Browse DevOps News (300)

Allison announces npm publish-time malware scanning and explains how it can delay package availability, when publishes may be held or blocked, and how maintainers can declare dual-use security functionality using new package metadata and a required DISCLOSURE file.

Mark Downie introduces the Visual Studio July update, centered on a new Agent (Preview) in Copilot Chat built on the GitHub Copilot SDK. The post also covers built-in .NET and Azure skills, org-level Copilot custom instructions, attaching Git branches as chat context, and improved MSVC toolset discovery for reproducible C++ builds.

Greg Ose summarizes the security changes GitHub and npm shipped over recent months to break common supply chain attack paths, focusing on preventing workflow compromise, reducing credential exposure, slowing malicious propagation, and improving incident response options for enterprises.

Alex Pysanets announces the general availability of Commit Search in Azure DevOps, a new way to find commits by searching commit message text across projects and repositories, with filters for project, repo, author, and branch plus sorting by time or relevance.

Allison announces an update to Dependabot malware alerts: GitHub Advisory Database now ingests malware advisories from the OpenSSF malicious-packages repository, expanding detection coverage across more ecosystems and surfacing matches as Dependabot alerts in your repos and orgs.

Allison announces a new GitHub Actions protection that automatically holds certain workflow runs flagged as potentially malicious until a collaborator with write access reviews and approves them via an authenticated web session.

Burke Holland shares a practical GitHub Copilot “harness” workflow for building features end-to-end: pick a Copilot surface, enable more autonomy safely, prototype and plan in the same session, implement with Autopilot, then iterate and run a Rubber Duck review to catch blind spots.

Allison announces that enterprise managed settings now apply to the GitHub Copilot app and Copilot cloud agent, letting enterprise owners enforce a single managed-settings.json policy across more Copilot clients, including controls for plugins, marketplaces, and approval-prompt bypass behavior.

Yuliia Kovalova and Jan Krivanek introduce the MSBuild Binlog Analyzer for VS Code, a preview extension that uses GitHub Copilot Chat plus an MCP server to explain build failures, pinpoint performance bottlenecks, compare builds, and spot regressions directly from MSBuild .binlog files.

Christopher Harrison introduces the GitHub Copilot app and shows how it supports real-world development workflows with project-scoped agent sessions, Quick Chat for parallel threads, interactive canvases for visual iteration, and Agent Merge to help move pull requests through CI and review.

Allison announces general availability of Copilot cloud agent for Linear, letting teams assign Linear issues to Copilot to produce draft pull requests, run work in an ephemeral environment backed by GitHub Actions, and report progress back into Linear with configurable models, branches, and custom agents.

Allison announces that GitHub MCP Server already supports the upcoming stateless MCP specification, outlining protocol changes (like removing sessions and initialize) and what GitHub changed internally to stay compatible while improving scalability and verification.

Allison announces a GitHub Mobile improvement that lets you use the Copilot cloud coding agent to investigate and fix failing GitHub Actions checks directly from a pull request, creating a follow-up PR for you to review and merge.

Allison announces a public preview update for GitHub Projects and GitHub Issues: multi-select fields, allowing a single field to store multiple values and enabling filtering, grouping, and searching across project views.

Carlin Cherry explains why Dependabot now applies a default three-day cooldown before opening non-security version update pull requests, aiming to reduce exposure to fast-moving supply chain attacks where malicious package releases are discovered and removed within hours.

Allison announces a public preview for GitHub Issues agent automation controls, adding approvals, confidence ratings, and rationale so teams can review or auto-apply agent-driven changes like labeling, assigning, and closing issues.

Andrea Griffiths breaks down what GitHub Copilot subscriptions pay for beyond raw model API calls, including the developer workflow surfaces Copilot connects, how GitHub AI Credits are metered, and when direct API access (or BYOK) makes more sense for teams building their own agent systems.

The Visual Studio Code Team shares the ongoing release notes for VS Code 1.131 (Insiders), including links to the commit log and closed issues so developers can track what’s landing in the build as features are added.

Allison announces a GitHub Enterprise Server security change that will reject command-line support bundle uploads from unpatched GHES versions starting August 18, 2026, and lists the minimum patch releases required to avoid disruption.

Gloridel Morales announces July 2026 patch releases for Azure DevOps Server, including download links for Patch 6 and Azure DevOps Server 2022.2 Patch 11, plus a quick command to verify whether the patch is installed on your server.

Allison announces general availability of GitHub Code Quality for GitHub Enterprise Cloud and GitHub Team, combining deterministic CodeQL analysis with AI-assisted detection and Copilot Autofix to flag maintainability and reliability issues in pull requests, plus new org-level dashboards, coverage reporting, ruleset-based quality gates, and APIs.

Allison announces general availability of repository-level GitHub Copilot usage metrics via the Copilot usage metrics REST API, enabling daily per-repository reporting for Copilot coding agent and Copilot code review pull request activity across enterprises and organizations.

Allison announces new controls for GitHub Copilot code review, including reading custom instructions from the PR head branch, expanded instruction file support, repository-level setup steps via a workflow YAML, and a default-on firewall with separate configuration from Copilot cloud agent.

Allison announces a GitHub Mobile improvement that lets you start “Fix with Copilot” directly from Copilot code review pull request comments, making it quicker to address review feedback from a phone while keeping PRs moving.

Dalia Abuadas argues that in an AI-assisted workflow, writing the first patch is often no longer the expensive part—reviewing, validating, and owning the change is. She proposes using a constrained “price check” patch to replace long scope debates with evidence from a real diff and tests.

Elliot Volkman shares Microsoft Security’s Black Hat USA 2026 agenda, focused on how attackers abuse “trust paths” across software supply chains, identities, cloud services, and AI systems. The post highlights sessions on npm supply chain campaigns, Azure Automation research, GitHub-focused detection ideas, and hands-on skilling with Defender and Sentinel.

Waldek Mastykarz explains how to evaluate agent skills that call APIs without paying for test traffic or mutating production data. He outlines why direct evals against real endpoints create cost, state, and non-determinism problems, then shows a proxy-based approach using Dev Proxy to emulate APIs while keeping production URLs unchanged.

Allison announces that GitHub Projects views now support advanced search in the filter bar, enabling boolean AND/OR expressions to build more precise views. The update also adds a reviews: filter for PR items and introduces a 90-day retention policy for deployment statuses in the REST and GraphQL APIs.

Allison announces a GitHub update that lets repository admins archive pull requests so they’re removed from public view without being deleted. The post explains what happens when a PR is archived (closed and locked), how visibility changes for non-admins, and how to find archived PRs during triage.

Allison announces new GitHub Enterprise Cloud REST API endpoints that let enterprise admins manage Visual Studio Subscription (VSS) assignments in bulk, including listing assignments, mapping UPNs to GitHub handles, and removing incorrect matches—useful when SCIM identities don’t align with VSS UPN formats.

Allison announces a public preview GitHub Actions runner image for Xcode 27 on GitHub-hosted macOS runners, including the new Xcode-version-based support model, the workflow labels to target the image, and current limitations around arm64-only availability.

Ruben Rios announces a preview of Private Marketplace support in Visual Studio, aimed at organizations that need tighter control over how developers discover and install extensions for security, compliance, and governance reasons.

Microsoft Security Research, Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan and Arvind Gowda break down a coordinated compromise of the @asyncapi npm organization, where attackers abused a misconfigured GitHub Actions workflow and trusted publishing to ship import-time malware, and they provide concrete indicators, hunting queries, and remediation steps.

Allison summarizes new GitHub secret scanning and public monitoring improvements, including new partner detectors, expanded push protection defaults, a new webhook field to distinguish secret categories, and additional insight cards to help enterprises understand leak attribution and exposure scope.

The Visual Studio Code Team shares the evolving release notes for VS Code 1.130 (Insiders), with links to the commit log and closed issues so developers can track what’s landing in the build as features are added.

Polly Davidson lays out a beginner-friendly roadmap for learning GitHub, from core Git concepts and essential commands to day-to-day collaboration with pull requests, issues, and projects. It also introduces GitHub Actions for CI/CD, GitHub Pages for publishing, and practical security basics like 2FA, secret scanning, Dependabot, and CodeQL.

Allison summarizes the June 2026 GitHub Copilot update for Visual Studio 2026, focusing on new usage tracking and alerts, a trust validation layer for MCP servers, and Copilot features that tie into pull request workflows and C++ modernization.

Allison announces a public preview feature where GitHub code scanning surfaces AI-powered security detections directly on pull requests, helping teams catch issues in languages and frameworks that don’t have native CodeQL coverage. The update explains what’s included, how it runs, enablement requirements, and how billing works via AI credits.

Simona Liao, Wendy Breiding, and Yun Jung Choi introduce Visual Studio 18.8’s built-in Agent Skills, a set of reusable Copilot capabilities for common .NET and Azure tasks. The post explains where to find and enable skills, why they’re off by default, and highlights starter skills for API work, performance reviews, Azure deployments, and Kusto queries.

Allison announces a new default safety behavior in Dependabot: version update pull requests will wait three days after a release appears in its registry, reducing the risk of immediately adopting compromised or broken dependency releases while keeping security updates immediate.