The 30-Second Brief
- Source report GitHub’s October 29 update adds three network ranges for webhook delivery. Static inbound allowlists need an update. [1]
- Analysis Treat the receiving network rule as part of the integration, with an owner and a delivery test.
What Changed
The Meta API’s hooks field now includes 9.234.98.160/28, 9.234.98.176/28 and 9.234.106.48/28. GitHub says to add them alongside existing webhook ranges. The change covers github.com across plans, including Enterprise Cloud. Lists already kept current through the Meta API need no change for these additions. [1]
Why It Matters
Analysis A webhook integration crosses an ownership boundary: application teams depend on an event reaching their service, while a separate network team may maintain the rule that admits it. A rule can become stale even when the application code has not changed. This update is a useful prompt to identify which team owns both the allowed ranges and evidence that delivery works.
For a static list, review the addition as a small configuration change and retain the existing entries. Then check a representative event from delivery attempt through the receiving application’s expected result. A successful firewall change alone does not prove the business workflow completed. For automated lists, review the last successful refresh and how refresh failures become visible. Automation with no failure signal can quietly turn into another static dependency.
Evidence & Uncertainty
BriefSpire verified the announcement, not any reader’s firewall or delivery history. GitHub does not identify a universal outage or an exploit in this notice. Priority: Important reflects an actionable integration-maintenance requirement for affected static lists.
Action Center
Selections remain in this browser.
Evidence Explorer
Should the three ranges replace the existing list?
No. GitHub explicitly describes additions alongside existing webhook ranges. [1]
What should teams with automated updates check?
Analysis: Check the refresh job’s recent success and failure alerting. Confirm the list actually in use matches the intended current configuration.
Sources & Transparency
Checked . This is a primary vendor source, not independent corroboration. Recommendations are BriefSpire analysis.
- GitHub: Webhook IP ranges added to the Meta API — October 29, 2026.