Dev Stack
GitLab 19.5.1 fixes a CVSS 10.0 code-execution flaw
GitLab shipped fixes on October 21, 2026 for CVE-2026-110264, a CVSS 10.0 flaw that lets an unauthenticated user run code on self-managed servers.
Git news and analysis
Git, the version-control tool that records every change to a codebase: the 2.56 release, with commands to drop commits and delete merged branches plus faster history searches, and Claude Code adding a session link to commits unless you opt out.
Dev Stack
GitHub Actions workflow lockfiles enter public preview
GitHub Actions lockfiles entered public preview on October 14. A new actions.lock file pins every action, even indirect ones, to the exact commit you reviewed.
Dev Stack
Anthropic Scion post now credits Meta's Mononoke
Anthropic added a credit to Meta's Mononoke in its Scion post on October 15, 2026, after a developer said Scion's design closely copies Mononoke's.
Dev Stack
GitHub AI Scan for pull requests is generally available
GitHub's AI Scan now checks pull requests in PHP, Shell, Terraform and Dockerfiles. It is out of preview, needs no Copilot license and cannot block merges.
Dev Stack
Anthropic swaps git for Scion as merges pass 30,000 a day
Anthropic moved its monorepo off git to Scion, an in-house version control system, after daily merges rose from about 2,500 in May 2026 to over 30,000.
Dev Stack
GitHub stacked pull requests are now generally available
GitHub made stacked pull requests generally available on October 6, 2026, on every github.com plan, with stack-aware merge queues and the gh stack CLI.
Dev Stack
Git post-checkout hook malware targets developers
Developer Frank Wiles says a fake client sent him a repo whose git post-checkout hook fetched malware on a branch switch. Job seekers face the same trick.
Dev Stack
Git 3.0's SHA-256 default is a costly mistake, says Chacon
Scott Chacon says Git 3.0's SHA-256 default fixes a problem no repository has hit and breaks 40-character hashes everywhere. Git says no date is set.
Dev Stack
Git 2.56.0 ships faster merge-base and smaller repacks
Git 2.56.0 cuts a Linux kernel merge-base walk from 167,441 steps to 3,887 and shrinks one test repository's pack by 71%. It shipped September 28.
Dev Stack
Git 2.56 adds history drop and delete-merged
Git 2.56 carries over 700 non-merge commits and is due at the end of September 2026, with new commands for dropping commits and pruning branches.
Dev Stack
Claude Code puts a session link in commits unless you opt out
Claude Code appends a Claude-Session: trailer linking to its own chat to commits and pull requests. It defaults to on, and developers want it opt-in.
The weekly digest
One email every Friday with the week's top stories from all six desks: AI, dev tools, coding, the tech industry, startups and what's next. Free, no spam.