GitHub

GitHub is consolidating security, AI, and supply chain tooling while enforcing capacity limits on high-volume usage.

CodeQL 2.25.2 tightened false positives in Java/Kotlin analysis. Kotlin support advanced to version 2.3.20, and the java/tainted-arithmetic query was refined to stop flagging bounds-checking patterns. The java/potentially-weak-cryptographic-algorithm query no longer flags Elliptic Curve, HMAC, or PBKDF2 algorithms as weak—reducing noise for teams using modern cryptography.

OIDC now eliminates long-lived secrets for Dependabot and code scanning. Both tools support OpenID Connect authentication for private registries at the organization level, removing the need to store credentials as repository secrets. Organizations can also configure multiple private registry feeds per ecosystem, dropping the previous single-registry constraint.

Code scanning alerts now link to GitHub Issues. This public preview feature brings security remediation into existing planning workflows, and a new Ask Copilot entry point lets org admins get contextual guidance directly from secret and Code Security risk assessments.

SBOM exports moved to async operations. Repository dependency exports and new API endpoints no longer block—exports are computed asynchronously and polled via webhook or status endpoint.

GitHub CLI 2.88.0+ gained Copilot Code Review integration. gh pr create and gh pr edit support --add-reviewer @copilot; issues can now close as duplicates with --duplicate-of; and gh workflow run immediately returns the workflow run URL instead of requiring polling. v2.89.0 fixed gh agent-task on ghe.com tenancies and introduced an experimental TUI-based prompter.

Actions Runner v2.333.0 added service container entrypoint and command support. Supports entrypoint and command fields for service containers, aligning Docker Compose behavior.

Copilot capacity and compliance tightened. New usage limits enforce a 50-rerun cap on workflows; Copilot Pro free trials paused due to abuse patterns; Opus 4.6 Fast retired from Pro+ to manage concurrency. Copilot cloud agent validation tools run 20% faster. Data residency now available for US and EU regions with FedRAMP compliance for government customers. Usage metrics now aggregate cloud agent and CLI activity into a single breakdown.

Repository properties and alerts gained deployment context. New built-in deployable and deployed properties expose artifact and deployment metadata; alerts and issues now surface release information in sidebars.