diff --git a/descriptions-next/api.github.com/api.github.com.2022-11-28.json b/descriptions-next/api.github.com/api.github.com.2022-11-28.json
index de55d89175..cc0ee5928c 100644
--- a/descriptions-next/api.github.com/api.github.com.2022-11-28.json
+++ b/descriptions-next/api.github.com/api.github.com.2022-11-28.json
@@ -136,6 +136,10 @@
       "name": "users",
       "description": "Interact with and view information about users and also current user."
     },
+    {
+      "name": "code-quality",
+      "description": "Insights into reliability, maintainability, and efficiency of your codebase."
+    },
     {
       "name": "codespaces",
       "description": "Endpoints to manage Codespaces using the REST API."
@@ -10849,6 +10853,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -33934,6 +33942,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for this repository. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -65024,6 +65036,18 @@
                   },
                   "assignee": {
                     "$ref": "#/components/schemas/secret-scanning-alert-assignee"
+                  },
+                  "validity": {
+                    "type": [
+                      "string",
+                      "null"
+                    ],
+                    "enum": [
+                      "active",
+                      "inactive",
+                      null
+                    ],
+                    "description": "Sets the validity of the secret scanning alert. Can be `active`, `inactive`, or `null` to clear the override."
                   }
                 },
                 "anyOf": [
@@ -65090,7 +65114,7 @@
             "description": "Repository is public, or secret scanning is disabled for the repository, or the resource is not found"
           },
           "422": {
-            "description": "State does not match the resolution or resolution comment, or assignee does not have write access to the repository"
+            "description": "State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert"
           },
           "503": {
             "$ref": "#/components/responses/service_unavailable"
@@ -115573,6 +115597,10 @@
             "items": {
               "type": "string"
             }
+          },
+          "use_immutable_subject": {
+            "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+            "type": "boolean"
           }
         },
         "required": [
@@ -127712,6 +127740,14 @@
             "items": {
               "type": "string"
             }
+          },
+          "use_immutable_subject": {
+            "description": "Whether the repository has opted in to the immutable OIDC subject claim format. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim. If not set at the repository level, falls back to the organization-level setting.",
+            "type": "boolean"
+          },
+          "sub_claim_prefix": {
+            "description": "The current `sub` claim prefix for this repository.",
+            "type": "string"
           }
         },
         "required": [
diff --git a/descriptions-next/api.github.com/api.github.com.2022-11-28.yaml b/descriptions-next/api.github.com/api.github.com.2022-11-28.yaml
index 7110b44bfd..93a2df4b6c 100644
--- a/descriptions-next/api.github.com/api.github.com.2022-11-28.yaml
+++ b/descriptions-next/api.github.com/api.github.com.2022-11-28.yaml
@@ -73,6 +73,9 @@ tags:
   description: Interact with GitHub Teams.
 - name: users
   description: Interact with and view information about users and also current user.
+- name: code-quality
+  description: Insights into reliability, maintainability, and efficiency of your
+    codebase.
 - name: codespaces
   description: Endpoints to manage Codespaces using the REST API.
 - name: copilot
@@ -7777,6 +7780,12 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for the organization. When `true`, new OIDC tokens will
+                    use a stable, repository-ID-based `sub` claim instead of the name-based
+                    format.
+                  type: boolean
             examples:
               default:
                 "$ref": "#/components/examples/oidc-custom-sub"
@@ -24731,6 +24740,11 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for this repository. When `true`, OIDC tokens will use
+                    a stable, repository-ID-based `sub` claim.
+                  type: boolean
             examples:
               default:
                 value:
@@ -47239,6 +47253,16 @@ paths:
                   "$ref": "#/components/schemas/secret-scanning-alert-resolution-comment"
                 assignee:
                   "$ref": "#/components/schemas/secret-scanning-alert-assignee"
+                validity:
+                  type:
+                  - string
+                  - 'null'
+                  enum:
+                  - active
+                  - inactive
+                  - 
+                  description: Sets the validity of the secret scanning alert. Can
+                    be `active`, `inactive`, or `null` to clear the override.
               anyOf:
               - required:
                 - state
@@ -47277,7 +47301,8 @@ paths:
             repository, or the resource is not found
         '422':
           description: State does not match the resolution or resolution comment,
-            or assignee does not have write access to the repository
+            assignee does not have write access to the repository, or the requested
+            validity change could not be applied to this alert
         '503':
           "$ref": "#/components/responses/service_unavailable"
       x-github:
@@ -83667,6 +83692,11 @@ components:
           type: array
           items:
             type: string
+        use_immutable_subject:
+          description: Whether to opt in to the immutable OIDC subject claim format
+            for the organization. When `true`, new OIDC tokens will use a stable,
+            repository-ID-based `sub` claim instead of the name-based format.
+          type: boolean
       required:
       - include_claim_keys
     empty-object:
@@ -92753,6 +92783,15 @@ components:
           type: array
           items:
             type: string
+        use_immutable_subject:
+          description: Whether the repository has opted in to the immutable OIDC subject
+            claim format. When `true`, OIDC tokens will use a stable, repository-ID-based
+            `sub` claim. If not set at the repository level, falls back to the organization-level
+            setting.
+          type: boolean
+        sub_claim_prefix:
+          description: The current `sub` claim prefix for this repository.
+          type: string
       required:
       - use_default
     actions-secret:
diff --git a/descriptions-next/api.github.com/api.github.com.2026-03-10.json b/descriptions-next/api.github.com/api.github.com.2026-03-10.json
index 54b6fd9178..4c8f5aad5c 100644
--- a/descriptions-next/api.github.com/api.github.com.2026-03-10.json
+++ b/descriptions-next/api.github.com/api.github.com.2026-03-10.json
@@ -136,6 +136,10 @@
       "name": "users",
       "description": "Interact with and view information about users and also current user."
     },
+    {
+      "name": "code-quality",
+      "description": "Insights into reliability, maintainability, and efficiency of your codebase."
+    },
     {
       "name": "codespaces",
       "description": "Endpoints to manage Codespaces using the REST API."
@@ -10848,6 +10852,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -33885,6 +33893,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for this repository. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -37425,7 +37437,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Response including the workflow run ID and URLs when `return_run_details` parameter is `true`.",
+            "description": "Response including the workflow run ID and URLs.",
             "content": {
               "application/json": {
                 "schema": {
@@ -64935,6 +64947,18 @@
                   },
                   "assignee": {
                     "$ref": "#/components/schemas/secret-scanning-alert-assignee"
+                  },
+                  "validity": {
+                    "type": [
+                      "string",
+                      "null"
+                    ],
+                    "enum": [
+                      "active",
+                      "inactive",
+                      null
+                    ],
+                    "description": "Sets the validity of the secret scanning alert. Can be `active`, `inactive`, or `null` to clear the override."
                   }
                 },
                 "anyOf": [
@@ -65001,7 +65025,7 @@
             "description": "Repository is public, or secret scanning is disabled for the repository, or the resource is not found"
           },
           "422": {
-            "description": "State does not match the resolution or resolution comment, or assignee does not have write access to the repository"
+            "description": "State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert"
           },
           "503": {
             "$ref": "#/components/responses/service_unavailable"
@@ -115009,6 +115033,10 @@
             "items": {
               "type": "string"
             }
+          },
+          "use_immutable_subject": {
+            "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+            "type": "boolean"
           }
         },
         "required": [
@@ -127072,6 +127100,14 @@
             "items": {
               "type": "string"
             }
+          },
+          "use_immutable_subject": {
+            "description": "Whether the repository has opted in to the immutable OIDC subject claim format. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim. If not set at the repository level, falls back to the organization-level setting.",
+            "type": "boolean"
+          },
+          "sub_claim_prefix": {
+            "description": "The current `sub` claim prefix for this repository.",
+            "type": "string"
           }
         },
         "required": [
diff --git a/descriptions-next/api.github.com/api.github.com.2026-03-10.yaml b/descriptions-next/api.github.com/api.github.com.2026-03-10.yaml
index 16ab777d1b..fbf005b54f 100644
--- a/descriptions-next/api.github.com/api.github.com.2026-03-10.yaml
+++ b/descriptions-next/api.github.com/api.github.com.2026-03-10.yaml
@@ -73,6 +73,9 @@ tags:
   description: Interact with GitHub Teams.
 - name: users
   description: Interact with and view information about users and also current user.
+- name: code-quality
+  description: Insights into reliability, maintainability, and efficiency of your
+    codebase.
 - name: codespaces
   description: Endpoints to manage Codespaces using the REST API.
 - name: copilot
@@ -7775,6 +7778,12 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for the organization. When `true`, new OIDC tokens will
+                    use a stable, repository-ID-based `sub` claim instead of the name-based
+                    format.
+                  type: boolean
             examples:
               default:
                 "$ref": "#/components/examples/oidc-custom-sub"
@@ -24693,6 +24702,11 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for this repository. When `true`, OIDC tokens will use
+                    a stable, repository-ID-based `sub` claim.
+                  type: boolean
             examples:
               default:
                 value:
@@ -27191,8 +27205,7 @@ paths:
       - "$ref": "#/components/parameters/workflow-id"
       responses:
         '200':
-          description: Response including the workflow run ID and URLs when `return_run_details`
-            parameter is `true`.
+          description: Response including the workflow run ID and URLs.
           content:
             application/json:
               schema:
@@ -47165,6 +47178,16 @@ paths:
                   "$ref": "#/components/schemas/secret-scanning-alert-resolution-comment"
                 assignee:
                   "$ref": "#/components/schemas/secret-scanning-alert-assignee"
+                validity:
+                  type:
+                  - string
+                  - 'null'
+                  enum:
+                  - active
+                  - inactive
+                  - 
+                  description: Sets the validity of the secret scanning alert. Can
+                    be `active`, `inactive`, or `null` to clear the override.
               anyOf:
               - required:
                 - state
@@ -47203,7 +47226,8 @@ paths:
             repository, or the resource is not found
         '422':
           description: State does not match the resolution or resolution comment,
-            or assignee does not have write access to the repository
+            assignee does not have write access to the repository, or the requested
+            validity change could not be applied to this alert
         '503':
           "$ref": "#/components/responses/service_unavailable"
       x-github:
@@ -83249,6 +83273,11 @@ components:
           type: array
           items:
             type: string
+        use_immutable_subject:
+          description: Whether to opt in to the immutable OIDC subject claim format
+            for the organization. When `true`, new OIDC tokens will use a stable,
+            repository-ID-based `sub` claim instead of the name-based format.
+          type: boolean
       required:
       - include_claim_keys
     empty-object:
@@ -92283,6 +92312,15 @@ components:
           type: array
           items:
             type: string
+        use_immutable_subject:
+          description: Whether the repository has opted in to the immutable OIDC subject
+            claim format. When `true`, OIDC tokens will use a stable, repository-ID-based
+            `sub` claim. If not set at the repository level, falls back to the organization-level
+            setting.
+          type: boolean
+        sub_claim_prefix:
+          description: The current `sub` claim prefix for this repository.
+          type: string
       required:
       - use_default
     actions-secret:
diff --git a/descriptions-next/api.github.com/api.github.com.json b/descriptions-next/api.github.com/api.github.com.json
index 86ae92e21e..61a53e103c 100644
--- a/descriptions-next/api.github.com/api.github.com.json
+++ b/descriptions-next/api.github.com/api.github.com.json
@@ -136,6 +136,10 @@
       "name": "users",
       "description": "Interact with and view information about users and also current user."
     },
+    {
+      "name": "code-quality",
+      "description": "Insights into reliability, maintainability, and efficiency of your codebase."
+    },
     {
       "name": "codespaces",
       "description": "Endpoints to manage Codespaces using the REST API."
@@ -10895,6 +10899,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -34146,6 +34154,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for this repository. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -37761,6 +37773,11 @@
               {
                 "op": "remove",
                 "path": "/requestBody/content/application~1json/schema/properties/return_run_details"
+              },
+              {
+                "op": "replace",
+                "path": "/responses/200/description",
+                "value": "Response including the workflow run ID and URLs."
               }
             ],
             "version": "2026-03-10"
@@ -65326,6 +65343,18 @@
                   },
                   "assignee": {
                     "$ref": "#/components/schemas/secret-scanning-alert-assignee"
+                  },
+                  "validity": {
+                    "type": [
+                      "string",
+                      "null"
+                    ],
+                    "enum": [
+                      "active",
+                      "inactive",
+                      null
+                    ],
+                    "description": "Sets the validity of the secret scanning alert. Can be `active`, `inactive`, or `null` to clear the override."
                   }
                 },
                 "anyOf": [
@@ -65392,7 +65421,7 @@
             "description": "Repository is public, or secret scanning is disabled for the repository, or the resource is not found"
           },
           "422": {
-            "description": "State does not match the resolution or resolution comment, or assignee does not have write access to the repository"
+            "description": "State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert"
           },
           "503": {
             "$ref": "#/components/responses/service_unavailable"
@@ -116320,6 +116349,10 @@
             "items": {
               "type": "string"
             }
+          },
+          "use_immutable_subject": {
+            "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+            "type": "boolean"
           }
         },
         "required": [
@@ -128718,6 +128751,14 @@
             "items": {
               "type": "string"
             }
+          },
+          "use_immutable_subject": {
+            "description": "Whether the repository has opted in to the immutable OIDC subject claim format. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim. If not set at the repository level, falls back to the organization-level setting.",
+            "type": "boolean"
+          },
+          "sub_claim_prefix": {
+            "description": "The current `sub` claim prefix for this repository.",
+            "type": "string"
           }
         },
         "required": [
diff --git a/descriptions-next/api.github.com/api.github.com.yaml b/descriptions-next/api.github.com/api.github.com.yaml
index edc810080e..8e34ad7169 100644
--- a/descriptions-next/api.github.com/api.github.com.yaml
+++ b/descriptions-next/api.github.com/api.github.com.yaml
@@ -73,6 +73,9 @@ tags:
   description: Interact with GitHub Teams.
 - name: users
   description: Interact with and view information about users and also current user.
+- name: code-quality
+  description: Insights into reliability, maintainability, and efficiency of your
+    codebase.
 - name: codespaces
   description: Endpoints to manage Codespaces using the REST API.
 - name: copilot
@@ -7802,6 +7805,12 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for the organization. When `true`, new OIDC tokens will
+                    use a stable, repository-ID-based `sub` claim instead of the name-based
+                    format.
+                  type: boolean
             examples:
               default:
                 "$ref": "#/components/examples/oidc-custom-sub"
@@ -24844,6 +24853,11 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for this repository. When `true`, OIDC tokens will use
+                    a stable, repository-ID-based `sub` claim.
+                  type: boolean
             examples:
               default:
                 value:
@@ -27397,6 +27411,9 @@ paths:
           path: "/responses/204"
         - op: remove
           path: "/requestBody/content/application~1json/schema/properties/return_run_details"
+        - op: replace
+          path: "/responses/200/description"
+          value: Response including the workflow run ID and URLs.
         version: '2026-03-10'
   "/repos/{owner}/{repo}/actions/workflows/{workflow_id}/enable":
     put:
@@ -47424,6 +47441,16 @@ paths:
                   "$ref": "#/components/schemas/secret-scanning-alert-resolution-comment"
                 assignee:
                   "$ref": "#/components/schemas/secret-scanning-alert-assignee"
+                validity:
+                  type:
+                  - string
+                  - 'null'
+                  enum:
+                  - active
+                  - inactive
+                  - 
+                  description: Sets the validity of the secret scanning alert. Can
+                    be `active`, `inactive`, or `null` to clear the override.
               anyOf:
               - required:
                 - state
@@ -47462,7 +47489,8 @@ paths:
             repository, or the resource is not found
         '422':
           description: State does not match the resolution or resolution comment,
-            or assignee does not have write access to the repository
+            assignee does not have write access to the repository, or the requested
+            validity change could not be applied to this alert
         '503':
           "$ref": "#/components/responses/service_unavailable"
       x-github:
@@ -84154,6 +84182,11 @@ components:
           type: array
           items:
             type: string
+        use_immutable_subject:
+          description: Whether to opt in to the immutable OIDC subject claim format
+            for the organization. When `true`, new OIDC tokens will use a stable,
+            repository-ID-based `sub` claim instead of the name-based format.
+          type: boolean
       required:
       - include_claim_keys
     empty-object:
@@ -93454,6 +93487,15 @@ components:
           type: array
           items:
             type: string
+        use_immutable_subject:
+          description: Whether the repository has opted in to the immutable OIDC subject
+            claim format. When `true`, OIDC tokens will use a stable, repository-ID-based
+            `sub` claim. If not set at the repository level, falls back to the organization-level
+            setting.
+          type: boolean
+        sub_claim_prefix:
+          description: The current `sub` claim prefix for this repository.
+          type: string
       required:
       - use_default
     actions-secret:
diff --git a/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.json b/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.json
index c1e04b71c3..9816f5efd2 100644
--- a/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.json
+++ b/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.json
@@ -136,6 +136,10 @@
       "name": "users",
       "description": "Interact with and view information about users and also current user."
     },
+    {
+      "name": "code-quality",
+      "description": "Insights into reliability, maintainability, and efficiency of your codebase."
+    },
     {
       "name": "codespaces",
       "description": "Endpoints to manage Codespaces using the REST API."
@@ -91517,6 +91521,10 @@
                       "items": {
                         "type": "string"
                       }
+                    },
+                    "use_immutable_subject": {
+                      "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+                      "type": "boolean"
                     }
                   },
                   "required": [
@@ -91580,6 +91588,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -268675,6 +268687,14 @@
                       "items": {
                         "type": "string"
                       }
+                    },
+                    "use_immutable_subject": {
+                      "description": "Whether the repository has opted in to the immutable OIDC subject claim format. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim. If not set at the repository level, falls back to the organization-level setting.",
+                      "type": "boolean"
+                    },
+                    "sub_claim_prefix": {
+                      "description": "The current `sub` claim prefix for this repository.",
+                      "type": "string"
                     }
                   },
                   "required": [
@@ -268850,6 +268870,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for this repository. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -628277,6 +628301,18 @@
                       "string",
                       "null"
                     ]
+                  },
+                  "validity": {
+                    "type": [
+                      "string",
+                      "null"
+                    ],
+                    "enum": [
+                      "active",
+                      "inactive",
+                      null
+                    ],
+                    "description": "Sets the validity of the secret scanning alert. Can be `active`, `inactive`, or `null` to clear the override."
                   }
                 },
                 "anyOf": [
@@ -629873,7 +629909,7 @@
             "description": "Repository is public, or secret scanning is disabled for the repository, or the resource is not found"
           },
           "422": {
-            "description": "State does not match the resolution or resolution comment, or assignee does not have write access to the repository"
+            "description": "State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert"
           },
           "503": {
             "description": "Service unavailable",
diff --git a/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.yaml b/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.yaml
index 0fd310ec3a..83d59b5628 100644
--- a/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.yaml
+++ b/descriptions-next/api.github.com/dereferenced/api.github.com.2022-11-28.deref.yaml
@@ -73,6 +73,9 @@ tags:
   description: Interact with GitHub Teams.
 - name: users
   description: Interact with and view information about users and also current user.
+- name: code-quality
+  description: Insights into reliability, maintainability, and efficiency of your
+    codebase.
 - name: codespaces
   description: Endpoints to manage Codespaces using the REST API.
 - name: copilot
@@ -22159,6 +22162,12 @@ paths:
                     type: array
                     items:
                       type: string
+                  use_immutable_subject:
+                    description: Whether to opt in to the immutable OIDC subject claim
+                      format for the organization. When `true`, new OIDC tokens will
+                      use a stable, repository-ID-based `sub` claim instead of the
+                      name-based format.
+                    type: boolean
                 required:
                 - include_claim_keys
               examples:
@@ -22200,6 +22209,12 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for the organization. When `true`, new OIDC tokens will
+                    use a stable, repository-ID-based `sub` claim instead of the name-based
+                    format.
+                  type: boolean
             examples:
               default: *136
       responses:
@@ -54546,6 +54561,15 @@ paths:
                     type: array
                     items:
                       type: string
+                  use_immutable_subject:
+                    description: Whether the repository has opted in to the immutable
+                      OIDC subject claim format. When `true`, OIDC tokens will use
+                      a stable, repository-ID-based `sub` claim. If not set at the
+                      repository level, falls back to the organization-level setting.
+                    type: boolean
+                  sub_claim_prefix:
+                    description: The current `sub` claim prefix for this repository.
+                    type: string
                 required:
                 - use_default
               examples:
@@ -54598,6 +54622,11 @@ paths:
                   type: array
                   items:
                     type: string
+                use_immutable_subject:
+                  description: Whether to opt in to the immutable OIDC subject claim
+                    format for this repository. When `true`, OIDC tokens will use
+                    a stable, repository-ID-based `sub` claim.
+                  type: boolean
             examples:
               default:
                 value:
@@ -95724,6 +95753,16 @@ paths:
                   type:
                   - string
                   - 'null'
+                validity:
+                  type:
+                  - string
+                  - 'null'
+                  enum:
+                  - active
+                  - inactive
+                  - 
+                  description: Sets the validity of the secret scanning alert. Can
+                    be `active`, `inactive`, or `null` to clear the override.
               anyOf:
               - required:
                 - state
@@ -95821,7 +95860,8 @@ paths:
             repository, or the resource is not found
         '422':
           description: State does not match the resolution or resolution comment,
-            or assignee does not have write access to the repository
+            assignee does not have write access to the repository, or the requested
+            validity change could not be applied to this alert
         '503': *114
       x-github:
         enabledForGitHubApps: true
diff --git a/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.json b/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.json
index 5acad8e7fd..5035a78206 100644
--- a/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.json
+++ b/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.json
@@ -136,6 +136,10 @@
       "name": "users",
       "description": "Interact with and view information about users and also current user."
     },
+    {
+      "name": "code-quality",
+      "description": "Insights into reliability, maintainability, and efficiency of your codebase."
+    },
     {
       "name": "codespaces",
       "description": "Endpoints to manage Codespaces using the REST API."
@@ -87337,6 +87341,10 @@
                       "items": {
                         "type": "string"
                       }
+                    },
+                    "use_immutable_subject": {
+                      "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+                      "type": "boolean"
                     }
                   },
                   "required": [
@@ -87400,6 +87408,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for the organization. When `true`, new OIDC tokens will use a stable, repository-ID-based `sub` claim instead of the name-based format.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -261071,6 +261083,14 @@
                       "items": {
                         "type": "string"
                       }
+                    },
+                    "use_immutable_subject": {
+                      "description": "Whether the repository has opted in to the immutable OIDC subject claim format. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim. If not set at the repository level, falls back to the organization-level setting.",
+                      "type": "boolean"
+                    },
+                    "sub_claim_prefix": {
+                      "description": "The current `sub` claim prefix for this repository.",
+                      "type": "string"
                     }
                   },
                   "required": [
@@ -261246,6 +261266,10 @@
                     "items": {
                       "type": "string"
                     }
+                  },
+                  "use_immutable_subject": {
+                    "description": "Whether to opt in to the immutable OIDC subject claim format for this repository. When `true`, OIDC tokens will use a stable, repository-ID-based `sub` claim.",
+                    "type": "boolean"
                   }
                 }
               },
@@ -282130,7 +282154,7 @@
         ],
         "responses": {
           "200": {
-            "description": "Response including the workflow run ID and URLs when `return_run_details` parameter is `true`.",
+            "description": "Response including the workflow run ID and URLs.",
             "content": {
               "application/json": {
                 "schema": {
@@ -614675,6 +614699,18 @@
                       "string",
                       "null"
                     ]
+                  },
+                  "validity": {
+                    "type": [
+                      "string",
+                      "null"
+                    ],
+                    "enum": [
+                      "active",
+                      "inactive",
+                      null
+                    ],
+                    "description": "Sets the validity of the secret scanning alert. Can be `active`, `inactive`, or `null` to clear the override."
                   }
                 },
                 "anyOf": [
@@ -616271,7 +616307,7 @@
             "description": "Repository is public, or secret scanning is disabled for the repository, or the resource is not found"
           },
           "422": {
-            "description": "State does not match the resolution or resolution comment, or assignee does not have write access to the repository"
+            "description": "State does not match the resolution or resolution comment, assignee does not have write access to the repository, or the requested validity change could not be applied to this alert"
           },
           "503": {
             "description": "Service unavailable",
diff --git a/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.yaml b/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.yaml
index 11ec1ffe67..150d751c11 100644
--- a/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.yaml
+++ b/descriptions-next/api.github.com/dereferenced/api.github.com.2026-03-10.deref.yaml
@@ -73,6 +73,9 @@ tags:
   description: Interact with GitHub Teams.
 - name: users
   description: Interact with and view information about users and also current user.
+- name: code-quality
+  description: Insights into reliability, maintainability, and efficiency of your
+    codebase.
 - name: codespaces
   description: Endpoints to manage Codespaces using the REST API.
 - name: copilot
@@ -21835,6 +21838,12 @@ paths:
                     type: array
                     items:
                       type: string
+      {"code":"deadline_exceeded","msg":"operation timed out"}