GitHub Package Firewall enters public preview

Wed, 21 Oct 2026 15:46:15 +0000

Platform/SRE — Skip
CI/CD — Learn: A pre-GA feature that intercepts malicious packages at install time on CI runners — worth monitoring for GA so you can evaluate it as a supply-chain hardening layer in your pipelines.
Leader — Learn: Signals maturing vendor-side tooling for supply-chain defense at the package layer; worth tracking as it approaches GA to assess whether it fits your org’s hardening roadmap.
Signals: pre-GA (alpha/beta/RC/preview)

Dependabot adds support for npm 12, pnpm 11/12, and Bun 1.4

Tue, 20 Oct 2026 15:29:56 +0000

Platform/SRE — Skip
CI/CD — Plan: If your pipelines use npm 12, pnpm 11/12, or Bun 1.4, you can now upgrade those package managers without losing Dependabot coverage — schedule the version bumps in your lockfiles and CI configs this quarter.
Leader — Skip