GitHub CLI now supports expiring, auto-refreshing OAuth tokens in public preview to improve security and reduce reauthentications. • Opt in with --expiring flag or config setting; tokens refresh automatically. github.blog/changelog/2026-1…

You can now bulk convert all branch protection rules in a repo to rulesets in one action. • Preview, select enforcement, & choose to keep or delete original protections during import github.blog/changelog/2026-1…

GitHub secret scanning improvements refine alerts, audit logs, and token revocation workflows. • Audit log business field switches from enterprise display name to slug on Nov 12, 2026; update integrations to avoid issues. github.blog/changelog/2026-1…

Dependabot alerts REST API now includes the vulnerable dependency version directly in alert responses. • version_requirement shows the dependency version or constraint detected by Dependabot github.blog/changelog/2026-1…

A package firewall is available in public preview to inspect npm package metadata and downloads for malware before they reach endpoints like CI/CD hosts or coding agents. github.blog/changelog/2026-1…

Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4. • Available to all users and included in GitHub Enterprise Server 3.24 • Keeps projects updated when using these package manager versions github.blog/changelog/2026-1…

You can now manage Copilot model policies via REST API for enterprises, teams, apps, and orgs. • GET & PATCH endpoints available for model policies at four levels github.blog/changelog/2026-1…

Several GitHub Copilot models deprecated as of October 19, 2026. • Update workflows to supported alternatives like GPT-6.1 Sol, GPT-6 Luna, and Grok 4.7. • Admins can enable new models in Copilot settings for Enterprise users. github.blog/changelog/2026-1…

Some Git clones and fetches over HTTPS from public repos may temporarily require authentication during unusual traffic to protect ’s availability. github.blog/changelog/2026-1…

CodeQL no longer supports traced scans on macOS 27, Xcode 27, or Swift 6.4 due to missing Intel code in required system binaries. • Support for traced extraction ends for C/C++, C#, Go, Java, Kotlin, and Swift on these versions. github.blog/changelog/2026-1…

Open source license compliance is now generally available for GitHub Enterprise Cloud with ruleset-based, enterprise-wide license policy checks. • Enforces license compliance before merging PRs that add or change dependencies github.blog/changelog/2026-1…

GitHub Copilot in Slack and Microsoft Teams now supports multi-repo conversations to track PRs, issues, and project activity without switching chats. • Mention GitHub anywhere in messages and switch repos faster github.blog/changelog/2026-1…

You can now download a CSV report of GitHub Code Quality license usage to match your license count with your records. • Includes active committers, repos with commits in the last 90 days, and committer uniqueness per repo or org github.blog/changelog/2026-1…

Selected GitHub Copilot models will be deprecated on November 16, 2026. • Update workflows to use newer models like Claude Opus 5.5, GPT-6.1 Sol, or GPT-6 Luna before the date github.blog/changelog/2026-1…

AI Scan for pull requests is generally available, finding security risks in code changes beyond CodeQL’s coverage. • Supports languages like PHP, Shell, Terraform, Dockerfiles, JSP, Blazor, and more github.blog/changelog/2026-1…

Agentic autofix for code scanning alerts is now generally available, automating fix proposals and validations across your codebase before opening a pull request for review. github.blog/changelog/2026-1…

Email notifications for repository push events have been retired as of October 15, 2026. • Prevents spam by requiring consent before emails can be received. github.blog/changelog/2026-1…

HydraFusion updates include an expanded model pool, refined workflows, and a new Max option for deeper reasoning. • HydraFusion Max targets complex tasks needing thorough analysis with efficient token use. github.blog/changelog/2026-1…

Workflow lockfiles for GitHub Actions are now in public preview on GitHub Enterprise Cloud, allowing workflows to run with exact locked commits despite tag or branch moves. github.blog/changelog/2026-1…

GitHub Apps now support least privilege with new fine-grained permissions for repo creation & installation management. • Create repos using repository_creation:write without full admin rights github.blog/changelog/2026-1…