More control over your GitHub-hosted runners

UpdateJun 25, 2026VerifiedAdded Sep 22, 2026

Organizations now have more control over who can use GitHub-hosted runners in Actions. Admins can now disable the standard labels for hosted runners such as ubuntu-latest , as well as add macOS runners to runner groups.

Governance Security Pricing Observability

Read GitHub's release notes

https://github.blog/changelog/2026-06-25-more-control-over-your-github-hosted-runners

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Actions releases

GitHub ActionsJun 25, 2026

Actions steps can now be run in parallel

GitHub Actions now supports running steps concurrently using background . Previously, all steps in a workflow ran in sequence, with each step starting only after the previous step completed. Previously, you could run steps in a non-blocking way using shell backgrounding ( & ), but that often interleaved logs from multiple steps.

UpdateObservabilityDeveloper toolsSource

GitHub ActionsJun 25, 2026

Red Hat Enterprise Linux runner images are now in public preview

GitHub-hosted larger runners now support Red Hat Enterprise Linux (RHEL) 9 and RHEL 10 images in public preview, introduced in partnership with Red Hat. Organizations can use these RHEL images as the foundation for custom images that include required tools, dependencies, and configurations.

PreviewObservabilityDeveloper toolsSource

GitHub ActionsJun 26, 2026

Read-only Actions cache for untrusted triggers

GitHub Actions now issues read-only cache tokens to the default branch for workflow events that can be triggered without write permissions to the repository. This applies least privilege to the cache and prevents common privilege-escalation paths through cache poisoning.

UpdateSecurityDeveloper toolsSource

GitHub ActionsJul 8, 2026

setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes

The actions/setup-java v5.5.0 release adds cryptographic signature verification for downloaded JDKs, support for a new distribution, and several quality-of-life improvements for Maven users. Here’s what changed since v5.4.0.

UpdateObservabilitySource

GitHub ActionsJul 16, 2026

Xcode 27 runner image now in public preview

You can now build and test your Apple applications against Xcode 27 on GitHub-hosted macOS runners. This is now available in public preview. With early access to the latest Xcode toolchain and Apple SDKs, you can validate your apps against the newest tools, catch compatibility issues sooner, and keep your CI/CD pipelines current.

PreviewData integrationObservabilityDeveloper toolsSource

GitHub ActionsJul 28, 2026

GitHub Actions holds potentially malicious workflows for approval

Recent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these attacks, GitHub Actions now holds certain workflow runs for approval before they start.

UpdateObservabilityDeveloper toolsSource

GitHub ActionsJul 30, 2026

Reference same-repository actions with self-repository syntax

You can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your workflow’s own repository at the exact commit that is running, with no checkout required.

UpdateGovernanceObservabilityDeveloper toolsSource

GitHub ActionsAug 19, 2026

CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling

CodeQL 2.26.3 adds JavaScript, TypeScript, and Vue source modeling and improves the accuracy of several GitHub Actions queries. CodeQL is the static analysis engine behind GitHub code scanning , which helps you find and remediate security issues in your code.

UpdateSQLSecurityDeveloper toolsSource

Also shipped on Jun 25, 2026

Databricks AI/BI and GenieJun 25, 2026

Genie One enhancements

- Share chats with account users : You can now share Genie One chats with all users in your account as read-only. See Share a chat . New external source connections (Beta) : Chat in Genie One now supports connecting to Gmail and additional Microsoft 365 apps (Teams, Outlook, and Calendar). See Connect to external tools and sources .

BetaBISource

Anthropic Claude PlatformJun 25, 2026

Fast mode for Claude Opus 4.7 deprecated, removal on July 24, 2026

After July 24, 2026, requests to claude-opus-4-7 with speed fast will return an error. Anthropic recommends migrating to fast mode on Claude Opus 4.8.

DeprecationLLMsSource

Starburst Starburst GalaxyJun 25, 2026

Smart load balancing for deployment set routing is generally available

Smart load balancing, a routing mechanism available with deployment set routing, is now generally available in Starburst Galaxy.

GASource

Palantir Foundry and AIPJun 25, 2026

Palantir MCP is generally available

Beginning the week of June 22, Palantir MCP is available across all Foundry enrollments. It enables AI IDEs and agents to design, build, edit, and review end-to-end applications within the Palantir platform.

GAAI agentsMCPSource

Palantir Foundry and AIPJun 25, 2026

Ontology MCP is generally available

Ontology MCP is generally available across all Foundry enrollments. It exposes an application's Ontology resources (object types, action types, and functions) as MCP tools for MCP-compatible agents.

GAAI agentsMCPSource

Confluent Confluent CloudJun 25, 2026

Flink UDF external connectivity generally available

UDFs can call external systems such as REST APIs through Connection objects bound with USING CONNECTIONS. Public endpoints on AWS, Azure, Google Cloud; private endpoints on AWS only.

GAStreamingSource