Six updates matter today: two Codex changes, one new Copilot model, two software-supply-chain defenses, and one deadline that arrives tomorrow. The first five are product or security updates; the last is a deadline reminder, not a same-day announcement.
1. A Codex usage reset is an operational signal, not a contract
Tibo Sottiaux said that usage limits were reset for ChatGPT Work and Codex users after a GPT-5.6 Sol issue was addressed. His update also said subscription limits were not reduced, typical Sol usage should last about 18% longer after the fix, and the temporarily paused five-hour usage window would resume the following day.
That explains a sudden change in the meter. It does not prove that every account now has the same long-term burn rate. If usage matters to your workflow, compare several runs with the same model, reasoning effort, task type, and starting position in the five-hour window.
Source: Tibo Sottiaux's update on X
2. Codex Security adds a public CLI and TypeScript SDK
OpenAI's Codex Security repository describes a CLI and TypeScript SDK for finding, validating, and fixing vulnerabilities, reviewing changes, tracking findings, and running checks in CI.
The quick start is short:
npm install @openai/codex-security
npx codex-security login
npx codex-security scan .The constraints matter: the repository lists Node.js 22+, Python 3.10+, and Codex Security access. A public package does not mean every account has access, and an AI-generated fix is not automatically safe to merge. Evaluate reproducibility, human-verifiable evidence, test results, and operating cost—not finding count alone.
Sources: OpenAI's Codex Security repository and Codex Security Help Center article
3. Grok 4.5 is rolling out in GitHub Copilot
GitHub says Grok 4.5 is entering gradual rollout for Copilot Pro, Pro+, Business, and Enterprise users. The model supports a 500,000-token context window, image input, and three reasoning levels.
For organizations, availability is not automatic: Business and Enterprise administrators may need to enable the model in policy settings, and provider pricing still applies. Teams should check both policy and cost before treating a model announcement as deployment.
Source: GitHub Changelog: Grok 4.5 in Copilot
4. Dependabot expands malicious-package detection
Dependabot alerts now use additional OpenSSF malicious-package data, expanding coverage across ecosystems including npm and PyPI. GitHub says the change is automatic for repositories where Malware alerts are already enabled.
This is useful because package compromise often looks like a normal dependency update until another signal says otherwise. The operational check is simple: confirm Malware alerts are enabled and make sure the person who can respond actually receives the alert.
Source: GitHub Changelog: broader malicious-package alerts
5. GitHub Actions can hold suspicious workflows for approval
GitHub Actions can now hold potentially malicious workflows instead of running them immediately. A collaborator with write access must authenticate and approve the run before it proceeds.
GitHub says this protection applies to public repositories on GitHub.com and is not available in GitHub Enterprise Server. It reduces automatic exposure to suspicious workflow changes, but it does not replace review: the approver still needs to inspect the diff, triggers, permissions, and secrets access.
Source: GitHub Changelog: suspicious workflow approval
6. GitHub Models retires on July 30
GitHub announced earlier this month that GitHub Models will be fully retired on July 30, 2026. The playground, model catalog, inference API, and bring-your-own-key path will stop working for all customers.
This is a deadline reminder rather than a July 29 launch. If a script, demo, or internal tool still calls GitHub Models, today is the day to inventory it, choose a replacement provider, rotate any related configuration, and run a real migration test.
Source: GitHub Changelog: GitHub Models retirement
The practical takeaway
The pattern is not just “more AI.” It is a maturing developer stack: model choice is expanding while security, policy, approval, and migration deadlines are becoming part of normal operations. The useful question for each update is the same: what changes in the workflow tomorrow, and what evidence will prove it works?
AI-assisted disclosure: I used AI to help organize and edit this roundup. I checked every factual claim against the primary sources above and take responsibility for the final text.
Top comments (0)