GitHub

Recently shipped Code Quality as GA, stacked PRs in public preview, and expanded Copilot model choices. GitHub Code Quality is now GA on Enterprise Cloud and Team. Pairs CodeQL with AI-assisted detection to catch maintainability and reliability issues in pull requests, with Copilot Autofix suggesting fixes. In GitHub's own engineering, 67.3% of findings are resolved before merging. Added org-level dashboards with maintainability and reliability scoring, per-repository dashboards, and audit log events for Copilot Autofix actions. Stacked pull requests are now in public preview. Break large changes into a series of small, independently reviewable PRs that merge together in one click. Teams can review layers in parallel while maintaining quality across every change. Copilot code review supports agent skills and MCP servers at GA. Add a SKILL.md file under .github/skills to bring your team's internal tools and coding standards into every review. MCP server connections pull context from third-party platforms (issue trackers, docs, service catalogs) — all MCP tool calls are read-only. GitHub Copilot gained new models and governance controls. Claude Opus 5, Gemini 3.6 Flash, and Grok 4.5 are rolling out to all Copilot plans. Models reaching GA on Business and Enterprise plans are now enabled by default, with a single opt-out control as an alternative. Enterprise managed settings now cover the Copilot cloud agent and Copilot app. The Copilot usage metrics REST API added repository-level reporting: two new endpoints return a daily per-repo breakdown of pull requests created/merged by Copilot coding agent and reviewed by Copilot code review. Agent automation controls in Issues are in public preview — approve, rate confidence, and see rationale for automated actions. Supply chain and registry security tightened. npm now blocks 2FA-bypass granular access tokens from performing sensitive account, org, and package management actions — closing a major credential-based attack surface. Publish-time malware scanning automatically checks newly published npm packages before they become available for install, typically adding a five-minute delay. GitHub Actions holds potentially malicious workflows in public repositories for approval by a collaborator with write access. GitHub Models is now fully retired; use Microsoft Foundry or GitHub Copilot instead. VS Code agents window improved with a redesigned layout, faster review workflows, support for worktrees with any Copilot harness, and quick chat commands. GitHub Desktop 3.6.4-beta1 and 3.6.3 fixed Copilot errors on Windows and general crashes. GitHub CLI 2.97.0 fixed four security vulnerabilities, including terminal escape sequence injection across several commands. GitHub MCP Server supports the new stateless MCP specification. Removed Redis sessions and initialize handshake for simpler scaling. GHES support bundle uploads will be rejected from August 18 if running on unpatched versions. GitHub iOS 1.267.0 lets you copy a pull request's head branch name in one tap.