Announced Oct 23, the consolidated GitHub app for Microsoft Teams (formerly GitHub notifications) lets you @GitHub on a bug notification so Copilot investigates, fixes it, and opens a PR for your team to review. The legacy GitHub app becomes "GitHub (deprecated)" and retires on November 16, so Copilot-in-Teams users need to install the new one.
In the update posted Oct 22, the Git agent in Visual Studio 2026 can summarize an attached pull request with links to its comments and files (via GitHub or Azure DevOps MCP servers), and NuGet Audit warnings get a fixer that has Copilot patch vulnerable packages. Bring Your Own Model now only works in the Copilot SDK based Agent (Preview), so previously configured Ollama models must be re added…
GA as of Oct 23, version 1.2 bundles dependency based builds, ZCodeScan static analysis on the CLI, unit and functional testing, and Wazi Deploy into governed pipelines for z/OS apps. It's sold as a peer to IBM Bob Premium Package for Z, which supplies the AI assisted coding at each stage (product page)…
Shandong University researchers held models fixed and ran Claude Code, OpenCode, and the 100 line mini SWE agent on 492 SWE bench Verified tasks, finding statistically equivalent success rates but up to 3x differences in cost per task. On the 45 hardest tasks, switching harnesses flipped results about as often as simply rerunning the same setup (13%), so small single run benchmark gaps say little…
Now GA as of Oct 23, the Copilot coding agent investigates a CodeQL alert, writes a fix, reruns CodeQL to confirm it, and opens a draft PR, with up to 25 alerts batchable into one PR. It only covers alerts on the default branch and needs GitHub Code Security or Advanced Security on Enterprise Cloud, an admin enabled policy, and a Copilot billing method…
GitHub Advanced Security for Azure DevOps now uses the Copilot coding agent to propose pull request fixes for dependency vulnerabilities and third party scanning findings, following repo instructions and skills in .github or .agents . It also adds EPSS exploit likelihood percentiles and dev versus runtime dependency labels to triage, and you still review and merge every fix yourself…
Spotted something we missed? Start a thread.
