Skip to content

October '26 enterprise roundup

In case you missed it…

October 2026 edition of the GitHub Monthly Enterprise Roundup (MER)

Published via GitHub Executive Insights | Authored by Dave Burnison

AI-assisted development is rapidly becoming agentic engineering—and this roundup helps enterprise leaders and developers turn that shift into measurable, governed results. The central theme is GitHub’s Agentic Engineering System: a practical operating model for deciding where agents should accelerate work, where human judgment remains essential, and how shared knowledge, guardrails, and outcome-based measurement can prevent faster code generation from scaling defects, rework, and risk.

This edition connects that strategy to capabilities across the software lifecycle.

Read about the lessons from GitHub’s large-scale Rust migration which provides a real-world playbook for agentic development at scale, showing why strong tests, incremental delivery, automated review, fast feedback loops, and sustained human technical judgment become even more critical as agents take on dramatically more implementation work.

Explore Project HydraFusion which selects the right model for each task freeing up developers to focus on the task at hand rather than spending time deciding which model to use. Check out GitHub Copilot’s expanding collaboration, and dynamic-workflow experiences across all surfaces: GitHub Copilot app, CLI, SDK & multiple IDEs to see how teams can orchestrate models and parallel work more efficiently.

Learn how to reduce risk through enforced security configurations, credential inventory, proof-of-presence protections, AI-assisted code scanning and autofix, supply-chain safeguards, and resilient CI/CD practices.

Read the sections most relevant to your role and share the targeted links with your team. The goal is not merely more code; it is a more productive engineering system that delivers higher-quality, more secure software at enterprise scale.

The MER is designed for everyone involved in enterprise software development, so it intentionally covers a broad range of topics. This is a long document and we do not expect you to read it from beginning to end—the intent is for you to scan the sections that match how you use GitHub, then explore the links most relevant to your work. Because readers often skip entire sections, some links appear more than once when they apply to multiple areas, such as Code Security and CI/CD. While no one person will follow every link, but across a team, each resource may be valuable to someone. Share the full MER with your colleagues, or send them the individual links that best fit their roles.

Want to get notified of when the next MER is available? Go to GitHub Enterprise on LinkedIn and click on the "Follow" button. In addition to MER notifications you'll be notified when other enterprise focused content becomes available.

Events

While GitHub hosts our own marquee events like Universe and Galaxy each year, you will also find GitHub participating in other industry events. Here is the latest news about upcoming conferences.

  • 📅 GitHub Universe (October 28–29 / San Francisco, CA) - In-person & virtual. GitHub’s flagship developer event uniting humans, agents, and the world’s code to build what’s next. GitHub Universe 2026 returns to Fort Mason Center in San Francisco on October 28–29, bringing together builders, security practitioners, and technical leaders for two days focused on navigating the shift from AI-powered code generation to fully agentic workflows.

  • 📢 10 technical talks I’m excited about at GitHub Universe 2026 - This curated agenda highlights practical sessions on agent memory, model evaluation, MCP authorization, software supply chain defenses, and reliable AI-assisted debugging. Enterprise teams can use the list to prioritize Universe sessions that address the governance, security, and engineering challenges they are actively working through.

  • 📅 Upcoming GitHub events, webinars & developer conferences - Discover upcoming and on demand GitHub events, webinars, and conferences. Connect with developers, explore new tools, and learn how to build, secure, and scale software with GitHub. There are a number of events led by GitHub and our partners covering GitHub Advanced Security, Understanding Budgets for Usage-Based Billing and the GitHub Copilot app. The Microsoft AI Tour is happening in multiple cities/regions - Accelerate your AI transformation. Join us for a free, one-day, in-person experience built for organizations navigating the next wave of AI transformation. Get the clarity and confidence to implement AI at scale.

GitHub Platform

The team at GitHub is incredibly passionate about our work. We read every email, social post, support ticket, and we take it all to heart. We are committed to improving availability, increasing resilience, scaling for the future of software development, and communicating more transparently along the way.

General Platform Updates

GitHub Issues and Projects

Enterprise Management & Governance

We have been listening to our enterprise customers for years. We are excited to share product updates and new guidance to assist those who manage GitHub for hundreds if not thousands of stakeholders. This month's updates demonstrate how we are acting on your feedback to address the issues in multiple areas you face managing GitHub Enterprise at scale not only with new features and capabilities but, with new guidance to properly manage it all in your world.

General

  • 🚢 Enforce GitHub Advanced Security configurations - Enterprise administrators can now prevent both organization and repository owners from overriding enterprise-defined security configurations, ensuring consistent security policy across every organization.

  • 🚢 Bring business context with external custom properties - External systems can now own and continuously sync repository metadata such as ownership, service tier, lifecycle, and compliance status, while keeping those values read-only in GitHub and available for filtering and ruleset targeting.

  • 🚢 Require proof of presence for high-impact actions - Enterprises with managed users that use Microsoft Entra ID can now require members to re-authenticate with their identity provider before sensitive operations such as creating tokens or changing security settings, helping block hijacked sessions and meet fresh-authentication compliance requirements.

  • 🚢 GitHub Enterprise adds credential inventory exports - Enterprise owners can now export or query through the API every SSH key, personal access token, OAuth token, and GitHub App token that can reach their enterprise, giving security teams a fast way to scope risk during an incident.

  • 🚢 SCIM user responses now include a profileUrl attribute - Identity providers and IT teams can now map SCIM identities directly to GitHub accounts using the standard profileUrl attribute instead of relying on extra lookups, with no impact on existing integrations.

  • 🚢 Automate SSO authorization for classic PATs and SSH keys - Enterprise-installed GitHub Apps can now bulk-authorize existing classic PATs and SSH keys across up to 50 SSO-protected organizations without handling credential secrets, reducing developer friction and the temptation to use long-lived tokens.

  • 🚢 Stateless GitHub App installation tokens rolled out - Enterprise teams should validate integrations now for much longer installation tokens, especially fixed-length storage, validation, proxies, and secret-redaction rules, before GitHub retires the temporary compatibility header on November 30, 2026.

  • 🚢 X25519-only TLS ends for GHE.com on October 7 - GitHub Enterprise Cloud with data residency will stop accepting TLS clients that offer only X25519 on October 7, so administrators should remove X25519-only settings and ensure P-256 is enabled to avoid connection failures.

  • 📐 Building resilience with repository mirroring - For business-critical applications, a source-code outage can quickly become a deployment outage, blocking urgent fixes and customer commitments. Building resilience with repository mirroring explains how to create a separate, deployment-ready mirror of critical repositories, along with independent credentials, CI/CD dependencies, monitoring, and rehearsed recovery procedures, so teams have a proven break-glass path when their primary GitHub environment is unavailable.

GitHub Copilot & AI

  • 📚 GitHub's Agentic Engineering System - Successful AI adoption in software engineering is not about generating more code, but about building an operating system for engineering work that balances governance, shared knowledge, and measurable customer value. The post introduces GitHub's Agentic Engineering System (AES), a practical framework for deciding where AI agents can safely accelerate delivery, where human judgment remains essential, and how to avoid scaling rework, defects, and risk alongside productivity. For software leaders and enterprise development teams, this is a blueprint for moving beyond AI experimentation toward sustainable, organization-wide adoption. It provides a structured way to evaluate readiness, define human-versus-agent responsibilities, and measure whether AI is actually improving customer outcomes rather than simply increasing output. Implementation guidance (recently updated) related to this playbook is available in GitHub Well-Architected. While the AES was introduced last month, there are new videos in this YouTube playlist, (four ~2 minute videos): Agentic Engineering System: scaling AI in your organization.

  • 🚢 Default Enablement of Copilot features for Copilot Business and Enterprise - Administrators have until October 22 to choose whether current and future generally available Copilot features default to enabled, disabled, or delegated to organizations, so review this policy now to avoid unexpected feature rollouts.

  • 🚢 Enterprise managed settings in-product validator - A new validator flags malformed JSON, unsupported configurations, and invalid team mappings in enterprise Copilot settings, helping administrators correct policy errors before they prevent settings from being enforced.

  • 🚢 Local sandboxing in the GitHub Copilot app - Per-project policies for filesystem, network, and credential access reduce the impact of unintended agent commands, can be tightened further through enterprise-managed settings, and fail closed if the operating system cannot enforce them.

  • 🚢 OpenTelemetry in the GitHub Copilot app - Administrators can use enterprise-managed settings to send traces of agent sessions, model requests, and tool calls to their existing observability tools, with prompt and response content excluded by default.

  • 📐 Managing AI credits – UPDATED Managing AI credits explains why AI usage needs the same disciplined FinOps approach as cloud infrastructure: shared enterprise credits, power users, and automated agents can quickly create unexpected costs or even productivity disruptions. It provides a practical governance model for controlling spend without stifling adoption, using layered budgets, cost attribution, model-selection guidance, and usage-based forecasting to balance AI innovation with financial accountability.

  • 🚢 Copilot budget increase requests are generally available - Members who run out of AI credits can request more budget right away, and owners or billing managers can approve, adjust, or deny the request from settings to restore access immediately.

  • 🚢 Usage metrics API adds pull request review stages - New median and 90th-percentile timings for ready-to-first-review, first-to-final review, and final-review-to-merge show exactly where pull requests stall, so engineering leaders can target the right bottleneck.

  • 🚢 Copilot impact dashboard now shows feature engagement - The dashboard and report APIs now show how many active users regularly use features such as code completion, agent edits, code review, cloud agent, CLI, and the Copilot app, helping administrators spot where more enablement is needed.

  • 🚢 Agentic CLI customizations now in the usage metrics API - New fields show which skills, custom agents, MCP servers, slash commands, and plugins developers use most in Copilot CLI, giving administrators data to guide investment in shared customizations.

  • 🚢 GitHub Copilot suggests custom properties definitions - When administrators define a new custom property, Copilot suggests relevant allowed values, such as compliance categories, making it easier to build a consistent governance taxonomy for targeting rulesets across large repository fleets.

Leadership and Developer Skills

General leadership and developer expertise based on our own experience and the collective experience of our customers and partners. It's time to start diving into how AI is going to work alongside you to make your teams better equipped to work with AI to help your organization create better outcomes not, just more outputs.

  • 📢 AI is rewriting the developer career ladder. Here’s how to stand out. - As AI takes on more implementation work, engineering leaders need to rethink what distinguishes high-performing developers: the ability to direct AI agents, critically evaluate their output, and apply sound technical judgment. The opportunity is bigger than developer productivity; it’s about evolving engineering roles and workflows so teams spend less time on routine implementation and more time on architecture, tradeoffs, customer problems, and higher-value decisions.

  • 📢 Developer policy update: Transparency, state policy, and what’s ahead - Policy decisions around AI transparency, age assurance, copyright, and government takedowns are increasingly capable of affecting developer tools, code repositories, and open source projects, even when those systems were not the intended regulatory target. GitHub highlights how developer and open source community engagement is already influencing legislation and identifies upcoming policy debates where technical voices can help prevent unintended consequences for software development and open source.

  • 📢 Developers want more efficient software. Here’s what over 1,000 GitHub users told us they need. - A survey of 1,039 GitHub users with the Yale Program on Climate Change Communication found that roughly 8 in 10 developers want tools and best practices for writing more energy-efficient code, yet few feel they have a practical way to measure or act on it. Engineering leaders can use these findings to frame efficiency work, such as reducing unnecessary compute, as normal engineering practice that also lowers costs.

  • 📚 What is the DevOps Model? Exploring foundational practices in DevOps - This guide cuts through DevOps buzzwords to show how culture, collaboration, automation, CI/CD, infrastructure as code, and continuous feedback work together to improve the speed and reliability of software delivery. For enterprise developers and engineering leaders, it provides a useful framework for assessing DevOps maturity and identifying the practices that can reduce friction between development and operations while enabling teams to deliver customer value faster.

GitHub Copilot Day

Learn how agentic development, multi-model orchestration with Project HydraFusion, reusable agent skills, and multi-surface workflows across Slack, VS Code, and the CLI are reshaping software engineering. Explore practical walkthroughs, technical deep dives, and live coding demos designed to help you take projects from idea to production with less complexity and more control. Check out all of the sessions in the GitHub Copilot Day YouTube Playlist.

  • 📺 Welcome to GitHub Copilot Day: the future of agentic engineering (4:46) - GitHub COO Kyle Daigle kicks off the first-ever GitHub Copilot Day with a look at how software development is shifting from manual coding to agentic orchestration. Discover how Project HydraFusion optimizes AI model selection to cut costs by 67% while improving code quality on TerminalBench 2.1. Learn about the shared runtime, the GitHub Copilot app, and how the Copilot SDK lets developers build custom agentic workflows.

  • 📺 Dream it, Build it, Ship it! (29:18) - Follow James Montemagno and Pierce Boggan as they demonstrate how to build, test, and ship applications using GitHub Copilot. See agentic workflows in action across Slack, Copilot app, VS Code, and the terminal with connected sessions that let you move between tools without starting over. Explore live web previews, automated issue triage, mobile app testing, and PR resolution with agent merge. Then, see how HydraFusion takes the guesswork out of model selection, automatically choosing models and workflows to balance quality, cost, and speed.

  • 📺 25 agent skills to improve your workflow in GitHub Copilot (19:50) - Want to get more consistent results from your AI coding agents? In this GitHub Copilot Day session, Matt Pocock walks through his popular open-source collection of Agent Skills. Learn how skills like "Grill with Docs", Dexter Horthy’s "Show Me", and "Code Review" help align agents before implementation, generate visual pull requests, and catch architecture issues early.

  • 📺 How Project HydraFusion reduces the cost of frontier AI (14:26) - Everyone's racing to build a better model. HydraFusion optimizes the path instead, orchestrating existing models per request rather than picking just one, and reduces the cost frontier AI. Join Aashna Garg and Julia Kasper to learn how it works, and the ceiling we hit that forced the shift.

  • 📺 GitHub Copilot everywhere: building code across Slack, Teams, mobile, and VS Code (12:11) - Development doesn’t happen only in your editor, and it rarely happens alone. Join Meagan to see how Copilot in Teams and Slack lets you work with AI alongside your teammates, right in the conversation. Plus, see how we’re streamlining chat across GitHub.com and the mobile app to bring Copilot to more of your daily development workflow.

  • 📺 How to use Claude, Codex, and BYOK in GitHub Copilot for VS Code (8:29) - VS Code now gives developers more choice in how they build, with support for multiple agent harnesses and bring your own key (BYOK) options. In this GitHub Copilot Day session, Tyler Leonhardt explores the Copilot, Claude, and Codex agent harnesses and the different ways to access models. Learn how each harness brings its own prompts and tools to your workspace, and how a single GitHub Copilot subscription lets you work with all three.

  • 📺 One Session, Every Surface: Inside Copilot’s Agent Runtime and SDK (12:03) - Agent sessions shouldn’t be trapped in one editor, terminal, or app. Patrick Nikoletich explores how GitHub’s shared agent runtime, Copilot SDK, and Session Agent Host Protocol enable sessions to move across hosts while retaining the context, tools, and permissions developers need. See how this foundation powers Copilot experiences today and how you can use it to build portable, multi-client agent workflows of your own.

AI & ML - GitHub Copilot

Recent advancements and feature updates for GitHub Copilot, with a particular focus on the GitHub Copilot app and the GitHub Copilot CLI & SDK.

GitHub Copilot app

The GitHub app is the only desktop experience for agent-driven development built natively on the GitHub Copilot CLI. Available for customers on paid GitHub Copilot plans for macOS, Windows, and Linux.

  • 📺 How to use GitHub Copilot with WSL on Windows (6:13) - Build software on Windows using the Linux environments and tools you already rely on. In this video, see how to connect the GitHub Copilot app to Windows Subsystem for Linux (WSL) and run coding agents directly inside Ubuntu. Watch how Copilot handles parallel feature requests using worktrees, previews changes in a built-in browser, and verifies code diffs, all without leaving the app.

  • 📅 GitHub Copilot for Every Builder (October 21, 12:00 PM — 12:45 PM EDT) - This demo-driven session shows how the GitHub Copilot App and Copilot Cloud Agent can turn ideas into finished work, delegate repetitive tasks, and create scheduled automations, even without traditional programming. Enterprise developers and engineering leaders should watch to understand how Skills, Plugins, Connectors, Canvases, and agents are expanding Copilot from a coding assistant into a platform for delegating and automating work across the software lifecycle.

  • 📢 When chat is the wrong UI - Chat is a universal starting point for AI, but once you know the task, a purpose-built interface is often faster and clearer. This post uses hands-on examples to show how canvases in the GitHub Copilot app act as small full-stack apps that talk bidirectionally with the agent, pointing to a more task-oriented future for AI-assisted development.

NOTE: The engine for the GitHub Copilot app is the GitHub Copilot CLI. See the GitHub Copilot CLI & SDK section for more recent news and updates.

GitHub Copilot app for Beginners

Ready to build faster with AI? 🚀 The GitHub Copilot App for Beginners blog series and YouTube playlist are your step-by-step guides to AI pair programming. Learn how to set up the app, prompt with confidence, and turn your ideas into code. New this month:

  • 📢 GitHub Copilot app for Beginners: How to build custom workflows with canvases - Instead of bending your process to fit fixed screens, you can describe a workflow in plain English with /create-canvas and get a shared, bidirectional interface such as a kanban board, triage board, or release checklist that both you and the agent update in real time. Canvases can be saved as project extensions for the whole team, making this a low-effort way to standardize repeatable agent-assisted workflows.

  • 📺 How to continue GitHub Copilot app sessions in VS Code (3:05) - Want to direct an AI agent in the app but finish coding in your favorite editor? In episode 9 of our beginner series, discover how to seamlessly hand off any active session from the GitHub Copilot app straight into VS Code. Learn how your task plan, conversation history, diff, and isolated git worktree travel with you without losing context.

GitHub Copilot Integrations in Slack and Microsoft Teams

  • 📺 GitHub Copilot everywhere: building code across Slack, Teams, mobile, and VS Code (12:11) - Development doesn’t happen only in your editor, and it rarely happens alone. Join Meagan to see how Copilot in Teams and Slack lets you work with AI alongside your teammates, right in the conversation. Plus, see how we’re streamlining chat across GitHub.com and the mobile app to bring Copilot to more of your daily development workflow.

  • 🚢 Updates to GitHub Copilot for Slack and Microsoft Teams - Copilot can now use Slack files, Teams images, forwarded messages, and thread history as context, checks for duplicate issues before creating new work, and links results back to the originating conversation for better traceability.

GitHub Copilot CLI & SDK

  • 🌐 The terminal is getting a user interface. Here’s why that matters. | LinkedIn - GitHub Copilot CLI is turning the terminal into an AI-powered development workspace where developers can bring GitHub issues and pull requests directly into their work, run multiple AI sessions in parallel, and preserve context as they switch between tasks. For enterprise development teams, the bigger story is the evolution from AI that simply helps write code to AI integrated into the end-to-end developer workflow, reducing context switching and making it easier for developers to direct multiple streams of work without continually reconstructing context.

  • 📺 Let's Learn GitHub Copilot SDK (1:30:00) - Join this beginner-friendly virtual training to get started with the GitHub Copilot SDK, your toolkit for building custom agent capabilities into your workflows. Learn how to programmatically interact with Copilot, create custom agent tools, and extend AI workflows across TypeScript, Python, .NET, Go, and Java.

  • 🚢 Dynamic workflows in Copilot CLI and the Copilot app - Teams can define reusable agent orchestrations in code, combining sequential or parallel steps, structured results, and human checkpoints for more reliable and observable multi-agent work across Copilot CLI, the app, and SDK.

  • 🚢 GitHub Copilot can now interact with desktop apps with computer use - In public preview, Copilot CLI and the Copilot app can operate approved macOS and Windows applications, extending agent automation to legacy and GUI-only workflows while retaining user approvals and enterprise controls.

  • 🚢 Faster C++ code intelligence with whole codebase indexing - A persistent, project-wide symbol index powered by the Microsoft C++ Language Server makes definitions, references, and symbol searches in large C++ codebases much faster in Copilot CLI.

GitHub Copilot Code Review

  • 📚 GitHub Copilot code review, tuned to how your team works - how Copilot code review is evolving from generic diff analysis into context-aware reviews grounded in your organization’s standards, project history, and toolchain, using AGENTS.md, custom instructions, MCP servers, and agent skills. For enterprise engineering teams, the payoff is more consistent reviews that can surface architectural decisions, operational requirements, and lessons from past incidents, freeing human reviewers to focus on higher-value architecture and design decisions.

  • 📢 ReviewBench: An open benchmark for AI code review - ReviewBench: An open benchmark for AI code review introduces an open, reproducible way to evaluate AI code review agents on realistic pull requests, measuring not just what they catch but also severity, category, precision, recall, and noise. For enterprise engineering teams adopting AI-assisted review, it provides a much-needed framework for objectively comparing tools, validating improvements, and choosing the reviewer that best matches their priorities rather than relying on vendor claims or simplistic benchmarks.

  • 🚢 Copilot code review: An improved review experience - A refreshed overview groups open, resolved, and previously missed findings, Copilot automatically resolves suggestions you've addressed, and batch-accepted suggestions now get meaningful generated commit messages.

  • 🚢 More ways to request and configure Copilot code reviews - Every Copilot plan, including Business and Enterprise, now gets a personal code review settings page for automatic reviews and default review effort, and enterprises can set a default review effort for all organization-owned repositories.

  • 🚢 Copilot code review: API support and new default effort level - For enterprise engineering teams, the key shift is the ability to embed AI-powered reviews directly into existing scripts, workflows, and internal tools while centrally controlling review depth across enterprise, organization, repository, and individual settings.

  • 🚢 GitHub Copilot in VS Code September 2026 releases - September's releases add recurring automations, agent merge, richer session navigation, Dev Container support, cross-app Codex continuity, and broader GitHub context so teams can manage agent-driven work from implementation through merge.

  • 📺 How to use Claude, Codex, and BYOK in GitHub Copilot for VS Code | GitHub Copilot Day (8:29) - VS Code now gives developers more choice in how they build, with support for multiple agent harnesses and bring your own key (BYOK) options. In this GitHub Copilot Day session, Tyler Leonhardt explores the Copilot, Claude, and Codex agent harnesses and the different ways to access models. Learn how each harness brings its own prompts and tools to your workspace, and how a single GitHub Copilot subscription lets you work with all three.

  • 🚢 New features and improvements in Copilot for JetBrains - Version 1.18.0 adds AI-assisted tool approvals in public preview, re-editing of earlier agent messages with automatic rewind, organization and enterprise skills and custom instructions, Codex plan review, and persistent MCP tool controls.

GitHub Copilot - New Models

GitHub Copilot supports multiple AI models, each with different strengths. Some prioritize speed and cost-efficiency, while others are optimized for accuracy, deep reasoning, or multimodal inputs. The right model depends on your task. Key reference documents:

HydraFusion

Last month we introduced GitHub’s new Project HydraFusion which hints at the next evolution of AI-assisted software development: instead of forcing developers to choose the “best” model, As the harness, Copilot dynamically orchestrates multiple models to draft, critique, revise, and escalate work behind the scenes, delivering frontier-level coding quality at significantly lower cost. This month there are a few new related resources.

  • 🚢 HydraFusion in VS Code and the GitHub Copilot app - The research preview brings single-model, cascade, and critique workflows to VS Code and the Copilot app, coordinating models to balance quality and efficiency while giving users clearer progress updates.

  • 📺 Inside Project HydraFusion: multi-model orchestration in the GitHub Copilot | demo | GitHub Checkout (13:24) - Stop guessing which AI model to use for your coding tasks. In this episode of GitHub Checkout, Julia Kasper joins to break down Project HydraFusion - a new approach to multi-model orchestration in the GitHub Copilot CLI. Learn how HydraFusion evaluates your intent and automatically routes prompts through single, cascade, or critique execution patterns. Try it today by turning on experimental mode in the Copilot CLI, GitHub Copilot App or Vs Code with /experimental.

  • 📺 How Project HydraFusion reduces the cost of frontier AI (14:26) - Everyone's racing to build a better model. HydraFusion optimizes the path instead, orchestrating existing models per request rather than picking just one, and reduces the cost frontier AI. Join Aashna Garg and Julia Kasper to learn how it works, and the ceiling we hit that forced the shift.

New Models

Here are the models that have been recently added to GitHub Copilot and related updates.

  • 🚢 Configure cost and quality in Copilot auto model selection - Efficiency, balance, and intelligence tiers let you tell auto model selection how to weigh cost, quality, and latency, while it still picks the best-suited model for each prompt.

  • 🚢 GPT-6.1 Sol in GitHub Copilot - OpenAI’s new model is rolling out for agentic coding and terminal workflows, with early testing showing strong multistep performance using fewer tokens and steps; administrators can manage access through Copilot model policies.

  • 🚢 OpenAI’s GPT-6 Sol and GPT-6 Luna now available - GPT-6 Sol is a balanced model for interactive and agentic coding, and GPT-6 Luna is the lowest-cost GPT-6 option for faster, smaller tasks, both available across IDEs, the CLI, cloud agent, and the Copilot app.

  • 🚢 Claude Opus 5.5 is now available in GitHub Copilot - In early testing, Anthropic's newest Opus model resolved tasks comparably to Claude Opus 5 while using significantly fewer steps and tokens, making it a strong option for long-running agentic work on Copilot Business, and Enterprise plans.

  • 🚢 Claude Sonnet 5.5 in GitHub Copilot - Anthropic’s latest Sonnet is generally available across Copilot plans and coding surfaces, with early tests showing comparable coding results to Sonnet 5 using fewer steps, tokens, and tool calls.

  • 🚢 Grok 4.7 is now available in GitHub Copilot - xAI's latest reasoning model builds on Grok 4.6 for agentic coding and complex multistep workflows, and administrators can control access through Copilot model policies.

Additional GitHub Copilot Updates

  • 📅 Orchestrating Agentic Workflows: From Idea to Trusted Production (On Demand) - Move beyond AI-assisted coding and see how GitHub enables autonomous, repo-native agents to take software from issue to pull request, automated review, and deployment. For enterprise development teams, this demonstrates how to gain the speed of multi-step agentic delivery while maintaining the governance, quality controls, integrations, and policy boundaries needed to trust AI agents in production.

  • 📄 Quickstart for using GitHub Copilot on GitHub.com - This guide shows how developers can move beyond AI-assisted Q&A to delegating coding work directly from GitHub.com, with Copilot analyzing repository context, working autonomously on issues, and returning changes through pull requests for human review. For enterprise engineering teams, it provides a practical starting point for understanding how agentic development can fit into existing GitHub workflows while preserving review and approval as part of the software delivery process.

  • 🚢 GitHub Copilot weekly releases — September 21 - This week's roundup covers new Claude, GPT-6, and Grok models, local sandboxing and OpenTelemetry support in the Copilot app, and updates to Copilot in Slack, Microsoft Teams, JetBrains, and VS Code.

  • 🚢 GitHub Copilot weekly releases — September 14 - Highlights include smarter Copilot code review, cost and quality tiers for auto model selection, Sentry integration in the Copilot app, new VS Code Agents usage metrics for administrators, and new agent features in VS Code.

  • 🚢 GitHub Changelog - Copilot - Skim through all of the recent Copilot changes.

Security

Application security with GitHub, ensuring the code that lives in GitHub and the dependencies that go into the solutions you build are secure and do not contain any secrets.

Code Security

  • 📚 What is risk-based vulnerability management? - Risk-based vulnerability management helps teams prioritize findings by exploit likelihood and business impact instead of treating every issue as equally urgent. The overview outlines how security teams can direct limited remediation capacity toward the vulnerabilities that pose the greatest risk.

  • 📢 AI-powered fuzzing with the GitHub Security Lab Taskflow Agent - The GitHub Security Lab built an autonomous pipeline that takes a C/C++ repository, writes and refines fuzzing harnesses, runs AFL++, triages crashes, and drafts vulnerability reports, all driven by an LLM agent. Security teams will find useful design lessons about where agents can replace tedious human fuzzing work, along with an important warning to run it only in disposable, unprivileged environments.

  • 📢 How we found 24 Android vulnerabilities using our open source AI security agent - AI-assisted security research is moving beyond finding routine coding flaws: GitHub Security Lab’s open-source Taskflow Agent used targeted, repeatable workflows to uncover 24 Android vulnerabilities, including critical logic flaws capable of location tracking and account takeover. For enterprise engineering leaders, the bigger lesson is that carefully orchestrated AI agents can extend security research deeper into the SDLC, while human expertise remains essential for validating findings, severity, and real-world exploitability.

  • 🚢 Agentic autofix now uses Copilot Memory - Agentic autofix now reads and writes repository memories of secure fix patterns, so each remediation can help resolve future alerts and teach other Copilot features, such as code review and cloud agent, your repository's secure coding conventions.

  • 🚢 Code scanning AI Scan no longer requires CodeQL default setup - GitHub Advanced Security customers who have enabled AI Scan for pull requests now get AI-powered vulnerability detection on eligible repositories even when CodeQL default setup isn't configured.

  • 🚢 CodeQL 2.27.1 adds C and C++ query and Kotlin 2.4.20 support - New C/C++ and C# queries, expanded Go and C/C++ data flow models, Kotlin 2.4.20 support, and accuracy fixes help code scanning find more real vulnerabilities with fewer false positives.

  • 🚢 Scheduled code scanning skips inactive repositories - Weekly default-setup scans now begin only after a push or pull request triggers analysis, avoiding unexpected scheduled work on inactive repositories after setup or configuration rollouts.

  • 🚢 GitHub Advanced Security trials for GitHub Team - GitHub Team customers can now start self-serve trials of GitHub Code Security and Secret Protection, making it easier to evaluate advanced security capabilities before adopting them.

  • 🚢 Deprecation notice: All-platform CodeQL bundle - Teams that download codeql-bundle.tar.gz or codeql-bundle.tar.zst should switch to platform-specific bundles before mid-March 2027, and those bundles are also the only way to get Linux ARM64 binaries.

Secret Protection

  • 🚢 GitHub Advanced Security trials for GitHub Team - GitHub Team customers can now start self-serve trials of GitHub Code Security and Secret Protection, making it easier to evaluate advanced security capabilities before adopting them.

Supply Chain Security

  • 📚 What is software composition analysis? - Software composition analysis inventories application dependencies to surface known vulnerabilities, outdated components, and license obligations. The overview explains how scanning and software bills of materials help teams manage open-source risk throughout development.

  • 🚢 Repository custom runner settings for Dependabot - Repository administrators can route Dependabot updates to selected self-hosted or larger GitHub-hosted runners, allowing dependency jobs to access private registries or specialized environments while retaining control over their execution context.

  • 🚢 Opt-in dist-tag permissions for npm trusted publishing - Enterprises can eliminate another lingering long-lived npm access token from release automation by securely handling version promotion, rollback, and prerelease tag updates with short-lived OIDC credentials while keeping the added capability explicitly controlled.

  • 🚢 Stage-only npm tokens for safer automation - A new token permission lets automation stage npm package versions for 2FA-approved release without granting direct publish rights, offering a migration path ahead of the planned January 2027 removal of bypass-2FA publishing.

  • 🚢 Confidential comments on repository security advisories - Maintainers can keep abuse concerns, investigation details, and coordination notes inside an advisory while restricting them to users with repository write access and recording views in the audit log.

  • 🚢 Repository security advisory comments API in public preview - New REST endpoints can read, add, and edit non-confidential advisory comments, enabling automated triage notes, audit exports, migrations, and workflows aligned with existing issue and pull request tooling.

  • 🚢 New fields for SecurityAdvisory GraphQL API - Five new advisory fields and server-side severity and withdrawal filters let security integrations build richer triage, audit, and review-latency workflows through one GraphQL authentication path and rate-limit budget.

  • 🚢 Structured forms for private vulnerability reports - Customizable forms, minimum-length fields, optional required CWE selection, and AI-use disclosure give maintainers more consistent evidence for vulnerability triage while remaining compatible with existing API integrations.

  • 🚢 Rate limits for private vulnerability reports - Daily per-user limits, repository-wide caps, and trusted-reporter allow lists help maintainers curb bulk or automated low-quality reports without blocking established security researchers.

Additional Security Updates

  • 🚢 Enforce GitHub Advanced Security configurations - Enterprise administrators can now prevent both organization and repository owners from overriding enterprise-defined security configurations, ensuring consistent security policy across every organization.

  • 🚢 Security improvements for SSH - GitHub is removing SHA-1 RSA signatures and an older Diffie-Hellman key exchange, requiring new RSA SSH keys to be at least 3072 bits starting October 14, and adding post-quantum ML-KEM key exchange, so audit your keys and SSH clients now.

  • 🚢 SHA-1 in HTTPS on GitHub sunset - SHA-1 is now disabled for HTTPS on github.com, GitHub Enterprise Cloud, and data residency partner CDNs, so any legacy clients or integrations that still rely on it will fail to connect.

  • 🚢 GitHub Changelog - Security - Skim through all of the recent security related changes.

GitHub Code Quality

GitHub Code Quality turns every pull request into an opportunity to improve. With in-context findings, one-click Copilot fixes, and reliability and maintainability scores, you spend less time chasing nits and more time building. Check out the documentation to learn more.

CI/CD

Continuous Integration & Continuous Deployment with GitHub Actions. If you are involved in managing and authoring GitHub Actions workflows you'll want to dive into these updates to see how we are addressing enterprise needs in the areas of scalability, debugging, security and bringing AI to GitHub Actions with Agentic Workflows and the GitHub Copilot CLI.

  • 📐 Recommendations for effective continuous integration (CI) - Recommendations for effective continuous integration (CI) shows how to turn CI from a simple merge gate into a fast, trustworthy developer feedback system, with practical guidance for reducing wasted compute, eliminating flaky tests, improving failure feedback, and securing GitHub Actions workflows. For enterprise engineering teams, it also addresses how to scale those practices across repositories through reusable workflows, runner strategies, deployment guardrails, and metrics that help balance developer velocity, reliability, and cost.

  • 📐 Building resilient CI/CD with GitHub Actions - Building resilient CI/CD with GitHub Actions explains how to keep critical deployments running even when your normal CI/CD orchestration is unavailable, without necessarily duplicating your entire pipeline infrastructure. For enterprise teams, it provides a practical resilience pattern built around portable deployment logic, independent authentication, preserved release artifacts and verification data, and rehearsed recovery paths so a CI/CD outage doesn’t become a business outage.

  • 🚢 Workflow execution protections in GitHub Actions generally available - Allowlists that control who can trigger workflows and which events can start them now support per-workflow-file targeting, insights, and REST API management, giving enterprises a stronger defense against unauthorized or malicious workflow runs.

  • 🚢 Actions Runner Controller release 0.15.0 - ARC 0.15.0 improves runner fleet reliability, scalability, and observability with less disruptive upgrades, configurable concurrency and API rate limits, and reduced reconciliation work.

  • 🚢 Actions retention now covers checks, runs, and statuses - GitHub Actions retention settings now also govern checks, workflow runs, and statuses, so administrators should review retention policies knowing that previously deleted records cannot be restored.

  • 🚢 Self-hosted runner version enforcement date has moved - Full enforcement for GitHub Enterprise Cloud began September 29, 2026; runners below the registration or job-execution minimum can no longer be used, so upgrade remaining runners and use the deprecation API to assess your fleet.

  • 🚢 Expired GitHub Actions artifacts no longer shown in UI and API - Run summaries and the artifacts REST API no longer list expired artifacts, removing confusion about whether deleted files are still billed, though the run logs still show which artifacts a run produced.

  • 🚢 Node 20 is no longer available in GitHub Actions - Runners now use Node 24 with no opt-out, so JavaScript action maintainers must update to node24 and workflow owners should upgrade to supported action versions, especially if they run self-hosted runners on macOS 13.4 or earlier or on ARM32.

  • 🚢 Ubuntu 26 generally available and latest migration - ubuntu-latest will gradually move from Ubuntu 24.04 to 26.04 between October 19 and November 19, so test workflows now against the changed and removed tools to avoid broken builds.

  • 🚢 GitHub Changelog - Actions - Skim through all of the recent security related changes.

Engineering

An inside look at how we’re building the home for all developers. Resources based on our internal experiences.

  • 📢 Migrating the GitHub Copilot runtime to Rust, using Copilot - Migrating the GitHub Copilot runtime to Rust, using Copilot shows that AI agents can fundamentally change the economics of large-scale software modernization: a rewrite that previously might have required a team and a year or two produced more than 800,000 lines of production Rust in just a few months, while the system continued shipping. More importantly for engineering leaders, it provides a real-world playbook for agentic development at scale, showing why strong tests, incremental delivery, automated review, fast feedback loops, and sustained human technical judgment become even more critical as agents take on dramatically more implementation work. NOTE: This is a long post, you may want ask your favorite AI tool to provide a summarized version to pull out the key points based on your role and perspective of enterprise software development.

  • 📢 Improving site performance by shipping more CSS - GitHub's Primer team explains how moving from CSS-in-JS to CSS Modules eliminated client and server styling costs that were slowing page loads and server-side rendering as component counts exploded. The incremental, feature-flagged migration backed by visual regression tests is a practical playbook for any team that needs to replace a foundational front-end technology without breaking production.

  • 📢 Rendering huge pull requests in the GitHub Copilot app - To keep reviews fast even for a pull request with 2,200 files, over a million changed lines, and 400+ inline comments, GitHub rebuilt the pull request view in the GitHub Copilot app around virtualization and a new approach to unpredictable comment heights. Teams that land large refactors or migrations as single pull requests will appreciate the performance engineering, and front-end engineers will value the detailed measure-and-improve methodology.

  • 📢 How we found 24 Android vulnerabilities using our open source AI security agent - AI-assisted security research is moving beyond finding routine coding flaws: GitHub Security Lab’s open-source Taskflow Agent used targeted, repeatable workflows to uncover 24 Android vulnerabilities, including critical logic flaws capable of location tracking and account takeover. For enterprise engineering leaders, the bigger lesson is that carefully orchestrated AI agents can extend security research deeper into the SDLC, while human expertise remains essential for validating findings, severity, and real-world exploitability.

GitHub Next

GitHub Next investigates the future of software development. We are a team of researchers and engineers at GitHub, exploring things beyond the adjacent possible. We prototype tools and technologies that will change our craft. We identify new approaches to building healthy, productive software engineering teams.

  • 🥼 Sparkle Pills - GitHub Next shares a simple templating convention that marks the slots an AI should fill in with *(...) while leaving the rest of the text untouched, and shows how to put deterministic code in charge so critical wording is never altered. It's a practical pattern for teams generating personalized communications, documentation, or reports at scale while keeping control of the approved content.

Legend

This legend represents the icons used above and links each icon to its corresponding resource page. These are the primary sources we review each month when compiling the Monthly Enterprise Roundup. Note that not every resource will appear in every edition.

That’s it for the October '26 edition of the MER. Follow GitHub Enterprise on LinkedIn to see when the next round of key updates become available.

Speakers
Dave Burnison
Dave BurnisonSr. Enterprise Advocate
Share