TL;DR
- Microsoft's July Patch Tuesday fixes 570 vulnerabilities with CVE-2026-56155 and CVE-2026-56164 already exploited in production.
- Rust 1.97 stabilizes v0 symbol mangling after eight years; production traces now carry full type information.
- Claude Opus 5 available in GitHub Copilot for Pro+/Enterprise users with 1M-token context, same Opus 4.8 pricing.
- Node.js 20 support ends in Azure SDK and AWS Lambda; teams have until August-September to upgrade.
Releases and versions
Rust standardizes symbol scheme, Node.js Azure era dawns
Production environments shift after eight years of compatibility pains and one major platform's version cutoff.
Rust 1.97.0 (July 9, patched July 16) makes v0 symbol mangling the default, finally standardizing how generic types appear in production binaries. The legacy scheme stripped type info; now traces show full generics like Vec<String>. The release adds build.warnings for CI to enforce warning-free builds without cache invalidation, and new integer bit helpers. (via Rust Blog)
Azure SDK stops supporting Node.js 20.x as of July 9, accelerating migration beyond April's EOL. AWS Lambda follows: security patches stop now, function creation blocks August 31, updates block September 30. Teams running Node 20 face an immediate upgrade to Node 22 LTS. (via Azure SDK Blog)
Python linting tool Ruff ships v0.16.0, expanding from 59 to 413 default lint rules—a major jump for teams adopting it in CI pipelines. The update signals Ruff's maturity as a Pylint alternative. (via Astral)
Breakage and security
Microsoft patches 570 flaws with zero-days already exploited
July's security patch deluge spans every vendor, from Microsoft to the Linux kernel, with AI-assisted vulnerability discovery blamed for the surge.
Microsoft's July Patch Tuesday fixes 570 vulnerabilities—57 critical, 510 important—triple June's volume and a record for the month. CVE-2026-56155 and CVE-2026-56164 are already exploited in the wild, and CVE-2026-48561, a remote code execution flaw in Microsoft Copilot (CVSS 9.6), landed among critical finds. (via Krebs on Security)
Linux kernel assigns 432 CVEs in 30 hours (July 22), prompting questions about CVE sustainability. The Linux CVE Numbering Authority's cautious stance—treating nearly any bugfix as a potential security issue—has collapsed the model teams once used to review each CVE individually. Speculation pins the surge to AI-assisted bug reports. (via The Register)
Oracle drops 1,449 security patches (July 23), continuing a trend of record-setting patch volumes across vendors. The sheer pace has left organizations unable to prioritize and validate patches in real time, raising questions about the sustainability of traditional patch management. (via The Register)
AI for developers
Copilot gets Claude Opus 5, VS Code births multi-threaded agents
Developers can now run parallel agent sessions and coordinate tool use across multiple chats in their IDE.
Claude Opus 5 arrives in GitHub Copilot (July 24), bringing Anthropic's flagship model to Copilot Pro+, Max, Business, and Enterprise users with a 1M-token context window. Opus 5 excels at agentic workflows—autonomous code changes, regression validation, multi-tool coordination—at the same $5/$25 per million token price as Opus 4.8. Rollout is gradual. (via GitHub Changelog)
VS Code 1.128 (July 8) makes Copilot Vision generally available in chat and adds multi-chat agent sessions, letting developers branch from earlier turns, compare approaches, and run work in parallel. The update also enables OS-level keyboard shortcuts that activate even when VS Code is unfocused. (via VS Code)
GitHub MCP Server now supports the next MCP specification (July 23), expanding interoperability across agent ecosystems. The update paves the way for tighter GitHub-and-IDE integration for teams running complex agent workflows. (via GitHub Changelog)
Tools and workflow
VS Code agents scale with worktree support and faster diffs
Multi-file change review becomes practical with compact diffs and dedicated agent processes you can reconnect to.
VS Code 1.130 (July 22) brings agent host improvements: run sessions in dedicated processes that multiple VS Code windows can connect to, review multi-file changes with compact diffs and file-level stats, and adds worktree support. The release targets teams running complex agent workflows across multiple repositories. (via VS Code)