Search results for: Security

Starting today, Dependabot offers full support for pnpm workspace catalogs. pnpm workspace catalogs are widely used in monorepos, and improper dependency handling can lead to: Broken dependency trees due to…

We’re excited to share the latest improvements for Copilot Workspace, including enabling enterprise managed users, auto-validating changes in the workspace, and more. Let’s get started! 🚀 Auto-validation We’ve shipped a…

Copilot Autofix suggestions for code scanning alerts can now be edited and validated using Copilot Workspace for pull requests. With this, GitHub Advanced Security users can: Review and integrate Copilot…

Empowering humanitarian action with open source: A natural language search tool for UN Resolutions.

With this preview, GitHub Enterprise Cloud accounts with Enterprise Managed Users (EMU) can decide to allow EMU enterprise traffic to github.com only via their existing corporate proxies. Unapproved traffic would…

Learn how specially crafted artifacts can be used to attack Maven repository managers. This post describes PoC exploits that can lead to pre-auth remote code execution and poisoning of the local artifacts in Sonatype Nexus and JFrog Artifactory.

Learn how to modernize legacy code with GitHub Copilot with real-world examples.

Explore insights into open source community growth, innovation, and inclusivity with an updated survey dataset.

GitHub Code Scanning powered by CodeQL now supports dependency caching for Java, Go, and C# projects. This feature ensures that scans can deliver meaningful results even if registries are temporarily…

GitHub uses GitHub to build GitHub, and our CLI extensions are no exception. Read on to find out how we built the GitHub Skyline CLI extension using GitHub!

Audit log streaming of API requests targeting your enterprise’s private assets is now generally available. This feature provides you as enterprise administrators new visibility into the API activity within your…

The open source Git project just released Git 2.48. Here is GitHub’s look at some of the most interesting features and changes introduced since last time.

On December 13, 2023, we released CodeQL Action v3, which runs on the Node.js 20 runtime. In January 2024, we announced that CodeQL Action v2 would be retired at the…

GitHub continually updates the default pattern set for secret scanning with new patterns and upgrades of existing patterns, ensuring your repositories have comprehensive detection for different secret types. The following…

Explore GitHub’s top blogs of 2024, featuring new tools, AI breakthroughs, and tips to level up your developer game.

We are excited to introduce the new CodeQL Community Packs, a comprehensive set of queries and models designed to enhance your code analysis capabilities. These packs are tailored to augment…

To enhance auditing and troubleshooting, we’ve introduced new webhook and audit log events to track the completion of certain secret backfill scans on repositories. The events specify the type of…

CodeQL build-mode: none scans can now access private dependencies stored in private registries (e.g. Artifactory) for Java and C# projects. This makes your scans more comprehensive, ensuring you receive all…

You can now more easily filter secret scanning alerts, with new filter options and advanced filtering. Enterprise and organization level list views now include a new menu with commonly used…

You can now enable code scanning in your GitHub Actions workflow files. By opting-in to this feature, you can enhance the security of repositories using GitHub Actions. Actions analysis support…

In this post, I’ll walk you through the vulnerabilities I uncovered in the GStreamer library and how I built a custom fuzzing generator to target MP4 files.