---
scope: org
organization: github
release_count: 113
last_release: 2026-10-15
generated: 2026-04-16
updated: 2026-10-16
canonical: https://releases.sh/github/overview.md
---

Recently shipped general availability for AI Scan on pull requests and agentic autofix for code scanning alerts, plus workflow lockfiles in preview.

**Code scanning split duties across two GA features.**
- **AI Scan** covers languages CodeQL does not — PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP, Blazor — posting advisory findings and autofixes on the Conversation and Files changed tabs.
- **Agentic autofix** explores the codebase, proposes a fix, reruns CodeQL to confirm the alert closes, then opens a draft pull request for review.
- CodeQL 2.27.2 added a C++ regex parser plus Go, Rust, and JavaScript analysis work.

**Actions workflows can pin dependencies.** Lockfiles are in public preview: runs stay on the exact commits you locked, even if tags or branches move afterward. Create and maintain them with the `gh actions-lock` CLI extension.

**Copilot's model lineup turned over.**
- Gemini 4 Argon is generally available, billed at provider list pricing.
- HydraFusion and new HydraFusion Max draw on Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna, tailoring reasoning effort per step.
- Claude Opus 4.8, Claude Opus 5, and GPT-5.6 Terra retire November 16; move to Opus 5.5, GPT-6.1 Sol, or GPT-6 Luna.

**Push attribution records the authenticated pusher.** Commits now carry durable pusher identity separate from author and committer strings, and a `Committer must match pusher` rule blocks mismatches. New GitHub App permissions support least-privilege tokens.

**Deprecations to track.** The stateless token validation header goes away November 30; `macos-14` runner labels retire November 2.