---
name: GitHub
slug: github
domain: github.com
category: developer-tools
sources: 5
total_releases: 853
releases_last_30d: 102
avg_releases_per_week: 20.5
last_updated: 2026-10-06
tracking_since: 2021-07-21
canonical: https://releases.sh/github
overview_url: https://releases.sh/github/overview.md
tags:
  - ci-cd
  - collaboration
  - git
accounts:
  github: "github"
  x: "github"
  youtube: "@github"
---

## Overview

Recently shipped computer use in Copilot CLI and the Copilot app, a generally available async merge API, and stateless GitHub App installation tokens.

**Copilot can drive desktop apps.** Computer use is in public preview on macOS and Windows: Copilot reads accessible app content, clicks controls, types, scrolls, and navigates workflows in GUI-only software with no API or CLI. It asks for approval before controlling an app. [Video](https://github.com/user-attachments/assets/866a9adf-4b90-4aef-9f92-b21dae47c551)

**Dynamic workflows and HydraFusion arrived.** Dynamic workflows landed in Copilot CLI, the Copilot app, and the Copilot SDK, letting you define multi-agent orchestration in code with parallel or sequential steps. HydraFusion, which picks between single, cascade, and critique execution patterns, expanded from CLI into VS Code and the Copilot app.

**Copilot code review is now scriptable.** Teams can request reviews through REST and GraphQL APIs, setting an effort level per request. Balanced is the new default; explicit Lite selections were kept. Four older models — Gemini 3.5 and 3.6 Flash, Kimi K2.7 Code, and Claude Opus 4.7 — were deprecated October 2, with Gemini 3.8 Flash, Kimi K3, and Claude Opus 5.5 suggested instead.

**Async merge API is GA, and installation tokens changed shape.** The async merge API is now the recommended programmatic merge path and the only one supporting stacked pull requests. All new GitHub App installation tokens use the stateless `ghs_APPID_JWT` format — same one-hour expiry and scoping, but roughly 520 characters instead of 40. The temporary validation header goes away November 30.

**The dashboard got a redesign, and macOS 14 runners are leaving.** A new default dashboard groups active agent sessions, issues, and pull requests, with a separate Feed tab; a preview toggle reverts it. Separate: `macos-14` runner labels retire November 2 after a series of brownouts, Actions retention now covers checks, runs, and statuses, and CLI 2.102.0 fixed four security flaws — including symlink-based writes to unintended files in `gh release download` and `gh run download`.

<Product name="GitHub" slug="github" sources="1" canonical="https://releases.sh/github/github" />
<Product name="GitHub Actions" slug="github-actions" sources="1" canonical="https://releases.sh/github/github-actions" />
<Product name="GitHub Desktop" slug="github-desktop" sources="1" canonical="https://releases.sh/github/github-desktop" />

<Source name="Actions Runner" slug="github-actions-runner" type="github" releases="105" latest-version="v2.337.0" latest-date="2026-08-26T14:33:29.000Z" url="https://releases.sh/github/github-actions-runner" />
<Source name="GitHub" slug="github-ios" type="appstore" releases="8" latest-version="1.277.0" latest-date="2026-09-17T13:47:25.000Z" url="https://releases.sh/github/github-ios" />
<Source name="GitHub CLI" slug="github-cli" type="github" releases="113" latest-version="v2.102.0" latest-date="2026-09-30T02:40:02.000Z" url="https://releases.sh/github/github-cli" />
<Source name="GitHub Changelog" slug="github-changelog" type="feed" releases="501" latest-date="2026-10-06T20:16:41.000Z" url="https://releases.sh/github/github-changelog" />
<Source name="GitHub Desktop" slug="desktop" type="github" releases="126" latest-version="release-3.6.6" latest-date="2026-09-21T12:39:28.000Z" url="https://releases.sh/github/desktop" />

## Recent Releases

_Summaries below — fetch the release's `canonical` URL for full content, or `url` for the original source._

<Release source="github-changelog" date="October 6, 2026" published="2026-10-06T20:16:41.000Z" url="https://github.blog/changelog/2026-10-06-stacked-pull-requests-generally-available" canonical="https://releases.sh/release/rel_xZADg1nGa6I9XrLt9M3KR" truncated="true">
### Stacked pull requests generally available

Stacked pull requests are now generally available on all github.com plans, with Rebase stack preserving approvals and signed commits, bypass permissions applying to stacks, and stacks entering the merge queue as a single merge group. Also adds auto-merge for stacks rolling out over the next few weeks, always-visible stack context in the PR header, Shift+J/Shift+K navigation, a stacked action on the pull_request webhook, and gh stack support for Git worktrees.
</Release>

<Release source="github-changelog" date="October 6, 2026" published="2026-10-06T10:23:38.000Z" url="https://github.blog/changelog/2026-10-06-code-scanning-ai-scan-enablement-status-in-security-overview" canonical="https://releases.sh/release/rel_Rj1Z_de-jHslDJsKKuAcp" truncated="true">
### Code scanning AI Scan enablement status in security overview

Organization and enterprise administrators can now see AI Scan for pull requests enablement status in the security overview coverage view, with enabled and not enabled repository counts in the code scanning summary and per-repository effective status. The coverage view is filterable with code-scanning-ai-scan-pr-scan:enabled and not-enabled, and CSV exports include a Code Scanning AI Scan for pull requests column.
</Release>

<Release source="github-changelog" date="October 5, 2026" published="2026-10-05T22:42:14.000Z" url="https://github.blog/changelog/2026-10-05-secret-scanning-adds-detectors-for-lovable-supabase-and-more" canonical="https://releases.sh/release/rel_88MPwZapG03iEDw2M8_ut" truncated="true">
### Secret scanning adds detectors for Lovable, Supabase, and more

Secret scanning now detects six new secret types from Lovable Labs, Pydantic Services Inc., and Supabase, including lovable_api_key, logfire_token, pydantic_ai_gateway_api_key, and Supabase OAuth and scoped personal access tokens. Lovable Labs also joined the secret scanning partnership program, so its secrets found in public repositories are forwarded to the provider for revocation.
</Release>

<Release source="github-changelog" date="October 2, 2026" published="2026-10-02T22:18:23.000Z" url="https://github.blog/changelog/2026-10-02-stateless-github-app-installation-tokens-rolled-out" canonical="https://releases.sh/release/rel_dnb7NacQ-r4anHausbVqY" truncated="true">
### Stateless GitHub App installation tokens rolled out

All newly minted GitHub App installation tokens now use the stateless ghs_APPID_JWT format, roughly 520 characters long instead of 40, with permissions, repo scoping, one-hour expiration, and the installation access token REST endpoint unchanged. The temporary X-GitHub-Stateless-S2S-Token header is deprecated on November 30, 2026, and integrations should treat tokens as opaque strings rather than assuming 40-character length.
</Release>

<Release source="github-changelog" date="October 2, 2026" published="2026-10-02T19:13:50.000Z" url="https://github.blog/changelog/2026-10-02-copilot-code-review-api-support-and-new-default-effort-level" canonical="https://releases.sh/release/rel_TuU7hSaqWxFBZvSI0IRDD" truncated="true">
### Copilot code review: API support and new default effort level

Copilot code review can now be requested through REST and GraphQL APIs with a per-request review effort level, and the Default review effort level now uses Balanced for new and existing repositories and organizations as of September 28, 2026. Explicit Lite selections were respected, and effort can be set per level in enterprise, organization, repository, or personal settings.
</Release>

<Release source="github-changelog" date="October 2, 2026" published="2026-10-02T19:07:04.000Z" url="https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire" canonical="https://releases.sh/release/rel_J0pKqdjgHdOXooLgT6nRO" truncated="true">
### Unvalidated npm trusted publishing configurations now expire

Unvalidated npm trusted publishing configurations now expire 48 hours after creation and can no longer authorize publishing, becoming validated and exempt after a first successful publish. npm also rejects trusted publishing tokens from GitHub Actions issue_comment events, alongside the existing pull_request_target restriction.
</Release>

<Release source="github-changelog" date="October 2, 2026" published="2026-10-02T19:05:17.000Z" url="https://github.blog/changelog/2026-10-02-npm-staged-publishing-now-supports-creating-new-packages" canonical="https://releases.sh/release/rel_JnTDdZuGlTE6-LBA2K19_" truncated="true">
### npm staged publishing now supports creating new packages

`npm stage publish` can now create new npm packages using a local session, a granular access token, or a stage-only token, so packages can be created from automated workflows without a manual first publish. It works for public scoped and unscoped packages and private scoped packages, with the first version entering the staged queue until a maintainer promotes it.
</Release>

<Release source="github-changelog" date="October 2, 2026" published="2026-10-02T18:24:19.000Z" url="https://github.blog/changelog/2026-10-02-selected-models-in-github-copilot-deprecated" canonical="https://releases.sh/release/rel_XUeMMUWJPeKZASt2nlXEC" truncated="true">
### Selected models in GitHub Copilot deprecated

Four models are deprecated across all Copilot experiences, including Copilot Chat, inline edits, ask and agent modes, and code completions. Copilot Enterprise administrators may need to enable access to the alternatives (Gemini 3.8 Flash, Kimi K3, Claude Opus 5.5) through model policies in Copilot settings.
</Release>

<Release source="github-changelog" date="October 2, 2026" published="2026-10-02T13:18:00.000Z" url="https://github.blog/changelog/2026-10-02-new-fields-for-securityadvisory-graphql-api" canonical="https://releases.sh/release/rel_Uh-MqlU-tNcvCOeuRYp2K" truncated="true">
### New fields for SecurityAdvisory GraphQL API

The SecurityAdvisory object gained cveId, sourceCodeLocation, githubReviewedAt, nvdPublishedAt, and repositoryAdvisoryUrl fields, and the securityAdvisories query gained severities and isWithdrawn filters so results can be narrowed server-side instead of filtered after download. The changes are additive and read-only, so existing queries keep working.
</Release>

<Release source="github-changelog" date="October 2, 2026" published="2026-10-02T13:15:40.000Z" url="https://github.blog/changelog/2026-10-02-confidential-comments-on-repository-security-advisories" canonical="https://releases.sh/release/rel_q4el1_Y5MvK-V7HvpR52f" truncated="true">
### Confidential comments on repository security advisories

Advisory maintainers can now post confidential comments visible only to people with write access to the repository, so reports can be discussed without the reporter or invited collaborators seeing it. Confidential comments are marked in the advisory timeline, recorded in the audit log, available via GraphQL but not REST, and cannot be switched between confidential and regular after posting.
</Release>

## Fetching more

Append `.md` (markdown), `.json` (raw data), or `.atom` (feed) to any URL on this page.

- Per-source history: `https://releases.sh/github/{source-slug}`
- Atom feed: `https://releases.sh/github.atom`
- Individual release: `https://releases.sh/release/{release-id}`