Latest from Tom

GitLab Fixes CVSS 10 Flaw in CI/CD Regex Engine, Plus 23 Other Vulnerabilities
GitLab is telling every self-managed customer to upgrade now. On October 12, the company shipped versions 19.4.2, 19.3.5, and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). The releases fix 24 security vulnerabilities. One has a CVSS score of 10.0, the highest rating possible. GitLab.com already runs the patched code. GitLab Dedicated customers […]
Oct 14, 2026 · 3 minAll articles by Tom Smith
Showing 1–24GitHub Narrows App Permissions to Pull Teams Off Classic PATs
GitHub is giving DevOps teams more ways to limit an automation job to only the access it needs. A batch of GitHub Apps updates released Oct. 13 adds narrower permissions, relaxes a long-standing install restriction for repository administrators, and makes it easier to move users to expiring tokens. GitHub says the goal is to help […]
npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations
GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no longer authorize a release. It’s a small change. But it closes a gap that matters to anyone who publishes packages from a CI/CD pipeline. How […]
Anthropic Builds Its Own Source Control After AI Agents Outgrow Git
Anthropic has moved its internal monorepo off Git and onto a version control system it built from scratch. The reason is simple. Its AI agents now write code faster than Git-based infrastructure can handle it. In a post on its engineering blog, the company said it averaged about 2,500 merged code changes a day in […]
GitHub Ties Every Commit to the Account That Pushed It
GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer information. A new repository rule can also block pushes when committer details don’t match the authenticated account, helping DevOps teams combat identity spoofing, improve audit trails and strengthen software supply chain security.
Cloudflare Brings the Deno Team In to Make Self-Hosted Workers Practical
Cloudflare brings Deno’s team aboard to expand self-hosted Workers and Durable Objects as Deno Deploy winds down and runtime support enters its final year.
Coding Agents Broke Git’s Scaling Math. GitHub Is Rebuilding to Keep Up
GitHub is rebuilding its Git infrastructure as AI coding agents drive billions of commits, promising up to 35x faster writes while exposing new DevOps bottlenecks.
Open Source Mod Brings Rate Limits, Costs and CI Status Into View for Claude Code Users
Claude Statuspane gives developers real-time visibility into Claude Code context use, rate limits, costs and CI status, highlighting a growing need for agent observability.
IBM Moves Its Bob Coding Agent Inside the Firewall
Plenty of enterprises want AI coding agents. Fewer are willing to send their source code to someone else’s cloud to get them. That tension has slowed adoption at banks, insurers, government agencies and other organizations that build software under strict rules about where code and data can live. IBM is betting a self-hosted option will […]
Git 2.56 Takes Aim at Messy Merges, Slow Diffs and Branch Sprawl
Git 2.56 improves merge safety, speeds up large-repository operations and adds cleanup tools that could prove especially useful for AI coding agents and busy DevOps teams.
GitHub’s Security Autofix Agent Now Remembers What It Fixed
GitHub’s agentic autofix now uses Copilot Memory to reuse repository-specific security fix patterns, helping Copilot apply lessons from past vulnerabilities across future alerts, reviews and coding workflows.
GitHub Gives Enterprises a Full Count of Who Holds the Keys
GitHub Enterprise Cloud now lets organizations export a full inventory of credentials, helping security teams identify stale, overprivileged and forgotten access across users, apps and automation.
Your AI Coding Assistant Has the Keys to the Repo. Z.ai Just Showed Why That Matters
ZCode’s default-on indexing feature reportedly uploaded entire developer workspaces to cloud storage, highlighting why AI coding assistants should be treated as privileged software and closely monitored.
Codex Sandbox Escapes Show Why Agent Guardrails Can’t Live Inside the Agent
Two patched OpenAI Codex vulnerabilities, Heapjack and Overpatch, exposed how coding agents can escape sandboxes and reach developer systems without approval prompts.
Claude Code Adds AGENTS.md Fallback, Cutting Instruction File Sprawl
Claude Code now supports AGENTS.md, giving development teams a shared instruction format across multiple AI coding agents and reducing configuration drift.
GitHub Separates Who Writes Code From Who Runs Your CI
GitHub’s new workflow execution protections let teams control who and what can trigger Actions workflows, reducing CI/CD attack paths and tightening pipeline security.
Anthropic Adds a Coordinator to Claude Projects for Running AI Work in Parallel
Anthropic’s redesigned Claude Projects coordinates parallel Claude Code sessions, delegates work across branches and brings the results back through familiar pull-request review workflows.
Java 27 Tackles Post-Quantum Security and a Faster Patch Cadence
Java 27 strengthens enterprise security with monthly critical patch updates and post-quantum TLS 1.3 support, helping organizations prepare for AI-driven threats and future quantum risks.
More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches
Attackers are actively exploiting three JFrog Artifactory flaws, exposing how slow patching can turn artifact repositories into software supply chain attack paths.
GitLab’s Critical Patch Closes a Path Traversal Flaw Attackers Are Already Probing
GitLab patches two critical flaws, including a CVSS 10.0 unauthenticated file-read vulnerability, putting self-managed instances under urgent pressure to upgrade.
GitHub’s August Outages Show Growth Is Outpacing Infrastructure
GitHub’s August 2026 report details five outages tied to Actions and Copilot growth outpacing infrastructure. Here’s what platform teams should know.
GitHub Widens the Door on Advanced Security Trials
GitHub raised its self-serve Advanced Security trial cap from 100 to 300 licenses, letting more mid-size Enterprise Cloud orgs test for free.
GitHub Puts Guardrails on Copilot’s Sandbox Inside JetBrains IDEs
JetBrains IDEs are where a lot of enterprise backend work happens — Java, Kotlin, Spring, big monorepos with a lot to break. So when an AI coding agent starts running shell commands inside that environment, the question isn’t whether it’s useful. It’s what happens if it touches the wrong file, the wrong network path, or […]
Rust’s First Debugging Survey Shows Most Developers Skip the Debugger Entirely
Most Rust developers don’t use a debugger. That’s the headline finding from the Rust compiler team’s first dedicated debugging survey, and it’s worth sitting with for a second. Rust has spent years building a reputation as the language that catches your mistakes before you ship them. The compiler is famously strict. The type system is […]