GitHub Upgrade – 3.10.2

On 23 October 2023 beginning at 5:00 PM EST, we will be taking the github.ncsu.edu service offline for an upgrade.

During the outage no one will be able to login or interact with the service in any way.

We do not expect the upgrade to take more than the scheduled period. In the event that more time is needed, we will update the service portal with that information.

This list of changes is not exhaustive. See GitHub’s Enterprise Release Notes for a complete changelog.

Features

• Authentication
  • To help users access resources more securely, fine-grained personal access tokens are available in public beta. For more information, see “Managing your personal access tokens.”
  • Users can create fine-grained personal access tokens with access to their personal repositories or, if permitted, organization-owned repositories.
  • Organization and enterprise owners can enable or disable the use of fine-grained personal access tokens in organization-owned repositories, and can use the REST API or GraphQL API to manage tokens in their organizations.
  • Users creating fine-grained tokens for an organization can add the pre-receive hooks permission to allow managing pre-receive hooks. For more information, see “Managing pre-receive hooks on your instance.”

• GitHub Advanced Security
  • To find vulnerabilities in specific parts of a project, users with write access to a repository can filter code scanning alerts by language or by file path by using the search queries language: and path:. For more information, see “Managing code scanning alerts for your repository.”
  • To help repository administrators and security managers quickly enable automatic code scanning without needing to configure a workflow, default setup for code scanning supports compiled languages including Go, Java, and C. Default setup is now available for all languages supported by CodeQL, except Swift. For more information, see “CodeQL code scanning for compiled languages” and Supported languages and frameworks in the CodeQL documentation.
  • Repository administrators and security managers can choose which languages to include or exclude in default setup for code scanning. For more information, see “Configuring default setup for code scanning.”
  • To improve analysis of C# code, the release of CodeQL included with GitHub Enterprise Server 3.10 can scan projects that include features from C# 11. For more information, see What’s new in C# 11 in the Microsoft documentation. Support for C# 11 is in beta and subject to change. CodeQL can scan projects built with C# 11 features, but does not analyse the code used for C# 11 features themselves.
  • To help users find vulnerabilities in projects for Swift libraries and Apple apps, the release of CodeQL included with GitHub Enterprise Server 3.10 includes support for Swift, up to version 5.8.1, and Xcode, up to version 14.3.1. Support for Swift is in beta and subject to change. Swift analysis is not supported in default setup for code scanning, and requires the advanced setup. For more information, see “Configuring code scanning.”
  • To help identify steps to remediate leaked secrets, repository administrators and security managers can view metadata such as the secret owner, expiration date, and access rights for any active GitHub token leaked in a repository. This feature is in beta and subject to change. For more information, see “Managing alerts from secret scanning.”
  • Repository administrators, security managers, and organization and enterprise owners can view metrics for alerts generated by a specific custom pattern for secret scanning. This feature is in beta and subject to change. For more information, see “Defining custom patterns for secret scanning.”
• Dependabot
  • Dependabot can automatically update the version of Node.js dependencies managed in the pnpm package manager. For more information, see “About Dependabot version updates.”
  • To avoid unnecessary compute cost, Dependabot updates are automatically paused in repositories where there has been no activity on pull requests created by Dependabot for 90 days. For more information about the criteria for Dependabot updates being paused, see “About Dependabot security updates” and “About Dependabot version updates.”
  • To avoid unnecessary compute cost, Dependabot stops automatically rebasing a pull request for version or security updates if the pull request has been open for 30 days.
• Code security
  • In the GitHub Advisory Database, users can search for any historical vulnerability recognized by the National Vulnerability Database. The “Unreviewed advisories” category has been backfilled to include vulnerabilities from previous years. For more information, see “Browsing security advisories in the GitHub Advisory Database.”
  • In the GitHub Advisory Database, users can search for malware advisories by using the query type:malware. Dependabot does not send alerts for malware advisories. For more information, see “Browsing security advisories in the GitHub Advisory Database.”
  • In the GitHub Advisory Database, users can search for advisories for the Hex package manager, including Elixir, Erlang, and more. Dependabot does not send alerts for Hex advisories. For more information, see “Browsing security advisories in the GitHub Advisory Database.”
  • Organization owners, security managers, and users with admin access to a repository can quickly enable or disable security features for a filtered selection of repositories from the “Security coverage” view in an organization’s security overview. This feature is in beta and subject to change. For more information, see “Enabling security features for multiple repositories.”
  • Enterprise owners, organization owners, and security managers can quickly assess adoption of security features and exposure to security vulnerabilities across their enterprise. The enterprise-level “Security coverage” and “Security risk” views in security overview display data for repositories in each organization where the viewer is an organization owner or security manager. These views replace the “Overview” page in the “Code Security” tab for an enterprise. The risk metric for filtering the “Overview” page is no longer available. This feature is in beta and subject to change. For more information, see “About security overview.”
  • Users can find curated security advisories for the Swift ecosystem in the GitHub Advisory Database. For more information, see “About the GitHub Advisory database.”
• GitHub Actions
  • Organization owners can increase instance security by preventing members from creating self-hosted runners at the repository level. For more information, see “Disabling or limiting GitHub Actions for your organization.”
  • Users with admin access to a repository can allow external systems and third-party services to approve or reject deployments across organizations, repositories, and environments by enabling custom deployment protection rules. This feature is in beta and subject to change. For more information, see “Using environments for deployment.”
  • The option to execute custom scripts on a self-hosted runner is no longer is beta. For more information, see “Running scripts before or after a job.”
  • To prevent unnecessary transfer of OIDC tokens between workflows, to fetch an OIDC token generated within a reusable workflow that is outside their enterprise or organization, users must set the id-token permission to write in the workflow or specific job where the reusable workflow is called. For more information, see “Configuring OpenID Connect in cloud providers.”
  • Repository administrators, organization owners, and users with the manage_runners:enterprise scope for enterprises can use the REST API to create ephemeral, just-in-time (JIT) runners that can perform at most one job before being automatically removed from the repository, organization, or enterprise. For more information, see “Security hardening for GitHub Actions.”
• Community experience
  • To improve the accuracy of marked answers in discussions, and reduce the burden on users to duplicate their text to get their answer marked as correct, users can mark threaded replies as the answer to a question.
  • To improve content organization and topic discoverability, GitHub Discussions maintainers can group discussion categories into sections.
• Repositories
  • To prevent unnecessary repository removal, the API for managing the repositories accessible by a GitHub App in your organization has been updated to fail early if the application is currently granted access to all repositories in the organization. This API can only be used to remove a repository when the application has been granted access to an explicit list of repositories. For more information, see “GitHub App installations.”
  • Repository administrators can ensure the security and stability of branches by requiring pull request approval by someone other than the last pusher. For more information, see “About protected branches.”
• Projects
  • Projects is no longer in public beta, and is now considered generally available. For more information, see “About Projects.”
  • To control the amount of work in progress and promote focus, on a board layout, users with admin access to a project can set a recommended limit on the number of items in a column. For more information, see “Customizing the board layout.”
  • To determine the default access rights organization members have to projects where they haven’t been granted individual access, organization owners can set a base role for projects. For more information, see “Managing access to your projects.”
  • To share a pre-configured project with other people in an organization, users with admin access to a project can set the project as a template. This feature is in beta and subject to change. For more information, see “Managing project templates in your organization.”
  • In a table layout, users can select and update multiple cells at once by clicking and dragging or using the Shift or Ctrl/Command key.
• Commits
  • When editing a file in the user interface, users with permission to bypass branch protection rules receive a note if their commit will bypass a rule, with the option to create a new branch instead of committing directly to the protected branch. Previously, the commit was added to the protected branch directly, without indication that a rule was being bypassed.
  • When using git push from the command line, users with permission to bypass branch protection rules receive a note if they have pushed a commit that bypasses a rule. Previously there was no indication after a Git push that branch rules had been bypassed.
• Markdown
  • Users can include mathematical expressions within Markdown by using LaTeX syntax delimited by $ characters and backticks. For more information, see “Writing mathematical expressions.”
• Accessibility
  • To make GitHub inclusive to all developers, GitHub has improved color contrast of the default light and dark themes, making them accessible to all users. These changes were made to Primer, GitHub’s Design System. For more information, see GitHub Accessibility.

Security fixes

• HTTP Strict Transport Security (HSTS) is enabled within the Management Console.
• Packages have been updated to the latest security versions.
• LOW: An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a reopened pull request. To exploit this vulnerability, an attacker would need write access to the repository. This vulnerability was reported via the GitHub Bug Bounty program and was assigned CVE-2023-23766.

Bug fixes

• On an instance with GitHub Actions enabled, scale sets configured at the enterprise level did not appear for use within the instance’s organizations or repositories.

Changes

• Users who use pull requests with protected branches may be affected by the following security measures.
  • Merge commits created locally and pushed to a protected branch are rejected if the contents of the commit differ from the merge commit predicted by GitHub.
  • If the branch protection rule for dismissing stale reviews is active, an approving review is dismissed if the merge base changes after the review was submitted. The merge base is the commit that is the latest common ancestor of the pull request branch and the protected branch.
  • A pull request approval only counts towards the pull request it was submitted for. Previously, approvals were gathered across multiple independent pull requests if the pull request branches pointed to the same commit and targeted the same base branch.
• The PUT and DELETE operations on the /installations/{installation_id}/repositories/{repository_id} endpoint are no longer functional for the management of GitHub App installations. You can add or remove a repository from an app installation using the documented APIs instead. For more information, see “GitHub App installations.”
• On an instance with a GitHub Advanced Security license, to make it easier to assess vulnerabilities to exposed secrets, enterprise owners and organization owners receive a single email with the results of the historical scan for secrets that is performed when secret scanning is first enabled in an organization or enterprise. Previously, secret scanning sent an email for each repository where secrets were detected. For more information, see “About secret scanning.”
• On an instance with a GitHub Advanced Security license, in the “Files changed” view of pull requests, GitHub only displays code scanning alerts for vulnerabilities detected in lines that a pull request has changed. Previously, code scanning displayed all alerts unique to the pull request branch, even if they were unrelated to the changes the pull request introduced.

Deprecations

• Upcoming deprecation of team discussions
  • GitHub will deprecate team discussions for users in GitHub Enterprise Server 3.12. In GitHub Enterprise Server 3.10, a banner appears atop teams’ discussions with information about the deprecation, including a link to tooling to migrate existing team discussions to GitHub Discussions. For more information, see “About team discussions” and “About discussions.”