The Ubuntu 26.04 runner image for GitHub Actions is now GA for production workflows on x64 and arm64; the ubuntu-latest label will migrate from 24.04 to 26.04 between October 19 and November 19, and the new image drops or updates some preinstalled tool versions.
why it mattersWorkflows pinned to specific preinstalled tool versions can break once ubuntu-latest migrates in October.
GitHub Changelog
Workflow execution protections, previously in preview, are now generally available across GitHub Enterprise, organizations and repositories, adding allowlists for who and what can trigger a workflow, per-file targeting, audit insights and a REST API; public repos without an existing policy now default to disabling pull_request_target.
why it mattersA default pull_request_target restriction closes a trigger that's been repeatedly abused in CI supply-chain attacks.
GitHub Changelog
npm granular access tokens now support a 'Read and write (stage only)' permission that lets CI stage a package version without the token being able to publish it directly; a maintainer must approve the staged version with 2FA before it goes live, ahead of npm's planned removal of bypass-2FA publish tokens.
why it mattersCuts the blast radius of a leaked CI token, a recurring root cause in this year's npm supply-chain compromises.
GitHub Changelog