May 2026 Summaries

Sourcegraph's security team has evolved its alert management from a Slack-based triage bot called SecBot to a more sophisticated system that leverages programmatic Security Information and Event Management (SIEM) detection with expression-based auto-close rules. Initially implemented in 2022 to address limitations of the Elastic Security platform, SecBot enriched alerts by calling APIs and using pattern matching for triage, allowing for mobile alert management. As the system matured, the team integrated enrichments from various sources, including Google Cloud Platform (GCP) and threat intelligence databases, to provide context and automate alert closure. By 2024, the team had fully migrated their rules to SIEM, enabling SecBot to template alerts and add necessary enrichments, such as resolving service account names and using metadata from GCP to automatically close alerts under specific conditions. This automation is facilitated by the use of expr-lang, a Go expression evaluation library, which allows for complex expressions to determine if alerts should be closed based on criteria like user on-call status and project details. The enhancements have streamlined alert management, with SecBot providing real-time updates in Slack and reducing the manual effort involved in security triage.

Context engineering is an emerging discipline within AI development that focuses on designing the pipeline that determines what information a large language model (LLM) processes during inference calls, encompassing elements like system prompts, user inputs, retrieved documents, conversation history, tool definitions, and long-term memory. Unlike prompt engineering, which focuses on crafting specific instructions for LLMs, context engineering involves creating a comprehensive system that ensures the right data is retrieved and utilized effectively, optimizing the signal-to-noise ratio within the finite token and attention budgets. This approach is crucial for complex AI agents, which operate beyond simple chatbot interactions, using tools and memory across multiple interactions to make decisions. The discipline is organized around four pillars: instructions, retrieval, memory, and tools, each addressing specific needs to maintain an efficient context window. As models grow larger context windows, context engineering remains vital due to ongoing challenges with latency, cost, and contextual relevance, ensuring that AI systems receive the most pertinent information for any given task.

Dependency prefixes in package management tools like npm, pnpm, and Yarn can ease updates but also widen the security risk by allowing compromised packages into production. These prefixes, such as ^, ~, and *, determine which code versions package managers can fetch, often without direct user control, leading to potential vulnerabilities when a package or its maintainer is compromised. To mitigate these risks, it's crucial to treat version ranges as a policy control and use lockfiles to ensure consistent, repeatable installations. For sensitive packages, pinning exact versions shifts update responsibility to developers, reducing the risk of malicious updates. It's also advisable to disable install scripts when possible to prevent unwanted code execution. Auditing the actual dependency tree and using tools like Sourcegraph Batch Changes can help manage policy implementation across multiple repositories, making version control more visible and manageable. While dependency ranges can be useful, they should be applied with deliberate consideration to maintain security.

A comprehensive code review checklist for engineering teams emphasizes the importance of evaluating code beyond individual files to ensure consistency across the entire codebase. It highlights critical aspects such as correctness, security, tests, architecture, and cross-cutting impacts that are often overlooked. The checklist advises starting the review process by assessing the overall code change's correctness, readability, meaningful test cases, architectural consistency, and security measures. It suggests prioritizing blocking issues over minor stylistic nits and using automated tools to handle repetitive tasks, allowing reviewers to focus on the substantial aspects of the code. The guide also addresses the nuances of reviewing AI-generated pull requests, stressing the need for thorough cross-cutting checks and robust test validations. Additionally, it underscores the importance of maintaining documentation and changelogs to keep the codebase aligned and highlights the role of tools like Sourcegraph in providing codebase-wide context for more effective reviews.

AI code review tools, which utilize large language models to analyze code changes and provide feedback, have rapidly evolved by 2026 but still face limitations. These tools excel at identifying style inconsistencies, syntax errors, and common security vulnerabilities, offering value by streamlining routine code review tasks and allowing human reviewers to focus on more complex issues. However, they struggle with cross-cutting changes and business logic correctness, which require a broader understanding of the codebase and organizational context. Successful adoption involves starting with low-stakes tasks, tuning the system to minimize false positives, and integrating comprehensive codebase context to enhance accuracy. While AI tools can support and augment the code review process, they are not a replacement for human reviewers, who are essential for architectural decisions and understanding the broader implications of code changes. The future of AI code review is moving towards more autonomous actions, where tools not only identify issues but also propose and implement solutions within a controlled framework.

Agentic coding represents a transformative shift in software development, where autonomous AI agents independently plan, write, test, and refine code with minimal human intervention, fundamentally differing from traditional autocomplete and chat-based AI tools by taking action rather than merely suggesting or responding. This approach gained traction post-2025, with leading tech companies like Anthropic, OpenAI, and GitHub developing agentic workflows that manage entire coding tasks across complex environments. Despite its efficiency in tackling visible tasks, agentic coding faces the "80% problem," where agents complete the majority of a task but miss crucial context-sensitive aspects, leading to potential errors in large-scale codebases. To mitigate this, the solution lies in providing comprehensive context infrastructure, such as Sourcegraph’s code intelligence and search capabilities, which equip agents with a holistic view of the codebase, ensuring they don't overlook critical components. As agentic coding becomes more integrated into engineering workflows, its success depends on the balance between utilizing advanced AI models and maintaining robust context frameworks to avoid oversights and maximize productivity.

The text outlines the concept of code complexity in software development, distinguishing it from algorithmic complexity and explaining its relevance to code readability, maintainability, and defect prediction. It delves into various metrics used to measure code complexity, including cyclomatic complexity, cognitive complexity, and Halstead complexity, each assessing different aspects of how challenging code is to read and modify. The guide emphasizes that high code complexity can lead to increased defect rates and slow onboarding, proposing strategies like method extraction and reducing nesting to mitigate complexity. It also mentions tools like SonarQube and Sourcegraph Code Insights for measuring and tracking complexity across large codebases, and highlights the importance of maintaining code simplicity even with AI-generated code, suggesting that comprehensive tooling and tracking can help manage complexity trends effectively.

Legacy code modernization in 2026 involves updating, refactoring, or replacing existing software systems to maintain business value while managing costs, risks, and developer efficiency. The challenge lies not in selecting a target architecture but in understanding the existing system's intricacies, such as dependencies and historical business logic. The 7 Rs framework—retain, retire, rehost, replatform, repurchase, refactor, or re-architect/rebuild—guides modernization strategies, emphasizing per-system decisions over blanket approaches. AI plays a supportive role by aiding comprehension and generating tests, though it cannot replace the nuanced judgment required for architectural decisions. Successful modernization requires a methodical approach, starting with inventory and discovery, followed by risk analysis, testing, and incremental refactoring, often utilizing the strangler fig pattern. The importance of understanding the current system and building a reliable inventory is emphasized, as modernization efforts often fail due to overlooked dependencies or business rules rather than technical execution.

In an intricate process of managing GitHub advisories, a Slack bot automates the triaging and response pipeline, primarily focusing on incidents with severe security implications such as the npm worm incident affecting @tanstack/* packages. The bot streamlines the workflow by posting advisories in a Slack channel, triggering automated content creation like detection queries, blog drafts, and social media posts upon a single human reaction, leaving operators to evaluate the honesty and importance of the drafts. This system has arisen in response to the increasing volume of both malicious software packages and AI-generated code, which has introduced complex security challenges due to AI's tendency to hallucinate or create non-existent package upgrades. The architecture is designed to be efficient, with no orchestrator process and limited in-memory state, allowing operators to focus on judgment and prose refinement. As the threat landscape evolves with AI and self-replicating malware, the bot's role is expanding to include pre-disclosure pattern detection and a public resource hub for security alerts to aid responders in mitigating future incidents.

In 2026, the landscape of automated code review tools has evolved significantly, integrating both AI-powered and traditional static analysis methods to enhance code quality. These tools analyze pull requests without human intervention, identifying issues for developers to fix before merging. While static analyzers enforce deterministic rules for security, style, and policy checks, AI reviewers offer deeper insights by summarizing diffs and identifying semantic issues across repositories. Teams often combine these approaches, leveraging static analysis for compliance and AI for contextual feedback. The comparison of 13 tools highlights their capabilities, such as integration depth, monorepo support, and pricing transparency, and underscores the importance of selecting tools based on team size, tech stack, and review needs. The success of AI reviewers depends on their ability to access comprehensive repo context, which is crucial for delivering high-quality feedback. As code review practices evolve, the emphasis remains on balancing automated tools with human judgment to ensure robust code quality and maintainability.

Analysis of 1,281 agent runs across over 40 large open-source repositories has identified five recurring failure patterns in coding agents, highlighting the significance of context infrastructure over model intelligence. Coding agents, when tasked with navigating large codebases like Kubernetes, often fail due to inefficient search strategies that result in being lost within the codebase, selecting wrong files or symbols, completing tasks partially, excessive tool thrashing, and context overflow. These failures stem from the lack of effective search tools and context management, not from the agents' reasoning capabilities. The research emphasizes the importance of investing in code search and indexing infrastructure, structural navigation tools, and task-type-aware retrieval systems to enhance agent efficiency. By addressing these infrastructure issues, agents can achieve better performance, demonstrating that the solution lies in improving the interface between the model and the codebase, rather than solely relying on advancements in model capabilities.

A Deep Search Slack agent was developed to improve the workflow of engineers in large companies by integrating directly into Slack, minimizing context switching between platforms and enhancing productivity. The agent was designed with a focus on user experience, enterprise security, and scalability, featuring natural communication, real-time updates, and rich link previews to maintain workflow continuity within Slack. The system employs a Redis-backed rate-limiting mechanism to ensure reliability and prevent abuse, while enterprise-grade security measures, such as seamless identity verification and OAuth integration, facilitate secure deployment across Slack Enterprise Grid. The design prioritizes user-friendly interactions, such as stateful sessions for follow-up questions and simplified authentication processes, ensuring that users can access the agent efficiently without additional sign-in steps.

In 2026, choosing the right monorepo build tool is crucial for platform engineers or build leads, as it significantly impacts the efficiency and scalability of software development processes. Monorepo build tools such as Bazel, Nx, Turborepo, Pants, Buck2, Mill, and Earthly offer varying benefits, from fine-grained dependency management and remote caching to multi-language support and hermetic builds. Each tool caters to different needs: Bazel, Buck2, and Pants are ideal for polyglot enterprises requiring robust, reproducible builds; Nx and Turborepo excel in JavaScript/TypeScript environments with strong developer experiences and caching capabilities; Mill serves JVM-centric teams; and Earthly integrates well with container-driven workflows. While these tools enhance build performance, they do not address code navigation or refactoring challenges in massive codebases, a gap filled by code intelligence solutions like Sourcegraph. This layered approach of combining an appropriate build tool with a code intelligence system can significantly improve productivity and maintainability in large monorepos.

Sourcegraph's Deep Search is an AI-driven tool designed to provide synthesized answers to complex codebase inquiries by leveraging an agentic retrieval pattern similar to those used by Gemini and ChatGPT. Unlike traditional code search, which requires exact queries and returns a list of matching files, Deep Search processes natural-language questions, conducts multiple targeted searches, and delivers explanations grounded in specific files with inline citations. This iterative method is particularly valuable in software engineering contexts, where understanding how systems work often involves reading across multiple files and repositories. Deep Search's application in codebases enables faster onboarding for new developers, efficient cross-repository investigations, and streamlined support for non-engineering teams by reducing the time spent on manual exploration. It operates within private code repositories, utilizing tools like regex search, symbol lookup, and Git history to construct answers that are contextually informed and verifiable. While sharing the agentic approach with web research tools like Gemini and ChatGPT, Deep Search is distinct in its focus on comprehensively navigating code environments, thus addressing the unique challenges associated with large and complex engineering systems.

In the ongoing debate between Perforce and Git as version control systems (VCS) in 2026, each has distinct advantages catering to different development needs. Perforce, a centralized system, excels in managing large binary files, exclusive file locking, and offers granular access control, making it popular in industries like game development, automotive, and aerospace where such features are crucial. In contrast, Git, a distributed VCS, is favored for its lightweight branching, comprehensive ecosystem integration, and suitability for code-heavy, distributed projects, often supported by modern CI/CD and code review tools. While Git is open-source and free, Perforce requires commercial licensing, albeit with a free tier for small teams. Organizations often deploy both systems, using Perforce for binary-heavy assets and Git for application code, navigating challenges of code search and integration across both platforms. Sourcegraph emerges as a solution to unify code search and navigation across these environments, offering developers a common code-understanding layer to maintain productivity during migrations or in mixed-VCS settings.