The Wayback Machine - https://web.archive.org/web/20250221122930/https://github.blog/changelog/2025-02-20-copilot-autofix-is-available-for-more-code-scanning-alerts/

Copilot Autofix is available for more code scanning alerts

Copilot Autofix helps you fix code scanning alerts and avoid introducing new security vulnerabilities by using large language models to suggest potential fixes.

We recently expanded the range of CodeQL security alerts where Copilot can suggest an autofix, covering a group that accounts for 29% of all CodeQL alerts. This expansion led to an 8% overall increase in alerts with an available autofix and a 270% increase in autofixes for this specific group of improved alerts. With more autofix suggestions, you can resolve security issues identified by CodeQL more easily—either by applying Copilot’s suggested fix directly or using it as a starting point for your own edits.

We made these improvements by analyzing our usage data to understand the most common types of alerts where Copilot was not suggesting fixes and then made a targeted effort to improve autofix for these alerts. Read more about the testing process that GitHub uses to identify the quality of autofix suggestions.

We continuously evaluate the performance of CodeQL and Copilot Autofix, so look for more improvements in the future.

Boost your productivity with GitHub Copilot in JetBrains IDEs, Introducing @project context, AI-generated commit messages, and other updates

We are excited to announce that the GitHub Copilot plugin now supports the use of @project in JetBrains IDEs! This feature allows you to ask questions about your entire codebase. Additionally, we also introduce our support for generating commit messages with AI and other enhancements.

What’s new ✨

  • @project context: Ask questions about your entire project and get intelligent references to relevant files and symbols.
  • Commit message with AI: Generate meaningful and consistent commit messages with the help of GitHub Copilot in JetBrains.
  • Enhanced user experience: Enjoy a more efficient and user-friendly experience.

Benefits for developers ⚡️

  • Better context understanding: @project allows you to get detailed answers with links and code examples from your entire project. This helps you find existing code, understand how certain functionalities are implemented, and locate utilities or methods efficiently.
  • Improved source control: With Git commit message support, GitHub Copilot helps you create informative and standardized commit messages, improving efficiency and enhancing overall productivity.

Get Involved 🛠

We encourage you to try out the latest version of the GitHub Copilot plugin and share your feedback. Your input is invaluable in helping us refine and improve the product.

Join the discussion 🚀

Connect with us and other developers in the GitHub Community to share your experiences, ask questions, and provide feedback.

See more

Dependabot helps users focus on the most important alerts by including EPSS scores that indicate likelihood of exploitation, now generally available

Dependabot alerts now feature the Exploit Prediction Scoring System (EPSS) from the global Forum of Incident Response and Security Teams (FIRST), helping you better assess vulnerability risks.

EPSS scores predict the likelihood of a vulnerability being exploited, with scores ranging from 0 to 1 (0 to 100%). Higher scores mean higher risk. We also show the EPSS score percentile, indicating how a vulnerability compares to others.

For example, a 90.534% EPSS score at the 95th percentile means:

  • 90.534% chance of exploitation in the next 30 days
  • 95% of other vulnerabilities are less likely to be exploited

You can use EPSS scores to help prioritize dependency vulnerabilities based on exploit likelihood.

This feature is available on GitHub.com today, and will be available in GitHub Enterprise Server staring with version 3.17.

Learn more in FIRST’s EPSS User Guide.
Join the discussion within GitHub Community.
Read more about viewing, sorting, and filtering Dependabot alerts in GitHub’s Dependabot docs.

See more
View all changes