Dependabot version updates now support Agent Package Manager. Dependabot opens PRs to update git dependencies declared in apm.yml, such as agent skills, prompts and instructions, and regenerates apm.lock.yaml. It does version updates only, not security updates.
How we checked
GitHub changelog read; GitHub Docs supported-ecosystems table lists APM as `apm` with version updates and no security updates
Why it matters
Teams that share agent skills and prompts as dependencies can keep them current with the same PR workflow they use for code.
Try this
Add an entry with package-ecosystem "apm" to .github/dependabot.yml, point it at the directory holding apm.yml, and set a weekly schedule.
GitHub Copilot is now an agent inside JetBrains Air through the Agent Client Protocol. It runs local tasks in the IDE, and cloud tasks run in isolated Docker VMs through Air Teams, billed to your Copilot plan rather than JetBrains AI credits.
How we checked · Why it matters · Try this
How we checked
Read GitHub's own changelog entry; the JetBrains help URL I guessed returned 404, so this was not cross-checked there
Why it matters
Another editor now speaks ACP. Copilot users can delegate agent tasks from JetBrains without paying for a second AI subscription.
Try this
Install Air in your JetBrains IDE, pick GitHub Copilot in the agent picker, connect your account, and run one small local task.
CodeQL 2.27.3 adds an opt-in "ai" threat model for LLM-generated data. It ships no built-in sources, so you define them yourself with data extensions, which can now also be written in JSON.
How we checked · Why it matters · Try this
How we checked
GitHub changelog read; the v2.27.3 release tag exists on the CodeQL repo, though the tag page has no notes
Why it matters
You can now trace model output into dangerous sinks with static analysis, treating LLM text as untrusted input.
Try this
Turn on the ai threat model in a test repo and add a data extension that marks your LLM client's response call as a source.
Claude Code v2.1.318 shows when a stored claude.ai sign-in expires: loginExpiresAt in claude auth status and credential_expires_at in claude -p JSON results. It also prints a stderr warning starting 10 days before expiry.
How we checked · Why it matters
How we checked
primary link exists: official anthropics/claude-code GitHub release v2.1.318 with these notes (face value not allowed for this source today)
Why it matters
Headless and CI jobs that use a stored sign-in can now spot an expiring login before the jobs start failing.
Google released Cheminformatics Skills for Antigravity through its Science plugin. They are built on RDKit with ChEMBL and PubChem connectors, and Google is offering 10,000 scientists the top Antigravity usage tier free for 6 months, by application.
How we checked · Why it matters
How we checked
primary link exists: Google DeepMind's own post; antigravity.google homepage does not mention the plugin yet (face value not allowed for this source today)
Why it matters
It shows how to pair an agent with deterministic domain tools: the model orchestrates while tested libraries do the exact calculations.
Gemini CLI nightly v0.67.0-nightly.20261104 fixes SubagentStop hook event mapping and hook-definition merging. It also adds --userns=keep-id for rootless podman sandboxes.
How we checked · Why it matters
How we checked
primary link exists: official google-gemini/gemini-cli GitHub pre-release with these notes (face value not allowed for this source today)
Why it matters
Anyone using subagent hooks or a rootless podman sandbox in Gemini CLI had broken or flaky behavior that this fixes.