GitHub App Tokens Grew. Check the Whole Path.
GitHub’s 2 October notice says its stateless installation-token rollout is complete. New eligible ghs_ tokens vary around 520 characters, up from 40. Permissions, repository scope, one-hour expiry and the issuance endpoint are unchanged.
Follow the token
Check validators, storage, proxy headers and masking. Fixed 40-character rules may reject, truncate or fail to redact the new form. These are risks to test, not reported failures or a disclosed leak.
Keep the scope and deadline clear
GitHub’s April notice covers Enterprise Cloud and Data Residency, includes Actions GITHUB_TOKEN and excludes Enterprise Server. It says clients must treat the JWT as opaque. GitHub will stop respecting the temporary X-GitHub-Stateless-S2S-Token header after 30 November 2026 and advises removing it after validating both formats.
GitHub’s token guide still describes a staged rollout. Its newer changelog establishes completion.
