MCP moves to a stateless core on July 28, 2026, and GitHub MCP Server already supports the latest spec. The practical changes are fewer session dependencies, less payload inspection, and official conformance tests for agent infrastructure.
GitHub’s security cleanup shows that the hard part is not finding secrets, but routing real risk to the right owners. The company says it cleared 20,000-plus alerts across 15,000 repositories in nine months.
Dependabot will now wait until a new package release has been on its registry for at least three days before opening a version-update pull request. Security updates still open immediately, and teams can tune or opt out through cooldown configuration.
GitHub code scanning can now show AI-powered security detections directly on pull requests. The preview extends coverage beyond languages and frameworks supported by CodeQL, while requiring GitHub Code Security, a Copilot license, and AI credits.
A public issue carrying hostile instructions became the evidence HN needed for a sharper debate about agent permissions.
GitHub is moving Copilot CLI from one-off terminal help toward versioned team workflows. The new custom agents cover at least four repeated tasks: security audits, release notes, infrastructure reviews, and incident response.
Copilot now has its first selectable open-weight model. GitHub says Kimi K2.7 Code starts in VS Code for Pro tiers, with Business and Enterprise admins required to enable it by policy.
GitHub compared the Copilot agentic harness against native model harnesses on five task suites. With the model and task held fixed, it claims comparable task resolution and fewer tokens across most configurations.
GitHub Desktop 3.6 moves three agent-era Git chores into the client: worktrees, Copilot-written commits, and AI-assisted merge conflict review. The bigger shift is that Desktop now treats parallel branches and model choice as everyday developer controls.
GitHub added another enterprise model option to Copilot. Microsoft AI’s in-house coding model MAI-Code-1-Flash is now generally available for Copilot Business and Enterprise, with admin policy controls and usage-based billing.
Opus 4.6 fast is leaving GitHub Copilot on June 29, 2026. The sunset covers Copilot Chat, inline edits, ask and agent modes, and code completions, with Opus 4.8 fast listed as the replacement.
Security alerts are moving from volume to trust. GitHub says LLM-based contextual verification reduced secret-scanning false positives by 75.76%, beating its 65% target.