Block pull requests with exposed secrets from merging

PreviewSep 9, 2026VerifiedAdded Sep 22, 2026

Repository rulesets allow you to easily add scalable protections across your repositories. Starting today, you can use repository rulesets to block pull requests from merging when the pull request introduces secret scanning alerts. What’s new You can enable the new rule require secret scanning alerts are resolved on pull requests for selected repositories.

Security

Read GitHub's release notes

https://github.blog/changelog/2026-09-09-block-pull-requests-with-exposed-secrets-from-merging

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecuritySep 9, 2026

npm extends recovery-code security holds to all accounts

npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.

UpdateSecurityObservabilitySource

GitHub Advanced SecuritySep 9, 2026

CodeQL 2.27.0 adds support for Linux ARM64

CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.

UpdateSQLSecurityDeveloper toolsSource

GitHub Advanced SecuritySep 9, 2026

GitHub Advanced Security expands trial availability

More GitHub Enterprise Cloud customers can now start a self-serve GitHub Advanced Security trial to evaluate GitHub Code Security and GitHub Secret Protection. Eligibility has expanded from enterprises with up to 100 licenses to enterprises with up to 300 licenses.

UpdateSecurityPricingObservabilitySource

GitHub Advanced SecuritySep 9, 2026

Remediate Code Quality findings with agentic autofix

Agentic autofix is now available to help you burn down findings in your code quality backlog. You can select up to 25 standard findings on a page and assign the whole set to Copilot in one action. Copilot starts fixing them agentically on a branch, validates its own changes, then opens a pull request for you to review and merge.

UpdateAI agentsGovernancePricingSource

GitHub Advanced SecuritySep 10, 2026

AI Scan for pull request APIs in public preview

You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI.

PreviewSecurityObservabilityDeveloper toolsSource

GitHub Advanced SecuritySep 8, 2026

Automatic Dependabot access to GitHub-hosted registries

Dependabot can now read from private GitHub Packages registries without a personal access token. If a package has granted your repository access through “Manage Actions access” in the package settings, Dependabot reuses that grant.

UpdateDeveloper toolsSource

GitHub Advanced SecuritySep 15, 2026

Enforce GitHub Advanced Security configurations

Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.

UpdateGovernanceSecurityObservabilitySource

GitHub Advanced SecuritySep 3, 2026

Multiple trusted publishing configurations for npm

We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback. Three updates to npm publishing are now generally available: Multiple trusted publishing configurations per package Staged packages can only be approved after malware scanning is complete Maintainers can see their staged history in the package versions...

GASource

Also shipped on Sep 9, 2026

Databricks Databricks Data Intelligence PlatformSep 9, 2026

Configurable retention for system tables is in Beta

Account admins can now set an account-wide retention period from 30 to 3,650 days for supported system tables. See Configure system table data retention .

BetaDeveloper toolsSource

Databricks Unity CatalogSep 9, 2026

External secrets in Unity Catalog (Beta)

External secrets connect a Unity Catalog schema to AWS Secrets Manager. The secrets appear in Unity Catalog as read-only securable objects that you govern with Unity Catalog privileges. Databricks reads their values from AWS Secrets Manager on demand. See External secrets in Unity Catalog .

BetaGovernanceSecurityObservabilitySource

Databricks LakeflowSep 9, 2026

Celigo connector (Beta)

The Celigo connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests audit log events, such as create, update, and delete operations on resources, from Celigo (integrator.io) into Databricks. Authentication uses a Celigo integrator.io API token.

BetaData integrationObservabilityDeveloper toolsSource

Databricks LakeflowSep 9, 2026

Anysphere Organization connector (Beta)

The Anysphere Organization connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector uses the Anysphere (Cursor) Organization Admin API to ingest organization members, groups, and group members into Databricks as daily snapshots.

BetaData integrationDeveloper toolsCoding agentsSource

Databricks LakeflowSep 9, 2026

Anaplan connector (Beta)

The Anaplan connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests audit trail events and user account records from your Anaplan tenant into Databricks. Authentication uses an Anaplan CA certificate and its paired private key. See Anaplan connector .

BetaPricingData integrationSource

Snowflake Snowflake OpenflowSep 9, 2026

Openflow gen 1 deployment creation retired

You can no longer create new first generation (gen 1) Openflow deployments (BYOC or Snowflake). All new deployments are second generation (gen 2), created with CREATE OPENFLOW DEPLOYMENT or the Openflow UI. Existing gen 1 deployments continue to work unchanged, and you can still create new gen 1 runtimes on an existing gen 1 deployment.

DeprecationData integrationSource