RSS feed from GitHub changelog. Nothing to do with GitHub.
Restricting npm bypass-2FA granular access tokens https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens
#github
The GitHub BlogRestricting npm bypass-2FA granular access tokens - GitHub Changelognpm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…Reference same-repository actions with self-repository syntax https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax
#github
The GitHub BlogReference same-repository actions with self-repository syntax - GitHub ChangelogYou can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your…npm publish-time malware scanning and dual-use metadata https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata
#github
The GitHub Blognpm publish-time malware scanning and dual-use metadata - GitHub ChangelogAs part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…GitHub Actions holds potentially malicious workflows for approval https://github.blog/changelog/2026-07-28-github-actions-holds-unproven-workflows-for-approval
#github
The GitHub BlogGitHub Actions holds potentially malicious workflows for approval - GitHub ChangelogRecent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these…