Dev Tools
- Dev Tools6 min
Conformance Lets a Client Ignore Half Your Plugin
By Petru Popa ·GitHub shipped Agent Plugins 1.0 across VS Code, Copilot CLI, the Copilot SDK and the Copilot app. The spec repository behind it standardizes the package and explicitly defers trust, permissions, sandboxing and provenance to the client — and lets a conforming client implement skills without MCP servers.
Read - Dev Tools6 min
The Audience Is the One Claim Your Attacker Picks
By Petru Popa ·A proposal to let GitHub Actions workflows pre-declare OIDC audiences is the wrong fix to wait for. Reading the permission schema and AWS's condition-key reference shows why the control that holds today lives on the relying party.
Read - Dev Tools6 min
Three Meters and One Brake
By Petru Popa ·Between 6 and 7 August, GitHub shipped per-agent usage metrics, an effort dial for Copilot code review, an ROI section that prices a developer in pull requests per month, and an organization-wide pull request limit. The limit is documented as applying only to public repositories and only to users without write access — which is not where your agents are.
Read - Dev Tools6 min
The Client List Is the Policy
By Petru Popa ·MCP allowlists went generally available in enterprise managed settings, and a day later enterprises could install third-party GitHub Apps. GitHub's own reference pages name the clients that enforce the first and the missing event stream under the second, and the Copilot cloud agent is covered by neither. What that changes about how you govern agents this quarter.
Read - Dev Tools5 min
MCP's Twelve-Month Deprecation Window Doesn't Cover This Revision
By Petru Popa ·MCP revision 2026-07-28 makes the protocol stateless and adopts a feature lifecycle policy with a twelve-month floor before removal. The removals that will cost you time this quarter never entered that policy, and the deprecated feature with the nearest removal date is the one that has read as deprecated since March 2025.
Read - Dev Tools6 min
npm Revoked the Skeleton Key, Not the Publish Key
By Petru Popa ·npm's 2FA-bypass tokens can no longer take over an account, but they can still publish until January 2027. The migration npm recommends does not exist yet for self-hosted runners — and the docs, not the changelog, are where that is written down.
Read - Dev Tools5 min
The Version Pin That Stopped Protecting You
By Petru Popa ·GitHub Models is gone: playground, catalog, inference API, BYOK. The migration is not a version bump. Two of the three major tags on the official Action still resolve to code that calls the retired endpoint, and the replacement needs a CLI install and a personal access token the old workflow never had.
Read - Dev Tools6 min
A Patch Release With a Major Version Inside
By Petru Popa ·CodeQL 2.26.1 is billed as improved analysis accuracy. The pack changelogs behind it record a breaking change in C/C++, undocumented changes in Python and C#, and alert counts that move in both directions on code nobody touched.
Read - Dev Tools5 min
Approval Gates for Code You Didn't Write
By Petru Popa ·GitHub shipped five small changes in a day — workflow approval, malware advisories, a Copilot app policy, managed settings, and agent telemetry. Read together, they say something about who is expected to do the governance work.
Read