GitHub Actions: MacOS Big Sur Preview

When a vulnerability is added to GitHub Advisory Database, the resulting Dependabot alert and security update notifications can be noisy. To help you focus on what matters, we've made a few changes to how Dependabot notifies you:

• You'll no longer be notified about the creation of Dependabot security update pull requests unless you're watching the repository where the pull request is created. To configure which repositories you are watching, see our documentation.
• You'll no longer receive email and web notifications for Dependabot alerts for Low- and Moderate-severity vulnerabilities. You'll still be able to see these alerts in your repository's Security tab, and if you have Dependabot security updates enabled, Dependabot will still create security update pull requests for them.

You can learn more about configuring your Dependabot notifications in our documentation.

We have updated how webhooks on repositories, organizations, and apps can be configured via the API. We have a new configuration resource for full or partial updates to any or all attributes of a webhook. The endpoint can also be used to read the configuration.

Also, webhooks now send a header with a SHA-256 hash of the request body if the webhook is configured with an HMAC key in the optional "secret" field. Developers verifying the authenticity of a webhook should use the SHA-256 signature because it is a more modern cryptographic hash function. SHA-1 is still retained for backwards compatibility with existing integrations, but should not be used for security purposes to verify cryptographic identity due to known collisions. See the documentation for the new delivery headers for more information.