Opt-in dist-tag permissions for npm trusted publishing

GitHub has expanded its advisory GraphQL interface with CVE identifiers, affected source-code links, GitHub review dates, NVD publication dates and links to associated repository advisories. New severity and withdrawal filters let integrations narrow results before downloading them. GitHub says the additions reduce the need to switch to REST for advisory data; they are read-only changes that preserve existing queries.

GitHub will remove its macOS 14 Actions runner images on November 2, 2026, covering the standard, large and xlarge labels. Scheduled brownouts beginning October 5 will temporarily fail affected jobs before retirement, and reduced capacity may lengthen queues. GitHub directs workflow maintainers to its listed macOS 15 or macOS 26 arm64 alternatives; the announcement includes the individual UTC interruption windows.

GitHub now makes repository accessibility statements easier to find from the overview page when maintainers place ACCESSIBILITY.md in the root, .github, or docs directory. Public repositories also let contributors add or propose a statement through Community Standards. The change is available across GitHub.com plans; GitHub says Enterprise Server support will arrive in version 3.24.

Old checks and workflow history now expire alongside Actions logs and artifacts. GitHub says the same retention setting also covers statuses from third-party apps, subject to organization and enterprise limits. Public repositories retain a maximum of 90 days, and extending the setting cannot bring back records already deleted.

Oct 1, 17:56 UTC Resolved - This incident has been resolved. Thank you for your patience and understanding as we addressed this issue. A detailed root cause analysis will be shared as soon as it is available.

Turning on code scanning no longer starts months of weekly scans for an otherwise dormant repository. GitHub still runs the initial validation, but scheduled scanning begins only after a push or pull request triggers analysis. The change applies to Enterprise Cloud, requires no configuration changes and is planned for Enterprise Server 3.24.