CodeQL 2.27.2 updates C/C++, Go, Rust, and JavaScript analysis, while introducing Go control-flow changes and macOS build limitations that teams should review.
CodeQL 2.27.2 Expands Analysis and Changes Go CFG Read More »
npm now expires unvalidated Trusted Publishing configurations after 48 hours. Maintainers should review setup, publishing events, workflow permissions, and required tool versions.
npm Trusted Publishing Configurations Now Expire Read More »
GitHub announced five new SecurityAdvisory GraphQL fields and two server-side filters. Here is what developers should know about the change, its benefits, and its current documentation gap.
GitHub Adds Fields and Filters to SecurityAdvisory API Read More »
GitHub now lets users with repository write access mark security advisory comments as confidential, giving maintainers a more restricted way to discuss sensitive remediation details.
GitHub Adds Confidential Comments to Security Advisories Read More »
GitHub will retire its macOS 14 GitHub Actions runner images on November 2, 2026. Here is how to identify affected workflows, choose a replacement label, and test toolchain differences before the deadline.
GitHub now lets administrators choose runner settings for Dependabot updates in eligible private and internal repositories, including labeled runners and runner groups.
GitHub Adds Repository Runner Controls for Dependabot Read More »
GitHub is replacing CodeQL’s all-platform bundle with platform-specific packages. Here’s what CLI, CI, and GitHub Actions users should update before mid-March 2027.
CodeQL Deprecates All-Platform Bundle in CLI 2.27 Read More »
GitHub Enterprise Cloud now lets authorized administrators inspect and export credential inventory metadata. Here is how the API, CSV workflow, permissions, and operational caveats affect security and platform teams.
GitHub Enterprise Adds Credential Inventory Exports Read More »
npm’s new stage-only token permission lets CI/CD workflows upload package versions for maintainer review instead of publishing them directly. Here’s how the workflow works and how teams can prepare for npm’s planned 2027 change.
GitHub has made workflow execution protections generally available, giving eligible administrators more control over which actors, events, repositories, and workflow files can run Actions workflows.
GitHub Makes Workflow Protections Generally Available Read More »
