Dev Tools — page 3 of 3
- Dev Tools6 min
npm Revoked the Skeleton Key, Not the Publish Key
By Petru Popa ·npm's 2FA-bypass tokens can no longer take over an account, but they can still publish until January 2027. The migration npm recommends does not exist yet for self-hosted runners — and the docs, not the changelog, are where that is written down.
Read - Dev Tools5 min
The Version Pin That Stopped Protecting You
By Petru Popa ·GitHub Models is gone: playground, catalog, inference API, BYOK. The migration is not a version bump. Two of the three major tags on the official Action still resolve to code that calls the retired endpoint, and the replacement needs a CLI install and a personal access token the old workflow never had.
Read - Dev Tools6 min
A Patch Release With a Major Version Inside
By Petru Popa ·CodeQL 2.26.1 is billed as improved analysis accuracy. The pack changelogs behind it record a breaking change in C/C++, undocumented changes in Python and C#, and alert counts that move in both directions on code nobody touched.
Read - Dev Tools5 min
Approval Gates for Code You Didn't Write
By Petru Popa ·GitHub shipped five small changes in a day — workflow approval, malware advisories, a Copilot app policy, managed settings, and agent telemetry. Read together, they say something about who is expected to do the governance work.
Read