📌 Security Releases Bulletin – June 2025 Edition #164345
Replies: 15 comments 7 replies
|
Thanks, saya sangat menunggu rilis terbaru ini. |
|
I love you |
|
I don't understand how so many tainted folders and files from the July 4th attack are still all over and passing as sha25y secured there are 8 million fake nodes that I know of alone |
|
SHA256 MD5 virus de chat gpt chat gemini spoily inventeur efface travaux et chage le repo sur machine apres activation du virus SHA 256 quii se faait passe pour un hash alert alert piege virur gemii et chat gpt pille inventer 4500 brevet sr mon pc disparut au eovit des gafamma geurre mondail est numerique $ |
|
🤧 |
|
Some really useful updates this month. The release asset digests are a big win for supply chain trust, checking binaries during malware analysis gets a lot simpler when the digest is exposed up front. The build-free CodeQL for C/C++ also stands out; most orgs have legacy code that never gets scanned because builds are painful, so this should help close a real gap. On the defensive side, the new MTTR metrics and better CodeQL insights are practical for tracking how fast teams actually respond. And bringing attestations into Kubernetes admission policies makes sense, it raises the bar for anyone trying to slip in tampered workloads. Overall, these feel like changes that hit real pain points we see in the field. |
|
Really appreciate the feedback, thanks for reading @marcostolosa! |
This comment was marked as spam.
This comment was marked as spam.
|
Emperor Knud Rules |
|
Suerte cn el proyecto¿ |
|
Hi @1percentspeed-collab and @PabloMultimediaPerez, thanks for participating! Unfortunately, we don’t currently have moderators for languages other than English. Until that changes, we need to ask that everyone use English here in the GitHub Community when posting to ensure discussions are adhering to our Code of Conduct. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
👋 Hey Security Community!
Welcome to the June 2025 edition of the Code Security Release Bulletin! Each month we’ll provide a roundup of the latest security-focused updates, enhancements, and product releases across GitHub’s security ecosystem.
June brought a wave of security updates designed to solve longstanding pain points, empower teams to work safer and smarter, and reflect the feedback we’ve heard from you—our community. This isn’t just a list of fixes: it’s a set of tools and enhancements that help you do your best work, with confidence in your supply chain and application security.
Releases from this Month
Organization-Level Dependabot Access
You can now grant organization-wide access to Dependabot, making onboarding new repositories effortless.
Custom Roles for Secret Scanning Alert Dismissal
Delegate and review secret alert dismissals using custom roles—because security workflows should fit your team, not the other way around.
Release Asset Digests for Supply Chain Trust
You can now verify the integrity of every release asset with exposed cryptographic digests.
Build-Free CodeQL for C/C++
Enable static analysis for C/C++ repositories at scale, without the build headaches.
Enhanced CodeQL Metrics & Copilot Autofixes
See the impact of your security work with improved metrics and actionable insights.
Private Registries for Go CodeQL Scans
Scan Go dependencies from private registries—your analysis is now as comprehensive as your codebase.
Delegated Alert Dismissal for Secret Protection (GA)
Empower teams to act quickly on secret scanning alerts, while maintaining centralized visibility.
CodeQL: Broader Language Support
Swift 6.1.1 & 6.1.2 and improved Go coverage are now available for CodeQL scans.
Mean Time to Remediate Metric for CodeQL PR Alerts
Understand and improve your team’s response times with actionable “mean time to remediate” metrics, now in the security dashboard.
Dependency Graph Defaults to Off for New Public Repos
You have more control over your supply chain data—dependency graphs are now opt-in for new public repositories.
Dependabot Compute Migration to GitHub Actions (Upcoming)
Dependabot’s compute is moving to GitHub Actions, paving the way for deeper integration and scalability.
Enforce Kubernetes Admission Policies with Artifact Attestations
Bring supply chain security into your Kubernetes clusters with OPA Gatekeeper integration.
Dependabot Metrics Page (Private Preview)
Prioritize vulnerabilities more effectively with the new Dependabot metrics page (private preview for GHA security users).
Dependabot Support for Gradle Lockfiles (GA)
Automate dependency updates for Java projects using Gradle lockfiles, now fully supported.
Secret Scanning REST API Improvements (GA)
New API fields give you more context and control when responding to leaked secrets.
Configurable Secret Scanning Patterns for Push Protection (Public Preview)
Fine-tune which secrets are blocked on push, striking the right balance for your workflows.
Closing Thoughts
Every update this month started with a user story—a challenge you shared, a bottleneck you flagged, or a new way you wanted to work. With each release, our goal is to build a safer, more empowering developer experience. As always, your feedback shapes what comes next. Thank you for being part of this journey.
What problem can we help you solve next? Let us know.
Join the Discussion!
We value your feedback! Join us here in the Code Security Community to discuss these releases, ask questions, and stay informed on the latest security updates. You can click on the release that interests you or comment down below!
Thanks for keeping up with GitHub Code Security! Stay secure and happy coding! 🚀🔐
🔗 github.com/security | 🔗 The Changelog | 🔗 The GitHub Blog - Security
All reactions