GitLab Fixes CVSS 10 Flaw in CI/CD Regex Engine, Plus 23 Other Vulnerabilities
GitLab is telling every self-managed customer to upgrade now. On October 12, the company shipped versions 19.4.2, 19.3.5, and 19.2.8 of GitLab Community Edition (CE) and Enterprise Edition (EE). The releases fix 24 security vulnerabilities. One has a CVSS score of 10.0, the highest rating possible. GitLab.com already runs the patched code. GitLab Dedicated customers […]
GitHub Narrows App Permissions to Pull Teams Off Classic PATs
GitHub is giving DevOps teams more ways to limit an automation job to only the access it needs. A batch of GitHub Apps updates released Oct. 13 adds narrower permissions, relaxes a long-standing install restriction for repository administrators, and makes it easier to move users to expiring tokens. GitHub says the goal is to help […]
npm Puts a 48-Hour Clock on Unused Trusted Publishing Configurations
GitHub has added an expiration date to unused npm trusted publishing configurations. Any configuration that doesn’t complete a successful publish within 48 hours of creation now expires and can no longer authorize a release. It’s a small change. But it closes a gap that matters to anyone who publishes packages from a CI/CD pipeline. How […]
Anthropic Builds Its Own Source Control After AI Agents Outgrow Git
Anthropic has moved its internal monorepo off Git and onto a version control system it built from scratch. The reason is simple. Its AI agents now write code faster than Git-based infrastructure can handle it. In a post on its engineering blog, the company said it averaged about 2,500 merged code changes a day in […]
Noma Security Discloses Claude Code Desktop Exploit
Security researchers at Noma Security uncovered SneakPeek, a vulnerability in Anthropic’s Claude Code Desktop that allowed malicious JavaScript embedded in large HTML files to bypass sandbox protections and silently steal sensitive local data. The flaw exposed credentials, API tokens and Kubernetes configurations through the application’s preview pane. Although Anthropic has released a security update addressing the exploit, the discovery highlights growing software supply chain risks as AI coding tools become embedded in developer workflows without sufficient security oversight.
GitHub Ties Every Commit to the Account That Pushed It
GitHub has introduced push attribution in limited public preview for Enterprise customers, adding authenticated pusher identities to commits alongside author and committer information. A new repository rule can also block pushes when committer details don’t match the authenticated account, helping DevOps teams combat identity spoofing, improve audit trails and strengthen software supply chain security.
AI Is Automating Code. The Job Is Engineering
AI is automating coding, but software engineering still requires human judgment. Explore what shifting developer demand means for DevOps, QA and software delivery.
Cloudflare Brings the Deno Team In to Make Self-Hosted Workers Practical
Cloudflare brings Deno’s team aboard to expand self-hosted Workers and Durable Objects as Deno Deploy winds down and runtime support enters its final year.
LocalStack Extends Emulation Reach to Microsoft Azure Services
LocalStack has made available a public beta of its platform that enables application developers to emulate Microsoft Azure cloud services on their local machines. Colin Neagle, head of marketing for LocalStack, said LocalStack now enables application developers to build software locally that can run across more than 40 Azure services. Following initial support for cloud […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
OllyGarden Extends AI Agent to Identify Instrumentation Gaps
OllyGarden expands its Rose AI agent with Minimum Viable Instrumentation to identify observability gaps, optimize OpenTelemetry data and reduce telemetry costs.
IBM and Red Hat Disclose Discovery of More Than 400 Java Vulnerabilities
IBM and Red Hat this week reported they have identified and remediated more than 400 previously unknown vulnerabilities in Java libraries since launching a Lightwell initiative earlier this year. Additionally, Lightwell Clearinghouse, a program that enables IT organizations to submit specific open source software dependencies for priority review and remediation, is now generally available. Ben […]
New Relic Debuts Command-Line Observability Tool for Developers and AI Agents
New Relic has unveiled Ground Truth CLI, a command-line tool that enables software developers and AI agents to analyze system performance and verify whether technical issues have been resolved without needing to use dashboards. The release reflects a big shift in enterprise IT as AI agents take on more advanced troubleshooting tasks. Traditional observability dashboards […]
Docsy for AI Agents, Oh, and People Too
Google’s Docsy is joining the Linux Foundation as AI agents become documentation readers. Prague — When I grew up in programming, if you didn’t understand something in the code or operating system, you were told to Read The Fine (Ah, yeah, fine) Manual (RTFM). Of course, back then we actually had manuals and documentation. Since […]
Harness Acquires Augment Code Assets to Expand Reach into AI Coding
Harness today added an artificial intelligence (AI) coding offering to its portfolio after revealing it acquired select assets from Augment Code. The Harness Cosmos Software Factory is based on Cosmos, a set of AI coding agents, an Auggie command line interface (CLI), a Code Context Engine and other related technologies originally developed by Augment Code. […]
Coding Agents Broke Git’s Scaling Math. GitHub Is Rebuilding to Keep Up
GitHub is rebuilding its Git infrastructure as AI coding agents drive billions of commits, promising up to 35x faster writes while exposing new DevOps bottlenecks.
HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs
HackerOne research shows vulnerability remediation is getting faster, but AI-driven discovery is expanding exposure debt even more quickly, putting DevSecOps teams under growing pressure.
DevOps Has Always Been Hard to Define. Does a Standard Help?
The new DevOps Standard deserves a serious reading. Its lasting value will depend on whether it helps organizations apply shared principles as people and agents take on different responsibilities.
GitHub Slams the Brakes on Private Vulnerability Reports
Drowning in AI-generated bug reports? GitHub has a radical answer: Stop accounts from reporting them. GitHub’s new limits on bug reports aren’t a solution to the AI bug-report flood. Anything but! They’re an admission that the traditional security-disclosure workflow, with human maintainers in the loop, simply doesn’t scale. The scarce resource is no longer discovering […]
Ten Great DevOps Job Opportunities
DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted as part of an effort to better serve our audience. Our goal in these challenging economic times is to make it just that much easier for DevOps professionals to advance their careers. Of course, the pool of […]
Open Source Mod Brings Rate Limits, Costs and CI Status Into View for Claude Code Users
Claude Statuspane gives developers real-time visibility into Claude Code context use, rate limits, costs and CI status, highlighting a growing need for agent observability.
Base44 Unveils AI Platform to Transform Application Development
Base44 this week unfurled a cloud-based platform that leverages artificial intelligence (AI) to foster greater collaboration between software engineers, application designers and product management teams. Yoav Orlev, chief product officer for Base44, said at the core of the Base Code platform is a harness the company developed that enables multiple AI models to be used […]
The DevOps Standard Gives Teams a Shared Model for Software Delivery
A release can pass every pipeline check and still leave an organization uncertain about whether to proceed. Security evidence may exist in another system, the recovery plan may be incomplete, and nobody may own the final decision. The difficulty lies in how the delivery system connects its capabilities and responsibilities. The new DEVOPS INSTITUTE Official […]
Showing the 24 most recent articles. Additional archive pages are not yet available.