Development platforms are repositioning around agent context and controlled execution, while infrastructure projects tighten defaults and security.

The week in development

The clearest direction this week is that code hosts are competing to be the layer agents work through. Routing, context graphs and pipeline permissions all shipped from the big three forges within days of each other.

Below them, infrastructure projects spent the week on defaults and security: new baselines, patched CVEs and customer-held encryption keys.

Leaders

GitHub made Copilot Fusion generally available, routing work across models, and folded Copilot into GitHub Enterprise for every licensed user. The two releases together turn a model choice into a bundled default.

GitLab took Orbit to general availability, a graph of code, merge requests, pipelines, vulnerabilities and owners. Its argument is fewer round trips and lower token cost for agents, and it pairs the release with a security pitch on slow remediation.

Bitbucket made Agentic Pipelines generally available on paid Cloud plans, and added step-level permissions and container tokens in place of long-lived secrets. Breaking changes were announced, so the access model is shifting under existing users.

Exoscale put KMS External Key Store into private preview, so customers hold keys in their own HSM and every encryption needs both parties. It also added asymmetric encryption and signatures to KMS.

Slurm published 26.11 RC1 with the threadpool on by default and OCI containers moved to a runtime plugin, plus a 26.05.4 release closing seven CVEs including a privilege escalation. Default changes and a security fix in the same week is the pattern for cluster operators to read closely.

Wildcards

Meta Box exposed custom field management to AI agents, so field groups and relationships can be built from natural language. It also shipped AIO 3.14 with view previews and a login attempt limiter, an unusually broad week for a WordPress plugin.

Eclipse Theia shipped 1.77 with 38 contributors, more than double the prior release, though its substance sits in linked notes rather than the feed.

Themes that compounded

• Agent-facing context and execution shipped at GitHub, GitLab and Bitbucket.
• Long-lived credentials gave way to scoped ones in Bitbucket and to customer-held keys in Exoscale.
• Security fixes ran alongside feature work at Slurm.
• Changed defaults, as in Slurm 26.11 RC1, are where operators should read notes first.

Watch this week

Bitbucket's announced breaking permission changes are the most concrete item to track, along with any matching move from GitHub or GitLab. Slurm's RC1 defaults will draw operator feedback ahead of a final 26.11 release, and Exoscale's XKS preview may open to more customers if the private cohort goes well.