Restricting npm bypass-2FA granular access tokens

UpdateJul 31, 2026VerifiedAdded Sep 22, 2026

npm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of the largest credential-based attack surfaces on the registry. This only impacts npm granular access tokens.

Developer tools

Read GitHub's release notes

https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecurityJul 29, 2026

CodeQL 2.26.1 improves analysis accuracy and framework coverage

CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.1 , which improves framework coverage for Go, Java/Kotlin, and JavaScript/TypeScript, and reduces false positives in Rust analysis.

UpdateSQLSecurityObservabilitySource

GitHub Advanced SecurityJul 28, 2026

npm publish-time malware scanning and dual-use metadata

As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time . This changelog covers what publishers can expect and a new metadata requirement for dual-use content.

UpdateGovernanceSecurityObservabilitySource

GitHub Advanced SecurityJul 28, 2026

Dependabot alerts on malicious packages across more ecosystems

The GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, significantly expanding the breadth of malware data available to you through Dependabot alerts.

UpdateSecurityData integrationSource

GitHub Advanced SecurityAug 4, 2026

Customize code scanning default setup at scale

You can now apply your own configuration file to code scanning default setup, using the new github-codeql-config-file repository property. This gives you control over how CodeQL scans your code for security vulnerabilities, whether that’s on one repository or across your whole organization.

UpdateSecurityDeveloper toolsSource

GitHub Advanced SecurityAug 4, 2026

Customize Dependabot pull request branch names

You can now customize the branch names Dependabot creates for pull requests. New pull-request-branch-name options in .github/dependabot.yml let you set a prefix and maximum length, choose segment and word separators, set letter case, or define a custom template using placeholders.

UpdateObservabilitySource

GitHub Advanced SecurityAug 4, 2026

Code coverage automatic enablement in Code Quality settings

We’re making code coverage setup faster and simpler. You’ll now see a new option in your repository’s Code Quality settings that lets GitHub generate your coverage workflow automatically with AI. We’ll open a pull request so you can review the changes before you merge them. Setting up code coverage has traditionally felt disconnected and manual.

PreviewAI agentsSecurityData integrationSource

GitHub Advanced SecurityAug 4, 2026

CodeQL 2.26.2 adds Swift 6.3.3 and Kotlin 2.4.10 support

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.2, which adds support for Swift 6.3.3 and Kotlin 2.4.10, and improves the accuracy of path injection, URL redirection, and GitHub Actions queries.

UpdateSQLGovernanceSecuritySource

GitHub Advanced SecurityAug 7, 2026

Secret scanning coverage updates

This release expands secret scanning’s coverage with more secrets blocked by push protection, one new secret scanning partner, and richer metadata on alerts. Secret scanning partnership program Lovable Labs is now a GitHub secret scanning partner. Secret scanning now automatically detects the following new secret type in your repositories.

UpdateLLMsSecuritySource

Also shipped on Jul 31, 2026

Databricks Databricks Data Intelligence PlatformJul 31, 2026

Web terminal on serverless GPU compute (AI Runtime) is in Public Preview

The web terminal in notebooks connected to serverless GPU compute (AI Runtime) is now in Public Preview . Use it to run shell commands, monitor GPU usage with nvidia-smi , install libraries, and manage files directly on the compute. This requires serverless GPU environment version 5 or above. See Run shell commands in Databricks web terminal .

PreviewNotebooksObservabilitySource

Databricks Unity CatalogJul 31, 2026

Packaged clean rooms are now generally available

Packaged clean rooms are now generally available. In a packaged clean room, a provider supplies notebooks, JARs, and data that a consumer runs against their own data without seeing the provider's code or data assets. See Packaged clean rooms .

GANotebooksSource

Databricks LakeflowJul 31, 2026

OpenAI connector (Beta)

The OpenAI connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector uses the OpenAI Organization Admin API to ingest organization administration data, such as users, projects, API keys, usage, costs, and audit logs, from OpenAI into Databricks.

BetaPricingData integrationObservabilitySource

Microsoft Azure databases and analyticsJul 31, 2026

[In preview] Public Preview: Azure SQL updates for late-July

In late-July 2026, the following update and enhancement was made to Azure SQL: Regex-based dynamic data masking (DDM) extends the built-in DDM feature with pattern‑based masking to hide sensitive data like emails, phone numbers, and identifiers, centrally

PreviewSQLGovernanceDeveloper toolsSource

Vercel AI SDK and AI GatewayJul 31, 2026

DeepSeek V4 Flash now runs updated weights on AI Gateway

DeepSeek V4 Flash now runs on updated weights by default on AI Gateway, with notably stronger agentic capabilities. On Terminal-Bench, it scores 82.7, up 25.8 points from 56.9 in the April preview. Requests to deepseek/deepseek-v4-flash pick up the new weights automatically, with no change to the model ID or your code.

PreviewAI agentsPricingDeveloper toolsSource

Vercel AI SDK and AI GatewayJul 31, 2026

Expanded search for workflow runs in Vercel Observability

The runs list for Vercel Workflows in Observability now has structured search, giving you more ways to find and investigate runs. Structured filters: Filter runs by workflow, environment, deployment ID, region , or any custom run attribute. Paste a run ID to pull up that exact run.

PreviewSQLObservabilityRegionsSource