GitHub now offers stacked pull requests in public preview, letting you break a massive change into an ordered series of small PRs that can be reviewed and merged independently or all at once. The feature works with existing branch protections and checks, so teams can keep velocity while maintaining code‑quality safeguards.
New DORA 2025 research reveals AI is an amplifier, not a magic fix. Teams that invest in foundational processes, clear priorities, robust architecture, and data pipelines, see up to 30% higher delivery speed and stability, while weak systems merely ship faster bugs. The report outlines seven team profiles and capabilities to guide effective AI adoption.
The preview warns that v1.37 will deprecate “kubectl run -f” as it no longer creates pods from files, and static pods will no longer be allowed to reference Secrets or ConfigMaps, breaking a long‑standing bug. It also flags the upcoming removal of ipvs mode in kube‑proxy and the impending phase‑out of cgroup v1, forcing admins to adapt now.
Amazon EKS now lets Auto Mode and Karpenter node pools use EC2 placement groups and Elastic Fabric Adapter (EFA) networking. This gives teams fine‑grained control over instance placement and IP usage, unlocking higher throughput for distributed training and tighter fault isolation for critical services. Available in all regions.
Cloudflare’s Authenticated Origin Pulls and Custom Origin Trust Store now accept ML‑DSA post‑quantum signatures, enabling fully quantum‑resistant TLS authentication between Cloudflare edge nodes and customer origin servers. This thwarts future quantum impersonation attacks on the server‑to‑origin link, completing the first milestone of Cloudflare’s 2029 post‑quantum security roadmap.
Dropbox open‑source the MCP‑based Dash server, letting AI‑assisted reviewers pull design‑level security data straight from the company's knowledge base. By exposing searchable security architecture details during code review, engineers can verify compliance on the fly, closing the long‑standing gap between design intent and implementation.
The new CISA guidance replaces the 2021 baseline and makes cryptographic hashes mandatory for every SBOM component, letting teams verify the exact bytes deployed. It also expands the minimum elements to cover AI/ML model artifacts, pushing vendors to disclose model and dataset provenance. Together these changes raise the bar for software supply‑chain transparency and risk management.
GitLab warns that agentic AI can bypass human review, letting code changes be made automatically, and offers a concrete governance framework, identity, permissions, audit trails, and an MCP‑enabled checklist, to keep the pipeline secure. The approach targets the 92% of DevSecOps teams already seeing AI‑generated risk, turning control points into a built‑in safety net.
Red Hat’s 2025 Product Security Risk Report charts 3,781 advisories and a 54% jump in supply‑chain attacks, proving that outdated flaws still surface in active exploits. It also shows how divergent legal “clocks” across EU, US and Asia create parallel compliance programs, turning regulation into hidden operational overhead for global software teams.
You’re caught up.
That was all 9 stories in the 31 July issue.