What changed in the GitHub API

Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4

 Bulk migrate branch protections to rulesets for a repository 
 Updates to GitHub secret scanning 
 Dependabot alerts REST API now includes dependency versions 
 GitHub package firewall in public preview 
 Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4 

GitHub Copilot models deprecated on October 19, 2026

 Copilot model policy API for enterprise, orgs, and teams 
 GitHub Copilot models deprecated on October 19, 2026 
 Some Git over HTTPS may temporarily require authentication 
 CodeQL changes for macOS 27, Xcode 27, and Swift 6.4 

Multi-repository support and other improvements for GitHub in Slack and Teams

 Open source license compliance generally available 
 Xcode 27 runner image generally available 
 Multi-repository support and other improvements for GitHub in Slack and Teams 

Upcoming deprecation of selected GitHub Copilot models in mid-November

 Multi-repo support and other improvements for GitHub Copilot in Slack and Microsoft Teams 
 Download GitHub Code Quality license usage as a CSV 
 Upcoming deprecation of selected GitHub Copilot models in mid-November 
 AI Scan for pull requests generally available 
 Agentic autofix for code scanning alerts general availability 
 Email notifications for repository push events have been retired 

GitHub Actions workflow lockfiles in public preview

 HydraFusion updates and new Max option 
 GitHub Actions workflow lockfiles in public preview 

Search and filter for budgets now available

 GitHub App improvements for least privilege and management 
 Gemini 4 Argon in GitHub Copilot 
 Audit GitHub Code Quality finding dismissals and reopenings 
 Secret scanning blocks Anthropic keys by default, adds Salesforce 
 Enterprise managed settings enforcement updates 
 Improved detection for withdrawn Dependabot alerts 
 Search and filter for budgets now available 
 Code scanning AI Scan metrics in security overview 

Push attribution for commits in limited public preview

 Client telemetry user attribution and configurable capture 
 Push attribution for commits in limited public preview 
 Anonymous organization-level registries for Dependabot 

New controls and chat improvements in Copilot for JetBrains

 New controls and chat improvements in Copilot for JetBrains 

Copilot code review: New organization billing options and controls

 GitHub Copilot weekly releases — October 5 
 CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis 
 Copilot code review: New organization billing options and controls 

Triage role users or higher can now archive pull requests

 Triage role users or higher can now archive pull requests 
 Screen readers can navigate timelines as lists 
 Draft pull requests count toward pull request limits 

Local sandboxing for GitHub Copilot now generally available

 Claude Haiku 5.5 in GitHub Copilot 
 Purpose-built model for leaked secret detection 
 Local sandboxing for GitHub Copilot now generally available 
 Discover local models in GitHub Copilot CLI 
 GitHub Copilot weekly releases — September 28 

Update your IDE to restore agent activity in Copilot usage metrics

 Update your IDE to restore agent activity in Copilot usage metrics 
enterprise management tools
 Stacked pull requests generally available 
 Code scanning AI Scan enablement status in security overview 

npm staged publishing now supports creating new packages

 Secret scanning adds detectors for Lovable, Supabase, and more 
 Unvalidated npm trusted publishing configurations now expire 
 npm staged publishing now supports creating new packages 

Selected models in GitHub Copilot deprecated

 Stateless GitHub App installation tokens rolled out 
 Copilot code review: API support and new default effort level 
 Selected models in GitHub Copilot deprecated 
 New fields for SecurityAdvisory GraphQL API 
 Confidential comments on repository security advisories 
 Repository security advisory comments API in public preview 

Code coverage uploads no longer fail CI for new branches

 Rate limits for private vulnerability reports 
 Structured forms for private vulnerability reports 
 GitHub Copilot can now interact with desktop apps with computer use 
 GitHub Actions: macOS 14 runner image retirement 
 GitHub Copilot in VS Code, September 2026 releases 
 Accessibility statements highlighted on repository overview 
 Actions retention now covers checks, runs, and statuses 
 Scheduled code scanning skips inactive repositories 
 Code coverage uploads no longer fail CI for new branches 
 Dynamic workflows in Copilot CLI and the Copilot app 
 New dashboard experience now the default 
 GitHub async merge API generally available 
 Actions Runner Controller release 0.15.0 

HydraFusion in VS Code and the GitHub Copilot app

 Opt-in dist-tag permissions for npm trusted publishing 
 GitHub Advanced Security trials for GitHub Team 
 HydraFusion in VS Code and the GitHub Copilot app 
 X25519-only TLS ends for GHE.com on October 7 

Bring business context with external custom properties

 Repository custom runner settings for Dependabot 
 Bring business context with external custom properties 
 GPT-6.1 Sol in GitHub Copilot 

Self-hosted runner version enforcement date has moved

 Self-hosted runner version enforcement date has moved 
 Claude Sonnet 5.5 in GitHub Copilot 

Expired GitHub Actions artifacts no longer shown in UI and API

 Enterprise managed settings in-product validator 
 Usage metrics API adds pull request review stages 
 Private saved views for repository issues and “Relates to” issue relationship is generally available 
 Changes to query results in the GitHub Actions API and UI 
 Agentic autofix now uses Copilot Memory 
 GitHub Copilot weekly releases — September 21 
 Updates to GitHub Copilot for Slack and Microsoft Teams 
 CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support 
 Default Enablement of Copilot features for Copilot Business and Enterprise 
 Require proof of presence for high-impact actions 
 Expired GitHub Actions artifacts no longer shown in UI and API 

Node 20 is no longer available in GitHub Actions

 More ways to request and configure Copilot code reviews 
 Node 20 is no longer available in GitHub Actions 
 Local sandboxing in the GitHub Copilot app 

New features and improvements in Copilot for JetBrains

 OpenTelemetry in the GitHub Copilot app 
 New features and improvements in Copilot for JetBrains 
 Faster C++ code intelligence with whole codebase indexing 
 Claude Opus 5.5 is now available in GitHub Copilot 
 OpenAI’s GPT-6 Sol and GPT-6 Luna now available 
 Security improvements for SSH 
 Deprecation notice: All-platform CodeQL bundle 

Grok 4.7 is now available in GitHub Copilot

 Refreshed repository pull requests page generally available 
 GitHub Enterprise adds credential inventory exports 
 Grok 4.7 is now available in GitHub Copilot 

Upcoming deprecation of selected GitHub Copilot models in mid-October

 Copilot code review: An improved review experience 
 Manage the code coverage ruleset condition with the REST API 
 GitHub Copilot weekly releases — September 14 
 Upcoming deprecation of selected GitHub Copilot models in mid-October 
 Stage-only npm tokens for safer automation 

Agentic CLI customizations now in the usage metrics API

 Copilot impact dashboard now shows feature engagement 
 Agentic CLI customizations now in the usage metrics API 
 Ubuntu 26 generally available and latest migration 
 Workflow execution protections in GitHub Actions generally available 

Code scanning AI Scan no longer requires CodeQL default setup

 Automate SSO authorization for classic PATs and SSH keys 
 SCIM user responses now include a profileUrl attribute 
 Copilot budget increase requests are generally available 
 Code scanning AI Scan no longer requires CodeQL default setup 

SHA-1 in HTTPS on GitHub sunset

 Enforce GitHub Advanced Security configurations 
 GitHub Copilot suggests custom properties definitions 
 SHA-1 in HTTPS on GitHub sunset 
ecosystem & accessibility
 Profiles now show your highest achievement badge tier 

Configure cost and quality in Copilot auto model selection

 Configure cost and quality in Copilot auto model selection 

Add VS Code Agents to Copilot usage metrics

 Add VS Code Agents to Copilot usage metrics 
 Auto-resolution and analysis updates in Copilot code review 
 GitHub Copilot weekly releases — September 7 

AI Scan for pull request APIs in public preview

 Refreshed repository pull requests page in public preview 
 AI Scan for pull request APIs in public preview 
 Control GitHub Actions cache access with cache-mode 
 MAI-Code-1-Flash deprecated 
 Xcode 27 runner image now runs on macOS 27 
 npm extends recovery-code security holds to all accounts 

Upcoming deprecation of selected GitHub Copilot models

 CodeQL 2.27.0 adds support for Linux ARM64 
 Enterprise managed permissions for GitHub Copilot agent operations 
 GitHub Advanced Security expands trial availability 
 Block pull requests with exposed secrets from merging 
 Remediate Code Quality findings with agentic autofix 
 Enterprise-managed sandbox in Copilot for JetBrains 
 GitHub Enterprise Server 3.22 is now generally available 
 New customer portal help.github.com 
 Automatic Dependabot access to GitHub-hosted registries 
 GitHub Copilot weekly releases — August 31 
 GPT-6 Astra is generally available in GitHub Copilot 
 New API endpoint provides privacy-safe star history data 
 Multiple trusted publishing configurations for npm 
 GitHub Actions: Early September 2026 updates 
 Upcoming deprecation of selected GitHub Copilot models 
 GitHub CLI Linux package signing key expires September 5 
 Gemini 3.8 Flash is now available in GitHub Copilot 
 Reopening Copilot Business and Enterprise signups 
 CodeQL 2.26.4 improves GitHub actions security detections 
 Enterprise-managed settings support any default model 
 Content exclusions generally available in Copilot app and CLI 
 Enterprise Live Migrations from GHES to ghe.com ge