structured form now requires four fields from reporters: summary, details, proof of concept (minimum 150 characters), and impact.
Enables a 'I used AI assistance to find or write up this report' disclosure checkbox for reporters.

+2 more show less

Allows requiring reporters to assign a CWE before submission, configurable from Settings > Advanced Security > Private vulnerability reporting, with enforcement available to organization and enterprise owners via policy.
Repositories with a SECURITY.md security policy now show reporters a banner linking to it before they submit a private vulnerability report.

Adds .github/VULNERABILITY_REPORT.yml to configure a custom structured form for private vulnerability reports; place the file in your org or account's .github repository to apply it across all repos you own.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Form fields support min_length (issue form syntax) so maintainers can enforce a minimum level of detail per field.
Adds a new REST API endpoint that returns the form a repository enforces, surfaced in error responses when an API submission does not match the custom form.
Enables a 'I used AI assistance to find or write up this report' disclosure checkbox for reporters.
Allows requiring reporters to assign a CWE before submission, configurable from Settings > Advanced Security > Private vulnerability reporting, with enforcement available to organization and enterprise owners via policy.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!If you add a custom VULNERABILITY_REPORT.yml form, reports submitted through the REST API must match it — API submissions that do not match will receive an error.

GitHub Copilot can now interact with desktop apps with computer use (2026-10-01) Oct 1, 2026 · issue 092

GitHub Copilot gains computer use in public preview, letting it click, type, and navigate desktop apps on macOS and Windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable computer use in Copilot CLI so Copilot can automate a GUI-only desktop workflow — for example, moving data through a legacy expense-report app with no API.

$ /computer on

Check whether computer use is active in the current Copilot CLI session, or turn it off after finishing an automated workflow.

$ /computer show
/computer off

Enable Computer Use from the GitHub Copilot app UI on macOS or Windows when you prefer not to use the CLI.

📍Open the GitHub Copilot app › Settings › Computer Use › turn on Enable Computer Use. On macOS, follow the prompted steps to grant Accessibility and Screen Recording permissions.

Adds /computer on in Copilot CLI to enable computer use, /computer show to check its status, and /computer off to disable it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Computer Use public preview in GitHub Copilot CLI and the GitHub Copilot app on macOS and Windows, letting Copilot interact with desktop applications — clicking controls, entering text, pressing keys, scrolling, dragging, and navigating workflows — including legacy and GUI-only software with no API, CLI, or MCP integration.
Adds a Computer Use settings panel in the GitHub Copilot app (Settings > Computer Use > Enable Computer Use) with per-app approval controls and the ability to review or reset always-allowed apps.
On macOS, guides users through required Accessibility and Screen Recording permissions as part of the computer use setup flow.
Supports organization-managed settings to disable computer use across managed devices.

5 details in Everything

GitHub Copilot can now interact with desktop apps with computer use (2026-10-01) Oct 1, 2026 · issue 015

GitHub Copilot gains computer use in public preview, letting it click, type, and navigate desktop apps on macOS and Windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable computer use in Copilot CLI so Copilot can automate a GUI-only desktop workflow — for example, moving data through a legacy expense-report app with no API.

$ /computer on

Check whether computer use is active in the current Copilot CLI session, or turn it off after finishing an automated workflow.

$ /computer show
/computer off

Enable Computer Use from the GitHub Copilot app UI on macOS or Windows when you prefer not to use the CLI.

📍Open the GitHub Copilot app › Settings › Computer Use › turn on Enable Computer Use. On macOS, follow the prompted steps to grant Accessibility and Screen Recording permissions.

Adds /computer on in Copilot CLI to enable computer use, /computer show to check its status, and /computer off to disable it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Computer Use public preview in GitHub Copilot CLI and the GitHub Copilot app on macOS and Windows, letting Copilot interact with desktop applications — clicking controls, entering text, pressing keys, scrolling, dragging, and navigating workflows — including legacy and GUI-only software with no API, CLI, or MCP integration.
Adds a Computer Use settings panel in the GitHub Copilot app (Settings > Computer Use > Enable Computer Use) with per-app approval controls and the ability to review or reset always-allowed apps.
On macOS, guides users through required Accessibility and Screen Recording permissions as part of the computer use setup flow.
Supports organization-managed settings to disable computer use across managed devices.

5 details in Everything

GitHub Copilot in VS Code, September 2026 releases (2026-10-01) Oct 1, 2026 · issue 092

Copilot in VS Code gains scheduled automations, agent merge, PR creation from sessions, and HydraFusion multi-model orchestration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Hand off post-PR-creation chores to the agent so you can focus on the next task instead of babysitting CI.

📍In the Agents window, open an active agent session, then select Enable agent merge to let the agent automatically respond to review feedback, resolve merge conflicts, rerun failed checks, and merge the pull request when ready.

Run a nightly dependency-audit prompt against your repo without manual intervention.

📍In the Agents window, select New Automation, choose a daily schedule, and enter your prompt (or pick a template) to have Copilot run the task automatically each day.

Run an agent session inside your project's Dev Container so it has access to the exact toolchain and dependencies defined in your devcontainer config.

📍In the Agents window, open the menu for your local or remote folder and select Use Dev Container to launch the agent session inside the configured container (works on SSH, Tunnel, and WSL hosts).

Adds HydraFusion model-picker option (research preview) to automatically select models and workflows for coding tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds automations to schedule recurring agent tasks on an hourly, daily, or weekly cadence, or run them on demand from a template or custom prompt (preview).
Adds agent merge in active sessions (preview) to let the agent handle review feedback, failed checks, merge conflicts, and workflow reruns.
Adds pull request creation directly from Copilot, Claude, or Codex agent sessions in the Agents window, with title/description editing, draft and merge options.
Adds Mark as Done suggestions and automatic cleanup to keep completed sessions organized (preview).

+6 more show less

Adds application badge support (preview) to surface new results, input requests, and PR checks on the dock, launcher, or taskbar.
Adds Use Dev Container option in the Agents window to start agent sessions inside a project's Dev Container on local, SSH, Tunnel, and WSL hosts.
Enables continuing a general Copilot quick chat (started without a workspace) by attaching a local folder mid-conversation.
Enables picking up a Codex conversation from the ChatGPT app inside VS Code to continue work on a codebase without copying context or files.
Adds hierarchical sessions list view so agents can create new chats or sessions and users can navigate back to the source chat via a navigation link.
Adds Add Context entry-point and URL-paste support in the new-session input to attach a GitHub issue or pull request to any chat.

Adds HydraFusion model-picker option (research preview) to automatically select models and workflows for coding tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds automations to schedule recurring agent tasks on an hourly, daily, or weekly cadence, or run them on demand from a template or custom prompt (preview).
Adds agent merge in active sessions (preview) to let the agent handle review feedback, failed checks, merge conflicts, and workflow reruns.
Adds pull request creation directly from Copilot, Claude, or Codex agent sessions in the Agents window, with title/description editing, draft and merge options.
Adds Mark as Done suggestions and automatic cleanup to keep completed sessions organized (preview).

+4 more show less

Adds application badge support (preview) to surface new results, input requests, and PR checks on the dock, launcher, or taskbar.
Adds Use Dev Container option in the Agents window to start agent sessions inside a project's Dev Container on local, SSH, Tunnel, and WSL hosts.
Enables picking up a Codex conversation from the ChatGPT app inside VS Code to continue work on a codebase without copying context or files.
Adds hierarchical sessions list view so agents can create new chats or sessions and users can navigate back to the source chat via a navigation link.

2 more in Everything

GitHub Copilot in VS Code, September 2026 releases (2026-10-01) Oct 1, 2026 · issue 015

Copilot in VS Code gains scheduled automations, agent merge, PR creation from sessions, and HydraFusion multi-model orchestration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Hand off post-PR-creation chores to the agent so you can focus on the next task instead of babysitting CI.

📍In the Agents window, open an active agent session, then select Enable agent merge to let the agent automatically respond to review feedback, resolve merge conflicts, rerun failed checks, and merge the pull request when ready.

Run a nightly dependency-audit prompt against your repo without manual intervention.

📍In the Agents window, select New Automation, choose a daily schedule, and enter your prompt (or pick a template) to have Copilot run the task automatically each day.

Run an agent session inside your project's Dev Container so it has access to the exact toolchain and dependencies defined in your devcontainer config.

📍In the Agents window, open the menu for your local or remote folder and select Use Dev Container to launch the agent session inside the configured container (works on SSH, Tunnel, and WSL hosts).

Adds HydraFusion model-picker option (research preview) to automatically select models and workflows for coding tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds automations to schedule recurring agent tasks on an hourly, daily, or weekly cadence, or run them on demand from a template or custom prompt (preview).
Adds agent merge in active sessions (preview) to let the agent handle review feedback, failed checks, merge conflicts, and workflow reruns.
Adds pull request creation directly from Copilot, Claude, or Codex agent sessions in the Agents window, with title/description editing, draft and merge options.
Adds Mark as Done suggestions and automatic cleanup to keep completed sessions organized (preview).

+6 more show less

Adds application badge support (preview) to surface new results, input requests, and PR checks on the dock, launcher, or taskbar.
Adds Use Dev Container option in the Agents window to start agent sessions inside a project's Dev Container on local, SSH, Tunnel, and WSL hosts.
Enables continuing a general Copilot quick chat (started without a workspace) by attaching a local folder mid-conversation.
Enables picking up a Codex conversation from the ChatGPT app inside VS Code to continue work on a codebase without copying context or files.
Adds hierarchical sessions list view so agents can create new chats or sessions and users can navigate back to the source chat via a navigation link.
Adds Add Context entry-point and URL-paste support in the new-session input to attach a GitHub issue or pull request to any chat.

Adds HydraFusion model-picker option (research preview) to automatically select models and workflows for coding tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds automations to schedule recurring agent tasks on an hourly, daily, or weekly cadence, or run them on demand from a template or custom prompt (preview).
Adds agent merge in active sessions (preview) to let the agent handle review feedback, failed checks, merge conflicts, and workflow reruns.
Adds pull request creation directly from Copilot, Claude, or Codex agent sessions in the Agents window, with title/description editing, draft and merge options.
Adds Mark as Done suggestions and automatic cleanup to keep completed sessions organized (preview).

+4 more show less

Adds application badge support (preview) to surface new results, input requests, and PR checks on the dock, launcher, or taskbar.
Adds Use Dev Container option in the Agents window to start agent sessions inside a project's Dev Container on local, SSH, Tunnel, and WSL hosts.
Enables picking up a Codex conversation from the ChatGPT app inside VS Code to continue work on a codebase without copying context or files.
Adds hierarchical sessions list view so agents can create new chats or sessions and users can navigate back to the source chat via a navigation link.

2 more in Everything

Actions retention now covers checks, runs, and statuses (2026-10-01) Oct 1, 2026 · issue 092

GitHub Actions retention now governs checks, workflow runs, and statuses alongside artifacts and logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Review or update your repository's unified retention period so checks, runs, and statuses are kept as long as your audit or compliance workflow requires.

📍In the repository, go to Settings › Actions › General, then locate 'Check, workflow run, status, artifact and log retention' and set the desired number of days (max 90 for public repositories).

Extends the existing Actions retention setting — labeled Check, workflow run, status, artifact and log retention in the UI — to also clean up checks, workflow runs, and statuses created by GitHub Actions and third-party applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Caps public repository retention for checks, workflow runs, and statuses at a maximum of 90 days.

Extends the existing Actions retention setting — labeled Check, workflow run, status, artifact and log retention in the UI — to also clean up checks, workflow runs, and statuses created by GitHub Actions and third-party applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

└──▷ BREAKING ON UPGRADE

!Checks, workflow runs, and statuses older than the configured retention period are now automatically deleted — including those created by third-party applications. Data already removed before this change cannot be restored.

Actions retention now covers checks, runs, and statuses (2026-10-01) Oct 1, 2026 · issue 015

GitHub Actions retention now governs checks, workflow runs, and statuses alongside artifacts and logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Review or update your repository's unified retention period so checks, runs, and statuses are kept as long as your audit or compliance workflow requires.

📍In the repository, go to Settings › Actions › General, then locate 'Check, workflow run, status, artifact and log retention' and set the desired number of days (max 90 for public repositories).

Extends the existing Actions retention setting — labeled Check, workflow run, status, artifact and log retention in the UI — to also clean up checks, workflow runs, and statuses created by GitHub Actions and third-party applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Caps public repository retention for checks, workflow runs, and statuses at a maximum of 90 days.

Extends the existing Actions retention setting — labeled Check, workflow run, status, artifact and log retention in the UI — to also clean up checks, workflow runs, and statuses created by GitHub Actions and third-party applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

└──▷ BREAKING ON UPGRADE

!Checks, workflow runs, and statuses older than the configured retention period are now automatically deleted — including those created by third-party applications. Data already removed before this change cannot be restored.

Dynamic workflows in Copilot CLI and the Copilot app (2026-10-01) Oct 1, 2026 · issue 092

GitHub Copilot gains dynamic workflows — code-defined, multi-agent orchestration now in CLI, app, and SDK.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable dynamic workflows in Copilot CLI to orchestrate a multi-agent incident investigation across logs and telemetry.

$ gh copilot --experimental

Turn on experimental features mid-session and discover existing dynamic workflows without restarting the CLI.

$ /experimental on
What dynamic workflows are available?

Have Copilot author a reusable release-check workflow that pauses for human review before resuming.

📍Ask Copilot: 'Create a dynamic workflow that runs release checks, asks one agent to assess failures, and pauses at a checkpoint for me to review before resuming.'

Enables dynamic workflows in the Copilot CLI via the --experimental command-line option or /experimental on in an interactive session, allowing code-defined multi-agent orchestration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds dynamic workflows to the GitHub Copilot app with no setup required, supporting parallel agent execution, checkpoints, and structured result passing.
Introduces dynamic workflows in the GitHub Copilot SDK, giving extension authors programmatic access to Copilot's extensibility APIs for multi-step, multi-agent processes.
Supports pause-and-resume checkpoints in dynamic workflows, letting practitioners review intermediate findings before continuing a long or expensive run.
Supports parallel sub-agent execution within a dynamic workflow, enabling tasks like reviewing many pull-request files or sweeping a large codebase across directories simultaneously.

+1 more show less

Includes built-in Copilot authoring guidance so practitioners can ask Copilot to write a dynamic workflow entirely for them, or use 'What dynamic workflows are available?' to discover existing ones.

6 details in Everything

Dynamic workflows in Copilot CLI and the Copilot app (2026-10-01) Oct 1, 2026 · issue 015

GitHub Copilot gains dynamic workflows — code-defined, multi-agent orchestration now in CLI, app, and SDK.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable dynamic workflows in Copilot CLI to orchestrate a multi-agent incident investigation across logs and telemetry.

$ gh copilot --experimental

Turn on experimental features mid-session and discover existing dynamic workflows without restarting the CLI.

$ /experimental on
What dynamic workflows are available?

Have Copilot author a reusable release-check workflow that pauses for human review before resuming.

📍Ask Copilot: 'Create a dynamic workflow that runs release checks, asks one agent to assess failures, and pauses at a checkpoint for me to review before resuming.'

Enables dynamic workflows in the Copilot CLI via the --experimental command-line option or /experimental on in an interactive session, allowing code-defined multi-agent orchestration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds dynamic workflows to the GitHub Copilot app with no setup required, supporting parallel agent execution, checkpoints, and structured result passing.
Introduces dynamic workflows in the GitHub Copilot SDK, giving extension authors programmatic access to Copilot's extensibility APIs for multi-step, multi-agent processes.
Supports pause-and-resume checkpoints in dynamic workflows, letting practitioners review intermediate findings before continuing a long or expensive run.
Supports parallel sub-agent execution within a dynamic workflow, enabling tasks like reviewing many pull-request files or sweeping a large codebase across directories simultaneously.

+1 more show less

Includes built-in Copilot authoring guidance so practitioners can ask Copilot to write a dynamic workflow entirely for them, or use 'What dynamic workflows are available?' to discover existing ones.

6 details in Everything

Opt-in dist-tag permissions for npm trusted publishing (2026-09-30) Sep 30, 2026 · issue 091

GitHub npm trusted publishing now supports opt-in dist-tag management via short-lived OIDC credentials, eliminating the last long-lived token requirement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable OIDC-based dist-tag management on a package so CI can promote a release to latest without storing a long-lived npm token.

📍In your package's trusted publishing settings, locate the configuration that handles releases, then enable Allow npm dist-tag on that configuration.

Adds an opt-in Allow npm dist-tag permission to each trusted publishing configuration, enabling dist-tag operations (promoting to latest, updating next and beta pointers) via short-lived OIDC credentials instead of a long-lived access token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Allows staging-only trusted publishing configurations to independently receive dist-tag management permission, without requiring direct publish access.
Authorizes a dist-tag operation when the incoming OIDC token matches any one configuration that has Allow npm dist-tag enabled, leaving existing token-based dist-tag management unchanged.

Adds an opt-in Allow npm dist-tag permission to each trusted publishing configuration, enabling dist-tag operations (promoting to latest, updating next and beta pointers) via short-lived OIDC credentials instead of a long-lived access token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

GitHub Advanced Security trials for GitHub Team (2026-09-30) Sep 30, 2026 · issue 091

GitHub Team orgs can now self-serve trial GitHub Advanced Security (Code Security + Secret Protection) without contacting sales.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Start a GitHub Advanced Security trial directly from your organization's billing settings without contacting sales.

📍In your GitHub organization, go to Settings › Billing and licensing › Licensing, then select Start trial under GitHub Advanced Security.

HydraFusion in VS Code and the GitHub Copilot app (2026-09-30) Sep 30, 2026 · issue 091

HydraFusion multi-model orchestrator expands to VS Code and the GitHub Copilot app, adding cascade and critique workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enable HydraFusion in VS Code when it does not appear in the model picker — useful for early adopters or orgs where the feature is not yet visible by default.

.vscode/settings.json

chat.copilot.hydraFusion.enabled

Turn on HydraFusion in the GitHub Copilot app to access multi-model orchestration on mobile or desktop outside VS Code.

📍In the GitHub Copilot app: go to Settings, search for HydraFusion, turn it on, then select HydraFusion from the model picker.

Enables chat.copilot.hydraFusion.enabled in VS Code 1.140+ to activate HydraFusion from the Copilot Chat model picker when it does not appear automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds HydraFusion to VS Code (version 1.140 or later, including VS Code Insiders) and the GitHub Copilot app, expanding beyond Copilot CLI.
Introduces three selectable orchestration workflows — Single, Cascade, and Critique — where HydraFusion picks the most efficient execution pattern per task instead of routing to a single model.
Adds real-time, more frequent progress updates so practitioners can track HydraFusion workflow steps and status during long-running tasks.

Enables chat.copilot.hydraFusion.enabled in VS Code 1.140+ to activate HydraFusion from the Copilot Chat model picker when it does not appear automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces three selectable orchestration workflows — Single, Cascade, and Critique — where HydraFusion picks the most efficient execution pattern per task instead of routing to a single model.

2 more in Everything

Repository custom runner settings for Dependabot (2026-09-29) Sep 29, 2026 · issue 090

Repository admins can now configure runner type, custom label, and runner group for Dependabot jobs at the repository level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Route Dependabot jobs to a self-hosted runner with access to a private package registry by setting a custom runner label at the repository level.

📍1. Go to your repository on github.com. 2. Navigate to Settings › Advanced Security. 3. Under Dependency scanning, find Dependabot version updates and click Runner type. 4. Select Labeled runner. 5. Enter your custom label (e.g. your self-hosted runner label) and optionally a runner group. 6. Save the configuration.

Adds repository-level runner configuration for Dependabot version and security updates, letting admins choose Labeled runner or Standard GitHub runner under Settings > Advanced Security > Dependency scanning > Dependabot version updates > Runner type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports optional custom runner label and runner group when Labeled runner is selected; defaults to the dependabot label if no label is specified.
Enables Dependabot jobs to target self-hosted runners or larger GitHub-hosted runners — useful for access to private package registries or specialized build environments.
Repository-level runner settings are available for private and internal repositories on github.com; hidden for public repositories and not available on GitHub Enterprise Server.

Adds repository-level runner configuration for Dependabot version and security updates, letting admins choose Labeled runner or Standard GitHub runner under Settings > Advanced Security > Dependency scanning > Dependabot version updates > Runner type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports optional custom runner label and runner group when Labeled runner is selected; defaults to the dependabot label if no label is specified.
Repository-level runner settings are available for private and internal repositories on github.com; hidden for public repositories and not available on GitHub Enterprise Server.

1 more in Everything

Bring business context with external custom properties (2026-09-29) Sep 29, 2026 · issue 090

GitHub adds external custom properties (public preview) to sync read-only business context from CMDBs and developer portals into repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds external custom properties APIs, letting enterprise integrations push read-only repository metadata (ownership, service tier, lifecycle stage, compliance status) from an external system of record into GitHub under a dedicated namespace prefix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports external custom properties everywhere standard custom properties work today, including repository views, repository filtering, and ruleset targeting.
Port.io is the first partner integration for external custom properties, with a published integration guide for syncing business context to GitHub.

Adds external custom properties APIs, letting enterprise integrations push read-only repository metadata (ownership, service tier, lifecycle stage, compliance status) from an external system of record into GitHub under a dedicated namespace prefix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Port.io is the first partner integration for external custom properties, with a published integration guide for syncing business context to GitHub.

1 more in Everything

GPT-6.1 Sol in GitHub Copilot (2026-09-29) Sep 29, 2026 · issue 090

GitHub: Adds GPT-6.1 Sol as a selectable model in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, the Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Select GPT-6.1 Sol for an agentic coding session in VS Code when you want fewer steps and lower token usage on multistep tasks.

📍In GitHub Copilot Chat (VS Code, JetBrains, or any supported IDE), open the model picker dropdown and select GPT-6.1 Sol, then issue your agentic coding prompt as normal.

Restrict or permit GPT-6.1 Sol org-wide before rollout reaches all users, so your Business or Enterprise policy is set before developers encounter it.

📍In GitHub Copilot settings (Business or Enterprise admin), go to Policies › Model policy, locate GPT-6.1 Sol under Default model enablement, and toggle access on or off.

Self-hosted runner version enforcement date has moved (2026-09-28) Sep 28, 2026 · issue 089

New REST API for runner version deprecations lets you query registration and runtime deprecation dates for any self-hosted runner version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ BREAKING ON UPGRADE

!Self-hosted runners below version 2.329.0 on GitHub Enterprise Cloud will not be able to register or reregister starting September 29, 2026; existing runners below the minimum runtime version will stop executing workflow jobs even if previously registered.

Claude Sonnet 5.5 in GitHub Copilot (2026-09-28) Sep 28, 2026 · issue 089

Claude Sonnet 5.5 is now generally available in GitHub Copilot across all supported clients and IDEs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Select Claude Sonnet 5.5 for an agentic coding task in VS Code to take advantage of its faster, lower-token execution on well-scoped feature work.

📍In GitHub Copilot (VS Code, JetBrains, or github.com), open the model picker and select Claude Sonnet 5.5, then submit your Copilot Chat or coding agent prompt as normal.

As a Copilot Enterprise or Business admin, control which users can access Claude Sonnet 5.5 before the gradual rollout reaches your org.

📍Navigate to your organization's Copilot settings › model policy, then enable or disable Claude Sonnet 5.5 under the default model enablement controls.

Copilot Enterprise and Business administrators can manage access to Claude Sonnet 5.5 via the model policy in Copilot settings, with new models automatically enabled under default model enablement unless the global default is off or the model is explicitly disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Enterprise managed settings in-product validator (2026-09-25) Sep 25, 2026 · issue 086

GitHub Copilot enterprise managed settings now include an in-product validator that catches malformed JSON, bad team mappings, and unsupported configs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

After editing Copilot managed settings, confirm your configuration is valid before policies take effect.

📍1. In your GitHub Enterprise account, go to Settings › Copilot › Enterprise AI controls. 2. Scroll to the Copilot settings validation section. 3. Review any listed issues — each shows the affected file (copilot/managed-settings.json or copilot/team-mappings.json) and the exact JSON path. 4. Fix the identified errors and commit to the default branch of your .github-private repository. 5. Reload the Agents page and re-check the validator to confirm no issues remain.

Usage metrics API adds pull request review stages (2026-09-25) Sep 25, 2026 · issue 086

Copilot usage metrics API gains pull_request_review_times array with per-stage PR review durations at median and p90.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds pull_request_review_times array to each repos-1-day row in the enterprise and organization Copilot usage metrics API, reporting median_minutes_ready_to_first_review, p90_minutes_ready_to_first_review, median_minutes_first_to_final_review, p90_minutes_first_to_final_review, median_minutes_final_review_to_merge, and p90_minutes_final_review_to_merge — all durations in minutes, attributed to the day the pull request merged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Each pull_request_review_times entry includes authored_by, reviewed_by (both human in this release), and total_merged to identify which pull requests contribute to each timing row.
Available to enterprise owners, billing managers, organization owners, and custom roles with the View Copilot Metrics Permission when the Copilot usage metrics policy is enabled; returns [] on days with no qualifying pull requests.

3 details in Everything

Private saved views for repository issues and “Relates to” issue relationship is generally available (2026-09-25) Sep 25, 2026 · issue 086

GitHub adds private saved views for repository issues and GA Relates to issue relationships across APIs, webhooks, and search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Save a personal filtered view of open issues assigned to you on a repository issues page so you can return to it quickly.

📍1. Navigate to your repository's Issues tab. 2. Apply your desired filters (e.g., assignee, label, milestone). 3. Click Save view and select Private to store the view visible only to you.

Adds Relates to issue relationship support to the REST API, GraphQL API, webhooks, timeline events, issues search, and projects search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds private saved views for repository issues pages, letting users create and save personalized issue filters.

2 details in Everything

GitHub Copilot weekly releases — September 21 (2026-09-25) Sep 25, 2026 · issue 086

Copilot gains Claude Opus 5.5, GPT-6, Grok 4.7, local sandboxing with OpenTelemetry, and new Slack/JetBrains/VS Code capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds local sandboxing in the GitHub Copilot app (public preview) to limit agents' access to files, networks, and credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds OpenTelemetry support in the GitHub Copilot app to track agent activity in existing monitoring tools, configured through enterprise-managed settings.
Adds Claude Opus 5.5 model to Copilot Pro+, Max, Business, and Enterprise plans.
Adds GPT-6 Sol model to Copilot Pro+, Max, Business, and Enterprise plans.
Adds GPT-6 Luna model to Copilot Pro, Pro+, Max, Business, and Enterprise plans.

+11 more show less

Adds Grok 4.7 model to Copilot Pro, Pro+, Max, Business, and Enterprise plans.
Adds assisted approvals (public preview) to Copilot agent sessions in JetBrains, automatically approving low-risk tool calls while prompting for higher-risk actions.
Enables running agents in Dev Containers on SSH, Tunnel, and WSL hosts in VS Code 1.139, using the remote project's tools and dependencies.
Supports model switching mid-conversation in Copilot in Slack and Microsoft Teams, with Copilot retaining the chosen model for the rest of the thread.
Enables setting per-channel model defaults in Copilot in Slack.
Adds duplicate-issue detection in Copilot in Slack and Microsoft Teams, checking for similar existing issues before creating a new one.
Supports sharing files, attachments, and message links as context for Copilot in Slack.
Adds message-editing to redirect agent sessions in JetBrains — Copilot rewinds both the conversation and file changes before sending the replacement request.
Enables shared organization and enterprise skills, and organization-managed custom instructions, in local and Copilot agent sessions in JetBrains.
Adds Compact View for session lists in VS Code, with filters to hide empty groups and the ability to rename sessions and chats directly in the list.
Adds a layout option (preview) in VS Code to choose between separate chat tabs or a single active-chat view within a session.

Adds local sandboxing in the GitHub Copilot app (public preview) to limit agents' access to files, networks, and credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds OpenTelemetry support in the GitHub Copilot app to track agent activity in existing monitoring tools, configured through enterprise-managed settings.
Adds Claude Opus 5.5 model to Copilot Pro+, Max, Business, and Enterprise plans.
Adds GPT-6 Sol model to Copilot Pro+, Max, Business, and Enterprise plans.
Adds GPT-6 Luna model to Copilot Pro, Pro+, Max, Business, and Enterprise plans.

+9 more show less

Adds Grok 4.7 model to Copilot Pro, Pro+, Max, Business, and Enterprise plans.
Adds assisted approvals (public preview) to Copilot agent sessions in JetBrains, automatically approving low-risk tool calls while prompting for higher-risk actions.
Enables running agents in Dev Containers on SSH, Tunnel, and WSL hosts in VS Code 1.139, using the remote project's tools and dependencies.
Enables setting per-channel model defaults in Copilot in Slack.
Adds duplicate-issue detection in Copilot in Slack and Microsoft Teams, checking for similar existing issues before creating a new one.
Supports sharing files, attachments, and message links as context for Copilot in Slack.
Adds message-editing to redirect agent sessions in JetBrains — Copilot rewinds both the conversation and file changes before sending the replacement request.
Adds Compact View for session lists in VS Code, with filters to hide empty groups and the ability to rename sessions and chats directly in the list.
Adds a layout option (preview) in VS Code to choose between separate chat tabs or a single active-chat view within a session.

2 more in Everything

Updates to GitHub Copilot for Slack and Microsoft Teams (2026-09-25) Sep 25, 2026 · issue 086

GitHub Copilot in Slack and Teams gains file/image context, model switching, and default owner/repo settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Route all Copilot-created issues and PRs to the right repo by default, so teammates don't have to specify it on every request in a shared Slack channel.

📍In Slack, open the GitHub app settings and set Default owner and Default repository for your workspace, then mention @GitHub in any channel to create work without specifying the repo each time.

Give Copilot richer context in a Teams thread by forwarding a message from another channel before asking it to draft an issue.

📍In Microsoft Teams, forward the relevant message into the current thread, then mention @GitHub and ask it to create an issue — Copilot will use the forwarded-message context and thread history in its response.

Adds support for setting default owners and repositories in Slack so Copilot knows where to create work without per-message prompting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports inline images, forwarded-message context, and channel and thread history as context in Microsoft Teams.
Enables switching models mid-conversation for the next message, with the choice persisting throughout that conversation.
Copilot now checks for similar existing issues before creating a new one, and includes direct links to created work and back to the originating conversation.

Adds support for setting default owners and repositories in Slack so Copilot knows where to create work without per-message prompting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables switching models mid-conversation for the next message, with the choice persisting throughout that conversation.

2 more in Everything

CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support (2026-09-25) Sep 25, 2026 · issue 085

CodeQL 2.27.1 adds new C/C++ and C# queries, Kotlin 2.4.20 support, and expanded data flow models for Go, Rust, and JS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds the cpp/ambiguous-assignment-of-comparison query to detect expressions that assign a comparison result to a variable and use the assignment as a truth value.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds the cs/linq/missed-firstordefault query to identify foreach loops that can be rewritten with LINQ's FirstOrDefault method.
Supports Kotlin 2.4.20 in CodeQL's Java/Kotlin analysis.
Adds taint flow models for boost::asio::ip::basic_resolver::resolve, flow summaries for BloombergLP::bdlbb::Blob, and flow summaries for the google::protobuf::MessageLite C++ API, improving C/C++ taint tracking.
Adds data flow models for Go 1.27 standard-library APIs including bytes.CutLast, database/sql.ConvertAssign, database/sql/driver.RowsColumnScanner.ScanColumn, net/url.URL.Clone, net/url.Values.Clone, strings.CutLast, and the new encoding/json/jsontext package.

+6 more show less

Expands data flow models for Go's strings package, covering Clone, Cut, CutPrefix, CutSuffix, Fields, FieldsFunc, Join, Builder, Reader, and Replacer APIs.
Adds data flow models for Rust's core::fmt::Write, improving detection of vulnerabilities where tainted data is written to formatted output buffers.
Recognizes Fastify servers configured through chainable methods such as fastify().withTypeProvider() and fastify().setValidatorCompiler(...), improving route attribution for queries like js/missing-rate-limiting.
The cs/web/missing-token-validation query now recognizes ASP.NET Core's AutoValidateAntiforgeryTokenAttribute when registered as a global MVC filter through AddControllersWithViews and related methods.
The actions/unpinned-tag query no longer flags actions pinned by a structurally valid .github/workflows/actions.lock entry for the enclosing workflow.
Private NuGet registries with the Replaces base option enabled in the organization-level private registry configuration now replace default NuGet feeds whenever CodeQL downloads dependencies.

Adds the cpp/ambiguous-assignment-of-comparison query to detect expressions that assign a comparison result to a variable and use the assignment as a truth value.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds the cs/linq/missed-firstordefault query to identify foreach loops that can be rewritten with LINQ's FirstOrDefault method.

9 more in Everything

Default Enablement of Copilot features for Copilot Business and Enterprise (2026-09-25) Sep 25, 2026 · issue 086

└──▷ HOW TO FIND IT

Prevent any new generally available Copilot features from rolling out to users automatically until an administrator explicitly approves them.

📍In the GitHub enterprise admin console, go to AI Controls › Copilot › Default policy for new features and select Disabled.

Delegate Copilot feature rollout decisions to individual organization admins rather than setting a single enterprise-wide default.

📍In the GitHub enterprise admin console, go to AI Controls › Copilot › Default policy for new features and select Let organizations decide.

└──▷ BREAKING ON UPGRADE

!Starting October 22, any eligible generally available Copilot feature left Unconfigured will automatically follow the global default policy — meaning features that were previously unconfigured (and therefore inaccessible) may become enabled enterprise-wide if the default is set to Enabled.

Default Enablement of Copilot Features for Copilot Business and Enterprise (2026-09-25) Sep 25, 2026 · issue 085

GitHub Copilot admins can now set a global default policy for all new GA features under AI Controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Prevent all future GA Copilot features from being silently enabled for your enterprise users until an admin explicitly approves them.

📍In GitHub, go to your enterprise settings › AI Controls › Copilot › Features & clients (https://github.com/enterprises/YOUR-ENTERPRISE-SLUG/ai-controls/copilot/features), then under Default policy for new features select Disabled.

Adds a Default policy for new features setting under the AI Controls > Copilot > Features & clients admin page, with options Enabled, Disabled, and Let organizations decide, controlling whether current and future eligible Copilot features are available to users by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Extends the global default policy to cover the Copilot Code Review policy on the Agents page and the MCP servers in Copilot policy, in addition to features managed on the Features & clients page.

Adds a Default policy for new features setting under the AI Controls > Copilot > Features & clients admin page, with options Enabled, Disabled, and Let organizations decide, controlling whether current and future eligible Copilot features are available to users by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

└──▷ BREAKING ON UPGRADE

!Starting October 22, any Copilot feature left Unconfigured at the enterprise level will automatically follow the new global default policy (Enabled, Disabled, or Let organizations decide), which may change feature availability for users without an explicit administrator decision.

Require proof of presence for high-impact actions (2026-09-24) Sep 24, 2026 · issue 085

GitHub Enterprise Cloud adds proof-of-presence re-authentication before high-impact actions for Entra ID EMU enterprises.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports two proof-of-presence requirement levels — re-authentication (password-level IdP sign-in) and MFA (authenticator app or biometric as configured in Entra ID) — allowing enterprises to set custom IdP policies governing which actions trigger which level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
After a successful proof-of-presence challenge, the verified session remains elevated for two hours in the same browser session, matching the existing sudo mode session model.

Supports two proof-of-presence requirement levels — re-authentication (password-level IdP sign-in) and MFA (authenticator app or biometric as configured in Entra ID) — allowing enterprises to set custom IdP policies governing which actions trigger which level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

More ways to request and configure Copilot code reviews (2026-09-23) Sep 23, 2026 · issue 084

GitHub Copilot code review adds per-user effort controls on all plans and an enterprise-wide default effort setting for org repos.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable automatic Copilot reviews — including on new pushes and draft PRs — and set a default effort level so every PR you open gets reviewed at your chosen depth without manual configuration.

📍In GitHub, go to your profile → Copilot settings → Code review. Enable Automatic reviews, toggle on New pushes and Draft pull requests, then set Default review effort to Balanced.

Standardize Copilot review depth across all org-owned repositories in an enterprise, so teams without their own override inherit a consistent baseline.

📍As an enterprise administrator, go to your enterprise settings → Copilot → Code review, and set the enterprise-wide Default review effort to Lite, Balanced, or GitHub default.

Adds a dedicated code review page under profile → Copilot settings, available on every Copilot plan (including Business and Enterprise), with separate toggles for automatic reviews on PR creation, new pushes, and draft PRs you create or coauthor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a personal default review effort setting (Lite or Balanced) on the Copilot code review settings page, applying to all reviews you request — including automatic ones — while still allowing per-request overrides from the Reviewers panel.
Adds an enterprise-wide default review effort setting (Lite, Balanced, or GitHub default) for organization-owned repositories, configurable by enterprise administrators, with organization- and repository-level overrides still permitted.

3 details in Everything

Local sandboxing in the GitHub Copilot app (2026-09-23) Sep 23, 2026 · issue 084

GitHub Copilot app gains per-project local sandboxing to restrict file, network, and credential access during agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable sandboxing mid-session on an active local Copilot session without altering the project-level default.

$ /sandbox on

Turn on sandboxing for all new sessions in a project via the app settings UI.

📍1. Open the GitHub Copilot app settings. 2. Select your project. 3. Under Sandbox, enable Sandbox new sessions. 4. Configure filesystem (read/write, read-only, denied folders), network (outbound internet, local network), and credential (Git credentials, GitHub CLI credentials) policies as needed.

Adds /sandbox on command to enable sandboxing for an already-running local session without changing the project default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds per-project sandbox settings in the GitHub Copilot app covering filesystem (additional read/write, read-only, and denied folder lists), outbound internet and local network controls, and Git/GitHub CLI credential access for local repository and working tree sessions.
Enforces hard failure — the sandboxed shell errors out rather than silently running without a sandbox — when the OS cannot enforce the requested policy.

3 details in Everything

OpenTelemetry in the GitHub Copilot app (2026-09-23) Sep 23, 2026 · issue 083

GitHub Copilot app gains OpenTelemetry support via enterprise managed-settings.json, enabling centralized agent observability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Enable OTel export for all developers in your enterprise so agent sessions flow into your existing monitoring stack without per-developer configuration.

managed-settings.json

{
  "telemetry": {
    "endpoint": "https://otel-collector.example.com"
  }
}

Adds a telemetry property to managed-settings.json for enterprise-managed Copilot settings to enable OTel export and specify the receiving endpoint, with prompt/response content excluded by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports sending Copilot agent activity data — including AI model requests, tool calls, and step-by-step execution traces — to any OpenTelemetry-compatible monitoring backend.

2 details in Everything

New features and improvements in Copilot for JetBrains (2026-09-23) Sep 23, 2026 · issue 083

GitHub Copilot for JetBrains 1.18.0 adds AI-assisted tool approvals, re-editable agent messages, org-shared skills, and Codex plan mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Use Codex plan mode to review and shape an agent's approach before it touches any files — useful for high-impact refactors or unfamiliar codebases.

📍In the Copilot tool window, open a Codex agent session, describe your task, and select Plan mode. Review the generated plan, refine the steps, then approve it to let the agent begin implementation.

Disable the built-in GitHub MCP Server to avoid conflicts with a custom MCP configuration while keeping your other manually configured MCP servers active.

📍In the Copilot tool window, open MCP tool settings, locate the labeled 'built-in GitHub MCP Server' entry, and toggle it off. Manually configured MCP servers remain unaffected.

Adds a setting to toggle the built-in GitHub MCP Server on or off independently of manually configured MCP servers, which remains enabled by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds persistent per-tool controls for MCP servers in Copilot agent sessions, letting you enable or disable individual tools without affecting others.
Introduces AI-assisted tool approvals (assisted approvals) in public preview for Copilot agent sessions, automatically approving low-risk tool calls while still prompting for higher-risk actions.
Enables re-editing of previous user messages in a Copilot agent session, rewinding both the conversation and file changes before the replacement message is sent.
Adds plan mode to the Codex agent, letting you review, refine, or approve a plan before the agent begins making changes.

+3 more show less

Extends local and Copilot agent sessions to support organization and enterprise skills and organization-managed custom instructions.
Adds a side-by-side chat panel switcher in the session toolbar, letting you keep a chat open in the editor while browsing sessions in the tool window.
Adds browsable usage tips above the chat input with shortcuts to commands, customizations, and settings.

Adds a setting to toggle the built-in GitHub MCP Server on or off independently of manually configured MCP servers, which remains enabled by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds persistent per-tool controls for MCP servers in Copilot agent sessions, letting you enable or disable individual tools without affecting others.
Introduces AI-assisted tool approvals (assisted approvals) in public preview for Copilot agent sessions, automatically approving low-risk tool calls while still prompting for higher-risk actions.
Enables re-editing of previous user messages in a Copilot agent session, rewinding both the conversation and file changes before the replacement message is sent.
Adds plan mode to the Codex agent, letting you review, refine, or approve a plan before the agent begins making changes.

+1 more show less

Adds a side-by-side chat panel switcher in the session toolbar, letting you keep a chat open in the editor while browsing sessions in the tool window.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!Inline chat and its entry points are now hidden in JetBrains Gateway and remote development environments.

Faster C++ code intelligence with whole codebase indexing (2026-09-22) Sep 22, 2026 · issue 083

GitHub Copilot CLI gains whole codebase indexing for C++, building a persistent symbol index across all project files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Check how far along the initial C++ index build is while working in a large repository.

$ /lsp logs

Adds the /lsp logs command to check C++ whole codebase indexing progress at any time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Claude Opus 5.5 is now available in GitHub Copilot (2026-09-22) Sep 22, 2026 · issue 083

Claude Opus 5.5 is now available in GitHub Copilot for agentic coding and long-running tasks across all major IDEs and clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Select Claude Opus 5.5 in your IDE to handle long-running agentic coding tasks that benefit from efficient multistep error recovery.

📍In the Copilot model picker (Visual Studio Code, JetBrains, Xcode, Eclipse, or github.com), select Claude Opus 5.5 from the model list.

Adds Claude Opus 5.5 to the Copilot model picker in Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

OpenAI’s GPT-6 Sol and GPT-6 Luna now available (2026-09-22) Sep 22, 2026 · issue 083

GitHub Copilot adds GPT-6 Sol and GPT-6 Luna as selectable models across VS Code, CLI, mobile, and IDEs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Switch to GPT-6 Luna in Copilot CLI for fast, low-cost inline suggestions during a code review session.

📍In Copilot CLI, open the model picker and select GPT-6 Luna before running your query.

As a Copilot Business admin, restrict which GPT-6 models are available to your organisation before rollout completes.

📍In GitHub, go to your organisation's Copilot settings › model policy, then locate the GPT-6 model entries and disable any models you do not want enabled by default.

Adds GPT-6 Sol to GitHub Copilot as a balanced model for interactive and agentic coding with multistep validation, available on Copilot Pro+, Max, Business, and Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GPT-6 Luna to GitHub Copilot as a lightweight, cost-efficient model for smaller and faster tasks — the lowest-cost option in the GPT-6 family — available on Copilot Pro, Pro+, Max, Business, and Enterprise plans.

2 details in Everything

Security improvements for SSH (2026-09-22) Sep 22, 2026 · issue 083

GitHub SSH gains post-quantum mlkem768x25519-sha256 key exchange and enforces 3072-bit minimum RSA key sizes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Generate a new Ed25519 key (recommended) or a compliant 3072-bit RSA key before the October 14 deadline to avoid connection failures.

$ ssh-keygen -t ed25519 -C "your_email@example.com"
# or, if RSA is required for compatibility:
ssh-keygen -t rsa -b 3072 -C "your_email@example.com"

Adds mlkem768x25519-sha256 post-quantum key exchange for SSH sessions on github.com and GitHub Enterprise Cloud with Data Residency (excluding the U.S.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ region), with GitHub Enterprise Server support in version 3.24.
Enforces a minimum RSA SSH key size of 3072 bits for all new keys uploaded after October 14, 2026, for both signing and authentication.

Adds mlkem768x25519-sha256 post-quantum key exchange for SSH sessions on github.com and GitHub Enterprise Cloud with Data Residency (excluding the U.S.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ region), with GitHub Enterprise Server support in version 3.24.

1 more in Everything

└──▷ BREAKING ON UPGRADE

!The ssh-rsa signature type (RSA keys using SHA-1, including ssh-rsa-cert-v01@openssh.com certificates) will be removed effective January 13, 2026 (brownouts November 4 and December 9, 2026); connections using it will fail.
!The diffie-hellman-group-exchange-sha256 key exchange algorithm will be removed on the same schedule; SSH clients relying on it will be unable to connect.
!New RSA SSH keys uploaded after October 14, 2026 must be at least 3072 bits; smaller keys will be rejected.

Refreshed repository pull requests page generally available (2026-09-22) Sep 22, 2026 · issue 082

GitHub's refreshed pull requests page is now GA, with AND/OR advanced search, bulk actions, and a collapsible sidebar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Narrow a busy repository's PR list to open, approved PRs that still need a specific team's attention — combining OR and AND in one query.

📍In the repository pull requests page, enter into the search bar: is:open review:approved AND (involves:@my-org/security-team OR involves:@my-org/platform-team)

Quickly close or re-label a batch of stale PRs without opening each one individually.

📍In the repository pull requests page, check the checkboxes next to the target pull requests, then open the Label or Close bulk-action menu that appears at the top of the list.

Advanced search on the pull requests page now supports AND and OR keywords as well as nested searches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Bulk actions let you close, label, or change milestones on one or more pull requests at once.
Collapsible sidebar provides quick access to common filters such as Authored by me and Involves me, and can be collapsed to expand the list view.
Compact presentation mode fits more pull requests on the page.
Pull request list now surfaces status check counts, stack indicators, and unread-update indicators.

+3 more show less

Clicking a review status in the list filters pull requests by that status.
Milestones, linked issues, and author badges are now visible directly in the pull request list.
Full profile names are shown when enabled for an enterprise.

Advanced search on the pull requests page now supports AND and OR keywords as well as nested searches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Bulk actions let you close, label, or change milestones on one or more pull requests at once.
Collapsible sidebar provides quick access to common filters such as Authored by me and Involves me, and can be collapsed to expand the list view.
Compact presentation mode fits more pull requests on the page.
Clicking a review status in the list filters pull requests by that status.

3 more in Everything

GitHub Enterprise adds credential inventory exports (2026-09-21) Sep 21, 2026 · issue 082

GitHub Enterprise gains a full credential inventory export — CSV from the UI or via new paginated REST API endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Export a one-off CSV snapshot of all enterprise credentials for offline review or audit when you don't need automation.

📍In your enterprise, go to Settings -> Authentication Security -> Credentials and click Export CSV next to the Overview section.

Adds a new View enterprise credentials fine-grained permission that grants members access to the enterprise credential inventory alongside enterprise owners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds new paginated REST API endpoints to programmatically retrieve the complete enterprise credential inventory for reporting and automation.
Adds an Export CSV option in enterprise Settings -> Authentication Security -> Credentials to download the full credential inventory.
Surfaces credential metadata in the inventory including owners, scopes and permissions, creation and expiration dates, last-used dates, and target organizations or repositories.
Supports filtering the credential inventory by user, app, credential type, or organization.

+1 more show less

Covers SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens in the exported inventory.

6 details in Everything

Grok 4.7 is now available in GitHub Copilot (2026-09-21) Sep 21, 2026 · issue 082

Grok 4.7 reasoning model now available in GitHub Copilot across VS Code, JetBrains, Xcode, Eclipse, CLI, and cloud agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Restrict or permit Grok 4.7 for your organisation by toggling its model policy in Copilot settings.

📍In GitHub, go to your organisation's Settings › Copilot › Policies, find Grok 4.7 under model enablement, and set it to Enabled or Disabled as required.

Copilot Enterprise and Business administrators can manage access to Grok 4.7 via the model policy in Copilot settings, with new models auto-enabled under the global default unless explicitly disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Copilot code review: An improved review experience (2026-09-18) Sep 18, 2026 · issue 079

Copilot code review gains a structured findings overview, titled comments, smarter auto-resolution, and AI-generated commit messages for batch suggestions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Quickly triage a Copilot review by checking which issues are still open, which were fixed, and which were newly surfaced in existing code — all from the overview comment without scrolling through inline threads.

📍In the pull request, open the Copilot overview comment › review findings grouped under Open, Resolved since last review, and Previously missed › click the inline-comment link next to any finding to jump directly to the relevant code.

Adds a refreshed overview comment grouping findings into Open, Resolved since last review, and Previously missed sections, each with severity and a link to the inline comment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds titles to every Copilot code review comment for at-a-glance prioritization, reused in the overview issue list.
Generates a commit title and optional description automatically when you commit an eligible batch of Copilot code review suggestions, including batches that mix in non-Copilot comments.

3 details in Everything

Manage the code coverage ruleset condition with the REST API (2026-09-18) Sep 18, 2026 · issue 079

GitHub REST API now supports managing the Restrict code coverage repository ruleset option programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

GitHub Copilot weekly releases — September 14 (2026-09-18) Sep 18, 2026 · issue 079

Copilot gains Sentry canvas, Dev Container agents, efficiency/balance/intelligence model tiers, and GA usage metrics in VS Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

When a Sentry alert fires in production, jump straight from the crash report into a fix workflow without leaving GitHub.

📍In the GitHub Copilot app: open the Sentry canvas › select a Sentry error report › review the stack trace and related context › ask Copilot to investigate the root cause › validate the proposed fix › create a pull request from the canvas.

Run a Copilot agent against a project that requires specific runtimes or dependencies defined in a Dev Container, so the agent uses the same environment as local development.

📍In VS Code 1.138, open the Agents window › start or resume a session › Copilot automatically launches the local Dev Container (Docker must be running and a Dev Container configuration must exist in the repo) › the agent executes tasks inside the container environment.

Prioritise response quality over cost for a high-stakes investigation by switching auto model selection to the intelligence tier.

📍In VS Code (or Copilot CLI / Copilot app): open Copilot settings › Auto model selection › set tier to intelligence to have Copilot pick the highest-quality available model for each request.

Adds efficiency, balance, and intelligence tiers to auto model selection, letting users control how Copilot weighs cost, quality, and response time; rolling out in VS Code, Copilot CLI, and the Copilot app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a Sentry canvas in the GitHub Copilot app to move from crash report to code fix — review errors, stack traces, and related context, then work with Copilot to investigate, validate a fix, and prepare a pull request.
Adds local Dev Container support in the VS Code Agents window, letting agents run with a project's own tools and dependencies (requires Docker and a supported Dev Container configuration).
Adds pull request creation directly from Agent Host sessions in the VS Code Agents window, including generated title and description, draft status selection, and agent-assisted creation.
Adds Copilot suggestions for repository custom property values (now in public preview), with organization and enterprise owners able to enable or disable suggestions via a Copilot policy.

+4 more show less

Adds a budget request flow for Copilot Business and Enterprise users on usage-based billing, allowing users to request higher AI credit limits that owners and billing managers can approve, adjust, or deny in settings; now generally available.
Adds automatic inactive-session cleanup in VS Code (opt-in, now in preview): marks sessions as Done once all their pull requests merge, with optional deletion after a configurable grace period.
Promotes VS Code Agents window usage metrics to general availability, covering daily active users, session counts, user message totals, and user-level activity data in enterprise and organization reports.
Copilot code review now resolves addressed comments during subsequent reviews, suggests commit messages when applying code suggestions, supports shell tools to validate changes, and combines findings from multiple agents in Lite reviews.

Adds efficiency, balance, and intelligence tiers to auto model selection, letting users control how Copilot weighs cost, quality, and response time; rolling out in VS Code, Copilot CLI, and the Copilot app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a Sentry canvas in the GitHub Copilot app to move from crash report to code fix — review errors, stack traces, and related context, then work with Copilot to investigate, validate a fix, and prepare a pull request.
Adds local Dev Container support in the VS Code Agents window, letting agents run with a project's own tools and dependencies (requires Docker and a supported Dev Container configuration).
Adds pull request creation directly from Agent Host sessions in the VS Code Agents window, including generated title and description, draft status selection, and agent-assisted creation.
Adds Copilot suggestions for repository custom property values (now in public preview), with organization and enterprise owners able to enable or disable suggestions via a Copilot policy.

+2 more show less

Adds a budget request flow for Copilot Business and Enterprise users on usage-based billing, allowing users to request higher AI credit limits that owners and billing managers can approve, adjust, or deny in settings; now generally available.
Adds automatic inactive-session cleanup in VS Code (opt-in, now in preview): marks sessions as Done once all their pull requests merge, with optional deletion after a configurable grace period.

2 more in Everything

Stage-only npm tokens for safer automation (2026-09-18) Sep 18, 2026 · issue 079

npm granular access tokens now support Read and write (stage only) to gate package publishes behind 2FA reviewer approval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Migrate a CI pipeline off bypass-2FA tokens by staging a release for maintainer approval instead of publishing directly.

$ npm stage publish

Create a stage-only granular access token scoped to your package so automation can submit releases without direct-publish rights — navigate to your npm account token settings and choose Read and write (stage only) for the target packages.

📍In npm account settings, go to Access Tokens › Generate New Token › Granular Access Token, set permissions to Read and write (stage only), and scope it to the packages your workflow publishes.

Adds Read and write (stage only) permission option when creating npm granular access tokens, allowing automated workflows to stage package versions without direct-publish rights.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Introduces npm stage publish as the publishing command for stage-only token workflows, replacing npm publish — staged versions require a maintainer to review and approve with 2FA before release.
Stage-only tokens retain other package write permissions (moving dist-tags, deprecating versions) but npm rejects direct npm publish attempts even when bypass-2FA is configured.
Requires npm CLI 11.15.0 or later and Node.js 22.14.0 or later for staged publishing workflows.

4 details in Everything

Copilot impact dashboard now shows feature engagement (2026-09-17) Sep 17, 2026 · issue 078

Copilot impact dashboard adds per-feature engagement counts and a new 28-day phase population field to enterprise and org reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds copilot_feature_engagement object to enterprise and organization 28-day aggregate reports, exposing active-user totals and per-feature engagement counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds totals_by_feature breakdown within copilot_feature_engagement, covering code completion, agent edit, passive Copilot code review, active Copilot code review, Copilot cloud agent, Copilot CLI, and Copilot app.
Adds users_in_phase_28d field to AI adoption phase reporting, exposing the full rolling 28-day phase population as of each report day alongside the existing total_engaged_users (active-that-day) count.
Copilot impact dashboard now surfaces how many active users engaged with each Copilot feature on at least two days during the 28-day period, giving enterprise administrators a view of which experiences are widely adopted.

Adds copilot_feature_engagement object to enterprise and organization 28-day aggregate reports, exposing active-user totals and per-feature engagement counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds totals_by_feature breakdown within copilot_feature_engagement, covering code completion, agent edit, passive Copilot code review, active Copilot code review, Copilot cloud agent, Copilot CLI, and Copilot app.

2 more in Everything

Agentic CLI customizations now in the usage metrics API (2026-09-17) Sep 17, 2026 · issue 078

GitHub Copilot usage metrics API gains agentic CLI fields for skills, custom agents, MCP servers, slash commands, and plugins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin arrays to enterprise and organization Copilot usage metrics API reports, each listing up to five most-active items with an interaction_count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds distinct_skill_use_count, distinct_custom_agent_use_count, distinct_mcp_use_count, distinct_slash_cmd_use_count, and distinct_plugin_use_count fields to the same reports, counting how many different CLI customization items were used in a period.
New agentic CLI metrics appear in per-user and aggregate 1-day reports, per-user 28-day reports, and day_totals entries in aggregate 28-day reports.

Adds totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin arrays to enterprise and organization Copilot usage metrics API reports, each listing up to five most-active items with an interaction_count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2 more in Everything

Ubuntu 26 generally available and latest migration (2026-09-17) Sep 17, 2026 · issue 078

Ubuntu 26.04 runner is GA for GitHub Actions; ubuntu-latest migrates from 24.04 to 26.04 starting October 19.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Explicitly target the new Ubuntu 26.04 ARM runner before the ubuntu-latest migration completes, so arm64 CI jobs run on the GA image immediately.

.github/workflows/ci.yml

jobs:
  build:
    runs-on: ubuntu-26.04-arm
    steps:
      - uses: actions/checkout@v4
      - run: make test

Pin a workflow to ubuntu-24.04 to avoid breakage during the ubuntu-latest migration while you validate your toolchain against Ubuntu 26.04.

.github/workflows/ci.yml

jobs:
  build:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - run: make test

Adds ubuntu-26.04 and ubuntu-26.04-arm as fully supported runs-on values for GitHub Actions workflows on x64 and arm64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
ubuntu-latest label migrates from Ubuntu 24.04 to Ubuntu 26.04, rolling out gradually between October 19 and November 19, 2026.

Adds ubuntu-26.04 and ubuntu-26.04-arm as fully supported runs-on values for GitHub Actions workflows on x64 and arm64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

└──▷ BREAKING ON UPGRADE

!ubuntu-latest will point to Ubuntu 26.04 (up from 24.04) after the October 19 – November 19, 2026 rollout; workflows that depend on tools, packages, or versions removed or changed between Ubuntu 24.04 and 26.04 may break automatically during this window.

Workflow execution protections in GitHub Actions generally available (2026-09-17) Sep 17, 2026 · issue 078

GitHub Actions workflow execution protections are GA, adding workflow-file scoping, an audit Insights view, and a full REST API for policy-as-code management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

If your public repo legitimately depends on pull_request_target, explicitly allow it in an event policy scoped to specific workflow files to opt out of the default blocking rule before November 2, 2026.

📍In the GitHub console, go to your repository › Settings › Actions › Policies, select the default pull_request_target rule, choose Allow for the specific workflow files that require the trigger, and save.

New REST API for Actions execution protections lets you create, read, update, and delete actor and event rules — including workflow path conditions — at the enterprise, organization, and repository level, enabling policy-as-code governance at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds workflow file targeting to scope execution protection rules to specific workflow files (e.g. deploy.yml) rather than an entire repository, so different policies can apply to different workflows in the same repo.
Adds an Insights view to audit how execution protection actions evaluate and enforce rules across your enterprise, organization, and repositories — including in evaluate (shadow) mode before enforcement.
Rolls out a default protection rule that disables pull_request_target events on public repositories that have no applicable event policy, running in evaluate mode initially and auto-enforcing on November 2, 2026.
Evaluate mode (shadow mode) is now generally available, letting you run execution protection rules without blocking workflows and preview which runs would be affected before enforcement.

New REST API for Actions execution protections lets you create, read, update, and delete actor and event rules — including workflow path conditions — at the enterprise, organization, and repository level, enabling policy-as-code governance at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds an Insights view to audit how execution protection actions evaluate and enforce rules across your enterprise, organization, and repositories — including in evaluate (shadow) mode before enforcement.
Rolls out a default protection rule that disables pull_request_target events on public repositories that have no applicable event policy, running in evaluate mode initially and auto-enforcing on November 2, 2026.

2 more in Everything

└──▷ BREAKING ON UPGRADE

!On November 2, 2026, GitHub will automatically enforce a default rule disabling pull_request_target on public repositories that had no applicable event policy before general availability — workflows relying on pull_request_target in those repos will be blocked unless explicitly allow-listed via an Actions event policy.

Automate SSO authorization for classic PATs and SSH keys (2026-09-16) Sep 16, 2026 · issue 077

GitHub Enterprise Cloud admins can now bulk-authorize classic PATs and SSH keys for up to 50 orgs via a new API and GitHub App permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds a new enterprise_credentials:write permission for enterprise-installed GitHub Apps, enabling credential delegation to automate SSO authorization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a new REST API for enterprise credential authorizations that bulk-authorizes a classic PAT or SSH key for up to 50 organizations in a single request, identified by non-secret token ID or SSH key fingerprint.
Adds a new enterprise setting to opt in to credential delegation through enterprise-installed GitHub Apps, replacing manual per-organization SSO authorization.

3 details in Everything

SCIM user responses now include a profileUrl attribute (2026-09-16) Sep 16, 2026 · issue 077

GitHub SCIM user responses now include a profileUrl attribute linking each record directly to its GitHub account URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SCIM /Users endpoint responses now include a profileUrl attribute containing the absolute URL of the linked GitHub account, eliminating extra lookups to match SCIM records to GitHub users — available across both organization and enterprise SCIM APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Copilot budget increase requests are generally available (2026-09-16) Sep 16, 2026 · issue 077

GitHub Copilot now lets members request more AI credits at the limit, with owners approving from org or enterprise settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Review and approve a member's Copilot budget increase request as an org owner so they regain AI credit access immediately.

📍In your organization's Settings, go to Billing › Requests from members, find the pending Copilot budget request, set a new amount, and select Approve and increase.

Adds a self-service budget increase request flow for Copilot users who exhaust their AI credits, routing requests to the paying account (org or enterprise) for review under Requests from members.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enables organization owners, enterprise owners, and billing managers to approve, adjust, or deny budget requests — setting a new credit amount and immediately restoring access — without leaving settings.

2 details in Everything

Code scanning AI Scan no longer requires CodeQL default setup (2026-09-16) Sep 16, 2026 · issue 077

GitHub AI Scan for pull requests now runs without CodeQL default setup, expanding coverage across eligible repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Enforce GitHub Advanced Security configurations (2026-09-15) Sep 15, 2026 · issue 076

GitHub Advanced Security configurations can now be enforced at the enterprise level, blocking org and repo admins from overriding policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Enforce for repository and organization owners option to the Enforcement dropdown in security configurations, blocking organization administrators from overriding enterprise-level GitHub Advanced Security settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

GitHub Copilot suggests custom properties definitions (2026-09-15) Sep 15, 2026 · issue 076

GitHub Copilot now suggests allowed values when defining custom repository properties, available in public preview for Business and Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable or restrict the new suggestion feature org-wide before rolling out custom property definitions to your repository fleet.

📍In your organization (or enterprise) settings, go to Copilot › Policies and set Repository custom property suggestions to Enabled or Disabled.

Adds a Repository custom property suggestions Copilot policy at the enterprise and organization level to control whether Copilot suggests allowed values when creating custom property definitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
GitHub Copilot now suggests relevant allowed values when admins create custom property definitions (single-select or multi-select) for repositories, speeding up governance taxonomy setup.

2 details in Everything

Configure cost and quality in Copilot auto model selection (2026-09-14) Sep 14, 2026 · issue 075

GitHub Copilot auto model selection gains efficiency, balance, and intelligence tiers to control cost-quality tradeoffs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds three optimization tiers — efficiency, balance, and intelligence — to Copilot auto model selection, letting users control how auto weighs cost, quality, and response latency per prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Rolls out auto model selection tier configuration in Visual Studio Code, Copilot CLI, and the GitHub Copilot app.

Adds three optimization tiers — efficiency, balance, and intelligence — to Copilot auto model selection, letting users control how auto weighs cost, quality, and response latency per prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Add VS Code Agents to Copilot usage metrics (2026-09-11) Sep 11, 2026 · issue 072

Copilot usage metrics API gains VS Code Agents fields: daily_active_vscode_agent_users, used_vscode_agent, and totals_by_vscode_agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds daily_active_vscode_agent_users to aggregate enterprise and organization Copilot usage reports (1-day and 28-day periods) to count unique users active in the VS Code Agents window each day.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds totals_by_vscode_agent to aggregate enterprise and organization reports, exposing optional session_count and total_user_messages rollups for the VS Code Agents window.
Adds used_vscode_agent to per-user enterprise and organization Copilot usage reports (1-day and 28-day periods) as an optional indicator of whether the user used the VS Code Agents window.
Adds totals_by_vscode_agent to per-user enterprise and organization reports, exposing optional per-user session_count and total_user_messages values for the VS Code Agents window.

Adds daily_active_vscode_agent_users to aggregate enterprise and organization Copilot usage reports (1-day and 28-day periods) to count unique users active in the VS Code Agents window each day.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3 more in Everything

Auto-resolution and analysis updates in Copilot code review (2026-09-11) Sep 11, 2026 · issue 072

Copilot code review auto-resolves addressed comments, writes smart commit messages, and uses shell tools plus an agent ensemble for deeper analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Generates smart commit messages when you apply a Copilot code review autofix suggestion, replacing the generic auto-filled message with one describing the specific change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Expands Copilot code review analysis to use the full set of shell tools from the Copilot SDK — including running build commands, tests, and targeted scripts — behind the Copilot agent firewall.

Generates smart commit messages when you apply a Copilot code review autofix suggestion, replacing the generic auto-filled message with one describing the specific change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

GitHub Copilot weekly releases — September 7 (2026-09-10) Sep 10, 2026 · issue 072

GitHub Copilot adds Jira integration, HydraFusion adaptive model routing, VS Code agent automations, and JetBrains enterprise sandbox controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Route a high-latency coding task through the best available model automatically, instead of manually choosing between local and cloud models.

📍In Copilot CLI, open the model selector and choose HydraFusion (listed under /experimental) — submit your task as normal and HydraFusion selects the local, cloud, or compound workflow based on cost and latency.

Adds Project HydraFusion to /experimental in Copilot CLI, enabling automated semantic routing between local, cloud, and compound models — select it like any other model and it balances performance, cost, and latency per task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Jira integration in the Copilot app, letting you bring Jira issues into a shared canvas and carry context through investigation, implementation, and pull request preparation.
Adds agent automations (public preview) in VS Code 1.137, enabling recurring agent tasks scheduled hourly, daily, or weekly, or triggered on demand.
Adds voice mode (experimental) in VS Code 1.137, allowing you to talk to, interrupt, or redirect Copilot while it works on your code.
Adds the ability to review issue and pull request details directly in the Agents window in VS Code 1.137 (experimental), even when the repository is not open.

+1 more show less

Adds centralized sandbox policy controls (public preview) for GitHub Copilot in JetBrains IDEs, allowing enterprise administrators to govern sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access.

6 details in Everything

Refreshed repository pull requests page in public preview (2026-09-10) Sep 10, 2026 · issue 071

GitHub's refreshed pull request listing page enters public preview with advanced filtering, compact mode, and richer PR context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Opt in to the refreshed PR listing page and switch back to the classic view if needed.

📍1. Navigate to the pull requests tab of any repository. 2. Click the Preview badge at the top of the page to enter the refreshed experience. 3. To return to the classic view, click the Preview badge again and choose Switch back.

Adds content assist to the PR listing page to help users find and apply the correct filters interactively.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds advanced search supporting AND and OR keywords as well as nested searches on the PR listing page.
Adds a collapsible sidebar with quick-access common filters including Authored by me and Involves me.
Adds a compact presentation mode to fit more pull requests on the PR listing page at once.
Adds richer PR context to the listing page including status check counts, stack indicator, and indicators for unread updates.

Adds content assist to the PR listing page to help users find and apply the correct filters interactively.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a compact presentation mode to fit more pull requests on the PR listing page at once.

3 more in Everything

Refreshed repository pull requests page in public preview (2026-09-10) Sep 10, 2026 · issue 011

GitHub's refreshed pull request listing page enters public preview with advanced filtering, compact mode, and richer PR context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Opt in to the refreshed PR listing page and switch back to the classic view if needed.

📍1. Navigate to the pull requests tab of any repository. 2. Click the Preview badge at the top of the page to enter the refreshed experience. 3. To return to the classic view, click the Preview badge again and choose Switch back.

Adds content assist to the PR listing page to help users find and apply the correct filters interactively.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds advanced search supporting AND and OR keywords as well as nested searches on the PR listing page.
Adds a collapsible sidebar with quick-access common filters including Authored by me and Involves me.
Adds a compact presentation mode to fit more pull requests on the PR listing page at once.
Adds richer PR context to the listing page including status check counts, stack indicator, and indicators for unread updates.

Adds content assist to the PR listing page to help users find and apply the correct filters interactively.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a compact presentation mode to fit more pull requests on the PR listing page at once.

3 more in Everything

AI Scan for pull request APIs in public preview (2026-09-10) Sep 10, 2026 · issue 071

GitHub adds REST API endpoints to manage AI Scan for pull requests at org and repo levels (public preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable AI Scan for pull requests on a specific repository without touching the GitHub UI.

$ curl -X PATCH \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  -d '{"enabled": true}' \
  https://api.github.com/repos/{owner}/{repo}/code-scanning/ai-scan

Check whether AI Scan for pull requests is enabled at the organization level before rolling out to individual repos.

$ curl -X GET \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  https://api.github.com/orgs/{org}/code-scanning/ai-scan

Adds GET/PATCH support on /orgs/{org}/code-scanning/ai-scan to read and update AI Scan for pull requests enablement across an organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GET/PATCH support on /repos/{owner}/{repo}/code-scanning/ai-scan to read and update AI Scan for pull requests enablement for individual repositories.
Enables programmatic, at-scale rollout of AI-powered security detections for pull requests without manually configuring each repository in the GitHub UI.

3 details in Everything

AI Scan for pull request APIs in public preview (2026-09-10) Sep 10, 2026 · issue 011

GitHub adds REST API endpoints to manage AI Scan for pull requests at org and repo levels (public preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Enable AI Scan for pull requests on a specific repository without touching the GitHub UI.

$ curl -X PATCH \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  -d '{"enabled": true}' \
  https://api.github.com/repos/{owner}/{repo}/code-scanning/ai-scan

Check whether AI Scan for pull requests is enabled at the organization level before rolling out to individual repos.

$ curl -X GET \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  https://api.github.com/orgs/{org}/code-scanning/ai-scan

Adds GET/PATCH support on /orgs/{org}/code-scanning/ai-scan to read and update AI Scan for pull requests enablement across an organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds GET/PATCH support on /repos/{owner}/{repo}/code-scanning/ai-scan to read and update AI Scan for pull requests enablement for individual repositories.
Enables programmatic, at-scale rollout of AI-powered security detections for pull requests without manually configuring each repository in the GitHub UI.

3 details in Everything

Control GitHub Actions cache access with cache-mode (2026-09-10) Sep 10, 2026 · issue 071

GitHub Actions gains cache-mode for least-privilege cache access control at workflow and job level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Lock a PR workflow to read-only cache access to prevent a contributor's code from poisoning the cache used by trusted builds.

.github/workflows/pr-build.yml

on:
  pull_request:

permissions:
  contents: read

cache-mode: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
      - run: npm ci

Allow a deployment job to save a freshly built artifact to the cache while preventing it from restoring — useful when you want to seed the cache without consuming a potentially tainted entry.

.github/workflows/seed-cache.yml

on:
  push:
    branches: [main]

jobs:
  seed-cache:
    runs-on: ubuntu-latest
    cache-mode: write-only
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: dist/
          key: ${{ runner.os }}-dist-${{ github.sha }}
      - run: npm run build

Job-level cache-mode settings override workflow-level settings, and a called reusable workflow cannot receive more cache access than its caller granted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
GitHub Actions emits a warning annotation when cache-mode is explicitly set to write or write-only for low-trust events such as pull_request_target, where the default is read.

2 details in Everything

Control GitHub Actions cache access with cache-mode (2026-09-10) Sep 10, 2026 · issue 011

GitHub Actions gains cache-mode for least-privilege cache access control at workflow and job level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Lock a PR workflow to read-only cache access to prevent a contributor's code from poisoning the cache used by trusted builds.

.github/workflows/pr-build.yml

on:
  pull_request:

permissions:
  contents: read

cache-mode: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
      - run: npm ci

Allow a deployment job to save a freshly built artifact to the cache while preventing it from restoring — useful when you want to seed the cache without consuming a potentially tainted entry.

.github/workflows/seed-cache.yml

on:
  push:
    branches: [main]

jobs:
  seed-cache:
    runs-on: ubuntu-latest
    cache-mode: write-only
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: dist/
          key: ${{ runner.os }}-dist-${{ github.sha }}
      - run: npm run build

Job-level cache-mode settings override workflow-level settings, and a called reusable workflow cannot receive more cache access than its caller granted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
GitHub Actions emits a warning annotation when cache-mode is explicitly set to write or write-only for low-trust events such as pull_request_target, where the default is read.

2 details in Everything

Xcode 27 runner image now runs on macOS 27 (2026-09-10) Sep 10, 2026 · issue 071

GitHub-hosted xcode-27 macOS runner image upgraded to run on macOS 27 (arm64, public preview)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Upgrades the xcode-27 and xcode-27-xlarge GitHub-hosted runner images to run on macOS 27 (previously macOS 26), enabling Apple app validation against the latest OS on arm64 runners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

Xcode 27 runner image now runs on macOS 27 (2026-09-10) Sep 10, 2026 · issue 011

GitHub-hosted xcode-27 macOS runner image upgraded to run on macOS 27 (arm64, public preview)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Upgrades the xcode-27 and xcode-27-xlarge GitHub-hosted runner images to run on macOS 27 (previously macOS 26), enabling Apple app validation against the latest OS on arm64 runners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 detail in Everything

CodeQL 2.27.0 adds support for Linux ARM64 (2026-09-09) Sep 9, 2026 · issue 070

CodeQL 2.27.0 adds Linux ARM64 support, a new Rust command-injection query, and Micronaut/PostgreSQL coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds native Linux ARM64 support for the CodeQL CLI and bundle, available via the linux-arm64 per-platform release assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds the rust/command-line-injection query to detect uncontrolled command lines in Rust code.
Adds PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare as SQL injection sinks for cpp/sql-injection and related C/C++ queries.
Adds modeling for the Micronaut framework in Java/Kotlin, covering HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.
Adds taint tracking support for OData action parameter binding in C#, improving detection for vulnerabilities involving ODataActionParameters and entities tracked by Delta.

+4 more show less

Enables GitHub code scanning default setup to authenticate with container registries or the GitHub API using an organization's private registry configurations, supporting custom content from private Git sources and Docker registries.
Improves ASP.NET Core MVC controller and action discovery to more closely match runtime behavior, covering application parts, endpoint mappings, inherited actions, and exclusions.
Improves how CodeQL evaluates author-association field checks in GitHub Actions event payloads, treating them as protection only when the relevant field is present — may surface additional alerts for workflows relying on ineffective checks.
Suppresses the new all-platforms CLI distribution warning by setting CODEQL_ALLOW_ALL_PLATFORMS_DIST=true.

Adds native Linux ARM64 support for the CodeQL CLI and bundle, available via the linux-arm64 per-platform release assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds the rust/command-line-injection query to detect uncontrolled command lines in Rust code.
Adds modeling for the Micronaut framework in Java/Kotlin, covering HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.

6 more in Everything

└──▷ BREAKING ON UPGRADE

!The generic multi-platform codeql.zip CLI distribution will be removed in a future release; users must switch to the per-platform .zip for their platform. The CLI now emits a warning when run from an all-platforms distribution.

CodeQL 2.27.0 adds support for Linux ARM64 (2026-09-09) Sep 9, 2026 · issue 011

CodeQL 2.27.0 adds Linux ARM64 support, a new Rust command-injection query, and Micronaut/PostgreSQL coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds native Linux ARM64 support for the CodeQL CLI and bundle, available via the linux-arm64 per-platform release assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds the rust/command-line-injection query to detect uncontrolled command lines in Rust code.
Adds PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare as SQL injection sinks for cpp/sql-injection and related C/C++ queries.
Adds modeling for the Micronaut framework in Java/Kotlin, covering HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.
Adds taint tracking support for OData action parameter binding in C#, improving detection for vulnerabilities involving ODataActionParameters and entities tracked by Delta.

+4 more show less

Enables GitHub code scanning default setup to authenticate with container registries or the GitHub API using an organization's private registry configurations, supporting custom content from private Git sources and Docker registries.
Improves ASP.NET Core MVC controller and action discovery to more closely match runtime behavior, covering application parts, endpoint mappings, inherited actions, and exclusions.
Improves how CodeQL evaluates author-association field checks in GitHub Actions event payloads, treating them as protection only when the relevant field is present — may surface additional alerts for workflows relying on ineffective checks.
Suppresses the new all-platforms CLI distribution warning by setting CODEQL_ALLOW_ALL_PLATFORMS_DIST=true.

Adds native Linux ARM64 support for the CodeQL CLI and bundle, available via the linux-arm64 per-platform release assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds the rust/command-line-injection query to detect uncontrolled command lines in Rust code.
Adds modeling for the Micronaut framework in Java/Kotlin, covering HTTP controllers, WebSocket endpoints, configuration injection, data access, security annotations, and HTTP client sinks.

6 more in Everything

└──▷ BREAKING ON UPGRADE

!The generic multi-platform codeql.zip CLI distribution will be removed in a future release; users must switch to the per-platform .zip for their platform. The CLI now emits a warning when run from an all-platforms distribution.

Enterprise managed permissions for GitHub Copilot agent operations (2026-09-09) Sep 9, 2026 · issue 070

GitHub Copilot admins can now centrally enforce per-operation agent permissions across shell, file, and network surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds enterprise-managed permissions for GitHub Copilot agent operations, letting admins block, require human approval for, or auto-allow shell commands, file reads and edits, and network domains — enforced across GitHub Copilot app, GitHub Copilot CLI, and Visual Studio Code Agent Host sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports per-team policy scoping so different enterprise teams can receive specialized agent permission rules.
Managed restrictions override and cannot be weakened by user settings, workspace settings, auto-approval rules, or previously saved approvals.

3 details in Everything

Enterprise managed permissions for GitHub Copilot agent operations (2026-09-09) Sep 9, 2026 · issue 011

GitHub Copilot admins can now centrally enforce per-operation agent permissions across shell, file, and network surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds enterprise-managed permissions for GitHub Copilot agent operations, letting admins block, require human approval for, or auto-allow shell commands, file reads and edits, and network domains — enforced across GitHub Copilot app, GitHub Copilot CLI, and Visual Studio Code Agent Host sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports per-team policy scoping so different enterprise teams can receive specialized agent permission rules.
Managed restrictions override and cannot be weakened by user settings, workspace settings, auto-approval rules, or previously saved approvals.

3 details in Everything

Block pull requests with exposed secrets from merging (2026-09-09) Sep 9, 2026 · issue 070

GitHub rulesets can now block PRs from merging when secret scanning alerts are open, configurable via UI, REST API, or GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable the secret scanning alert resolution rule via the UI to protect your default branch without writing any API calls.

📍1. Go to your repository (or organization/enterprise) Settings. 2. Navigate to Repository › Rulesets. 3. Create or edit a ruleset targeting your protected branches. 4. Enable Require secret scanning alerts are resolved. 5. Optionally expand Secret types to include custom or generic patterns. 6. Save the ruleset.

Adds require_secret_scanning_alert_resolution rule type to the REST API (with a secret_types parameter) to block PRs from merging when open secret scanning alerts exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION rule type in the GraphQL API for the same PR-blocking capability.
Adds Require secret scanning alerts are resolved ruleset rule in repository, organization, and enterprise settings under Repository > Rulesets, blocking PR merges until all introduced secret alerts are cleared.
Supports configuring the rule to block additional secret categories beyond default provider patterns, such as custom or generic patterns, via the secret_types parameter.

Adds require_secret_scanning_alert_resolution rule type to the REST API (with a secret_types parameter) to block PRs from merging when open secret scanning alerts exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION rule type in the GraphQL API for the same PR-blocking capability.
Adds Require secret scanning alerts are resolved ruleset rule in repository, organization, and enterprise settings under Repository > Rulesets, blocking PR merges until all introduced secret alerts are cleared.

1 more in Everything

Block pull requests with exposed secrets from merging (2026-09-09) Sep 9, 2026 · issue 011

GitHub rulesets can now block PRs from merging when secret scanning alerts are open, configurable via UI, REST API, or GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable the secret scanning alert resolution rule via the UI to protect your default branch without writing any API calls.

📍1. Go to your repository (or organization/enterprise) Settings. 2. Navigate to Repository › Rulesets. 3. Create or edit a ruleset targeting your protected branches. 4. Enable Require secret scanning alerts are resolved. 5. Optionally expand Secret types to include custom or generic patterns. 6. Save the ruleset.

Adds require_secret_scanning_alert_resolution rule type to the REST API (with a secret_types parameter) to block PRs from merging when open secret scanning alerts exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION rule type in the GraphQL API for the same PR-blocking capability.
Adds Require secret scanning alerts are resolved ruleset rule in repository, organization, and enterprise settings under Repository > Rulesets, blocking PR merges until all introduced secret alerts are cleared.
Supports configuring the rule to block additional secret categories beyond default provider patterns, such as custom or generic patterns, via the secret_types parameter.

Adds require_secret_scanning_alert_resolution rule type to the REST API (with a secret_types parameter) to block PRs from merging when open secret scanning alerts exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION rule type in the GraphQL API for the same PR-blocking capability.
Adds Require secret scanning alerts are resolved ruleset rule in repository, organization, and enterprise settings under Repository > Rulesets, blocking PR merges until all introduced secret alerts are cleared.

1 more in Everything

Remediate Code Quality findings with agentic autofix (2026-09-09) Sep 9, 2026 · issue 069

GitHub Code Quality gets agentic autofix: assign up to 25 findings to Copilot in bulk and receive a reviewed PR.

└──▷ HOW TO FIND IT

Burn down a backlog of code quality findings by assigning a batch to Copilot, which opens a PR with validated fixes for each one.

📍In your repository, go to Code Quality › Findings. Select up to 25 standard findings using the checkboxes, then choose Assign to Copilot from the bulk-action menu. Copilot will fix them on a new branch and open a pull request for your review.

Adds Assign to Copilot bulk action that lets you select up to 25 standard Code Quality findings and have Copilot fix them agentically on a branch, validate its own changes, and open a pull request for review.
Available for repositories with GitHub Code Quality enabled on GitHub Team and GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency; governed by the existing enterprise GitHub Code Quality policy with no separate policy to manage.

Adds Assign to Copilot bulk action that lets you select up to 25 standard Code Quality findings and have Copilot fix them agentically on a branch, validate its own changes, and open a pull request for review.

1 more in Everything

Remediate Code Quality findings with agentic autofix (2026-09-09) Sep 9, 2026 · issue 011

GitHub Code Quality gets agentic autofix: assign up to 25 findings to Copilot in bulk and receive a reviewed PR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Burn down a backlog of code quality findings by assigning a batch to Copilot, which opens a PR with validated fixes for each one.

📍In your repository, go to Code Quality › Findings. Select up to 25 standard findings using the checkboxes, then choose Assign to Copilot from the bulk-action menu. Copilot will fix them on a new branch and open a pull request for your review.

Adds Assign to Copilot bulk action that lets you select up to 25 standard Code Quality findings and have Copilot fix them agentically on a branch, validate its own changes, and open a pull request for review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Available for repositories with GitHub Code Quality enabled on GitHub Team and GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency; governed by the existing enterprise GitHub Code Quality policy with no separate policy to manage.

Adds Assign to Copilot bulk action that lets you select up to 25 standard Code Quality findings and have Copilot fix them agentically on a branch, validate its own changes, and open a pull request for review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

Enterprise-managed sandbox in Copilot for JetBrains (2026-09-09) Sep 9, 2026 · issue 069

Copilot for JetBrains gains enterprise sandbox policies, cross-file cursor jumps, global project context, and /ide CLI integration.

Adds enterprise-managed sandbox policies (public preview) so administrators can centrally control sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access via managed restrictions that override user settings — visible under GitHub Copilot > Sandbox when the Editor Preview feature flag is on or a managed setting is configured.
Adds /ide command in GitHub Copilot CLI (public preview) to connect a terminal session to JetBrains IDE context, including selections, diagnostics, and file references; shell commands can also consume IDE terminal environment variables and the project's configured Python interpreter, and can activate the project's local Python virtual environment.
Adds cross-file cursor jumps in next edit suggestions, letting Copilot move your cursor directly to the relevant location in another file when a suggested change continues there.
Adds global project context in chat, enabling you to include global files and folders as persistent context across a project rather than re-adding them per session.
Adds enterprise policy diagnostics to verify that Copilot policies are correctly detected and enforced on a device.

+2 more show less

Adds support for selecting the session model used by built-in subagents in the Copilot agent harness.
Promotes OpenTelemetry settings in GitHub Copilot – Chat to general availability for all users.

Adds enterprise-managed sandbox policies (public preview) so administrators can centrally control sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access via managed restrictions that override user settings — visible under GitHub Copilot > Sandbox when the Editor Preview feature flag is on or a managed setting is configured.
Adds /ide command in GitHub Copilot CLI (public preview) to connect a terminal session to JetBrains IDE context, including selections, diagnostics, and file references; shell commands can also consume IDE terminal environment variables and the project's configured Python interpreter, and can activate the project's local Python virtual environment.
Adds enterprise policy diagnostics to verify that Copilot policies are correctly detected and enforced on a device.

4 more in Everything

Enterprise-managed sandbox in Copilot for JetBrains (2026-09-09) Sep 9, 2026 · issue 011

Copilot for JetBrains gains enterprise sandbox policies, cross-file cursor jumps, global project context, and /ide CLI integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds enterprise-managed sandbox policies (public preview) so administrators can centrally control sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access via managed restrictions that override user settings — visible under GitHub Copilot > Sandbox when the Editor Preview feature flag is on or a managed setting is configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds /ide command in GitHub Copilot CLI (public preview) to connect a terminal session to JetBrains IDE context, including selections, diagnostics, and file references; shell commands can also consume IDE terminal environment variables and the project's configured Python interpreter, and can activate the project's local Python virtual environment.
Adds cross-file cursor jumps in next edit suggestions, letting Copilot move your cursor directly to the relevant location in another file when a suggested change continues there.
Adds global project context in chat, enabling you to include global files and folders as persistent context across a project rather than re-adding them per session.
Adds enterprise policy diagnostics to verify that Copilot policies are correctly detected and enforced on a device.

+2 more show less

Adds support for selecting the session model used by built-in subagents in the Copilot agent harness.
Promotes OpenTelemetry settings in GitHub Copilot – Chat to general availability for all users.

Adds enterprise-managed sandbox policies (public preview) so administrators can centrally control sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access via managed restrictions that override user settings — visible under GitHub Copilot > Sandbox when the Editor Preview feature flag is on or a managed setting is configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds /ide command in GitHub Copilot CLI (public preview) to connect a terminal session to JetBrains IDE context, including selections, diagnostics, and file references; shell commands can also consume IDE terminal environment variables and the project's configured Python interpreter, and can activate the project's local Python virtual environment.
Adds enterprise policy diagnostics to verify that Copilot policies are correctly detected and enforced on a device.

4 more in Everything

GitHub Enterprise Server 3.22 is now generally available (2026-09-08) Sep 8, 2026 · issue 069

GHES 3.22 adds air-gapped Copilot CLI, enterprise teams GA, ruleset bypass by user, and required-reviewers rulesets

└──▷ HOW TO FIND IT

Require the security team to review all changes to the default branch by adding a required reviewers rule to a repository ruleset — enforcing sign-off from teams beyond CODEOWNERS.

📍In your repository, go to Settings › Rules › Rulesets › New ruleset, set the target branch to main, add a Required reviewers rule, select your security team, and set the minimum number of required reviews.

Grant a service account ruleset bypass rights without creating a dedicated role or team — useful for automated merge workflows in CI/CD.

📍In your repository, go to Settings › Rules › Rulesets, open the target ruleset, navigate to Bypass list, click Add bypass, search for the service account by username, and save.

Adds support for configuring Copilot CLI to work with GHES in disconnected or air-gapped environments — set up a model provider once in GHES and end users authenticate with their GHES credentials (technical preview).
Promotes enterprise teams to general availability, letting enterprise owners manage users and access across all organizations and repositories from a single centralized team structure.
Repository rulesets now support bypass by individual users, allowing administrators to add specific accounts (e.g., a service account) to a bypass list without creating a dedicated role or team.
Adds a required reviewers rule to repository rulesets, supporting pattern matching on branches, files, and folders, and a configurable minimum number of reviews per team.
Adds sorting of secret scanning push protection bypass requests and alert dismissal requests by date (ascending or descending) via the filter bar at repository, organization, and enterprise levels.

+2 more show less

Displays a Latest release or Pre-release badge in the issue sidebar when a linked pull request has been included in a release.
Shows contributor role labels (First-time contributor, Contributor, Member) directly in the pull request list view for public repositories.

Adds support for configuring Copilot CLI to work with GHES in disconnected or air-gapped environments — set up a model provider once in GHES and end users authenticate with their GHES credentials (technical preview).
Adds a required reviewers rule to repository rulesets, supporting pattern matching on branches, files, and folders, and a configurable minimum number of reviews per team.
Displays a Latest release or Pre-release badge in the issue sidebar when a linked pull request has been included in a release.
Shows contributor role labels (First-time contributor, Contributor, Member) directly in the pull request list view for public repositories.

3 more in Everything

GitHub Enterprise Server 3.22 is now generally available (2026-09-08) Sep 8, 2026 · issue 011

GHES 3.22 adds air-gapped Copilot CLI, enterprise teams GA, ruleset bypass by user, and required-reviewers rulesets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Require the security team to review all changes to the default branch by adding a required reviewers rule to a repository ruleset — enforcing sign-off from teams beyond CODEOWNERS.

📍In your repository, go to Settings › Rules › Rulesets › New ruleset, set the target branch to main, add a Required reviewers rule, select your security team, and set the minimum number of required reviews.

Grant a service account ruleset bypass rights without creating a dedicated role or team — useful for automated merge workflows in CI/CD.

📍In your repository, go to Settings › Rules › Rulesets, open the target ruleset, navigate to Bypass list, click Add bypass, search for the service account by username, and save.

Adds support for configuring Copilot CLI to work with GHES in disconnected or air-gapped environments — set up a model provider once in GHES and end users authenticate with their GHES credentials (technical preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Promotes enterprise teams to general availability, letting enterprise owners manage users and access across all organizations and repositories from a single centralized team structure.
Repository rulesets now support bypass by individual users, allowing administrators to add specific accounts (e.g., a service account) to a bypass list without creating a dedicated role or team.
Adds a required reviewers rule to repository rulesets, supporting pattern matching on branches, files, and folders, and a configurable minimum number of reviews per team.
Adds sorting of secret scanning push protection bypass requests and alert dismissal requests by date (ascending or descending) via the filter bar at repository, organization, and enterprise levels.

+2 more show less

Displays a Latest release or Pre-release badge in the issue sidebar when a linked pull request has been included in a release.
Shows contributor role labels (First-time contributor, Contributor, Member) directly in the pull request list view for public repositories.

Adds support for configuring Copilot CLI to work with GHES in disconnected or air-gapped environments — set up a model provider once in GHES and end users authenticate with their GHES credentials (technical preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds a required reviewers rule to repository rulesets, supporting pattern matching on branches, files, and folders, and a configurable minimum number of reviews per team.
Displays a Latest release or Pre-release badge in the issue sidebar when a linked pull request has been included in a release.
Shows contributor role labels (First-time contributor, Contributor, Member) directly in the pull request list view for public repositories.

3 more in Everything

New customer portal help.github.com (2026-09-08) Sep 8, 2026 · issue 069

GitHub launches a unified customer portal at help.github.com with Copilot-powered search across support, docs, and community.

New unified portal at help.github.com consolidates support, entitlements, docs, learning, community, and account resources into a single entry point.
Copilot-powered search across all portal content is available without sign-in.
Product status and important announcements are surfaced directly within the portal.

New unified portal at help.github.com consolidates support, entitlements, docs, learning, community, and account resources into a single entry point.
Copilot-powered search across all portal content is available without sign-in.

1 more in Everything

New customer portal help.github.com (2026-09-08) Sep 8, 2026 · issue 011

GitHub launches a unified customer portal at help.github.com with Copilot-powered search across support, docs, and community.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

New unified portal at help.github.com consolidates support, entitlements, docs, learning, community, and account resources into a single entry point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Copilot-powered search across all portal content is available without sign-in.
Product status and important announcements are surfaced directly within the portal.

New unified portal at help.github.com consolidates support, entitlements, docs, learning, community, and account resources into a single entry point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Copilot-powered search across all portal content is available without sign-in.

1 more in Everything

Automatic Dependabot access to GitHub-hosted registries (2026-09-08) Sep 8, 2026 · issue 069

Dependabot now reads private GitHub Packages registries via GITHUB_TOKEN — no PAT or dependabot.yml changes required.

└──▷ HOW TO FIND IT

Grant Dependabot read access to a private GitHub Package so it can resolve updates without a PAT — replaces any PAT-based registry block you previously added to dependabot.yml.

📍1. Go to your organization's or personal account's Packages tab and open the target package. 2. Under Manage Actions access, click Add repository. 3. Select the repository that runs Dependabot and set access to Read. 4. Remove the corresponding PAT-based entry from dependabot.yml (no other changes needed).

Dependabot's GITHUB_TOKEN now requests the packages: read permission automatically, sending that token when pulling from *.pkg.github.com and ghcr.io — no PAT-based registry entries in dependabot.yml needed.
Dependabot reuses existing Manage Actions access grants on package settings pages to authenticate with private GitHub Packages registries, covering every GitHub Packages ecosystem Dependabot supports.

2 details in Everything

Automatic Dependabot access to GitHub-hosted registries (2026-09-08) Sep 8, 2026 · issue 011

Dependabot now reads private GitHub Packages registries via GITHUB_TOKEN — no PAT or dependabot.yml changes required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Grant Dependabot read access to a private GitHub Package so it can resolve updates without a PAT — replaces any PAT-based registry block you previously added to dependabot.yml.

📍1. Go to your organization's or personal account's Packages tab and open the target package. 2. Under Manage Actions access, click Add repository. 3. Select the repository that runs Dependabot and set access to Read. 4. Remove the corresponding PAT-based entry from dependabot.yml (no other changes needed).

Dependabot's GITHUB_TOKEN now requests the packages: read permission automatically, sending that token when pulling from *.pkg.github.com and ghcr.io — no PAT-based registry entries in dependabot.yml needed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Dependabot reuses existing Manage Actions access grants on package settings pages to authenticate with private GitHub Packages registries, covering every GitHub Packages ecosystem Dependabot supports.

2 details in Everything

GitHub Copilot weekly releases — August 31 (2026-09-04) Sep 4, 2026 · issue 065

Copilot adds Claude Fable 5.1 and Gemini 3.8 Flash, gains content exclusions in CLI, and ships Agent Merge in VS Code

Adds Claude Fable 5.1 model availability for Copilot Pro+, Max, Business, and Enterprise users.
Adds Gemini 3.8 Flash model rolling out to Copilot Pro, Pro+, Max, Business, and Enterprise users.
Copilot app and CLI now honor content exclusions, keeping sensitive code out of context across agentic workflows.
Agent Merge is now in public preview in VS Code 1.136, resolving review feedback, failed checks, and merge conflicts to get pull requests merge-ready.
Multi-root workspaces (experimental) bring Copilot and Claude agent sessions to every folder in a VS Code workspace.

+3 more show less

Chat backgrounds (experimental) let you personalize the Agents window in VS Code with built-in patterns or custom images.
Chat sessions in VS Code organize related chats into a hierarchy and surface which ones need attention.
The GitHub Copilot harness is now generally available in Copilot for JetBrains, enabling faster feature delivery and better code quality.

Adds Claude Fable 5.1 model availability for Copilot Pro+, Max, Business, and Enterprise users.
Adds Gemini 3.8 Flash model rolling out to Copilot Pro, Pro+, Max, Business, and Enterprise users.
Agent Merge is now in public preview in VS Code 1.136, resolving review feedback, failed checks, and merge conflicts to get pull requests merge-ready.
Multi-root workspaces (experimental) bring Copilot and Claude agent sessions to every folder in a VS Code workspace.
Chat backgrounds (experimental) let you personalize the Agents window in VS Code with built-in patterns or custom images.

+1 more show less

Chat sessions in VS Code organize related chats into a hierarchy and surface which ones need attention.

2 more in Everything

GitHub Copilot weekly releases — August 31 (2026-09-04) Sep 4, 2026 · issue 011

Copilot adds Claude Fable 5.1 and Gemini 3.8 Flash, gains content exclusions in CLI, and ships Agent Merge in VS Code⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds Claude Fable 5.1 model availability for Copilot Pro+, Max, Business, and Enterprise users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Gemini 3.8 Flash model rolling out to Copilot Pro, Pro+, Max, Business, and Enterprise users.
Copilot app and CLI now honor content exclusions, keeping sensitive code out of context across agentic workflows.
Agent Merge is now in public preview in VS Code 1.136, resolving review feedback, failed checks, and merge conflicts to get pull requests merge-ready.
Multi-root workspaces (experimental) bring Copilot and Claude agent sessions to every folder in a VS Code workspace.

+3 more show less

Chat backgrounds (experimental) let you personalize the Agents window in VS Code with built-in patterns or custom images.
Chat sessions in VS Code organize related chats into a hierarchy and surface which ones need attention.
The GitHub Copilot harness is now generally available in Copilot for JetBrains, enabling faster feature delivery and better code quality.

Adds Claude Fable 5.1 model availability for Copilot Pro+, Max, Business, and Enterprise users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds Gemini 3.8 Flash model rolling out to Copilot Pro, Pro+, Max, Business, and Enterprise users.
Agent Merge is now in public preview in VS Code 1.136, resolving review feedback, failed checks, and merge conflicts to get pull requests merge-ready.
Multi-root workspaces (experimental) bring Copilot and Claude agent sessions to every folder in a VS Code workspace.
Chat backgrounds (experimental) let you personalize the Agents window in VS Code with built-in patterns or custom images.

+1 more show less

Chat sessions in VS Code organize related chats into a hierarchy and surface which ones need attention.

2 more in Everything

GPT-6 Astra is generally available in GitHub Copilot (2026-09-04) Sep 4, 2026 · issue 065

GPT-6 Astra, OpenAI's agentic long-horizon coding model, is now selectable in GitHub Copilot across all major IDEs and surfaces.

Adds GPT-6 Astra as a selectable model in the Copilot model picker across VS Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, the Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.
Copilot Enterprise and Business admins can enable or restrict GPT-6 Astra access via the model policy in Copilot settings, under the default model enablement control.

Adds GPT-6 Astra as a selectable model in the Copilot model picker across VS Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, the Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.

1 more in Everything

GPT-6 Astra is generally available in GitHub Copilot (2026-09-04) Sep 4, 2026 · issue 011

GPT-6 Astra, OpenAI's agentic long-horizon coding model, is now selectable in GitHub Copilot across all major IDEs and surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds GPT-6 Astra as a selectable model in the Copilot model picker across VS Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, the Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Copilot Enterprise and Business admins can enable or restrict GPT-6 Astra access via the model policy in Copilot settings, under the default model enablement control.

Adds GPT-6 Astra as a selectable model in the Copilot model picker across VS Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, the Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

1 more in Everything

New API endpoint provides privacy-safe star history data (2026-09-04) Sep 4, 2026 · issue 065

GitHub adds a privacy-safe REST API endpoint to retrieve repository star history with timestamps, without exposing stargazer identities.

New API endpoint provides privacy-safe star history data (2026-09-04) Sep 4, 2026 · issue 011

GitHub adds a privacy-safe REST API endpoint to retrieve repository star history with timestamps, without exposing stargazer identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

announced Sep 4, 2026 · issue 067

GitHub Copilot gains HydraFusion research preview: a multi-model orchestration engine selectable like any other model

└──▷ TRY IT

Submit feedback on HydraFusion task quality directly from the terminal without leaving your workflow.

$ /feedback

Adds HydraFusion as a selectable model in GitHub Copilot that dynamically orchestrates multiple models across providers using Single, Cascade, or Critique execution patterns to balance quality, cost, and latency per task.
Supports /feedback in Copilot CLI to submit HydraFusion preview feedback directly from the command line.

2 details in Everything

announced Sep 4, 2026 · issue 011

GitHub Copilot gains HydraFusion research preview: a multi-model orchestration engine selectable like any other model⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Submit feedback on HydraFusion task quality directly from the terminal without leaving your workflow.

$ /feedback

Adds HydraFusion as a selectable model in GitHub Copilot that dynamically orchestrates multiple models across providers using Single, Cascade, or Critique execution patterns to balance quality, cost, and latency per task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports /feedback in Copilot CLI to submit HydraFusion preview feedback directly from the command line.

2 details in Everything

Multiple trusted publishing configurations for npm (2026-09-03) Sep 3, 2026 · issue 064

npm trusted publishing now supports multiple OIDC configurations per package, malware-scan-gated approvals, and staged version history.

Supports multiple trusted publishing (OIDC) configurations per npm package, each with independent repository, workflow, and environment criteria — a publish or stage is authorized if the incoming OIDC token matches any one configuration.
Direct publishing is now opt-in per configuration (staging-only is the default); every configuration can stage a package without additional setup.
The staged publishing queue's approval button is now disabled while malware scanning is in progress, and re-enables automatically once the scan completes — the page refreshes scan status every minute.
The versions tab on npmjs.com now shows maintainers a per-version staged history, including whether each version was approved, rejected, or remains staged.

4 details in Everything

Multiple trusted publishing configurations for npm (2026-09-03) Sep 3, 2026 · issue 011

npm trusted publishing now supports multiple OIDC configurations per package, malware-scan-gated approvals, and staged version history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Supports multiple trusted publishing (OIDC) configurations per npm package, each with independent repository, workflow, and environment criteria — a publish or stage is authorized if the incoming OIDC token matches any one configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Direct publishing is now opt-in per configuration (staging-only is the default); every configuration can stage a package without additional setup.
The staged publishing queue's approval button is now disabled while malware scanning is in progress, and re-enables automatically once the scan completes — the page refreshes scan status every minute.
The versions tab on npmjs.com now shows maintainers a per-version staged history, including whether each version was approved, rejected, or remains staged.

4 details in Everything

GitHub Actions: Early September 2026 updates (2026-09-03) Sep 3, 2026 · issue 064

GitHub Actions adds a runner deprecation API, a new vulnerability-alerts GITHUB_TOKEN permission, and four reusable-workflow job context properties.

└──▷ TRY IT

Check when a specific runner version loses runtime and registration support, so you can schedule upgrades before deprecation.

$ curl -H "Authorization: Bearer <token>" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/actions/runners/deprecations/2.315.0

Grant a workflow read-only access to Dependabot alerts using least-privilege scoping instead of broad repository permissions.

.github/workflows/audit-alerts.yml

permissions:
  vulnerability-alerts: read

jobs:
  audit-alerts:
    runs-on: ubuntu-latest
    steps:
      - name: List Dependabot alerts
        run: gh api repos/${{ github.repository }}/dependabot/alerts

Surface the exact source file and commit of a reusable workflow at runtime for audit logging or conditional logic.

.github/workflows/caller.yml

jobs:
  called-job:
    runs-on: ubuntu-latest
    steps:
      - name: Print reusable workflow identity
        run: |
          echo "Workflow ref: ${{ job.workflow_ref }}"
          echo "Workflow SHA: ${{ job.workflow_sha }}"
          echo "Repository:   ${{ job.workflow_repository }}"
          echo "File path:    ${{ job.workflow_file_path }}"

Adds GET /actions/runners/deprecations/{version} endpoint (available at repository, organization, and enterprise level) returning runner_version, runtime_deprecates_at, and registration_deprecates_at so teams can plan runner upgrades before support ends.
Adds vulnerability-alerts permission for GITHUB_TOKEN supporting read and none values, enabling least-privilege read-only access to Dependabot alerts without broader scopes.
Adds four new job context properties for reusable workflows — job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path — so a reusable workflow can determine its own source identity at runtime (not available on GitHub Enterprise Server).

3 details in Everything

GitHub Actions: Early September 2026 updates (2026-09-03) Sep 3, 2026 · issue 011

GitHub Actions adds a runner deprecation API, a new vulnerability-alerts GITHUB_TOKEN permission, and four reusable-workflow job context properties.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Check when a specific runner version loses runtime and registration support, so you can schedule upgrades before deprecation.

$ curl -H "Authorization: Bearer <token>" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/actions/runners/deprecations/2.315.0

Grant a workflow read-only access to Dependabot alerts using least-privilege scoping instead of broad repository permissions.

.github/workflows/audit-alerts.yml

permissions:
  vulnerability-alerts: read

jobs:
  audit-alerts:
    runs-on: ubuntu-latest
    steps:
      - name: List Dependabot alerts
        run: gh api repos/${{ github.repository }}/dependabot/alerts

Surface the exact source file and commit of a reusable workflow at runtime for audit logging or conditional logic.

.github/workflows/caller.yml

jobs:
  called-job:
    runs-on: ubuntu-latest
    steps:
      - name: Print reusable workflow identity
        run: |
          echo "Workflow ref: ${{ job.workflow_ref }}"
          echo "Workflow SHA: ${{ job.workflow_sha }}"
          echo "Repository:   ${{ job.workflow_repository }}"
          echo "File path:    ${{ job.workflow_file_path }}"

Adds GET /actions/runners/deprecations/{version} endpoint (available at repository, organization, and enterprise level) returning runner_version, runtime_deprecates_at, and registration_deprecates_at so teams can plan runner upgrades before support ends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds vulnerability-alerts permission for GITHUB_TOKEN supporting read and none values, enabling least-privilege read-only access to Dependabot alerts without broader scopes.
Adds four new job context properties for reusable workflows — job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path — so a reusable workflow can determine its own source identity at runtime (not available on GitHub Enterprise Server).

3 details in Everything

Gemini 3.8 Flash is now available in GitHub Copilot (2026-09-03) Sep 3, 2026 · issue 064

Gemini 3.8 Flash is now selectable in GitHub Copilot across VS Code, JetBrains, Xcode, Eclipse, CLI, and more.

└──▷ HOW TO FIND IT

Enable or restrict Gemini 3.8 Flash for your organization before the gradual rollout reaches all users.

📍In GitHub Copilot settings, go to Settings › Copilot › Model policy › Default model enablement and explicitly enable or disable Gemini 3.8 Flash for your Enterprise or Business plan.

Adds Gemini 3.8 Flash as a selectable model in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, JetBrains IDEs, Xcode, and Eclipse.
Enterprise and Business admins can manage access to Gemini 3.8 Flash via the model policy in Copilot settings, including the default model enablement toggle that auto-enables new models unless explicitly disabled.

2 details in Everything

Gemini 3.8 Flash is now available in GitHub Copilot (2026-09-03) Sep 3, 2026 · issue 011

Gemini 3.8 Flash is now selectable in GitHub Copilot across VS Code, JetBrains, Xcode, Eclipse, CLI, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ HOW TO FIND IT

Enable or restrict Gemini 3.8 Flash for your organization before the gradual rollout reaches all users.

📍In GitHub Copilot settings, go to Settings › Copilot › Model policy › Default model enablement and explicitly enable or disable Gemini 3.8 Flash for your Enterprise or Business plan.

Adds Gemini 3.8 Flash as a selectable model in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Enterprise and Business admins can manage access to Gemini 3.8 Flash via the model policy in Copilot settings, including the default model enablement toggle that auto-enables new models unless explicitly disabled.

2 details in Everything

CodeQL 2.26.4 improves GitHub actions security detections (2026-09-03) Sep 3, 2026 · issue 064

CodeQL 2.26.4 adds Go 1.27 support, sharper GitHub Actions checks, and new Java/Python taint flows.

The actions/unpinned-tag query now detects mutable references to reusable workflows, expanding pinning enforcement beyond actions to workflow calls.
Supports specifying EnvironmentCheck through a models-as-data model, allowing custom environment sanitizer definitions without modifying queries.
Adds SQL injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI, covering reactive database access patterns in Java/Kotlin.
Actor-field checks on github.event.pull_request.user.login and similar event payload fields now only count as protection for events that actually populate that field, reducing false negatives in ControlCheck-based queries.
Adds taint flow through list.extend and list.insert in Python, matching existing coverage for list.append.

+4 more show less

Adds taint propagation through String.valueOf(Object) when the argument is a CharSequence (e.g., String or StringBuilder) in Java/Kotlin.
Adds support for regular expressions using the d flag and for the React Native Worklets 'worklet' directive in JavaScript/TypeScript.
The cs/web/missing-token-validation query now recognizes enabled ASP.NET Core RequireAntiforgeryToken attributes when antiforgery middleware is used.
Adds Go 1.27 language support to CodeQL.

9 details in Everything

└──▷ BREAKING ON UPGRADE

!Rust data flow query alert locations now reflect actual source and sink nodes — some alerts will change location, appearing as new alerts while previous alerts close.
!GitHub Actions ControlCheck-based queries may produce more alerts because actor fields from event payloads are no longer treated as protection for events that do not populate them, and environments are no longer a sufficient sanitizer.

CodeQL 2.26.4 improves GitHub actions security detections (2026-09-03) Sep 3, 2026 · issue 011

CodeQL 2.26.4 adds Go 1.27 support, sharper GitHub Actions checks, and new Java/Python taint flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

The actions/unpinned-tag query now detects mutable references to reusable workflows, expanding pinning enforcement beyond actions to workflow calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Supports specifying EnvironmentCheck through a models-as-data model, allowing custom environment sanitizer definitions without modifying queries.
Adds SQL injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI, covering reactive database access patterns in Java/Kotlin.
Actor-field checks on github.event.pull_request.user.login and similar event payload fields now only count as protection for events that actually populate that field, reducing false negatives in ControlCheck-based queries.
Adds taint flow through list.extend and list.insert in Python, matching existing coverage for list.append.

+4 more show less

Adds taint propagation through String.valueOf(Object) when the argument is a CharSequence (e.g., String or StringBuilder) in Java/Kotlin.
Adds support for regular expressions using the d flag and for the React Native Worklets 'worklet' directive in JavaScript/TypeScript.
The cs/web/missing-token-validation query now recognizes enabled ASP.NET Core RequireAntiforgeryToken attributes when antiforgery middleware is used.
Adds Go 1.27 language support to CodeQL.

9 details in Everything

└──▷ BREAKING ON UPGRADE

!Rust data flow query alert locations now reflect actual source and sink nodes — some alerts will change location, appearing as new alerts while previous alerts close.
!GitHub Actions ControlCheck-based queries may produce more alerts because actor fields from event payloads are no longer treated as protection for events that do not populate them, and environments are no longer a sufficient sanitizer.

Enterprise-managed settings support any default model (2026-09-02) Sep 2, 2026 · issue 063

GitHub Copilot enterprise-managed settings now support any default model, configurable per team via team-mappings.json

Adds model key to enterprise-managed settings, configurable in team-mappings.json, to set a default Copilot model per enterprise team — with the key marked overridable to let teams choose their own preferred model.
Supports a global enterprise default model for all Copilot users, with per-team overrides assignable based on team membership; non-mapped users inherit the enterprise default.
Model defaults are now generally available across Copilot Business and Copilot Enterprise in the GitHub Copilot app, Copilot CLI, and Visual Studio Code.

3 details in Everything

Content exclusions generally available in Copilot app and CLI (2026-09-02) Sep 2, 2026 · issue 063

GitHub Copilot app and CLI now enforce content exclusion policies, blocking excluded files from agentic workflow context.

docs update Sep 2, 2026 · issue 062

GitHub CLI gains file attachment support for issues, pull requests, and comments

Adds the ability to attach local images and videos to issues, pull requests, and comments directly from the command line via GitHub CLI.

1 detail in Everything

Enterprise Live Migrations from GHES to ghe.com generally available (2026-09-01) Sep 1, 2026 · issue 062

GitHub Enterprise Live Migrations now GA, enabling near-zero-downtime repo moves from GHES to GHEC DR via the gh elm CLI extension.

Adds the gh elm GitHub CLI extension to manage the full Enterprise Live Migration lifecycle — creating migrations, monitoring sync progress (with --json output for scripting), and initiating cutover — against the GHES REST API.
Introduces Enterprise Live Migrations (ELM) as a generally available service running on GHES appliances for near-zero-downtime repository migrations from GHES to GitHub Enterprise Cloud with Data Residency (GHEC DR).
Supports migrations from GHES versions 3.17.18+, 3.18.12+, 3.19.9+, 3.20.3+, 3.21.3+, and 3.22.0+.
Provides resource-level progress tracking that surfaces failures before cutover, enabling informed go/no-go decisions on large monorepos.
ELM and GitHub Enterprise Importer (GEI) can be run concurrently as part of the same migration strategy, letting teams choose the right tool per repository.

5 details in Everything

Set an expiration date for individual user budgets (2026-09-01) Sep 1, 2026 · issue 062

GitHub Budgets REST API and billing UI now support optional expiration dates on individual user budget overrides.

└──▷ HOW TO FIND IT

Create a new individual user budget with an expiration at the start of the next billing cycle directly from billing settings.

📍1. Go to your enterprise Billing settings › Budgets. 2. Click Create budget or select an existing individual user budget to edit. 3. Under Expiration, choose 'Expiration at the start of the next billing cycle'. 4. Save the budget — GitHub will automatically remove it on that date.

Adds expires_at field to the Budgets REST API when creating or updating an individual user budget, supporting no expiration (default), start of next billing cycle, or a specific date — available on Copilot Business and Copilot Enterprise plans.
Adds expiration date controls in billing settings UI when creating or editing an individual user budget, with options: no expiration (default), start of next billing cycle, or a specific date — changeable or clearable at any time.
Automatically removes expired individual user budgets on their expiration date, falling the user back to their cost center per-user budget or the universal budget.

3 details in Everything

Copilot code review can now approve pull requests (2026-09-01) Sep 1, 2026 · issue 062

GitHub Copilot code review can now emit PR approvals counting toward required-approvals rules, configurable at enterprise, org, and repo level.

└──▷ HOW TO FIND IT

Enable Copilot approvals for specific repositories in your organization so Copilot-issued approvals count toward required-reviewer rules.

📍In your organization settings, go to Copilot › Code review › Approvals, set the policy to Enable for specific repositories, and select the target repositories. At the repository level, go to Settings › Copilot › Code review › Approvals, turn approvals on, and optionally restrict which file paths Copilot is allowed to approve.

Adds an approval assessment to the overview comment of every Copilot code review, signaling whether Copilot considers the pull request ready to approve (assessment alone does not count toward merge requirements).
Enables Copilot to submit a formal PR approval that counts toward a repository's required-approvals rule when turned on by an admin — off by default, configurable at enterprise, organization, and repository level, including per-file-path controls at the repository level.
Copilot's approval is automatically dismissed when new commits are pushed after approval, matching human-reviewer dismissal behavior, and a fresh review can be requested to re-approve.

3 details in Everything

Block users from discussion comments in personal repositories (2026-09-01) Sep 1, 2026 · issue 062

GitHub lets you block or unblock users directly from discussion comments in personal repositories.

└──▷ HOW TO FIND IT

Block a disruptive commenter without leaving the discussion thread in your personal repository.

📍In a discussion comment on your personal repository, open the More menu (…) on the comment › select Block user › optionally enter a private note explaining the reason › confirm your selection.

Adds in-context block/unblock controls to discussion comments in personal repositories, matching controls already available on issue and pull request comments — accessible via the More menu on any comment, with an optional private note.

1 detail in Everything

Claude Fable 5.1 is generally available in GitHub Copilot (2026-09-01) Sep 1, 2026 · issue 062

Claude Fable 5.1 is now selectable in GitHub Copilot across all major IDEs and surfaces for long-horizon agentic coding tasks.

└──▷ HOW TO FIND IT

Enable Claude Fable 5.1 for your organization as a Copilot Enterprise or Business admin so team members can select it in the model picker.

📍In GitHub Copilot settings for your organization, navigate to Policies, locate the Claude Fable 5.1 policy, and toggle it on. Note: enabling constitutes acknowledgment of Anthropic's data retention requirement for Mythos-class models.

Adds Claude Fable 5.1 to the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse — available to Copilot Pro+, Max, Business, and Enterprise plans.
Enterprise and Business admins can enable Claude Fable 5.1 via the Claude Fable 5.1 policy in Copilot settings (off by default); enabling the policy constitutes acknowledgment of Anthropic's data retention requirement for Mythos-class models.
Eligible enterprise customers can access Claude Fable 5.1 and Claude Fable 5 with zero data retention through a time-bound exemption while Anthropic rolls out Enterprise Frontier Safeguards (EFS), with requests routed to zero data retention endpoints when the model is enabled.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Claude Fable 5.1 (and Claude Fable 5) require data retention by default — prompts and outputs are retained by Anthropic to operate safety classifiers — unlike all other Claude models in Copilot, which continue to operate under zero data retention (ZDR).

GitHub CLI: Media in issues, pull requests, and comments (2026-09-01) Sep 1, 2026 · issue 062

GitHub CLI v2.99.0 adds --attach flag to upload images and video directly into issues, PRs, and comments from the command line.

└──▷ TRY IT

File a bug report with a screenshot attached in one command so the issue shows the actual problem immediately.

$ gh issue create --title 'Login button misaligned on mobile' --body 'See screenshot for the rendering issue.' --attach './screenshot.png#Login button misaligned'

Open a PR with before/after video clips so reviewers see the visual change without pulling the branch.

$ gh pr create --title 'Smooth out modal animation' --body 'Before and after recordings attached.' --attach './before.mp4#Before' --attach './after.mp4#After'

Add a clarifying screenshot to an existing issue comment when a text description alone is ambiguous.

$ gh issue comment 42 --body 'Reproduced on v2.99.0 — error visible here:' --attach './error.png#Error on screen'

Adds repeatable --attach flag to gh issue create, gh issue edit, gh issue comment, gh pr create, gh pr edit, and gh pr comment, uploading a local file and embedding it inline in the Markdown body.
Supports PNG, JPEG, GIF, WebP, SVG, MP4, MOV, and WebM formats, with size limits of 10 MB for images/GIFs, 10 MB for video on Free plans, and 100 MB for video on paid plans.
Allows inline alt text via the # syntax in --attach, e.g. --attach './login.png#The login error state'; omitting # falls back to the filename.
Rewrites local image paths already present in the Markdown body (e.g. ![alt](./login.png)) to the uploaded asset URL, preserving existing alt text; unreferenced attachments are appended at the end.

4 details in Everything

GitHub Copilot in VS Code, August 2026 releases (2026-08-31) Aug 31, 2026 · issue 060

GitHub Copilot in VS Code gains side-chats, cross-window agent sessions, text search, token usage hover, and multi-language dictation.

└──▷ TRY IT

Get a second opinion from a complementary model on the current agent session to catch missed edge cases before merging.

$ /rubber-duck

Set the integrated browser as the default editor for HTML files so local previews open automatically instead of the text editor.

📍In VS Code Settings, go to Editor › Associations and add an entry mapping *.html to the integrated browser editor.

Adds /btw slash command to open a side chat that shares the primary chat's context and prompt cache while the main chat continues running.
Adds experimental /rubber-duck command in a Copilot Agent Host session to ask a complementary model to surface missed details and edge cases.
Adds text search across the complete chat transcript with options for case matching, whole words, and regular expressions.
Supports the Agent Plugins 1.0 standard, enabling portable agent plugin installation across VS Code and compatible agent clients.
Adds a prompt timeline control in the transcript gutter to navigate to specific prompts and review related file changes.

+17 more show less

Enables connecting multiple VS Code windows to the same agent session via Agent Host.
Adds ability to view and continue recent Copilot or Claude agent sessions created in other applications from the Sessions list in VS Code.
Adds experimental setting to open the Agents window without GitHub sign-in when Claude is configured with an API key.
Enables switching between models from an Anthropic subscription and Copilot subscription at any time within Claude sessions.
Adds chat sticky scroll to keep the current prompt pinned while scrolling through long conversations.
Shows input, cached input, and output token usage per model in a chat turn by hovering over the response footer.
Adds an experimental hybrid Markdown editor combining diff viewing and Markdown editing in a single experience.
Enables switching between regular and diff editors from the breadcrumb bar in the Agents window.
Supports arranging chats side by side in horizontal or vertical groups, with layout restored on return to the session.
Adds default single-pane layout to open session details and editors in one side pane with adaptive-width diffs.
Allows terminal output expanded in chat to reflow as the view is resized.
Adds comment-on-elements capability in the integrated browser: select and annotate HTML elements to provide targeted UI feedback for batch agent edits.
Adds automatic reload of local HTML files in the integrated browser when they change on disk.
Supports setting the integrated browser as the default editor for HTML files via the editor associations setting.
Adds multi-language dictation support using an on-device model, with automatic language detection.
Enables user-level and workspace-level dictation instructions for custom transcript cleanup aligned to project terminology.
Adds shell-aware dictation cleanup for terminal commands, preserving command syntax instead of inserting spoken punctuation literally.

22 details in Everything

GitHub Copilot in Visual Studio — August update (2026-08-28) Aug 28, 2026 · issue 059

GitHub Copilot in Visual Studio gains org-level custom agents, thinking effort controls, and Git agent code review.

└──▷ HOW TO FIND IT

Use the Git agent to catch issues in uncommitted work before opening a pull request, without leaving Visual Studio.

📍In the Copilot Chat pane, select the Git agent, then type: Review my uncommitted changes. Findings appear inline in the editor; navigate them via the list in Git Changes.

Lower token consumption for a quick, routine edit by setting thinking effort to Low instead of the default.

📍In the Copilot model picker, select your model, then choose Low under the thinking effort control before sending your prompt.

Adds thinking effort controls — Low, Medium, and High — for supported models, letting you trade reasoning depth against token usage per task.
Introduces organization-level custom agents: org and enterprise owners can publish custom agents that Visual Studio automatically detects, showing descriptions and organization source in the agent picker.
Enables the Git agent to review uncommitted changes or commits before a pull request is opened, with findings surfaced inline in the editor and a navigable list in Git Changes, for both GitHub and Azure DevOps repositories.
Adds View all Copilot usage in the context window (opened from the Copilot prompt box) to see full plan details and approaching-limit notifications.
Adds model management controls: pin favorite models, collapse less-used models, and open Manage models for a view of capabilities, context window sizes, cost information, and controls for Copilot and custom models.

5 details in Everything

GitHub Copilot weekly releases — August 24 (2026-08-28) Aug 28, 2026 · issue 059

Copilot gains shared Slack/Teams agent sessions, defaultMode/defaultPermissionMode CLI defaults, a native Rust runtime, and a GA Customize tab.

Adds defaultMode and defaultPermissionMode settings to GitHub Copilot CLI so every new session starts with your preferred execution and permission modes.
Adds new management experiences for plugins, MCP servers, and skills via /plugin, /mcp, and /skills in the Copilot CLI.
Copilot CLI now runs on a native Rust runtime for significantly faster performance while keeping the terminal interface in TypeScript.
Adds session restore in Copilot CLI, letting you pick up sessions that did not exit cleanly, including those interrupted mid-turn.
Introduces shared agent sessions in GitHub Copilot for Slack and Microsoft Teams — mention @GitHub to investigate problems, plan work, and make changes your whole team can follow and guide together.

+13 more show less

The Customize tab in the GitHub Copilot app is now generally available, bringing MCP servers, plugins, skills, and canvases together in one place.
Adds Azure DevOps issue and pull request integration to the Copilot app's Customize tab, enabling Copilot sessions from ADO work items.
Adds experimental Windows Subsystem for Linux (WSL) support in the Copilot app.
Adds tab split-and-move and external browser preview (via tab context menu) to the Copilot app.
Adds enterprise controls for GitHub Copilot in JetBrains, covering plugins, MCP servers, telemetry, and agent permission modes.
VS Code 1.135 lets you continue recent Copilot or Claude agent sessions started in other applications.
VS Code 1.135 adds a complementary-model second opinion mode to surface missed details and edge cases.
VS Code 1.135 adds per-turn, per-model detailed chat usage breakdowns.
VS Code 1.135 introduces a new single-pane Agents layout with simpler session controls.
GitHub Copilot for Visual Studio adds the ability to pin favorite models, hide unused ones, compare capabilities and costs, and adjust reasoning effort per task.
GitHub Copilot for Visual Studio enables sharing custom agents across an organization to standardize workflows.
GitHub Copilot for Visual Studio adds a Copilot plan consumption view to monitor and manage premium model usage before hitting limits.
GitHub Copilot for Visual Studio adds a Git agent for reviewing uncommitted changes or individual commits before opening a pull request.

18 details in Everything

Upcoming changes to GitHub Copilot policies and billing (2026-08-28) Aug 28, 2026 · issue 058

GitHub Copilot unifies chat, cloud agent, and mobile into one policy; code review default shifts to Balanced effort level.

└──▷ HOW TO FIND IT

Keep Lite as your org's code review default before the September 28th cutover, so automated reviews don't silently become more expensive.

📍Go to your organization's Copilot settings on github.com › Code review › Review effort level, then change the value from Default to explicitly select Lite before September 28th, 2026.

Confirm or update the unified Copilot experience policy for your organization before it launches, to control whether members retain access on github.com and Mobile.

📍Go to Copilot settings on github.com › Select Copilot cloud agent (coming soon) › Set the policy option to your desired value before September 28th, 2026.

Copilot Chat on github.com, Copilot Chat in GitHub Mobile, and Copilot cloud agent are merging into a single unified experience and policy, enabled by default no earlier than September 28th, 2026.
Chat data retention extends from 28 days to the life of the account as the unified experience fully adopts the agent sessions model.
Cloud agent gains Sandbox to provide a faster cloud execution environment in the unified experience.
The default Copilot code review effort level changes from Lite to Balanced for all repositories and organizations on September 28th, 2026 — organizations and repos that want to keep Lite must explicitly set it before that date.
Organization-level and repository-level defaults for review effort level work independently: the organization default applies to repos that have not set their own, while the repository default governs automatically requested reviews.

+2 more show less

For manually requested code reviews, the effort level (Lite, Balanced, etc.) can be selected directly from the Reviewers bar in the pull request UI.
Copilot Business and Copilot Enterprise sign-ups reopen September 1st, 2026 with upfront per-seat billing required before users gain access; existing customers move to this model October 1st, 2026.

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Starting September 28th, 2026, the Default review effort level for Copilot code review maps to Balanced instead of Lite; any repo or org relying on Default to mean Lite must explicitly select Lite in settings before that date or reviews will run at higher effort.
!Opting out of the unified Copilot experience after September 28th, 2026 removes access to Copilot on github.com and GitHub Mobile entirely.
!Starting October 1st, 2026, all existing Copilot Business and Copilot Enterprise seats incur an upfront charge at the start of each billing cycle rather than being billed in arrears.

Rule insights dashboard generally available (2026-08-25) Aug 25, 2026 · issue 057

GitHub rule insights dashboard now GA at repo and org levels, with CSV export and cross-repo bypass tracking.

Adds an organization-level rule insights dashboard at Settings > Repository tab, showing aggregated ruleset evaluation metrics, top repositories by bypass count, and filters by evaluation status, branch, ruleset, and date range across all repositories.
Adds a repository-level rule insights dashboard at Settings > Rules tab, showing successes, failures, and bypasses over time plus most active bypassers, with each chart linking to the rule insights page with filters prefilled.
Supports CSV export of rule insights data at both the repository and organization levels for offline reporting and record keeping.

3 details in Everything

GitHub Copilot app Customize tab is generally available (2026-08-25) Aug 25, 2026 · issue 057

GitHub Copilot app gains a GA Customize tab unifying MCP servers, plugins, skills, and canvases in one place.

└──▷ HOW TO FIND IT

Reach the new Customize tab to discover and install MCP servers, plugins, skills, and canvases for your team.

📍1. Open the GitHub Copilot app. 2. Select Customize in the top navigation. 3. Browse Featured for curated picks, or choose a dedicated section (MCP servers, plugins, skills, canvases) to filter by type. 4. Select a trending MCP server or featured canvas and follow the install prompt.

New Customize tab in the GitHub Copilot app consolidates MCP servers, plugins, skills, and canvases into a single discovery surface with featured picks and category browsing.
Trending MCP server discovery lets users browse by category to find and install MCP servers faster.
Featured canvases surface contextual views that bridge understanding work and acting on it, including Azure DevOps backlog triage and prioritization delegated to Copilot.

3 details in Everything

Block users directly from security advisories (2026-08-25) Aug 25, 2026 · issue 057

Block abusive users directly from security advisory pages without leaving the page, via the three-dot menu.

└──▷ HOW TO FIND IT

Block a spammer directly from a security advisory comment without leaving the page.

📍In the security advisory, open the three-dot menu on the offending description or comment, then select Block user and confirm the action in the dialog that appears.

Adds a block-user action to the three-dot menu on security advisory descriptions and comments in public repositories, eliminating the need to navigate to organization or profile settings.
Shows a confirmation dialog explaining the consequences of blocking before the action is taken.
Restricts the in-advisory block action to organization moderators or administrators for org-owned repos, and to the account owner for personal repos.

3 details in Everything

Push rules in rulesets now support path exceptions (2026-08-25) Aug 25, 2026 · issue 057

GitHub rulesets now support path-level exceptions for push rules, letting you block file types or sizes everywhere except specific paths.

└──▷ HOW TO FIND IT

Allow JAR files only inside the Gradle wrapper directory while blocking them everywhere else in the repository.

📍In your repository or organization, go to Settings › Rules › Rulesets, open or create a ruleset, add the Restrict file paths push rule, expand Allowed exceptions, and add the pattern **/gradle/wrapper/*.jar.

Adopt a repository-wide file size limit without forcing an immediate cleanup of existing large files at known legacy paths.

📍In your repository or organization, go to Settings › Rules › Rulesets, open or create a ruleset, add the Restrict file size push rule, expand Allowed exceptions, and add the path patterns for directories that already contain files exceeding the limit.

Adds path exception patterns to the Restrict file paths push rule, so you can block a file type repository-wide while exempting specific glob patterns (e.g., **/gradle/wrapper/*.jar).
Adds path exception patterns to the Restrict file size push rule, letting you enforce a size limit without requiring immediate changes to pre-existing oversized files at exempted paths.
GitHub validates exception path patterns at ruleset save time, surfacing pattern errors immediately.

3 details in Everything

Better tools for managing blocked users (2026-08-21) Aug 21, 2026 · issue 053

GitHub's blocked-user management gains search, filtering, sorting, private notes, and block metadata for personal and org accounts.

└──▷ HOW TO FIND IT

Review who applied an org block and when it expires, to audit moderation actions across a large organization.

📍In Organization settings, go to Moderation › Blocked users, then filter by block reason (e.g., Harassment) and review the applied-by and expiry details for each entry.

Adds search across blocked-user lists by username, full name, or email in Settings → Moderation → Blocked users.
Adds filtering by block reason (Spam, Misconduct, or Harassment) on blocked-user lists.
Adds sort and pagination support for long blocked-user lists.
Adds private notes to blocked-user entries to preserve moderation context.
Adds visibility into who applied an organization block and when it expires.

+1 more show less

Separates the blocked-user search flow from the 'block a new user' action to reduce accidental blocks.

6 details in Everything

The new GitHub Copilot experience in Slack (2026-08-21) Aug 21, 2026 · issue 053

GitHub Copilot's agentic coding capabilities come to Slack in public preview, enabling async PR creation and team-shared agent sessions.

Mention @GitHub in any Slack direct message, channel, or thread to start a GitHub Copilot agent session that can triage issues, implement code changes in a secure cloud sandbox, and open pull requests.
Copilot can create a dedicated Slack Code channel per task, where teammates can follow the plan, inspect diffs, review HTML artifact previews, and iterate without noising up the original conversation.
Agent sessions are multiplayer — any team member can join from the original thread, add context, redirect the approach, or stop the session, making agent workflows visible and learnable across the team.
Copilot works asynchronously while users are away; sessions can be handed off to a terminal, the GitHub Copilot app, or an IDE via the resulting pull request.
Pull requests and issues created via Slack are attributed to the Copilot app identity and remain bounded by existing GitHub permissions; repository admins can require an additional human approval before agent-authored PRs merge.

+1 more show less

Available in public preview to organizations on GitHub Copilot Business and GitHub Copilot Enterprise plans; usage counts against existing Copilot entitlements and is manageable via existing Copilot cloud agent budgets.

6 details in Everything

Shared agentic work with GitHub Copilot in Microsoft Teams (2026-08-21) Aug 21, 2026 · issue 053

GitHub Copilot cloud agent sessions now run collaboratively inside Microsoft Teams channels, threads, and DMs.

Adds @GitHub mention support in Microsoft Teams channels, threads, and direct messages to start a GitHub Copilot cloud agent session that all conversation participants can view and direct.
Participants with write access to the target repository can trigger Copilot to make code changes directly from the Teams conversation.
Agent work runs asynchronously in a secure cloud sandbox; progress is visible in the channel thread and artifacts can be picked up in a terminal, the GitHub Copilot app, or an IDE.
Repository administrators can require an additional approval for any pull request attributed to the Microsoft Teams Copilot integration identity before it can merge.
Cloud agent AI credit usage in Teams is governed by usage-based billing budgets; cloud sandbox usage is billed separately and can be controlled with a product-level or SKU-level budget.

+2 more show less

Public channels can be configured with a default repository; direct messages do not use a default repository.
Supports @GitHub help to list available commands from within Teams.

7 details in Everything

Pinning saved views to the repository issues sidebar is generally available and more (2026-08-20) Aug 20, 2026 · issue 052

GitHub adds pinned saved views to the repository issues sidebar, reaction avatars, dashboard density controls, and scoped issue dependency APIs.

Enables pinning saved views to the repository issues sidebar for one-click access, even when the sidebar is collapsed.
Adds profile avatars for reactions on issues.
Adds an Issues Dashboard density setting to control how many issues are visible at once.

3 details in Everything

Windows 11 arm64 VS2026 image generally available (2026-08-20) Aug 20, 2026 · issue 052

GitHub-hosted runners gain a Windows 11 arm64 image with Visual Studio 2026, available via runs-on: windows-11-vs2026-arm.

└──▷ USE IT

Opt in to the new VS2026 arm64 image now to validate your build pipeline before the September 2026 forced migration.

.github/workflows/build.yml

jobs:
  build:
    runs-on: windows-11-vs2026-arm
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: msbuild MyProject.sln

└──▷ BREAKING ON UPGRADE

!Starting September 21, 2026, the windows-11-arm image will be gradually updated to use Visual Studio 2026 by default (rollout completes September 30, 2026), which may break workflows that depend on Visual Studio 2022.

CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling (2026-08-19) Aug 19, 2026 · issue 051

CodeQL 2.26.3 adds Vue/Sails/WinReg flow models, file-scoped custom models, and tightens several GitHub Actions queries.

Adds support for file:<path> package name syntax in JavaScript/TypeScript custom models, letting analysts define sources and sinks based on a file's public exports.
Adds flow models for Vue Composition API helpers ref, shallowRef, toRef, reactive, and computed.
Recognizes Vue Router's useRoute() Composition API as a client-side remote flow source, including its query, params, path, fullPath, and hash members.
Treats declared inputs properties in Sails Action2 controller files as remote flow sources, potentially improving results for queries such as js/path-injection.
Tracks promise-wrapped client response data into promise fulfillment values under the response threat model, potentially improving results for queries such as js/xss.

+9 more show less

Adds flow source models for RegQueryValue and related functions from the winreg.h Windows header in C/C++.
GitHub Actions analysis now recognizes untrusted data in github.event.merge_group for workflows triggered by the merge_group event.
The js/missing-rate-limiting query now recognizes @fastify/rate-limit as a rate limiter.
The actions/output-clobbering/high query no longer reports simple jq path filters when their output remains JSON-encoded, improving accuracy.
The actions/cache-poisoning/poisonable-step and actions/untrusted-checkout/critical queries now start alert paths at the expressions that control untrusted checkouts.
The actions/envvar-injection/critical query now requires the untrusted source and privileged context to originate from the same trigger event, and no longer treats pull request head labels as injection-capable.
The actions/cache-poisoning/code-injection, actions/cache-poisoning/direct-cache, and actions/cache-poisoning/poisonable-step queries now account for read-only cache access on low-trust triggers running in the default branch scope.
GitHub Actions queries now correctly classify the schedule event when determining whether a workflow can be externally triggered.
Removes Ruby library input to vendored gems from the set of taint sources, reducing false positives when using vendoring.

14 details in Everything

└──▷ BREAKING ON UPGRADE

!The codeql.actions.security.SelfHostedQuery module has been removed; any custom queries that import or rely on this module must be updated.

Track organization code quality trends (2026-08-19) Aug 19, 2026 · issue 050

GitHub Code Quality dashboard gains a Trends tab showing open findings over 7, 14, or 30-day windows across repositories.

Adds a Trends tab to the organization-level Code Quality dashboard, plotting open findings over time grouped by health score or severity across date ranges of 7, 14, or 30 days.
Adds most improved and needs support repository ranking tables alongside the trend graph, showing net change in open findings since the start of the selected period.
Trend graph and ranking tables respect repository filters applied at the top of the dashboard page.
Available on GitHub Enterprise Cloud, GitHub Team plans with GitHub Code Quality enabled, and GitHub Enterprise Cloud with data residency; not available on GitHub Enterprise Server.

4 details in Everything

Enterprise managed settings in GitHub Copilot for JetBrains (2026-08-18) Aug 18, 2026 · issue 050

GitHub Copilot for JetBrains gains enterprise-managed controls for plugins, MCP servers, OpenTelemetry, and permission modes.

└──▷ USE IT

Lock JetBrains Copilot users to approved MCP servers only, blocking any unlisted connections enterprise-wide.

yaml

allowedMcpServers:
  - https://mcp.example.com/approved
deniedMcpServers:
  - https://mcp.untrusted.io

Prevent developers from enabling Bypass Approvals or Autopilot in the Copilot agent.

yaml

permissions:
  disableBypassPermissionsMode: disable

Adds enabledPlugins enterprise managed setting to require Copilot plugins to be enabled or disabled across JetBrains IDEs.
Adds extraKnownMarketplaces enterprise managed setting to make approved plugin sources available in JetBrains IDEs.
Adds strictKnownMarketplaces enterprise managed setting to restrict plugin installation to approved sources only.
Adds allowedMcpServers and deniedMcpServers enterprise managed settings to centrally control which MCP servers developers can connect to from GitHub Copilot for JetBrains.
Adds permissions.disableBypassPermissionsMode enterprise managed setting to prevent the Copilot agent in JetBrains from using Bypass Approvals or Autopilot.

+2 more show less

Enables centrally managed OpenTelemetry configuration for Copilot in JetBrains, covering collector endpoint, protocol, service name, resource attributes, and content-capture policy — managed values take precedence over developer settings.
Exposes applied OpenTelemetry configuration to developers under Settings > Tools > GitHub Copilot > Chat > OpenTelemetry.

7 details in Everything

Credential revocation and deauthorization by token type (2026-08-18) Aug 18, 2026 · issue 050

GitHub adds token-type-specific credential revocation and deauthorization for enterprises and organizations via UI and REST APIs.

Adds token-type-specific bulk deauthorization via the enterprise REST APIs and UI, letting enterprise owners revoke all SSO authorizations for a specific credential type (Personal access tokens, SSH keys, OAuth app tokens, or GitHub App user access tokens) across the enterprise or for a single user — without touching other credential types.
Adds token-type-specific bulk revocation via the enterprise REST APIs and UI, enabling deletion or revocation of all user-level credentials of a specific type (e.g., all personal access tokens for an individual EMU user) while leaving other credential types intact.
Extends all bulk credential-revocation actions previously available only at the enterprise level to the organization level through the organization REST APIs and web UI, giving organization admins incident-response parity.
All deauthorization and revocation actions are captured in the audit log and trigger email notifications to affected users.

4 details in Everything

Multiple redirect URIs and token refresh for OAuth apps (2026-08-14) Aug 14, 2026 · issue 048

GitHub OAuth apps gain expiring tokens with refresh, up to 10 redirect URIs, and wildcard redirect matching.

└──▷ TRY IT

Test refresh-token support in a new OAuth app flow by requesting short-lived tokens via the offline_access scope during user authorization.

$ GET https://github.com/login/oauth/authorize?client_id=<client_id>&scope=repo%20offline_access&redirect_uri=https://app.example.com/callback

OAuth apps can now include the offline_access scope in authentication requests to opt into short-lived access tokens (8-hour lifetime) paired with 6-month refresh tokens.
OAuth app registrations can be set to always issue short-lived tokens, forcing all clients — including old ones — onto the refresh token flow.
Short-lived tokens are enabled by default for all newly created OAuth applications; the behavior can be disabled while updating an incompatible SDK.
OAuth apps can now register up to 10 redirect URIs (labeled callback URIs in GitHub settings), surfaced via a new Add redirect URI button in application settings.
OAuth apps and GitHub Apps can now enable per-URI wildcard matching for redirect URIs, allowing authorization redirects to subdomain or subpath variants without registering each individually.

+2 more show less

Apps with a single redirect URI now have wildcard matching enabled by default (existing legacy behavior made visible and controllable) — all OAuth apps and GitHub Apps with one registered redirect URI are affected.
All changes will be available in GitHub Enterprise Server 3.23.

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Apps with only one registered redirect URI have wildcard matching enabled by default as a now-visible legacy behavior; operators who do not need it should explicitly disable it in application settings to reduce redirect attack surface.

Grok 4.6 is now available in GitHub Copilot (2026-08-14) Aug 14, 2026 · issue 048

Grok 4.6 arrives in GitHub Copilot for agentic coding and complex multi-step workflows across VS Code, CLI, and more.

Adds Grok 4.6 as a selectable model in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, JetBrains, Xcode, and Eclipse.
Grok 4.6 is available to Copilot Pro, Pro+, Max, Business, and Enterprise SKUs, billed at provider list pricing under usage-based billing.
Copilot Enterprise and Business administrators must enable the Grok 4.6 policy in Copilot settings — the policy is off by default.

3 details in Everything

GitHub Copilot weekly releases — August 10 (2026-08-14) Aug 14, 2026 · issue 048

GitHub Copilot gains Kimi K3, Agent Plugins 1.0 GA, new CLI task management, Ollama BYOK in JetBrains, and cross-session memory.

└──▷ TRY IT

Roll back Copilot-generated changes mid-session without touching git history or throwing away your own edits.

$ /rewind

Inspect and bulk-update all installed Copilot plugins from one place in the app.

📍In the Copilot app, go to Customize (or Settings) › Plugins, review each plugin's current version, then click Update all to upgrade every plugin at once.

Adds Agent Plugins 1.0 (now generally available) enabling a plugin built once to run across VS Code, Copilot CLI, the GitHub Copilot SDK, and the GitHub Copilot app.
New /tasks subcommand in GitHub Copilot CLI to manage all subagents and their tasks, with support for queuing prompts, shell commands, and supported slash commands while an agent turn is running.
New --plan combined with --mode autopilot in headless mode (-p) lets the Copilot CLI agent produce a plan and then implement it automatically.
New /rewind slash command in Copilot CLI restores Copilot changes without requiring git or discarding user edits.
Rolls out Kimi K3 model to Copilot Pro, Pro+, Max, Business, and Enterprise plans.

+7 more show less

Rolls out MAI-Code-1.1-Flash with native image understanding and improvements to coding quality, instruction following, tool use, and performance.
Supports Ollama as a BYOK (bring your own key) provider in GitHub Copilot for JetBrains, enabling use of local Ollama models.
Adds Copilot memory in JetBrains to persist useful context across agent chat sessions.
Updated /app command in Copilot CLI now preserves session and folder context when opening the Copilot app.
VS Code 1.133: allows switching between Claude BYOK and built-in Copilot models mid-session, per turn, without leaving the Claude session.
Copilot app now shows each installed plugin's current version and supports individual or bulk plugin updates from Customize or Settings.
Copilot app lets users open an agent's question in a side chat to discuss it before responding, while the original question waits.

12 details in Everything

GitHub

Summary

How GitHub helps

Languages

Features

What GitHub offers you

release 14 total

example

release 9 total

release 9 total

example

release

example

release 30 total

docs

example 12 total

release 21 total

example

release 21 total

docs

example

release 17 total

docs

example

release 14 total

docs

example 7 total

release 16 total

example

release 17 total

example

release 13 total

docs

example

release 17 total

example

release 19 total

example

release 13 total

example 7 total

release 15 total

example

release 11 total

docs

example 7 total

release 11 total

docs

example 7 total

release 15 total

example

release 14 total

example

release 16 total

example

release 16 total

example

release 11 total

example

release 8 total

example

release 13 total

example

release 8 total

docs

example

release 7 total

example

release 9 total

example

release 8 total

example

release 8 total

example

release 8 total

example

release 7 total

example

release

example

release 7 total