GitHub - 6

2026 (12)

October (5)

github: Rate limits for private vulnerability reports

GitHub

2026-10-01

GitHub is adding rate limits for private vulnerability reports to reduce low-quality and automated submissions that can obscure important reports. The change caps how many new reports a single account can submit.

github: Structured forms for private vulnerability reports

GitHub

2026-10-01

Private vulnerability reports now support structured forms to collect the details needed for triage, including a reproducible proof of concept. This replaces reliance on a single free-text field with a more guided intake flow.

github: Accessibility statements highlighted on repository overview

GitHub

2026-10-01

GitHub now highlights an `ACCESSIBILITY.md` file on the repository overview when it is located in the repository root, `.github/`, or `docs/`. The changelog entry also notes support for adding or proposing an accessibility statement file.

github: Scheduled code scanning skips inactive repositories

GitHub

2026-10-01

Weekly scheduled scans for code scanning default setup and GitHub Code Quality now run only after a repository has had an analysis triggered by a push or pull request. Repositories with no recent activity no longer count toward scheduled scanning.

github: Code coverage uploads no longer fail CI for new branches

GitHub

2026-10-01

GitHub Code Quality’s upload-code-coverage action no longer causes CI failures when coverage is uploaded from a branch that does not yet have an open pull request. This changes behavior from the previous failure case for new branches.

September (7)

github: Opt-in dist-tag permissions for npm trusted publishing

GitHub

2026-09-30

npm trusted publishing can now optionally get permission to manage dist-tags using short-lived OIDC credentials. This covers actions like moving tags such as latest, next, and beta without using long-lived credentials.

github: X25519-only TLS ends for GHE.com on October 7

GitHub

2026-09-30

Starting October 7, 2026, GitHub Enterprise Cloud with data residency (GHE.com) will stop accepting TLS connections from clients that support only X25519 for key agreement. Most customers are not expected to be affected.

github: Repository custom runner settings for Dependabot

GitHub

2026-09-29

Repository administrators can now set the runner type, optional custom label, and optional runner group for Dependabot version and security updates. This extends existing runner configuration options for Dependabot.

github: Bring business context with external custom properties

GitHub

2026-09-29

GitHub now supports external custom properties so repository business context can be synced from a system of record such as a CMDB, internal developer portal, or other in-house system. This lets teams attach external metadata to repositories more seamlessly.

github: Usage metrics API adds pull request review stages

GitHub

2026-09-25

GitHub’s enterprise and organization repository-level Copilot usage metrics reports now include pull request review stage timing. Each repos-1-day row gets a new pull_request_review_times array with time spent in each review stage.

github: Private saved views for repository issues and “Relates to” issue relationship is generally available

GitHub

2026-09-25

GitHub repository issues now support private saved views, allowing users to save personalized issue filters and layouts. The “Relates to” issue relationship is also generally available.

github: Agentic autofix now uses Copilot Memory

GitHub

2026-09-25

Agentic autofix now checks Copilot Memory when that feature is enabled, using existing memories as context to help resolve security alerts.