5 articles tagged
GitHub announced on 11 June 2026 that the windows-11-arm runner label migrates to the Visual Studio 2026 image in early September. The live runner-images READMEs show four component groups the new image does not carry
GitHub shipped three application-security changes on 20 August 2026. The new Mitigated dismissal reason is absent from the REST API enum and from the documentation page the changelog links to, and admins are told
Attackers force-pushed 75 of 76 trivy-action tags in March 2026 and stole secrets from every pipeline that ran a scan. Here is the credential isolation architecture that survives a poisoned action, with the exact GitHub
GitHub resumes minimum version enforcement for self-hosted runners on 25 September 2026, with brownouts from 24 August. How to inventory a fleet, fix each runner type, and avoid the 30-day trap.
TanStack's release pipeline authenticated 84 malicious npm versions in six minutes using a valid OIDC token. No token was stolen. Here is the chain, and the controls that close it as of July 2026.
