npm install-time security and GAT bypass2fa deprecation

DeprecationJul 8, 2026VerifiedAdded Sep 22, 2026

npm v12 is now generally available and tagged latest . This major release turns on the install-time security defaults we announced in June , and it’s also where we begin a deprecation of the most sensitive uses of 2FA-bypass granular access tokens (GATs).

Security

Read GitHub's release notes

https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecurityJul 8, 2026

Innersource security advisories are generally available

GitHub Advanced Security enterprise customers can now publish internal security advisories. Innersource advisories work similarly to GitHub’s open source advisories, but their visibility is restricted to repositories owned by the enterprise.

GASecurityObservabilityDeveloper toolsSource

GitHub Advanced SecurityJul 9, 2026

Organization-level targeting for GitHub Code Quality

Organization owners can now target a subset of repositories when enabling or disabling GitHub Code Quality, rather than applying it to every repository at once. This gives you more granular control on where you enable or disable Code Quality across your organization.

PreviewPricingObservabilitySource

GitHub Advanced SecurityJul 7, 2026

Secret scanning extended metadata and multipart validation

To help you understand ownership and impact of a leaked secret, GitHub secret scanning surfaces enriched metadata for supported secret types. Extended metadata checks are now generally available, including support for multipart validators with supplementary metadata. What’s new?

GASecurityDeveloper toolsPerformanceSource

GitHub Advanced SecurityJul 10, 2026

CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection

CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0 , which adds support for Kotlin 2.4.0, introduces a JavaScript and TypeScript query for system prompt injection, and improves analysis accuracy across multiple languages.

UpdateSQLStreamingSecuritySource

GitHub Advanced SecurityJul 10, 2026

Clearer names for secret scanning detector types

To make secret scanning easier to understand, we’re updating the names we use for our detector types to better reflect how each one finds secrets. This is a naming change only; detection behavior is exactly the same.

UpdateSecurityObservabilityDeveloper toolsSource

GitHub Advanced SecurityJul 13, 2026

Manage secret scanning custom patterns via REST API

Starting today, security teams can create, edit, and manage secret scanning custom patterns with the REST API. What’s new The following endpoints are generally available: GET .../secret-scanning/custom-patterns list patterns POST .../secret-scanning/custom-patterns create patterns PATCH .../secret-scanning/custom-patterns/{id} update patterns DELETE...

GASecurityObservabilityDeveloper toolsSource

GitHub Advanced SecurityJul 13, 2026

GitHub Code Quality license estimate in public preview

You can now see the number of active committers on repositories using GitHub Code Quality across your enterprise, giving you an estimate of your Code Quality license cost before it becomes a paid product on July 20, 2026. Code Quality is free during the public preview, so this usage isn’t billed today.

PreviewPricingDeveloper toolsCoding agentsSource

GitHub Advanced SecurityJul 14, 2026

Code scanning shows AI security detections on pull requests

GitHub code scanning now surfaces AI-powered security detections directly on pull requests, expanding vulnerability coverage to languages and frameworks not currently supported by CodeQL. These detections help teams identify and address potential issues in parts of the codebase that previously had no native scanning coverage, all before code is merged.

UpdateGovernanceSecuritySource

Also shipped on Jul 8, 2026

Databricks Databricks Data Intelligence PlatformJul 8, 2026

Object metadata column is now in Public Preview

The _object_metadata column is now in Public Preview. The _object_metadata column is a hidden metadata column that exposes object-level properties for objects in cloud storage, including MIME type, ETag, user-defined key-value metadata, system-defined metadata, and object tags. It is available starting from Databricks Runtime 18.1.

PreviewGovernanceSource

Databricks AI/BI and GenieJul 8, 2026

Genie products now use pay-as-you-go pricing

Starting July 8, 2026 at 00:00 UTC, Genie products, including Genie Agents , Genie Code , and Genie One , are billed following a pay-as-you-go pricing model that includes 150 Databricks units (DBUs) of free large language model (LLM) usage every month, equivalent to about $10.50 in the US East region.

PricingAI agentsLLMsPricingSource

Databricks Agent Bricks and Mosaic AIJul 8, 2026

Google Gemini 2.5 Flash and Pro are scheduled for retirement

Google Gemini 2.5 Flash and Gemini 2.5 Pro will be retired on October 2, 2026. The recommended replacement models are Gemini 3.1 Pro or Gemini 3.5 Flash. See Deprecated and retired models for migration guidance.

DeprecationLLMsSource

Databricks Agent Bricks and Mosaic AIJul 8, 2026

Anthropic Claude Sonnet 4 is scheduled for retirement

Anthropic Claude Sonnet 4 will be retired on October 9, 2026. Claude Sonnet 4.6 is the recommended replacement. See Deprecated and retired models for migration guidance.

DeprecationLLMsSource

Databricks Agent Bricks and Mosaic AIJul 8, 2026

Restrict access to AI Functions with Unity Catalog permissions (Public Preview)

You can now use Unity Catalog permissions to restrict which task-specific AI Functions your organization can access, independent of foundation model access. Contact your account team to enable this feature. See AI Functions Unity Catalog permissions .

PreviewGovernanceSecurityObservabilitySource

Databricks AI/BI and GenieJul 8, 2026

Genie Agents now uses pay-as-you-go pricing

Starting July 8, 2026 at 00:00 UTC, Genie Agents is billed following a pay-as-you-go pricing model that includes 150 DBUs of free large language model (LLM) usage every month, equivalent to about $10.50 in the US East region. Usage beyond the free amount is billed in DBUs, reflecting the underlying LLM models and agents that power each Genie Agents session.

PricingAI agentsLLMsPricingSource