…In Visual Studio Code, install the advanced-security agent plugin , then use /dependency-scanning in Copilot Chat to start your prompt. Ask your agent to scan your current changes for vulnerable dependencies…
Back to changelog CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0 , which adds…
Back to changelog Dependabot now supports Nix flakes . Add nix as a package ecosystem in your dependabot.yml file. Dependabot will then monitor your flake.lock inputs and open pull requests when…
Back to changelog We have deprecated the following fields from the get an organization and update an organization REST API endpoints: advanced_security_enabled_for_new_repositories dependabot_alerts_enabled_for_new…
Back to changelog Following the recent release of the new Asynchronous SBOM REST API , the older, synchronous API is deprecated and slated for removal in six months, on November 13, 2026. If…
Back to changelog This release expands secret scanning’s coverage with more secrets blocked by push protection, one new secret scanning partner, and richer metadata on alerts. Secret scanning partnership program Lovable…
Back to changelog On April 21, 2026, we’re deprecating and removing the following fields from the get an organization and update an organization REST API endpoints: advanced_security_enabled_for_new…
Back to changelog You can now designate secret scanning push protection exemptions from your repository settings. Previously, exemptions could only be managed from security configurations at the organization and enterprise levels. What…
Back to changelog Artifact and deployment context now appears in two new places: repository properties and security alert pages. Repository properties: deployable and deployed Two new built-in repository properties— deployable and…
…V1 of actions/checkout will not receive this change. The security update will be backported to all other supported versions of actions/checkout. The pull_request_target event is one of the…