- GitHub Actions now automatically holds potentially malicious workflows for manual approval before execution.
- This protects public repositories from supply‑chain attacks that use compromised credentials to inject harmful CI/CD workflows.
- Repository owners can review, approve, or reject flagged workflows to prevent credential theft and further exploitation.
GitHub Actions holds potentially malicious workflows for approval
Official GitHub changelog summary with source attribution, release tags, and community reactions.
Track this GitHub release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this GitHub release note into a weekly digest for the tools you actually use.
Create digestMore GitHub changelog updates
Expanded Copilot app usage metrics to cover additional API report rollups.
Grok 4.5, xAI’s latest reasoning model, is now rolling out in GitHub Copilot.
Dependabot now ingests malware advisories from the OpenSSF malicious‑packages repository