The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
WebMCP tools can now emit PostHog's standard `$mcp_tool_call` event through posthog-js. The implementation adds privacy redaction and omits arguments/results, but only works for sites that enable the feature and initialise instrumentation before registering tools.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
Publishers can opt out of AI model training without necessarily leaving traditional search or AI citations. Microsoft's new page-level grounding controls introduce a migration trap for sites relying on legacy NoArchive/NoCache settings.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
Microsoft's October 13 Topics Portfolio beta shows AI-grounding queries that cite rivals but not your site, grouped by theme with approximate demand and competition measures; access depends on sufficient site data.
The incidents do not have a proven common attacker. Wiz's forensic evidence shows downstream abuse and resale of stolen keys, not that every platform breach caused the same misuse.
A missed call can now become a billable Google Local Services Ads lead. Advertisers should review phone routing, business hours and the 30-day credit window rather than assuming only answered calls count.
From December 3, agent workflows that ask Atlassian's Teamwork Graph for cross-product context will need a cost budget. Most enriched tool calls use 1–10 Rovo credits, with paid overages at $0.01 per credit.
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
WooCommerce is removing unnecessary block bootstrap work from non-rendering requests. The performance gain is concrete, but extension authors need to understand the new registration boundary rather than assuming Woo blocks are always initialized.
Developers can submit tool integrations to Google Search and Gemini using MCP, but access is phased, users must connect apps, and Google reviews submissions.