GitHub Copilot can now operate desktop apps, not just code
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
Search
Search results for “GitHub Actions security”
Find published research by company, product, platform or technology.
Showing 21–40 of 268 dossiers
GitHub adds credential inventory to its selective incident-response kill switches
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
GitHub rewrote Copilot’s 800,000-line agent runtime in Rust with agents doing most of the coding
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
GitHub AI Scan no longer needs CodeQL default setup
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
GitHub has switched off SHA-1 HTTPS support — old Git and API clients can now fail
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
GitHub Copilot Auto now lets developers choose whether routing optimizes for cost or intelligence
The material change is that model routing is no longer a single opaque optimization target. Developers can now tell Copilot whether to bias Auto toward lower cost, a middle ground or higher quality while GitHub still chooses a model prompt by prompt.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
GitHub can now make unresolved secret leaks a hard pull-request merge blocker
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI CodingDeployment & DevOpsDeveloper ToolsActive dossier
GitHub Enterprise Server 3.22 brings Copilot CLI into disconnected and air-gapped environments
The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
GitHub restores repository star-history analytics without exposing individual stargazers
Repository growth tools can measure when star counts changed again without rebuilding individual-user histories. The new API deliberately separates aggregate popularity data from stargazer identity, so integrations need to distinguish trend analytics from user-level community data.
GitHub Copilot code review can now approve pull requests
Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.
GitHub CLI’s Linux package signing key expires September 5
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
Artificial IntelligenceWeb DevelopmentSaaSPricing & BillingAI CodingSaaS OperationsDeveloper ToolsActive dossier
GitHub Copilot is moving enterprise seats to upfront billing and longer chat retention
From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.
GitHub Copilot turns Slack and Teams conversations into shared coding-agent sessions
GitHub Copilot can now turn Slack or Teams threads into collaborative cloud-agent sessions. Teammates can add context and steer the work in public, while repository permissions, agent budgets and optional extra PR approvals remain the main control boundaries.
GitHub’s OAuth apps get short-lived tokens, multiple callbacks — and a wildcard setting worth auditing
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
GitHub is turning agent confidence into a workflow control for Issues
GitHub Issues now gives agent automations confidence levels, rationales and optional approvals, letting teams automate routine triage while holding uncertain changes for review.
Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
NativePHP Mobile patches seven security flaws — rebuilding and app-store releases are required
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
FrankenPHP 1.13.4 fixes seven security flaws, including unauthenticated worker-mode crash
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
Coolify rushes security fixes to all v4 lines after PHP2Shell and dependency vulnerabilities
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.