Find published research by company, product, platform or technology.
Showing 1–20 of 139 dossiers
Project Rubicon uses object storage, disposable replicas and a reference transaction service to accommodate agent-driven parallel Git writes; access remains limited.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
GitHub Apps can now authenticate Copilot SDK workloads without a user's credentials. Organisation admins control installation permissions, usage attribution and budgets.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
GitHub moved its September 25 deadline to September 29 and has begun full version enforcement for self-hosted runners in Enterprise Cloud. Old pinned images and disabled auto-updates can still stop workflows.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.
GitHub Agentic Workflows 1.2.x previews durable handoffs, hardened egress and queue recovery after GA; teams must distinguish pre-releases from stable deployment guarantees.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
Copilot Projects can coordinate agents, files and recurring tasks across repositories or non-code work; review and permissions remain human responsibilities.
GitHub's 2026 platform data shows agent-started PRs rising sharply. The implications concern code review, security and multi-model workflows, not proof of higher software quality.
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Stacked pull requests are now generally available on GitHub. The shift matters as coding agents make large changes faster than humans can safely review them: teams can keep one coherent change dependency-ordered while reviewing it as smaller PRs.
The useful boundary change is that Copilot can now cross from code and terminals into ordinary desktop interfaces, with per-app approval and organisation-level controls.