Signal Hub 2026-08-07

Slash commands in the GitHub Copilot app go beyond the CLI, offering text shortcuts for managing sessions, planning, and executing workflows. Key commands include /plan for breaking down tasks, /spar for challenging assumptions, /autopilot for hands-off implementation, /rubber-duck for independent review, /create-canvas for building interactive visualizations, and /orchestrate for coordinating multi-repository work. These shortcuts aim to speed up development by integrating planning, review, and automation directly into chat.

• Slash commands in the Copilot app are text shortcuts for managing sessions and workflows.
• /plan helps break down tasks before coding and enters Plan mode.
• /spar challenges assumptions to identify risks and tradeoffs.
• /autopilot switches to Autopilot mode to implement features and iterate.
• /rubber-duck uses a different model to independently review work for blind spots.
• /create-canvas creates interactive interfaces like diagrams or boards from chat.
• /orchestrate coordinates tasks across multiple repositories or sessions.

GitHub Copilot / slash commands / AI coding assistant / developer productivity / planning / code review / automation

GitHub's Dependabot now supports malware advisories across eight package ecosystems by building an importer for OpenSSF's malicious-packages repository. The importer validates, normalizes, and deduplicates records, with safeguards like batch caps, provenance tracking, and rollback to handle potential bad data. Users can enable opt-in malware alerts.

• Dependabot now covers malware advisories for npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and Packagist.
• The solution uses a single importer for OpenSSF's malicious-packages repository instead of building eight detection systems.
• Importer validates OSV records, normalizes ecosystem names and version ranges, and drops round-tripped GitHub advisories.
• Security layers: batch caps halt runs on unexpected volume, provenance ties each advisory to an upstream commit, and rollback reverses batches as a unit.
• Malware alerts are opt-in and backfill existing dependencies when enabled.

GitHub Advisory Database / malware / npm / open source / supply chain security / Dependabot