What shipped · 2026-w43
What shipped in AI dev tools: week of Oct 19, 2026
Oct 19, 2026 – Oct 25, 2026
39 releases across 14 tools this week; biggest: GitHub Copilot (12 releases).
GitHub Copilot
Copilot in the GitHub app for Microsoft Teams
On October 23, 2026, GitHub announced the new GitHub app in Microsoft Teams, previously called GitHub notifications. It brings notifications and Copilot into channels, group chats, or private chats. Mention @GitHub on an issue notification and it can investigate the issue, fix the bug, and open a pull request. Existing GitHub notifications installs keep working after an update. The legacy GitHub app will be renamed "GitHub (deprecated)" and retired on November 16; the consolidated app is the one that keeps Copilot in Teams.
Source for Copilot in the GitHub app for Microsoft Teams (opens in a new tab)Copilot usage metrics add totals by client
On October 23, 2026, the Copilot usage metrics API added totals_by_client to the enterprise, organization, enterprise-user, and organization-user 1-day and 28-day reports. Each entry names the client that sent the requests, such as opencode, claude_code, codex, zed, copilot_cli, github_app, cloud_agent, code_review, vscode, or jetbrains, with unrecognized clients grouped under other. It includes request_count, session_count, token_usage, and totals_by_model, plus a model_selection_mode of user_selected, auto, product_selected, other, or unknown. In the 28-day reports, totals_by_client appears in each day_totals entry. request_count counts model calls, not prompts. Clients are identified by the integration ID they send, which GitHub describes as a best-effort grouping. Existing fields are unchanged.
Source for Copilot usage metrics add totals by client (opens in a new tab)Copilot global default policy enforcement
On October 22, 2026, GitHub started rolling out enforcement of the global default policy for generally available Copilot features and supported client capabilities on Copilot Business and Copilot Enterprise, through October 26. Eligible features left Unconfigured on Features & clients and MCP servers in Copilot are set once to the selected default of Enabled, Disabled, or Let organizations decide. Explicit choices stay as they are, and preview features stay opt-in. Admins review the setting under AI Controls, Copilot, Default policy for new features.
Source for Copilot global default policy enforcement (opens in a new tab)Copilot in Visual Studio, September update
Published October 22, 2026. GitHub Copilot in Visual Studio 2026 can explore a pull request with the Git agent: attach a pull request from the Git Repository window and get a summary with links to comments and files. That requires the Git provider's MCP servers; GitHub and Azure DevOps are supported. Bring Your Own Model is in preview, on by default, and now requires the Agent (Preview) built on the Copilot SDK harness. The previous Ask and Agent modes no longer support bring-your-own-model, and previously configured Ollama models have to be added again. Supported providers are Microsoft Foundry, OpenAI, Anthropic, and Ollama. NuGet Audit warnings in the Error List can open Copilot Chat in agent mode to fix vulnerable packages through the NuGet MCP server.
Source for Copilot in Visual Studio, September update (opens in a new tab)Copilot usage metrics name custom skills and agents
On October 22, 2026, Copilot usage metrics started reporting the configured names of organization skills, custom agents, MCP servers, slash commands, and plugins in totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin, instead of grouping them under other or custom. Each list includes up to 25 entries, and the rest stay in a trailing other entry. Names come from Copilot CLI, the Copilot app, ACP integrations such as JetBrains, and the Copilot SDK. Prompt mode, the app, and ACP need Copilot CLI 1.0.97 or later, and the SDK needs v1.0.21 or later. An IDE's built-in chat telemetry does not report names. Names appear for report days processed after this release.
Source for Copilot usage metrics name custom skills and agents (opens in a new tab)GitHub Copilot CLI 1.0.103
Released October 22, 2026. Clicking a completed response code block copies its original code when that is enabled. ACP sessions honor saved sandbox settings and the --sandbox and --no-sandbox flags, including on resume. Cloud replies keep their full text when the CLI reconnects after a dropped connection. The sessions browser shows a session's recorded title instead of a generic Session N fallback when one is available. Model-specific default Responses verbosity applies for GPT-5 models unless session verbosity is set. On Windows, npm.cmd shims and dnx commands receive the same sandbox grants as their tools when developer-tool access is enabled. Gemini tool calls avoid 400 schema validation errors for nullable and enum fields. Resume works under mandatory managed model defaults without rejecting saved preferences. Hash mention suggestions refresh when the GitHub client is ready, and cached local MCP tool snapshots are reused across registered Git worktrees in one repository. Remote launch options use clearer hosting and connection flags, and the legacy --remote and --no-remote startup flags are retired.
Source for GitHub Copilot CLI 1.0.103 (opens in a new tab)Industry comparisons in the Copilot impact dashboard
On October 22, 2026, the Copilot impact dashboard added an Industry comparison section. Enterprises, and organizations that are not owned by an enterprise, can compare agentic adoption and leverage with aggregated benchmarks from participating peers. Participation is opt-in and off by default. Scores cover the share of users who are agent-first or multi-agent, and the pull request merge rate of agentic users compared with nonagentic users, ranked against the peer median and, as the group grows, the top decile. Peer groups are by company size and one of ten industries, or all industries when the industry group is too small. Opt in from the dashboard or from Copilot policies. Rankings appear only after enough businesses have opted in, and they are not in the usage metrics API.
Source for Industry comparisons in the Copilot impact dashboard (opens in a new tab)GitHub Copilot CLI 1.0.102
Released October 21, 2026. Prompt mode honors managed Auto model selection for -p and piped stdin runs. Subagents honor custom and MCP tool approvals, which avoids a second permission prompt and lets inherited workflows run. Plugin marketplaces accept git-subdir sources and long plugin descriptions. Long-running sandboxed commands keep running past 10 seconds, and sandboxed network traffic honors NO_PROXY and ALL_PROXY when it inherits host proxy settings. Replies cut off by a provider overload error retry with backoff and show the provider's message and request ID. Fish shell completion works when aliases include option aliases such as --effort, and chats are no longer blocked by organization plugin preparation while sending a message.
Source for GitHub Copilot CLI 1.0.102 (opens in a new tab)GitHub Copilot CLI 1.0.101
Released October 20, 2026. Adds native structured output for dynamic workflow subagents on supported models, and an assistedApprovalInstructions setting that guides Assisted Permissions confirmation decisions. Shell commands that create and then enter a directory request path approval instead of being denied early. Team-assigned plugins can be installed from Team-defined GitHub marketplaces. The release also includes reliability fixes for MCP, models, sandboxing, and sessions.
Source for GitHub Copilot CLI 1.0.101 (opens in a new tab)Copilot model policy API
On October 19, 2026, GET and PATCH REST endpoints for Copilot model policies became generally available for enterprises, enterprise teams, enterprise apps, and organizations. Enterprise policies can delegate model control to organizations, or to teams and apps.
Source for Copilot model policy API (opens in a new tab)Copilot retires six models
On October 19, 2026, GitHub deprecated Gemini 3.7 Flash, GPT-5.5, GPT-5.4, GPT-5.4 mini, GPT-5 mini, and Grok 4.5 across most Copilot experiences, including chat, inline edits, ask and agent modes, and code completions. Suggested alternatives are Gemini 3.8 Flash, GPT-6.1 Sol, GPT-6 Luna, and Grok 4.7. Enterprise admins may need to enable the replacements in Copilot model policies.
Source for Copilot retires six models (opens in a new tab)GitHub Copilot CLI 1.0.100
Released October 19, 2026. Adds --disable-client-telemetry to turn off client telemetry uploads from the CLI. Opening /share with no arguments shows a full-screen menu for sharing the current session. --trust-folder trusts a folder for one prompt-mode session started with -p or piped stdin, and copilot plugin install can install verified Skills and plugins from GitHub install links. The release also includes reliability fixes for MCP, sandboxing, and sessions.
Source for GitHub Copilot CLI 1.0.100 (opens in a new tab)
Claude Code
Claude Code 2.1.310
Released October 23, 2026. Adds the Monitor tool and plugin monitors on Bedrock, Vertex, and Foundry, and when telemetry or nonessential traffic is disabled, and blocks long foreground sleeps there too. Requests that fail behind gateways and compatible servers that reject the effort-2025-11-24 beta value or mid-conversation system messages are retried without them. Compaction after a "Prompt is too long" error no longer keeps so much dense text, such as base64 or SVG, that the next request fails again. File-read permission prompts show where a symbolic link leads. Enterprise custom roles can include Claude Code cloud sessions and Remote Control permissions, and turning either on in admin settings asks for confirmation and lists the roles that have that permission. An MCP tool call that times out in a non-interactive session while elicitation is unanswered tells Claude that no answer came and not to repeat the call. On Linux, /sandbox and the sandbox startup warning name Ubuntu's AppArmor restriction on user namespaces when it keeps bubblewrap from starting the sandbox. The release also includes fixes for VS Code plan review, cloud sessions, Claude Tag, and Code Review.
Source for Claude Code 2.1.310 (opens in a new tab)Claude Code 2.1.309
Released October 22, 2026. sed -i now gets the standard Bash prompt and runs as written, instead of a simulated file-edit preview, and /rewind no longer restores those edits. claude ultrareview requires workspace trust: it asks in a terminal, otherwise it refuses, and scripts pass --trust-workspace or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. In bypass-permissions mode in the Desktop app and VS Code, dangerous rm and rmdir prompts are denied immediately with a rewrite hint. The /claude-api skill builds Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, and service account keys and Workload Identity Federation tokens can manage OpenTelemetry destinations. The bundled dataviz skill accepts APCA as a text-contrast measure. Sandbox fixes cover startup files running outside the sandbox, symlink write denies, MCP config edits, and Bash permission checks. The release also includes a large fix sweep for worktrees, MCP, VS Code, cloud sessions, Slack, and Code Review.
Source for Claude Code 2.1.309 (opens in a new tab)Claude Code 2.1.306
Released October 21, 2026. Fixes claude -p inside cloud sessions reporting that it is not logged in when started without the session's environment variables. Also fixes an API error being replaced by a prompt-is-too-long message, and an unneeded compaction, in sessions with many MCP tools.
Source for Claude Code 2.1.306 (opens in a new tab)Claude Code 2.1.307
Released October 21, 2026. Adds /claude-api api-version to move Claude API code to API version 2026-10-21, and the claude_code.safety_event OpenTelemetry event for each tool call a permission rule, auto mode, a safety check, a hook, or the sandbox stopped, prompted, or sent back. HTTP MCP tool calls that were sent twice when the connection closed mid-call are now retried only for read-only or idempotent tools. @claude review stop, also off and pause, ends an @claude review always subscription on a pull request without starting a new review. The release also includes a large fix sweep for MCP, autocompact, cloud sessions, the Agent SDK, and VS Code.
Source for Claude Code 2.1.307 (opens in a new tab)Claude Code 2.1.305
Released October 20, 2026. Adds sandbox.allowNestedUserNamespaces so sandboxed commands on Linux can create user namespaces, such as Chromium or rootless Podman, which lets those commands get around the sandbox's file protections. Adds CLAUDE_CODE_RETRY_WATCHDOG_USAGE_LIMIT_RECHECK_MS so unattended retry mode notices a usage limit that was lifted before its reset. Requests no longer all fail on Vertex, Bedrock, and other providers when the endpoint or a gateway rejects tool search, a 2.1.304 regression. The release also includes a large fix sweep for worktrees, MCP, cloud sessions, Remote Control, and Code Review.
Source for Claude Code 2.1.305 (opens in a new tab)Claude Code 2.1.304
Released October 19, 2026. Adds /auto-mode-setup, a guided setup that reads the project and recent sessions to teach auto mode about the environment, including on Bedrock, Vertex, Foundry, and telemetry-disabled sessions. A transcript line names the plugin when a plugin that runs first skips one of a mod's hooks. Pro and Max plans warn when resuming an inactive conversation would use a noticeable share of the 5-hour usage limit. Code Review owners can choose Quick, Standard, or Deep for the organization or a repository. The release also includes a large fix sweep.
Source for Claude Code 2.1.304 (opens in a new tab)
Vercel AI SDK
Kimi K3.1 Pro and Highspeed on AI Gateway
On October 23, 2026, Moonshot AI's Kimi K3.1 Pro and Kimi K3.1 Pro Highspeed became available on Vercel AI Gateway. K3.1 Pro is the first model in the K3.1 series. Vercel says it builds on Kimi K3 for coding, 3D modeling, financial analysis, and agentic tasks, and keeps a 1M-token context window and image input. Highspeed is a faster version for interactive use. Use moonshotai/kimi-k3.1-pro or moonshotai/kimi-k3.1-pro-highspeed through the AI SDK, the Chat Completions, Responses, and Anthropic Messages APIs, or a coding agent connected to AI Gateway. Moonshot AI plans to release the model weights by November 4. AI Gateway reflects provider pricing with no markup.
Source for Kimi K3.1 Pro and Highspeed on AI Gateway (opens in a new tab)Mammoth-1 and Elephant-1 on AI Gateway
On October 21, 2026, Baseten's Mammoth-1 and Elephant-1 became available for free on Vercel AI Gateway through October 27. These decision models classify text, route requests, and score content against criteria you define. Mammoth-1 is the 27B model and Elephant-1 is the 9B model. Vercel says Mammoth-1 is #1 on the Jev Decision Index and Elephant-1 is tied for #1 on the Artificial Analysis Decision Index. Both use a 16k-token context window and can answer several questions about the same input in one request, returning choices, probabilities, and scores. Use baseten/mammoth-1 or baseten/elephant-1. Decision calls appear in AI Gateway logs and count toward budgets.
Source for Mammoth-1 and Elephant-1 on AI Gateway (opens in a new tab)DeepSeek V4.1 Flash in Token Pass
On October 20, 2026, Token Pass added DeepSeek V4.1 Flash, using the 1017 weights, alongside Kimi K3 and GLM 5.3. Token Pass is a $30/month subscription on Pro teams that grants $80 in monthly credit and runs through AI Gateway, with Zero Data Retention on by default. Add the model from the Token Pass page in the team's AI Gateway dashboard.
Source for DeepSeek V4.1 Flash in Token Pass (opens in a new tab)Mercury 3 on AI Gateway
On October 19, 2026, Inception's Mercury 3 became available on Vercel AI Gateway as inception/mercury-3, with 50% off launch pricing. Vercel describes it as a diffusion text model that generates through parallel refinement, with a 1M-token context window, for latency-sensitive workloads. Inception reports generation speeds above 1,000 tokens per second.
Source for Mercury 3 on AI Gateway (opens in a new tab)MiniMax M3.1 Flash on AI Gateway
On October 19, 2026, MiniMax M3.1 Flash became available on Vercel AI Gateway as minimax/minimax-m3.1-flash, free until October 22 when MiniMax serves the request. Vercel describes it as an open-weight multimodal model for coding and agentic work with a 1M-token context window. After the offer, pinned requests bill at MiniMax's standard rate.
Source for MiniMax M3.1 Flash on AI Gateway (opens in a new tab)
Base44
Compliance API workspace transfer and token fields
On October 22, 2026, Base44's Compliance API workspace endpoint added app_transfer_out and app_transfer_in, for who can move apps in and out of the workspace, and personal_access_token_policy, for whether members' tokens can act on the workspace and which permissions they may hold. The legacy token_policy field is superseded, is always null, and will be removed in v2.
Source for Compliance API workspace transfer and token fields (opens in a new tab)AI chat turn webhook events renamed
On October 21, 2026, Base44 retired the builder.turn_started.v1 and builder.turn_ended.v1 webhook event types and replaced them with chat.turn_started.v1 and chat.turn_ended.v1. Endpoints still selecting the old names receive nothing. Update the endpoint configuration in Settings or through the API, and update receiver code that checks type or dataschema.
Source for AI chat turn webhook events renamed (opens in a new tab)Live updates for white-label builders
On October 20, 2026, Base44 white-label workspaces can stream AI build activity to the builder's browser in real time, including messages, tool calls, status changes, and preview reloads, without polling. The server opens a short-lived socket session for the apps a page shows, and the browser connects with the Platform SDK. It is in beta on the Builder plan or higher.
Source for Live updates for white-label builders (opens in a new tab)
Anthropic API
Claude Models on Google Cloud
On October 22, 2026, Anthropic launched Claude Models on Google Cloud (Anthropic managed), the Claude API operated by Anthropic and reached through a Google Cloud project. Google Cloud IAM controls access, and Google Cloud Marketplace handles billing. Fast mode is available for Claude Opus 5.5 on that offering.
Source for Claude Models on Google Cloud (opens in a new tab)Claude API version 2026-10-21
On October 21, 2026, Anthropic released API version 2026-10-21. New client SDKs and the ant CLI send that version by default: Python SDK 2.0.0, TypeScript SDK 1.0.0, C# SDK 13.0.0, Go SDK 2.0.0, Java SDK 3.0.0, PHP SDK 1.0.0, Ruby SDK 2.0.0, and ant CLI 2.0.0. Those releases also include breaking changes that do not depend on the API version, and they are licensed under Apache 2.0 instead of the MIT License. User profiles now include enforcement_status and enforcement_actions, and listing profiles accepts an enforcement_status[] filter for profiles with an open restriction or ban.
Source for Claude API version 2026-10-21 (opens in a new tab)
Devin Desktop
Devin Desktop 3.11.216
Released October 24, 2026. Members whose organization role has no Devin Cloud session permissions can see, open, and start Devin Local sessions again. On Windows, devin is available in a new terminal (PowerShell, Command Prompt, Windows Terminal, and Git Bash) right after Install Devin CLI, without signing out first. On macOS and Linux, running Install Devin CLI again refreshes the link instead of failing. A saved sign-in keeps working after updating on machines where the editor's own connections to the Devin servers fail. Devin Local sessions no longer crash when a terminal command prints an inline image (Sixel, iTerm2, or Kitty).
Source for Devin Desktop 3.11.216 (opens in a new tab)Devin Desktop 3.11.212
Released October 23, 2026. The Agent Window now runs the same interface as the Devin web app: the sessions sidebar, session view, Automations, Review, Wiki, settings, and Command Palette match app.devin.ai and follow the Devin Desktop theme. Drag a session onto an open session to view up to 8 sessions side by side, group sidebar sessions by workspace, and open a Files view, a Changes tab, and a terminal for local and cloud sessions. Cloud sessions can open a Remote SSH window, an app preview with an element picker, and a code-scan Findings view. Pressing Enter while Devin is working steers the running turn, and Cmd/Ctrl+Enter queues the message. Configured MCP servers can be @-mentioned. Agent diff zones are off by default, so agent edits are applied directly to files. Plugins can declare platforms of cloud or local, and Devin Desktop only activates plugins that apply locally.
Source for Devin Desktop 3.11.212 (opens in a new tab)
OpenCode
OpenCode 2.1.4
Released October 23, 2026. When an MCP server asks for input during a tool call, the form shows up instead of the call waiting until it times out. Desktop and web can show these forms too, including text, number, choice, multiselect, boolean, and URL requests. Set experimental.background_compaction to true to prepare a summary in the background as a session nears its compaction threshold, so automatic compaction does not wait for it. Summaries that are never used still cost tokens. ChatGPT sign-in context caps are a documented built-in plugin; add "-opencode.provider.openai-context-caps" to plugins to turn them off. An experimental TUI tools option lets agents open and type into the session terminal through tui_open_terminal and tui_write_terminal without taking keyboard focus. SDK clients can call connectClientMcp() to host MCP tools over the experimental client MCP WebSocket transport.
Source for OpenCode 2.1.4 (opens in a new tab)OpenCode 1.19.4
Released October 22, 2026. Upgrades the bundled Bun runtime to 1.4.4. OpenCode says that runtime includes security fixes for Brotli, TLS, HTTP/1.1, HTTP/2, HTTP/3, WebSocket, and fetch, and updates root certificates to NSS 3.131.1.
Source for OpenCode 1.19.4 (opens in a new tab)
Codex CLI
Codex CLI 0.164.0
Released October 23, 2026. Adds ten numbered /presets slots for reusable prompts and slash commands, with a keyboard menu. Inline /model and /permissions arguments set the model, reasoning effort, speed, and permission profiles. Terminals that support Kitty or Sixel graphics can preview viewed and generated images in the fullscreen transcript. Enterprise MCP connections can authenticate with eligible Codex account grants or a dedicated sign-in, including OAuth clients that require secrets. Supported remote Bash commands and Zsh snapshot sessions mask credentials, including credentials from custom providers. The Amazon Bedrock setup wizard is on by default. Failed compaction no longer leaves partial summaries in history, and resuming a session finds compressed histories and restores saved thread settings.
Source for Codex CLI 0.164.0 (opens in a new tab)
Figma
Enterprise controls for paid AI credits
On October 22, 2026, Figma gave Enterprise admins controls for paid AI credits and administration. They can set default per-user access to paid AI credits at the organization and billing group levels, for new and existing users who do not have custom access, and configure paid AI credit access and limits for SCIM-managed users from an identity provider. They can also block team members from creating new Starter or Professional plans with company email addresses, and use admin REST APIs to set up and manage teams, folders, and files. Figma says this is rolling out to Enterprise plans in the coming days.
Source for Enterprise controls for paid AI credits (opens in a new tab)
Gemini CLI
Gemini CLI 0.65.0
Released October 20, 2026. Untrusted folders enforce read-only workspace settings. Resuming a session no longer duplicates tool-response turns or deletes history on a quick exit. Telemetry configuration can send custom OTLP headers. The release also fixes OAuth verification retry loops, an interactive-mode hang on Enter, and session poisoning from a rapid Ctrl-C, along with a broader fix sweep.
Source for Gemini CLI 0.65.0 (opens in a new tab)
Lovable
Enterprise policies, API, and audit export
On October 20, 2026, Lovable made workspace policies, the Action center, the Lovable API, and audit log exports available. Policies can block publishing or require an admin or owner to approve it first. Admins approve those requests in the Action center, which also flags projects that need a decision. The API lets admins read usage and security data and publish, unpublish, update, or delete projects. Audit logs can be sent every hour or every three hours to Splunk, Azure Log Analytics, Amazon S3, Google Cloud Storage, or Azure Blob Storage. The same announcement covers private-preview deploy on AWS and Azure, bring-your-own-key, EU inference, and Organizations.
Source for Enterprise policies, API, and audit export (opens in a new tab)
Mistral
GLM 5.3 Flash on Mistral
On October 22, 2026, Mistral made Z.ai GLM 5.3 Flash available as zai-glm-5-3-flash. Mistral describes it as a multimodal Mixture-of-Experts model with 320B parameters and 18B active, a 1M-token context window, and a 128k-token max output, served without Mistral modifications, for developer agent workflows, visual coding, and tool use. Pricing is $0.15 per million input tokens, $0.03 per million cached input tokens, and $0.50 per million output tokens.
Source for GLM 5.3 Flash on Mistral (opens in a new tab)
OpenAI API
Decisions API generally available
On October 22, 2026, OpenAI made the Decisions API generally available. It uses GPT-6 Luna for questions with bounded answers and, OpenAI says, is up to 10x faster than GPT-6 Luna through the Responses API. Since the public beta it adds a native GPT-Live integration, prompt caching, and inference residency in the US and EU. Requests can include native JSON and images in question instructions, and up to 400 questions, twice the previous limit. Answer types are predicate (a probability from 0 to 1), choice (one of the supplied values, plus probabilities and confidence), and score (a probability-weighted average of rubric level indices). Input is $0.10 per million tokens and cached input is $0.01 per million tokens, with no output-token charge. Regional processing is available in the US and EU.
Source for Decisions API generally available (opens in a new tab)
Replit
Monitoring Agent
On October 22, 2026, Replit introduced Monitoring Agent. With monitoring alerts and auto-fix enabled, it is notified of a production issue, can read production logs and metrics, investigate the cause, validate a fix, and email a summary. With auto-publish enabled, it can deploy that validated fix. Turn it on from a published app's Publishing settings. You decide whether fixes are published automatically.
Source for Monitoring Agent (opens in a new tab)
Updated