Search

github.blog › changelog

npm trusted publishing now supports CircleCI - GitHub Changelog

…security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply chain security May.12 Retired Synchronous SBOM API deprecated supply chain security…

Apr 6, 2026 · Allison

Top stories

bleepingcomputer.com

GitHub links repo breach to TanStack npm supply-chain attack

5d ago

techcrunch.com

OpenAI says hackers stole some data after latest code security issue | TechCrunch

1w ago

pcgamer.com

I asked supply chain experts just how screwed PC components are due to the war in Iran

1w ago

tomshardware.com

Compromised Mistral AI and TanStack packages may have exposed GitHub, cloud and CI/CD credentials in 'mini Shai Hulud'  malware infection — supply-chain campaign spreads across npm and AI developer ecosystems like wildfire

1w ago

github.blog › security › supply-chain-security

Supply chain security Archives

…supply chain with GitHub’s dependency graph The GitHub dependency graph maps every direct and transitive dependency in your project, so you can identify risks, prioritize fixes, and keep your code secure…

Apr 1, 2026 · Zachary Steindler

github.blog › changelog

Dependabot now detects malware in npm dependencies - GitHub Changelog

…May.19 Improvement Expanded OIDC support for Dependabot and code scanning application security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply…

Mar 17, 2026 · Allison

github.blog › changelog

Dependabot and code scanning: Org-level private registries - GitHub Changelog

…security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply chain security May.12 Retired Synchronous SBOM API deprecated supply chain security…

Apr 14, 2026 · Allison

Discussions and forums

Hacker News · u/randersson1000 · Apr 22, 2026

Speed Matters: Why AI Software Vulnerability Exploitation is going be bad

I co-founded a successful security company close to the Mythos ecosystem and have spoken with participants in the know and I am deeply concerned. We, collectively, have answers for some but not all of the problems ahead …

13 5

github.blog › changelog

Code Security risk assessment available for organizations - GitHub Changelog

…May.19 Improvement Expanded OIDC support for Dependabot and code scanning application security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply…

Apr 8, 2026 · Allison

github.blog › changelog

Dependabot now supports Xcode projects using SwiftPM with .xcodeproj manifests - GitHub Changelog

…security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply chain security May.12 Retired Synchronous SBOM API deprecated supply chain security…

Mar 31, 2026 · Allison

github.blog › changelog

Cross-org Dependabot access for internal repositories - GitHub Changelog

…security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply chain security May.12 Retired Synchronous SBOM API deprecated supply chain security…

May 11, 2026 · Allison

github.blog › changelog

SBOM exports are now computed asynchronously - GitHub Changelog

…security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply chain security May.12 Retired Synchronous SBOM API deprecated supply chain security…

Apr 14, 2026 · Allison

github.blog › changelog

Dependency scanning with GitHub MCP Server is in public preview - GitHub Changelog

…security supply chain security May.19 Improvement Start a GitHub Advanced Security trial from a risk assessment application security supply chain security May.12 Retired Synchronous SBOM API deprecated supply chain security…

May 5, 2026 · Allison

github.blog › changelog

Lock and unlock draft repository security advisories - GitHub Changelog

…for repository security advisories supply chain security May.05 Release Dependency scanning with GitHub MCP Server is in public preview supply chain security May.05 Release Code-to-cloud risk visibility with…

Mar 4, 2026