GitHub Changelog

The Xcode 27 runner image is now generally available, running on macOS 27 with the Xcode 27 toolchain and Apple SDKs, after a public preview. It is available on Apple Silicon (arm64) runners only, via the xcode-27 and xcode-27-xlarge labels.

GitHub Copilot in Slack and Microsoft Teams now works across multiple repositories in a single conversation, so users can track pull requests, merged changes, and issues spanning several repos without switching conversations. Also adds @GitHub mentions anywhere in a message, easier repository switching, shared Slack messages and threads as context, and reliability improvements for error reduction and recovery.

Organizations and enterprises can now download a CSV report of GitHub Code Quality license usage from the Billing and licensing page, listing each active committer, the repositories that received their commits in the last 90 days, and whether each committer is unique to a single repository or organization. CSV downloads are available on GitHub Team and GitHub Enterprise Cloud.

Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra are deprecated across all GitHub Copilot experiences on November 16, 2026, with Claude Opus 5.5 suggested in place of the Opus models and GPT-6.1 Sol or GPT-6 Luna for GPT-5.6 Terra. Claude Opus 4.8 remains available to individual subscribers on annual plans, and the suggested alternatives are automatically enabled for Copilot Enterprise and Copilot Business under default model enablement.

AI Scan for pull requests is now generally available, complementing CodeQL by finding vulnerabilities in PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP, and Blazor. Findings are advisory and do not fail the code scanning check or block merges, and the feature does not run on fork or Dependabot pull requests.

Assigning a code scanning alert to Copilot now explores the codebase, proposes a fix, reruns CodeQL to confirm the alert is closed, then opens a draft pull request, replacing the free Generate Fix option. Available to GitHub Code Security and GitHub Advanced Security customers on GitHub Enterprise Cloud and consumes AI Credits from the Code Security budget plus Actions minutes.

As of October 15, 2026, email notifications for repository push events are retired and no longer sent, to prevent spam and abuse via GitHub's email infrastructure. A GitHub Actions workflow triggered by push events can send emails through your own SMTP server or email provider instead.

HydraFusion and the new HydraFusion Max draw from an updated model pool including Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, and now tailor reasoning effort per stage, using medium effort for initial drafts and high effort for review. Cascade gains an optional judging step that requests repair only when needed, Critique inspects the workspace directly with parallel critic models, and Max is tuned for the deepest reasoning on demanding tasks.

Workflow dependency lockfiles are in public preview for GitHub Enterprise Cloud, pinning actions, reusable workflows, and transitive dependencies to reviewable commits via the gh actions-lock CLI extension so a moved tag or branch can't inject new code. A Require lockfile policy and automatic Dependabot lockfile regeneration on action updates ship alongside.

Two new fine-grained permissions, repository_creation:write and installation_repositories:write, let apps and fine-grained PATs create repositories and manage installation repositories without the broader repository_administration:write or coarse repo scope. GitHub Apps also support the offline_access scope for gradually migrating to expiring rotating tokens, repository admins can add already-approved org apps to their repositories without org owner approval, and credentials moved to a dedicated tab.

Gemini 4 Argon is now generally available in GitHub Copilot for Pro+, Max, Business, and Enterprise users, selectable across VS Code, Visual Studio, Copilot CLI, the coding agent, JetBrains IDEs, Xcode, and Eclipse. It is billed at provider list pricing under usage-based billing, and Enterprise and Business admins can manage access via the model policy in Copilot settings.

Two new audit log events, repo.code_quality_findings_dismissed and repo.code_quality_findings_reopened, record manual dismissals and reopenings of Code Quality findings, including who made the request, the repository and rule, and the identifiers and count of affected findings. Available on GitHub Team and GitHub Enterprise Cloud, with API retrieval on Enterprise Cloud, but not on GitHub Enterprise Server.

Secret scanning now detects Anthropic service and user API keys, Cloudsmith API keys, and Salesforce Marketing Cloud OAuth2 tokens, with the Anthropic detectors included in push protection by default so commits containing them are automatically blocked. Salesforce joins as a secret scanning partner, forwarding found secrets in public repositories to the provider for revocation.

Enterprise administrators can set forceRemoteSettingsRefresh to true so supported Copilot clients fetch current server-managed settings at startup instead of using a cached policy, failing closed when policy cannot be confirmed. The sandbox managed settings key now enforces a required minimum client version, forcing users pinned to older Copilot clients to update.

The dependabot_alert webhook event now includes a withdrawn action with payload identifiers captured before removal, including alert number, GHSA and CVE IDs, package, and manifest path; existing subscribers receive these automatically. REST API get and update requests for withdrawn alerts now return 410 Gone instead of 404 Not Found, distinguishing them from alerts that never existed.

The Budgets and alerts page in GitHub billing settings now lists all budgets in one page with search and filtering by scope, product, or SKU, with user search available for enterprises and organizations. User-level budgets appear in the same list, and the Scope menu narrows results to a single scope such as organizations or cost centers.

Organization and enterprise administrators can now see AI Scan impact in security overview, including findings generated, resolved, remediation rate, which repositories generated findings, trends over the reporting period, and how often developers applied autofix suggestions. The CodeQL pull requests page is renamed Code scanning on pull requests with separate CodeQL and AI Scan tabs.

Enterprise administrators can enable telemetry.capture.identity in managed settings to add user.name, process.user.name, and host.name attributes to OpenTelemetry data without collecting prompts, responses, or tool content. Identity capture and five additional capture classes (prompts, responses, toolArguments, toolOutput, policyDetail) are all off by default, and explicit managed values take precedence over local settings, SDK configuration, and environment variables.

GitHub now durably records the authenticated user who pushed each commit and surfaces that pusher identity in the UI and API alongside author and committer fields. A new repository rule condition, Committer must match pusher, blocks pushes where committer metadata doesn't match any verified email of the authenticated pusher.