Block users directly from security advisories

UpdateAug 25, 2026VerifiedAdded Sep 22, 2026

You can now block a user directly from a security advisory page in public repositories owned by either an organization or a personal account. This brings the streamlined moderation experience available for issues and pull requests to security advisories.

Streaming Security Observability

Read GitHub's release notes

https://github.blog/changelog/2026-08-25-block-users-directly-from-security-advisories

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecurityAug 20, 2026

Code scanning adds a mitigated alert dismissal reason

You can now dismiss a code scanning alert with the reason Mitigated when a vulnerability remains in the code but external controls, such as a web application firewall or network policy, mitigate its risk.

UpdateGovernanceSecurityObservabilitySource

GitHub Advanced SecurityAug 20, 2026

Track GitHub Code Quality enablement changes in the audit log

GitHub Code Quality now writes an audit log event whenever someone enables, disables, or changes its settings on a repository. Three new events give you that history: repo.code_quality_enabled records when someone turns on Code Quality for a repository. repo.code_quality_disabled records when someone turns it off.

UpdateSQLPricingObservabilitySource

GitHub Advanced SecurityAug 19, 2026

Track organization code quality trends

The organization-level Code Quality dashboard now includes a Trends tab that shows how code quality has changed across your repositories over time. Instead of a point-in-time snapshot, you can see whether open findings are trending up or down and which repositories are driving the change.

GAPricingBIObservabilitySource

GitHub Advanced SecurityAug 18, 2026

Credential revocation and deauthorization by token type

Building on our self-service credential revocation experiences for incident response, you can now take token-type and user-specific actions to deauthorize and revoke user credentials during a security incident. This gives you finer-grained control when responding to a compromise.

UpdateSecurityDeveloper toolsSource

GitHub Advanced SecuritySep 3, 2026

Multiple trusted publishing configurations for npm

We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback. Three updates to npm publishing are now generally available: Multiple trusted publishing configurations per package Staged packages can only be approved after malware scanning is complete Maintainers can see their staged history in the package versions...

GASource

GitHub Advanced SecurityAug 13, 2026

License data quality improvements

GitHub now uses package registries like npmjs.org and PyPI to determine license information for software components in the dependency graph. This improves the accuracy and completeness of the licenses shown in dependency insights, software bills of materials (SBOMs), the open source license compliance feature in GitHub Advanced Security, and the dependency...

UpdateGovernanceSecuritySource

GitHub Advanced SecuritySep 8, 2026

Automatic Dependabot access to GitHub-hosted registries

Dependabot can now read from private GitHub Packages registries without a personal access token. If a package has granted your repository access through “Manage Actions access” in the package settings, Dependabot reuses that grant.

UpdateDeveloper toolsSource

GitHub Advanced SecuritySep 9, 2026

npm extends recovery-code security holds to all accounts

npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.

UpdateSecurityObservabilitySource

Also shipped on Aug 25, 2026

Google Cloud BigQueryAug 25, 2026

BigQuery data governance tags are supported in Terraform

BigQuery data governance tags are supported in Terraform. This feature is in Preview .

PreviewSQLGovernanceDeveloper toolsSource

Snowflake Snowflake Horizon CatalogAug 25, 2026

Multi-value tags (General availability)

With this release, multi-value tags are generally available. You can assign more than one string value to the same tag.

GAGovernanceSource

Snowflake Snowflake Native Apps and MarketplaceAug 25, 2026

Remote app operations for Snowflake Native Apps (Preview)

Remote app operations are now available in public preview for Snowflake Native Apps. Providers can perform on-demand operations on consumer apps, including running SQL statements ( run_sql ), retrying a failed upgrade ( retry_upgrade ), and disabling/enabling the app ( disable / enable ), all through a new system function SYSTEM$REMOTE_APP_OPERATION .

PreviewSQLSource

Snowflake SnowflakeAug 25, 2026

Remote Development with the Snowflake Extension for Visual Studio Code (Preview)

Remote Development with the Snowflake Extension for Visual Studio Code is now available in public preview.

PreviewSource

Snowflake SnowflakeAug 25, 2026

Stable egress IP addresses on Azure (Preview)

Stable egress IP addresses are now available in preview on Azure. You can generate Snowflake egress IP address ranges (as CIDR addresses) and add them to an external server's allowlist so that Snowflake can make requests to that server.

PreviewSource

Databricks LakebaseAug 25, 2026

LTAP Direct Writes accelerates synced table loads (Beta)

LTAP Direct Writes speeds up how synced tables load into Lakebase. When you create a synced table, Lakebase loads a full copy of your Unity Catalog data into your Postgres branch.

BetaGovernancePostgresObservabilitySource