What’s new from GitHub Changelog? October 2021 recap

October’s security-focused releases, in brief

October brought a wave of GitHub releases, but security teams will want to pay special attention to several updates that tighten control over code, credentials, and dependencies. Below is a summary of the most relevant changes for security-conscious developers and administrators.

Code scanning: Java analysis with CodeQL is now generally available

CodeQL’s Java analysis is out of beta and generally available. This means you can now run the same powerful, semantic code analysis engine that powers GitHub’s own security research across your Java repositories. No special configuration is required to enable it; CodeQL will use its default queries to catch common vulnerabilities and code smells in Java code. For teams already using CodeQL in CI, this update guarantees that Java workflows run on a stable, production-ready analysis engine.

Secret scanning now supports more providers and custom patterns

Secret scanning, which automatically detects committed credentials, added support for Ansible Vault keys. This is a common format for storing encrypted secrets inside playbooks, and its inclusion closes a gap for infrastructure-as-code teams. Beyond the new provider, GitHub introduced custom patterns for secret scanning. This lets you define your own regular expressions to catch internal or proprietary token formats that the default detectors don’t know about. Custom patterns are available for repositories in private beta, giving you an early look at how to tailor secret detection to your own tooling.

Dependabot: enhanced security updates and new ecosystem support

Dependabot’s security updates feature (which automatically opens pull requests for vulnerable dependencies) is now enabled by default for all eligible repositories. If you previously relied on manual configuration, the service will now pick up the slack automatically. The update also expands coverage for the Terraform module ecosystem, ensuring that your infrastructure as code receives the same vulnerability-driven PR automation as your application dependencies.

GitHub Actions: hardened security for self-hosted runners and OIDC

For teams running their own compute, GitHub raised the security bar on self-hosted runners. Two new policy controls let you restrict which workflows can use a runner: runner group restrictions and repository-level allowlists. This prevents untrusted or lower-privilege repositories from hijacking a more privileged runner environment. Additionally, GitHub Actions now supports OpenID Connect (OIDC) for cloud deployments. With OIDC, your workflow can exchange a short-lived token for cloud credentials (AWS, Azure, Google Cloud) without storing long-lived access keys as secrets, reducing the blast radius of a leaked secret.

New GitHub Issues: context for security workflows

The new GitHub Issues experience moved to public beta. While not a security tool itself, its enhanced structure—including draft-to-issue conversion, iterations, and bulk actions—lets security teams organize remediation sprints and track vulnerability work in the same place as the code. If you manage a public advisory or a coordinated disclosure process, the revamped issues board can double as a public roadmap.

For a full walkthrough of every October changelog entry, review the GitHub Changelog directly. The updates above represent the highest-impact changes for those whose primary concern is the security posture of their repositories, pipelines, and dependencies.

Security and administration

October brought a fresh security manager role for organizations. You can now grant entire teams the permission to manage security alerts and settings across repositories in the organization, instead of assigning those duties member by member.

The dependency review feature reached general availability. It shows dependency changes in pull requests along with their security impact, so reviewers can spot risky updates before merging. The dependency graph also picked up support for the Poetry package manager, and repository advisories can now list multiple affected products when a vulnerability spans several packages.

GitHub secret scanning added two more partners: Checkout.com, a global payments platform, and FullStory, which provides digital experience intelligence. Additionally, the default pattern set for secret scanning on private repositories will no longer include Azure SQL connection strings.

CodeQL’s code scanning engine now has beta support for Ruby. The new queries target common issues such as SQL injection, reflected cross-site scripting, and unsafe deserialization.

A warning now appears when a file’s contents contain bidirectional Unicode text, which can be interpreted or compiled differently than it appears in a UI. On the advisory side, drafts for repository vulnerabilities that affect multiple packages no longer have to be split into separate advisories.

Sponsor transaction exports now include the VAT status and location of sponsors, which maintainers need for tax purposes.

Workflows and deployments

GitHub Actions took a big step toward workflow reuse with a public beta that lets you reference an entire existing workflow as if it were an action. Instead of copying workflow definitions across repositories, you can pull one in with a single line of configuration.

For cloud deployments, Actions now supports OpenID Connect (OIDC). The protocol uses short-lived tokens that rotate automatically per deployment, removing the need to store long-lived cloud credentials in GitHub.

Workflows triggered by Dependabot pull requests now respect the permissions key specified in the workflow, so you can control exactly what the GitHub token can do during automatic dependency updates. The default remains read-only. Enterprise admins also gained more granular scopes for self-hosted runner management: manage_runners:enterprise now works for personal access tokens instead of requiring the broader admin:enterprise scope.

Mark your calendar: the Windows 2016 runner image will be removed from GitHub-hosted runners on March 15, 2022.

Repositories and releases

Creating a release just got easier. Two improvements are now generally available: maintainers can auto-generate release notes, and the release UI now presents what’s included in a release with clearer contributor recognition.

Smaller repository touches: searching branches by exact name now puts an exact match at the top of the suggestion list, and public repositories display a public label next to their name, just like private and internal repositories. When a new tag is created, the push webhook payload always includes a head_commit object with data for the commit the tag points to.

For pull requests, the merge queue entered limited beta. It runs parallel validation on different combinations of pull requests marked ready to merge, so you can merge efficiently without the usual delays between landings. Elsewhere in PRs, the hide-whitespace diff setting is now remembered per pull request, and Markdown-enabled fields support a fixed-width font for easier editing of tables and code structures. Notification email titles were also improved: they now show whether a thread concerns issue #xx or PR #xx.

API and integrations

REST and GraphQL APIs now let you set whether a repository allows forking when you create or update it. The REST API header is no longer required for 23 graduated previews, and the Codes of Conduct API preview, previously gated by the scarlet-witch-preview header, has been deprecated.

Enterprise organizations can now define custom repository roles (beta), choosing from 40+ fine-grained permissions. GitHub Docs also added an Enterprise Cloud option in the version drop-down, so documentation aligns with the GHEC experience.

Audit log streaming remains in beta, with S3 support added for GHEC users. The GitHub App for Microsoft Teams can now alert on more events, including new releases. Organization owners on GitHub.com and GHEC can export a member list as JSON or CSV.

Everyday editing and discovery

The command palette beta is available to all github.com users, letting you run commands from the keyboard: search repositories, switch themes, create issues, and more. Use Ctrl k or Ctrl Alt k on Windows and Linux, or ⌘ k and ⌘ Option k on Mac. Keyboard shortcuts now cover formatting too, across Markdown files, issues, pull requests, and comments:

• Quote: cmd+shift+. on Mac, ctrl+shift+. on Windows/Linux.
• Ordered list: cmd+shift+7 on Mac, ctrl+shift+7 on Windows/Linux.
• Unordered list: cmd+shift+8 on Mac, ctrl+shift+8 on Windows/Linux.

The “Display the source blob” button at the top of any Markdown file now toggles between source and rendered views.

The Explore tab in GitHub Mobile was redesigned, with personalized repository recommendations and trending projects. Meanwhile, the npm registry requires TLS 1.2 or higher, and the npm CLI was upgraded to version 8. The npm advisory database is now part of the GitHub Advisory Database: npm audit points to GitHub URLs, and npmjs.com advisories redirect there.

Closed issues now use a purple icon instead of red, and the new GitHub Issues public beta is available.

GitHub’s public roadmap has more on what’s next.