GitHub

Push rules in rulesets now support path exceptions, letting you exempt specific file paths from a rule while keeping it in force elsewhere. Available for restrict file paths and restrict file size rules, in public preview.

Personal accounts and organizations can now search blocked users by username, full name, or email; sort and paginate long lists; filter by block reason; and add private notes for moderation context. The updated experience also separates searching from blocking new users to prevent accidental blocks.

The GitHub integration in Slack now brings the agentic capabilities of GitHub Copilot CLI and the Copilot app into Slack in public preview. You can work with @GitHub to plan changes, investigate problems, and hand off coding tasks from Slack conversations, with sessions continuing asynchronously.

Mention @GitHub in a Microsoft Teams channel, thread, or direct message to start a collaborative Copilot cloud agent session anyone in the conversation can steer, with participants holding write access able to trigger changes. Sessions continue across other Copilot surfaces, and repo admins can require an extra approval for agent-attributed pull requests.

Saved views can now be pinned to the repository issues sidebar, keeping frequently used views one click away even when the sidebar is collapsed. Issue reactions now show profile avatars, and the Issues Dashboard density can be adjusted to fit more issues on screen.

Fixed a security vulnerability where gh codespace ports forward bound the forwarded port to all network interfaces by default; users are advised to update immediately. gh pr checkout now supports a --worktree PATH flag, and gh search issues gains semantic and hybrid --search-type options.

The Windows 11 arm64 image with Visual Studio 2026 is now generally available on standard and larger GitHub-hosted runners. GitHub will update the existing windows-11-arm image to use VS2026 by default starting September 21, 2026, which may break workflows that depend on Visual Studio 2022; update your workflow to target windows-11-vs2026-arm to test before the rollout completes September 30.

Code scanning alerts can now be dismissed with a "Mitigated" reason when external controls like a firewall mitigate the risk, distinguishing them from "Won't fix" dismissals and aligning with exception processes.

GitHub Code Quality analysis now runs on dynamic/github-code-quality/codeql and shows github-code-quality as the actor, separate from code scanning's dynamic/github-code-scanning/codeql path. Update billing reports, scripts, and filters that reference the old path or github-advanced-security actor.

GitHub Code Quality writes audit log events whenever it is enabled, disabled, or reconfigured on a repository. The three new events—repo.code_quality_enabled, repo.code_quality_disabled, and repo.code_quality_updated—capture the repository, the actor, and the timestamp, and are queryable via the audit log API.

Removed the codeql.actions.security.SelfHostedQuery module because runner labels don't reliably distinguish self-hosted from managed runners; custom queries relying on it must be updated. Added JavaScript, TypeScript, and Vue source modeling, including Vue Router's useRoute() and Sails Action2 inputs as remote flow sources, plus accuracy improvements to several GitHub Actions queries.

Organization-level Code Quality dashboards now include a Trends tab showing how open findings change over 7, 14, or 30-day ranges, ranked by health score or severity. Tables rank repositories by improvement or need for attention, respecting applied filters.

Administrators can now centrally manage Copilot plugin governance, MCP server access, and OpenTelemetry configuration in JetBrains IDEs. New settings enforce plugin allowlists/denylists, MCP server allowlists, and are overridden by managed OpenTelemetry policies.

Enterprise and organization admins can now revoke or deauthorize credentials by token type — for example, revoking all personal access tokens while leaving SSH keys intact — through the UI or the REST APIs. Previously enterprise-only, these controls now cover both scopes and are available via the organization REST APIs.

OAuth apps can opt in to short-lived access tokens (eight hours) with refresh tokens (six months), and can register up to 10 redirect URIs. Wildcard matching for redirect URIs is now controllable for both OAuth apps and GitHub Apps, and is enabled by default for apps with only one redirect URI.

Grok 4.6, xAI’s latest reasoning model, is rolling out across GitHub Copilot surfaces including VS Code, Copilot CLI, and JetBrains. It’s billed at provider list pricing under usage-based billing; Copilot Enterprise and Business admins must enable the model policy, which is off by default.

Agent Plugins 1.0 are now generally available across VS Code, Copilot CLI, the SDK, and the Copilot app. New models include Kimi K3 for Copilot plans and MAI-Code-1.1-Flash with native image understanding; Copilot CLI adds /tasks, prompt queuing, and /rewind, plus Copilot memory and Ollama support in JetBrains.

GitHub now prioritizes license information from package registries like npmjs.org, PyPI, and crates.io over the ClearlyDefined service, cutting missing licenses from 45% of 170 million packages to 24%. The dependency graph now tracks version ranges instead of per-version database entries, improving coverage across new releases.

You can now block or unblock users directly from the comment menu on pull requests and issues in repositories owned by personal GitHub accounts, with an optional private note. This saves maintainers from leaving the conversation to manage spam.

Gemini 3.7 Flash, Google’s latest Flash model, is rolling out in GitHub Copilot with improvements in web and app development, agentic coding workflows, code quality, and verification. Available to Pro, Pro+, Max, Business, and Enterprise users across VS Code, Visual Studio, CLI, cloud agent, app, JetBrains, Xcode, and Eclipse; admins must enable the Preview policy for Business and Enterprise.