This release contains the following breaking API changes:
- fix!: Resolve inconsistent options for
createandupdateon custom org role (#4075)
BREAKING CHANGE:GetOrgRole,CreateCustomOrgRole, andUpdateCustomOrgRolehave new params and return values. - fix!: Change
idfromint64tostringinActivityService.MarkThreadDone(#4056)
BREAKING CHANGE:ActivityService.MarkThreadDoneacceptsstringidinstead ofint64.
...and the following additional changes:
- chore: Bump version of go-github to v85.0.0 (#4173)
- chore: Update
openapi_operations.yaml(#4172) - security: Reject cross-host redirects to prevent Authorization leak (#4171)
- chore: Improve GitHub Actions workflows lint and testing (#4169)
- chore: Switch legacy redirect handling to new pattern (#4161)
- feat: Add
CodeSecuritytoSecurityAndAnalysis(#4155) - fix: Reject URL path segments containing ".." in all request methods (#4150)
- feat: Refactor repositories download contents (#4153)
- chore: Bump google.org/x/tools to v0.44.0 in /tools (#4168)
- docs: Fix broken blog post link (#4160)
- build(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 in /example (#4156)
- chore: Update openapi_operations.yaml (#4157)
- feat: Remove Google App Engine standard support (#4152)
- feat: Add
DownloadCopilotMetricshelper method (#4149) - docs: Add
apiVersionto GitHub API link (#4147) - chore: Simplify
redundantptrcustom linter (#4148) - docs: Deprecate old Copilot metrics endpoints closed on April 2, 2026 (#4137)
- refactor: Remove redundant
github.Ptrcalls (#4145) - fix: Add missing
Userfields (#4146) - fix: Preserve
Marketplace.Stubbedduring client copy (#4144) - refactor: Simplify array copying (#4143)
- build(deps): Bump golang.org/x/crypto from 0.49.0 to 0.50.0 in /example (#4141)
- build(deps): Bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 in /tools (#4142)
- build(deps): Bump golang.org/x/term from 0.41.0 to 0.42.0 in /example (#4140)
- build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0 in /scrape (#4139)
- build(deps): Bump go.opentelemetry.io/otel to v1.43.0 (#4135)
- fix: Expand
sanitizeURLsecrets redactions (#4126) - build(deps): Bump github.com/alecthomas/kong from 1.14.0 to 1.15.0 in /tools (#4132)
- build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0 in the actions group (#4131)
- feat: Add support for custom names and methods that return structs with multiple
[]*Tfields ingen-iterators.go(#4128) - fix: Limit webhook payload size in
ValidatePayloadFromBody(#4125) - build(deps): Bump codecov/codecov-action from 5.5.3 to 6.0.0 (#4123)
- fix: Synchronize
requestCountin rate limit tests (#4124) - chore: Simplify
generate.shby removinggit worktreeand using generator-based check (#4120) - docs: Improve comments in /examples (#4122)
- chore: Use
golangci-lint-action; removenewreposecretwithlibsodium(#4119) - feat: Add custom image endpoints for GitHub-hosted runners (#4101)
- chore: Cache custom golangci-lint binaries in GHA workflow (#4116)
- build(deps): Bump github.com/ProtonMail/go-crypto from 1.4.0 to 1.4.1 in /example (#4115)
- build(deps): Bump golang.org/x/tools from 0.29.0 to 0.43.0 in /tools/extraneous-new (#4114)
- build(deps): Bump codecov/codecov-action from 5.5.2 to 5.5.3 (#4112)
- build(deps): Bump github.com/golangci/plugin-module-register from 0.1.1 to 0.1.2 in /tools/extraneous-new (#4113)
- build(deps): Bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 in /tools (#4111)
- build(deps): Bump github.com/PuerkitoBio/goquery from 1.11.0 to 1.12.0 in /scrape (#4110)
- chore: Upgrade deps for linters using dependabot (#4107)
- chore: Use
structfield.Settingsincheck-structfield-settings(#4108) - build(deps): Bump google.golang.org/grpc from 1.78.0 to 1.79.3 in /example (#4109)
- chore: Remove unnecessary use of
newand&SomeStruct{}and add newextraneousnewcustom linter (#4106) - feat: Add
NetworkConfigurationIDandHostedRunnersURLto enterprise runner group types (#4099) - feat: Generate accessors for all fields (#4105)
- feat: Add
ListRunnerGroupHostedRunnersfor org runner groups (#4100) - chore: Enable
default: nonelinters; remove duplicated (#4097) - fix: Use
Cursorpagination for*.ListHookDeliveriesIter(#4096) - chore: Remove duplicated formatters (#4094)
- chore: Fix typos in comments and tests (#4093)
- chore: Fix typo in CONTRIBUTING.md (#4092)
- chore: Update openapi_operations.yaml (#4091)
- build(deps): Bump github.com/bradleyfalzon/ghinstallation/v2 from 2.17.0 to 2.18.0 in /example (#4084)
- chore: Bump go.opentelemetry.io/otel to v1.42.0 (#4090)
- build(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0 in /example (#4081)
- build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0 in /tools (#4078)
- build(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0 in /scrape (#4079)
- test: Add fuzz test for
ParseWebHook(#4076) - feat: Add enterprise budgets API (#4069)
- feat: Add list organization fine-grained permissions (#4072)
- feat: Make
script/lint.shoutput simpler to read (#4073) - chore: Speed up linting (#4071)
- build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0 in /otel (#4065)
- build(deps): Bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /otel (#4068)
- build(deps): Bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.40.0 to 1.41.0 in /example (#4062)
- build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.41.0 in /example (#4064)
- build(deps): Bump github.com/ProtonMail/go-crypto from 1.3.0 to 1.4.0 in /example (#4063)
- feat: Add
client_idfield toApp(#4060) - test: Simplify
CopilotServicetests (#4058) - test: Fix flaky
TestDo_rateLimit_abuseRateLimitError_xRateLimitReset(#4057) - feat: Add support for enterprise audit log streaming API (#4035)
- feat: Add repository-level immutable releases settings (#4039)
- chore: Add
SASas a common initialism tostructfield(#4054) - fix: Fix data race on Windows (#4051)
- docs: Fix grammar in
README.md(#4053) - chore: Simplify form value assertions in tests (#4048)
- chore: Bump go-github from v83 to v84 in /scrape (#4050)