The npm security advisory database is now part of the GitHub Advisory Database. As a result, npm audit will now return URLs to the GitHub Advisory Database and the advisories on the npmjs.com will redirect to GitHub.
When a new tag is created, the push webhook payload will now always include a head_commit object that contains the data of the commit that the new tag points to. In other words, the head_commit object will always contain the commit data of the payload's after commit.
Previously, during tag creation, there were certain circumstances where the head_commit would contain the data of a different commit.
Recover Accounts Elsewhere allows a user to store a recovery token with a third-party recovery partner to use as a recovery method when their account is protected by two-factor authentication. Effective immediately, we will no longer be allowing new recovery tokens to be stored using Recover Accounts Elsewhere.
On December 1st, 2021, account recovery tokens stored using Recover Accounts Elsewhere will no longer be accepted as a recovery option when contacting support to recover access to your account. You will still be able to use our other recovery mechanisms to recover your account.
If you have registered an account recovery token using this feature, we recommend you take this opportunity to download your two-factor recovery codes. You can also revoke your recovery tokens using these steps:
We'll be sending occasional email notifications throughout the deprecation period to all users with recovery tokens registered.
Questions? Take a look at our updated documentation on account recovery, or contact GitHub Support.