GitHub’s October 29 changelog says the Meta API now includes webhook-delivery IP ranges in its hooks field. That is an operationally useful change for systems that only accept inbound webhook traffic from specified network ranges.
If an integration you maintain uses a static firewall allowlist for GitHub webhooks, check the official API data against its current rules. If you rely on webhook signatures and a managed ingress without IP allowlisting, there may be no action to take. This is a conditional maintenance task, not a universal emergency.
For a future client integration, prefer signature verification as a core authenticity check, with network controls as a supplement. Document how your service refreshes published IP ranges so the allowlist does not silently age out.
Go to Source — [github.blog](https://github.blog/changelog/month/10-2026/) https://github.blog/changelog/month/10-2026/