July 2026 Summaries

Code Finder, a search tool available in Beta on the Sourcegraph MCP server, optimizes the process of locating specific files and line ranges in a code repository by running its own search loop and providing concise, relevant results for coding agents. This approach significantly reduces the time and cost compared to traditional methods where coding agents perform their own searches, as Code Finder offers a focused response that allows agents to proceed with their tasks more efficiently. Tests show that Code Finder completes tasks more than twice as fast and up to 40% cheaper than agents using local or other MCP tools, without compromising result quality. The tool's efficiency is attributed to its specialized design for searching, which contrasts with the broader capabilities of general coding agents. Available for free during its Beta phase, Code Finder enhances file discovery within Deep Search and can be integrated with a user's own agent by connecting to the Sourcegraph MCP Server.

Large-scale code changes, distinct from typical code modifications, involve making logically related edits across numerous repositories that cannot be submitted as a single atomic unit due to practical constraints like tooling limitations and potential merge conflicts. The complexity lies not in the coding itself but in coordinating the process across multiple teams and repositories, requiring comprehensive enumeration, consistent application, and meticulous tracking of changes. Companies like Google have developed processes that shard a master change into smaller, independently manageable pieces, ensuring each can be reviewed, tested, and merged separately. Tools like Sourcegraph's Batch Changes streamline this process by allowing engineers to apply a single declarative change specification across multiple repositories, track the progress of each changeset, and manage the rollout systematically. This approach has proven effective for organizations like Workiva and Quantcast, significantly reducing the time needed to implement large-scale changes and increasing confidence in the completeness and consistency of these modifications.

The playbook outlines a comprehensive strategy for migrating from AngularJS to React, emphasizing the importance of addressing both technical and organizational challenges in the process. AngularJS, which is no longer supported as of January 2022, presents security and maintenance risks that drive the need for migration. The guide highlights the conceptual shift from AngularJS’s two-way data binding to React’s one-way data flow, requiring a detailed inventory of every AngularJS component, directive, and dependency using tools like Sourcegraph Code Search. It discusses various migration strategies, recommending incremental or hybrid approaches over a risky big-bang rewrite, and suggests leveraging react2angular for hybrid coexistence during the transition. Codemods and Sourcegraph Batch Changes are recommended for efficient execution of repetitive code transformations across multiple repositories, ensuring consistency and reducing manual effort. Finally, the playbook stresses the importance of comprehensive testing and a phased rollout to ensure the migration’s success, using examples from real-world scenarios like Lyft and Workiva to illustrate the potential for significant time savings and risk mitigation.

The text discusses the challenges and solutions associated with automating dependency upgrades across multiple repositories, particularly in large-scale environments where dependencies may be spread across hundreds of services owned by different teams. It highlights the limitations of per-repo automation tools like Dependabot and Renovate, which are effective for managing dependencies within a single repository but fall short when coordinating upgrades across multiple repositories. The solution proposed involves using Sourcegraph's Batch Changes, which allows for a coordinated rollout of dependency upgrades by finding every affected version using Code Search and applying changes across all relevant repositories in a single operation. This approach not only streamlines the upgrade process but also offers a centralized dashboard for tracking pull requests and ensuring that all changes are merged efficiently, addressing both routine updates and urgent security patches. The importance of having a coordinated workflow for emergency upgrades, especially in response to disclosed vulnerabilities, is emphasized, with tools like Batch Changes providing the necessary infrastructure for managing large-scale code changes effectively.

Vulnerability remediation at the codebase scale faces significant challenges due to AI-generated code lacking context, detection coverage gaps, and lengthy fix times across numerous repositories. CISA's Binding Operational Directive 26-04 mandates that federal agencies must remediate high-risk vulnerabilities within three days, highlighting the urgency for faster remediation processes. Current tools are insufficient because they operate within limited scopes, failing to address these issues comprehensively. AI coding agents frequently produce insecure code due to a lack of awareness of existing code patterns and standards, while security programs struggle to verify detection coverage across all owned code, resulting in potential blind spots. Remediation processes are slow and cumbersome, often taking weeks, as they involve manual, fragmented efforts across thousands of repositories. A universal code search that allows for comprehensive coverage, precise identification, and coordinated changes across all repositories is proposed as a solution, enabling faster and more effective vulnerability management.

In the evolving landscape of application security, the focus should shift from isolated detection in individual repositories to achieving comprehensive codebase visibility, as this is crucial for prevention, detection, and response. Traditional security tools excel at identifying issues within single repositories but fail to address the broader challenge of assessing vulnerabilities across an entire codebase, especially as AI-generated code increases and dependency sprawl accelerates. Effective security posture requires the ability to quickly identify and address vulnerabilities across all repositories, considering both direct and transitive dependencies. This approach enables teams to understand the full impact of security threats and respond efficiently, preventing breaches that exploit gaps between repository-level detections. The increasing volume and velocity of AI-written code and the rising number of malicious third-party packages emphasize the need for a unified view of the codebase rather than relying solely on more precise detection tools.