July’s supply chain security expansion
GitHub brought its full suite of supply chain security tools to the Go community this month. The features—GitHub Security Advisories, Dependency Graph, Dependabot Alerts, and Dependabot Security Updates—are now available to Go developers, covering discovery, reporting, and remediation of vulnerabilities in Go dependencies.
Access control and account management
Personal access tokens now support expiration dates, both for newly created tokens and existing ones. GitHub sends a renewal reminder email as the expiration approaches. A new response header, GitHub-Authentication-Token-Expiration, exposes the expiration date so scripts can react to it programmatically, such as logging a warning when the date is near.
New GitHub.com users will see a redesigned onboarding flow, aimed at simplifying the first-time setup experience.
Repository and metadata improvements
Repositories containing a CITATION.cff file now have their metadata parsed into APA and BibTeX citation formats. Academics citing your work can copy the formatted reference directly from the repository page. Documentation for adding a citation file is available on GitHub Docs.
Release notes creation got a text-editing toolbar in the markdown editor, making it easier to format release descriptions with bold, italics, and other markdown features.
GitHub Actions
The requirement for maintainers to approve workflow runs from first-time contributors, introduced in April, is now configurable. Repository, organization, and enterprise administrators can each decide whether this approval step applies to public forks under their control.
The setup-node action now supports dependency caching, which can speed up Node.js projects on GitHub Actions. Both npm and yarn package managers are supported. Questions and feedback are being collected in the GitHub Support Community.
- uses: actions/setup-node@v2
with:
node-version: '14'
cache: npm
GitHub Discussions
A new beta feature adds machine translation to GitHub Discussions comments. From the overflow menu on any comment, users can translate content into Korean, Brazilian Portuguese, or English. The target language is determined by the web browser’s default language configuration. Additional languages are planned.
Code scanning and CodeQL
The CodeQL package manager entered public beta. CodeQL packages can contain queries and libraries, and when a pack is uploaded to the GitHub package registry, CodeQL fetches required dependencies automatically when running queries. Details are in the Changelog entry.
CodeQL security alerts now carry severity levels—critical, high, medium, or low. Each security query is assigned a numerical security-severity score, and the Changelog documents the scoring logic plus how to view and customize alerts.
CodeQL’s analysis coverage was also expanded. Support was added for more libraries and frameworks, and existing models were extended across C++, JavaScript, Python, and Java.
The code scanning branch filter got a syntax upgrade. While the security view of a repository shows alerts for the default branch, the improved filter syntax makes it simpler to search for alerts on other branches.
Secret scanning and notifications
Linear and Ionic joined the GitHub secret scanning partner program. GitHub now scans for and alerts on developer tokens issued by both companies.
Security alert notification settings were also aligned: since June, repositories can opt in to security alerts on a per-repository basis, and digest emails now respect those choices.
GitHub Sponsors
Sponsorship profiles can now offer custom donation amounts. Maintainers can enable the option for both recurring and one-time sponsorships.
Organizations no longer need a business bank account to join GitHub Sponsors—a personal bank account or fiscal host is sufficient.
