As of Oct 15, GitHub's AI Scan flags vulnerabilities in pull request changes for languages CodeQL doesn't cover, like PHP, Shell, Terraform HCL, Dockerfiles, JSP, and Blazor, with findings and suggested autofixes shown next to CodeQL results. Findings are advisory and can't block merges; it's free on public repos (no Copilot license needed), while private org repos need Code Security or Advanced Security and use AI Credits.
As of Oct 16, Composio sessions can require a person's approval before selected toolkits, tools, or tagged tools execute: set requireApproval ( require approval in Python), catch the input required error, show its requests, then resend the call with the answers. It covers meta tool calls too, and over MCP it uses elicitation, with a deny or allow fallback for clients that can't ask…
As of Oct 14, Kiro IDE (1.3+) and Kiro CLI (2.31+) can run agent executed commands in a kernel enforced sandbox (Seatbelt on macOS, bubblewrap on Linux, AppContainer on Windows) that confines writes to the project, denies common credential paths like /.ssh , and routes network traffic through a domain filtering proxy. It's off by default; enable it with sandbox.json or /sandbox on , and it reuses your existing permissions.yaml rules…
As of Oct 15, liquid/d1 ultra is on AI Gateway: a multimodal decision model that returns calibrated probabilities for yes/no, choice, and score questions over text and images instead of generating text, handy for routing or deciding when an agent should hand off to a human. It has a 32K context window and bills input tokens only, callable via the AI SDK's decide or a new Decisions API…
As of Oct 16, RTX Spark laptops (GB10, up to 128GB unified memory) are available with local model support tuned for GitHub Copilot, Pi, Hermes, OpenClaw, and JetBrains Junie Local; compact desktops follow in November. NVIDIA also released Nemotron 3.5 Bolt 74B A9B, a fully open 2 bit MoE that fits in 24GB and runs on llama.cpp, vLLM, Ollama, Unsloth, and LM Studio…
As of Oct 15, Vercel Bring Your Own Cloud on AWS is generally available for Enterprise: Node.js and Python Vercel Functions run as Lambdas in your AWS account under your IAM and VPC rules, while Vercel still handles deploys, routing, and static assets…
Spotted something we missed? Start a thread.