GitHub

From verifying AI-written code to securing npm dependencies, these are the sessions I’m building my Universe agenda around. The post 10 technical talks I’m excited about at GitHub Universe 2026 appeared first on The GitHub Blog .

Explore GitHub’s latest transparency data and learn more about policy updates affecting developers and open source. The post Developer policy update: Transparency, state policy, and what’s ahead appeared first on The GitHub Blog .

A look at the targeted AI taskflows behind these findings, the critical Android bugs they uncovered, and how to run the same open-source agent on your own app. The post How we found 24 Android vulnerabilities using our open source AI security agent appeared first on The GitHub Blog .

The open source Git project just released Git 2.56. Here is GitHub's look at some of the most interesting features and changes introduced since last time. The post Highlights from Git 2.56 appeared first on The GitHub Blog .

Describe the interface you need in plain English, then let the agent build a live surface you can both use and update—so you spend less time adapting to tools and more time getting work done. The post GitHub Copilot app for Beginners: How to build custom workflows with canvases appeared first on The GitHub Blog .

How we fully migrated github.com away from CSS-in-JS. The post Improving site performance by shipping more CSS appeared first on The GitHub Blog .

What is a developer to do when they need something more tangible than a chat box? Enter canvases. The post When chat is the wrong UI appeared first on The GitHub Blog .

In this blog post, I explain how to use the new fuzzing taskflow based on the GitHub Security Lab Taskflow Agent AI framework. The post AI-powered fuzzing with the GitHub Security Lab Taskflow Agent appeared first on The GitHub Blog .

## What's Changed * Recompile workflows with latest gh-aw pre-release by @lpcox in https://github.com/github/gh-aw-mcpg/pull/13405 * [log] Add debug logging to guard policy conversion and validation by @github-actions[bot] in https://github.com/github/gh-aw-mcpg/pull/13383 * [test-improver] Improve tests for launcher mount_policy canonicalizePath/ValidateMount by @github-actions[bot] in https://github.com/github/gh-aw-mcpg/pull/13384 * [Repo Assist] refactor: rename enclavegithub.MatchRoute to MatchEnclaveRoute by @github-actions[bot] in https://github.com/github/gh-aw-mcpg/pull/13417 * build(deps): bump go-sdk to v1.8.0 and pflag to v1.0.10 by @lpcox with @Copilot in https://github.com/github/gh-aw-mcpg/pull/13419 * [test] Add tests for config.formatErrorContext fallback branches by @github-actions[bot] in https://github.com/github/gh-aw-mcpg/pull/13381 * Centralize get_job_logs and security-alert tool-name literals into constants by @lpcox with @Copilot in https://github.com/github/g

## Install ```bash uv tool install specify-cli --from git+https://github.com/github/[email protected] specify init my-project ``` ## Upcoming Deprecation The core /speckit.taskstoissues command is planned to move out of Spec Kit core in a future release as GitHub-specific issue tracking transitions to a bundled github extension. The command remains supported for now. ## What's Changed - chore: bump version to 1.0.11 - feat: make catalog add idempotent across all catalog families (#4505) (#4543) - [extension] Update SpecAssay Check extension to v0.5.1 (#4703) - Add Spec Kit Design System extension to community catalog (#4707) - [extension] Update Applied Epistemic Engineering extension to v1.0.1 (#4699) - fix(integrations): remove duplicate Forge dispatch override (#4714) - fix(deps): drop platformdirs, which is never imported (#4675) - [preset] Update SpecAssay preset to v0.5.1 (#4706) - docs: add Japanese (日本語) README (#4560) - fix(integrations): drop invalid --model/--output-forma

## 🌟 Release Highlights This release brings native web-search support for the Copilot engine, more flexible reusable-workflow failure reporting, and hardened safe-outputs checkout detection. ### ✨ What's New - **Native web-search on the Copilot engine** — `tools: web-search:` now compiles to Copilot's built-in `web_search` tool (`--allow-tool web_search`) instead of producing a compile warning, making web search usable even in repos without GitHub tooling (e.g. Azure DevOps-hosted). See [Web Search reference](https://github.github.com/gh-aw/reference/web-search/). (#62957) - **Dynamic `failure-issue-repo` for reusable workflows** — `safe-outputs.failure-issue-repo` now accepts `${{ inputs.* }}` expressions, matching existing support for `report-failure-as-issue` and `report-failed-jobs`, so reusable (`workflow_call`) workflows can route failure issues per caller without patching the compiled lock file. (#62945) - **Gateway steering events in audit output** — `gh aw audit` now surfaces