π Security Releases Bulletin β June 2025 Edition #164345
Replies: 4 comments 2 replies
-
|
Thanks, saya sangat menunggu rilis terbaru ini. |
Beta Was this translation helpful? Give feedback.
-
|
R |
Beta Was this translation helpful? Give feedback.
-
|
I don't understand how so many tainted folders and files from the July 4th attack are still all over and passing as sha25y secured there are 8 million fake nodes that I know of alone |
Beta Was this translation helpful? Give feedback.
-
|
Some really useful updates this month. The release asset digests are a big win for supply chain trust, checking binaries during malware analysis gets a lot simpler when the digest is exposed up front. The build-free CodeQL for C/C++ also stands out; most orgs have legacy code that never gets scanned because builds are painful, so this should help close a real gap. On the defensive side, the new MTTR metrics and better CodeQL insights are practical for tracking how fast teams actually respond. And bringing attestations into Kubernetes admission policies makes sense, it raises the bar for anyone trying to slip in tampered workloads. Overall, these feel like changes that hit real pain points we see in the field. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
π Hey Security Community!
Welcome to the June 2025 edition of the Code Security Release Bulletin! Each month weβll provide a roundup of the latest security-focused updates, enhancements, and product releases across GitHubβs security ecosystem.
June brought a wave of security updates designed to solve longstanding pain points, empower teams to work safer and smarter, and reflect the feedback weβve heard from youβour community. This isnβt just a list of fixes: itβs a set of tools and enhancements that help you do your best work, with confidence in your supply chain and application security.
Releases from this Month
Organization-Level Dependabot Access
You can now grant organization-wide access to Dependabot, making onboarding new repositories effortless.
Custom Roles for Secret Scanning Alert Dismissal
Delegate and review secret alert dismissals using custom rolesβbecause security workflows should fit your team, not the other way around.
Release Asset Digests for Supply Chain Trust
You can now verify the integrity of every release asset with exposed cryptographic digests.
Build-Free CodeQL for C/C++
Enable static analysis for C/C++ repositories at scale, without the build headaches.
Enhanced CodeQL Metrics & Copilot Autofixes
See the impact of your security work with improved metrics and actionable insights.
Private Registries for Go CodeQL Scans
Scan Go dependencies from private registriesβyour analysis is now as comprehensive as your codebase.
Delegated Alert Dismissal for Secret Protection (GA)
Empower teams to act quickly on secret scanning alerts, while maintaining centralized visibility.
CodeQL: Broader Language Support
Swift 6.1.1 & 6.1.2 and improved Go coverage are now available for CodeQL scans.
Mean Time to Remediate Metric for CodeQL PR Alerts
Understand and improve your teamβs response times with actionable βmean time to remediateβ metrics, now in the security dashboard.
Dependency Graph Defaults to Off for New Public Repos
You have more control over your supply chain dataβdependency graphs are now opt-in for new public repositories.
Dependabot Compute Migration to GitHub Actions (Upcoming)
Dependabotβs compute is moving to GitHub Actions, paving the way for deeper integration and scalability.
Enforce Kubernetes Admission Policies with Artifact Attestations
Bring supply chain security into your Kubernetes clusters with OPA Gatekeeper integration.
Dependabot Metrics Page (Private Preview)
Prioritize vulnerabilities more effectively with the new Dependabot metrics page (private preview for GHA security users).
Dependabot Support for Gradle Lockfiles (GA)
Automate dependency updates for Java projects using Gradle lockfiles, now fully supported.
Secret Scanning REST API Improvements (GA)
New API fields give you more context and control when responding to leaked secrets.
Configurable Secret Scanning Patterns for Push Protection (Public Preview)
Fine-tune which secrets are blocked on push, striking the right balance for your workflows.
Closing Thoughts
Every update this month started with a user storyβa challenge you shared, a bottleneck you flagged, or a new way you wanted to work. With each release, our goal is to build a safer, more empowering developer experience. As always, your feedback shapes what comes next. Thank you for being part of this journey.
What problem can we help you solve next? Let us know.
Join the Discussion!
We value your feedback! Join us here in the Code Security Community to discuss these releases, ask questions, and stay informed on the latest security updates. You can click on the release that interests you or comment down below!
Thanks for keeping up with GitHub Code Security! Stay secure and happy coding! ππ
π github.com/security | π The Changelog | π The GitHub Blog - Security
Beta Was this translation helpful? Give feedback.
All reactions