GitHub Copilot code review switches from Lite to Balanced today
From 28 September the default effort level for Copilot code review moves to a higher-reasoning model, unless you already pinned your repo or org to Lite.
Tagged
Tooling
From The Wire
Adminer patches an RCE hiding behind a UTF-8 byte-order mark
A regex filter meant to block dangerous SQLite commands in Adminer missed statements prefixed with a UTF-8 BOM, letting an authenticated user write PHP straight to a web-accessible directory. Fixed in 6.1.1.
Cloudflare Workers tracing gets four new span APIs
startSpan, getActiveSpan, recordException and setAttributes let you instrument Workers code without threading span objects through every function call.
GitHub Copilot puts a local sandbox around its coding agents
A public preview lets you cap what Copilot agents can touch — files, networks and credentials — and adds Dev Container support for running them on remote hosts.
Ollaya brings Ollama-style serving to small classification models
A new open-source runtime pulls and serves compact "decision models" locally, answering typed yes/no and scoring questions in milliseconds instead of round-tripping to a hosted LLM.
GitHub restored two hijacked Actions without fixing the tags
Two Actions poisoned in the May Mini Shai-Hulud attack came back online in September with the malicious tags untouched, so tag-pinned workflows ran the payload again.
Check Baseline before you check caniuse
Baseline turns "which browsers support this" into a yes or a no, and it is now built into MDN, the docs, and a linter you can run in CI.
Import maps mean small projects do not need a bundler
Bare module specifiers work natively in every current browser. For a site with a handful of dependencies, that removes the build step entirely.