GitHub's December 2026 deadlines — Copilot model retirements, ARM32 runners and Dependabot pauses, and what to change now

Key takeaways

• Six GitHub Copilot models stop working on 14 December 2026 across chat, inline edits, agent mode and code completions: Claude Fable 5, Claude Haiku 4.5, Gemini 3.8 Flash, Gemini 4 Argon, Grok 4.6 and Kimi K3 (GitHub changelog).
• Gemini 4 Hydrogen is now generally available in Copilot (13 November) as the named replacement for Gemini 3.8 Flash, on Pro, Pro+, Max, Business and Enterprise plans, billed at provider list pricing under usage-based billing (GitHub changelog).
• GitHub-hosted runners stop running ARM32 jobs on Linux and Windows by 8 December 2026, a knock-on effect of Node 24 not supporting 32-bit ARM (GitHub changelog).
• From 8 December, Dependabot alerts switch off on most repositories with no activity for a year. Alerts are archived, not deleted, and come back on the next push (GitHub changelog).
• None of this is hard to fix, but all of it fails quietly. A pinned model name, a 32-bit build matrix or a "finished" client repo can break or lose its security alerts without anyone being told. Spend an hour this week on the checklist at the end.

1. What changed this week, in one table

GitHub published a cluster of changelog entries between 10 and 13 November 2026. Most are small. Four carry dates that land in December and need action from teams, not just from admins.

Two smaller items from the same week are worth knowing: secret scanning now detects Cloudflare Access service tokens, and issue types and custom fields are now available on personal-account repositories (up to 25 of each), which helps freelancers and small studios who never moved to an organisation account.

2. The Copilot model retirements and their replacements

GitHub's notice lists a suggested successor for each retiring model:

For Business and Enterprise organisations, the replacements are enabled automatically under default model enablement — unless an admin has switched off the global default. If your org turned that off (many Indian enterprises and BFSI teams do, for compliance review), the replacements will not appear until someone approves them in the Copilot model policy. Do that review before 14 December, not after developers start filing tickets.

For individual developers, the risk is in places you set a model once and forgot: a custom chat mode, a Copilot CLI alias, a coding-agent configuration, or an internal tool built on the Copilot SDK that passes a model ID. Search your dotfiles and repos for the six model names.

Kimi K3 users have no announced successor. If you chose it for cost or for long context, test one of the GA alternatives this month so you are not choosing under pressure.

3. Gemini 4 Hydrogen: what GitHub actually says

GitHub describes Hydrogen as Google's latest Flash model, built for fast agentic coding, tool use and multi-step workflows, with better instruction following than Gemini 3.8 Flash. It is available in the model picker across VS Code, Visual Studio, JetBrains IDEs, Xcode, Eclipse, Copilot CLI, the coding agent, the Copilot app, github.com and GitHub Mobile (source).

What the post does not include: benchmarks, latency figures or a per-request price. Billing is "provider list pricing under usage-based billing", so check GitHub's models-and-pricing documentation before you make it a team default. The rollout is gradual, so some seats may not see it for a few days.

A practical way to evaluate it: pick five recent tasks your team did with Gemini 3.8 Flash (a refactor, a test-writing job, a bug fix with a stack trace), rerun them with Hydrogen, and compare accepted-diff rate and how often you had to re-prompt. That tells you more than any leaderboard. Our guide to choosing an LLM for a product uses the same approach.

4. ARM32 builds: who in India is exposed

Most web and SaaS teams can skip this section. It matters for:

• IoT and embedded firms building firmware or agents for older Raspberry Pi models, industrial gateways, POS terminals and set-top boxes that still run 32-bit ARM user space.
• Open-source maintainers whose release matrix includes linux/arm/v7 or armhf artefacts.
• Teams cross-compiling with QEMU on hosted runners to produce 32-bit images.

According to GitHub's notice, hosted runners end ARM32 job execution on both Windows and Linux by 8 December, because the Actions runner moved off Node 20 and Node 24 has no 32-bit ARM build. Your options:

If you ship to Indian retail or manufacturing customers on older hardware, check your device fleet before dropping the target — field devices often outlive their vendor support by years.

5. Dependabot pauses: the quiet security risk

The logic is sensible: a repo nobody has touched in a year probably does not need daily alerts. The trouble is that "untouched code" and "unused code" are not the same thing. Agencies and IT-services firms in India routinely deliver a website or API, hand it over, and never push again — while the code keeps running on the client's server.

From 8 December, GitHub will archive alerts on most such repositories. Repositories under an enforced security configuration, or covered by an enterprise policy that stops admins toggling alerts, keep them on. Any push, or re-enabling alerts in settings, restores them and restarts the one-year clock.

What to do:

1. List repos with no pushes in 12 months (gh repo list <org> --json name,pushedAt and filter).
2. Split them into "archived and not deployed" (fine to let alerts pause) and "still in production" (needs alerts).
3. For production ones, apply an organisation security configuration that enforces Dependabot alerts, or schedule a small quarterly maintenance push — a dependency bump is the useful kind.
4. If you hold client code under an AMC, add this to your service checklist so the client knows who watches their dependencies.

6. A one-hour checklist for this week

GitHub has several more December changes in flight, and its changelog is the only reliable place to track them. Subscribe to it, or put a calendar reminder on 1 December to re-check before the deadlines land.

Running GitHub Actions, Copilot rollouts or client repos across many teams? See how our managed IT services handle CI/CD, patching and dependency monitoring, or read what GitHub's Octoverse 2026 says about India's developer base.