Find published research by company, product, platform or technology.
Showing 1–20 of 156 dossiers
GitHub's gh-aw reaches GA, making Markdown-defined agent jobs a supported Actions workflow pattern. Security boundaries, model costs and privileged triggers still matter.
GitHub's October 14 editor's correction confirms Actions workflow lockfiles are available on Free and Team as well as Enterprise Cloud—not enterprise-only as initially reported.
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
GitHub-hosted Actions jobs that use `ubuntu-latest` are about to change operating-system generation without a YAML edit; teams can test on `ubuntu-26.04` now or pin 24.04 while they migrate.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
Teams with pinned, custom-image or auto-update-disabled GitHub Actions runners can now see registration or job execution fail before the September 25 cutoff. The migration is not just a one-time jump to v2.329.0: already-registered runners must also stay within 30 days of the latest runner release.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
Vercel Agent now works in Slack as well as the Vercel dashboard, combining logs, metrics, deployments and repository context with team conversation before proposing approved actions such as pull requests, rollbacks, configuration changes and cache purges.
GitHub Apps can now authenticate Copilot SDK workloads without a user's credentials. Organisation admins control installation permissions, usage attribution and budgets.
Small SaaS teams can now move supported Paddle setup and billing tasks into Claude Code, Codex and similar agent workflows, but production account writes still require careful access control; native metered billing is not generally available.
Grafana Pages goes beyond dashboard panels: prompt-built interactive pages can use connected telemetry and invoke external tools via MCP. It is a public Grafana Cloud preview, not a self-managed release.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.