Enforce GitHub Advanced Security configurations

UpdateSep 15, 2026VerifiedAdded Sep 22, 2026

Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.

Governance Security Observability

Read GitHub's release notes

https://github.blog/changelog/2026-09-15-enforce-github-advanced-security-configurations

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecuritySep 16, 2026

Code scanning AI Scan no longer requires CodeQL default setup

You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.

PreviewSecurityObservabilitySource

GitHub Advanced SecuritySep 18, 2026

Manage the code coverage ruleset condition with the REST API

You can now use the generally available REST API to manage the Restrict code coverage repository ruleset option, in addition to the existing UI support. This ruleset lets you enforce a minimum code coverage percentage based on line coverage or set a maximum tolerable coverage drop for a pull request.

GAObservabilityDeveloper toolsSource

GitHub Advanced SecuritySep 18, 2026

Stage-only npm tokens for safer automation

You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token permission to publish new versions directly to the npm registry. Your workflow uses npm stage publish to submit a version.

UpdateGovernanceSecurityDeveloper toolsSource

GitHub Advanced SecuritySep 10, 2026

AI Scan for pull request APIs in public preview

You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI.

PreviewSecurityObservabilityDeveloper toolsSource

GitHub Advanced SecuritySep 21, 2026

GitHub Enterprise adds credential inventory exports

Enterprise owners can now export a complete inventory of every credential that can access their enterprise (e.g., SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens).

UpdateSecurityPricingObservabilitySource

GitHub Advanced SecuritySep 9, 2026

npm extends recovery-code security holds to all accounts

npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.

UpdateSecurityObservabilitySource

GitHub Advanced SecuritySep 9, 2026

CodeQL 2.27.0 adds support for Linux ARM64

CodeQL 2.27.0 is now available on Linux ARM64, adds a new Rust security query, expanded framework coverage for Java/Kotlin and C#, and analysis accuracy improvements across multiple languages. CodeQL is the static analysis engine behind GitHub code scanning, which helps you find and remediate security issues in your code.

UpdateSQLSecurityDeveloper toolsSource

GitHub Advanced SecuritySep 9, 2026

GitHub Advanced Security expands trial availability

More GitHub Enterprise Cloud customers can now start a self-serve GitHub Advanced Security trial to evaluate GitHub Code Security and GitHub Secret Protection. Eligibility has expanded from enterprises with up to 100 licenses to enterprises with up to 300 licenses.

UpdateSecurityPricingObservabilitySource

Also shipped on Sep 15, 2026

Snowflake SnowflakeSep 15, 2026

Predict dynamic table refresh behavior with EXPLAIN CHANGES (General availability)

You can now use EXPLAIN CHANGES to predict a dynamic table's refresh behavior before it happens, either for a manual refresh or as part of a DDL change, without applying the change.

GASource

Snowflake Snowflake Horizon CatalogSep 15, 2026

Horizon Catalog Explorer UI (Preview)

With this release, the Horizon Catalog Explorer is the default experience for browsing Snowflake objects in Snowsight, replacing Database Explorer. The Horizon Catalog Explorer provides consistent navigation and object detail pages while preserving the tabs and actions that you already use.

PreviewGovernanceObservabilitySource

Snowflake Snowflake Cortex AISep 15, 2026

Embedding Streamlit in Snowflake apps in external pages (General availability)

Embedding Streamlit in Snowflake apps in external pages is now generally available. You can render a container-runtime app inside a page you host, such as a customer portal or an internal dashboard, using a single tag.

GAVector searchStreamingGovernanceSource

Snowflake SnowflakeSep 15, 2026

Elastic Channels for Snowpipe Streaming (General availability)

Elastic Channels for Snowpipe Streaming are now generally available. Elastic Channels provide one implicit, server-scaled ingestion path per pipe, so concurrent producers can stream directly to Snowflake tables and supported Snowflake-managed Iceberg tables without managing channel names, lifecycle, ordering, or offset tokens.

GAStreamingData integrationApache IcebergSource

Databricks Databricks AppsSep 15, 2026

Webhook-triggered deployments for Databricks Apps will soon be generally available

Starting in October 2026, webhook-triggered deployments for Databricks Apps will be generally available. Automatically deploy your app when changes are pushed to a connected GitHub or Azure DevOps repository, so your deployed app stays in sync with your repository without manual redeployment. See Deploy a Databricks app .

GASource

Databricks Unity CatalogSep 15, 2026

Sharing foreign Delta tables with OpenSharing is now generally available

Sharing and reading foreign Delta tables with OpenSharing is now generally available. Providers can share Delta-format tables federated from OneLake, a Hive metastore, or AWS Glue, without copying data into Databricks. See Add foreign Delta tables to a share .

GASource