Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-09-04 · source-backed
Starting with the first release after that date, APT and RPM repository metadata and newly published RPM packages are signed only with the replacement key. A keyring containing both keys went out in April, so machines that installed gh before April 8 and never refreshed will fail on the next upgrade. Remediation is in cli/cli issue #13118. GitHub Changelog
Each link below shares sources, entities, or timing with this story.
Latent Space published maintainer numbers on September 1 that I've been chewing on since (Latent Space). Vercel's AI SDK, Astro, Flue and tldraw have all converged on the same arrangement: agents do triage, reproduction, implementation and review, and humans only merge. AI SDK...
Anthropic released Claude Fable 5.1 on September 1. Claude Code v2.1.257 made it the default Fable model at 17:53 UTC that day, with a 1M-token context window, $10 per million input tokens, $50 per million output, and $0.25 per million on cache reads (claude-code CHANGELOG). B...
From September 1, new signups reopen for card and PayPal customers with every seat assignment requiring payment before access; existing card/PayPal customers start incurring upfront per-seat charges October 1. Copilot code review's default effort moves from Lite to Balanced, s...
GitHub paused all new individual plan sign-ups and gutted the model lineup. The reason they gave is the quiet part said loud: agentic workflows consume far more resources than the plan structure can support. Starting April 20, new sign-ups for Copilot Pro ($10/mo), Pro+ ($39/m...
The September 4 changelog announces a REST endpoint returning historical star counts with timestamps but no stargazer identities, restoring growth tracking that broke when stargazer listing got restricted to admins and collaborators earlier this year. Called against repos/verc...
Three changes GA on September 3. Packages can hold more than one trusted publishing configuration, each operating independently with per-config direct-publishing opt-in. The staged-package approval button is disabled while a scan runs and only enables on completion. The versio...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.