August 2026 Summaries

GitHub has expanded Dependabot malware advisories from npm to eight package ecosystems—npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer—by ingesting reports from OpenSSF’s public malicious-packages repository. Rather than build separate detection systems for each ecosystem, GitHub created an importer that validates OSV-format reports, normalizes package and version data, preserves source records, processes withdrawals, and avoids re-importing GitHub’s own advisories through origin metadata. Because malware reports must be published quickly to protect users, the resulting advisories can automatically generate Dependabot alerts without prior human review, unlike many conventional vulnerability advisories. To reduce the risks of incorrect or compromised upstream data, the pipeline uses configurable batch limits, commit-level provenance tracking, and batch-wide rollback capabilities. Malware alerts are opt-in and can be enabled at repository, organization, or enterprise level, whereupon Dependabot checks both current dependencies and existing advisories for malicious packages.

GitHub Copilot app slash commands are chat-composer shortcuts that provide context-aware access to workflows for managing sessions, projects, and agent behavior, differing from the terminal-focused commands in Copilot CLI because the desktop app handles project context visually. Typing “/” opens autocomplete, and some commands, including /clear and /model, are shared with the CLI. The app’s workflow-oriented commands include /plan for outlining features, refactors, and bug investigations; /spar for challenging assumptions and evaluating risks or technical alternatives; and /autopilot for implementing multi-step changes such as new features, upgrades, and maintenance work. Other commands include /rubber-duck, which uses a different model to independently review plans or changes; /create-canvas, which turns conversations into interactive visualizations, dashboards, or workflows; and /orchestrate, which coordinates parallel tasks and changes across multiple repositories. Users are encouraged to explore commands through autocomplete and adopt those that fit their development process.

In a post highlighting the transformative potential of AI tools like GitHub Copilot CLI, non-technical professionals such as lawyers and program managers have successfully created automated solutions for repetitive tasks. Ngandu Kasuku, a Principal Product Counsel, used Copilot CLI to develop "terms-ai," a contract drafting tool that streamlined his process by organizing key documents and employing a plain language drafting style. Jesse Geraci, an Online Safety Counsel, leveraged Copilot to address legal workflow challenges, initially focusing on DMCA notice analysis and expanding into a full desktop app for various legal tasks. Both professionals emphasize that AI empowers them to build tools around their unique expertise without needing extensive coding skills, demonstrating that AI can enhance efficiency and consistency in legal work while keeping human judgment central.

The discussion explores the challenges of managing large pull requests in software development and the benefits of using stacked pull requests to enhance code review and integration processes. While traditional large pull requests often become cumbersome and difficult to review, leading to slower merges and increased potential for conflicts, stacked pull requests offer a structured alternative by decomposing features into smaller, logically ordered, and independently reviewable layers. This method allows for focused reviews and clearer allocation of tasks among different agents or developers, improving the quality and efficiency of code integration. With tools like GitHub's native support for stacked pull requests, including the gh-stack CLI, developers can streamline the process by setting a stack base, layering dependencies, and using automated agents to manage specific tasks, ultimately facilitating a smoother and more organized workflow from development to deployment.