Dependabot no longer infers .npmrc

UpdateJun 30, 2026VerifiedAdded Sep 22, 2026

Dependabot will no longer attempt to infer .npmrc configuration for npm private registries. Previously, Dependabot tried to reconstruct .npmrc contents from lockfile resolved URLs, but incorrect lockfile URLs, lockfile format differences across npm, Yarn v1, Yarn Berry, and pnpm, and other edge cases regularly caused registry authentication failures.

Observability

Read GitHub's release notes

https://github.blog/changelog/2026-06-30-dependabot-no-longer-infers-npmrc

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecurityJun 30, 2026

GitHub code coverage merge protection for pull requests

You can now use branch rulesets to block pull requests from merging when test coverage drops below thresholds you set. You can set a minimum coverage percentage, a maximum allowed drop from the default branch, or both. You can start in evaluate mode to understand impact first, then switch to active mode when you’re ready to enforce merge protection.

PreviewObservabilitySource

GitHub Advanced SecurityJun 30, 2026

Open source license compliance is in public preview

Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is in public preview, letting you block noncompliant dependencies before they reach production.

PreviewGovernanceDeveloper toolsSource

GitHub Advanced SecurityJun 30, 2026

Upcoming cloud data retention policy for closed security alerts

Starting September 25, 2026, GitHub will introduce a data retention policy for closed Dependabot security alerts. This policy gives you a clear commitment for how long your alert data stays accessible and where you can find it. It applies to Dependabot security alerts on github.com, including GitHub Enterprise Cloud (GHEC).

UpdateGovernanceSecurityDeveloper toolsSource

GitHub Advanced SecurityJun 30, 2026

Upcoming access restrictions to public API endpoints and UI views

As part of our ongoing commitment to protect our users and ensure responsible use of our platform, the Notifications team will soon introduce access restrictions to several public API endpoints and related UI views.

UpdateSecurityDeveloper toolsSource

GitHub Advanced SecurityJul 1, 2026

Secret scanning adds validators for Asana, IBM, and MessageBird

Secret scanning now runs validity checks on Asana, IBM, and MessageBird secrets so you can tell whether a leaked credential is still active. Validity checks added These patterns now support validity checks.

UpdateSecurityObservabilitySource

GitHub Advanced SecurityJul 2, 2026

Secret scanning public monitoring for enterprises

GitHub is committed to empowering the developer community by helping organizations recognize and address the risks of secret leaks wherever they happen. We believe every enterprise should know the moment its secrets leak in public, no matter where it happens on GitHub.

PreviewSecurityPricingObservabilitySource

GitHub Advanced SecurityJun 25, 2026

npm adds preventive account protection for high-impact accounts

npm now adds a temporary, preventive safeguard for high-impact accounts , those responsible for the registry’s most widely used packages, whenever it detects a sensitive account change, strengthening protection against account-takeover attacks.

UpdateVector searchSecurityObservabilitySource

GitHub Advanced SecurityJun 24, 2026

Self-service credential revocation for incident response

For a timely response to security incidents involving compromised accounts or stolen credentials, GitHub Enterprise owners can now use new “break-glass” capabilities to instantly revoke all credentials for a given user. This builds on the enterprise-wide credential management tools for incident response released earlier.

UpdateSecurityDeveloper toolsSource

Also shipped on Jun 30, 2026

Snowflake SnowflakeJun 30, 2026

Analytical search (Public Preview)

Analytical search, an orchestration capability in Cortex Agents that enables analytical queries over large document collections, is now in Public Preview. Traditional retrieval-augmented generation (RAG) approaches retrieve a small number of passages, which limits their ability to answer questions requiring comprehensive analysis, such as counts...

PreviewAI agentsVector searchSource

Databricks Databricks SQLJun 30, 2026

MATCH_RECOGNIZE is now in Beta

Databricks SQL and Databricks Runtime now support the SQL:2016 MATCH_RECOGNIZE clause for row pattern recognition. Enable the Match Recognize preview in workspace preview settings . See MATCH_RECOGNIZE clause .

BetaSQLSource

Databricks Databricks SQLJun 30, 2026

Lakehouse Real-Time (Beta)

Lakehouse Real-Time (Lakehouse//RT) is now in Beta . Lakehouse//RT is a serverless SQL warehouse type built for low-latency, high-concurrency workloads, delivering sub-second SQL read queries against Unity Catalog tables.

BetaSQLStreamingGovernanceSource

Google Cloud Gemini APIJun 30, 2026

Gemini Omni Flash in public preview

Released gemini-omni-flash-preview, a high-performance multimodal model designed for high-speed video generation and conversational video editing. Using the Interactions API, you can generate 3--10 second videos at 720p from text descriptions or animate still images, and then conversationally edit and refine the outputs.

PreviewLLMsDeveloper toolsPerformanceSource

Google Cloud Gemini APIJun 30, 2026

Gemini 3.1 Flash Lite Image (Nano Banana 2 Lite) is generally available

gemini-3.1-flash-lite-image is a multimodal model optimized for ultra-low latency, cost-effective image generation and editing, now GA in the Gemini API.

GALLMsPricingDeveloper toolsSource

Microsoft Microsoft FoundryJun 30, 2026

[Launched] Generally Available: Toolboxes in Microsoft Foundry

Microsoft Foundry brings Toolboxes to GA, providing a unified endpoint to invoke the most-used tools in prompt agents and callable outside of prompt agents. Today every agent team hand-assembles its own tool list to solve the same tasks, with no shared ar

GAAI agentsDeveloper toolsSource