What's new in DevEx - August 21

GitHub went down for over 7 hours on August 17 after an infrastructure component in its Central US data center failed to scale with a new traffic peak. Authentication broke first, then Actions, pull requests, and Copilot across three IDEs. CTO Vlad Fedorov's post-mortem disclosed that monthly commits grew from 1.4 billion in April to 2.9 billion, and remediation adds 3 million CPU cores and 120 petabytes of storage.

Datadog had three models build the same document-sharing application in both plan mode and default mode, then ran static analysis on the results. Claude Composer 2.5 dropped from 29 findings to 2, but GPT 5.5 rose from 2 to 3 and Claude Sonnet 5 gained an infrastructure-as-code finding. Variance between models proved far larger than variance between modes.

Stripe announced on August 19 that it will acquire OpenRouter, the gateway routing requests across 400 models from 80 providers for roughly 8 million users. Terms were not disclosed. TechCrunch, citing a leaked investor letter, reported $7.5 billion, up from a $1.3 billion valuation in May. The deal extends Stripe's existing Token Billing product into model routing.

Cursor shipped Origin on August 17, moving into GitHub's territory with repos, pull requests, and code browsing on all paid plans. It syncs rather than replaces: pushes still go to GitHub, comments post both ways, and existing GitHub Actions workflows run unchanged. For now it adds to GitHub rather than replacing it, and the agent-native features have not shipped.

GitHub opened public previews on August 21 that let teams mention @GitHub in Slack or Teams to start a coding agent session. Copilot triages bugs, investigates failures, implements changes in a cloud sandbox, and opens linked pull requests inside shared code channels. Agent credits and sandbox usage bill separately.

On August 20 an attacker published malicious versions of three Rust packages, which together carry over 264 million downloads. Each pulled in a lookalike dependency that ran a payload during compilation, before any of the code was called. Because the packages were removed entirely rather than flagged, dependency scanners will not warn teams that already built against them.

Till next time,