GitHub Changelog

Settings → Whitespace changes now offers Always show, Always hide, or Hide for this diff only, with the saved choice applying across pull requests; an active Hide whitespace filter beside All commits can be dismissed to temporarily show whitespace without changing the saved preference. In split view, new and deleted files now span both columns instead of one, reducing line wrapping.

The Copilot impact dashboard now includes an Industry comparison section that benchmarks agentic adoption and leverage against peer medians and top deciles, segmented by company size and one of ten industries. Participation is opt-in and disabled by default via the Copilot metrics industry comparison policy, set in the dashboard or centrally in enterprise or organization Copilot policies.

GitHub CLI v2.103.0 introduces opt-in expiring OAuth credentials that store an expiring access token with a rotating refresh token and refresh automatically, limiting a leaked token to hours rather than indefinite validity. Opt in via gh auth login --expiring or gh config set expiring_credentials enabled; scripts that cache gh auth token output will eventually hold an expired token and should read it fresh each time.

Repositories can now convert all branch protection rules to rulesets in a single action from Settings → Rulesets via Import branch protection rules. The import dialog previews the rulesets to be created, flags rules already covered by an existing ruleset, notes when one protection rule produces multiple rulesets, and lets you pick enforcement status and which rulesets to create, then keep or delete the originals.

On November 12, 2026 the business field in secret_scanning_alert.* and secret_scanning_push_protection.bypass audit log events changes from the enterprise display name to the enterprise slug; integrations filtering by display name should accept both formats or use business_id. Also fixed empty secret-type and location details in bypass-request API responses and webhook payloads, push failures from organization-role entries in reviewer lists, and custom pattern API requests returning 500 instead of 422 for invalid arguments.

Dependabot alert responses now include a version_requirement field on each alert's dependency object, reporting the resolved lockfile version, the version or constraint declared in a manifest, or the version submitted via the dependency submission API. The field appears in individual alert responses, repository, organization, and enterprise alert lists, and dependabot_alert webhook payloads, so syncing tools no longer need to parse lockfiles or call GraphQL for vulnerableRequirements.

GitHub's new package firewall sits between endpoints like Actions runners or coding agents and upstream package repositories, inspecting metadata requests and package downloads against administrator-set policies such as a configurable cooldown period, GitHub Advisory Database malware and vulnerability checks, and attestation downgrade detection, with exception requests for wrongly blocked packages. It is free in public preview for GitHub Enterprise Cloud customers including data residency, supports only npm today, and will be charged on metered usage at general availability.

GET and PATCH endpoints for Copilot model policies are now generally available at the enterprise, enterprise team, enterprise app, and organization levels. Enterprise policies can delegate model control to organizations in organization mode, or to teams and apps in enterprise teams mode.

Six models are deprecated across most Copilot experiences, including Copilot Chat, inline edits, ask and agent modes, and code completions: Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini, and Grok 4.5. Suggested alternatives are Gemini 3.8 Flash, GPT-6.1 Sol, GPT-6 Luna, and Grok 4.7; Copilot Enterprise administrators may need to enable access to alternatives through model policies in Copilot settings.

During periods of unusual traffic, GitHub may temporarily require authentication for some clones and fetches of public repositories over HTTPS to protect github.com availability, failing affected operations with an authentication-required message. Authenticated HTTPS operations, SSH, pushes, and unrelated web and API traffic are unaffected, and GitHub recommends GITHUB_TOKEN in Actions or a GitHub App installation token in other CI systems for reliable automated clones.

Because Apple no longer ships Intel x86_64 code in some system binaries and libraries CodeQL relies on for build tracing, traced extraction is unavailable for C/C++, C#, Go, Java, Kotlin, and Swift when Xcode 27 or macOS 27 is used, and Swift 6.4 is unsupported on any platform. Pin workflows to macOS 26 or earlier and Xcode 26 or earlier, or switch C/C++, C#, and Java scans to build mode none.

The Xcode 27 runner image is now generally available, running on macOS 27 with the Xcode 27 toolchain and Apple SDKs, after a public preview. It is available on Apple Silicon (arm64) runners only, via the xcode-27 and xcode-27-xlarge labels.

GitHub Copilot in Slack and Microsoft Teams now works across multiple repositories in a single conversation, so users can track pull requests, merged changes, and issues spanning several repos without switching conversations. Also adds @GitHub mentions anywhere in a message, easier repository switching, shared Slack messages and threads as context, and reliability improvements for error reduction and recovery.

Organizations and enterprises can now download a CSV report of GitHub Code Quality license usage from the Billing and licensing page, listing each active committer, the repositories that received their commits in the last 90 days, and whether each committer is unique to a single repository or organization. CSV downloads are available on GitHub Team and GitHub Enterprise Cloud.

Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra are deprecated across all GitHub Copilot experiences on November 16, 2026, with Claude Opus 5.5 suggested in place of the Opus models and GPT-6.1 Sol or GPT-6 Luna for GPT-5.6 Terra. Claude Opus 4.8 remains available to individual subscribers on annual plans, and the suggested alternatives are automatically enabled for Copilot Enterprise and Copilot Business under default model enablement.

AI Scan for pull requests is now generally available, complementing CodeQL by finding vulnerabilities in PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP, and Blazor. Findings are advisory and do not fail the code scanning check or block merges, and the feature does not run on fork or Dependabot pull requests.

Assigning a code scanning alert to Copilot now explores the codebase, proposes a fix, reruns CodeQL to confirm the alert is closed, then opens a draft pull request, replacing the free Generate Fix option. Available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud and consumes AI Credits from the Code Security budget plus Actions minutes.

As of October 15, 2026, email notifications for repository push events are retired and no longer sent, to prevent spam and abuse via GitHub's email infrastructure. A GitHub Actions workflow triggered by push events can send emails through your own SMTP server or email provider instead.