Browse DevOps News (307)
Allison announces a security change for npm: granular access tokens configured to bypass 2FA can no longer perform sensitive account, org, and package-management actions without an interactive 2FA challenge, and automated publishing should move to trusted or staged publishing.
Alexander Neubeck explains how GitHub sped up Unicode case folding for code search by removing early-exit branches, enabling SIMD vectorization, and using byte-space arithmetic to avoid UTF-8 decode/encode work. The post also covers allocation-avoidance techniques and a compact lookup-table design for fast “does this fold?” checks.
Amaury Levé introduces an open-source polyglot unit-test generation agent that learns a repo’s conventions, writes tests, and validates they build and run in the project’s normal test workflow. The post explains the agent’s research/plan/execute/check loop, shows benchmark results versus stock Copilot, and includes setup commands for Copilot CLI and VS Code.
Kristen Womack’s July 2026 roundup for Azure Developer CLI (azd) summarizes releases 1.27.0 through 1.29.0, including new extension install options, a full tool uninstall workflow, Azure AI Foundry resource modeling in azure.yaml, container deployments to Azure App Service, and CI-friendly non-interactive behavior plus a breaking flag rename.
Allison announces a GitHub Actions update that lets workflows reference actions and reusable workflows in the same repository using a new $/ prefix, avoiding an explicit checkout and keeping internal references aligned with the exact commit being executed.
Cassidy Williams shows how she used the GitHub Copilot app to modernize an old React codebase by splitting work into stacked sessions and stacked pull requests, keeping changes reviewable while iterating on plans, branching strategy, and dependency upgrades.
Allison announces GitHub stacked pull requests in public preview, a workflow for breaking large changes into an ordered series of smaller PRs that can be reviewed independently and merged together, while still respecting existing checks, reviews, and branch protections.
Allison summarizes the July 2026 GitHub Copilot updates in Visual Studio Code (v1.127–v1.131), focusing on the Agents window workflow, multi-chat sessions, model and chat controls (including Copilot Vision and BYOK), plus editor, terminal, browser, and accessibility improvements.
Allison announces general availability for Copilot code review support for agent skills and MCP server connections, enabling teams to bring internal standards and external context into reviews. The update includes attribution on generated comments and outlines where to configure MCP servers and store tokens in repository settings.
Bruno Borges explains how to reduce Dependabot pull request noise without slowing down vulnerability fixes, using Microsoft’s GCToolkit repo as an example. The post shows how to group version updates, move to a monthly cadence, cover all ecosystems you use, and tune the new default “cooldown” window for safer upgrades.
murray-kp rounds up the July 2026 Microsoft Fabric updates across CI/CD and Git integration, OneLake governance, Spark runtime and diagnostics, lakehouse and warehouse features, and Real-Time Intelligence improvements including Eventstream security and new connectors.
The Visual Studio Code Team shares the evolving release notes for VS Code 1.132 (Insiders), with links to the commit log and closed issues so developers can track what’s landing as features are added throughout the iteration.
Allison summarizes what’s new in CodeQL 2.26.1 for GitHub code scanning, including expanded framework modeling across Go, Java/Kotlin, and JavaScript/TypeScript, plus query updates that reduce false positives and improve detection for issues like SSRF, path injection, and hard-coded cryptographic values.
Allison announces npm publish-time malware scanning and explains how it can delay package availability, when publishes may be held or blocked, and how maintainers can declare dual-use security functionality using new package metadata and a required DISCLOSURE file.
Mark Downie introduces the Visual Studio July update, centered on a new Agent (Preview) in Copilot Chat built on the GitHub Copilot SDK. The post also covers built-in .NET and Azure skills, org-level Copilot custom instructions, attaching Git branches as chat context, and improved MSVC toolset discovery for reproducible C++ builds.
Greg Ose summarizes the security changes GitHub and npm shipped over recent months to break common supply chain attack paths, focusing on preventing workflow compromise, reducing credential exposure, slowing malicious propagation, and improving incident response options for enterprises.
Alex Pysanets announces the general availability of Commit Search in Azure DevOps, a new way to find commits by searching commit message text across projects and repositories, with filters for project, repo, author, and branch plus sorting by time or relevance.
Allison announces an update to Dependabot malware alerts: GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, expanding detection coverage across more ecosystems and surfacing matches as Dependabot alerts in your repos and orgs.
Allison announces a new GitHub Actions protection that automatically holds certain workflow runs flagged as potentially malicious until a collaborator with write access reviews and approves them via an authenticated web session.
Burke Holland shares a practical GitHub Copilot “harness” workflow for building features end-to-end: pick a Copilot surface, enable more autonomy safely, prototype and plan in the same session, implement with Autopilot, then iterate and run a Rubber Duck review to catch blind spots.
Allison announces that enterprise managed settings now apply to the GitHub Copilot app and Copilot cloud agent, letting enterprise owners enforce a single managed-settings.json policy across more Copilot clients, including controls for plugins, marketplaces, and approval-prompt bypass behavior.
Yuliia Kovalova and Jan Krivanek introduce the MSBuild Binlog Analyzer for VS Code, a preview extension that uses GitHub Copilot Chat plus an MCP server to explain build failures, pinpoint performance bottlenecks, compare builds, and spot regressions directly from MSBuild .binlog files.
Christopher Harrison introduces the GitHub Copilot app and shows how it supports real-world development workflows with project-scoped agent sessions, Quick Chat for parallel threads, interactive canvases for visual iteration, and Agent Merge to help move pull requests through CI and review.
Allison announces general availability of Copilot cloud agent for Linear, letting teams assign Linear issues to Copilot to produce draft pull requests, run work in an ephemeral environment backed by GitHub Actions, and report progress back into Linear with configurable models, branches, and custom agents.
Allison announces that GitHub MCP Server already supports the upcoming stateless MCP specification, outlining protocol changes (like removing sessions and initialize) and what GitHub changed internally to stay compatible while improving scalability and verification.
Allison announces a GitHub Mobile improvement that lets you use the Copilot cloud coding agent to investigate and fix failing GitHub Actions checks directly from a pull request, creating a follow-up PR for you to review and merge.
Allison announces a public preview update for GitHub Projects and GitHub Issues: multi-select fields, allowing a single field to store multiple values and enabling filtering, grouping, and searching across project views.
Carlin Cherry explains why Dependabot now applies a default three-day cooldown before opening non-security version update pull requests, aiming to reduce exposure to fast-moving supply chain attacks where malicious package releases are discovered and removed within hours.
Allison announces a public preview for GitHub Issues agent automation controls, adding approvals, confidence ratings, and rationale so teams can review or auto-apply agent-driven changes like labeling, assigning, and closing issues.
Andrea Griffiths breaks down what GitHub Copilot subscriptions pay for beyond raw model API calls, including the developer workflow surfaces Copilot connects, how GitHub AI Credits are metered, and when direct API access (or BYOK) makes more sense for teams building their own agent systems.
The Visual Studio Code Team shares the ongoing release notes for VS Code 1.131 (Insiders), including links to the commit log and closed issues so developers can track what’s landing in the build as features are added.
Allison announces a GitHub Enterprise Server security change that will reject command-line support bundle uploads from unpatched GHES versions starting August 18, 2026, and lists the minimum patch releases required to avoid disruption.
Gloridel Morales announces July 2026 patch releases for Azure DevOps Server, including download links for Patch 6 and Azure DevOps Server 2022.2 Patch 11, plus a quick command to verify whether the patch is installed on your server.
Allison announces general availability of GitHub Code Quality for GitHub Enterprise Cloud and GitHub Team, combining deterministic CodeQL analysis with AI-assisted detection and Copilot Autofix to flag maintainability and reliability issues in pull requests, plus new org-level dashboards, coverage reporting, ruleset-based quality gates, and APIs.
Allison announces general availability of repository-level GitHub Copilot usage metrics via the Copilot usage metrics REST API, enabling daily per-repository reporting for Copilot coding agent and Copilot code review pull request activity across enterprises and organizations.
Allison announces new controls for GitHub Copilot code review, including reading custom instructions from the PR head branch, expanded instruction file support, repository-level setup steps via a workflow YAML, and a default-on firewall with separate configuration from Copilot cloud agent.
Allison announces a GitHub Mobile improvement that lets you start “Fix with Copilot” directly from Copilot code review pull request comments, making it quicker to address review feedback from a phone while keeping PRs moving.
Dalia Abuadas argues that in an AI-assisted workflow, writing the first patch is often no longer the expensive part—reviewing, validating, and owning the change is. She proposes using a constrained “price check” patch to replace long scope debates with evidence from a real diff and tests.
Elliot Volkman shares Microsoft Security’s Black Hat USA 2026 agenda, focused on how attackers abuse “trust paths” across software supply chains, identities, cloud services, and AI systems. The post highlights sessions on npm supply chain campaigns, Azure Automation research, GitHub-focused detection ideas, and hands-on skilling with Defender and Sentinel.
Waldek Mastykarz explains how to evaluate agent skills that call APIs without paying for test traffic or mutating production data. He outlines why direct evals against real endpoints create cost, state, and non-determinism problems, then shows a proxy-based approach using Dev Proxy to emulate APIs while keeping production URLs unchanged.