Insights, Guides & Product Strategy

Version Comparison Has No Standard

SemVer defines no range syntax. Debian, PEP 440, npm, Maven, RPM and Go each order versions differently, and the cross-ecosystem spec is still unpublished.

Dark cover: local model, remote telemetry, listing local model, COPILOT_OFFLINE and remote base URL

Oct 9, 2026

A local model in Copilot CLI is not local privacy

Copilot CLI 1.0.94-0 discovers local Ollama models, but GitHub says that does not enable offline mode or disable telemetry. Those are separate settings.

Dark cover: node:sqlite drops the Sync suffix, with DatabaseSync, Database and node:sqlite/promises listed

Oct 9, 2026

node:sqlite renamed DatabaseSync to Database

Node 26.11.0 renamed DatabaseSync to Database. The old names survive as documentation-only aliases, so no code breaks and no runtime warning fires.

Dark cover: pnpm can skip node_modules, listing the isolated, loaded and excluded linker settings

Oct 9, 2026

pnpm 12.10 can install without a node_modules tree

pnpm 12.10.0 adds an experimental loaded nodeLinker that reads packages from the content-addressable store. It ships with an exclusion list for a reason.

Dark cover: Copilot Sandboxing Is Off by Default, with macOS, Linux and Windows sandbox backend rows

Oct 8, 2026

Copilot Local Sandboxing Is GA and Off by Default

GitHub called local Copilot sandboxing generally available on 7 October. Its own docs still say public preview, experimental, and off by default.

Dark cover: Copilot Metrics Undercount Agents, with VS Code, Visual Studio and JetBrains fix-version rows

Oct 8, 2026

Data & Analytics

Copilot Usage Metrics Undercounted Your Agents

GitHub confirmed agent activity went missing from Copilot usage metrics. Billing is fine, the numbers are not, and past data cannot be backfilled.

Dark cover: The npm Read Path Has No Owner, with api-docs, commonjs wiki and repo markdown rows

Oct 8, 2026

The npm Read Path Has No Owner

The endpoint every npm install hits is missing from npm's API docs. What specifies it is a 2014 wiki page and an unversioned repo markdown file.

Cover: Your Tarball Ships Your .env, with rows for .npmrc always blocked, .env no rule, files allowlist.

Oct 7, 2026

npm Will Never Publish Your .npmrc. It Will Publish Your .env.

npm hardcodes a list of files it refuses to publish. Your registry token is on it; your .env is not. pnpm 12.8 added a warning, not a block. The real fix.

Cover: Git 3.0 Defaults To SHA-256, beside rows for GitHub not supported, GitLab experimental, Gitea supported.

Oct 7, 2026

Git 3.0 Defaults to SHA-256. Nothing Can Talk To It.

Git 3.0 makes SHA-256 the default for new repositories, but Git's own docs say SHA-256 and SHA-1 repos cannot interoperate and GitHub still cannot host one.

Cover: Python Wants A std Namespace, beside rows showing toml, graph and timezone all taken on PyPI.

Oct 7, 2026

Python Wants a std Namespace Because PyPI Owns the Names

At the 2026 Python Language Summit, Pablo Galindo Salgado proposed import std.json. The real driver is not shadowing: PyPI already owns every good name.

Dark cover: GitHub async merge API, showing submit accepted, poll for real result and rules at merge time

Oct 6, 2026

API & Backend

GitHub's Async Merge API: Your Merge Bot Is Now Legacy

GitHub's async merge API went GA on 1 October 2026 and its docs now call the synchronous merge endpoint legacy. The real cost is when failures surface.

Dark cover: npm trusted publishing configs expire in 48 hours, showing create, 48h clock and publish steps

Oct 6, 2026

npm Trusted Publishing Configs Now Expire in 48 Hours

npm trusted publishing configs now expire 48 hours after creation unless a publish validates them, and npm's own documentation mentions none of it.

Dark cover: Rust drops 32-bit Windows host tools, showing target still Tier 1, std lib shipped, host tools gone

Oct 6, 2026

Rust Stops Shipping a 32-bit Windows Toolchain in 1.100

From Rust 1.100.0 on 12 November 2026 you cannot install a toolchain on 32-bit Windows. You can still build for it, and that distinction is the story.

Dark cover reading Namespaces verified, code is not, with rows for namespace, code review and moderation

Oct 5, 2026

Product Directory

The MCP Registry verifies namespaces, not servers

The official MCP Registry proves a publisher owns its domain or GitHub account. It does not review code, and says to assume minimal-to-no moderation.

Dark cover reading Scans that never start, with rows for weekly scans, the six-month rule and the start rule

Oct 5, 2026

Testing & QA

GitHub's scheduled code scans may never start at all

From 1 Oct 2026 weekly code scanning waits for a push or PR. There are now two inactivity rules and the docs page describes only one of them.

Dark cover reading Tokens went from 40 to 520 chars, with classic, stateless and failing-field rows.

Oct 4, 2026

API & Backend

GitHub App tokens went from 40 to 520 characters

Every new GitHub App installation token is a 520-character stateless JWT. Your auth still works. Your VARCHAR(40) column and redaction regex do not.

Dark cover reading Roots, Sampling, Logging: one year, with deprecation date, window and removal rows.

Oct 4, 2026

MCP deprecated Roots, Sampling and Logging

MCP's 2026-07-28 revision deprecated four features and shipped its first deprecation policy. Minimum window: twelve months. Earliest removal: July 2027.

Dark cover reading PyPI froze its HTML index API, with HTML, JSON and default Accept header rows.

Oct 4, 2026

PyPI froze the HTML simple index API

PEP 833 closed PyPI's HTML simple index to new features. Nothing breaks, nothing is removed, and everything added from here lands in JSON only.

Dark cover reading GitHub Now Rate-Limits Vuln Reports with required fields, proof of concept and daily cap

Oct 3, 2026

GitHub Now Rate-Limits Vulnerability Reports

GitHub added daily caps and a structured form to private vulnerability reporting on 1 October 2026. The 150-character proof-of-concept floor is the real filter.

Dark cover reading macOS 14 Runners Retire and Intel Is Missing with macos-14-large, macos-latest and macos-26-intel

Oct 3, 2026

macOS 14 Runners Retire and Intel Is Missing

GitHub retires the macOS 14 runner labels on 2 Nov 2026 after eight October brownouts. Every replacement label it lists is arm64; one retiring label is not.