CodeQL 2.26.1 improves analysis accuracy and framework coverage

UpdateJul 29, 2026VerifiedAdded Sep 22, 2026

CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1 , which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis.

SQL Security Observability Developer tools

Read GitHub's release notes

https://github.blog/changelog/2026-07-29-codeql-2-26-1-improves-analysis-accuracy-and-framework-coverage

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecurityJul 28, 2026

npm publish-time malware scanning and dual-use metadata

As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time . This changelog covers what publishers can expect and a new metadata requirement for dual-use content.

UpdateGovernanceSecurityObservabilitySource

GitHub Advanced SecurityJul 28, 2026

Dependabot alerts on malicious packages across more ecosystems

The GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, significantly expanding the breadth of malware data available to you through Dependabot alerts.

UpdateSecurityData integrationSource

GitHub Advanced SecurityJul 31, 2026

Restricting npm bypass-2FA granular access tokens

npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of the largest credential-based attack surfaces on the registry. This only impacts npm granular access tokens.

UpdateDeveloper toolsSource

GitHub Advanced SecurityAug 4, 2026

Customize code scanning default setup at scale

You can now apply your own configuration file to code scanning default setup, using the new github-codeql-config-file repository property. This gives you control over how CodeQL scans your code for security vulnerabilities, whether that’s on one repository or across your whole organization.

UpdateSecurityDeveloper toolsSource

GitHub Advanced SecurityAug 4, 2026

Customize Dependabot pull request branch names

You can now customize the branch names Dependabot creates for pull requests. New pull-request-branch-name options in .github/dependabot.yml let you set a prefix and maximum length, choose segment and word separators, set letter case, or define a custom template using placeholders.

UpdateObservabilitySource

GitHub Advanced SecurityAug 4, 2026

Code coverage automatic enablement in Code Quality settings

We’re making code coverage setup faster and simpler. You’ll now see a new option in your repository’s Code Quality settings that lets GitHub generate your coverage workflow automatically with AI. We’ll open a pull request so you can review the changes before you merge them. Setting up code coverage has traditionally felt disconnected and manual.

PreviewAI agentsSecurityData integrationSource

GitHub Advanced SecurityAug 4, 2026

CodeQL 2.26.2 adds Swift 6.3.3 and Kotlin 2.4.10 support

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.2, which adds support for Swift 6.3.3 and Kotlin 2.4.10, and improves the accuracy of path injection, URL redirection, and GitHub Actions queries.

UpdateSQLGovernanceSecuritySource

GitHub Advanced SecurityAug 7, 2026

Secret scanning coverage updates

This release expands secret scanning’s coverage with more secrets blocked by push protection, one new secret scanning partner, and richer metadata on alerts. Secret scanning partnership program Lovable Labs is now a GitHub secret scanning partner. Secret scanning now automatically detects the following new secret type in your repositories.

UpdateLLMsSecuritySource

Also shipped on Jul 29, 2026

Google Cloud BigQueryJul 29, 2026

BigQuery Data Transfer Service adds incremental Klaviyo transfers in preview

Klaviyo transfers to BigQuery can now load data incrementally instead of in full.

PreviewSQLSource

Snowflake SnowflakeJul 29, 2026

Data quality monitoring dashboard (Public preview)

The data quality monitoring dashboard is now available in public preview for Enterprise Edition accounts. The dashboard provides an account-wide view of data quality health in Snowsight.

PreviewGovernanceSecurityBISource

Databricks Agent Bricks and Mosaic AIJul 29, 2026

Upcoming general availability of Unity Gateway

Unity Gateway, the Databricks governance solution for enterprise AI, is scheduled for general availability soon. Built on Unity Catalog, Unity Gateway extends governance to the runtime interactions between models, agents, MCP servers, and tools.

GAAI agentsMCPGovernanceSource

Google Cloud Gemini EnterpriseJul 29, 2026

Gemini Enterprise: New data stores and support for new actions (Preview)

The following data stores are available in Public Preview: Compute Engine Egnyte Sourcegraph Tavily Additionally, support for new actions is available in Public Preview for the following data stores: AirOps : Suggest Brand Kit edits and write grid. Egnyte : Create comments, create folders, create links, and upload files. Google Stitch : Edit screens.

PreviewLLMsSource

Microsoft Microsoft FabricJul 29, 2026

[In preview] Public Preview: Azure Monitor Logs mirroring into Microsoft Fabric

This capability shares telemetry from Azure Monitor Log Analytics workspaces into Microsoft Fabric, making observability data available in OneLake as Delta Parquet, the open format, without duplication and with near real-time availability. All Azure Monit

PreviewStreamingData integrationObservabilitySource

Vercel Vercel platformJul 29, 2026

Sign in with ChatGPT is now available on Vercel

Sign in with ChatGPT adds your ChatGPT account as an authentication option for Vercel. It is available when adding the Vercel plugin to ChatGPT and when signing in to Vercel or v0. When you add the Vercel plugin to ChatGPT, you can easily sign in to Vercel and grant team and project permissions without leaving ChatGPT.

BetaSecurityObservabilitySource