As we announced previously, the format of GitHub authentication tokens has changed. The following token types are affected: Personal Access Tokens OAuth Access Tokens GitHub App User-to-Server Tokens GitHub App…
Millions of repos use Dependabot to keep their dependencies up to date, either by updating when a Dependabot alert lets them know about a vulnerable dependency (security updates), or on…
Dependabot now supports bundler v2 for both security and version updates. Learn more about Dependabot version updates and security updates. To see what’s next for Dependabot, visit the public roadmap.
Code Scanning alerts from all enabled tools are now shown in one consolidated list, so that you can easily prioritise across all alerts. You can view alerts from a specific…
Webhook events for GitHub Discussions are now available as a public beta. Get started with the GitHub Discussions webhooks. For questions or feedback, visit GitHub Discussions feedback.
You can now use GITHUB_TOKEN to authenticate with the Packages Container registry in your Actions workflows. Say goodbye to all those PATs (delete them from your profile too!), and say…
The GitHub Packages Container registry can now create and use containers set with Internal visibility. Internal visibility allows all members of an organization and all organizations within an enterprise read…
Security researchers provide a critical service to developers by identifying vulnerable software, but unfortunately, many developers don’t know the people behind this work. GitHub Security Advisories allow developers to provide…
The “Compare two commits” REST API, which returns a list of commits reachable from one commit (or branch) but not reachable from another, now supports pagination. It can also now…
To prevent unexpected changes from potentially slipping in after auto-merge is enabled on a pull request, auto-merge is now disabled automatically when new changes are pushed by a user without…
GitHub and the Python Package Index (PyPI) are collaborating to help protect you from leaked PyPI API tokens. From today, GitHub will scan every commit to a public repository for…
When comparing changes to a file using the split view, you can now select and copy just one side of the diff. Previously both sides were copied. Selecting over a…
Submodules defined with relative paths are now clickable in the web UI, making it easy to navigate to linked repositories. Previously, only submodules with absolute URLs were clickable. Only relative…
In February, we announced a simplified listing process for apps on the marketplace. All “verified apps” on the marketplace are now updated to the validated publisher model. The listings have…
Dependency review, in beta, helps you review dependency changes in your pull requests. But how do you find your package manifests amongst all the other files? Now you can filter…
Build what’s next on GitHub, the place for anyone from anywhere to build anything.
