Find published research by company, product, platform or technology.
Showing 1–20 of 156 dossiers
GitHub Apps can now authenticate Copilot SDK workloads without a user's credentials. Organisation admins control installation permissions, usage attribution and budgets.
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
The material change is that model routing is no longer a single opaque optimization target. Developers can now tell Copilot whether to bias Auto toward lower cost, a middle ground or higher quality while GitHub still chooses a model prompt by prompt.
The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.
From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.
GitHub Copilot can now turn Slack or Teams threads into collaborative cloud-agent sessions. Teammates can add context and steer the work in public, while repository permissions, agent budgets and optional extra PR approvals remain the main control boundaries.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
The change separates three things that are often bundled together: the harness, the subscription that pays for it, and the sandbox that executes it. Builders can switch among supported coding agents behind one interface while reusing existing subscription access and reducing credential exposure inside agent runtimes.
The August 28 transition is now active, and Railway’s current documentation removes an earlier ambiguity about new services in existing projects. Config as Code is legacy-only from here; production users should migrate and validate `.railway/railway.ts` before the December hard cutoff.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
GitHub's gh-aw reaches GA, making Markdown-defined agent jobs a supported Actions workflow pattern. Security boundaries, model costs and privileged triggers still matter.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.