devops

GitHub says GitHub Apps and fine-grained PATs get two new repository permissions, repository admins can add org-approved apps, and apps gain offline_access.

GitHub's October 12 changelog adds an Anonymous option for organization-level Dependabot private registries; two docs pages read October 13 still list Token, Username and password, and OIDC.

Atlassian disclosed CVE-2026-21589, a 9.3-rated path traversal letting unauthenticated attackers read known files in eight self-hosted products, with fixes listed for each.

GitHub says all newly minted App installation tokens are now stateless JWTs of about 520 characters; the opt-out header ends November 30, 2026.

Cursor released two automated bots that watch code from pull request to production and scan every PR for security flaws, six weeks after acquiring startup Firetiger.

AWS introduced CloudWatch Omni, an off-console observability tool unifying application and AI-agent monitoring behind enterprise SSO, with an AI investigation agent.

Harness launched an agent-ready code repository and an AI Code Review product built to handle thousands of pull requests per second as coding agents multiply PR volume.

CISA added CVE-2026-82329, a 9.8-severity Artifactory authentication bypass, to its exploited-vulnerabilities catalog days after JFrog patched it.

Diagrid's Catalyst 2.0 adds Dapr-based cryptographic attestation and automatic failure recovery for AI agents across ten frameworks, including LangGraph and Microsoft Agent Framework.

Packer 1.16 adds a provenance post-processor and a verify-attestation command, letting teams cryptographically sign and check the origin of every machine image they build.

Dash0 buys Berlin's Polar Signals to bring CUDA-aware continuous profiling and a new storage engine into its OpenTelemetry-native observability platform.

Grafana 13.2 brings a generally available shared query library, Git Sync support for GitHub Enterprise and webhook-based GitLab/BitBucket sync, and a public-preview view panel sidebar for viewers.