Weekly DevOps Roundup: Dependency Security and Cloud Operations

by TechHub

Welcome to this week's DevOps roundup, where the LiteLLM compromise puts dependency incident response alongside GitHub's package firewall preview and Agentic Autofix announcement. Azure Container Registry's generally available traffic metrics and sovereign infrastructure updates give teams more options for monitoring and controlling deployments, while Java support deadlines and Foundry workflow retirement call for migration planning. We also cover GitHub automation credentials, security scanning compatibility, and coding-agent workflows that keep validation and human review in the delivery process.

This Week's Overview

Java support deadlines call for upgrade planning

Azure App Service and Azure Functions will end support for Java 8, 11, and 17 on September 1, 2027. Existing applications will keep running, but those versions will no longer receive security updates, improvements, or related customer support. Teams should treat the deadline as a support and security boundary, not an automatic application shutdown.

The Microsoft Build of OpenJDK schedule is separate: September 2027 is the earliest listed end-of-support date for Java 11 and 17, and those targets may be extended. Microsoft supports Java 8 on Azure through Eclipse Temurin builds rather than a Microsoft Build of OpenJDK 8. Modernize CLI can assess applications, help plan upgrades, and apply changes for review, giving teams a starting point for migration work.

Azure Container Registry makes traffic and throttling visible

Azure Container Registry's new metrics give operators a view of outbound traffic and registry API activity. The accompanying engineering articles explain how that visibility accounts for storage redirects and activity across regions.

Generally available metrics and dashboards

Data Transfer and Transactions metrics are now generally available for every Azure Container Registry, with no additional configuration or charge for the metrics themselves. Data Transfer measures outbound bytes by ApiName and Region, while Transactions counts registry API operations and adds a ResponseType dimension. Filtering Transactions to ResponseType=Throttled helps identify which APIs and regions are affected.

The integrated Grafana dashboard includes transaction, outbound transfer, throttling, and storage panels without requiring a separately managed Grafana instance. This gives teams a ready-made starting point for investigating registry activity before building their own views.

How transfer accounting reaches the dashboard

The Data Transfer metric attributes egress to GetManifest, GetBlob, GeoReplication, and ImportSource, includes service-initiated traffic, and uses a PT1M time grain. Capturing GetBlob traffic requires storage telemetry because downloads typically redirect clients to Azure Storage, outside the registry serving path. The Storage Activity Platform reduces telemetry arrival from days to minutes in many regions without affecting that serving path.

The metrics infrastructure assigns each registry to one internal shard across its regions and components. Failed requests count as Transactions but not Data Transfer, while redirects and downloads are counted separately and delivered bytes are counted once. These distinctions matter when comparing operation counts with outbound volume: the two metrics describe different aspects of the same workload.

Sovereign infrastructure expands local deployment and control options

Microsoft's sovereign cloud updates cover disconnected infrastructure, local development and AI services, and controls for public-cloud deployments. Availability varies by component, so teams need to distinguish generally available capabilities from previews and Ignite plans.

Azure Local infrastructure and disconnected operations

Azure Local introduces public-preview rehoming from Azure-connected infrastructure to disconnected environments, using phased execution, user approvals, and secure backups. Confidential virtual machines are generally available, with hardware-encrypted memory, hardware-based isolation, attestation, and guest operating system integrity protection. These address separate operational needs: changing an environment's connectivity model and protecting workloads while they run.

The private-cloud announcement places DocumentDB and Blob Storage on Azure Local in public preview at Ignite and notes that SQL Server on Azure Local general availability was announced at FabCon. It also describes GitHub Enterprise Local as a prebuilt appliance supporting repositories, continuous integration and delivery (CI/CD), and development artifacts in connected and disconnected environments.

Local AI models and retrieval

Foundry Local runs supported models on Azure Local through Azure Arc-enabled Kubernetes, with CPU- and GPU-backed deployments and OpenAI-compatible APIs. The dedicated sovereign AI article describes the model catalog and Agentic Retrieval as generally available, including local ingestion, indexing, multi-step retrieval, and citations. Agents, enterprise connectors using Model Context Protocol (MCP), and configurable AI guardrails remain preview capabilities.

Azure Local disconnected operations uses a local control plane to operate supported infrastructure and services without continuous public-cloud connectivity. The article describes GitHub Enterprise Local as becoming generally available at Ignite, including GitHub Actions and self-hosted runners on Azure Local. These distinctions help separate capabilities available for deployment from those still being previewed or announced for later availability.

GitHub Enterprise Local deployment responsibilities

GitHub Enterprise Local keeps repositories and core development workflows on customer-controlled Azure Local infrastructure. Workload Orchestration guides deployment of the core infrastructure and GitHub Enterprise Server appliance, with deployment secrets stored in Azure Key Vault.

Local infrastructure does not make every connected service local. Connected GitHub Copilot use still requires a GitHub.com identity and a Copilot license, while administrators running approved models through Foundry Local remain responsible for models, security, certificates, and access controls.

Public-cloud keys, access oversight, and deployment definitions

External Key Management with Azure Managed HSM is generally available, allowing customers to retain root encryption keys in customer-operated hardware. Data Guardian and Production Touch Ledger add oversight and tamper-evident records for qualifying Microsoft engineer access in EU and EFTA regions. The updated Sovereign Landing Zone implementation supports Bicep, Terraform, and Azure Verified Modules, bringing these deployment patterns into infrastructure-as-code workflows.

Sovereign Control Panel is in private preview, with public preview planned for Microsoft Ignite and delivery timelines subject to change. Azure Confidential Clean Rooms is in limited preview for approved Spark SQL analysis in hardware-protected environments. Teams can evaluate those previews separately from the generally available key-management capability.

Foundry workflow retirement shifts orchestration to Logic Apps

Microsoft Foundry workflows retire on December 1, 2026, ending support for the visual workflow designer and for running workflows in the Foundry portal. Azure Logic Apps provides an orchestration path through API calls, schedules, and events from more than 1,400 connectors. It adds branching, retries, timeouts, parallel execution, and run history around agent calls.

The guidance distinguishes Prompt Agents, configured through instructions, models, and tools, from Hosted Agents, which run custom containerized code with Foundry-managed hosting and scaling. Selecting an existing Hosted Agent from a Foundry project for workflow invocation is planned, not currently supported. Migration planning needs to account for that limitation rather than assuming every existing agent can already be selected directly.

Dependency security spans incident response, prevention, and remediation

The LiteLLM compromise provides an immediate incident-response concern, while GitHub's package firewall and Autofix announcements address different stages of dependency risk. The preview controls are not substitutes for rebuilding compromised environments or rotating exposed credentials.

LiteLLM compromise requires careful investigation

Compromised LiteLLM 1.107.0 was published to PyPI and distributed through official container images on October 21, 2026. Malicious Python startup files could execute a credential collector even when an application did not import LiteLLM. Investigators should avoid starting Python or pip inside suspect environments because interpreter initialization could activate the payload.

Recovery requires rebuilding affected environments, addressing surviving processes, and rotating reachable credentials from a known-clean machine. Microsoft provides Defender detections and Kusto Query Language (KQL) hunting queries, while Defender Vulnerability Management identifies exposure as TVM-2026-0003. The startup-hook behavior makes the investigation environment itself part of the containment problem.

Package firewall checks dependencies before delivery

GitHub package firewall is in public preview for all GitHub Enterprise Cloud customers, including data-resident enterprises. It inspects metadata requests and package downloads before dependencies reach CI/CD hosts or developer workstations. Enterprise controls include configurable cooldown periods, GitHub Advisory Database checks, and attestation downgrade checks.

The preview supports npm packages only, so it does not cover the Python package involved in the LiteLLM incident. Endpoints must route package traffic through the firewall, and users can request exceptions for incorrectly blocked packages. The preview is free, with metered billing planned for general availability.

Agentic Autofix broadens proposed fixes

Agentic Autofix uses the Copilot coding agent to explore repository context and review proposed changes, with support for custom instructions and skills. It expands beyond scoped CodeQL support to dependency vulnerabilities and code scanning alerts from third-party tools. Dependency alerts gain Exploit Prediction Scoring System (EPSS) percentiles and development-versus-runtime scope to help teams prioritize work.

Generating fixes consumes AI credits, enabling Autofix does not automatically generate fixes, and a request does not always produce a fix. The announced rollout spans two to three weeks, with public preview availability in November. Teams should budget for requested generation and retain review gates around proposed changes.

Dependabot follows package-manager updates

Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4 for all GitHub.com users. These package-manager versions will also be supported in GitHub Enterprise Server 3.24.

GitHub automation needs explicit credentials and current network rules

GitHub's updates affect how automation authenticates, how enterprises replace long-lived credentials, and which storage endpoints restricted networks must allow. The practical work ranges from making public clones resilient to updating federated identity configuration.

Public HTTPS clones may temporarily require authentication

GitHub may temporarily require authentication for some public repository clones and fetches over HTTPS during unusual traffic. Affected operations return an authentication-required message, and users can authenticate or retry after the protection is lifted. This applies across plans on github.com but is not a general authentication requirement for public repositories.

Authenticated HTTPS operations, SSH operations, pushes, and unrelated web and API traffic are unaffected. GitHub recommends GITHUB_TOKEN for GitHub Actions and GitHub App installation access tokens, or personal access tokens, for other CI systems. Pipelines that depend on anonymous public clones should account for the temporary protection.

Enterprise GitHub App installations reach general availability

Enterprise-level GitHub App installations are generally available, with expanded APIs allowing Apps to replace classic personal access tokens in more enterprise and organization workflows. New permissions cover repository policies, bypass requests, enterprise settings, two-factor authentication, verifiable domains, IP allowlists, access restrictions, and repository rulesets.

Access to enterprise organization and repository policies requires read permission for enterprise settings. Teams moving automation to GitHub Apps should include that dependency in their permission review. These updates will be available in GitHub Enterprise Server 3.24.

Immutable identity claims reduce name-reuse risks

Name-based OpenID Connect (OIDC) subject claims can leave dangling Azure federated credentials after repositories or organizations are deleted, renamed, or transferred. Immutable subject claims include owner and repository IDs, helping prevent access through reused names. The guidance recommends retrieving those IDs through the GitHub API with GitHub CLI and configuring Owner ID and Repository ID in Azure before enabling immutable claims.

Enterprise claims and custom repository properties require manually editing the Azure Subject Identifier. That makes the migration more than a GitHub-side switch: the Azure trust configuration needs to match first.

GitHub CLI previews expiring credentials

GitHub CLI v2.103.0 introduces an opt-in public preview of expiring access tokens paired with rotating refresh tokens. Enable it with gh auth login --expiring, or set expiring_credentials to enabled for future sign-ins. GitHub recommends Git 2.46 or later and using GitHub CLI as the Git credential helper for HTTPS.

Scripts that consume tokens outside GitHub CLI should retrieve them fresh rather than cache them for later reuse. The feature is available on github.com and ghe.com, with GitHub Enterprise Server support starting in version 3.23.

Actions storage endpoint additions affect host allowlists

The GitHub meta API now includes productionresultssa30.blob.core.windows.net through productionresultssa49.blob.core.windows.net and productionresultssa100.blob.core.windows.net through productionresultssa199.blob.core.windows.net, with both ranges inclusive. Organizations allowing individual hosts must add them to avoid interruptions to job summaries and logs, while those allowing productionresultssa*.blob.core.windows.net need no changes.

Security scanning updates require toolchain and integration checks

CodeQL users face toolchain compatibility limits, while secret scanning users have audit-schema and triage changes to accommodate. These updates affect both whether scans run and how downstream systems process their findings.

Pin CodeQL workflows away from unsupported toolchains

Installing Xcode 27 prevents CodeQL traced extraction for C/C++, C#, Go, Java, Kotlin, and Swift. Traced extraction may also be unavailable on macOS 27, and CodeQL does not support Swift 6.4 on any platform. Affected workflows should pin macOS and Xcode to version 26 or earlier.

C/C++, C#, and Java workflows can use build mode none as an alternative. CodeQL support for Intel-based Macs will be deprecated in mid-December 2026, creating a separate planning concern for teams maintaining those scanning environments.

Secret scanning changes audit fields and API behavior

On November 12, 2026, affected secret scanning audit events will put enterprise slugs rather than display names in the business field. Integrations filtering on display names should accept both formats or use business_id, whose numeric values remain unchanged. Event names remain unchanged as well.

Token revocation now supports Base64-encoded GitHub tokens in private and internal repositories with secret scanning enabled. Dismissal-request webhooks include the repository-scoped exemption_request.number, matching the number available through the REST API. Custom pattern requests rejected for invalid arguments now return 422 instead of 500, allowing integrations to distinguish those failures from server errors.

Public monitoring gains triage and automation

Public monitoring dashboards now support dismissing, reopening, filtering, and sorting alerts, with an activity timeline. Ongoing validity checks classify supported credentials as Active, Inactive, or Unknown, while enterprise admins and security managers can query attributed findings through a REST API and receive newly attributed leak notifications through enterprise webhooks.

Closing an alert does not revoke the credential or remove it from the public repository, so triage still needs a separate remediation step. Public monitoring remains in public preview for GitHub Enterprise Cloud and is included with GitHub Advanced Security or GitHub Secret Protection at no additional cost.

Coding-agent workflows connect chat, editors, and review gates

The agent workflow updates connect repository discussions to implementation and let developers carry ongoing work between interfaces. The accompanying examples emphasize explicit plans, validation, and clear limits on what automated review establishes.

Teams consolidates notifications and coding actions

The consolidated GitHub app in Microsoft Teams combines repository notifications with GitHub Copilot coding actions. Mentioning @GitHub can initiate issue investigation, bug fixes, tests, and pull requests using linked repository updates and conversation context. Users connect their GitHub account and select a repository through the resulting prompts.

Existing GitHub notifications users must update the app, while their notification capabilities continue to work. The legacy app will be renamed “GitHub (deprecated)” and retired on November 16. Teams using that integration should plan the app update rather than treating the coding capabilities as an entirely separate installation.

Editor handoffs preserve work, while plans guide implementation

Selecting Open in VS Code transfers a Copilot app session's task, plan, conversation, diff, and isolated worktree into the editor. Developers can continue prompting, edit manually, and run local validation without recreating the original context. Pushing from the associated branch updates the pull request already tracking the session.

A separate IntelliJ IDEA walkthrough takes an existing issue through plan mode, implementation, and Ask mode review. It validates the accessibility fix with VoiceOver before creating the pull request, providing a concrete example of checking behavior outside the agent's own assessment.

Automated approvals can contribute to merge requirements

GitHub Copilot can provide delegated code review approvals that count toward merge protection rules. The suggested workflow combines its automated review with one human approval to satisfy branch requirements. Teams adopting this pattern need to decide which checks remain human responsibilities.

A retrospective on September's updates covers automated approvals alongside generally available local sandboxing and bulk agent autofix for up to 25 CodeQL quality findings. It also describes Project HydraFusion expanding to VS Code and the GitHub Copilot app, with full model visibility and a claim of up to 10x token efficiency. Those items are retrospective context, rather than a new set of releases for this week.

Evaluation environments and verification gates matter

Across 340 GPT-5.6 Sol runs, agents pushed without being asked in 65% of GitHub-remote runs versus 54% of local-remote runs. The 11-percentage-point difference had a reported p-value of 0.033, although every explicitly requested push occurred on both remote types. All rebases were correct, every push used --force-with-lease, and no run used a destructive Git command.

The experiment tested one model on one repository with a conflict-free rebase and no confirmation requirement, so its result should not be generalized to every agent workflow. Practitioner accounts reinforce the value of task-specific verification: Patrick Baumgartner checked approximately 900 migrated slides through screenshots, animation comparisons, and generated PDFs, while Frank Delporte used the coding agent to investigate virtual-thread pinning in Pi4J. Their recommendations center on reviewed plans, reusable skills, tests, and maintainer approval rather than unchecked acceptance.

Model routing keeps policy ahead of scoring

A decision-routing architecture selects a model once per new user turn and keeps that choice across the resulting tool continuations. It filters candidates by entitlement, pricing, context capacity, API compatibility, and administrator policy before scoring them. Microsoft-Decision-1 supplies typed decisions and probabilities through binary, choice, and ordered-score questions.

VS Code discovers available Copilot models through its public Language Model API instead of a hardcoded list. GitHub credentials stay in memory and must not be logged or sent to the Decision API, separating authentication from routing decisions.

Canvases organize work before agent execution

Canvases are preview shared workspaces in VS Code for organizing releases and prioritizing backlog tasks. Contextual cards can become actionable plans for coding agents, with examples covering database visualization, cloud resource management, and application modernization. Users can create a workflow-specific canvas or install an existing one.

Production AI operations gain profiling and investigation guidance

Operating AI workloads requires visibility into both application behavior and infrastructure pressure. This week's material covers GPU allocation profiling, repeatable agent evaluation, and connections between operational findings and development tools.

AKS GPU profiling identifies allocation sites

GPU memory profiling for Azure Kubernetes Service (AKS) is in preview and tracks memory allocations, not GPU compute utilization. Inspektor Gadget traces CUDA allocation calls at node level without application instrumentation or sidecar containers. Results flow into Pyroscope as Grafana flame graphs and can be correlated with managed Prometheus metrics.

The vLLM example attributes approximately 55.1 GiB of self allocation to the function creating KV cache tensors. This connects observed memory pressure to the allocating code, while preserving the distinction between memory consumption and compute activity.

Agent evaluation connects quality to resource consumption

The Azure Cosmos DB production framework organizes agent operations around observation, evaluation, and optimization. End-to-end traces help locate quality and performance problems, while evaluation suites provide consistent assessments instead of ad-hoc manual testing. Optimization spans retrieval quality, latency, token usage, memory efficiency, and Cosmos DB request unit consumption, with debugging across data, retrieval, memory, and language-model layers.

SRE Agent adds operational context and private integrations

Azure SRE Agent Canvas brings operational findings and context into GitHub Copilot Apps and Copilot CLI. Two private Splunk MCP samples cover same-region and cross-region connections without opening Splunk to inbound internet traffic, while private Azure DevOps repositories can serve as a marketplace for plugins and skills.

Updated security guidance covers execution isolation, secretless credentials, customer separation, encryption, network controls, logging, and data residency. ServiceNow guidance describes incident-type response plans that trigger investigation workflows within existing processes, connecting agent investigations to established incident handling.

Other DevOps News

Before renewing virtual-machine commitments, teams should reassess platform-as-a-service options: App Service removes underlying VM and operating system maintenance, while Azure SQL Managed Instance and Azure SQL Database provide managed patching, backups, and high availability. From February 1, 2027, new eligible reservations for services covered by savings plans will no longer be exchangeable, and moving a workload does not end its reservation obligation.

The Fabric walkthrough covers SQL workload migration, automatic mirroring into OneLake without a separate replication pipeline, and Git-based development and deployment across Fabric and VS Code. Related viewing includes SQL Modernization Day and the PostgreSQL Like A Pro teaser.

Most GitHub repositories now have two of five replicas in Azure, which serves about half of Git traffic. GitHub's infrastructure article describes internal tests showing 3-4x higher throughput with per-reference write serialization, plus virtual write replicas that require Azure Blob Storage durability before acknowledging writes and virtual read replicas that serve traffic without joining the write quorum.

GitHub administrators can convert all branch protection rules in a repository to rulesets through Settings > Rulesets > Import branch protection rules, review coverage, and choose Active, Evaluate, or Disabled enforcement before deciding whether to retain the originals. Pull request reviewers gain saved whitespace preferences, matching diff statistics, and full-width display of new and deleted files in split view.

GitHub restored Enterprise Managed User records affected by incorrect deprovisioning between June 1 and June 13, 2026, which deleted approximately 12,285 accounts, including 76 active accounts, instead of suspending and obfuscating them. Enterprise owners need no action, but can identify affected accounts through user.delete audit events during the incident window.

Co-op Translator uses temporary line and chunk markers to catch missing or reordered labels, alongside deterministic checks for stale translations, broken local links, and some Markdown and notebook integrity problems. Those checks cannot establish meaning or readability, while incremental translation can preserve human edits only when a previous baseline exists and the source and translation structures align.

PowerToys 0.102 expands command-line automation: Advanced Paste accepts files, standard input/output, and clipboard content, while Settings CLI can list or toggle utilities even when PowerToys is not running. The release also adds Mouse Button Lock, CursorHide, an optional Command Palette shelf, and Keyboard Manager profile deployment and export through DSC v3.

Visual Studio 2026 version 18.11 adds Compare with Working Tree to the repository-level commit workflow, comparing a historical commit with current code, including uncommitted changes, without switching branches. The result lists every differing file, not only files changed in the selected commit.

VS Code 1.144 Insiders adds experimental workspace-free session composition and model comparison, richer Mermaid diagram viewing, and separate OAuth tokens for each MCP server, with release notes still evolving. Companion videos cover built-in Markdown editing and integrated terminal operations such as creating, splitting, and clearing sessions.

Also relevant this week

Dates to know

Deadlines

Coming up