Dev Tools — page 1 of 2
- Dev Tools6 min
npm Trusted Publishing Is Now an Or Across Ten Configurations
By Petru Popa ·A package can now carry up to ten trusted publishing configurations, and a publish is authorized if the incoming OIDC token matches any one of them. Adding a configuration can only widen who can publish — and the configurations that leave no provenance attestation are the ones you would least want to be the weak link.
Read - Dev Tools6 min
GitHub Stargazers Now 404s. Its Replacement Is a Reconciled Series, Not an Event Log.
By Petru Popa ·GitHub closed the stargazers listing endpoint in June and shipped an aggregate star history series on 4 September. Measured against three repositories, the new series reconciles exactly to the live star count and contains no negative buckets, which tells you what it can and cannot reconstruct.
Read - Dev Tools5 min
Your Supply Chain Has an Expiry Date. GitHub CLI's Is Tomorrow.
By Petru Popa ·GitHub announced on 3 September that the PGP key signing its Linux gh packages expires on Saturday. Any image that added the APT or RPM repository before 8 April and has not re-run the install steps will fail on the next apt update. The replacement keyring is already published, and reading the key material answers a planning question neither the changelog nor the issue calls out.
Read - Dev Tools6 min
Copilot Code Review Can Approve Pull Requests. Four of Our Last 53 Would Qualify.
By Petru Popa ·GitHub shipped Copilot approvals on 1 September. The approval is the headline; the eligibility rule buried in the repository settings is what decides whether the feature ever fires on your pull requests.
Read - Dev Tools6 min
Log Retention Falls to 90 Days, and Two More Defaults You Did Not Choose
By Petru Popa ·From 1 October, GitHub applies artifact-and-log retention to checks, workflow runs, and statuses, which had been kept past 400 days regardless of the setting. Public repositories cap at 90 days with no value above it. Two other defaults moved in the same window, in opposite directions.
Read - Dev Tools6 min
Gang Scheduling Is Beta, and Beta Means Off
By Petru Popa ·Kubernetes v1.37 graduates gang scheduling to Beta through the Workload and PodGroup APIs. The feature gate that turns it on ships defaulted to false, and the DRA piece that makes it useful for GPU jobs is a second gate, also off, that depends on the first.
Read - Dev Tools6 min
Stacked Diffs Split the Change, Not the Reviewers
By Petru Popa ·maiao v1.4.0 brings Gerrit-style stacked diffs to six git hosts, weeks after GitHub put native stacked pull requests into public preview. The repository ships itself as a stack, which turns its own release into a measurement of what stacking buys.
Read - Dev Tools5 min
Write Access Decides Who Starts the Agent, Not Who It Hears
By Petru Popa ·GitHub shipped shared Copilot cloud agent sessions into Slack and Microsoft Teams in public preview. Only people with repository write access can trigger the agent, and guests cannot start or steer a session at all. But the docs also say the agent reads every message in the conversation. Those are two different boundaries, and only one of them is enforced.
Read - Dev Tools6 min
The OAuth Consent Screen Can Now Hand Back Less Than You Asked For
By Petru Popa ·Cloudflare added an optional_scopes field to third-party OAuth clients, so a user can clear individual permissions at the consent screen and the issued token carries only what survived. The announcement tells you to check the granted scope set. It does not say which field carries it, and neither does the client documentation. RFC 6749 does.
Read - Dev Tools5 min
The Mojo License Is Apache. The MAX SDK License Is Not.
By Petru Popa ·Modular put the Mojo compiler on GitHub under Apache 2.0 with LLVM exceptions. The same repository carries the Modular MAX Community License, whose terms are not the Apache terms and which never names the packages it governs. Nine merged pull requests across all of 2026 answers the other question a technical lead has.
Read - Dev Tools6 min
The Reviewable Unit Is the Pull Request, Not the Commit
By Petru Popa ·Wiz published research on an Actions script injection that leaked a Jira API token from a Snowflake runner. The pull request that introduced it carries a commit attributed to Copilot Autofix, and the diff removed the exact mitigation GitHub's own hardening page prescribes. The artifact cannot tell you which lines the model wrote — and that gap, not the model's error rate, is what your review process has to absorb.
Read - Dev Tools6 min
Your Refresh Token Is Now a Lock, Not a Secret
By Petru Popa ·OAuth apps on GitHub can now register up to ten redirect URIs and refresh short-lived tokens. The authorization docs add the part the changelog leaves out: refreshing invalidates the refresh token and the old access token together, which turns a copyable secret into something exactly one process may hold.
Read