This Week's Highlights — issue 011, September 11, 2026

Decodes coding-assistant streaming protocols — Server-Sent Events, WebSockets, Protobuf, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication., and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. — inline without buffering, preserving native streaming speed while enabling content inspection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Intercepts destructive shell commands and unauthorized git pushes at the wire level — in the tool call the model streams back — before the client executes them, with configurable block or confirmation-checkpoint policy.

GitHub Actions adds cache-mode to scope least-privilege cache access at the workflow or job level, with values including read, write, and write-only; job-level settings override workflow-level ones, and a called reusable workflow cannot receive more cache access than its caller granted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ A warning annotation is emitted when cache-mode is explicitly set to write or write-only for low-trust events such as pull_request_target, where read is the default.

on:
  pull_request:

permissions:
  contents: read

cache-mode: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
      - run: npm ci

on:
  push:
    branches: [main]

jobs:
  seed-cache:
    runs-on: ubuntu-latest
    cache-mode: write-only
    steps:
      - uses: actions/checkout@v4
      - uses: actions/cache@v4
        with:
          path: dist/
          key: ${{ runner.os }}-dist-${{ github.sha }}
      - run: npm run build

New REST endpoints let admins read and update AI Scan for pull requests enablement programmatically: GET/PATCH /orgs/{org}/code-scanning/ai-scan at the organization level and GET/PATCH /repos/{owner}/{repo}/code-scanning/ai-scan at the repository level, in public preview. This enables at-scale rollout of AI-powered PR security detections without configuring each repository through the UI.

$ curl -X PATCH \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  -d '{"enabled": true}' \
  https://api.github.com/repos/{owner}/{repo}/code-scanning/ai-scan

$ curl -X GET \
  -H 'Authorization: Bearer <token>' \
  -H 'Accept: application/vnd.github+json' \
  https://api.github.com/orgs/{org}/code-scanning/ai-scan

Rulesets can require secret scanning alerts to be resolved before a PR can merge, configurable via the Require secret scanning alerts are resolved rule under Repository > Rulesets, the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.'s require_secret_scanning_alert_resolution rule type (with a secret_types parameter), or the GraphQL REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION rule type — available at repository, organization, and enterprise level, and configurable to cover custom or generic secret patterns beyond default provider patterns.

New GET /actions/runners/deprecations/{version} endpoint (available at repository, organization, and enterprise level) returns runner_version, runtime_deprecates_at, and registration_deprecates_at so teams can plan runner upgrades before support ends.

$ curl -H "Authorization: Bearer <token>" \
  -H "Accept: application/vnd.github+json" \
  https://api.github.com/actions/runners/deprecations/2.315.0

CodeQL 2.27.0 and 2.26.4 expand query and sink coverage across languages: the new rust/command-line-injection query detects uncontrolled command lines in Rust; PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare are added as SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. sinks for cpp/sql-injection and related C/C++ queries; taint tracking is added for OData action parameter binding in C# (ODataActionParameters, Delta); SQL injection sink models are added for Spring R2DBC DatabaseClient and the R2DBC SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. in Java/Kotlin; Python taint flow now propagates through list.extend and list.insert (matching existing list.append coverage); Java/Kotlin taint propagation is added through String.valueOf(Object) when the argument is a CharSequence; JavaScript/TypeScript gains support for regular expressions using the d flag and the React Native Worklets 'worklet' directive; and EnvironmentCheck can now be specified via a models-as-data model for custom environment sanitizer definitions.

Dependabot's GITHUB_TOKEN now automatically requests the packages: read permission and sends that token when pulling from *.pkg.github.com and ghcr.io, so no PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.-based registry entries in dependabot.yml are needed. Dependabot reuses existing Manage Actions access grants on package settings pages to authenticate, covering every GitHub Packages ecosystem Dependabot supports.

CodeQL 2.27.0 adds native Linux ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support for the CLI and bundle via the linux-arm64 per-platform release assets. The generic multi-platform codeql.zip CLI distribution will be removed in a future release, so users must switch to the per-platform .zip for their platform; the CLI now emits a warning when run from an all-platforms distribution, which can be suppressed by setting CODEQL_ALLOW_ALL_PLATFORMS_DIST=true.

Four new job context properties — job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path — let a reusable workflow determine its own source identity at runtime; not available on GitHub Enterprise Server.

jobs:
  called-job:
    runs-on: ubuntu-latest
    steps:
      - name: Print reusable workflow identity
        run: |
          echo "Workflow ref: ${{ job.workflow_ref }}"
          echo "Workflow SHA: ${{ job.workflow_sha }}"
          echo "Repository:   ${{ job.workflow_repository }}"
          echo "File path:    ${{ job.workflow_file_path }}"

Claude Fable 5.1 is now available for Copilot Pro+, Max, Business, and Enterprise users. Gemini 3.8 Flash rolls out to Copilot Pro, Pro+, Max, Business, and Enterprise users across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, the Copilot app, JetBrains IDEs, Xcode, and Eclipse, with admin control via the model policy's default model enablement toggle. GPT-6 Astra, OpenAI's agentic long-horizon coding model, is now generally available and selectable across VS Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, the Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse, with Enterprise/Business admins able to enable or restrict it via the same model policy control.

A new vulnerability-alerts permission for GITHUB_TOKEN supports read and none values, enabling least-privilege read-only access to Dependabot alerts without broader scopes.

permissions:
  vulnerability-alerts: read

jobs:
  audit-alerts:
    runs-on: ubuntu-latest
    steps:
      - name: List Dependabot alerts
        run: gh api repos/${{ github.repository }}/dependabot/alerts

An Assign to Copilot bulk action lets you select up to 25 standard Code Quality findings and have Copilot fix them agentically on a branch, validate its own changes, and open a pull request for review. Available for repositories with GitHub Code Quality enabled on GitHub Team and GitHub Enterprise Cloud (including data residency), governed by the existing enterprise Code Quality policy with no separate policy to manage.

Repository rulesets now support bypass by individual users, letting administrators add specific accounts (e.g. a service account) to a bypass list without creating a dedicated role or team. A new required reviewers rule supports pattern matching on branches, files, and folders, plus a configurable minimum number of reviews per team.

npm packages can now have multiple trusted publishing (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.) configurations, each with independent repository, workflow, and environment criteria — a publish or stage is authorized if the incoming OIDC token matches any one configuration. Direct publishing is now opt-in per configuration, with staging-only as the default and every configuration able to stage without extra setup. The staged publishing queue's approval button is disabled while malware scanning is in progress and re-enables automatically once it completes, refreshing scan status every minute. The versions tab on npmjs.com now shows a per-version staged history, including whether each version was approved, rejected, or remains staged.

A redesigned repository PR listing page enters public preview with content assist to help find and apply filters, advanced search supporting AND/OR keywords and nested searches, a collapsible sidebar with quick filters like Authored by me and Involves me, a compact presentation mode, and richer per-PR context including status check counts, stack indicators, and unread-update indicators. Opt in via the Preview badge on the pull requests tab, and switch back to the classic view the same way.

Administrators can centrally control Copilot's sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access via managed restrictions that override user settings, visible under GitHub Copilot > Sandbox when the Editor Preview feature flag is on or a managed setting is configured (public preview). Enterprise policy diagnostics let admins verify that Copilot policies are correctly detected and enforced on a device.

⤢ ⤢

The /ide command in GitHub Copilot CLI (public preview) connects a terminal session to JetBrains IDE context, including selections, diagnostics, and file references. Shell commands run in that session can consume IDE terminal environment variables and the project's configured Python interpreter, and can activate the project's local Python virtual environment.

⤢

CodeQL changes how it evaluates author-association and actor-field checks in GitHub Actions event payloads (e.g. github.event.pull_request.user.login), treating them as protection only when the relevant field is actually populated for that event — this may surface additional alerts for workflows relying on previously ineffective checks, and environments are no longer treated as a sufficient sanitizer. The actions/unpinned-tag query also now detects mutable references to reusable workflows, extending pinning enforcement beyond actions to workflow calls.

HydraFusion, a research preview model selectable like any other model in GitHub Copilot, dynamically orchestrates multiple models across providers using Single, Cascade, or Critique execution patterns to balance quality, cost, and latency per task. Feedback on the preview can be submitted directly from the command line with /feedback in Copilot CLI.

$ /feedback

Enterprise admins can centrally block, require human approval for, or auto-allow specific shell commands, file reads/edits, and network domains that Copilot agents perform, enforced across the GitHub Copilot app, GitHub Copilot CLI, and Visual Studio Code Agent Host sessions. Policies can be scoped per enterprise team, and managed restrictions override and cannot be weakened by user settings, workspace settings, auto-approval rules, or previously saved approvals.

CodeQL improves ASP.NET Core MVC controller and action discovery to more closely match runtime behavior, covering application parts, endpoint mappings, inherited actions, and exclusions (2.27.0); the cs/web/missing-token-validation query now recognizes enabled ASP.NET Core RequireAntiforgeryToken attributes when antiforgery middleware is used (2.26.4).

Flags newly registered lookalike domains and phishing infrastructure within hours of registration, using logo detection and image OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. to catch impersonation beyond keyword matching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Surfaces compromised employee credentials from active infostealer logs within hours of exfiltration, with VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. monitoring available for executive accounts.

For Malicious Site Monitoring and Dark Web Brand Monitoring, an AI Triage Agent automatically evaluates high-interest detections and delivers an explicit verdict with reasoning, surfacing only critical, high-priority Alerts.

Adds --compiler-scan / --no-compiler-scan flags to enable or disable a compiler-analyzer channel using gcc -fanalyzer or clang --analyze, and --compiler-scan-max-tus <n> to cap the number of translation units analyzed (default 2000).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ /scan /path/to/c-project --compiler-scan --compiler-scan-max-tus 500 --build-command 'make -j4'

Adds --audit-verbose for strace-style verbose output during sandbox audit runs, and --audit-budget <n> to cap the maximum number of audit events collected per run.

$ /scan /path/to/target --audit --audit-verbose --audit-budget 500

Adds --expanded-semgrep to re-run Semgrep rules over preprocessor-expanded views of macro-heavy C/C++ translation units, catching bugs that only appear after macro expansion.

$ /scan /path/to/c-project --expanded-semgrep --languages c,cpp