GitHub News
AI Scan for pull requests generally available
October 15, 2026
Code scanning AI Scan for pull requests is now generally available. It complements CodeQL by finding vulnerabilities in pull request changes for languages and frameworks that CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, Blazor for C#, and more. How it works AI Scan runs automatically on pull requests when code scanning and the repository’s effective AI Scan setting are enabled. Findings appear alongside CodeQL results on the Conversation and Files changed tabs, with an “AI” indicator to distinguish them from CodeQL alerts. Findings can include an explanation of the security risk and a suggested autofix. AI Scan findings are advisory. They do not fail the code scanning check and cannot block pull request merges through ruleset requirements. AI Scan does not run on pull requests from forks or pull requests created by Dependabot. Availability AI Scan is available for public repositories owned by organizations or personal accounts. For private and internal organization-owned repositories, GitHub Code Security or GitHub Advanced Security is required. A GitHub Copilot license is not required. Billing AI Scan for pul
Agentic autofix for code scanning alerts general availability
October 15, 2026
Agentic autofix for code scanning alerts is now generally available. It remediates alerts by working across your codebase the way a developer would: it explores relevant files, proposes a fix, and reruns CodeQL to confirm the fix closes the alert before opening a pull request for your review. Agentic autofix is available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency. How it works When you assign a code scanning alert to Copilot, it: Explores relevant files across your codebase. Generates a proposed fix. Validates the fix works by rerunning CodeQL. Iterates if needed, then opens a draft pull request ready for your review. The pull request includes a summary of the fix, why it closes the alert, and the validation steps Copilot took to confirm that it works. When the pull request containing the fix is ready, you can instruct Copilot to make further changes to it by commenting on the pull request or interacting with the session in the Agents tab of your repository. How to use it When enabled, agentic autofix replaces the free Generate Fix option on individual code scanning alerts with an
Email notifications for repository push events have been retired
October 15, 2026
As of October 15, 2026, email notifications for repository push events have been retired and are no longer sent. We shut down this feature to help prevent spam and abuse. Because recipients didn’t have to consent before receiving these emails, the feature could be misused to send unwanted messages through GitHub’s email infrastructure. To continue sending email notifications for repository push events, you can use a GitHub Actions workflow triggered by push events to send emails through your own SMTP server or email provider. The post Email notifications for repository push events have been retired appeared first on The GitHub Blog.
HydraFusion updates and new Max option
October 14, 2026
HydraFusion has an updated model pool, improved orchestration workflows, and introduces HydraFusion Max. Both HydraFusion and HydraFusion Max are available across VS Code, the GitHub Copilot app, and GitHub Copilot CLI and remain in research preview. HydraFusion orchestrates multiple models to produce a single response, bringing together their strengths so you don’t have to choose an individual model for each task. What’s new in HydraFusion Latest frontier models: HydraFusion and HydraFusion Max draw from a pool that now includes Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna. The models used for each task vary based on the orchestration workflow. Reasoning effort tailored to each step: Previously, HydraFusion only used each model’s default reasoning effort. With this update, it explicitly tailors effort to each stage, using medium effort for initial drafts and high effort for review. This keeps drafting efficient while dedicating deeper reasoning to checking and improving the work. Optimized Cascade and Critique workflows: Cascade: Previously used an initial model to solve the task, with escalation to a stronger model when needed. It can now include a judging step that
GitHub Actions workflow lockfiles in public preview
October 14, 2026
GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Tags and branches can move after you review a workflow, so a later run might execute different code. Lockfiles let you keep those references in your workflow while running the exact commits you locked. If an action is compromised, a moved tag or branch can introduce malicious code into your workflow without a change to your repository. Lockfiles help protect against unexpected dependency changes by keeping workflow runs tied to the commits you locked. Locking does not determine whether the dependency itself is safe, so review dependencies before locking them. Install the gh actions-lock extension for the GitHub CLI to create and maintain your workflow lockfile. With the extension, you can: Pin your dependencies: Generate .github/workflows/actions.lock with reviewable commits for actions and their transitive dependencies, as well as reusable workflow dependencies. Adopt locking gradually: Onboard workflows individually. Once onboarded, a workflow must have lockfile entries for its dependencies, and GitHub Actions runs the recorded commit
GitHub App improvements for least privilege and management
October 13, 2026
We’re releasing several GitHub Apps improvements today that help developers move off of classic PATs, improve GitHub App management, and request fewer sensitive permissions. We’ve also made it easier for repository administrators to use apps that their administrators have approved and updated the GitHub App credential management UI in advance of our planned workload federation features. New repository creation and installation management permissions Two new repository fine-grained permissions have been added, available to both fine-grained PATs and GitHub Apps. repository_creation:write: Allows the caller to create a repository in the account where it’s granted. installation_repositories: write: Allows the caller to add or remove that repository from an installation in the organization. Create a repository without repository_administration You can now use the repository_creation:write permission to create repositories without needing the broader repository_administration:write permission. Previously, an app or PAT needed repository_administration:write to create a repository. That permission also grants other repository administration features like deletion and transfer. This could
Gemini 4 Argon in GitHub Copilot
October 13, 2026
Gemini 4 Argon, Google’s newest frontier model, is now generally available in GitHub Copilot. It is designed for complex coding, agentic, and reasoning tasks. In early testing, Gemini 4 Argon solved more tasks than previous Gemini models on every coding benchmark, with its largest gains in Copilot CLI. It also thoroughly checks its work, testing edge cases before it finishes. This model is billed at provider list pricing under usage-based billing. See Models and pricing for GitHub Copilot for details. Availability in GitHub Copilot Gemini 4 Argon is available to Copilot Pro+, Max, Business, and Enterprise users. You can select the model in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot coding agent GitHub Copilot app JetBrains IDEs Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Enterprise and Copilot Business plan administrators can manage access to Gemini 4 Argon through the model policy in Copilot settings. Under default model enablement, new models are automatically enabled unless an administrator has turned off the global default or explicitly disables this model. Learn more To explore al
Audit GitHub Code Quality finding dismissals and reopenings
October 13, 2026
You can now review manual dismissals and reopenings of GitHub Code Quality findings in your organization or enterprise audit log. Findings may appear in either your repository’s default-branch backlog or pull requests. Two new events record these actions: repo.code_quality_findings_dismissed records a dismissal of one or more backlog findings. repo.code_quality_findings_reopened records a reopening of one or more backlog findings. Each event includes who made the request, when it happened, the repository and rule, and the identifiers and count of the affected findings. For repositories with Code Quality enabled, you don’t need additional setup. If you have access to your organization audit log or enterprise audit log, filter by these action names to review activity. On GitHub Enterprise Cloud, you can also retrieve these events through the audit log API. This improvement is generally available on GitHub Team and GitHub Enterprise Cloud, including enterprises with data residency. It isn’t available on GitHub Enterprise Server. For more on managing findings, see Fixing code quality findings in your repository backlog. Join the GitHub Community discussion. The post Audit GitHub Code Q
Secret scanning blocks Anthropic keys by default, adds Salesforce
October 13, 2026
Secret scanning now detects new secret types from Salesforce, Anthropic, and Cloudsmith, with the new Anthropic secret types blocked with push protection by default. New secret scanning partner Salesforce is now a secret scanning partner. When a provider’s secret is found in a public repository, GitHub forwards it to the relevant partner so they can revoke or rotate the credential before it can be abused. Provider Secret type Salesforce salesforce_marketing_cloud_api_oauth2_token Detectors added Secret scanning now automatically detects the following new secret types in your repositories. Provider Secret type Anthropic anthropic_service_api_key Anthropic anthropic_user_api_key Cloudsmith cloudsmith_api_key Partner secrets are automatically reported to the secret issuer when found in public repositories through the secret scanning partnership program. User secrets generate secret scanning alerts when found in public or private repositories. Push protection defaults expanded The following detectors are now included in push protection by default. Repositories with secret scanning enabled, including free public repositories, will have commits containing these secrets automatically bloc
Enterprise managed settings enforcement updates
October 13, 2026
Enterprise administrators can now require supported GitHub Copilot clients to retrieve current server-managed settings at startup instead of relying on a cached policy. We are also adding minimum client version requirements to governance-focused managed settings keys over time, starting with the sandbox key. Force refresh settings on client startup Set forceRemoteSettingsRefresh to true through server-managed, MDM-managed, or file-based settings when a policy change must take effect before Copilot starts. The setting is supported in Copilot CLI, VS Code, and the GitHub Copilot app. MDM-managed and file-based delivery can require freshness before the client signs in for the first time. A server-managed value begins requiring refreshes on subsequent startups after the client has received it once. While the setting is active, a cached response cannot satisfy the freshness requirement. If the client cannot confirm current policy, it fails closed rather than running with a stale or unconfirmed policy. Without this setting, clients continue to use the normal managed-settings cache for faster startup and resilience during transient service failures. Minimum required client version We’ve a
Improved detection for withdrawn Dependabot alerts
October 13, 2026
You can now more easily detect withdrawn Dependabot alerts. Dependabot withdraws and removes an alert when the advisory or vulnerability that produced it is no longer valid. Two changes help you detect these withdrawals: Webhooks: The dependabot_alert webhook event now includes a withdrawn action. The payload contains identifiers captured before the alert was removed, such as the alert number, GHSA and CVE IDs, package, and manifest path. If you already subscribe to dependabot_alert events, you’ll automatically receive these deliveries. REST API: Requests to get or update a withdrawn alert now return 410 Gone instead of 404 Not Found, so you can tell a withdrawn alert apart from one that never existed. These changes are available for all repositories on github.com and will be included in GitHub Enterprise Server 3.24. Learn more about the dependabot_alert webhook event and the REST API endpoints for Dependabot alerts. The post Improved detection for withdrawn Dependabot alerts appeared first on The GitHub Blog.
Search and filter for budgets now available
October 13, 2026
The “Budgets and alerts” page in your GitHub billing settings now shows all of your budgets in one list that you can search and filter. Whether you manage budgets for a personal account, enterprise or organization, you can find a specific budget without paginating through the full list. With this release, you can: Search or filter budgets by scope, product, or SKU. In enterprises and organizations, you can also search by user. Narrow the list to one scope, such as organizations or cost centers, from the Scope menu. Track user-level budgets in the same list, including which budget applies to a specific user. To learn more, see Setting up budgets. The post Search and filter for budgets now available appeared first on The GitHub Blog.
Code scanning AI Scan metrics in security overview
October 13, 2026
Organization and enterprise administrators can now observe the impact of AI Scan for pull requests in security overview. New metrics show how many AI Scan findings were generated, resolved, the remediation rate, which repositories generated findings, trends over the selected reporting period, and how often developers applied autofix suggestions. The “CodeQL pull requests” page is now named “Code scanning on pull requests” and includes separate CodeQL and AI Scan tabs. The AI Scan tab shows total findings and how many findings include or do not include an autofix suggestion. Metrics from the “CodeQL pull requests” page are now under the CodeQL tab. These metrics help security teams evaluate the effectiveness of AI Scan across their organization or enterprise, understand developer response, and make informed rollout and investment decisions without reviewing individual pull requests. This public preview is available on github.com, including GitHub Enterprise Cloud, for customers with GitHub Code Security or GitHub Advanced Security. GitHub Enterprise Server isn’t supported for this release. Learn more about AI Scan for pull requests and join the AI Scan Community discussion. The post
Client telemetry user attribution and configurable capture
October 12, 2026
Enterprise administrators can now use telemetry in managed settings to attribute GitHub Copilot activity to a user without collecting their prompts, responses, or tool content. The telemetry.capture.identity setting adds three attributes to OpenTelemetry (OTel) data: user.name: The authenticated Copilot account name, currently the GitHub login. process.user.name: The local operating-system account. host.name: The local machine name. Identity capture is off by default and remains separate from the existing pseudonymous user identifier. Fine-grained capture controls are available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. Administrators can also independently control five additional capture classes: prompts: User, system, and developer prompts and supported input context. responses: Assistant responses and supported reasoning content. toolArguments: Raw tool arguments, commands, tool schemas, and identifiers for tools, MCP servers, plugins, and hooks. toolOutput: Tool results and execution-error details. policyDetail: Raw policy details such as sandbox filesystem paths. Every capture class is off by default. Explicit managed values take precedence
Anonymous organization-level registries for Dependabot
October 12, 2026
You can now select Anonymous as the authentication method for an organization-level private registry. Use it for registries that Dependabot can reach without credentials, such as an internal package mirror that allows anonymous reads. On github.com, Dependabot update jobs can only reach hosts on the egress allowlist and the private registries you configure. A private registry that’s only defined in a file such as .npmrc or nuget.config is blocked. Organization-level registries apply to every repository you grant access to, including repositories that only use Dependabot security updates and don’t have a dependabot.yml file. To add a registry, go to your organization’s Settings, select Secrets and variables, then Private registries, and choose New private registry. If you used a placeholder token as a workaround, delete that registry and add it again with Anonymous authentication. This is necessary because you can’t change the authentication method of an existing registry. The Anonymous option is now generally available on github.com and will be available in GitHub Enterprise Server 3.24. Learn more about giving security features access to private registries and resolving a blocked
Push attribution for commits in limited public preview
October 12, 2026
GitHub now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside the existing author and committer fields. Commit author and committer fields are just strings that the pushing client supplies, so anyone with write access to a repository can set them to any name and email they choose. That makes it possible for an attacker who compromises a low-privilege account to forge commits that appear to come from a trusted maintainer, evading review policies and confusing audit trails. GitHub already authenticates pushes. This release adds durable, per-commit pusher attribution alongside the author and committer metadata. With this release: Every commit pushed to a repository now has a durable, authenticated pusher identity attached to it, independent of whatever the author and committer metadata claims. A new repository rule condition, Committer must match pusher, blocks pushes where the committer metadata doesn’t match any verified email address of the authenticated pusher. This closes a path for commit identity spoofing. You can use the pusher identity to spot-check suspicious activity or speed up security investigations
New controls and chat improvements in Copilot for JetBrains
October 10, 2026
This update brings more control over default models and MCP server in GitHub Copilot for JetBrains. It also makes diagnostics easier to address, improves chat navigation and account controls, and strengthens reliability across agent sessions, customizations, and worktrees. What’s new Enterprise-managed default models Enterprise administrators can now use managed settings to choose any available Copilot agent model as the default for new conversations. This gives organizations more control over the starting model while still preserving an explicit model picker choice. Faster fixes from diagnostics Diagnostic intention menus now include a Fix action that opens inline chat and asks Copilot to repair the issue. The action uses agent mode when it is available and ask mode otherwise, helping you move from a reported problem to a proposed fix with fewer steps. More control over MCP server startup A new MCP setting lets you disable automatic server startup for Copilot and Claude, giving you more control over when configured tools become active. User experience enhancements This release makes everyday chat, account, and navigation workflows clearer: Account controls: Signed-in Copilot accou
GitHub Copilot weekly releases — October 5
October 9, 2026
This week’s updates make Copilot easier to use across accounts and environments, with more control over what agents can access and how you manage their work. GitHub Copilot Claude Haiku 5.5 is available to Copilot Pro, Pro+, Max, Business, and Enterprise users. Limit agents’ access to files, networks, and credentials with local sandboxing, now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host. This is included with Copilot at no extra cost. Learn more about local sandboxing. GitHub Copilot app The Copilot app now lets you use separate GitHub accounts for your Copilot license and your repositories. For example, use an enterprise-provided Copilot license while accessing repositories through another account. Download the Copilot app. GitHub Copilot CLI GitHub Copilot CLI makes it easier to choose a local model without leaving your existing workflow. Use /model to discover supported models from a running local Ollama instance, alongside your configured models and cloud models provided by GitHub Copilot. Discover local models in GitHub Copilot CLI. GitHub Copilot in VS Code (1.141 release) View agent sessions side by side in the Agents window. Ar
CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis
October 9, 2026
CodeQL 2.27.2 is now available, adding a C++ regular-expression parser and analysis improvements across several languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code. The Default suite runs 498 security queries covering 170 CWEs. The Extended suite adds 131 queries covering 32 more CWEs. Language and framework support C/C++ CodeQL now parses regular expressions that use the ECMAScript grammar in std::regex. We’ve added SQL-injection sink models for the Comdb2 C API as well as flow summaries for Bloomberg BDE codecs and byte-stream deserializers. Go CodeQL now models the github.com/coder/websocket import path, in addition to nhooyr.io/websocket. Rust The Rust extractor now supports the AnyAttr and DocComment classes. We’ve improved data flow for async blocks used with await as well as added flow summaries for native-tls, async-native-tls, and tokio-native-tls. JavaScript/TypeScript CodeQL now recognizes the Workflow SDK’s "use workflow" and "use step" directives. We’ve improved Hapi route-handler and request-input tracking through custom route-registration helpers and higher-order functions. macOS
Copilot code review: New organization billing options and controls
October 8, 2026
This release adds new billing and license controls for Copilot code review admins: Billing: Organization owners can bill Copilot code reviews from members with a Copilot license to the organization’s cost center instead of using up those members’ Copilot quotas. Review request controls: Organization owners and repository admins can control whether people with external licenses can request a review. 💳 Choose how members with a Copilot license are billed By default, Copilot code review bills requests associated with members who have a Copilot license to that member’s own Copilot entitlement. Organization owners can now choose to bill the organization that owns the repository instead in order to avoid consuming or exhausting member quotas. The Choose how members with a Copilot license are billed setting has two options: Member (default): Bills the member’s own Copilot entitlement. If the member’s quota is exhausted, the code review fails. Organization: Bills the organization that owns the repository. This requires AI Credits paid usage to be enabled for the organization, and you can optionally set a budget. You can find the setting in your organization settings, under Copilot -> Poli
Triage role users or higher can now archive pull requests
October 8, 2026
Users with the triage role or higher in a repository can now archive and unarchive pull requests. Previously, archiving was limited to repository administrators, requiring trusted triagers to hand routine moderation work to someone with higher permissions. Maintainers increasingly rely on triagers to keep pull request queues healthy without granting them permission to change code. Archiving—often used for spam, duplicate, or abandoned pull requests—is a common moderation action, and restricting it to administrators created unnecessary friction for projects that delegate this work. We’ve also improved how archived pull requests become read-only. Previously, archiving would lock the pull request, but admins were still able to leave comments. Now, we’re preventing any new activity on the pull request once it’s been archived. This keeps archived pull requests read-only without granting triage users the ability to manipulate a conversation’s locked state, which requires write access. With these changes: Users with the triage, write, maintain, or admin role can archive and unarchive pull requests. Archiving automatically closes the pull request and makes its conversation read-only. New c
Draft pull requests count toward pull request limits
October 8, 2026
Maintainers are seeing more low-quality contributions in their repositories and need better ways to manage them. You can now configure pull request limits to also include draft pull requests. Previously, draft pull requests didn’t count toward a user’s limit. That meant someone could open any number of drafts, even when you’d set a limit for other pull requests. Counting drafts toward the limit helps you curb that loophole and reduce the clutter, notifications, and CI runs that can come with repository spam. We’d love to hear how this setting works for you. Leave your feedback in our Community discussion. The post Draft pull requests count toward pull request limits appeared first on The GitHub Blog.
Claude Haiku 5.5 in GitHub Copilot
October 7, 2026
Claude Haiku 5.5, Anthropic’s newest lightweight model, is now generally available in GitHub Copilot. It is designed for fast, high-volume work like subagents, quick edits, and terminal tasks. In early testing, Haiku 5.5 matched Claude Sonnet 5 on many coding tasks while using significantly fewer tokens and steps. This model is billed at provider list pricing under usage-based billing. See Models and pricing for GitHub Copilot for details. Availability in GitHub Copilot Claude Haiku 5.5 is available to Copilot Pro, Pro+, Max, Business, and Enterprise users. You can select the model in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot cloud agent GitHub Copilot app github.com GitHub Mobile on iOS and Android JetBrains IDEs Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Enterprise and Copilot Business plan administrators can manage access to Claude Haiku 5.5 through the model policy in Copilot settings. Under default model enablement, new models are automatically enabled unless an administrator has turned off the global default or explicitly disables this model. Learn more To explore all models av
Local sandboxing for GitHub Copilot now generally available
October 7, 2026
Local sandboxing for GitHub Copilot is now generally available in GitHub Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host. Local sandboxes give developers a secure execution boundary for agentic workflows on their own machines. Tools and commands initiated by Copilot run with restricted access to the filesystem, network, credentials, and other system capabilities, based on policies defined by the developer or their organization. Local sandboxing is powered by Microsoft eXecution Container (MXC), which translates a common sandbox policy into native operating-system controls across Windows, macOS, and Linux. With local sandboxing, developers and organizations can: Limit the files and directories that agent-run commands can read or modify. Control access to the internet, local networks, Git credentials, and GitHub CLI credentials. Apply sandboxing to local tools and services, including local MCP and language servers where supported. Use enterprise-managed settings to require sandboxing and enforce policies that developers cannot weaken. Adopt more autonomous agent workflows while maintaining clear boundaries around what Copilot can access. Model execution and
Discover local models in GitHub Copilot CLI
October 7, 2026
GitHub Copilot CLI makes it easier to choose a local model without leaving your existing workflow. Starting in CLI version 1.0.94-0, use /model to discover supported models from a running local Ollama instance, alongside your configured models and cloud models provided by GitHub Copilot. Discovery doesn’t automatically add models. Choose a discovered model, review its provider and endpoint, then confirm Add and use for this session or Add without switching. You can use the model in your current session without restarting the CLI. Ollama and the model must already be installed—this flow doesn’t install a runtime or download models. Models must support tool calling and streaming. Provider connection failures appear in the picker with an explanation, helping you identify what needs attention. This CLI update builds on the same idea as the GitHub Copilot app’s provider experience: choose the model that fits your work. In the app, add a supported provider in Settings > Model providers. Choosing a local model doesn’t turn on offline mode or disable GitHub telemetry. In the CLI, offline mode remains an explicit choice through COPILOT_OFFLINE=true. A remote provider can still receive promp
Purpose-built model for leaked secret detection
October 7, 2026
Secret protection should keep pace with the way you build software, whether you write code yourself or work with an AI agent. With our new purpose-built model, we’re bringing context-aware detection into more developer workflows to help you catch secrets before they’re exposed. What’s new Today, we’re sharing plans for AI secret detection across secret scanning alerts, push protection, and GitHub Copilot security reviews. These features leverage GitHub’s fine-tuned model for secret detection. It reads surrounding code to identify likely credentials, including passwords without a recognizable token format, without generating code or prose. Model availability: Customers with AI-detected Password alerts have automatically been upgraded to the new model. AI-detected secrets in push protection is available in private preview. AI-based secret scanning with the GitHub Copilot /security-review command for the Copilot CLI and Copilot app available soon in private preview. Billing notice and availability AI-detected secret alerts will remain included in GHSP and GHAS at no additional charge. The new opt-in checks for push protection and the security review command will consume GitHub AI Cred
Update your IDE to restore agent activity in Copilot usage metrics
October 6, 2026
If your Copilot usage metrics have shown agent activity or agent lines of code falling while Copilot usage kept growing, we’ve found the cause, and a fix is rolling out to each IDE. Several IDEs recently moved Copilot agent sessions to the Copilot SDK. Those sessions didn’t identify which IDE they came from, so usage metrics couldn’t attribute them correctly. Most of that activity was left out of reports, and some was counted as Copilot CLI activity. Only IDE versions that use the Copilot SDK for agent mode are affected. Developers on earlier versions are still counted. The fix is available now in Visual Studio Code. Other IDEs will receive it in upcoming releases, which we expect to finish rolling out by November 2026. Once developers update, their agent activity is counted again in the Copilot usage metrics dashboard and API. Update your IDE Agent activity is counted again once developers are on these versions. If your developers are on an affected version, update as soon as the fixed version is available, because their activity can’t be recovered later. If you manage IDE versions centrally and rely on agent metrics, you can plan your rollout to move developers directly to these
Stacked pull requests generally available
October 6, 2026
GitHub stacked pull requests are now generally available. Break large changes into smaller, focused pull requests that you can review independently and merge together. Since the feature went into public preview, repositories using stacks have seen a 9% increase in merged code compared to peers. Over two-thirds of the top 1% of repos now use stacked pull requests and have seen a 5% improvement in time-to-merge. With this general availability release, we’re introducing several improvements to make stacks easier to create, review, and merge. Thank you to everyone who provided feedback and input during the preview period. More flexible merging and rebasing Approvals stay in place for unchanged code. When an otherwise unchanged stack is updated after its base branch, such as main, moves ahead, Rebase stack now preserves approvals, even in repositories that dismiss stale approvals. Rebased commits stay signed. GitHub creates signed replacement commits during Rebase stack, preserving original authorship. Automatic rebases after partial merges also sign replacement commits when branch rules require signatures or any original commit was signed. Bypass permissions apply to stacks. Users with
Code scanning AI Scan enablement status in security overview
October 6, 2026
Organization and enterprise administrators can now see AI Scan for pull requests enablement status in the security overview coverage view. The code scanning summary shows enabled and not enabled repository counts, while repository rows show each repository’s effective AI Scan enablement. You can filter the coverage view with code-scanning-ai-scan-pr-scan:enabled and code-scanning-ai-scan-pr-scan:not-enabled. Coverage CSV exports now include a Code Scanning AI Scan for pull requests column with enabled and not-enabled values. This visibility helps you track adoption and manage AI Scan for pull requests enablement across your organization or enterprise. Learn more about assessing adoption of security features and join the AI Scan Community discussion. The post Code scanning AI Scan enablement status in security overview appeared first on The GitHub Blog.
Secret scanning adds detectors for Lovable, Supabase, and more
October 5, 2026
Secret scanning now detects new secret types from Lovable Labs, Pydantic Services Inc., and Supabase. New secret scanning partner The following provider joined the secret scanning partnership program. When one of their secrets is found in a public repository, GitHub forwards it to the partner so they can revoke or rotate the credential before it can be abused. Provider Secret type Lovable Labs lovable_api_key Detectors added Secret scanning now automatically detects the following new secret types in your repositories. Provider Secret type Lovable Labs lovable_api_key Pydantic Services Inc. logfire_token Pydantic Services Inc. pydantic_ai_gateway_api_key Supabase supabase_oauth_access_token Supabase supabase_scoped_personal_access_token Partner secrets are automatically reported to the secret issuer when found in public repositories through the secret scanning partnership program. User secrets generate secret scanning alerts when found in public or private repositories. Learn more Learn more about secret scanning and see the full list of supported secrets in our documentation. Let us know what you think in the community discussion. The post Secret scanning adds detectors for Lovable
GitHub Copilot weekly releases — September 28
October 2, 2026
This week, put Copilot to work with new models, reusable workflows and desktop app automation, plus Azure canvases and VS Code improvements. GitHub Copilot Claude Sonnet 5.5 is available to Copilot Pro, Pro+, Max, Business, and Enterprise users. GPT-6.1 Sol is available to Copilot Pro+, Max, Business, and Enterprise users. Let Copilot select and coordinate models for your task with HydraFusion, a research preview now available in VS Code and the GitHub Copilot app alongside Copilot CLI. Clearer, more frequent progress updates help you follow its work. Save a process for Copilot to follow again. With dynamic workflows, you can ask Copilot to run release checks, investigate failures, and pause for your review, then reuse that workflow next time. Describe the steps and ask Copilot to build it, or write it yourself in code. Now in public preview in Copilot CLI, the Copilot app, and the Copilot SDK. Learn more about dynamic workflows. Automate tasks in desktop apps with computer use in Copilot CLI and the Copilot app, now in public preview on macOS and Windows. Copilot can navigate apps, edit content, and move information across workflows, even in software without an API or command-line
Unvalidated npm trusted publishing configurations now expire
October 2, 2026
Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing. This limits the risk of trusting a repository or project name that changes ownership. Your configuration becomes validated and exempt from expiry after its first successful publish. Changing the repository or project identity requires a new trust relationship with a fresh 48-hour validation window—ordinary edits don’t restart the deadline. If your configuration expires, recreate it to start a new 48-hour window. Expired configurations remain visible in trusted publisher settings but don’t count toward per-package limits. Other valid configurations on the package are unaffected. npm also now rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target restriction. If affected, move publishing to a permitted event such as push, release, or workflow_dispatch. Join the discussion within GitHub Community. The post Unvalidated npm trusted publishing configurations now expire appeared first on The GitHub Blog.
npm staged publishing now supports creating new packages
October 2, 2026
You can now create a new npm package with npm stage publish, using a local session or a granular access token, including a stage-only token. This lets you create packages from your automated workflows without a manual first publish. This works for public scoped and unscoped packages, and private scoped packages. Your first version enters the staged queue and requires a maintainer to promote it before that version becomes available to install. After package creation, you can manage its settings and configure trusted publishing. Learn more about staged publishing. Join the npm roadmap discussion in GitHub Community to share feedback and discuss what’s next. The post npm staged publishing now supports creating new packages appeared first on The GitHub Blog.
Stateless GitHub App installation tokens rolled out
October 2, 2026
The staged rollout of the stateless GitHub App installation token format, which began on April 27, 2026, is complete. By default, all newly minted GitHub App installation tokens will be in the stateless ghs_APPID_JWT format, which makes token issuance and validation faster and improves the reliability of the GitHub API. What’s changed Installation tokens still start with the ghs_ prefix, but they’re now about 520 characters long instead of 40. Token permissions, repository scoping, the one-hour expiration, and the installation access token REST API endpoint are unchanged. Tokens minted before the change continue to work until they expire. What to expect going forward The temporary X-GitHub-Stateless-S2S-Token request header, which we introduced so you could validate the new format on demand, will be deprecated on November 30, 2026. After that date, GitHub will no longer respect the header, and all eligible apps will always receive stateless tokens. To learn more about the temporary header, see our original changelog for its release. Once you’ve validated your apps and workflows with both token formats, remove the header from your production code before November 30, 2026. Check your
Copilot code review: API support and new default effort level
October 2, 2026
You can now request a GitHub Copilot code review through the REST and GraphQL APIs and set the review effort level for each request. Balanced is also now the default review effort level. These changes are generally available to Copilot Pro, Pro+, Max, Business, and Enterprise plans. 🔌 Request Copilot code review with the API You can now request a review from Copilot using the supported REST and GraphQL APIs. When you make a request, you can optionally set the review effort level for that review. This lets you bring Copilot code review into your own scripts, workflows, and internal tools, so reviews can start from the systems your team already uses. ⚖️ Balanced is now the default review effort level As announced on August 28, 2026, the Default review effort level now uses Balanced for new and existing repositories and organizations using Copilot code review. If you explicitly selected Lite in your settings, that selection was respected. This change took effect September 28, 2026. ⚙️ Configure your review effort level If you prefer Lite or want to try out the options available to you, you can change the review effort level from Default to Lite at the level you manage: Enterprise: In
Selected models in GitHub Copilot deprecated
October 2, 2026
As of today, October 2, 2026, we have deprecated the following models across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions). Model Deprecation date Suggested alternative Gemini 3.5 Flash 2026-10-02 Gemini 3.8 Flash Gemini 3.6 Flash 2026-10-02 Gemini 3.8 Flash Kimi K2.7 Code 2026-10-02 Kimi K3 Claude Opus 4.7 2026-10-02 Claude Opus 5.5 Please update your workflows and integrations to use supported models. Copilot Enterprise administrators may need to enable access to alternative models through their model policies in Copilot settings. As an administrator, you can verify availability by checking your individual Copilot settings and confirming that the policy is enabled for the specific model. Once enabled, you’ll see the model in the Copilot Chat model selector in VS Code and on github.com. No action is required to remove the deprecated models. GitHub Enterprise customers with questions or concerns are encouraged to reach out to their account manager for further assistance. Share your feedback To learn more about the models available in Copilot, see our documentation on models and get started with Copilot today. Join t
New fields for SecurityAdvisory GraphQL API
October 2, 2026
You can now read more of the GitHub Advisory Database directly from the GraphQL API without falling back to the REST API. The SecurityAdvisory object gained five new fields: cveId: The advisory’s CVE identifier. sourceCodeLocation: A link to the affected source code relevant to the advisory. githubReviewedAt: When GitHub reviewed the advisory. nvdPublishedAt: When the National Vulnerability Database (NVD) published its record. repositoryAdvisoryUrl: A link to the linked repository security advisory when there is one. The securityAdvisories query also gained two new filters, severities and isWithdrawn, so you can narrow results on the server instead of downloading everything and filtering it yourself. They work alongside the filters you already use, such as classification, identifier, EPSS, and published or updated since. This means fewer round trips, one authentication path, and one rate limit budget for integrations that read advisory data. It also makes it easier to build things like severity-based triage feeds, withdrawn advisory audits, and tracking of how quickly advisories move from NVD publication to GitHub review. These changes are additive and read-only, so your existing q
Repository security advisory comments API in public preview
October 2, 2026
You can now read, add, and edit comments on repository security advisories using the REST API, including advisories created from private vulnerability reports. Until now, the discussion on an advisory was only reachable in the web UI, even though it often holds the most useful triage context on a vulnerability report. With the new endpoints, you can: List the comments on a repository security advisory, optionally limited to those updated since a given time. Get a single comment. Add a comment. Edit a comment. Repository security advisory responses also now include a comments count, and global advisory responses include the count for their linked repository advisory, so you can tell which advisories have discussion before you fetch it. These fields count non-confidential comments and help identify advisories with comment activity before fetching the comments. This helps you export advisory discussions for audits and migrations, automatically add triage notes, and build advisory workflows that work the same way as the ones you already have for issues and pull requests. A few things to know: Access follows the same rules as the advisory itself. You need the repository security advisor
Confidential comments on repository security advisories
October 2, 2026
You can now post confidential comments on repository security advisories. Confidential comments are visible only to people with write access to the repository, so you can discuss a report with your team without the reporter or other invited collaborators seeing it. Previously, every comment on an advisory was visible to all of its collaborators, including the reporter. To discuss suspected abuse, investigation details, or coordination notes, you had to move the conversation somewhere else and lose it from the advisory’s history. With this update: Select Confidential. Only maintainers will see this comment below the comment box before you post. Confidential comments are clearly marked in the advisory timeline. Reporters and invited collaborators without write access can’t see confidential comments and aren’t notified about them. Access follows current repository permissions. If someone loses write access, they can no longer read confidential comments. Views of confidential comments are recorded in the audit log. You can’t switch a comment between confidential and regular after you post it. Confidential comments are available in the GraphQL API, but they aren’t returned by the REST A
Code coverage uploads no longer fail CI for new branches
October 1, 2026
Code coverage uploads from the GitHub Code Quality upload-code-coverage action no longer fail CI when you push a branch that doesn’t yet have an open pull request. Previously, the coverage API required a pull request number for any push to a non-default branch. Since that number only exists once a pull request is open, pushing a new branch before opening a pull request caused the coverage-upload step to fail, even though nothing was actually wrong with your workflow. Now, when the action runs on a push to a branch without an associated pull request, it skips the upload instead of failing, and explains why in an Actions notice and step summary. This applies to: Pushes to branches that don’t yet have an open pull request. Subsequent pushes to those branches, until a pull request is opened. Uploads for pushes to your default branch, and for supported pull request events, continue to work exactly as before, so you don’t need to change any existing workflow configuration. If your workflow uploads coverage only on push events, opening a pull request won’t trigger a new upload by itself—coverage resumes on the next push to that branch. If you want coverage to upload as soon as a pull requ
Dynamic workflows in Copilot CLI and the Copilot app
October 1, 2026
Dynamic workflows are now available in Copilot CLI, the GitHub Copilot app, and the GitHub Copilot SDK. These let you define an orchestration in code to get the reliability and observability that complex, multi-agent work demands. What is a dynamic workflow? A dynamic workflow is a program that defines how a task is carried out. It combines automated steps with the work of one or more agents, and those steps can run one after another, in parallel, or both. The steps, when to involve agents, and how to use their results are all defined in code, while agents handle the parts that need analysis or judgment. The program itself lives inside a GitHub Copilot extension, which means it has access to Copilot’s powerful extensibility APIs. For example, you could use a dynamic workflow to investigate a service incident: collect logs and telemetry, assign independent agents to analyze different systems, and combine their structured findings into a timeline and root-cause report. The same steps run every time. Dynamic workflows can: Run commands, use tools, or call other services. Divide a goal into tasks and run independent tasks in parallel. Pass structured results from one stage to the next.
Rate limits for private vulnerability reports
October 1, 2026
Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit in a day, both to your repository and across GitHub. This helps protect you from bulk and automated submissions, while legitimate researchers can still reach you. With this update: Private vulnerability reporting now applies daily per-user rate limits to new reports. Reporters who reach a limit see a message asking them to try again later. Limits apply only to new reports. Comments on existing advisories aren’t affected. Repository administrators can set a custom daily overall reporting limit for their repository. Repository administrators can add trusted reporters to an allow list so they’re never rate limited. To configure these settings, go to your repository’s settings, select Advanced Security, and click Settings next to “Private vulnerability reporting.” This is available for public repositories with private vulnerability reporting enabled on GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud. Learn more in our docs about configuring private vulnerability reporting. T
Structured forms for private vulnerability reports
October 1, 2026
Private vulnerability reports can now use a structured form that asks reporters for the details you need to assess a vulnerability, including a reproducible proof of concept. A single free-text box made it easy to submit low-quality or AI-generated reports and hard for you to find the signal in them. Now, by default, reporters must fill in four required fields: summary, details, proof of concept (at least 150 characters), and impact. Their answers are combined into the advisory description, so you review and edit the report as you do today. With this update: You can customize the form by adding a .github/VULNERABILITY_REPORT.yml file to your repository’s default branch. To apply a form to all repositories you own, add it to your organization or account’s .github repository. Forms use issue form syntax, and fields support min_length so you can require a minimum level of detail. If your form is invalid, the default form is used. You can require reporters to assign a CWE before they submit, from Settings > Advanced Security > Private vulnerability reporting. Organization and enterprise owners can enforce this setting through a policy. If your repository has a security policy, reporter
GitHub Copilot can now interact with desktop apps with computer use
October 1, 2026
Computer use is now available in public preview in GitHub Copilot CLI and the GitHub Copilot app on macOS and Windows. Copilot can interact with desktop applications on your behalf (e.g., reading accessible app content and visual context, clicking controls, entering and editing text, pressing keys, scrolling, dragging, and navigating workflows across applications). This expands the tasks Copilot can help automate, including workflows in legacy and GUI-only software that do not provide an API, command-line interface, or MCP integration. Copilot uses computer-use tools to navigate an expense-report workflow in Safari. You remain in control. Copilot asks for approval before controlling an app, and you can review or reset apps that you have chosen to always allow. On macOS, computer use also guides you through the required Accessibility and Screen Recording permissions. Organization-managed settings can disable the feature. To get started: In Copilot CLI, run /computer on. Use /computer show to check its status and /computer off to disable it. In the GitHub Copilot app, open Settings, select Computer Use, and turn on Enable Computer Use. You can also use /computer on. Computer use work
GitHub Actions: macOS 14 runner image retirement
October 1, 2026
The macOS 14 runner image will be retired on November 2, 2026. To raise awareness of the upcoming removal, jobs using macOS 14 will temporarily fail during the following scheduled brownout periods: October 5, 14:00 UTC to October 6, 00:00 UTC October 12, 14:00 UTC to October 13, 00:00 UTC October 16, 14:00 UTC to October 17, 00:00 UTC October 19, 14:00 UTC to October 20, 00:00 UTC October 23, 14:00 UTC to October 24, 00:00 UTC October 26, 14:00 UTC to October 27, 00:00 UTC October 29, 14:00 UTC to October 30, 00:00 UTC October 30, 14:00 UTC to October 31, 00:00 UTC This deprecation includes the following labels: macos-14 macos-14-large macos-14-xlarge During the lead-up to retirement, GitHub may reduce macOS 14 runner capacity, which could result in longer queue times for jobs that continue to use these labels. What you need to do Update your workflow files to use one of the following macOS arm64 labels: macos-latest (macos-26) macos-15 macos-latest-xlarge (macos-26-xlarge) macos-15-xlarge For up-to-date information about available tools and software, see the runner images repository. If you run into problems or need help, contact GitHub Support. The post GitHub Actions: macOS 14 r
GitHub Copilot in VS Code, September 2026 releases
October 1, 2026
This changelog covers VS Code v1.136 through v1.140, shipped throughout September 2026. September’s releases streamline agent-driven development from implementation through pull request merge. Automations handle repeatable tasks, agent merge helps land changes, and improved session management keeps work organized. Agents are also more flexible across workspaces, Dev Containers, and apps, while GitHub context helps you collaborate without breaking your flow. Agents window Agents window updates made it easier to automate work, manage sessions, and move changes from implementation to merge. Let HydraFusion coordinate models: If eligible, enable preview features and select HydraFusion in the model picker to choose models and workflows for your coding tasks automatically. This feature is in research preview. Schedule recurring work: Use automations to run tasks on an hourly, daily, or weekly schedule or run them on demand. Start from a template or use your own prompt. This feature is in preview. Get pull requests ready to merge: Enable agent merge in an active session to let the agent handle review feedback, failed checks, merge conflicts, and workflow reruns. This feature is in preview
Accessibility statements highlighted on repository overview
October 1, 2026
You can now find an ACCESSIBILITY.md file in your repository’s root, the .github/ directory, or the docs/ directory highlighted on the repository overview. You can also add or propose an accessibility statement from a public repository’s Community Standards page. This improvement is available on all GitHub plans on github.com and will be available in GitHub Enterprise Server 3.24. For more information, see Adding an accessibility page to your repository. The post Accessibility statements highlighted on repository overview appeared first on The GitHub Blog.
Actions retention now covers checks, runs, and statuses
October 1, 2026
As previously announced, checks, workflow runs, and statuses are now governed by the same GitHub Actions retention setting that controls how long artifacts and logs are kept. These records are automatically cleaned up when they exceed the retention period configured for your enterprise, organization, or repository. This applies to checks and statuses created by GitHub Actions and third-party applications. The setting is labeled “Check, workflow run, status, artifact and log retention” in the UI. Repository retention remains subject to organization and enterprise caps, and the maximum retention for public repositories is 90 days. Changing the setting won’t restore data that was previously removed. Review or update the artifact and log retention period for your repository. The expanded retention policy applies to GitHub Actions on github.com. The post Actions retention now covers checks, runs, and statuses appeared first on The GitHub Blog.
Scheduled code scanning skips inactive repositories
October 1, 2026
Weekly scheduled scans for code scanning default setup and GitHub Code Quality now start only after a push or pull request triggers an analysis, rather than counting every kind of scan as recent activity. Previously, activity for a repository was based on any unscheduled scan, including the one-time validation scan that runs when you first enable default setup and scans triggered by a change in detected languages. That meant enabling default setup or rolling out a security configuration across many repositories at once could make a dormant repository look active for another six months and trigger weekly scheduled scans you didn’t expect. The current behavior is as follows: Enabling default setup still runs an initial validation scan and populates findings right away. Weekly scheduled scanning only begins once a push or pull request triggers an analysis. This determination is based on analysis history, not on Git activity from before scanning was enabled. Activity continues to be shared between code scanning and Code Quality. If you manage code scanning or Code Quality across many repositories, you should see fewer unexpected weekly scans on repositories that haven’t had recent deve
New dashboard experience now the default
October 1, 2026
The new dashboard experience, previously available as a feature preview, is now the default view for everyone. The redesigned dashboard helps you focus on the work that matters most and makes it easier to find and act on what you need next. You can: View your active agent sessions, issues, and pull requests in one place. Use filters to choose what appears in each section, with up to 12 items in each list. Catch up on updates in the separate Feed tab, keeping your feed distinct from your productivity-focused dashboard. Start work directly from the dashboard, such as assigning an issue to Copilot coding agent or opening a pull request in Copilot Chat. If you’d rather keep the previous experience, you can switch back at any time by clicking the dropdown next to “Preview.” We’d love to hear your thoughts on the new dashboard experience. Drop a comment with any questions or feedback in the Community discussion. The post New dashboard experience now the default appeared first on The GitHub Blog.
GitHub async merge API generally available
October 1, 2026
You can now use the generally available GitHub async merge API to merge individual or stacked pull requests, add pull requests to a merge queue, or merge pull requests directly. This includes optionally bypassing rules if you have permission. The API processes merges asynchronously, helping your automations handle busy repositories without waiting for complex merges to finish in a single request. Submit a merge request with PUT, then poll with GET using the returned request ID to check its status. The async merge API is now the recommended path for programmatically merging pull requests instead of the synchronous REST endpoint or GraphQL mutations. It’s also the only merge API that supports stacked pull requests. Check out the async merge API documentation for request parameters and examples. The post GitHub async merge API generally available appeared first on The GitHub Blog.
Actions Runner Controller release 0.15.0
October 1, 2026
GitHub Actions Runner Controller 0.15.0 includes reliability, scalability, and observability improvements for runner scale sets. These updates help you operate larger runner fleets with fewer disruptions during upgrades and Kubernetes API updates. Here’s what’s now available: Patch version upgrades now update resources in place, reducing disruption between autoscaling runner sets and ephemeral runner sets. Controller shutdown behavior is more reliable because terminationGracePeriodSeconds is configurable and now aligns with the controller manager graceful shutdown timeout. Runner scale sets can be reregistered when the recorded scale set no longer exists in the Actions service. Controller updates now use patch requests instead of full update requests, reducing Kubernetes API payload size. Runner status aggregation has moved to metrics for EphemeralRunnerSet and AutoscalingRunnerSet, reducing status patch requests. Listener Kubernetes client rate limits are configurable through QPS and burst settings. Controller concurrency can now be configured globally and per controller with max-concurrent-reconciles flags. Controllers now filter incoming events so they perform fewer reconciliati
Opt-in dist-tag permissions for npm trusted publishing
September 30, 2026
Trusted publishing configurations for npm can now be granted permission to manage dist-tags (e.g., promoting a version to latest, updating next and beta pointers) using short-lived OIDC credentials instead of a long-lived access token. Previously, trusted publishing covered publishing and staging, but not dist-tag operations. That meant maintainers who had otherwise fully moved to token-free, OIDC-based workflows still had to keep a granular access token around solely to manage tags after a release or a rollback. Each trusted publishing configuration now has an opt-in Allow npm dist-tag permission. It defaults to off for both new and existing configurations, so no configuration automatically gains new capability. The permission is independent of direct publishing, so a staging-only configuration can also be granted dist-tag management. A dist-tag operation is authorized if the incoming OIDC token matches any one configuration with the permission enabled. Existing token-based dist-tag management continues to work unchanged. To use it, open your package’s trusted publishing settings and enable Allow npm dist-tag on the configurations that should be able to manage tags. Learn more abo
GitHub Advanced Security trials for GitHub Team
September 30, 2026
GitHub Team customers can now start self-serve trials of GitHub Advanced Security to evaluate GitHub Code Security and GitHub Secret Protection. Start a trial from your organization’s Overview page, Billing and licensing > Licensing page, or the Risk Assessment completion page. For more information, see self-serve GitHub Advanced Security trials. The post GitHub Advanced Security trials for GitHub Team appeared first on The GitHub Blog.
HydraFusion in VS Code and the GitHub Copilot app
September 30, 2026
The HydraFusion research preview is now available in Visual Studio Code and the GitHub Copilot app, expanding beyond Copilot CLI. HydraFusion appears in the model picker, but rather than being a single model, it orchestrates multiple models. HydraFusion treats workflow selection as an optimization problem. It uses capability signals for reasoning, code generation, debugging, and tool use to select the most efficient execution pattern to meet the quality bar. HydraFusion uses one of three workflows: Single: One selected model directly solves the task. Cascade: An efficient model drafts a solution and a quality gate decides whether to accept it or escalate to a stronger model. Critique: One model drafts a result, an independent read-only critic from a different model family reviews it—following the same review pattern as Rubber Duck—and the drafting model revises once. Get started In VS Code (version 1.140 or later, or VS Code Insiders): Select HydraFusion from the Copilot Chat model picker. If it does not appear, enable chat.copilot.hydraFusion.enabled. If you get Copilot through an organization or enterprise, an administrator may need to allow preview features in organization or en
X25519-only TLS ends for GHE.com on October 7
September 30, 2026
Beginning October 7, 2026, GitHub Enterprise Cloud with data residency will no longer accept TLS connections from clients that offer only X25519 for key agreement. Most customers don’t need to take action. The affected endpoints will continue to support the FIPS-approved P-256 (secp256r1) and P-384 (secp384r1) groups. Current browsers, operating systems, GitHub CLI releases, and commonly used TLS libraries already support P-256. You may be affected if an application, proxy, security appliance, or TLS library is explicitly configured to offer only X25519. Before October 7, 2026, you should: Update your operating system, runtime, GitHub CLI, proxy, and TLS libraries to supported versions. Remove any X25519-only configuration. Ensure P-256 (secp256r1) is enabled. You may also enable P-384 (secp384r1). After October 7, X25519-only clients will be unable to establish HTTPS connections. This change applies only to GitHub Enterprise Cloud with data residency. SSH connectivity is not affected. If you need help validating your TLS configuration, contact GitHub Support. The post X25519-only TLS ends for GHE.com on October 7 appeared first on The GitHub Blog.
Repository custom runner settings for Dependabot
September 29, 2026
As a repository administrator, you can now configure the runner type, optional custom label, and optional runner group for Dependabot version and security updates. This extends the runner configuration already available at the organization level, giving you more control over where each repository’s Dependabot jobs run. Labeled runners can target both self-hosted and larger GitHub-hosted runners suited to your project’s needs, such as access to private package registries or specialized environments. These repository-level settings are available for private and internal repositories on github.com. The controls are hidden for public repositories and on GitHub Enterprise Server. To get started, open your repository settings and select Advanced Security. Under “Dependency scanning”, find “Dependabot version updates”, then edit Runner type. Choose Labeled runner, then optionally enter a custom label and runner group. If you do not specify a label, Dependabot uses the dependabot label. Alternatively, choose Standard GitHub runner to use the default GitHub-hosted environment. Security configurations do not currently enforce Dependabot runner settings. Check out the docs to learn more about
Bring business context with external custom properties
September 29, 2026
You can now seamlessly bring business context about your repositories from an external system of record (e.g., a configuration management database (CMDB), an internal developer portal, or an in-house system) into GitHub with external custom properties. This feature is now in public preview. Keep business context aligned with its source, with updates managed by your external system. This includes information such as ownership, service tier, lifecycle stage, and compliance status. When to choose external custom properties Use custom properties when you want to manage this context in GitHub, whether through the UI or APIs. Choose external custom properties when an external system should exclusively own and continuously update that context: Read-only in the GitHub UI: Users can’t edit these values in GitHub, preventing conflicting updates across systems. Ongoing synchronization: Your external integration uses the external custom properties APIs to keep values current as your source data changes. Dedicated namespace: Your integration manages properties under its own prefix, keeping them separate from properties managed by other sources. You can use external custom properties everywhere
GPT-6.1 Sol in GitHub Copilot
September 29, 2026
GPT-6.1 Sol, the latest model from OpenAI, is now generally available and rolling out in GitHub Copilot. You can use it for agentic coding and terminal workflows with strong multistep coding performance and efficient token use. In early testing, it reliably completed tasks while using noticeably fewer tokens and steps than earlier models in the GPT-6 and GPT-5.6 families. This model is billed at provider list pricing under usage-based billing. See Models and pricing for GitHub Copilot for details. Availability in GitHub Copilot GPT-6.1 Sol is available to Copilot Pro+, Max, Business, and Enterprise users. You can select it in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot coding agent GitHub Copilot app github.com GitHub Mobile on iOS and Android JetBrains IDEs Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Business and Enterprise administrators can manage access to GPT-6.1 Sol through the model policy in Copilot settings. Under default model enablement, new models are automatically enabled unless an administrator has turned off the global default or explicitly disables this model. Learn more
Self-hosted runner version enforcement date has moved
September 28, 2026
The enforcement date for GitHub Actions minimum version requirements for self-hosted runners on GitHub Enterprise Cloud has changed. The change ships Monday, September 28, 2026, and full enforcement now begins Tuesday, September 29, 2026. This is instead of the date that was previously announced. The requirements themselves are unchanged: Self-hosted runners below version 2.329.0 won’t be able to register or reregister. Existing runners below the minimum version required to execute workflow jobs (which is a higher version than the registration minimum) will stop running jobs, even if they were previously registered. If you haven’t upgraded your self-hosted runners yet, do so before September 29, 2026 to avoid disruption to your workflows. See the self-hosted runner documentation for upgrade guidance. You can also use the new REST API for runner version deprecations to check the registration and runtime deprecation dates for any runner version and build automated alerts for fleets nearing their deadline. This shift only affects GitHub Enterprise Cloud. GitHub Enterprise Server isn’t impacted. Enforcement already began for GitHub Enterprise Cloud with Data Residency on July 31, 2026.
Claude Sonnet 5.5 in GitHub Copilot
September 28, 2026
Claude Sonnet 5.5, Anthropic’s newest Sonnet model, is now generally available in GitHub Copilot. It is designed for well-scoped everyday work like building features and fixing bugs. In our early testing, Sonnet 5.5 stood out for its efficiency, matching Claude Sonnet 5 on coding tasks while using significantly fewer steps, tokens, and tool calls. It also finished tasks noticeably faster. This model is billed at provider list pricing under usage-based billing. See Models and pricing for GitHub Copilot for details. Availability in GitHub Copilot Claude Sonnet 5.5 is available to Copilot Pro, Pro+, Max, Business, and Enterprise users. You can select the model in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot coding agent GitHub Copilot app github.com GitHub Mobile on iOS and Android JetBrains IDEs Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Enterprise and Copilot Business plan administrators can manage access to Claude Sonnet 5.5 through the model policy in Copilot settings. Under default model enablement, new models are automatically enabled unless an administrator has turned off the global
Enterprise managed settings in-product validator
September 25, 2026
You can now use an in-product validator for enterprise managed settings for GitHub Copilot. The validator detects malformed JSON, unsupported configurations, invalid team mappings, and other errors that can prevent policies from being enforced. Review and correct errors in the “Copilot settings validation” section of the enterprise AI controls page. Each issue identifies the affected file and JSON path, helping you make corrections to ensure that policies are enforced as intended. Validation covers: copilot/managed-settings.json copilot/team-mappings.json and any team settings files referenced by the team mappings file After correcting an issue, commit the change to the default branch of your .github-private repository, reload the Agents page, and review the validator results to confirm that your configuration is valid. To learn more, see our documentation on enterprise managed client settings. The post Enterprise managed settings in-product validator appeared first on The GitHub Blog.
Usage metrics API adds pull request review stages
September 25, 2026
The enterprise and organization repository-level Copilot usage metrics reports now break down how long pull requests spend in each stage of review. A new pull_request_review_times array on each repos-1-day row reports a median and a 90th percentile for the time from ready for review to first review, first review to final review, and final review to merge. What’s new Each entry in pull_request_review_times includes: authored_by and reviewed_by: Who opened and who reviewed the pull requests in this entry. Both are human in this release. total_merged: The number of qualifying pull requests merged in the repository that day. median_minutes_ready_to_first_review and p90_minutes_ready_to_first_review: Time from the pull request becoming ready for review to its first review. median_minutes_first_to_final_review and p90_minutes_first_to_final_review: Time between the first and final review. median_minutes_final_review_to_merge and p90_minutes_final_review_to_merge: Time from the final review to merge. Durations are in minutes and attributed to the day the pull request merged. The existing pull_requests fields are unchanged. Why this matters Teams can already see when pull requests take a l
Private saved views for repository issues and “Relates to” issue relationship is generally available
September 25, 2026
Private saved views for repository issues Repository issues pages now support private saved views, making it easier to create and save personalized views of your issues. “Relates to” issue relationship The “Relates to” issue relationship now works across the REST API, GraphQL API, webhooks, timeline events, issues search, and projects search. Share your feedback on personal saved views for repository issues in GitHub Community discussion. The post Private saved views for repository issues and “Relates to” issue relationship is generally available appeared first on The GitHub Blog.
Changes to query results in the GitHub Actions API and UI
September 25, 2026
Queries for workflow runs in the GitHub Actions API and UI now return a less precise but more accurate count of records when you search by workflow, event, status, branch, or actor. We will continue to return paginated results of up to 1,000 items. However, if the number of found records exceeds 2,500, we will report “2,500+” instead of attempting to return the exact number of records. This is because queries that retrieve more than 2,500 records frequently timeout and return the number of records found before the timeout rather than the true count. By implementing this limit, our counts will be more accurate and we will improve performance for customers. If your integrations or scripts rely on retrieving more than 2,500 matching workflow runs from a single query, narrow your filters (e.g., by adding a date range) to retrieve the specific runs you need. This change is rolling out now on github.com and GitHub Enterprise Cloud. The post Changes to query results in the GitHub Actions API and UI appeared first on The GitHub Blog.
Agentic autofix now uses Copilot Memory
September 25, 2026
Agentic autofix now uses Copilot Memory for customers who’ve enabled it. When you use agentic autofix, it reviews existing memories for context that can help resolve security alerts. When it creates a fix, it stores the fix pattern as a memory for future use. These memories can help agentic autofix resolve additional security alerts and teach other GitHub Copilot features (e.g., Copilot code review, Copilot cloud agent) about secure development patterns unique to your repository. Both agentic autofix and Copilot Memory are available in public preview. Learn more in our docs about GitHub Copilot Memory. The post Agentic autofix now uses Copilot Memory appeared first on The GitHub Blog.
GitHub Copilot weekly releases — September 21
September 25, 2026
This week’s releases add new models to Copilot, local sandboxing in the Copilot app, and updates to Copilot in Slack, Microsoft Teams, JetBrains, and VS Code. GitHub Copilot Claude Opus 5.5 is available to Copilot Pro+, Max, Business, and Enterprise plans. GPT-6 Sol is available to Copilot Pro+, Max, Business, and Enterprise plans. GPT-6 Luna is available to Copilot Pro, Pro+, Max, Business, and Enterprise plans. Grok 4.7 is available to Copilot Pro, Pro+, Max, Business, and Enterprise plans. GitHub Copilot app Limit agents’ access to files, networks, and credentials with local sandboxing, now in public preview. Track agent activity in your existing monitoring tools with OpenTelemetry, configured through enterprise-managed settings. Download the Copilot app. GitHub Copilot in Slack and Microsoft Teams Choose the best model for each task. Switch models mid-conversation, and Copilot keeps your choice for the rest of the thread. In Slack, you can also set channel defaults. Avoid duplicate issues since Copilot now checks for similar existing issues before creating a new one. Follow longer-running tasks more easily with clearer implementation-plan status, better recovery from interrupte
Updates to GitHub Copilot for Slack and Microsoft Teams
September 25, 2026
GitHub Copilot in Slack and Microsoft Teams now gives you more context, more control, and a clearer path from conversation to GitHub work. Whether you’re sharing files in Slack or images and forwarded messages in Teams, Copilot can use more of the context already in your conversation. We’ve also improved how Copilot creates GitHub work and connects it back to the source discussion, so teams can more quickly see the context behind a decision. Better context for the work you’re already doing You can now use supported Slack files, attachments, and message links as context. In Teams, Copilot can work with inline images, forwarded-message context, and channel and thread history. Copilot also checks for similar issues before creating a new one, includes direct links to the resulting work, and keeps a link back to the originating conversation so the context remains easy to trace. More control over how you work You can switch models for the next message and keep that choice throughout the conversation. In Slack, you can also set default owners and repositories. This makes it easier to keep work moving across repositories and shared conversations. Bug fixes and reliability improvements We’v
CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support
September 25, 2026
CodeQL 2.27.1 adds new queries for C/C++ and C#, support for Kotlin 2.4.20, and query-accuracy improvements. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code. Language and framework support C/C++ We’ve added taint flow models for boost::asio::ip::basic_resolver::resolve, flow summaries for Bloomberg Development Environment’s BloombergLP::bdlbb::Blob segmented byte buffer, and flow summaries for the Protocol Buffers google::protobuf::MessageLite C++ API. Go We’ve added or improved data flow models for Go 1.27 standard-library APIs, including bytes.CutLast, database/sql.ConvertAssign, database/sql/driver.RowsColumnScanner.ScanColumn, net/url.URL.Clone, net/url.Values.Clone, strings.CutLast, and the new encoding/json/jsontext package. We’ve expanded data flow models for the strings package, including Clone, Cut, CutPrefix, CutSuffix, Fields, FieldsFunc, Join, Builder, Reader, and Replacer APIs. Java/Kotlin CodeQL now supports Kotlin 2.4.20. We’ve fixed extraction of Foo::class.java arguments when using the Kotlin K2 compiler. This reduces false positives in queries such as java/android/implicit-pendingint
Default Enablement of Copilot Features for Copilot Business and Enterprise
September 25, 2026
We’re introducing a new global default policy for generally available GitHub Copilot features and supported client capabilities in enterprise and organization Copilot settings. For the next 28 days, you can configure this policy, but it won’t affect feature access for your users yet. What’s changing Today, you can configure the new policy by going to the “AI Controls” page, opening the “Copilot” subpage, and selecting an option under “Default policy for new features”. This policy applies to eligible features managed on your enterprise’s “Features & clients” page (i.e., https://github.com/enterprises/YOUR-ENTERPRISE-SLUG/ai-controls/copilot/features), as well as the Copilot Code Review policy on the “Agents” page and the MCP servers in Copilot policy. For feature eligibility and exceptions, see our docs on default availability. You can choose from the following settings: Enabled: Current and future eligible features will be available to users by default. Disabled: Current eligible features will remain unavailable, and future eligible features will require administrator approval. Let organizations decide: Organization administrators can choose whether to enable or disable eligible fe
Expired GitHub Actions artifacts no longer shown in UI and API
September 24, 2026
Expired artifacts are no longer displayed in the GitHub Actions run summary or returned by the REST API. Previously, an expired artifact remained visible with an “Expired” pill, even though the underlying files had already been deleted from storage. That leftover pill left some users unsure whether they were still being billed for storing artifacts that no longer existed. To remove that ambiguity, expired artifacts will not be shown when viewing run data, including: The list of artifacts on a workflow run summary page. The list artifacts for a repository and get an artifact REST API endpoints. If you need to know which artifacts a workflow run produced after they’ve expired, you can still find that information in the run’s logs. This change doesn’t affect artifact retention settings or billing—it only changes how expired artifacts are displayed. The post Expired GitHub Actions artifacts no longer shown in UI and API appeared first on The GitHub Blog.
Require proof of presence for high-impact actions
September 24, 2026
You can now require an interactive re-authentication or a multi-factor challenge before members take high-impact actions on GitHub Enterprise Cloud accounts. Proof of presence is an expansion of GitHub’s sudo mode for enterprises, enforcing a higher security bar when it’s needed. This public preview is only scoped to managed user (EMU) enterprises on github.com and GHEC-DR that use Microsoft Entra ID as their SSO identity provider (IdP), via SAML or OIDC. Stolen session cookies and long-lived authentication tokens have shown up in several recent supply chain attacks. Proof of presence confirms that a real, authorized person is acting at the moment the high-impact action happens, not just that a valid session or token was used. We validate this by sending the user back to their IdP to check, allowing you to set custom IdP policies to govern the actions taken on GitHub. This improves security posture by blocking the use of compromised or hijacked credentials or agents going an extra step without your knowledge. It also helps regulated customers meet compliance requirements for fresh authentication before sensitive operations from frameworks like FDA Part 11. With proof of presence en
More ways to request and configure Copilot code reviews
September 23, 2026
GitHub Copilot code review now offers additional personal configurations to an expanded set of Copilot plans and an enterprise-level default setting. These improvements are now generally available: A dedicated personal settings page for automatic review and your default review effort An enterprise-wide default review effort setting for organization-owned repositories ⚙️ Manage your personal review settings Previously, personal Copilot code review settings were available only with Copilot Pro, Pro+, and Max on the “Copilot features” page. They covered a single automatic review setting without separate controls for draft pull requests or new pushes. Under your profile → Copilot settings, a dedicated “code review” page under Copilot is now available on every Copilot plan, including Copilot Business and Copilot Enterprise. From this page you can: Turn on automatic reviews from Copilot, which will trigger when you create a pull request, coauthor a pull request, or move a pull request out of draft state. Turn on automatic review for new pushes and for draft pull requests you create or coauthor. Set your default review effort, shown today as Lite or Balanced. Your default effort appl
Node 20 is no longer available in GitHub Actions
September 23, 2026
This is the final notification that Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available. If you maintain a JavaScript action, update its runs.using value to node24 and publish a new release as soon as possible. For details, see the metadata syntax for JavaScript actions. If you use JavaScript actions in your workflows, update to the latest versions of those actions that support Node 24. For details, see using versions for actions. The newest versions of all first-party actions were updated to use Node 24 as referenced in our announcement changelog. Node 24 is incompatible with macOS 13.4 and earlier, and it doesn’t officially support ARM32. Self-hosted runners using these operating systems or architectures are no longer supported. This change applies to github.com and GitHub with Data Residency. The post Node 20 is no longer available in GitHub Actions appeared first on The GitHub Blog.
Local sandboxing in the GitHub Copilot app
September 23, 2026
Local sandboxing helps reduce the potential impact of unintended commands by limiting access to files, network resources, and credentials on your machine. In the GitHub Copilot app, you configure it per project for local repository and working tree sessions. The project’s sandbox settings include: Filesystem: Additional read/write, additional read-only, and denied folder lists. Network: Outbound internet and local network settings. Credentials: Git credentials for authenticated HTTPS git operations, and GitHub CLI credentials for GitHub CLI authentication. These project settings describe the policy that the app requests when a sandboxed session starts. The effective policy can be more restrictive when enterprise-managed settings apply. If your operating system cannot enforce the requested policy, the sandboxed shell fails with an error rather than running without a sandbox. Get started Local sandboxing is off by default. Open the app settings, select your project, and turn on Sandbox new sessions under “Sandbox”. This applies to new sessions in the project, not sessions already running. Changes to filesystem, network, and credential settings apply to new sessions or when an existin
OpenTelemetry in the GitHub Copilot app
September 23, 2026
Understand how Copilot agents perform and interact with models and tools. The GitHub Copilot app now supports OpenTelemetry (OTel) configuration through enterprise-managed settings. OTel is an open source observability framework. Administrators can use it to send agent activity data to their organization’s compatible monitoring tools. This helps teams: Analyze agent sessions: Follow the flow of a session, including requests to AI models and the tools an agent uses. Investigate unexpected behavior: Review step-by-step traces of agent execution in their existing monitoring tools. Manage monitoring centrally: Apply telemetry settings across teams instead of requiring each developer to individually configure them. Get started Configure the telemetry property in your enterprise’s managed-settings.json file to enable export and specify the endpoint that will receive the data. Prompt and response content is excluded by default—review your content-capture settings before enabling it. Learn more about OpenTelemetry for agent monitoring and configuring enterprise-managed settings. The post OpenTelemetry in the GitHub Copilot app appeared first on The GitHub Blog.
New features and improvements in Copilot for JetBrains
September 23, 2026
GitHub Copilot for JetBrains 1.18.0 brings AI-assisted tool approvals, more control over agent conversations, and shared skills and instructions for your organization. You can also review plans with the Codex agent and manage MCP tools with persistent controls. What’s new AI-assisted tool approvals AI-assisted tool approvals, called assisted approvals, are now in public preview for Copilot agent sessions. Low-risk tool calls receive automatic approval, while higher-risk actions continue to prompt you for a decision. This gives you fewer approval interruptions for low-risk actions while keeping higher-risk decisions in your hands. Re-edit earlier messages You can now re-edit a previous user message in a Copilot agent session. Before sending your replacement message, Copilot rewinds both the conversation and file changes. This lets you revise an earlier request and continue from that point, rather than adding another message to correct the direction of the conversation. Shared skills and instructions Local and Copilot agent sessions now support organization and enterprise skills, along with organization-managed custom instructions. You can use shared skills and organizational guidanc
Faster C++ code intelligence with whole codebase indexing
September 22, 2026
C++ code intelligence in GitHub Copilot CLI is now faster with support for whole codebase indexing. C++ repositories can contain millions of lines of code across deeply connected source files and headers. Without a reusable index, code-intelligence requests may need to rediscover project information as you navigate, making it slower to find a definition, locate references, or understand unfamiliar code. Whole codebase indexing (WCI) creates a persistent index of symbols across your C++ project, including files that aren’t currently open. The Microsoft C++ Language Server uses your project’s compilation information to resolve types, symbols, includes, and relationships between files. WCI makes that symbol information available for reuse instead of rediscovering it for each request. You spend less time waiting for definitions, references, implementations, and symbol search results, and more time reviewing, understanding, and changing code. Configure indexing Whole codebase indexing is enabled by default because its persistent symbol index helps the Microsoft C++ Language Server efficiently understand relationships across your entire project. The language server loads the index when y
OpenAI’s GPT-6 Sol and GPT-6 Luna now available
September 22, 2026
OpenAI’s GPT-6 family is expanding in GitHub Copilot with two additional models: GPT-6 Sol, and GPT-6 Luna. Joining the previously released GPT-6 Astra, these new options let you select the model that best fits your task, whether that’s everyday agentic coding or fast, cost-efficient assistance. GPT-6 Sol: A balanced model for interactive and agentic coding. A strong all-round choice for development tasks that benefit from careful, multistep validation. GPT-6 Luna: A lightweight, cost-efficient model for smaller, faster tasks and the lowest-cost option in the GPT-6 family. These models are billed under usage-based billing. See pricing for GitHub Copilot models and requests for details. Availability in GitHub Copilot GPT-6 Sol is available to Copilot Pro+, Max, Business, and Enterprise plans. GPT-6 Luna is available to Copilot Pro, Pro+, Max, Business, and Enterprise plans. You can select the models in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot cloud agent GitHub Copilot app github.com GitHub Mobile iOS and Android JetBrains Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see the models yet. Enabling access Copilot Enterprise
Security improvements for SSH
September 22, 2026
We’re removing several SSH algorithms, adding a new algorithm, and requiring larger RSA SSH keys to improve security. The changes are as follows: We’re removing the ability to use RSA keys using SHA-1 in SSH (i.e., the ssh-rsa signature type, including ssh-rsa-cert-v01@openssh.com certificates using SHA-1). We’re removing the key exchange mechanism diffie-hellman-group-exchange-sha256. All new RSA SSH keys uploaded after October 14, 2026 must be at least 3072 bits in size, both for signing and authentication. We’re additionally supporting the post-quantum key exchange method mlkem768x25519-sha256 for SSH sessions on github.com and GitHub Enterprise Cloud with Data Residency, except for the U.S. region. Adding ML-KEM lets us offer a newer, more performant key exchange method that is secure against quantum computers. We’re also removing the older Diffie-Hellman method, a slow, little-used algorithm that could be broken with advances in quantum computing. For RSA, we’re removing the use of SHA-1 since it’s known to be weak, as well as increasing key sizes to align with 128-bit security requirements. Schedule October 14, 2026: The new RSA key size requirements take effect. In addition,
Claude Opus 5.5 is now available in GitHub Copilot
September 22, 2026
Claude Opus 5.5, Anthropic’s newest Opus model, is now available in GitHub Copilot. You can use it for agentic coding, long-running agentic tasks, and knowledge work. In early testing, Opus 5.5 resolved tasks comparably to Claude Opus 5 while using significantly fewer steps and tokens. It also quickly recovered from errors in multistep tasks. Claude Opus 5.5 watermarks its text outputs. The watermark doesn’t change the meaning, quality, or readability of outputs, nor does it add any tokens or cost. To learn more visit Anthropics’s How Claude’s text watermark works. This model is billed at provider list pricing under usage-based billing. See Models and pricing for GitHub Copilot for details. Availability in GitHub Copilot Claude Opus 5.5 is available to Copilot Pro+, Max, Business, and Enterprise users. You can select the model in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot coding agent GitHub Copilot app github.com GitHub Mobile on iOS and Android JetBrains IDEs Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Enterprise and Copilot Business plan administrators can manage access to Claude Op
Deprecation notice: All-platform CodeQL bundle
September 22, 2026
Starting with CodeQL CLI 2.27.0, the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst), which includes the binaries for all supported platforms up to this release, is marked as deprecated. In mid-March 2027, we will remove the all-platform CodeQL bundle. Download the platform-specific bundle for your supported operating system and architecture instead. Linux ARM64 binaries are available only through platform-specific downloads and will not be included in the all-platform bundle. To learn more, see the documentation about supported platforms. The post Deprecation notice: All-platform CodeQL bundle appeared first on The GitHub Blog.
Refreshed repository pull requests page generally available
September 22, 2026
The new repository pull requests page is now generally available to all GitHub users. Highlights The new page makes it easier to find and act on pull requests in a repository, with new filtering and search options to help you find exactly what you’re looking for: Content assist helps you easily find and apply the correct filters. Advanced search supports AND and OR keywords as well as nested searches. Collapsible sidebar gives you quick access to common filters (e.g., “Authored by me” and “Involves me”). Compact presentation mode lets you fit more pull requests on the page. More context including status check counts, stack indicator, and indicators for unread updates. Recent improvements Since the public preview, your feedback has helped us make several improvements. Now you can: Collapse the sidebar to make more room for the list. Take bulk actions on one or more pull requests, including closing, labeling, changing milestones, and more. See milestones, linked issues, and author badges. Click a review status to filter the list. See full profile names if they’re enabled for your enterprise. To learn more, see About pull requests. The post Refreshed repository pull requests page gene
GitHub Enterprise adds credential inventory exports
September 21, 2026
Enterprise owners can now export a complete inventory of every credential that can access their enterprise (e.g., SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens). This enables enterprise owners with a single plane view into all the credentials owned by members and apps across their enterprise. During a security incident, this enables their security teams to quickly assess the risk surface area and plan remediation and communications based on the identified set of compromised tokens. With this release, enterprise owners and members with the fine-grained permission View enterprise credentials can: Export the inventory from enterprise settings or programmatically retrieve it through a paginated REST API. View the full credential inventory CSV or filter by user, app, credential type, or organization. Review credential metadata, including owners, scopes and permissions, creation and expiration dates, last-used dates, and target organizations or repositories. Correlate credentials with audit log activity to get more insights about their usage and risk exposure. If you’re an enterprise owner, you ca
Grok 4.7 is now available in GitHub Copilot
September 21, 2026
Grok 4.7, xAI’s latest reasoning model, is now rolling out in GitHub Copilot. Building on Grok 4.6, it is designed for agentic coding and complex, multistep workflows. This model is billed at provider list pricing under usage-based billing. See Models and pricing for GitHub Copilot for details. Availability in GitHub Copilot Grok 4.7 will be available to Copilot Pro, Pro+, Max, Business, and Enterprise SKUs. You’ll be able to select the model in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot cloud agent GitHub Copilot app JetBrains Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Enterprise and Copilot Business plan administrators can manage access to Grok 4.7 through the model policy in Copilot settings. Under default model enablement, new models are automatically enabled unless an administrator has turned off the global default or explicitly disables this model. Learn more To explore all models available in GitHub Copilot, see our documentation on models and get started with Copilot. The post Grok 4.7 is now available in GitHub Copilot appeared first on The GitHub Blog.
Copilot code review: An improved review experience
September 18, 2026
Copilot code review now gives you a clearer view of how a review changes over time, more intelligently auto-resolves its own suggestions, and generates useful commit messages when you accept eligible suggestions in a batch. These updates help you focus on findings that still need attention and make the resulting commits easier to understand. These updates are now generally available. 🔍 Clearer review progress at a glance The refreshed overview comment shows Copilot’s current assessment of your pull request, the review effort level it used, and lists a summary of the findings it identified in its review. Findings are now grouped into: Open: Issues that have not been addressed yet. These may have a new label, indicating that they were introduced by a new commit. Resolved since last review: Copilot has validated that you’ve fixed those issues it found earlier. Each finding includes its severity and a link to the corresponding inline comment, so you can quickly move from the overview to the relevant code. Previously missed: Issues not introduced by a new commit, but newly found in your existing changes by Copilot’s subsequent review. This section includes the exact details of those co
Manage the code coverage ruleset condition with the REST API
September 18, 2026
You can now use the generally available REST API to manage the Restrict code coverage repository ruleset option, in addition to the existing UI support. This ruleset lets you enforce a minimum code coverage percentage based on line coverage or set a maximum tolerable coverage drop for a pull request. Previously, configuring this rule required using the web interface. Now you can create, update, and read this ruleset option programmatically, making it easier to manage code coverage requirements consistently across many repositories or as part of your existing infrastructure-as-code workflows. To use this rule, your repository must have GitHub Code Quality enabled and code coverage uploads configured. It’s available on GitHub Enterprise Cloud and GitHub Team, including GitHub Enterprise Cloud with data residency. It isn’t available on GitHub Enterprise Server. Learn more about available rules for rulesets and the REST API endpoints for rules. The post Manage the code coverage ruleset condition with the REST API appeared first on The GitHub Blog.
GitHub Copilot weekly releases — September 14
September 18, 2026
This week, GitHub Copilot adds new model selection options, code review updates, and Sentry integration in the Copilot app. There are also updates for admins, plus new agent features in VS Code. GitHub Copilot Copilot code review now resolves addressed comments during subsequent reviews, leaving outstanding feedback open. It also suggests commit messages when you apply its code suggestions. Reviews can use shell tools to validate changes, and Lite reviews now combine findings from multiple agents. Choose how Copilot weighs cost, quality, and response time with the new efficiency, balance, and intelligence tiers in auto model selection. All three tiers select from the same available models. This update is rolling out in VS Code, Copilot CLI, and the Copilot app. GitHub Copilot Business and Enterprise users Measure adoption and activity in the dedicated VS Code Agents window with new usage metrics that are now generally available. Enterprise and organization reports include daily active users, session counts, and user message totals, alongside user-level activity data. These metrics are separate from the editor-window metrics. Get help choosing values for repository custom properties
Upcoming deprecation of selected GitHub Copilot models in mid-October
September 18, 2026
We will deprecate the following models across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions) on October 19th, 2026: Model Deprecation date Suggested alternative Gemini 3.7 Flash 2026-10-19 Gemini 3.8 Flash GPT-5.5 2026-10-19 GPT-5.6 Sol GPT-5.4 2026-10-19 GPT-5.6 Sol GPT-5.4 mini 2026-10-19 GPT-5.6 Luna GPT-5 mini 2026-10-19 GPT-5.6 Luna Grok 4.5 2026-10-19 Grok 4.6 Please update your workflows and integrations to use the supported models before this date. Under default model enablement, the suggested alternatives are automatically enabled for Copilot Enterprise and Copilot Business customers unless an administrator has turned off the global default or explicitly disabled the model. If you’ve turned off the global default, you can enable access to the alternative models through their model policies in Copilot settings. Once enabled, users will see the model in the Copilot Chat model selector in supported GitHub Copilot experiences. No action is required to remove the models after they have been deprecated. GitHub Enterprise customers with questions or concerns are encouraged to contact their account team for assistan
Stage-only npm tokens for safer automation
September 18, 2026
You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token permission to publish new versions directly to the npm registry. Your workflow uses npm stage publish to submit a version. A package maintainer then reviews and approves its release with two-factor authentication (2FA). npm rejects direct npm publish attempts with that token, even if you’ve configured it to bypass 2FA for automation. Stage-only tokens retain other package write permissions, including moving dist-tags and deprecating versions. Protect them with the same care as any other write token. Prepare your automation for the token transition This release is opt-in and doesn’t change existing tokens or their direct-publish capabilities. As previously announced, npm is targeting January 2027 to remove direct publishing through bypass-2FA tokens. If you can’t move to trusted publishing yet, stage-only tokens offer a migration path for token-based automation. To get started: Create a granular access token with Read and write (stage only) permissions for the packages your workflow needs. Replace you
Copilot impact dashboard now shows feature engagement
September 17, 2026
The Copilot impact dashboard now shows how many active users regularly use key Copilot features. Enterprise administrators can quickly see which experiences are widely adopted and which may need more enablement. Enterprise and organization report APIs now include the same 28-day feature engagement breakdown, along with an AI adoption phase reporting improvement that adds each phase’s full rolling 28-day population as of each report day. What’s new Copilot impact dashboard: Shows how many active users engaged with each included feature on at least two days during the 28-day period. copilot_feature_engagement: Adds the dashboard’s active-user total and feature engagement counts to enterprise and organization 28-day aggregate reports. totals_by_feature: Breaks engagement down by code completion, agent edit, passive Copilot code review, active Copilot code review, Copilot cloud agent, Copilot CLI, and Copilot app. users_in_phase_28d: Reports the full rolling 28-day population classified into each AI adoption phase as of that day. The existing total_engaged_users field continues to only report users in the phase who were active that day. Why this matters Enterprise leaders can see which
Agentic CLI customizations now in the usage metrics API
September 17, 2026
GitHub Copilot expands existing CLI report coverage with agentic activity metrics for skills, custom agents, Model Context Protocol (MCP) servers, slash commands, and plugins. What’s new The fields appear in enterprise and organization per-user and aggregate 1-day reports, per-user 28-day reports, and the day_totals entries in aggregate 28-day reports. In a per-user report, the fields answer two questions about that user’s activity. In an aggregate report, they answer the same questions across the enterprise or organization: Which items are used most? The totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin arrays list up to five items with the most recorded activity. Each entry includes an interaction_count. Depending on the category, this counts invocations for skills, slash commands, and plugin skills, plus custom agent starts and MCP server connection attempts. How many different items were used? The distinct_skill_use_count, distinct_custom_agent_use_count, distinct_mcp_use_count, distinct_slash_cmd_use_count, and distinct_plugin_use_count fields count the number of different items used. In a per-user report, each item that user use
Ubuntu 26 generally available and latest migration
September 17, 2026
The Ubuntu 26.04 runner image for GitHub Actions is now out of public preview and fully supported for production workflows on both x64 and arm64. As part of this release, the ubuntu-latest label will migrate to Ubuntu 26.04, giving you the latest supported Ubuntu release by default. Using Ubuntu 26.04 To run your workflows on the new image, set runs-on: ubuntu-26.04 or runs-on: ubuntu-26.04-arm in your workflow file. Ubuntu 26.04 includes updated, and in some cases removed, tools and tool versions compared to earlier images. These changes can break workflows that depend on specific software versions or preinstalled packages. Review the full list of changes and test your workflows against Ubuntu 26 before the migration begins. ubuntu-latest is migrating to Ubuntu 26.04 The ubuntu-latest label will migrate from Ubuntu 24.04 to Ubuntu 26.04. This migration will roll out gradually between October 19 and November 19, 2026. During this window, workflows that use ubuntu-latest will automatically move to Ubuntu 26.04. Because this moves your workflows to a new operating system version, the migration may break builds that rely on tools, packages, or versions that changed between Ubuntu 24.0
Workflow execution protections in GitHub Actions generally available
September 17, 2026
Workflow execution protections for GitHub Actions, previously in public preview, are now generally available for GitHub Enterprise, organizations, and repositories. Execution protections let you define an allowlist that controls who can trigger an Actions workflow and what events can start it. Actor rules cover the who, event rules cover the what, and actions evaluate both before a run. What’s new Alongside the actor and event rules you’ve used in public preview, general availability adds: Workflow file targeting: Scope execution protection rules to specific workflow files rather than an entire repository, so a single repository can apply different policies to different workflows. For example, restrict deploy.yml to a designated team while leaving CI workflows open to all contributors. Insights: See how actions evaluate and enforce your rules across your enterprise, organization, and repositories. This enables you to audit policy impact and tune rules both before and after you enforce them. REST API: Manage execution protections programmatically at the enterprise, organization, and repository level. Create, read, update, and delete rules — including workflow path conditions — so yo
SCIM user responses now include a profileUrl attribute
September 16, 2026
SCIM user responses from GitHub now include the standard profileUrl attribute defined by RFC 7643, containing the absolute URL of the GitHub account linked to the external identity. Previously, matching a SCIM record to the corresponding GitHub account required extra lookups or inference. Identity providers and IT teams provisioning access to GitHub through SCIM can now read profileUrl directly instead of working around the gap. profileUrl is returned from the /Users endpoint and is consistently supported across both organization and enterprise SCIM responses. profileUrl is omitted when an external identity isn’t yet linked to a GitHub user. The attribute is documented in the SCIM OpenAPI schema and example responses. userName and other attributes continue to return the same values as before, so existing SCIM, GraphQL, and identity management integrations aren’t affected. This is an additive change and no action is required for existing integrations. If you want to use the new mapping, start reading profileUrl in your SCIM responses when it’s present. Learn more in the REST API documentation for Enterprise SCIM and Org SCIM. The post SCIM user responses now include a profileUrl att
Copilot budget increase requests are generally available
September 16, 2026
Previously, when a member used all the Copilot AI credits available to them, they were blocked from Copilot features that consume credits. This release adds a flow for them to request more budget the moment they hit the limit. You can approve, adjust, or deny that request without leaving your settings. Requests automatically route to whichever account pays for the budget. Requests against an organization-owned budget appear in your organization’s settings, and requests against an enterprise-owned budget appear in your enterprise’s settings. As an organization owner, enterprise owner, or billing manager, you can review pending requests under “Requests from members”, set a new amount for each one, and select Approve and increase. Approving a request updates the member’s budget to the amount you set and immediately restores their access to AI credits. This feature is available with the GitHub Copilot Business and GitHub Copilot Enterprise plans under usage-based billing. To learn more, see Managing requests for additional Copilot budget and Setting up budgets to control spending on metered products. The post Copilot budget increase requests are generally available appeared first on Th
Code scanning AI Scan no longer requires CodeQL default setup
September 16, 2026
You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured. What’s changed Code scanning and AI Scan for pull requests must still be enabled at the repository, organization, or enterprise level, if the organization belongs to an enterprise. The same permission hierarchy still applies. There’s no new setup step. If you’ve already enabled GitHub code scanning’s AI Scan for your organization, it now runs more broadly across your eligible repositories, regardless of whether CodeQL default setup is configured. This change is now in public preview for organization-owned and personal repositories on github.com for GitHub Advanced Security customers. GitHub Enterprise Server is not supported for this release. To learn more, see our docs about AI-powered security detections. Join the discussion and leave feedback on GitHub Community. The post Code scanning AI Scan no longer requires CodeQL default setup appeared first on The GitHub Blog.
Enforce GitHub Advanced Security configurations
September 15, 2026
Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise. Previously, enforcement only prevented repository owners from changing these settings. To configure enforcement in a security configuration, select Don’t enforce, Enforce for repository owners, or Enforce for repository and organization owners from the “Enforcement” dropdown menu. Learn more in our docs about security configurations. The post Enforce GitHub Advanced Security configurations appeared first on The GitHub Blog.
GitHub Copilot suggests custom properties definitions
September 15, 2026
GitHub Copilot can now suggest allowed values when you create a custom property for repositories in your organization. This feature is in public preview for GitHub Copilot Business and Copilot Enterprise plans. Custom properties let enterprise and organization admins attach governance metadata to repositories, which you can then use to target repositories with rulesets. Custom properties are one of the most popular ways to scope rulesets, but getting started has been a challenge. Admins often aren’t sure which properties to define or what allowed values to use, and inconsistent metadata makes it harder to apply governance consistently across a large fleet of repositories. With this release, when you create a new custom property definition at the enterprise or organization level, Copilot will suggest relevant allowed values based on the property you’re defining. For example: Creating a multi-select property like FedRAMP surfaces suggested compliance-related values. Creating a single-select property like internet-facing surfaces suggested values such as yes and no. You can accept a suggestion in one click, helping you stand up a meaningful custom property taxonomy faster. Enterprise
SHA-1 in HTTPS on GitHub sunset
September 15, 2026
Previously we announced we would be disabling SHA-1 in HTTPS for GitHub on September 15th, 2026. Following the planned schedule, GitHub has disabled SHA-1 in HTTPS for github.com and partner CDNs, including GitHub Enterprise Cloud and GitHub Enterprise Cloud with Data Residency. GitHub Enterprise Server is unaffected. Please see the previous announcement for more information. The post SHA-1 in HTTPS on GitHub sunset appeared first on The GitHub Blog.
Configure cost and quality in Copilot auto model selection
September 14, 2026
GitHub Copilot auto model selection now offers three tiers: efficiency, balance, and intelligence. Choose the tier that reflects how you want auto to weigh cost, quality, and response time for each prompt. Copilot will then optimize accordingly. Efficiency prioritizes keeping costs low and suits fast, straightforward tasks. Balance weighs cost, quality, and latency together, and is a good fit for everyday work. Intelligence prioritizes quality and is built for complex tasks. All three tiers use the same set of available models. Auto individually evaluates each prompt to select a best-suited model. For example, a simple task like adding a docstring to an existing function may use a small, efficient model even when auto is optimizing for intelligence. This feature is currently rolling out in Visual Studio Code, Copilot CLI, and GitHub Copilot app. Usage is charged based on the model auto selects, regardless of tier. Paid subscribers continue to receive a 10% discount on usage billed through auto. This is the first step in our journey toward letting you customize how model selection works for you, with more visibility into the tradeoffs you’re making. Learn more about Copilot Auto mod
Profiles now show your highest achievement badge tier
September 11, 2026
Your GitHub profile now displays the highest tier you’ve earned for achievements with multiple levels. Previously, profiles could display the first tier earned, even after you had progressed to a higher level. Now, your profile better reflects your latest achievement and the progress you’ve made on GitHub. The post Profiles now show your highest achievement badge tier appeared first on The GitHub Blog.
Add VS Code Agents to Copilot usage metrics
September 11, 2026
GitHub Copilot usage metrics reports now include generally available metrics for activity in the dedicated VS Code Agents window, helping you measure adoption and engagement across enterprises and organizations. What’s new Aggregate enterprise and organization reports for both 1-day and 28-day periods now include: daily_active_vscode_agent_users: An optional count of unique users active in the VS Code Agents window each day. totals_by_vscode_agent: Optional aggregate of session_count and total_user_messages values. Enterprise-user and organization-user reports for both 1-day and 28-day periods now include: used_vscode_agent: An optional indicator of whether the user used the VS Code Agents window. totals_by_vscode_agent: Optional per-user session_count and total_user_messages values. Why this matters These metrics help you understand how many people use the VS Code Agents window and how they engage with it. You can use the aggregate reports to track adoption and activity trends, then use the user-level reports to understand usage across teams. Important notes These metrics cover the dedicated VS Code Agents window only. They remain separate from editor-window Agent Mode and generic
Auto-resolution and analysis updates in Copilot code review
September 11, 2026
Copilot code review now resolves its own comments once you address them and writes smart commit messages for you when you apply its code suggestions. Behind the scenes, Copilot now uses a broader set of shell tools to validate the code it reviews, and an ensemble of agents produce a more thorough review within the Lite effort level. Together, these updates make it easier to focus on the feedback that still matters and give Copilot more ways to check its work. Review experience updates ✅ Automatic resolution of addressed comments When you push a commit that addresses a Copilot code review comment, Copilot now resolves that comment during its rereview. Instead of manually resolving threads that are no longer relevant, you can now rely on the open comments to reflect only the feedback that still needs your attention. Comments are automatically resolved when a later commit addresses the underlying feedback. Feedback that is still outstanding stays open, so nothing gets lost. Smart commit messages on Copilot autofix suggestions When you apply a suggestion provided by a Copilot code review comment, instead of auto-filling the standard commit message, Copilot now generates a smart suggest
GitHub Copilot weekly releases — September 7
September 10, 2026
This week, GitHub Copilot introduces Jira integration in Copilot app and adaptive model orchestration with Project HydraFusion in Copilot CLI. We also introduced new agent automation in Visual Studio Code and expanded enterprise controls for Copilot in JetBrains. GitHub Copilot app Turn Jira issues into action. Bring Jira issues into a shared canvas, choose what moves forward, and let Copilot carry the context into investigation, implementation, and pull request preparation. Download the Copilot app. GitHub Copilot CLI Project HydraFusion is now in /experimental. HydraFusion delivers automated semantic routing between local, cloud, and compound models. You select HydraFusion like any other model, and it chooses a workflow that balances performance, cost, and latency for each task. To learn more, read the Project HydraFusion blog post. Install Copilot CLI. VS Code 1.137 release updates Schedule recurring agent tasks to run hourly, daily, or weekly, or run them on demand with automations, now in public preview. Voice mode is now in experimental so you can talk to, interrupt, or redirect Copilot while it works on your code. New in experimental, review issue and pull request details di
Refreshed repository pull requests page in public preview
September 10, 2026
A refreshed repository-level pull request listing page is now in public preview for all GitHub users. It brings powerful filtering, compact presentation mode, and more. Highlights The new page makes it easier to find and act on pull requests in a repository, with new filtering and search options to help you find exactly what you’re looking for: Content assist helps you easily find and apply the correct filters. Advanced search supports AND and OR keywords as well as nested searches. Collapsible sidebar gives you quick access to common filters (e.g., “Authored by me” and “Involves me”). Compact presentation mode lets you fit more pull requests on the page. More context including status check counts, stack indicator, and indicators for unread updates. Known limitations There are some known issues and feature gaps we are working to address: Milestones currently not shown Bulk updates currently not available Emojis in labels do not always appear Saving custom views not currently supported We want to hear from you Your feedback helps us improve the experience during the public preview. Click the Preview badge at the top of the page, then select Give feedback to let us know what you thin
AI Scan for pull request APIs in public preview
September 10, 2026
You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI. Manage AI Scan for pull requests at scale Use the new organization and repository APIs to read and update whether AI Scan for pull requests is enabled. Organization settings control whether pull request scans can run across the organization, and repository settings let you turn scans on or off for individual repositories. Repository settings do not override an organization-level disabled state. To view and update the status of AI Scan for selected repositories, users can use the /orgs/{org}/code-scanning/ai-scan and /repos/{owner}/{repo}/code-scanning/ai-scan endpoints. This public preview is available on github.com for GitHub Advanced Security customers. GitHub Enterprise Server is not supported for this release. For more information, see AI Scan security detections. Join the discussion and leave feedback on the announcement in GitHub Communit
Control GitHub Actions cache access with cache-mode
September 10, 2026
You can now use cache-mode to apply least-privilege access to the GitHub Actions cache at the workflow or job level. By granting each workflow or job only the cache access it needs, you can prevent unnecessary restores or saves and help protect trusted workflows from cache poisoning. This capability is now generally available on all plans. Choose the access each workflow or job needs: read allows cache restores but prevents cache saves. This is the default for low-trust events such as pull_request_target. write allows cache restores and saves. This is the default for trusted events such as push. write-only allows cache saves but prevents cache restores. none prevents all cache access. Job-level settings override workflow-level settings. The selected mode is enforced by the cache service and carries through reusable workflows, where a called workflow cannot receive more cache access than its caller granted. An explicitly declared cache-mode also overrides the read-only cache default for low-trust events such as pull_request_target. Declaring write or write-only for these events can increase the risk of cache poisoning, so GitHub Actions adds a warning annotation when the declared mo
MAI-Code-1-Flash deprecated
September 10, 2026
We have deprecated MAI-Code-1-Flash across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions) today, September 10, 2026. Model Deprecation date Suggested alternative MAI-Code-1-Flash 2026-09-10 MAI-Code-1.1-Flash Please update your workflows and integrations to use a supported model. Copilot Enterprise administrators may need to enable access to the alternative model through their model policies in Copilot settings. As an administrator, you can verify availability by checking your individual Copilot settings and confirming that the policy is enabled for the specific model. Once enabled, you’ll see the model in the Copilot Chat model selector in VS Code and on github.com. No action is required to remove the deprecated model. GitHub Enterprise customers with questions or concerns are encouraged to reach out to their account manager for further assistance. Share your feedback To learn more about the models available in Copilot, see our documentation on models and get started with Copilot today. Join the GitHub Community Discussion to share your feedback. The post MAI-Code-1-Flash deprecated appeared first on The GitHub Blog
Xcode 27 runner image now runs on macOS 27
September 10, 2026
You can now validate your Apple apps against macOS 27 using the Xcode 27 runner image for GitHub-hosted macOS runners, available in public preview. The image previously ran on macOS 26. How you target the image stays the same. Keep using the following labels in your workflow’s runs-on: value: xcode-27 xcode-27-xlarge This image runs on arm64 macOS runners only. To view the full list of installed software or report an issue, visit the runner-images repository. The post Xcode 27 runner image now runs on macOS 27 appeared first on The GitHub Blog.
npm extends recovery-code security holds to all accounts
September 9, 2026
npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused. You can still sign in as well as browse and install packages. The hold expires automatically — no action or support request is needed to restore full access. This extension builds on the preventive account protection npm introduced for high-impact accounts, further slowing account-takeover attempts and reducing the risk of malicious publishing from a compromised recovery code. If you’re unexpectedly blocked from publishing and you didn’t use your recovery code to sign in, contact npm Support right away. The post npm extends recovery-code security holds to all accounts appeared first on The GitHub Blog.
CodeQL 2.27.0 adds support for Linux ARM64
September 9, 2026
CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code. Language and framework support CodeQL CLI You can now run CodeQL natively on Linux arm64. Download the CodeQL CLI and CodeQL bundle from the linux-arm64 per-platform release assets. GitHub code scanning default setup can now use your organization’s private registry configurations to authenticate with container registries or the GitHub API when fetching custom queries or packs. This lets you use custom content from private Git sources and Docker registries. C# We’ve improved ASP.NET Core MVC controller and action discovery to more closely match runtime behavior. This improves coverage for application parts, endpoint mappings, inherited actions, as well as controller and action exclusions. We’ve added taint tracking support for OData action parameter binding. This improves detection coverage for vulnerabilities involving values extracted from ODataActionParameters a
Enterprise managed permissions for GitHub Copilot agent operations
September 9, 2026
If you administer GitHub Copilot Business or GitHub Copilot Enterprise, you can now centrally control which agent operations are blocked, require human approval, or can proceed without a prompt. Managed permissions cover shell commands, file reads and edits, and network domains. This gives you fine-grained guardrails for sensitive operations without disabling agent workflows. Managed restrictions can’t be weakened by user or workspace settings, auto-approval, or previously saved approvals. You can also provide specialized policies for different enterprise teams. These controls are generally available in the GitHub Copilot app, GitHub Copilot CLI, and Visual Studio Code sessions that use Agent Host. Learn more about enterprise managed permissions. Share feedback and implementation questions in the GitHub Community discussion. The post Enterprise managed permissions for GitHub Copilot agent operations appeared first on The GitHub Blog.
GitHub Advanced Security expands trial availability
September 9, 2026
More GitHub Enterprise Cloud customers can now start a self-serve GitHub Advanced Security trial to evaluate GitHub Code Security and GitHub Secret Protection. Eligibility has expanded from enterprises with up to 100 licenses to enterprises with up to 300 licenses. To set up a GitHub Advanced Security trial, go to the Enterprise “Billing and licensing” page. For details, see self-serve GitHub Advanced Security trials. The post GitHub Advanced Security expands trial availability appeared first on The GitHub Blog.
Block pull requests with exposed secrets from merging
September 9, 2026
Repository rulesets allow you to easily add scalable protections across your repositories. Starting today, you can use repository rulesets to block pull requests from merging when the pull request introduces secret scanning alerts. What’s new You can enable the new rule require secret scanning alerts are resolved on pull requests for selected repositories. Developers without bypass permissions must clear the block by resolving each alert. The rule checks two things before a pull request can merge: A secret scan has completed for the head commit No alerts are open for secrets introduced by the pull request’s commits By default, the rule runs on open pull requests and blocks secrets found via provider patterns. You can additionally configure the rule to block other categories (e.g., custom or generic patterns). This rule is available today in public preview for customers with GitHub Secret Protection or GitHub Advanced Security. How this rule differs from push protection Push protection stops a secret at the push, before it ever reaches the repository. This rule adds an additional layer of protection at the pull request layer, catching cases that push protection isn’t able to or conf
Remediate Code Quality findings with agentic autofix
September 9, 2026
Agentic autofix is now available to help you burn down findings in your code quality backlog. You can select up to 25 standard findings on a page and assign the whole set to Copilot in one action. Copilot starts fixing them agentically on a branch, validates its own changes, then opens a pull request for you to review and merge. Assign to Copilot replaces Generate fix for individual findings, so you get one consistent flow whether you select one finding or 25. Agentic autofix follows your existing enterprise policy for GitHub Code Quality. There is no separate policy to manage, so if your enterprise allows GitHub Code Quality, users can use bulk remediation too. Assigning findings to Copilot consumes AI credits. Bulk agentic autofix for code quality findings is available for repositories with GitHub Code Quality enabled on GitHub Team and GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency. Learn more in the GitHub Code Quality documentation. Join the discussion and share feedback in the GitHub Code Quality announcement. The post Remediate Code Quality findings with agentic autofix appeared first on The GitHub Blog.
Enterprise-managed sandbox in Copilot for JetBrains
September 9, 2026
This update brings support for enterprise-managed sandbox policies, cross-file cursor jumps for next edit suggestions, global project context in chat, enterprise policy diagnostics, and a new connection between terminal Copilot CLI sessions and JetBrains IDEs. It also improves model selection, the chat experience, and reliability across MCP servers and agent sessions. What’s new Enterprise-managed sandbox policies in public preview Enterprise administrators can now centrally configure sandbox behavior for GitHub Copilot in JetBrains IDEs. Managed policies can control sandbox enablement, filesystem and network access, proxy settings, developer-tool access, macOS Keychain access, and more. Managed restrictions take precedence over user settings. Copilot locks affected controls in the IDE and identifies settings managed by your organization, helping administrators enforce consistent development environment boundaries. The sandbox settings under GitHub Copilot > Sandbox are visible when your organization enables the Editor Preview feature flag or configures a managed setting to enable or disable the sandbox. If neither condition applies, the sandbox settings do not appear. For more inf
GitHub Enterprise Server 3.22 is now generally available
September 8, 2026
GitHub Enterprise Server (GHES) 3.22 is now available and introduces new capabilities across the platform. Here are a few highlights in the 3.22 release: Administrators can configure Copilot CLI to work with GHES for enterprises that operate in disconnected or air-gapped environments without connectivity to GitHub Cloud. Set up a model provider once in GHES, and your end users across the enterprise can use Copilot CLI with their GHES credentials. This capability is in technical preview and is subject to change. Enterprise teams, previously in public preview, is now generally available. Enterprise owners can use enterprise teams to manage users and their access across the entire enterprise, including organizations and repositories, from a single, centralized team structure. This reduces the operational overhead of managing user access across multiple organizations within an enterprise. Security analysts can now sort secret scanning push protection bypass requests and secret scanning alert dismissal requests by date, in ascending or descending order, using the filter bar at the repository, organization, and enterprise levels. Previously, sort order for these requests could not be adj
Automatic Dependabot access to GitHub-hosted registries
September 8, 2026
Dependabot can now read from private GitHub Packages registries without a personal access token. If a package has granted your repository access through “Manage Actions access” in the package settings, Dependabot reuses that grant. What’s new Dependabot’s GITHUB_TOKEN can now request packages: read, and Dependabot jobs send that token when pulling from *.pkg.github.com and ghcr.io. Any package that has granted your repository access through “Manage Actions access” will accept it, the same as a regular GitHub Actions workflow. This is available for every GitHub Packages ecosystem that Dependabot supports. How to enable it For each package Dependabot needs to read: Open the package’s settings page (under your organization’s or personal account’s Packages tab). Under “Manage Actions access”, add the repository that runs Dependabot with Read access. You don’t need to change dependabot.yml, and you can remove any PAT-based registry entries you added for these packages. Learn more Ensuring workflow access to your package Configuring access to private registries for Dependabot Editor’s note Shortly after the initial release on June 23, 2026, we temporarily rolled back this feature after i
New customer portal help.github.com
September 4, 2026
The support portal has been redesigned and moved to a new home at help.github.com. It brings support, docs, learning, community, and account resources together in one place with Copilot-powered search across all of them. What’s new for you: Find support, entitlements, and self-serve resources from a single entry point with less clicking across separate sites. Search anything and get Copilot-powered answers, no sign-in required. Easily view GitHub product statuses and important announcements. Visit help.github.com to try it out! Please note that we’re gradually rolling this out over the next couple of weeks so you may not see the new experience right away. If you don’t have access yet, support.github.com will continue to work as expected. Feedback or suggestions for improvement? Feel free to post directly to this discussion in the GitHub Community for consideration. The post New customer portal help.github.com appeared first on The GitHub Blog.
GitHub Copilot weekly releases — August 31
September 4, 2026
This week, GitHub Copilot expands model choice and content protections, while VS Code adds new ways to manage agent sessions and get pull requests merge-ready. GitHub Copilot, general Claude Fable 5.1 is available to Copilot Pro+, Max, Business, and Enterprise users. Gemini 3.8 Flash is rolling out to Copilot Pro, Pro+, Max, Business, and Enterprise users. For more information, see our list of all supported models. GitHub Copilot app and Copilot CLI Copilot app and CLI now honor content exclusions, keeping sensitive code out of context across agentic workflows. GitHub Copilot in JetBrains The GitHub Copilot harness is now generally available in Copilot for JetBrains, providing faster feature delivery and better code quality. For more information, see our previous changelog about the release. VS Code 1.136 release updates Agent Merge is now in public preview and gets your pull request ready to merge by resolving review feedback, failed checks, and merge conflicts. Multi-root workspaces are now experimental and bring Copilot and Claude agent sessions to every folder in your workspace. Chat backgrounds are now experimental and let you personalize the Agents window with built-in patter
GPT-6 Astra is generally available in GitHub Copilot
September 4, 2026
GPT-6 Astra from OpenAI is now available in GitHub Copilot. OpenAI’s latest general-purpose model, GPT-6 Astra, is designed for long-horizon, autonomous coding and agentic tasks. In our internal testing, GPT-6 Astra stood out for how it works, not just what it produces: it plans and validates as it goes, batches diagnosis with verification, and independently confirms its results before declaring a task done. That translated into stronger performance on long-horizon coding tasks with fewer steps than prior OpenAI models. This model is billed at provider list pricing under usage-based billing. See pricing for GitHub Copilot models and requests for details. Availability in GitHub Copilot GPT-6 Astra is available to Copilot Pro+, Max, Business, and Enterprise users. You can select the model in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot coding agent GitHub Copilot app github.com GitHub Mobile on iOS and Android JetBrains IDEs Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Enterprise and Copilot Business plan administrators can manage access to GPT-6 Astra through the model policy in Copilot se
New API endpoint provides privacy-safe star history data
September 4, 2026
Track repository star growth over time with the new star history REST API endpoint without exposing stargazer identities. Earlier this year, stargazer listing endpoints were restricted to admins and collaborators to protect user privacy. Now you can get the insights you need with a privacy-safe alternative. With the new endpoint, you can: Retrieve historical star counts with timestamps without exposing individual stargazer data. Update tools and integrations that previously tracked star growth before these privacy restrictions took effect. To learn more, see our GitHub REST API docs. If you have any feedback, leave a comment in our Community discussion. The post New API endpoint provides privacy-safe star history data appeared first on The GitHub Blog.
Multiple trusted publishing configurations for npm
September 3, 2026
We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback. Three updates to npm publishing are now generally available: Multiple trusted publishing configurations per package Staged packages can only be approved after malware scanning is complete Maintainers can see their staged history in the package versions tab A package can now have more than one trusted publishing (OIDC) configuration. Maintainers are no longer limited to one configuration per package to separate workflows with stable, prerelease, or staging versions. Before this, maintainers had to depend on workflow workarounds or keep a long-lived token around for the paths OIDC couldn’t cover. Each configuration is independent and additive, with its own repository, workflow, and environment criteria. You can add, list, and remove them from your package’s settings page. A publish or stage is authorized if the incoming OIDC token matches any one configuration. Configurations never restrict one another, and evaluation order is not guaranteed, so don’t build logic that depends on which configuration matches. Every trusted publishing configuration can stage a package by default. Dir
GitHub Actions: Early September 2026 updates
September 3, 2026
GitHub Actions now includes three updates that give you clearer visibility and finer-grained control over your workflows. New REST API for runner version deprecations A new REST API returns when registration and runtime support end for a given runner version, so you can plan runner upgrades before a version is deprecated. Call GET /actions/runners/deprecations/{version} at the repository, organization, or enterprise level. The response includes runner_version, runtime_deprecates_at, and registration_deprecates_at. New vulnerability-alerts permission for GITHUB_TOKEN You can now grant workflows read-only access to Dependabot alerts with the new vulnerability-alerts permission for GITHUB_TOKEN. This permission supports read and none values, which lets you follow least-privilege practices instead of relying on broader scopes. For more information, check the permissions key in the workflow syntax. New job context properties for reusable workflows Reusable workflows can now determine their own source identity at runtime with four new job context properties: job.workflow_ref: The full ref of the workflow file that defines the current job. job.workflow_sha: The commit SHA of the workflow
Upcoming deprecation of selected GitHub Copilot models
September 3, 2026
We will deprecate the following models across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions) on October 2nd, 2026: Model Deprecation date Suggested alternative Gemini 3.5 Flash 2026-10-02 Gemini 3.8 Flash Gemini 3.6 Flash 2026-10-02 Gemini 3.8 Flash Kimi K2.7 Code 2026-10-02 Kimi K3 Claude Opus 4.7 2026-10-02 Claude Opus 5 Please update your workflows and integrations to use the supported models before this date. Copilot Enterprise and Copilot Business administrators may need to enable access to the alternative models through their model policies in Copilot settings. As an administrator, you can verify availability in your organization or enterprise Copilot model settings and confirm that the policy is enabled for the specific model. Once enabled, users will see the model in the Copilot Chat model selector in supported GitHub Copilot experiences. No action is required to remove the models after they have been deprecated. GitHub Enterprise customers with questions or concerns are encouraged to contact their account team for assistance. Share your feedback To learn more about the models available in Copilot, see our do
GitHub CLI Linux package signing key expires September 5
September 3, 2026
The current PGP key for the GitHub CLI Linux package repositories expires on Saturday, September 5, 2026. Beginning with the first release after that date, APT and RPM repository metadata and newly published RPM packages will be signed with just the replacement key. In April, we published a keyring containing both the current and replacement keys. If you installed gh from the official APT or RPM repositories before April 8, 2026, and have not updated the setup since, follow the instructions in the full announcement before September 5. If you installed later, do not remember, or use a custom image or automation path, follow the steps in the announcement to verify that your system trusts the replacement key. This change does not affect you if you: Use Windows or macOS. Build from source. Install gh through Homebrew, Conda, or a community package manager. Use a direct .deb file or standalone archive binary from GitHub Releases. The post GitHub CLI Linux package signing key expires September 5 appeared first on The GitHub Blog.
Gemini 3.8 Flash is now available in GitHub Copilot
September 3, 2026
Gemini 3.8 Flash, Google’s latest Flash model, is now available in GitHub Copilot. In our early testing, Gemini 3.8 Flash performed strongly on complex terminal-based coding tasks and demonstrated rigorous validation and persistent recovery from actionable failures. This model is billed at introductory provider pricing under usage-based billing through December 31, 2026. See pricing for GitHub Copilot models and requests for details. Availability in GitHub Copilot Gemini 3.8 Flash will be available to Copilot Pro, Pro+, Max, Business, and Enterprise users. You’ll be able to select the model in the model picker in: Visual Studio Code Visual Studio Copilot CLI GitHub Copilot cloud agent GitHub Copilot app JetBrains IDEs Xcode Eclipse Rollout will be gradual. Check back soon if you don’t see it yet. Enabling access Copilot Enterprise and Copilot Business plan administrators can manage access to Gemini 3.8 Flash through the model policy in Copilot settings. Under default model enablement, new models are enabled automatically unless an administrator has turned off the global default or explicitly disables this model. Learn more To explore all models available in GitHub Copilot, see our
Reopening Copilot Business and Enterprise signups
September 3, 2026
We’re gradually reopening sign-ups for Copilot Business and Copilot Enterprise customers paying by credit card or PayPal over the next couple of weeks. If you’ve been waiting to get started with Copilot, select the plan that fits your needs. If your preferred option isn’t available yet, check back soon. To improve availability and reliability of Copilot services, we’re also strengthening account vetting and updating billing experiences for customers who pay by credit card or PayPal. What’s changing The following changes will apply to Copilot Business and Copilot Enterprise customers paying via credit card or PayPal: All new Copilot Business or Copilot Enterprise seat assignments will require payment for each seat before users gain Copilot access. At the start of the next billing cycle, all Copilot Business and Copilot Enterprise seats assigned will incur an upfront charge. This includes existing customers starting October 1, 2026. If you exceed your included usage, additional payment may be required for you and your users to continue using Copilot. Included usage may be prorated across the month to align with the seat cost proration. What’s not changing Plan pricing and seat prorat
CodeQL 2.26.4 improves GitHub actions security detections
September 3, 2026
CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.4, which adds support for Go 1.27, improves alert locations for Rust data flow queries, and includes accuracy improvements across C#, Java/Kotlin, and GitHub Actions. Language and framework support Go CodeQL now supports Go 1.27. Rust Alert locations for data flow queries are now more precise and are based on the actual source and sink nodes. Some alerts will change location, so they’ll appear as new alerts while the previous alerts close. Java/Kotlin We’ve added SQL injection sink models for Spring R2DBC DatabaseClient and the R2DBC SPI. Taint now propagates through calls to String.valueOf(Object) when the argument is a CharSequence (e.g., a String or a StringBuilder). JavaScript/TypeScript We’ve added support for regular expressions using the d flag and for the React Native Worklets 'worklet' directive. Python We’ve added taint flow through list.extend and list.insert, matching the existing taint flow through list.append. Query changes C# The cs/web/missing-token-validation query now recognizes enabled ASP.NET Core RequireA
Enterprise-managed settings support any default model
September 2, 2026
You can now set your preferred GitHub Copilot model as the default for new conversations through enterprise-managed settings. This lets you choose the default model that best fits your workflows. You can also customize the default by enterprise team, assigning a different default model based on team membership. Set the model key as overridable and update team configuration files in team-mappings.json so that enterprise teams can choose their own preferred default model. All other users inherit your enterprise default. Model defaults in managed settings are generally available with Copilot Business and Copilot Enterprise in the GitHub Copilot app, Copilot CLI, and Visual Studio Code. Learn more in our docs about enterprise managed settings, or join the discussion in the GitHub Community. The post Enterprise-managed settings support any default model appeared first on The GitHub Blog.
Content exclusions generally available in Copilot app and CLI
September 2, 2026
The GitHub Copilot app and Copilot CLI now respect content exclusion policies configured by enterprise, organization, and repository administrators. Copilot won’t use excluded files as context, helping you protect sensitive code across agentic workflows. This is available for Copilot Business and Copilot Enterprise customers. To learn more, see our docs about content exclusion. The post Content exclusions generally available in Copilot app and CLI appeared first on The GitHub Blog.
Enterprise Live Migrations from GHES to ghe.com generally available
September 1, 2026
Enterprise Live Migrations (ELM) is now generally available, enabling near-zero-downtime repository migrations from GitHub Enterprise Server (GHES) to GitHub Enterprise Cloud with Data Residency (GHEC DR), so you can move even your largest, most active repositories while the contributions keep flowing. Key features of ELM to consider when selecting a tool for your next repository migration are: Cutover in minutes, not days: ELM continuously syncs data from source to target, so developers keep working in their repositories throughout the migration. When you’re ready, the cutover only requires the time to drain remaining in-flight changes. This is especially valuable for business-critical repositories contributed to by geographically dispersed teams where there is no convenient downtime window to fit a migration into. Built for the largest monorepos: ELM was purpose-built to handle the repositories that push existing tooling to its limits (i.e., massive monorepos with deep git history, large volumes of issues and pull requests, and constant activity around the clock). Resource-level progress tracking surfaces failures before cutover, so you can make an informed decision about when to
Set an expiration date for individual user budgets
September 1, 2026
You can now set an optional expiration date on an individual user budget, and GitHub removes the budget on that date. This capability is generally available. The user then falls back to the next budget that applies to them (i.e., their cost center per-user budget or otherwise your universal budget). Previously, you had to remove every temporary budget override by hand, creating recurring cleanup work at enterprise scale. When you create or edit an individual user budget, you can choose: No expiration, which is the default and matches current behavior. Expiration at the start of the next billing cycle. Expiration on a specific date. You can change or clear an expiration date at any time. Set an expiration date in your billing settings, or use the expires_at field in the Budgets REST API when you create or update a budget. Expiration dates are available for the GitHub Copilot Business and Copilot Enterprise plans. Learn more about setting up budgets and the Budgets REST API. The post Set an expiration date for individual user budgets appeared first on The GitHub Blog.
Origin Code Hosting Is Live
August 17, 2026
via Cursor
Origin, Cursor's code hosting platform, is now live — fast, easy to use, and deeply integrated with Cursor. Get started by syncing your repos from GitHub: imports stay in sync in real time with GitHub as the source of truth. Pull requests are fully supported, diffs, comments and merges included, and sync both ways. Agents can browse code, answer questions, make changes, and push branches inside a repo, and third-party apps come pre-integrated: Vercel for preview deployments, Depot and Buildkite for CI.
View on X