Search results for: Security

As of today, npm trusted publishing with OpenID Connect (OIDC) is now generally available. This feature enables you to securely publish npm packages directly from CI/CD workflows using OpenID Connect…

Upgrade from a local MCP Docker image to GitHub’s hosted server and automate pull requests, continuous integration, and security triage in minutes — no tokens required.

On July 28, 2025 21:41 UTC, GitHub Enterprise Importer (GEI) was identified as being in a degraded state with migrations stalled. An incident was declared to restore the service to…

What’s new You can now dismiss or reopen multiple Dependabot alerts at once across your entire organization, making alert management more efficient for security and development teams. Previously, organization-level alert…

We’re investing in keeping Dependabot relevant for modern development teams, whether you’re experimenting with a new language or relying on the latest version of your favorite package manager. We’ve expanded…

Secret scanning is adding validity check support for eight additional token types across five providers. In addition to previously announced token types, you will now see validity checks for the…

More context can mean more attack surfaces for your projects. Be prepared for what lies ahead with this guide.

Build a custom Azure DevOps extension that eliminates the complexity of JWT generation and token management, enabling powerful automation and enhanced security controls.

Open source software is critical infrastructure, but it’s underfunded. With a new feasibility study, GitHub’s developer policy team is building a coalition of policymakers and industry to close the maintenance funding gap.

Secret scanning is adding validity check support for 45 additional token types across over 30 providers. What’s changing? In addition to previously announced token types, you will now see validity…

Organization administrators can now centrally configure private registries for Dependabot at the organization level, streamlining dependency management across all repositories. What’s new Previously, organizations had to individually configure private registry…

Starting on July 22nd, 2025, GitHub code scanning will no longer combine multiple SARIF files that share the same tool and category properties. Impacted SARIF files will also be rejected.…

Strengthen your repositories against actions workflow injections — one of the most common vulnerabilities.

GitHub Copilot coding agent, currently in public preview, has limited internet access by default to help protect your data and mitigate security risks. Today, we’re releasing an updated experience that…

GitHub now supports social login with Google! You can now signup for a new GitHub account with your trusted Google social credentials in just a few clicks. You can also…

When it comes to merging code, developers will always make the final decision. But we’re rethinking how tools like GitHub Copilot can help.

Automatic dependency submission now supports the pip package manager for Python. This release completes the cohort of package managers that now have auto-submission support, adding to the previously-released Maven, Gradle,…

DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to open a crafted document.

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.22.1 which brings Rust support to public…

Learn how to streamline your development workflow with five different MCP use cases.

GitHub code scanning customers can now require a review process before dismissing alerts, helping you manage security risks as well as meet audit and compliance requirements. What’s new Provide a…