IT intelligence

GitHub has expanded its advisory GraphQL interface with CVE identifiers, affected source-code links, GitHub review dates, NVD publication dates and links to associated repository advisories. New severity and withdrawal filters let integrations narrow results before downloading them. GitHub says the additions reduce the need to switch to REST for advisory data; they are read-only changes that preserve existing queries.

GitHub will remove its macOS 14 Actions runner images on November 2, 2026, covering the standard, large and xlarge labels. Scheduled brownouts beginning October 5 will temporarily fail affected jobs before retirement, and reduced capacity may lengthen queues. GitHub directs workflow maintainers to its listed macOS 15 or macOS 26 arm64 alternatives; the announcement includes the individual UTC interruption windows.

GitHub now makes repository accessibility statements easier to find from the overview page when maintainers place ACCESSIBILITY.md in the root, .github, or docs directory. Public repositories also let contributors add or propose a statement through Community Standards. The change is available across GitHub.com plans; GitHub says Enterprise Server support will arrive in version 3.24.

Old checks and workflow history now expire alongside Actions logs and artifacts. GitHub says the same retention setting also covers statuses from third-party apps, subject to organization and enterprise limits. Public repositories retain a maximum of 90 days, and extending the setting cannot bring back records already deleted.

Oct 1, 17:56 UTC Resolved - This incident has been resolved. Thank you for your patience and understanding as we addressed this issue. A detailed root cause analysis will be shared as soon as it is available.

Turning on code scanning no longer starts months of weekly scans for an otherwise dormant repository. GitHub still runs the initial validation, but scheduled scanning begins only after a push or pull request triggers analysis. The change applies to Enterprise Cloud, requires no configuration changes and is planned for Enterprise Server 3.24.

A new branch without a pull request will no longer make GitHub's code coverage upload step fail CI. The action now skips that upload and explains why. For workflows triggered only by pushes, opening a pull request does not itself resume uploads: coverage returns on the next push unless a pull-request trigger is also configured.

GitHub's redesigned dashboard is now the default, bringing active agent sessions, issues and pull requests into one workspace. Filters control each list, while news updates live in a separate Feed tab. Users can start Copilot work from the dashboard or switch back to the previous experience through the preview dropdown.

Automation no longer has to wait for a complex pull-request merge to finish inside one request. GitHub's generally available async merge API accepts the job and returns an identifier to poll for progress. It supports individual and stacked pull requests, merge queues and direct merges; bypassing rules still requires the appropriate permission.

Oct 1, 13:57 UTC Resolved - This incident has been resolved. Thank you for your patience and understanding as we addressed this issue. A detailed root cause analysis will be shared as soon as it is available.

Actions Runner Controller 0.15.0 targets the operational friction of large Kubernetes runner fleets. GitHub describes less disruptive patch upgrades, configurable graceful shutdown and concurrency, and fewer Kubernetes API updates. Runner status moves into metrics, while scale sets can register again if their recorded counterpart has disappeared from the Actions service.

GitHub's resolved, retroactive incident report says an infrastructure failure around 02:00 UTC on October 1 lost execution state for a small number of Actions runs. Connectivity recovered, but affected runs could remain stuck or fail deployment approvals. GitHub advises starting a new run or contacting support; before rerunning jobs, teams should check completed deployment steps to avoid repeating changes.

npm release automation can now move distribution tags using short-lived OIDC credentials instead of retaining a token just for that step. GitHub says the new trusted-publishing permission is opt-in and starts disabled. It can also be granted to staging-only configurations, while existing token-based tag management continues unchanged.

GitHub Enterprise Cloud with data residency will reject HTTPS clients that offer only X25519 key agreement from October 7, 2026. GitHub says most current clients already support P-256 and need no action. Explicitly restricted clients, proxies or security appliances need a compatible configuration; SSH connections and other GitHub hosting scopes are outside this change.

Repository administrators can choose a labeled runner for Dependabot version updates and optionally specify a runner group. GitHub exposes the controls for private and internal repositories on github.com; public repositories and Enterprise Server do not get them. Security configurations do not currently enforce these runner settings, so administrators manage the choice at repository level.

GitHub's external custom properties preview lets an outside system keep repository ownership, service tier or compliance context in sync. Values remain read-only in GitHub so the external integration stays in control. Teams can use that context in repository filters and rulesets, with either the initial Port.io integration or their own API integration.

GitHub moved full enforcement of its Enterprise Cloud self-hosted runner requirements to September 29, 2026. Registration requires at least version 2.329.0, but running workflow jobs has a separate, higher minimum. The notice points operators to the runner-deprecation API for version-specific dates and says Enterprise Server is unaffected.

GitHub says about 1,700 users encountered errors or delays while adding or changing billing addresses during a resolved September 22-24, 2026 incident. An operating system upgrade exposed an HTTP client adapter incompatibility that stalled address-validation requests. Switching the HTTP client mitigated the problem at 20:24 UTC on September 24. GitHub also reported new alerts and plans to extend the fix to other integrations.

GitHub's resolved September 23-24, 2026 incident disrupted app installation, organization creation and membership changes, while Projects showed delayed labels and stale search results. GitHub traced the failures to database maintenance and replica recovery problems in Azure Central US. API errors were mitigated at 10:58 UTC on September 23; clearing the Projects backlog took until 04:55 UTC the next day. GitHub says it is strengthening maintenance and recovery safeguards.

Sep 20, 23:22 UTC Resolved - On September 20, 2026, between 21:46 and 22:24 UTC the Pull Requests service was degraded and pull request merge and test-merge commits were created late, with delays reaching approximately four minutes at peak.

GitHub says an upstream capacity shortage disrupted Gemini 3.8 Flash in Copilot on September 16, 2026, from 04:40 to 11:45 UTC. Requests failed at an average rate of 6.4%, with the greatest impact during peak demand. Other models remained available. The historical incident was resolved after traffic eased and monitoring confirmed recovery; GitHub said it was working to improve resilience during demand peaks.

Some Copilot reviews of pull requests stopped before completion on September 15, 2026, GitHub reports. A slowdown in an internal cache prevented review jobs from acquiring coordination locks before their timeout, interrupting the work. GitHub rolled back the cache change and restored operation by 20:00 UTC, ending an incident that began at 15:30 UTC.

Sep 15, 11:17 UTC Resolved - On September 15, 2026, between 05:45 and 09:50 UTC, the Claude Fable 5.1 model in GitHub Copilot experienced intermittently degraded availability, with an average error rate of 2.8%.

GitHub traced slow starts for Actions larger-runner jobs on September 14, 2026, to a provisioning bug exposed during a capacity expansion. It says 5.7% of those jobs were affected between 16:10 and 19:01 UTC because new runners could not be created quickly enough. GitHub corrected capacity records to restore provisioning, fixed the underlying selection bug and added alerts. The incident is resolved.