Security improvements for SSH

UpdateSep 22, 2026VerifiedAdded Sep 22, 2026

We’re removing several SSH algorithms, adding a new algorithm, and requiring larger RSA SSH keys to improve security. The changes are as follows: We’re removing the ability to use RSA keys using SHA-1 in SSH (i.e., the ssh-rsa signature type, including ssh-rsa-cert-v01@openssh.com certificates using SHA-1).

Security Regions

Read GitHub's release notes

https://github.blog/changelog/2026-09-22-security-improvements-for-ssh

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Advanced Security releases

GitHub Advanced SecuritySep 22, 2026

Deprecation notice: All-platform CodeQL bundle

Starting with CodeQL CLI 2.27.0 , the all-platform CodeQL bundle (i.e., codeql-bundle.tar.gz and codeql-bundle.tar.zst ), which includes the binaries for all supported platforms up to this release, is marked as deprecated. In mid-March 2027, we will remove the all-platform CodeQL bundle.

DeprecationObservabilityDeveloper toolsSource

GitHub Advanced SecuritySep 21, 2026

GitHub Enterprise adds credential inventory exports

Enterprise owners can now export a complete inventory of every credential that can access their enterprise (e.g., SSH keys, classic and fine-grained personal access tokens, OAuth App access tokens, and GitHub App user-to-server and installation tokens).

UpdateSecurityPricingObservabilitySource

GitHub Advanced SecuritySep 18, 2026

Manage the code coverage ruleset condition with the REST API

You can now use the generally available REST API to manage the Restrict code coverage repository ruleset option, in addition to the existing UI support. This ruleset lets you enforce a minimum code coverage percentage based on line coverage or set a maximum tolerable coverage drop for a pull request.

GAObservabilityDeveloper toolsSource

GitHub Advanced SecuritySep 18, 2026

Stage-only npm tokens for safer automation

You can now select Read and write (stage only) when creating an npm granular access token. This lets your automated workflows stage package versions for review without giving the token permission to publish new versions directly to the npm registry. Your workflow uses npm stage publish to submit a version.

UpdateGovernanceSecurityDeveloper toolsSource

GitHub Advanced SecuritySep 16, 2026

Code scanning AI Scan no longer requires CodeQL default setup

You can now use AI Scan for pull requests to find security vulnerabilities, even when CodeQL default setup isn’t enabled on a repository. Previously, AI Scan for pull requests only ran on repositories where CodeQL default setup was configured.

PreviewSecurityObservabilitySource

GitHub Advanced SecuritySep 15, 2026

Enforce GitHub Advanced Security configurations

Enterprise administrators can now enforce GitHub Advanced Security configurations across their organizations. This prevents both organization and repository administrators from overriding settings defined at the enterprise level, helping security and compliance teams apply consistent policies across their enterprise.

UpdateGovernanceSecurityObservabilitySource

GitHub Advanced SecuritySep 10, 2026

AI Scan for pull request APIs in public preview

You can now manage GitHub code scanning’s AI Scan for pull request enablement with REST API endpoints at the organization and repository levels. This public preview gives teams a programmatic way to roll out AI-powered security detections for pull requests across select repositories without manually configuring each setting in the GitHub UI.

PreviewSecurityObservabilityDeveloper toolsSource

GitHub Advanced SecuritySep 9, 2026

npm extends recovery-code security holds to all accounts

npm now places a temporary 72-hour security hold on any account after a successful recovery-code sign-in, extending a protection that previously applied only to high-impact accounts. This change applies to all npm accounts. During the hold, publishing and other security-sensitive writes, including creating access tokens, are paused.

UpdateSecurityObservabilitySource

Also shipped on Sep 22, 2026

Databricks LakeflowSep 22, 2026

Shopify connector (Beta)

The Shopify connector is now available in Lakeflow Connect in Beta . Workspace admins can control access to this feature from the Previews page. The connector ingests e-commerce data such as products, orders, customers, inventory, fulfillments, and discounts from Shopify into Databricks. Authentication uses the Shopify OAuth client credentials grant.

BetaSecurityData integrationSource

Databricks LakebaseSep 22, 2026

Lakebase backup schedule API (Beta)

You can now manage Lakebase backup schedules programmatically. The snapshot schedule API lets you read and set a root branch's automated snapshot cadences (daily, weekly, or monthly) and how long each cadence's snapshots are retained. This API is in Beta and available to all Lakebase workspaces. See Create a backup schedule .

BetaDeveloper toolsSource

AWS Amazon BedrockSep 22, 2026

OpenAI GPT-6 Sol and GPT-6 Luna are now generally available on Amazon Bedrock

Today, AWS announces the general availability of GPT-6 Sol and GPT-6 Luna from OpenAI on Amazon Bedrock. Expanding the GPT-6 family alongside Astra, these two models give teams more ways to balance intelligence, speed, and cost across every workload. Sol is the daily model for recurring complex tasks and software development.

GALLMsGovernanceSecuritySource

Anthropic Claude PlatformSep 22, 2026

Claude Opus 5.5 launches with a 1M token context window and 128k output

Anthropic released Claude Opus 5.5 for long-running agentic coding and knowledge work, with a default 1M token context, 128k max output and always-on adaptive thinking. It costs $4 / $20 per MTok, below Claude Opus 5, and is on the Claude API, Bedrock, Google Cloud and Microsoft Foundry.

GAAI agentsLLMsDeveloper toolsSource

Anthropic Claude PlatformSep 22, 2026

Fast mode research preview available for Claude Opus 5.5 on the Claude API

Fast mode, in research preview, can now be used with Claude Opus 5.5 on the Claude API.

PreviewLLMsDeveloper toolsSource

Anthropic Claude PlatformSep 22, 2026

Claude API beta lets tools be defined inside mid-conversation system messages

With the inline-tools-2026-09-15 beta header, a tool_addition block can carry a full tool definition, so agents can add tools, change schemas or upgrade server tools mid-conversation without invalidating the prompt cache. The same header covers adding and removing tools by reference.

BetaLLMsMCPData integrationSource