GHAS-on-GHES-feature-matrix.md

GitHub Advanced Security (GHAS) Feature Matrix

This document helps answer the question "is this GHAS feature available in my version of GitHub Enterprise Server?".

The following tables include notable feature releases for GitHub Advanced Security. Each row represents a feature. The columns in the row indicate the level of support for each supported Enterprise Server release. Are your repositories hosted on github.com? All of these features are already available for you 👍.

Contents

• GitHub Advanced Security (GHAS) Feature Matrix - Contents - How do I read this document?
  • Release notes
  • Secret Protection
  • Code Security
    • Code scanning
    • Dependabot Alerts
    • Dependabot Updates
    • Dependency Review and submission API
  • Security Overview
  • Administration
• Dependencies

How do I read this document?

Each section of this document represents a different capability of the GitHub security features. Each row in the tables represent a different feature of GHAS. The columns indicate if that feature is available in each version of GitHub Enterprise Server.

Cells with ☑️ indicate Public Preview support. ✅ indicates General Availability.

End of life Archive

• 2022 - 2024 GHES 3.4 - GHES 3.13

Release notes

• Releases of GitHub Enterprise Server

Version	3.14	3.15	3.16	3.17	3.18	3.19	3.20
Release date	2024-08-06	2024-11-12	2025-02-25	2025-05-20	2025-10-14	2025-12-09	2026-03-17
Deprecation date	2025-08-27	2025-12-19	2026-03-11	2026-06-03	2026-10-14	2026-12-09	2027-03-17
	Notes	Notes	Notes	Notes	Notes	Notes	Notes

Secret Protection

Secret scanning identifies plain text credentials inside your code repository. Learn more about secret scanning

• Secret scanning documentation
• Secret scanning API documentation

Feature	3.14	3.15	3.16	3.17	3.18	3.19	3.20
Partner pattern count	274	286	289	321	347	370	452
Non-provider patterns	☑️	☑️	✅	✅	✅	✅	✅
User-space secret scanning	✅	✅	✅	✅	✅	✅	✅
Push Protection Bypass	☑️	☑️	✅	✅	✅	✅	✅
Detect secrets leaked in discussions and in pull request titles, bodies, and comments	☑️	✅	✅	✅	✅	✅	✅
Push protection on file upload	☑️	☑️	✅	✅	✅	✅	✅
Audit log events for non-provider patterns	✅	✅	✅	✅	✅	✅	✅
Create a push protection bypass API endpoint	✅	✅	✅	✅	✅	✅	✅
Enabling detection of non-provider patterns for an organization	☑️	✅	✅	✅	✅	✅	✅
REST API endpoint for secret scanning scan history		✅	✅	✅	✅	✅	✅
Delegated alert dismissal for secret scanning				☑️	✅	✅	✅
Secret scanning scan events via audit log and webhooks				✅	✅	✅	✅
Base64-encoded GitHub tokens detection				✅	✅	✅	✅
Push protection bypass requests management via REST API				✅	✅	✅	✅
Free secret risk assessment for organization and security admins					✅	✅	✅
Configurable push protection patterns					✅	✅	✅
Secret scanning in GitHub wikis						✅	✅
REST API first_location_detected and has_more_locations fields						✅	✅
Secret scanning validity checks							✅
Secret scanning alert assignment							✅
Enterprise-level push protection delegated bypass							✅

Code Security

Code Scanning

Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub.

• Code scanning documentation
• Code scanning API documentation

Feature	3.14	3.15	3.16	3.17	3.18	3.19	3.20
CodeQL "toolcache" Version	2.17.6	2.18.4	2.20.3	2.20.7	2.21.4	2.22.4	2.23.9
Kotlin language support	☑️	✅	✅	✅	✅	✅	✅
CodeQL supports Swift programming language	☑️	✅	✅	✅	✅	✅	✅
CodeQL threat models for detecting relevant alerts	☑️	☑️	☑️	✅	✅	✅	✅
Code Scanning merge protection rulesets	☑️	☑️	☑️	✅	✅	✅	✅
CodeQL threat models for default setup	☑️	☑️	☑️	✅	✅	✅	✅
CodeQL model packs for organization/repo	☑️	☑️	☑️	✅	✅	✅	✅
CodeQL can scan Java projects without a build	☑️	☑️	☑️	✅	✅	✅	✅
CodeQL can scan C# projects without a build	☑️	☑️	✅	✅	✅	✅	✅
CodeQL dependency caching for advanced setup		✅	✅	✅	✅	✅	✅
Zstandard archive for CodeQL tools		✅	✅	✅	✅	✅	✅
Delegated alert dismissal for code scanning				☑️	✅	✅	✅
Code scanning alert-related events in audit log				✅	✅	✅	✅
Development section to track code scanning alert resolution progress					✅	✅	✅
CodeQL code scanning to detect security vulnerabilities in GitHub Actions workflows					✅	✅	✅
CodeQL Rust language support						☑️	✅
CodeQL can scan C/C++ projects without a build							✅
Code scanning alert assignment							☑️

Dependabot Alerts

Dependabot alerts tell you that your code depends on a package that is insecure.

• Dependabot alerts documentation
• Dependabot alerts API

Feature	3.14	3.15	3.16	3.17	3.18	3.19	3.20
Dependabot alerts show vulnerable function calls	☑️	☑️	☑️
Dependabot auto-triage rules	✅	✅	✅	✅	✅	✅	✅
Security advisories can use the new CVSS 4.0 schema to calculate a base vulnerability score		✅	✅	✅	✅	✅	✅
Added Exploit Prediction Scoring System (EPSS) to advisories to show estimated probability that a vulnerability will be exploited over the next 30 days		✅	✅	✅	✅	✅	✅
EPSS scores for vulnerability prioritization in Dependabot alerts				✅	✅	✅	✅
Dependabot metrics page for prioritizing security fixes						✅	✅

Dependabot Updates

Feature	3.14	3.15	3.16	3.17	3.18	3.19	3.20
Dependabot supports devcontainer.json files	✅	✅	✅	✅	✅	✅	✅
Dependabot access to Cargo private registries	✅	✅	✅	✅	✅	✅	✅
Dependabot pauses scheduled jobs after 15 failures.	✅	✅	✅	✅	✅	✅	✅
Dependabot grouped security updates	✅	✅	✅	✅	✅	✅	✅
Private registry support for target-branch configuration	✅	✅	✅	✅	✅	✅	✅
Updates support pnpm workspace catalogs		✅	✅	✅	✅	✅	✅
Version updates support .NET SDK in global.json		✅	✅	✅	✅	✅	✅
Dependabot version updates support for bun dependencies				✅	✅	✅	✅
Dependabot version updates support for Docker Compose dependencies				✅	✅	✅	✅
Dependabot version updates support for uv dependencies				✅	✅	✅	✅
Organization administrators can grant Dependabot access to repositories at scale					✅	✅	✅
Dependabot version updates support for Helm dependencies					✅	✅	✅
Custom update frequencies for Dependabot using cron expressions					✅	✅	✅
Dependabot supports Gradle lockfiles						✅	✅
Minimum package age configuration						✅	✅
Cross-ecosystem grouped pull requests						✅	✅
Central management of private registry configurations						✅	✅
Version updates support vcpkg dependencies and Rust toolchain						✅	✅
Dependabot can update private Go modules						✅	✅
Dependabot version updates support for Conda dependencies							✅

Dependency Graph, Dependency Review and snapshot submission API

Dependency review helps you understand dependency changes and the security impact of these changes at every pull request.

• Dependency review docs
• Dependency review API docs

Feature	3.14	3.15	3.16	3.17	3.18	3.19	3.20
SBOM generated for a package now includes the package URL for more packages	✅	✅	✅	✅	✅	✅	✅

Security Overview

Security overview provides high-level summaries of the security status of an organization or enterprise and makes it easy to identify repositories that require intervention.

• Security Overview documentation

Feature	3.14	3.15	3.16	3.17	3.18	3.19	3.20
Enablement trends dashboard is available	✅	✅	✅	✅	✅	✅	✅
Enterprise level secret scanning metrics and enablement trend dashboards	✅	✅	✅	✅	✅	✅	✅
Security overview dashboard group by tool	✅	✅	✅	✅	✅	✅	✅
Security overview dashboard filter by security tool	☑️	✅	✅	✅	✅	✅	✅
CodeQL pull request alerts view		✅	✅	✅	✅	✅	✅
Security overview dashboard adds SAST vulnerabilities summary table			✅	✅	✅	✅	✅
Security overview dashboard adds Prevention metrics alongside Detection and Remediation metrics at both the organization and enterprise levels			✅	✅	✅	✅	✅
Export CSV data from the "CodeQL pull request alerts" view			✅	✅	✅	✅	✅
Security overview dashboard accessibility enhancements			✅	✅	✅	✅	✅

Administration

Security Configurations and Global Settings for Advanced Security configuration and policy enforcement at scale!

Feature	3.14	3.15	3.16	3.17	3.18	3.19	3.20
Enable at scale - security configurations		✅	✅	✅	✅	✅	✅
Enterprise-level security configurations			✅	✅	✅	✅	✅
Security configurations for archived repositories			✅	✅	✅	✅	✅
Advanced filtering for repository selection by security feature status			✅	✅	✅	✅	✅
Security manager role can be assigned directly to individual users			✅	✅	✅	✅	✅
Standalone SKUs for Code Security and Secret Protection				✅	✅	✅	✅
"Not set" option for security configurations						✅	✅
Security configurations support default or advanced CodeQL setup						✅	✅
Enterprise Security Manager role							☑️
Code scanning default setup can override Actions policies							✅

Dependencies

This section calls out the dependencies required to enable GitHub Advanced Security on GitHub Enterprise Server.

Feature	GHAS license required?	GitHub Actions required?	GitHub Connect required?	Documentation	Notes
Security Overview Description Know what needs attention throughout the entire SDLC	No *	No	No	Feature Docs	* Features not needing a GHAS license will still show up
Dependency Graph Description Parse manifest and lock files in your repository	No	No	No	Feature Docs	Enabling this feature will reload some services on the appliance.
Dependabot Alerts Description Know which of ☝️ have open CVEs	No	No	Yes	Feature Docs	GitHub Connect dependency and data transmission details
Dependabot Security Updates Description One-click "enable all" to send PRs updating ☝️	No	Yes	Yes	Feature Docs	Requires a runner with Docker and internet connectivity to open PRs (specs) As of GHES 3.8, will not require internet connectivity if private registry is configured
Dependabot Updates Description Allows Dependabot to process optional updates using ~/.github/dependabot.yml file	No	Yes	Yes	Feature Docs	Same requirements as ☝️ - this just allows the same "non-security" updates using the same flexible configuration file as GitHub.com
Dependency Review Description Inspect dependencies at pull request, blocking merges that add more security vulnerabilities	Yes	Yes	Yes	Feature Docs	Does not require the build to be moved into GitHub Actions, but needs a runner to inspect manifests. Dependency "snapshots" submitted through the dependency submission API for non-default branches are not supported on GitHub Enterprise Server. Checking for licenses is not supported on GitHub Enterprise Server because the API does not return license information.
CodeQL Description Highly accurate static analysis tool, flexible and extensible query language	Yes	No *	No *	Feature Docs	* CodeQL can be installed in your existing build system (directions) and/or be used on GitHub Actions with self-hosted runners (directions) * GitHub Connect is not required, but it makes keeping the CodeQL queries up-to-date easier. * codeql-action-sync-tool is the offline updater without Connect. * Code Scanning default setup requires runners with the code-scanning label applied.
Upload SARIF files from other tools Description View security results from other tools using SARIF file uploads	Yes	No	No	Feature Docs	Many other tools support the SARIF interchange format. This feature provides a single pane of glass into the entire codebase.
Secret scanning Description Look at the present and all history for secrets, including partner patterns and custom regex	Yes	No	No	Feature Docs
Push protection for secrets Description Block commits containing partner patterns and custom regex from GitHub, preventing compromise	Yes	No	No	Feature Docs	Bare metal hypervisors may require an additional CPU flag, as outlined here