Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-15 · high
It ships fixes as draft pull requests instead of inline suggestions, with the feature now in public preview, per GitHub.
Why now: GitHub put the feature into public preview as of July 15, without stating a broader rollout date.
Copilot's autofix now re-runs CodeQL on its own patch before opening a pull request, per GitHub. The tool explores the flagged files, drafts a fix, and only opens it as a draft PR once the re-scan confirms the alert closed.
That verify step is the point. A fix that looks right and an alert that's actually closed are two different things, and whoever approves the PR usually pays for the gap.
I've shipped enough AI-assisted patches to trust the pattern here: checking the model's own claim beats trusting its judgment. Building the re-scan into the loop means a reviewer opens a PR that's already been confirmed clean.
The fix also lands differently than most autofix tools. GitHub's post describes remediation arriving as a reviewable pull request, not an inline hint buried in a code scanning tab.
That's a smaller change than the verify loop. But it means the fix competes for review time the way a human's PR would, with the CodeQL result already attached.
GitHub baking the re-scan into the loop is what separates this from a plain suggestion engine. Any competing autofix that skips that check should get called out for shipping unverified guesses. Worth watching whether the re-scan catches fixes that close the CodeQL alert but change behavior elsewhere in the file. GitHub's post doesn't say.
Each link below shares sources, entities, or timing with this story.
CodeQL supports JavaScript / Shared entities / Same source / Earlier coverage
Linked by a graph relationship (CodeQL supports JavaScript); both cover CodeQL, GitHub; cite the same source (GitHub).
Microsoft released Copilot / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Microsoft released Copilot); both cover Copilot, GitHub; overlapping topics (agent, copilot).
Linked by a graph relationship (Microsoft released Copilot); both cover Copilot, GitHub; overlapping topics (actually, copilot).
Copilot uses Claude / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Copilot uses Claude); both cover Copilot, GitHub; overlapping topics (actually, agent).
Copilot supports Visual Studio / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Copilot supports Visual Studio); both cover Copilot, GitHub; reported by the same outlet (releasebot.io).
Copilot uses Terra / Shared entity: Copilot / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Copilot uses Terra); both cover Copilot; overlapping topics (agent, copilot).
VS Code uses Copilot / Shared entity: GitHub / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (VS Code uses Copilot); both cover GitHub; overlapping topics (agent, agentic).
VS Code uses Copilot / Shared entity: Copilot / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (VS Code uses Copilot); both cover Copilot; overlapping topics (agent, copilot).