Add Changes section and note to 3.14.0 release notes for change in scope for user org membership (#56660)

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Vanessa <[email protected]>

Author: 3 people

data/release-notes/enterprise-server/3-14/0.yml

@@ -168,6 +168,10 @@ sections:
         - |
           When using a JSON Web Token (JWT) to authenticate or request an installation token, developers of GitHub Apps can use the app's client ID for the JWT's `iss` claim. The application ID remains valid, but is considered deprecated.
 
+  changes:
+    - |
+      The API endpoint for setting and removing organization membership for a user (`PUT /orgs/{org}/memberships/{username}` and `DELETE /orgs/{org}/memberships/{username}`) requires `admin:org` permissions for classic tokens. Previously, the changes were allowed with the `read:org, repo` permissions. [Updated: 2025-07-16]
+
   known_issues:
     - |
       Complete SCIM payloads are written to the audit log, including SCIM attributes that are not required or supported per [API docs](/rest/enterprise-admin/scim?apiVersion=2022-11-28#supported-scim-user-attributes). Customers using Okta with SCIM may notice that a placeholder password attribute is among the data passed to audit logs in its current configuration. This placeholder data is associated with Okta’s password synchronization feature that is not expected or required by GitHub. See [okta-scim](https://developer.okta.com/docs/api/openapi/okta-scim/guides/scim-20/#create-the-user) for more information.
@@ -244,5 +248,7 @@ sections:
       These release notes previously did not include a note for the deprecation of team discussions.
     - |
       These release notes previously indicated as a known issue that on GitHub Enterprise Server 3.14.0, repositories originally imported using `ghe-migrator` will not correctly track Advanced Security contributions.
-      
+
       The fix for this problem was already included in GitHub Enterprise Server [3.12](/admin/release-notes#3.12.0-bugs). [Updated: 2025-04-11]
+    - |
+      The release notes previously did not include a note for the change in permissions required for managing user organization membership. [Updated: 2025-07-16]