A week defined by two big ideas running in parallel: AI agents are breaking the infrastructure underneath them, and the security surface around developer workflows keeps growing. Both threads showed up in force. Here's what mattered.
Anthropic hit 30,000 merges a day, and Git couldn't keep up — so it built Scion
By September 2026, Anthropic was averaging 30,000 merged changes a day, up from 2,500 in May. Its main branch history had grown close to 100 GB. CI alone required 25 million checkouts a day, and at peak the team ran several hundred Git mirrors just to keep up. Standard workarounds stopped working. So a seven-person team built a replacement from scratch.
Scion is Anthropic's internal version control system. The design is built for always-online, agent-heavy workloads rather than Git's original model of offline, occasional human pushes. Servers handle commits, merges, rebases, and diffs. Clients keep a small local cache. Commits are stored as changesets that scale with the size of the change, not the size of the repo. Cache hit rates are above 99% at each of the three tiers. The result: checkouts take seconds instead of minutes, use about 200 times less CPU and memory than the old mirror fleet, and recover 25% of CI capacity.
Anthropic says Scion only makes sense for very large monorepos and has no plans to release it — but it wants to share the ideas with GitHub, GitLab, and the open source community. Last week's briefing covered GitHub's infrastructure rebuild to handle agent-scale load. This week, Anthropic said: we got there first, and we had to build something new to do it.
Read more
GitLab patches a CVSS 10 — update now
A critical vulnerability in GitLab's CI/CD regex engine, CVE-2026-97229, got a perfect CVSS score of 10.0. An unauthenticated attacker could send a crafted regex in a CI/CD configuration and execute arbitrary code on the server — which typically holds source code, pipeline definitions, and production secrets. GitLab shipped fixes in versions 19.4.2, 19.3.5, and 19.2.8 on October 12. GitLab.com is already patched. Dedicated customers need no action. Self-managed instances need to upgrade now. The release also covers 23 other vulnerabilities, including an 8.7-rated prompt injection in GitLab Duo Agent Platform.
Read more
GitHub now records who pushed every commit
Git has always let developers set their own name and email in commits — metadata that's trivially spoofed. GitHub's new push attribution feature records the authenticated account that actually pushed each commit, separate from the author and committer fields. A new repository ruleset, "Committer must match pusher," can block pushes where the committer's email doesn't match the pusher's verified addresses. The practical benefit: bots and agents often push commits under a human's name. This makes that visible. It's in limited public preview for GitHub Enterprise. Before enabling the enforcement rule, audit your release bots, shared tokens, and any workflow that pushes on behalf of someone else — the rule will break those if you don't.
Read more
GitHub is pushing teams off classic PATs — here's the new permission model
GitHub announced narrowed app permissions aimed at getting teams off classic personal access tokens. Classic PATs have been a persistent weak spot: long-lived, often over-scoped, and easy to forget once they're embedded in a workflow. The new fine-grained permissions limit what any given token or GitHub App can access. If your team still uses classic PATs in automation, this is a push to move. The transition won't happen overnight, but the direction is clear.
Read more
npm gives unused trusted publishing configurations 48 hours to prove themselves
npm's trusted publishing feature ties release authority to a repository or project name. That's useful until the name changes hands — an abandoned or reorganized repo that still has a trusted configuration is exactly where supply chain attacks start. npm's fix: any configuration that doesn't complete a successful publish within 48 hours of creation expires. Once it publishes successfully, the expiration goes away. The practical change: create your trusted publishing configuration when you're ready to publish, not during setup. If it expires, recreate it.
Read more
Anthropic added native OpenTelemetry trace export to the Claude Platform, in public beta. It works with the Messages API, Claude Managed Agents, and the Claude SDKs. Each trace includes duration, status, token counts, the model used, tool names, and request IDs. Teams can also enable full content export, which adds prompts, responses, and tool inputs and outputs. Setup for the Messages API and Managed Agents requires no application code changes — just configure an export destination in the Claude Console. The feature supports any OTLP-compatible backend; Anthropic has published guides for 12 partners, including Datadog, Grafana, Honeycomb, Langfuse, New Relic, and Splunk. The practical value: agents make several model calls, tool calls, and retries per request, and failures in that chain are hard to trace without instrumentation. This is the instrumentation.
Read more
Figma gives AI agents a spec sheet and code layers land on the canvas
Figma shipped two features worth tracking. Specs is a Markdown editor — on canvas or as a standalone file — where teams write requirements, design rules, and agent instructions. It can reference canvas elements, pull context from a connected GitHub repo, and embed diagrams and code. On the development side, Code Layers lets teams place running, code-backed prototypes directly in a Figma file. Code can come from a GitHub repo, a local folder, a live website, or an AI coding tool. Claude Code gets a round-trip: work from Claude Code can land in Figma, and design changes can be pulled back into the codebase through MCP. Both features are in open beta.
Read more
Also from this week
Cloudflare acquires Deno's team to build self-hosted Workers. Cloudflare is hiring Ryan Dahl and the Deno team to make workerd, the open-source Workers runtime, production-viable for self-hosted deployments. Deno Deploy shuts down in six months. Deno runtime gets one more year of maintenance releases. JSR keeps running. If you're on Deno Deploy, start planning the move now. Read more
Microsoft launches Decision-1, a fast, cheap decision-scoring model. Built on post-trained Qwen3.5-9B, Decision-1 takes a fixed set of answers and returns calibrated probabilities in a single API call. It's aimed at routing, classification, and workflow control — the "System One" decisions in an agent pipeline. Available in Microsoft Foundry and through OpenRouter at $0.042 per million input tokens. Read more
Nvidia hands Run:ai to the open source community. The GPU orchestration platform Nvidia acquired in 2024 is going open source. For teams managing GPU workloads for AI training and inference, this matters. Read more
SpaceX bundles Grok, Cursor, and X Premium into one subscription. The $30/month Premium tier combines Grok, Cursor Pro, and X Premium+ — tools that would cost about $90 separately. The catch: Grok and Cursor share a usage pool, so AI chat and coding work against the same weekly limit. Dev teams should audit that tradeoff before committing. Read more
AI doesn't replace your thinking — it raises the bar for it. My latest for Insights From Analytics: the patterns I keep seeing when professionals struggle to get real value from AI, and what changes when they fix them. Read more
Developer Spotlights this week
Bryan MacLee drives an oil and gas truck in Vernal, Utah, and builds his own programming language on the side. SCRML is a full-stack language for the browser — the compiler handles the wiring between frontend and backend that developers normally manage by hand. Version 0.8 is out. Adoption is near zero, by his own description on the project site. He's building it anyway. A good conversation about what it takes to build something nobody's using yet.
Watch the conversation
Jonathan Gordon spent decades building developer tools at Google, Apple, Microsoft, Oracle, and SAP. His warning: AI-generated code often has error handling that "puts nothing in the catch block." Users find out when buttons stop working. His rule: "We can't just let AI build the software by itself." The full conversation is a useful counterweight to the vibe coding conversation.
Watch the conversation
The through-line this week: agents are breaking things at the infrastructure layer, and security controls designed for human developers don't hold up at agent scale. Anthropic had to build a new VCS. GitHub is adding authentication that was never needed when a human was always at the keyboard. The same pressure is showing up everywhere.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.
