If your CI pipeline or security tooling makes a pre-flight call to GET /rate_limit before uploading a SARIF file to GitHub, May 19, 2026 is your deadline. GitHub is removing the code_scanning_upload object from the response. Eleven days of runway from this article.

The headline change is small: one key disappears from a JSON response. The interesting part is what was actually inside that key — and the silent decision your gating logic has been making since you wrote it.

The exact shape change

Today, GET /rate_limit returns this under resources (truncated to the relevant keys):

{ "resources" : { "core" : { "limit" : 5000 , "used" : 1 , "remaining" : 4999 , "reset" : 1372700873 }, "code_scanning_upload" : { "limit" : 5000 , "used" : 1 , "remaining" : 4999 , "reset" : 1372700873 } } }

Enter fullscreen mode

Exit fullscreen mode

Starting May 19, 2026:

{ "resources" : { "core" : { "limit" : 5000 , "used" : 1 , "remaining" : 4999 , "reset" : 1372700873 } } }

Enter fullscreen mode

Exit fullscreen…