Skip to content

Changelog

Subscribe to all Changelog posts via RSS or follow GitHub Changelog on Twitter to stay updated on everything we ship.

→ ~ cd github-changelog
→ ~/github-changelog|main git log main
showing all changes successfully

Repository Custom Properties GA and Ruleset Improvements

repository custom properties banner image

We’re excited to announce the general availability of Repository Custom Properties, a major enhancement to how repositories are managed and classified across GitHub organizations.

Properties offer a flexible way to add meaningful metadata to your repositories that simplifies repository classification, enhances discoverability, and seamlessly integrates with rulesets.

Check out this video from our own Jon Peck for a walk through of a common scenario.

New organization repositories list public beta

Starting today the new repositories list view moves to public beta.

Improvements to Repository Rulesets

Repository Rules now support adding Dependabot to bypass lists. This enables you to let Dependabot merge changes to a repository’s protected branch.

Learn more about managing custom properties for your organization and managing rulesets for your organization.

Head over to community discussions for feedback.

See more

Deprecation notice: v1 and v2 of the artifact actions

On December 14, 2023, GitHub Actions released v4 of the actions to upload and download artifacts. This version improves upload/download speeds by up to 98%, addresses long-standing customer feedback requests, and represents the future of artifacts in GitHub Actions.

With the introduction of v4, we will be deprecating v1 and v2 of actions/upload-artifact, actions/download-artifact, and related npm packages on June 30, 2024. We strongly encourage customers to update their workflows to begin using v4 of the artifact actions.

In order to prevent issues for customers using GitHub Connect, the tags for v1 through v2 will not be removed from the actions/upload-artifact and actions/download-artifact project repositories. However, attempting to use a version of the actions after the announced deprecation date will result in a workflow failure. This deprecation will not impact any existing versions of GitHub Enterprise Server being used by customers.

This announcement will also be added to actions/upload-artifact and actions/download-artifact. Please visit the documentation to learn more about storing workflow data as artifacts in Actions.

See more

Dependabot support for pub private repositories and registries

If you use private hosted pub repositories or registries to manage your Dart dependencies, Dependabot can now automatically update those dependencies. By adding the details of the private repository or registry to dependabot.yml, Dependabot will be able to access and update these dependencies.

See more

Secret scanning adds webhook support for validity checks

The secret_scanning_alert webhook is sent for activity related to secret scanning alerts. Secret scanning webhooks now support validity checks, so you can keep track of changes to validity status.

Changes to the secret_scanning_alert webhook:

  • A new validity property that is either active, inactive, or unknown depending on the most recent validity check.
  • A new action type, validated, which is triggered when a secret’s validity status changes.

Note: you must enable validity checks at the repository or organization level in order to opt in to the feature. This can be done from your secret scanning settings on the Code security and analysis settings page by selecting the option to “automatically verify if a secret is valid by sending it to the relevant partner.”

Learn more about which secret types are supported or the secret scanning webhook.

See more

Enhanced Codespaces Connection

We’re excited to announce an important upgrade to the Codespaces connection infrastructure. Our team has been working to enhance the security, reliability, and overall performance of both the main connection and port forwarding features.

What’s Changing

To support these enhancements, we require the addition of *.visualstudio.com to be allowlisted for your firewall rules. This is a crucial step to ensure a seamless and secure experience with Codespaces.

Release Plan

Today we are going to enable you to opt into this new connection system through the Feature Preview section on github.com. This feature flag will be an opt-in flag for two weeks to enable you to test these changes against your own firewalls.

In two weeks we will turn on these changes as a default. Users can opt out of using this new connection system for 30 days under the same feature flag. Customers who need more time will be able to request extra time through GitHub Support.

After 30 more days we will move everyone over to our new connection system.

Your Action Needed

Ensure that *.visualstudio.com is allowlisted under your firewall rules.

Enable the feature flag under github.com to test these changes out yourself, as well as to ensure these domains are added to your firewall rules promptly to maintain uninterrupted access and optimal functionality of Codespaces.

If you’re having any issues, read our firewall troubleshooting guide.

We appreciate your cooperation and understanding as we continue to improve your experience with Codespaces. If you have any questions or need assistance, our support team is here to help.

Thank you for being a valued member of the Codespaces community.

See more

GitHub Issues & Projects – Projects without Limits Private Beta

When we first introduced GitHub Projects, we set a limit of 1,200 items per project to keep projects snappy and encourage tracking of only active work. Your feedback over the years has been invaluable, and we heard you loud and clear – sometimes, 1,200 items just isn’t enough for those growing, scaling projects. That’s why today, we’re excited to announce the private beta of Projects without Limits, which will enable unlimited issue limits on your projects.

While this feature is still under development, the private beta currently supports the table, board, and roadmap layouts. Stay tuned for upcoming support for other beloved features such as slice by, swimlanes, mobile support, Projects API, and insights.

If you’re a project admin and your project is nearing the item limit while exclusively using our supported features, this banner will appear over your project.

To join the private beta waitlist, click the Join waitlist button. If space is available, your project will be granted beta access.

For questions and feedback, please visit our Community Discussion.

See more

VS Code Copilot Chat January 2024 (version 0.12)

Copilot enhancements in Visual Studio Code

We have introduced several features to the Copilot Chat extension in Visual Studio Code. These updates, available in Visual Studio Code 1.86 and the latest Copilot Chat extension 0.12, aim to provide a more streamlined and interactive coding experience. From new context variables that offer more control over the context you provide to Copilot, to expanded voice control capabilities, these updates are designed to improve your interaction with Copilot. Let’s take a closer look at these new features.

Context variables

You can use context variables to provide additional context to your questions in chat by using the # symbol. We have introduced two new context variables: #file and #editor to give you more control to specify that context.

The #file variable lets you reference specific files from your workspace in your chat prompt. This helps make the answers from Copilot Chat more relevant to your code by providing context about the file you are working with. You can ask questions like “Can you suggest improvements to #file:package.json?” or “How do I add an extension in #file:devcontainer.json?”. By using the #file variable, you can get more targeted and accurate responses from Copilot.

image

With the #editor context variable, you have control over whether to include the visible code of the active editor in your prompt to Copilot Chat. Previously, this information was automatically included when you hadn’t selected text in the editor. Now, you can choose to explicitly add the visible code to the context or omit it for more general questions.

image

The #selection context variable already enabled you to focus Copilot’s suggestions on the specific code you select in the editor. By combining the #file, #editor, and #selection variables, you have full control over the context you provide to Copilot Chat, ensuring that you receive the most relevant and helpful answers.

Inline chat

We also added several features, such as Copilot Code Actions and an updated live mode, to make your Copilot inline chat experience more productive.

As you’re writing and iterating over your code, you can now invoke Copilot through Code Actions (light bulb) on a specific line in the editor. This functionality gives you direct and targeted access to Copilot to improve your code. When there is an error in the code, you can use the sparkle Code Action to let Copilot explain the error or propose a fix.

Image

With the updated inline chat live mode, you can now see and evaluate the suggested code modifications in-place in the editor. Additionally, you have the option to drill through to the inline diff editor to compare the proposed changes against the original code.

Responsible AI

We emphasize responsible usage of AI, especially when it comes to source code. We’ve added a new setting that asks users for confirmation before saving code that was generated by Copilot. This ensures that users have control over the code generated by Copilot and can review it before saving.

This setting, inlineChat.acceptedOrDiscardBeforeSave, is enabled by default. When the setting is enabled, a file save will wait for the user to accept or discard any pending inline chat session. This also applies when Auto Save is enabled, which will be temporarily turned off until inline chat has ended.

Image

Enhancing voice interactions

We have further enhanced voice interactions in VS Code by giving you more flexibility and options for initiating voice interactions.

Now, you can use the “Hey Code” voice command to start a voice session with Copilot Chat. You can choose whether you want this voice command to open the Chat view, inline chat in the editor, quick chat, or choose dynamically based on where the focus is.

To enable this voice command, make sure to install the GitHub Copilot Chat and VS Code Speech extensions. Once installed, you can enable the “Hey Code” voice command in the accessibility.voice.keywordActivation setting.

In addition, you can accelerate voice input for chat by using the “hold to speak” mode: press and hold the keybinding for inline chat and voice recording automatically starts. As soon as you release the keys, the request is sent to Copilot.

Besides these main features, you can also explore our other exciting new preview features.

See more

Copilot in GitHub Support (GA)

We are excited to announce the GA release of Copilot in GitHub Support, a faster way to find answers to your GitHub-related questions! Copilot in GitHub Support is an AI-powered assistant that answers questions based on our official GitHub documentation.
It will help you get instant answers to some of your basic questions without needing to create a support ticket.

This tool is part of our ongoing efforts to make GitHub the best place for all developers to collaborate, innovate, and ship great software. We believe that Copilot in GitHub Support will enhance your experience and productivity.

We look forward to hearing from you and learning from your feedback. Try out Copilot in GitHub Support today!

See more

Secret scanning adds validity checks for Stripe, Telegram, SendGrid, and more

Secret scanning is extending validity check support to several additional token types.

Validity checks indicate if the leaked credentials are active and could still be exploited. If you’ve previously enabled validation checks for a given repository, GitHub will now automatically verify validity for alerts on supported token types. In addition to token types announced in our previous changelogs, you will now see validity checks for the following token types:

Provider Token
Dropbox dropbox_short_lived_access_token
Notion notion_integration_token
OpenAI openai_api_key
OpenAI openai_api_key_v2
SendGrid sendgrid_api_key
Stripe stripe_api_key
Stripe stripe_test_secret_key
Telegram telegram_bot_token

Validity checks are available for repositories with GitHub Advanced Security on Enterprise Cloud. You can enable the feature at both organization and repository levels from the “Code security and analysis” settings page by checking the option to “automatically verify if a secret is valid by sending to the relevant partner.”

Learn more about secret scanning or our supported patterns for validity checks.

See more

Code scanning can now be enabled on repositories before they contain CodeQL supported languages

Code scanning can now be enabled on repositories even if they don’t contain any code written in the languages currently supported by CodeQL. Default setup will automatically trigger the first scan when a supported language is detected on the default branch. This means users can now enable code scanning using default setup, for example on empty repositories, and have confidence that they will be automatically protected in the future when the languages in the repository change to include supported languages.

This also takes effect from the organization level so you can bulk-enable code scanning on repositories without CodeQL supported languages.

Enabled on repo without supported languages

This change is now on GitHub.com and will be available in GitHub Enterprise Server 3.13. For more information, see “About code scanning default setup.”

See more

Support ticket priority for GitHub Enterprise

Support tickets created for GitHub Enterprise are assigned a priority based on the circumstances and impact of the issue.

Enterprise members with support entitlements were able to suggest the initial priority of a support ticket when contacting GitHub Support. To ensure that support requests are handled in order, and according to their circumstances and impact, GitHub Support will set the initial priority of all support tickets.

See more

Gradle starter workflows now automatically submit transitive dependencies

If you’re using starter workflows to prepare the build and release steps for your Java projects that use Gradle, these projects will now have more comprehensive dependency graph information in GitHub. The Gradle starter workflows have been updated to automatically submit transitive dependencies to GitHub, improving the quality of dependency graph data and Dependabot updates for these apps.

Learn more about the action these starter workflows use by checking out the Build with Gradle action on the GitHub Marketplace. Thank you Gradle for making these updates!

Join the discussion within GitHub Community.

See more

Code faster and better with GitHub Copilot’s new features in Visual Studio

We have introduced two new powerful features to the latest Visual Studio Copilot Chat extension: slash commands (/) that allow you to direct Copilot to perform specific tasks, and context Variables (#) that allow you to specify a file for Copilot to focus its answer on. These features are available on the latest Chat extension that is compatible with Visual Studio 2022 version 17.8 and higher.

Slash Commands

Slash commands are special commands that you can use in chat to receive targeted assistance, including explanations, documentation, test creation, and various other forms of support related to your code. For example, you can use:

  • /doc to add a documentation comment
  • /explain to explain the code
  • /fix to propose a fix for the problems in the selected code
  • /generate to generate code to answer your question
  • /help to get help with Copilot Chat
  • /optimize to analyze and improve the running time of the selected code
  • /tests to create unit tests for the selected code

VS Code Slash Commands

Context Variables

The context variables feature enables you to add files from your solution into your questions using the # symbol. By referencing a file in this way, you allow Copilot to access the content of the file and provide more targeted answers about it. For example, you can ask “How does the #file:’Main.cs’ file work?” or “What is the purpose of the #file:’Calculator.cs’ file?” and get relevant answers from Copilot Chat. You can add multiple files to one question.

VS Code Context Variables

Besides these main features, you can also explore our other exciting new preview features

Join the discussion within GitHub Community.

See more

GitHub Actions: macOS 14 (Sonoma) is now available

The macOS 14 runner image is now available for GitHub hosted runners. Workflows executed on this image will run exclusively on the 3 vCPU M1 runner announced earlier today. To use the runner, simply update the runs-on: key in your YAML workflow file to macos-14, macos-14-xlarge, or macos-14-large.

The macOS 12 runner image will remain latest until migration of the latest YAML workflow label to macOS 14 in Q2 FY24 (April – June 2024). While macOS 13 is now generally available under the macos-13 label, this image will not be migrated to latest. Following this announcement, macOS 11 runner image will begin deprecation immediately with retirement expected to complete by June 2024.

The full list of software available for all macOS runner images can be found here. If there is software you require that is not installed on the image, please create an issue in the runner-images repository.

See more

GitHub Actions: Introducing the new M1 macOS runner available to open source!

Today, GitHub is excited to announce the launch of a new M1 macOS runner! This runner is available for all plans, free in public repositories, and eligible to consume included free plan minutes in private repositories. The new runner executes Actions workflows with a 3 vCPU, 7 GB RAM, and 14 GB of storage VM, which provides the latest Mac hardware Actions has to offer. The new runner operates exclusively on macOS 14 and to use it, simply update the runs-on key in your YAML workflow file to macos-14.

See more

CodeQL 2.16.1: Swift 5.9.2 Support, New Queries, and Scanned-File Count Changes

CodeQL 2.16.1 is now available to users of GitHub code scanning on github.com, and all new functionality will also be included in GHES 3.13. Users of GHES 3.12 or older can upgrade their CodeQL version.

Important changes in this release include:

Swift 5.9.2 is now supported.

We added a new query for Swift, swift/weak-password-hashing, to detect the use of inappropriate hashing algorithms for password hashing and a new query for Java, java/exec-tainted-environment, to detect the injection of environment variables names or values from remote input.

We improved the tracking of flows from handler methods of a PageModel class to the corresponding Razor Page (.cshtml) file, which may result in additional alerts from some queries.

JavaScript now supports doT templates and Go added support for AWS Lambda functions and fasthttp framework.

In the previous version, 2.16.0, we announced that we will update the way we measure the number of scanned files in the Code Scanning UI. This change is now live for JavaScript/TypeScript, Python, Ruby, Swift, and C#.

For a full list of changes, please refer to the complete changelog for version 2.16.1.

See more

Dependabot Version Updates Support devcontainers

If you use devcontainer.json files to define your development containers, you will now be able to use Dependabot version updates to keep your Features up-to-date. Once configured in dependabot.yml, Dependabot will open pull requests on a specified schedule to update the listed Features to latest. This ensures Features are pinned to the latest major version in the associated devcontainer.json file. If a dev container has a lockfile, that file will also be updated. Dependabot security updates for dev containers are not supported at this time.

See more

CodeQL 2.16: Python Dependency Installation Disabled, New Queries, and Bug Fixes

CodeQL 2.16.0 is now available to users of GitHub code scanning on github.com, and all new functionality will also be included in GHES 3.13. Users of GHES 3.12 or older can upgrade their CodeQL version.

Important changes in this release include:

In July 2023, we disabled automatic dependency installation for new CodeQL code scanning setups when analyzing Python code. With the release of CodeQL 2.16.0, we have disabled dependency installation for all existing configurations as well. This change should lead to a decrease in analysis time for projects that were installing dependencies during analysis, without any significant impact on results. A fallback environment variable flag is available to ease the transition, but will be removed in CodeQL 2.17.0. No action is required for Default setup users. Advanced setup users that had previously set the setup-python-dependencies option in their CodeQL code scanning workflows are encouraged to remove it, as it no longer has any effect.

We fixed a bug that could cause CodeQL to consume more memory than configured when using the --ram flag. If you have used this flag to manually override the memory allocation limit for CodeQL, you may be able to increase it slightly to more closely match the system’s available memory. No action is required for users of the CodeQL Action (on github.com or in GHES) who are not using this flag, as memory limits are calculated automatically.

We added 2 new C/C++ queries that detect pointer lifetime issues, and identify instances where the return value of scanf is not checked correctly. We added a new Java query that detects uses of weakly random values, which an attacker may be able to predict. Furthermore, we improved the precision and fixed potential false-positives for several other queries.

The measure of scanning Go files in the code scanning UI now includes partially extracted files, as this more accurately reflects the source of extracted information even when parts of a file could not be analyzed. We will gradually roll this change out for all supported languages in the near future.

We fixed a bug that led to errors in build commands for Swift analyses on macOS that included the codesign tool.

For a full list of changes, please refer to the complete changelog for version 2.16.0 and 2.15.5.

See more

Migrating GitHub Classroom Assignment Repository Creation from “Create from Template” to Forks [Public Beta]

Last month, we announced our plan to migrate from a strategy where student repositories are created from a template starter code repository to a strategy where student repositories are forked from the starter code repository.

Today, we are launching these changes as a Public Beta that you can opt-into on a per-classroom basis. You may opt-in your Classrooms by clicking the “Opt-in this classroom” button on the banner displayed at the top of the Dashboard of the Classroom you wish to opt-in.

We anticipate generally rolling out these changes to all Classrooms on June 17, 2024.

This public beta allows us to enable one of our most-requested features from teachers: the ability to change starter code after an assignment has been accepted by students. Students will be able to sync their assignment repository with the upstream starter code, allowing teachers to correct starter code mistakes or add additional content after the assignment has gone live to students.

Because there are important differences between creating a repository from a template and forking a repository, there are important changes in behavior for both new and existing assignments in GitHub Classroom. We recommend reviewing the following new behaviors and making adjustments to your assignments if necessary.

Important Changes for Classrooms in the Public Beta

  • All new accepted assignments will be forks, including existing assignments that were created with a template repository. Existing assignment repositories will not be changed, so they will not be able to sync changes from upstream.
  • Starter code assignments cannot be empty. If you are using a starter code repository without any commits, students will not be able to accept your assignment. GitHub Classroom will enforce this requirement for new assignments, but you will need to manually create an initial commit to existing empty starter code repositories in order for students to accept assignments.
  • Starter code commits will no longer be automatically squashed in student repos. A new fork includes the entire commit history of the parent repository, while a repository created from a template starts with a single commit. This can affect teachers who may have assignment solutions in the commit history of the starter code. We recommend using Git on the command line or GitHub Desktop to squash commits of starter code repositories prior to distributing assignments to students if you previously had solutions filled-in the starter code.
  • In order to enable private assignments, your organization must allow forking private repositories. Forking private repositories is not enabled for organizations by default. See managing the forking policy for your organization for information on how to enable this. During the Public Beta, our team is exploring options for automating this step.
  • Student repository visibility will be inherited from the starter code repository. Forks of public repositories cannot be made private on GitHub. As a result, if you wish to use a public template repository as starter code for an assignment where student repositories should remain private, we recommend creating a new repository from the public template and setting it to private prior to using it as starter code in a GitHub Classroom assignment. During the Public Beta, our team is exploring options to automate this step.
  • Private repositories must be in the same organization as the Classroom in order to be used as starter code. If you wish to use a private repository as starter code for an assignment that is housed under your user account or in another organization, we recommend configuring it to be a template repository and creating a new private repository from the template in the same organization as the Classroom prior to using it as starter code in a GitHub Classroom assignment. During the Public Beta, our team is exploring options to automate this extra step.
See more

GitHub Issues & Projects – Project status updates & issues side panel

Today's changelog brings you project status updates and an updated issues side panel in Projects!

🟢 Project status updates

You can now provide high level details on the status, timing, and progress of your project, directly from the project! This makes it easy to know and share with others how your work is progressing, any risks, and a history of when and why something changed, all in the same place where you're tracking your work.

You can access status updates from the Project details panel, where you can also add a short description or README with additional project information. Select Add update to give your project a Status, Start date, or Target date, along with additional details or mentioning another user or team. You can also edit, delete, or copy a link to a specific update to make it easy to share with others.

Once you add a status update to a project, you'll find it visible in the project header and the project index pages, so you can quickly find and access the high level details for all of your projects in a single place and drill in for more information.

project index page showing the description and start / end dates next to the project name

For more details, check out the documentation.

🛝 Issues side panel in Projects

Projects has an updated issues side panel which matches the design of issues reached from a repository. In addition to providing a consistent experience, this update also means that issues accessed from a project have all timeline events and include any other projects the issue is a part of, making it easier to manage issues from either a project or a repository.

The image shows a project with an open issue page in a side panel

✨ Bug fixes and improvements

  • Fixed a bug where labels were being unexpectedly changed on issues when adding them to a project
  • Improved the workflow name editing experience by providing a dialog
  • Improved keyboard focus and navigation on the Insights and Workflows pages

✍️ Tell us what you think!

Join the conversation in the community discussion to share your feedback.

See how to use GitHub for project planning with GitHub Issues, check out what's on the roadmap, and learn more in the documentation.

See more
View more changes