Repo sync

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
 # Update ARG and FROM together from the Node devcontainer image tags:
 # https://mcr.microsoft.com/en-us/product/devcontainers/javascript-node/tags
-ARG VARIANT=dev-24-bookworm
-FROM mcr.microsoft.com/devcontainers/javascript-node:dev-24-bookworm@sha256:42a1a7629b5a2c22c759a1de4fbb277c9e600b6fecd66b89583fc36e9453e698
+ARG VARIANT=dev-26-bookworm
+FROM mcr.microsoft.com/devcontainers/javascript-node:dev-26-bookworm@sha256:50273c54d771adc1599a5c08ba849b4f65de1df8d8040fee3a11e8640c500d31

.devcontainer/devcontainer.json

@@ -5,8 +5,8 @@
   "name": "docs.github.com",
   "build": {
     "dockerfile": "Dockerfile",
-    // Update 'VARIANT' to pick a Node version
-    "args": { "VARIANT": "24" }
+    // The pinned FROM image in .devcontainer/Dockerfile picks the Node version. Keep VARIANT in sync.
+    "args": { "VARIANT": "26" }
   },
 
   // Install features. Type 'feature' in the VS Code command palette for a full list.

Dockerfile

@@ -15,11 +15,11 @@ RUN --mount=type=secret,id=pkg-mirror-host,target=/etc/pkg_mirror_host.txt \
   if [ -f /etc/pkg_mirror_host.txt ]; then cat /etc/pkg_mirror_host.txt >> /etc/apt/mirrorlist.txt; fi
 RUN --mount=type=secret,id=apt-auth-conf,target=/etc/apt/auth.conf.d/apt_auth.conf \
   apt-get -qq update && apt-get -qq install --no-install-recommends curl git \
-  && curl -sL https://deb.nodesource.com/setup_24.x | bash - \
+  && curl -sL https://deb.nodesource.com/setup_26.x | bash - \
   && apt-get install -y nodejs \
   && node --version
-# Fail the build if the NodeSource snapshot predates Node 24.22.1 (CVE-2026-111497 brotli decoder fix).
-RUN node -e 'const [maj, min, pat] = process.versions.node.split(".").map(Number); if (maj !== 24 || min < 22 || (min === 22 && pat < 1)) { throw new Error("Node >= 24.22.1 required (brotli CVE-2026-111497), got " + process.versions.node); }'
+# Fail the build unless NodeSource installed Node 26.x at 26.12.1 or later (CVE-2026-111497 brotli decoder fix).
+RUN node -e 'const [maj, min, pat] = process.versions.node.split(".").map(Number); if (maj !== 26 || min < 12 || (min === 12 && pat < 1)) { throw new Error("Node 26.x >= 26.12.1 required (brotli CVE-2026-111497), got " + process.versions.node); }'
 # Stages built FROM base inherit this ARG, so every later stage can use APP_HOME.
 ARG APP_HOME="/home/node/app"
 RUN useradd -ms /bin/bash node \

Dockerfile.openapi_decorator

@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:7d042bda1f5999f5bd14a23e9e62d9c320cceb68f93f167ce01ca3ecbd9cef71
+FROM node:26-alpine@sha256:40cd011b55415bc894e45b02fdd5a5dfde056921b7d23a64c74f80497af48797
 
 WORKDIR /openapi-check
 

content/get-started/learning-about-github/about-github-code-quality.md

@@ -0,0 +1,41 @@
+---
+title: About GitHub Code Quality
+intro: 'Decide whether {% data variables.product.prodname_code_quality %} meets your team''s needs, how it complements other {% data variables.product.github %} products, and what to consider before purchasing.'
+product: '{% data reusables.gated-features.code-quality-availability %}'
+versions:
+  feature: code-quality
+shortTitle: GitHub Code Quality
+category:
+  - Explore GitHub plans and features
+---
+
+## About {% data variables.product.prodname_code_quality %}
+
+{% data variables.product.prodname_code_quality %} analyzes your code for quality and coverage issues using {% data variables.product.prodname_codeql %} rules and AI-powered analysis.
+
+* On pull requests, findings appear as inline comments with one-click {% data variables.product.prodname_copilot_short %}-powered fixes, so new quality debt doesn't accumulate before code is merged.
+* On your default branch, scans surface existing quality debt. You can apply autofixes directly, or delegate remediation to {% data variables.copilot.copilot_cloud_agent %}.
+
+You can enforce quality thresholds with rulesets to block pull requests that don't meet your team's standards. To also enforce line coverage thresholds, upload a Cobertura XML coverage report from your tests.
+
+To purchase {% data variables.product.prodname_code_quality %}, see {% data variables.product.pricing_link %}. For more information, including supported languages, see [AUTOTITLE](/code-security/concepts/code-quality/code-quality).
+
+## How {% data variables.product.prodname_code_quality_short %} fits with other {% data variables.product.github %} products
+
+{% data variables.product.prodname_code_quality_short %} is purchased separately from {% data variables.product.prodname_GHAS %} and {% data variables.product.prodname_copilot_short %}. It focuses on metrics related to code quality, such as code coverage. {% data variables.product.prodname_GHAS %} products focus on security, and {% data variables.copilot.copilot_code-review_short %} provides AI-powered feedback on pull requests.
+
+{% data variables.product.prodname_code_quality_short %} enforces deterministic quality and coverage rules that you can use to block merges, while {% data variables.copilot.copilot_code-review_short %} gives broader, conversational AI feedback. Many teams use both: {% data variables.copilot.copilot_code-review_short %} for general review, and {% data variables.product.prodname_code_quality_short %} for enforceable standards.
+
+## Costs to consider
+
+Before purchasing {% data variables.product.prodname_code_quality_short %}, consider these costs:
+
+* A per-active-committer fee for repositories where it's enabled
+* {% data variables.product.prodname_actions %} minutes for scans, unless you use self-hosted runners
+* {% data variables.product.prodname_ai_credits %} for {% data variables.product.prodname_copilot_short %}-powered fixes and AI-powered detections (no {% data variables.product.prodname_copilot_short %} license required)
+
+For more information, see [AUTOTITLE](/billing/concepts/product-billing/github-code-quality).
+
+## Next steps
+
+To start using {% data variables.product.prodname_code_quality_short %}, see [AUTOTITLE](/code-security/how-tos/maintain-quality-code/enable-code-quality).

content/get-started/learning-about-github/githubs-plans.md

@@ -89,7 +89,7 @@ In addition to the features available with {% data variables.product.prodname_fr
   For more information, see [AUTOTITLE](/get-started/learning-about-github/about-github-advanced-security).
 
 {% ifversion fpt or ghec %}
-* The option to purchase {% data variables.product.prodname_code_quality %}, which helps teams find and fix code quality and coverage issues. For more information, see [AUTOTITLE](/code-security/concepts/code-quality/code-quality).
+* The option to purchase {% data variables.product.prodname_code_quality %}, which helps teams find and fix code quality and coverage issues. For more information, see [AUTOTITLE](/get-started/learning-about-github/about-github-code-quality).
 {% endif %}
 
 * Advanced tools and insights in private repositories:

content/get-started/learning-about-github/index.md

@@ -14,6 +14,7 @@ children:
   - /types-of-github-accounts
   - /access-permissions-on-github
   - /about-github-advanced-security
+  - /about-github-code-quality
   - /faq-about-changes-to-githubs-plans
   - /github-glossary
 ---

contributing/node-versions.md

@@ -4,9 +4,11 @@ This site will run on the Node.js version specified in `package.json`.
 
 When updating to a new Node.js version, consider the following files:
 
-- [ ] The `engines.node` entry in `package.json`
+- [ ] The `engines.node` entry in `package.json` and `package-lock.json`
 - [ ] The `.github/workflows/*.yml` Actions files that pin a Node version (grep for `node-version`)
-- [ ] The `Dockerfile` that can be used for deployments
+- [ ] The `Dockerfile` that can be used for deployments, including its minimum Node version check
+- [ ] The `.devcontainer/Dockerfile` and `.devcontainer/devcontainer.json` files
+- [ ] The `Dockerfile.openapi_decorator` file
 - [ ] The `contributing/development.md` guide
 - [ ] The `contributing/node-versions.md` file