Find published research by company, product, platform or technology.
Showing 21–40 of 364 dossiers
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
A hard shutdown date makes this more than a hosting refresh: unmigrated Codeberg Pages sites will go offline, and the replacement changes deployment and URL behaviour.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
The significance is not that Git is obsolete: Anthropic's unusually large agent workload prompted an internal architecture with sparse on-demand checkouts and server-side source-control APIs. Its claimed performance gains are not independently benchmarked.
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
GitHub-hosted Actions jobs that use `ubuntu-latest` are about to change operating-system generation without a YAML edit; teams can test on `ubuntu-26.04` now or pin 24.04 while they migrate.
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
The material change is that model routing is no longer a single opaque optimization target. Developers can now tell Copilot whether to bias Auto toward lower cost, a middle ground or higher quality while GitHub still chooses a model prompt by prompt.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.