Keep control over the security posture of your organization with delegated alert dismissal. With this feature, you can require a review process before alerts are dismissed in code scanning and secret scanning. This helps you manage security risk better, as well as meet audit and compliance requirements.
While this feature adds oversight and control, organizations should carefully balance security needs with development velocity. Things to consider include:
Who can close alerts
When and how alerts should be closed
Who should review and approve dismissal requests.
This feature can be configured and managed at scale using security configurations or at the repository level.
Each dismissal request requires a mandatory comment explaining the rationale, with email notifications sent to both approvers and requesters throughout the process. If rejected, the alert remains open.
People with the organization owner or security manager role can review and approve dismissal requests by default. The state of previously dismissed alerts does not change when enabling this feature.
The dismissal and approval process is visible on the alert timeline, included on the audit log, and accessible through both the REST API and webhooks.
You can enable this feature today for code scanning and secret scanning in GitHub Enterprise Cloud. It will also be available in version 3.17 of GitHub Enterprise Server.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
At GitHub, we believe that investing in the security of your codebases should be straightforward, cost-effective, and accessible for everyone. Today, we’re announcing changes to pricing plans and availability of GitHub Advanced Security (GHAS), aligning with our ongoing mission to help organizations of all sizes secure their code with the flexibility they seek.
Announcing new pricing plans for GitHub Advanced Security
Starting April 1, 2025, GitHub Advanced Security will be available as two standalone security products: GitHub Secret Protection and GitHub Code Security. In addition, these products will become available to GitHub Team plan customers for the first time.
GitHub Secret Protection
New customers can purchase GitHub Secret Protection, which includes features that help detect and prevent secret leaks (e.g. secret scanning, AI-detected passwords, and push protection for secrets). Secret Protection will be available for $19 per month per active committer, with features including:
Push protection, to prevent secret leaks before they happen
AI detection with a low rate of false positives, so you can focus on what matters
Secret scanning alerts with notifications, to help you catch exposures before they become a problem
Custom patterns for secrets, so you can search for sensitive organization-specific information
Security overview, which provides insight into distribution of risk across your organization
Push protection and alert dismissal enforcement for secrets, which supports governance at enterprise scale
In addition, we’re launching a new scanning feature to help organizations understand their secret leak footprint across their GitHub perimeter. This feature will be free for GitHub Team and Enterprise organizations.
GitHub Code Security
New customers will also be able to purchase Code Security, which detects and fixes vulnerabilities in your code before it reaches production. Code Security will be available for $30 per month per active committer with features including:
Copilot Autofix for vulnerabilities in existing code and pull requests for developer-first security management
Security campaigns to address security debt at scale
Dependabot features for protection against dependency-based vulnerabilities
Security overview, which provides insight into distribution of risk across your organization
Security findings for third-party tools
Availability for GitHub Team customers
Starting April 1, 2025, customers on the GitHub Team plan can purchase Secret Protection and Code Security. These products will be available through a consumption-based, pay-as-you-go model (i.e., metered billing) to ensure security remains affordable, scalable, and accessible for all customers on GitHub.
Get started today
Existing customers with plans managed with a GitHub or Microsoft sales account team can transition to the new GitHub Advanced Security plans at start time of renewal for renewal dates after April 1, 2025. Please contact your account team for further details. For existing self-serve customers, instructions on how to transition to the new GitHub Advanced Security plans will be announced over the coming months through GitHub’s roadmap and changelog.
GitHub Team customers can choose to purchase Secret Protection or Code Security from their organization settings pages starting April 1, 2025.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
GitHub is committed to empowering the developer community by helping organizations recognize and address the risks of secret leaks. That’s why we’re launching a new free tool next month which will provide clear insights into their exposure, along with actionable steps to strengthen their security and protect their code.
Scan your organization for aggregate insights on public leaks, private exposures, and token types.
When will this feature be available?
The secret risk assessment will be available on April 1, 2025 as part of the launch of Secret Protection for GitHub Team and Enterprise plans.
What will this dashboard include?
Available in the ‘Security’ tab, organization and security admins will be able to run a scan in order to understand how their organization is affected by secret leaks and exposures. Once a scan is initiated, GitHub will look for secret leaks and exposures across your organization, returning a collection of insights including:
Number of secrets leaked per type
Number of publicly visible secrets in your public repositories
Number of repositories affected per secret type
No specific secrets will be stored or shared. The scan will be a point-in-time assessment across all public and private repositories. For organizations ready to adopt a continuous monitoring tool, we recommend enabling secret scanning for detection and incident management of specific secrets.
Why are we doing this?
We’re launching this feature to help organizations understand their secret leak footprint across their GitHub perimeter.
GitHub is committed to making a meaningful impact on the developer community by helping organizations recognize their risk from secret leaks. Our goal is to provide clear insights into their exposure and a clear path to stronger security.
Who can use this feature?
This feature will be available for free to organizations with a GitHub Team or Enterprise plan. Organization admins and security managers will be able to run the report and review any results.
To learn more about the launch of GitHub Secret Protection, please refer to this changelog. Have questions? Let us know what you think by starting a discussion in GitHub Community — we’re listening.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
The improved merge experience on the pull request page is now generally available! This update is designed to help you better understand the state of your pull request and get it merged faster.
This experience supports all the usual ways of merging: direct, bypass and merge, auto-merge, and merge queue, and works with rulesets to ensure pull requests meet all the requirements to merge.
What’s new
The new experience is designed to feel familiar, but also improves on the previous experience. Here are some highlights:
Checks grouped by status: checks are now grouped by status with failing checks prioritized at the top of the list, making it easier to identify problems that need attention
Checks ordered logically: status checks are now ordered using natural ordering to make it easier to find a specific check, especially when the list gets long
Improved rule enforcement: errors resulting from failing commit metadata rules (like invalid commit messages) are now reported at the point of merging so they can be corrected
Improved accessibility: consistent keyboard navigation, focus management, and landmarks help make the experience more accessible to everyone
npm’s massive ecosystem of open source packages is one of its greatest strengths. But as a security-conscious developer, it can be tough to keep up with vulnerability reporting and updates once your project has more than a handful of dependencies, each of which has its own set of dependent packages. Dependabot notifies you of vulnerabilities and their fixes as they come in. Unfortunately, it’s hard to distinguish actionable alerts about direct dependencies you’ve added to your manifests from those transitive dependencies that were pulled in along the way… until now, that is.
GitHub’s dependency graph now tracks direct and transitive dependencies for npm packages. This helps you triage, prioritize, and remediate your Dependabot alerts. This capability shows up in user-facing features across the site:
Dependabot alerts will now contain a direct label if they are associated with a package you’ve directly included in a manifest. You can filter the list of alerts down to only these direct ones with the relationship:direct filter in the search bar.
Alerts for transitive dependencies now show transitive path information – the chain of packages which led from your direct dependency to the transitive one which has the vulnerability.
A repository’s dependency graph now distinguishes between direct and transitive relationships. Direct dependencies will have a label in the table UI, whereas indirect dependencies have a disclosure menu that shows the transitive path which led to their inclusion.
A repository’s SBOM will contain a relationships section that uses the SPDX relationshipType: DEPENDS_ON field to express the tree of package dependencies. Tools like guac.sh can help explore and visualize this tree.
The GraphQL API will now return a relationship field with direct, transitive, or unknown values in the DependencyGraphDependency object. See the API documentation for details.
We started with npm because it’s the most popular package ecosystem in the known universe, but it’s just the beginning. Over the next few months, package types for other programming languages will also get the transitivity treatment. Up next: Maven packages for Java.
To try this out, you’ll need to make sure the dependency graph is enabled. To see the Dependabot labels, you’ll also need to enable Dependabot alerts. If the “Direct” labels aren’t showing up for you immediately, push a commit that updates one of your manifest files, which will trigger an update of the dependency graph.
Scaling your GitHub usage just got easier! We are expanding our pay-as-you-go usage-based billing and licensing reporting interface to include GitHub Enterprise (GHE) and GitHub Advanced Security (GHAS) Server-only usage.
We announced pay-as-you-go billing for GHE and GHAS on August 1, 2024 to give customers flexible self-provisioning and pricing. Since then, enterprise accounts on github.com created on or after that date could generate a GitHub Enterprise Server key for the appropriate license count when license adjustments were needed. This required all users, including Server-only users, to be represented in the enterprise account’s user list on GitHub Enterprise Cloud.
Now, you can track and monitor your Server-only license usage for both Enterprise and Advanced Security as a separate line item on the Billing & Licensing > Licensing page.
Note that it will still be required to add all Server-only users to your GitHub Enterprise Cloud enterprise user list to account for their license usage and generate a license key with the appropriate license count. This update does not change this compliance requirement.
For existing customers who already have GHE or GHAS, your plan and existing billing method will remain as-is.
If you are interested in pay-as-you-go usage-based billing and have a GitHub account team, please connect with them to discuss whether switching to this model is an option for you.
Check out our documentation to learn more about usage-based billing for licenses.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
The GitHub Copilot plugin for JetBrains IDEs now includes the ability to view code references, designed to enhance your coding experience and improve productivity.
What’s new ✨
Viewing code references: When GitHub Copilot suggests code that matches public code, you will be notified of this match. Click “View matches” at the end of the response to access the reference information.
Benefits for developers ⚡️
Informed decisions with code suggestions: code referencing allows you to make more informed decisions about whether to use the suggested code.
This week, we’ve added an indicator for your daily or hourly quotas, allocated a section of the dashboard to issues assigned to you, and introduced several UX improvements and bug fixes to ensure a smooth development process with Copilot Workspace.
Showing approaching quota limits
As you’re nearing your quota limit, Copilot Workspace will now display a counter so you can keep track of how many tokens you have left, and prioritize your usage accordingly.
Issues listed in homepage dashboard
Your recently assigned issues are now listed in the homepage dashboard, providing another jumping point to start developing from!
UX improvements and bug fixes
The session list has been refactored to link directly to pull requests created from a session.
The sessions index page now maintains scroll position when navigating across sessions.
When viewing a new file’s diff, the diff is now highlighted in green.
We’ve added an arrow to the current branch name, indicating that it is clickable.
You can now select file names in the Plan stage, allowing you to copy them as needed.
We fixed the “live preview” button on the run command.
We fixed the overlay of the file tree view on small viewports.
Light/dark mode is now fixed to match your settings theme.
Terminal commands are now correctly disposed of when exiting the command dialogue without saving.
There’s improved file name generation to remove excess backtick characters.
We fixed a bug where the plan was not being shown in mobile view.
The “Revise” button on file headers is now represented by a sparkling pencil icon instead of crosshairs.
There’s a new square circle button for stop buttons.
Providing feedback
Please give your feedback in our GitHub Discussion. We’d love to hear your thoughts!
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
January and February brought a number of improvements to GitHub Mobile, making it more powerful and flexible. We’re rolling out exciting new features designed to make coding and collaboration easier on the go. From third-party integrations that extend GitHub Copilot’s capabilities to in-chat coding assistance, sub-issues, and refined notification preferences, these updates are designed to boost productivity and keep you connected wherever you are.
Copilot Extensions on GitHub Mobile are generally available. Developers can extend Copilot’s capabilities on the go, integrating third-party tools, automating tasks, and receiving personalized code suggestions.
Introducing sub-issues on GitHub Mobile. Track progress and understand remaining work within a parent-child hierarchy on the go.
Review your notification preferences: from time to time, we’ll ask that you check in on your notification preferences to ensure that you’re receiving the kinds of notifications you want, at times you want to receive them.
Copilot Extensions
Sub-issues
iOS bug fixes:
Widgets reflect the accent color when tinted.
Add reactions to the latest release in the Releases view.
Inbox swipe actions get dismissed before entering batch selection mode.
In the Explore view, avatars load correctly with transparent background.
In the Issue view, remove an extra animation when data loads.
Navigate content in the Explore view’s “For You” feed using assistive technologies.
Pull request reviews from Copilot code review show the “Copilot” brand name.
Clearing a field used for a grouping within a project re-groups content without duplicate group titles.
Fixed an issue where the search bar was improperly updated during text input with marked text in Japanese or Chinese input methods.
Fixed an issue where pull-to-refresh in discussions failed to refresh data and the loading indicator remained stuck.
The pull request widget responds to user specified tints.
Issues in archived repositories no longer show update actions.
Code vulnerability alerts in Copilot chat are no longer duplicated.
Indented code blocks in Copilot chat display within a chat response.
Nested lists in markdown content display with less indentation when viewed with larger text sizes.
Issue and pull requests display their issue or pull request number when scoped to a single repository.
Shortcuts scoped to a single repository will no longer list the repository name for each issue or pull request.
Android bug fixes:
Improved scrolling performance for lists where list items contains web views.
The correct default commit message now appears when creating a new file in a repository.
Improved line wrapping in the Code view.
Various sub-issues design tweaks and improvements.
Fixed file header appearance in pull request reviews.
Pull request reviews now display the correct submission date.
Anchor links in markdown files will now scroll to the correct position.
The delete branch button will now be shown after closing a pull request.
Bots are now mentionable in pull request reviews if they are the author.
CodeQL version 2.20.5 has been released and includes a host of coverage improvements, including extended support for C# 13 and new detection capabilities for Java and GitHub Actions workflow files.
CodeQL is the static analysis engine that powers GitHub code scanning, which finds and remediates security issues in your code.
CodeQL 2.20.5 adds full support for new language features introduced in C# 13 / .NET 9, as well improved coverage for .NET 9. This will improve the detection of alerts and reduce the chance of false negative results.
CodeQL Java analysis is improved with additional support for Cross Site Request Forgery (CSRF). The new analysis capability detects vulnerabilities that occur when using HTTP request types that are not protected against cross site requests by default.
Go analysis has been updated to support Go 1.24, which includes new language features and improvements. This will improve the detection of alerts and reduce the chance of false negative results.
For a full list of changes, please refer to the complete changelog for version 2.20.5. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on GitHub.com. The new functionality in CodeQL 2.20.5 will also be included in GitHub Enterprise Server (GHES) version 3.17. If you use an older version of GHES, you can manually upgrade your CodeQL version.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
With the release of CodeQL 2.20.5, we are expanding the analysis capabilities to detect additional types of security risks associated with Actions workflow files and we have adjusted some of the existing queries.
The analysis coverage is improved with the addition of five new queries that identify additional types of security risks associated with Actions workflow files. The new queries are:
actions/envpath-injection/medium detects situations where user-controlled sources (like the text of a GitHub issue) are used to populate the PATH environment variable. This could allow an attacker to alter the execution of system commands.
actions/envvar-injection/medium detects situations where environment variables which are not properly sanitized can lead to the injection of additional unwanted variables, using new lines or {delimiters}.
actions/code-injection/medium– detects situation where user-controlled input can end up in contexts like run: or script:, leading to malicious code being executed and secrets being leaked.
actions/artifact-poisoning/medium detects situations where artifacts are not correctly extracted, stored and verified, which could result in a poisoned artifact being executed, leading to repository compromise.
actions/untrusted-checkout/medium detects situations where workflows triggered by events like pull_request_target or issue_comment can execute arbitrary code from untrusted sources, if followed by an explicit checkout.
Because of its lower precision and the large number of alerts it generates, the query actions/unpinned-tag has been moved to the security-extended query suite from the default query suite, and all existing alerts for this query will be automatically closed if the security-extended suite is not being used.
Three queries have been removed from the default and security-extended query suites because they do not produce relevant security alerts. Alerts generated by these queries will be closed automatically.
These changes are now available with the release of CodeQL 2.20.5. For a full list of changes, please refer to the complete changelog for version 2.20.5. Every new version of CodeQL is automatically deployed to users of GitHub code scanning on GitHub.com. The new functionality in CodeQL 2.20.5 will also be included in GitHub Enterprise Server (GHES) version 3.17. If you use an older version of GHES, you can manually upgrade your CodeQL version.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
OpenAI’s latest model, GPT-4.5, is now available in GitHub Copilot Chat to Copilot Enterprise users. GPT-4.5 is a large language model designed with advanced capabilities in intuition, writing style, and broad knowledge. It performs effectively with creative prompts and provides reliable responses to obscure knowledge queries. GPT-4.5 will launch in Visual Studio Code and on github.com for Copilot Enterprise users with a limit of 10 requests every 12 hours per user. In the coming weeks, we’ll be scaling rate limits and extending support to Visual Studio and JetBrains.
As model releases have continued to accelerate, we’ve been thinking about how we can sustainably offer advanced AI models like GPT-4.5 to more GitHub users. This includes individual developers who want the most advanced capabilities from day one. Stay tuned for updates.
Enabling access
Copilot Enterprise administrators will need to enable access to GPT-4.5 via a new policy in Copilot settings. As an administrator, you can confirm availability by checking your individual Copilot settings and confirming the policy for GPT-4.5 is set to “enabled”. Once enabled, users will see GPT-4.5 in the Copilot Chat model selector in VS Code and on github.com.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
Codespaces will be undergoing maintenance in Europe and Southeast Asia from 17:00 UTC on Friday, February 28 to 02:00 UTC on Saturday, March 1. Maintenance will begin in North Europe at 17:00 UTC on Friday, February 28. Once it is complete, maintenance will start in Southeast Asia, followed by UK South. Each region will take approximately two to three hours to complete.
During this time period, users may experience connectivity issues with new and existing Codespaces.
If you have uncommitted changes you may need during the maintenance window, you should verify they are committed and pushed before maintenance starts. Codespaces with any uncommitted changes will be accessible as usual once maintenance is complete.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
We are making changes to npm replication APIs to optimize performance and availability. As part of this update, certain endpoints will be deprecated as of Thursday, May 29, 2025.
To facilitate a seamless transition, the new endpoints will be available starting Tuesday, March 18, 2025, operating in parallel with the existing endpoints. The existing endpoints will be fully deprecated on Thursday, May 29, 2025.
During the transition period, you may access the new endpoints by including the npm-replication-opt-in header with the value true in your requests. This option will be available from Tuesday, March 18, 2025 until the deprecation date, after which only the new endpoints will be available. Effective Thursday, May 29, 2025, the header will be ignored, and all requests will be directed to the new endpoints by default.
This notice is provided to ensure adequate time for necessary updates to replication implementations. We strongly encourage developers to migrate to the new endpoints as early as possible.
How to migrate?
To assist with migration, we have detailed documentation in our replication API migration community discussion, outlining alternative approaches for deprecated endpoints when available. This is the go-to place for questions and discussions.
Additional support for migration
If you have further questions or need additional assistance, please reach out to our support team.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
Push protection for secret scanning blocks any push that contains a secret. By default, this block can be bypassed, which results in a secret scanning alert in the repository. Delegated bypass controls let you choose who is allowed to bypass push protection, and contributors without permissions to bypass must submit a request for approval by the listed reviewers. These controls can reduce the risk of secrets being accidentally exposed in your codebase.
Managing bypass requests is now available with the REST API, offering flexibility for triaging and reviewing by integrating with your existing workflows.
Reviewers can retrieve bypass requests for an organization or repository with the following endpoints:
Now it is easier to see how many of your historical CodeQL alerts received autofix suggestions and how many of those alerts were resolved across all the repositories in your organization.
Historical alerts are those found in your default and protected branches, indicating potential existing security issues in your code. You can stay informed about the progress of historical alert resolution and expediting this process as it is essential for accurately assessing your security risks.
The new “Alerts fixed with autofix suggestions” tile on the Security Overview provides you with the total number of fixed vulnerabilities compared to the total suggested autofixes for existing alerts. This will help you stay informed about the security trends in your organization.
The latest AI models from Phi, 4-mini-instruct and 4-multimodal-instruct, are now available in GitHub Models.
Phi-4-mini-instruct is a 3.8B parameter lightweight model designed for chat-completion prompts and strong reasoning, particularly in math and logic. Its efficiency makes it well-suited for memory- and compute-constrained environments.
Phi-4-multimodal-instruct is a 5.6B parameter multimodal model that excels at generating text outputs from various inputs including text, images, and audio. This model demonstrates strength in reasoning across multiple modalities.
GitHub Models makes it easy for every developer to build AI features and products on GitHub.
With the latest stable release of the extension (v1.5.35 or above), OpenAI o3-mini (Preview) and Google Gemini 2.0 Flash (Preview) are now available to all JetBrains users of GitHub Copilot Chat.
Click the Copilot Chat icon in the JetBrains IDE, and you will have a Copilot chat model picker to choose which model version to use for your chat conversations.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
Following our opt-in preview last October, we’re excited to expand item limits for all projects — increasing from 1,200 to 50,000 items per project.
Since the last release, we’ve added support for project insights and mobile, addressed your top bug reports, and delivered key performance improvements.
We’re rolling out increased limits incrementally over the next week. If you see the Increased items preview pill in your project, you’re now in the preview.
Insights for all
With this release, we’re also making project insights fully accessible to all plans—removing paid gating entirely. All plans now have access to both current state and historical charts in public and private repositories, with no feature restrictions. Learn more about insights for projects.
For questions and feedback, join the discussion within the GitHub Community.
✕
Wait! Don't Go Yet 🚀
Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!
Copilot secret scanning, which scans for passwords using AI, offers greater precision for detecting unstructured credentials that can cause security breaches if exposed.
You can now use code security configurations to enable Copilot secret scanning across your enterprise or organization, allowing you to control which repositories are detecting passwords at scale.
Copilot secret scanning is available for all repositories with a GitHub Advanced Security license. You do not need a Copilot license. To give you control over how AI is used across your repositories, Copilot secret scanning is not included in the GitHub Recommended configuration.
