What GitHub shipped

@GitHub in Slack and Teams is generally available, allowing users to investigate bugs, create issues, make changes, and open pull requests from conversations. Canvas in Teams lets teams review plans, code changes, and previews alongside discussions.

Weekly Copilot updates include Agent Merge set up from a pull request, reviewer status checks, quoting comment text, and compacting or reviewing conversations at the context limit. Sessions can start by dropping files on New, and CSV and TSV files open as tabl

Copilot usage metrics reports add per-user fields showing missing client telemetry and IDEs or extensions below minimum versions, plus daily counts of affected users.

Copilot usage metrics reports add a copilot_code_review object per repository per day, counting evaluated and addressed code review comments so an addressed rate can be tracked.

An optional Overview page for pull requests enters public preview, placing merge status and next available actions in a summary at the top of the page.

GitHub Copilot is available in Xcode's built-in coding assistant in public preview, starting with Xcode 27.3 beta; the separate Copilot for Xcode extension remains an option.

CodeQL 2.27.4 adds query accuracy improvements across Java/Kotlin, Rust and C/C++, stronger security checks when bundling or publishing a pack, and corrected query metadata.

The Copilot usage metrics API now reports bring your own key usage separately from Copilot-hosted models, distinguishing developer-configured local BYOK and admin-set enterprise custom models.

GitHub Desktop 3.6.10 and later can issue short-lived, automatically refreshing authentication tokens during sign-in for eligible accounts. The rollout is gradual on github.com and excludes GitHub Enterprise Server.

Dependabot now supports Python 3.15, so projects upgrading to that version can keep receiving dependency updates. It is available on github.com and planned for GitHub Enterprise Server 3.24.

CodeQL 2.27.3 adds support for Python 3.15 features, JSON syntax for data extensions, C23 bit-precise integers, and accuracy improvements across languages.

GitHub Copilot is available in JetBrains Air via the Agent Client Protocol, supporting local IDE and cloud tasks. Users can select Copilot as the agent and use their existing Copilot subscription.

A new REST API endpoint returns the cost center ID and name for a user, organization, repository, or enterprise team, replacing the need to scan every cost center's resources.

Dependabot version updates now support Agent Package Manager, opening pull requests for supported git dependencies in apm.yml and regenerating apm.lock.yaml. This covers version updates only, not security updates.

From December 2, 2026, pull_request_target events are blocked by default in public repositories unless an Actions event policy allows them. Private and internal repositories are unaffected.

Security risk assessments now include repository protection status.

GitHub added new IP ranges for webhook deliveries on github.com to the Meta API hooks field. Users maintaining static allowlists must add the three new CIDR prefixes to avoid rejected deliveries.

Copilot can now generate and edit images from natural language in chat sessions, previewing results inline and saving them to the workspace. Organization and enterprise owners can disable image generation.

Repository plugin defaults and enterprise plugin controls are now generally available.

Copilot in VS Code now supports session continuity, letting users start a cloud agent session in one client and continue it in VS Code, the Copilot app, GitHub Mobile or github.com while the agent runs in the cloud.

Shared Copilot Automations are rolling out, letting teams build and maintain workflows from prompts, triggers and tools. Previously automations were personal and used the individual's identity and credits.

GitHub intelligence is described as a context and learning layer built from the graph of GitHub data, aimed at helping agents retain team conventions and find relevant code and history.

A security extension for the GitHub Copilot app, in public preview, shows a repository's open code scanning alerts ordered by severity. Users can ask Copilot to explain or help fix selected alerts without leaving the app.

GitHub Enterprise now includes Copilot for every licensed user through an account team. Usage against the enterprise budget becomes the main thing to manage; self-serve subscriptions are unaffected.

Projects in the GitHub Copilot app give multi-repository and non-repository work a single place for context, agents and results. Copilot coordinates background work and returns results such as pull requests for review.

The entry title indicates GitHub Copilot Fusion routes and orchestrates models, but no further details were provided.