#github

GitHub’s security cleanup shows that the hard part is not finding secrets, but routing real risk to the right owners. The company says it cleared 20,000-plus alerts across 15,000 repositories in nine months.

Dependabot will now wait until a new package release has been on its registry for at least three days before opening a version-update pull request. Security updates still open immediately, and teams can tune or opt out through cooldown configuration.

GitHub code scanning can now show AI-powered security detections directly on pull requests. The preview extends coverage beyond languages and frameworks supported by CodeQL, while requiring GitHub Code Security, a Copilot license, and AI credits.

A public issue carrying hostile instructions became the evidence HN needed for a sharper debate about agent permissions.

GitHub is moving Copilot CLI from one-off terminal help toward versioned team workflows. The new custom agents cover at least four repeated tasks: security audits, release notes, infrastructure reviews, and incident response.

Copilot now has its first selectable open-weight model. GitHub says Kimi K2.7 Code starts in VS Code for Pro tiers, with Business and Enterprise admins required to enable it by policy.

GitHub compared the Copilot agentic harness against native model harnesses on five task suites. With the model and task held fixed, it claims comparable task resolution and fewer tokens across most configurations.

GitHub Desktop 3.6 moves three agent-era Git chores into the client: worktrees, Copilot-written commits, and AI-assisted merge conflict review. The bigger shift is that Desktop now treats parallel branches and model choice as everyday developer controls.

GitHub added another enterprise model option to Copilot. Microsoft AI’s in-house coding model MAI-Code-1-Flash is now generally available for Copilot Business and Enterprise, with admin policy controls and usage-based billing.

Opus 4.6 fast is leaving GitHub Copilot on June 29, 2026. The sunset covers Copilot Chat, inline edits, ask and agent modes, and code completions, with Opus 4.8 fast listed as the replacement.

Security alerts are moving from volume to trust. GitHub says LLM-based contextual verification reduced secret-scanning false positives by 75.76%, beating its 65% target.

GitHub expanded the Copilot app technical preview to paid Copilot customers and put local and cloud sandboxes into public preview. The notable shift is not another chat feature: it is execution control for coding agents that can run commands, modify files, and open pull requests.