devops

Dependabot now waits three days before proposing new dependency versions by default. GitHub says the delay keeps freshly compromised releases out of update pull requests; security updates are exempt and repositories can opt out.

npm v12 disables install scripts, Git dependencies, and remote-URL dependencies by default, closing the execution path several npm worms exploited over the past year.

AWS added an Express mode to CloudFormation that ends deployments once configuration is applied instead of waiting for resources to stabilize, available in all commercial Regions at no extra cost.

GitLab's next-generation source code management, shown at its Transcend event, keeps the Git protocol but rebuilds the backend so agents query repos server-side instead of cloning them.

OpenTofu v1.12.0 lands with variable-driven prevent_destroy, a destroy=false lifecycle flag, and dual output modes — features the Terraform tracker left open since 2016.

Grafana Labs shipped version 13 at its annual conference in Barcelona, graduating dynamic dashboards and Git Sync to GA while delivering a rebuilt Loki that runs aggregation queries up to 10x faster.

Google Cloud Run Worker Pools hit general availability on April 14, 2026, shipping with Blackwell GPU support and CREMA, an open-source KEDA-based autoscaler for queue-driven workloads.

GitHub released the Enterprise Server 3.21 release candidate on May 13, making organization custom properties generally available along with Projects hierarchy views, REST API 2026-03-10, and secret scanning and Actions workflow improvements.

GitLab disclosed a reduction in force on May 11, plans to shed up to 30% of its country footprint, remove up to three management layers, and reorganize R&D into roughly 60 teams by June 1.

A malicious build of Checkmarx's Jenkins AST plugin was live on the Jenkins Marketplace from May 9 at 01:25 UTC to May 10 at 08:47 UTC, the latest TeamPCP intrusion against Checkmarx weeks after the April KICS wave.

CVE-2026-3854 let any authenticated user run code on GitHub's backend with a single git push. GitHub patched github.com in two hours on March 4; public disclosure on April 28 found most Enterprise Server instances still vulnerable.

GitHub moved custom runner images out of preview on March 26, exposing a snapshot keyword that turns a workflow run into a versioned VM image — and Copilot's own cloud agent cut another 20 percent off its cold start using it.