Copilot gets a service identity
October 27, 2026 · public preview
GitHub Apps can call Copilot on behalf of an organization without an individual employee’s credentials. The app needs an organization and Copilot Requests permission; it uses short-lived installation tokens. Costs and model policies belong to the organization, a useful separation for services that must keep running when personnel change.
Source: github.blogAssisted permissions become generally available
October 26, 2026
In the CLI, Copilot app, and VS Code, a model assesses requests to run commands, access files, and open URLs. Actions judged clearly safe proceed automatically; others require a human decision. This concerns approval of individual operations and does not guarantee the safety of an arbitrary agent workflow.
Source: github.blogCopilot metrics see OpenCode and other clients
October 23, 2026
The usage metrics API now shows model use in third-party clients, including OpenCode. The totals_by_client array reports the tool, request count, and tokens; a separate breakdown covers models and how they were selected. It helps reveal work beyond a single editor.
Source: github.blogTurn a Teams notification into a Copilot task
October 23, 2026
The updated GitHub app for Teams combines notifications and Copilot interactions. After receiving an update in a channel, group, or personal chat, users can mention GitHub and continue work from the conversation. Users of the previous GitHub notifications app are prompted to update; existing notifications remain.
Source: github.blogGitHub explains accidental managed account deletion
Analysis published October 23, 2026 · incident June 1–13
In June, some Enterprise Managed Users were deleted after SCIM deactivation instead of being suspended and anonymized as expected. Ghost users consequently appeared in issues, pull requests, and the audit log. The account lifecycle analysis was published in October but describes an earlier incident.
Source: github.blogPublic monitoring gains investigation tools
October 23, 2026
Monitoring of publicly exposed secrets gained alert management and automatic validity checks. On the enterprise dashboard, findings can be closed and reopened with an explanation of the decision. API and webhooks allow these signals to enter an organization’s own response queue.
Source: github.blogGitHub Apps can be installed on an enterprise
October 23, 2026 · generally available
Enterprise-level GitHub App installations became generally available along with additional administrative APIs. Areas include repository policies, rulesets, and bypass requests. This expands the automation scenarios where a separate app can replace a classic personal token.
Source: github.blogCustom skills no longer disappear into other
October 22, 2026
Usage metrics now include names of team-configured skills, agents, MCP servers, slash commands, and plugins. Each list’s limit rose from five entries to 25; remaining activity is grouped into other. The report helps show which internal tools are actually used.
Source: github.blogDefault Copilot policy applies to new features
October 22–26, 2026 · gradual rollout
GitHub began applying the global default policy to eligible Copilot features without their own setting. The rollout continued gradually through October 26. Administrators should review both individual switches and Default policy for new features in AI Controls.
Source: github.blogActions adds storage addresses to the Meta API
October 22, 2026
GitHub is expanding blob storage for Actions, and the Meta API now returns additional addresses. Organizations with network allowlists should check the announcement to avoid losing job logs and summaries. No separate change is needed if productionresultssa*.blob.core.windows.net is already allowed.
Source: github.blogDiff view remembers whitespace preferences
October 22, 2026
In pull requests, users can save a personal preference to always show whitespace changes, hide them, or hide them only in the current diff. An active filter allows whitespace to be shown temporarily without changing the setting. In split view, new and deleted files occupy both columns, reducing unnecessary wrapping.
Source: github.blogImpact dashboard adds industry comparisons
October 22, 2026 · opt-in
Enterprises and independent organizations can compare their use of Copilot agent features with aggregated figures from other participants. Groups are selected by company size and industry; a small group is broadened. Participation is off by default, and team figures do not prove the tool caused an effect.
Source: github.blogGitHub CLI tests automatically refreshed tokens
October 21, 2026 · public preview
From gh 2.103.0, users can choose expiring OAuth credentials: the CLI stores an access token and a refresh token that can be renewed. Daily commands continue without manually signing in at every expiry. The official instructions separately explain Git over HTTPS integration so the credential helper accounts for token refresh.
Source: github.blogBranch protections move to rulesets in one operation
October 20, 2026
Repository settings gained bulk conversion of all branch protection rules into rulesets. GitHub previews the import before changes are applied. The feature builds on the earlier one-rule-at-a-time migration and reduces manual work when moving to a shared policy model.
Source: github.blogDependabot API returns the project dependency version
October 20, 2026
The REST API response’s dependency object gained version_requirement: the version or constraint last recorded for the alert. Previously the response contained the advisory’s vulnerable range but not the version in the repository itself. The field can be null or represent only one of several values, which integrations should account for.
Source: github.blog