Summary

The day's signals cluster around making code platforms safer and AI tooling defensible at enterprise scale. GitHub pushed a run of supply-chain and security changes: durable authenticated-pusher attribution with a "committer must match pusher" repository rule to curb commit forgery, a CodeQL 2.27.2 release that refreshes taint models and extractors across C/C++, Go, Rust, and JavaScript/TypeScript, Dependabot support for anonymous auth on organization-level private registries, and AI Scan metrics in security overview. In parallel, enterprise governance for AI coding assistants matured — admin-controlled Copilot telemetry attribution and content capture, and managed default-model plus MCP startup controls for Copilot in JetBrains. On the agent-infrastructure side, Vercel added Meta's Muse Wonder to AI Gateway and shipped human-gated domain purchasing in its CLI, and Cloudflare expanded its Clef decision-model family with the multimodal Clef-omni while cutting Clef-flash pricing, plus Logpush Transformers for SQL-based log redaction at the edge. All ten signals come from primary sources.

Key themes

  • GitHub hardens the software supply chain: authenticated-pusher attribution and a committer-must-match-pusher rule target commit forgery, CodeQL 2.27.2 refreshes taint models and framework support across five languages, and Dependabot gains anonymous auth for org-level private registries (removing throwaway-token workarounds).
  • Enterprise governance arrives for AI coding assistants: admins get per-user Copilot telemetry attribution and per-class content-capture toggles (off by default), managed default-model and MCP startup controls in Copilot for JetBrains, and AI Scan remediation/adoption metrics in security overview to justify rolling out AI code review.
  • Agent infrastructure matures around model access and bounded real-world actions: Vercel AI Gateway offers single-key access to Meta's Muse Wonder for coding and long-running agents, and the Vercel CLI exposes a full domain discovery-to-purchase flow with a deliberate human-in-the-loop gate on spend.
  • Task-specialized and edge primitives get cheaper and faster: Cloudflare's multimodal Clef-omni decision model and 1.7-2.0x faster, lower-priced Clef inference push calibrated classification/routing as a cheaper alternative to general LLM calls, while Logpush Transformers move PII redaction and data minimization to the edge of the logging pipeline.

Notable items

  • GitHub now durably records the authenticated pusher of every commit (shown in UI and API) and adds a "Committer must match pusher" repository rule, giving supply-chain and IR teams a verifiable identity signal at the push boundary — limited public preview for Enterprise customers.
  • CodeQL 2.27.2 adds a C++ ECMAScript std::regex parser and new taint models and framework support (coder/websocket for Go; native-tls variants and async-await flow for Rust; Hapi and Workflow SDK directives for JS/TS); the Default suite runs 498 queries across 170 CWEs.
  • GitHub Copilot telemetry can now attribute activity to individual users and toggle capture of five content classes (prompts, model responses, tool arguments/output, raw policy details), all enforced via managed settings and off by default — governance tooling to make Copilot defensible to security and legal teams.
  • Vercel CLI lets coding agents run the full domain search/check/price/buy flow, but non-interactive buy returns a machine-readable error and suggested next commands instead of spending money — the human-in-the-loop pattern vendors are converging on for agentic commerce.
  • Cloudflare launched Clef-omni, a fully multimodal (audio/video/image/text) decision model at $0.15 per million input tokens (~130-150ms median latency), made Clef inference up to 2.0x faster via SGLang, and cut Clef-flash's input price from $0.09 to $0.038 per million tokens.
  • GitHub added AI Scan metrics to security overview (findings created/resolved, remediation rate, autofix adoption, trends), and Cloudflare's Logpush Transformers run one SQL query per batch to drop, redact, rename, or tag log fields before export — data minimization at the edge.

Source coverage

Source rows used: 10