GitHub's package firewall preview: a checkpoint between coding agents and npm
GitHub's package firewall checks npm installs from CI runners and coding agents against age, malware and attestation rules. How it works, and its limits.
6 min read
Blog tag
#DevOps
Building, shipping and running software, with AI in the loop.
Anthropic moved its monorepo off Git: what agent-scale merging asks of yours
Anthropic built Scion after daily merges rose from 2,500 to over 30,000. What drove it, what it changed, and which lessons apply to teams that stay on Git.
MCP servers over HTTP: the SDK resource limits you now have to set
Recent MCP SDK advisories added size, batch, session and validation limits to HTTP servers. Some need a code change, not just an upgrade. What to check.
GitHub's AI Scan and agentic autofix are GA: what they will and won't do
AI Scan adds advisory findings to pull requests; agentic autofix turns alerts into draft fixes. Coverage, limits, billing and how to fit both into review.
5 min read
When a repository's git config runs code: ConfigPoisoning and coding agents
GitLab researchers showed a coding tool running attacker code from a repository's own git filters. Why deny-lists fail, and what to ask of tools that run git.
5 min read
The tensorlake npm worm: planted agent settings and a revoke-first trap
A poisoned tensorlake release stole developer credentials, planted Claude Code and VS Code settings in repositories, and punished revoking tokens first.
6 min read
Copilot's Agents window and worktree cleanup: running many agent sessions
VS Code 1.141 adds a session grid and worktree cleanup for parallel Copilot agents. What changed, and the review and disk habits that parallel sessions need.
Browse by tag
- #Security (54)
- #Agents (40)
- #AI coding tools (37)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Networking (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (1)
- #Skills (1)
- #Testing (1)