Technology News: GitHub Copilot, JavaScript Security, Cloudflare and AI

Coverage: October 2–3, 2026
Scope: Fresh developer and technology news from yesterday and today
Method: Primary-source verification; older stories are excluded from the main coverage.

Introduction

The last two days have been more about the evolution of AI-assisted software engineering, software supply-chain security, developer APIs, and cloud observability than about a major JavaScript runtime release.

GitHub has been particularly active. Copilot Code Review is now accessible through REST and GraphQL APIs, Dynamic Workflows brings multi-step and agentic workflows into Copilot CLI and the Copilot app, and Computer Use allows Copilot to interact with desktop applications in public preview. At the same time, GitHub expanded its Security Advisory APIs and completed the rollout of longer stateless GitHub App installation tokens.

On the infrastructure side, Cloudflare introduced Traces, extending request tracing across more of its platform, and launched a Web Search API through AI Gateway so agents can search the live web instead of guessing URLs. OHTTP Gateway also moves privacy-preserving networking further into the developer platform.

For JavaScript developers, the most important security item is the Seroval advisory. Projects that deserialize untrusted data should review their dependency tree and upgrade where applicable.

Quick Take

• GitHub Copilot Code Review can now be triggered through REST and GraphQL APIs.
• Dynamic Workflows adds multi-step and agentic workflow tooling to Copilot CLI and the Copilot app.
• Copilot Computer Use is available in public preview for desktop interaction.
• GitHub expanded Security Advisory APIs with comments, confidential comments, and new GraphQL fields.
• Seroval has an important security advisory; affected projects should review their dependency versions.
• Cloudflare Traces is in open beta and follows requests across more of the Cloudflare-to-origin path.
• Cloudflare Web Search API gives AI Gateway agents a first-class web search tool.
• Cloudflare also introduced an OHTTP Gateway for privacy-preserving HTTP requests.
• No new Node.js, Deno, Bun, or TC39 release was verified for October 2–3.

1. GitHub Copilot Code Review gets API support

Stage: Stable / Generally Available
Published: October 2, 2026

GitHub now allows Copilot Code Review requests through REST and GraphQL APIs. Each request can also specify the review effort level, while Balanced is now the default.

This turns code review into an automation-friendly component that can be triggered from scripts, CI systems, and internal engineering tools.

Why it matters

AI review is moving from a UI-only feature toward an API-level building block for engineering workflows.

Recommended action

Test the API in a non-critical repository first. Keep human approval before automated merges.

Primary source:
https://github.blog/changelog/2026-10-02-copilot-code-review-api-support-and-new-default-effort-level/

2. Dynamic Workflows in Copilot

Stage: Experimental workflow tooling
Published: October 2, 2026

GitHub introduced Dynamic Workflows for Copilot CLI and the Copilot app. The feature is designed around multi-step workflows and coordination between multiple agents.

Why it matters

Instead of treating an AI assistant as a single prompt-response tool, a workflow can represent a sequence of engineering tasks.

Recommended action

Keep agent permissions narrow and make workflows observable and reversible.

Primary source:
https://github.blog/changelog/2026-10-01-dynamic-workflows-in-copilot-cli-and-the-copilot-app/

3. Copilot Computer Use

Stage: Public Preview / Experimental
Published: October 1, 2026

Copilot can interact with desktop applications with user approval, including clicking, entering text, scrolling, and navigating GUI workflows.

This is particularly interesting for legacy applications and tools without usable APIs or CLIs.

Primary source:
https://github.blog/changelog/2026-10-01-github-copilot-can-now-interact-with-desktop-apps/

4. GitHub Security Advisory API expansion

Stage: Public Preview / API expansion
Published: October 2, 2026

GitHub added repository security advisory comment APIs, confidential comments, additional GraphQL fields, and new advisory filters.

These changes make it easier to build security-management tooling without relying on UI scraping.

Primary source:
https://github.blog/changelog/2026-10-02-repository-security-advisory-comments-api-in-public-preview/

5. GitHub App installation tokens are now stateless

Stage: Stable / Rollout complete
Published: October 2, 2026

GitHub completed the rollout of stateless GitHub App installation tokens. New tokens are substantially longer, at roughly 520 characters.

Permissions and token lifetime remain unchanged, but integrations that assume a fixed token length should be audited.

Primary source:
https://github.blog/changelog/2026-10-02-stateless-github-app-installation-tokens-rolled-out/

6. Seroval JavaScript security advisory

Stage: Security advisory
Relevant fixed version: 1.6.2+

Seroval has a security advisory involving serialization and Promise/thenable handling. Applications that deserialize untrusted data should review whether they use an affected version or vulnerable code path.

Recommended action

Check the dependency tree:

npm ls seroval

Then upgrade according to the official advisory and commit the resulting lockfile.

Primary source:
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c

7. Cloudflare Traces

Stage: Open Beta
Published: October 2, 2026

Cloudflare Traces extends request tracing beyond Workers to more of the full request path, including supported security rules, transformations, cache decisions, routing, Worker execution, and origin handling.

OpenTelemetry and trace context are part of the broader architecture.

Why it matters: it can make multi-layer debugging substantially easier for applications sitting behind Cloudflare.

Primary source:
https://blog.cloudflare.com/cloudflare-tracing/

8. Cloudflare Web Search API for AI Gateway

Stage: Product release
Published: October 2, 2026

Cloudflare introduced a Web Search API through AI Gateway, REST APIs, and Workers bindings. The goal is to let agents search for live web information instead of guessing URLs and fetching them directly.

Primary source:
https://blog.cloudflare.com/introducing-web-search-api/

9. Cloudflare OHTTP Gateway

Stage: Closed Beta / Experimental
Published: October 2, 2026

Cloudflare announced an OHTTP Gateway based on the IETF Oblivious HTTP standard. The architecture allows a backend to process HTTP requests without directly receiving the user's IP address.

Primary source:
https://blog.cloudflare.com/announcing-cloudflare-ohttp-gateway/

10. Cloudflare observability updates

Stage: Product update
Published: October 2, 2026

Cloudflare announced a broader observability update bringing logs, traces, analytics, alerts, dashboards, querying, and telemetry export into a more unified platform.

Primary source:
https://blog.cloudflare.com/one-observability-platform/

JavaScript, TypeScript, Node.js, Deno, Bun and TC39

No new official Node.js, Deno, Bun, or TC39 release was verified for October 2–3, 2026.

The official Node.js release page currently shows its latest listed releases in September, so those older releases were intentionally excluded from the daily news set.

Source: https://nodejs.org/en/blog/release

Browser and Web Platform

No sufficiently significant Chrome, Firefox, or WebKit release or Web API announcement from October 2–3 was found in primary sources for this package.

Rumors

No unconfirmed story from these two days met the threshold for inclusion.

FAQ

Did Node.js release a new version today?

No new Node.js release was verified for October 2–3 in the official release feed.

Can Copilot Code Review run inside CI?

Yes. GitHub now exposes Copilot Code Review through REST and GraphQL APIs.

Are Dynamic Workflows and Computer Use the same thing?

No. Dynamic Workflows focuses on multi-step and agentic workflows, while Computer Use lets an agent interact with desktop GUIs.

Is Cloudflare Traces stable?

No. It is currently in open beta.

Is OHTTP a VPN?

No. OHTTP is a privacy-oriented HTTP architecture that separates client network identity from request content. It is not a general-purpose VPN replacement.

What should I do about Seroval?

Check whether your project uses Seroval and whether the installed version is affected. Follow the official security advisory when upgrading.

Three priority actions

1. Audit JavaScript dependencies, especially Seroval.
2. Test Copilot Code Review API in a controlled CI workflow.
3. Evaluate Cloudflare Traces in staging for multi-layer request debugging.

Primary sources

• GitHub Changelog: https://github.blog/changelog/
• Cloudflare Blog: https://blog.cloudflare.com/
• Node.js Releases: https://nodejs.org/en/blog/release
• Seroval Security Advisory: https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c