npm publish-time malware scanning and dual-use metadata

UpdateJul 28, 2026VerifiedAdded Sep 22, 2026

As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time . This changelog covers what publishers can expect and a new metadata requirement for dual-use content.

Governance Security Observability

Read GitHub's release notes

https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecurityJul 28, 2026

Dependabot alerts on malicious packages across more ecosystems

The GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, significantly expanding the breadth of malware data available to you through Dependabot alerts.

UpdateSecurityData integrationSource

GitHub Advanced SecurityJul 29, 2026

CodeQL 2.26.1 improves analysis accuracy and framework coverage

CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1 , which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis.

UpdateSQLSecurityObservabilitySource

GitHub Advanced SecurityJul 31, 2026

Restricting npm bypass-2FA granular access tokens

npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of the largest credential-based attack surfaces on the registry. This only impacts npm granular access tokens.

UpdateDeveloper toolsSource

GitHub Advanced SecurityAug 4, 2026

Customize code scanning default setup at scale

You can now apply your own configuration file to code scanning default setup, using the new github-codeql-config-file repository property. This gives you control over how CodeQL scans your code for security vulnerabilities, whether that’s on one repository or across your whole organization.

UpdateSecurityDeveloper toolsSource

GitHub Advanced SecurityAug 4, 2026

Customize Dependabot pull request branch names

You can now customize the branch names Dependabot creates for pull requests. New pull-request-branch-name options in .github/dependabot.yml let you set a prefix and maximum length, choose segment and word separators, set letter case, or define a custom template using placeholders.

UpdateObservabilitySource

GitHub Advanced SecurityAug 4, 2026

Code coverage automatic enablement in Code Quality settings

We’re making code coverage setup faster and simpler. You’ll now see a new option in your repository’s Code Quality settings that lets GitHub generate your coverage workflow automatically with AI. We’ll open a pull request so you can review the changes before you merge them. Setting up code coverage has traditionally felt disconnected and manual.

PreviewAI agentsSecurityData integrationSource

GitHub Advanced SecurityAug 4, 2026

CodeQL 2.26.2 adds Swift 6.3.3 and Kotlin 2.4.10 support

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.2, which adds support for Swift 6.3.3 and Kotlin 2.4.10, and improves the accuracy of path injection, URL redirection, and GitHub Actions queries.

UpdateSQLGovernanceSecuritySource

GitHub Advanced SecurityJul 20, 2026

GitHub Code Quality is now generally available

GitHub Code Quality is now generally available on GitHub Enterprise Cloud and GitHub Team. It solves an emerging challenge for software development: AI accelerates code output, and Code Quality helps teams ship code they trust.

GASecurityPricingBISource

Also shipped on Jul 28, 2026

Snowflake SnowflakeJul 28, 2026

AI code suggestions in Workspaces (General availability)

AI code suggestions in Cortex Code are now generally available. This release also includes updated keybindings and bug fixes. Notebook Python cells , no changes to keybindings.

GANotebooksCoding agentsSource

Snowflake Snowflake Native Apps and MarketplaceJul 28, 2026

Snowflake Native Apps support for Virtual Private Snowflake on AWS for apps with containers (General availability)

Snowflake Native App with Snowpark Container Services now support Virtual Private Snowflake (VPS) on Amazon Web Services. Apps with containers can be distributed to Snowflake customers in VPS deployments. Apps running in VPS can use the functionality of Snowpark Container Services, including compute pools, services, jobs, and external access integrations.

GASource

Databricks Unity CatalogJul 28, 2026

Python UDTFs in Unity Catalog are now generally available

Registering Python user-defined table functions (UDTFs) in Unity Catalog is now generally available in Databricks Runtime 18. A Unity Catalog Python UDTF is a governed function that returns a table, invoked in the FROM clause of a SQL statement to return multiple rows and columns.

GASQLGovernanceObservabilitySource

Google Cloud AlloyDBJul 28, 2026

Note: IAM group authentication is available in Preview for new AlloyDB clusters

Note: IAM group authentication is available in Preview for new AlloyDB clusters. To enable this feature on an existing cluster, contact your Google Cloud account team. IAM group authentication for AlloyDB is available in Preview for new clusters running PostgreSQL 15 and later.

PreviewSecurityPostgresSource

Vercel Vercel platformJul 28, 2026

Vercel Connect now supports Custom Environments

Vercel Connect now lets you link a connector to a Custom Environment so deployments there can request provider tokens and receive forwarded webhooks. Custom Environments appear alongside Production, Preview, and Development when you add or edit a project on a connector in the dashboard.

PreviewPricingData integrationBISource

Palantir Foundry and AIPJul 28, 2026

AIP Document Intelligence: deploy extraction strategies as Python functions (GA)

Deploying extraction strategies to Python functions is generally available in AIP Document Intelligence, as an alternative to running a strategy in a batch pipeline.

GAData integrationSource