Snack Pack #5: Mark the dates before the switches flip
Week of Nov 5–11, 2026 · 7 snacks · ~8 min
Two dates are closing in on your GitHub setup.
The legacy GitHub app in Microsoft Teams retires on Nov 16, Cursor cloud agents can now publish shareable live apps and OpenAI opens GPT-6 Cyber to a select group of Daybreak Red defenders.
Dependabot alerts pause on idle repositories on Dec 8, while Claude Code’s “Don’t ask again” can save secrets, Claude adds IP allowlists and Copilot offers Claude Fable 5.2.
Nutrition Facts
Serving: 1 Snack Pack · ~8 min
Counts from this issue · 15 cards · Hype: 0 g.
Here’s what changed in your agent tools. Every bite links to its source. No funding fluff. No “AI will change everything.” Just what shipped, what changed, and why it might matter to you. A fresh pack lands every Thursday.
Legacy GitHub Teams app retires Nov 16
Action needed: the legacy GitHub app in Microsoft Teams retires on Nov 16, 2026. GitHub announced this on Oct 23, 2026. Install the consolidated GitHub app (formerly GitHub notifications) so @GitHub and Copilot in Teams keep working.
Who cares Anyone still on the legacy GitHub app in Microsoft Teams who uses Copilot there.
Source: GitHub Changelog: Turn notifications into code with GitHub Copilot in Teams, Oct 23, 2026
Cursor cloud agents ship shareable live apps
Your cloud agent can now leave localhost with a shareable live app. Cursor’s Nov 5, 2026 changelog says you describe the app, and it scaffolds the code, can provision Postgres, puts auth behind Cursor sign-in, and hosts it after you publish.
Who cares Paid Cursor users with cloud agents who need internal dashboards, portals, or microsites without a separate deploy stack.
Source: Cursor Changelog: Build Live Apps in Cursor, Nov 5, 2026 · Cursor docs: Cloud Agent Apps
GPT-6 Cyber joins Daybreak Red for defenders
GPT-6 Cyber is OpenAI’s new model for authorized security research. The Nov 5, 2026 post says it finds and validates exploitable vulnerabilities, helps develop fixes, and is trained to stay inside the scope researchers set. It starts on the API and Codex for a select group of Daybreak Red customers.
Who cares Approved Daybreak Red security teams who already use OpenAI for authorized vulnerability research, triage, and patch work.
Source: OpenAI: Introducing GPT-6 Cyber, Nov 5, 2026 · OpenAI API changelog, Nov 5, 2026
Dependabot alerts turn off on idle repos Dec 8, 2026
Dependabot alerts go quiet on repos with no activity for a year, starting Dec 8, 2026. GitHub announced the change on Nov 10, 2026, and says existing alerts are archived, not deleted.
Who cares Anyone with older repositories on github.com, including agent side projects.
Source: GitHub Changelog: Dependabot alerts will pause on inactive repositories, Nov 10, 2026
Claude Code “Don’t ask again” can save your secrets
Check your project’s .claude/settings.local.json for passwords and keys. As reported by The Hacker News, Apiiro found 1,122 public copies of that file on GitHub holding at least one secret, saved by “Yes, and don’t ask again” approvals.
Who cares Anyone who clicks “Yes, and don’t ask again” in Claude Code on a command that has a password, token or key typed into it.
Source: Apiiro research, Nov 6, 2026 · The Hacker News write-up of the Apiiro research, Nov 7, 2026 · Claude Code docs: Settings
Claude IP allowlists lock keys to your net
A leaked Claude API key now has fewer places it can run. Claude Platform’s Nov 5, 2026 release notes add organization IP allowlists in beta, so covered requests from addresses outside your list are refused. You can add up to 1,000 IPv4 or IPv6 addresses or CIDR ranges.
Who cares Claude Console and Claude Enterprise admins who want to limit where API keys or stolen sign-ins still work.
Source: Claude Platform release notes, Nov 5, 2026 · Claude docs: IP allowlisting
Claude Fable 5.2 in Copilot is off until an admin flips it
Claude Fable 5.2 is now in your Copilot model picker, if your plan and admin allow it. GitHub made it generally available on Nov 9, 2026, for complex, multistep coding tasks across large codebases.
Who cares Copilot Pro+, Max, Business and Enterprise users, and the admins who set Copilot policies.
Source: GitHub Changelog: Claude Fable 5.2 in GitHub Copilot, Nov 9, 2026
What’s a secret, and what do you do when one leaks?
A secret is any credential that proves it’s you, such as an API key, a password or a token.
GitHub’s docs say that when secret scanning finds one exposed, the advice is to rotate the affected credential right away, because scrubbing it from Git history is time-intensive and often unnecessary once the credential is revoked (GitHub Docs: About secret scanning).
Try this: if you have ever pasted a key into a command, a chat or a config file, read our Claude Code Daily to see one place it can end up. New here? Start here.
When Opus isn’t enough, Claude Fable 5.2 is the next step up
Claude Fable 5.2 is the model Anthropic wants you to reach for when Opus 5.5 still isn’t enough. It shipped on Nov 9, 2026, costs less than Fable 5.1, and generates outputs up to 30% faster, with an optional fast mode on some platforms.
Four API changes can turn a request that used to work into a 400 error, so don’t just swap the model id.
Full Main Course: 11-min read
Sources
Put the riskiest Dependabot alerts first
Try it now:
- In a repository, open the Security and quality tab, then pick Vulnerabilities under Dependabot in the Findings sidebar.
- Keep the default Most important sort, which weighs signals such as CVSS score and dependency scope, or type
scope:developmentin the search bar to see which alerts only touch development dependencies. - Open an alert and use the Assignees menu to give it an owner, which can be a person, a team or an AI agent.
Your apps have moved into Claude
Plays from YouTube when you press play.
Video Summary
- Interactive connectors open the full version of a tool inside Claude.
- The demo adds a summary to a Confluence launch plan, applies a dither effect to a photo in Adobe, and checks a Box floor plan against a design standard.
- Make changes yourself, or ask Claude to make them with you. Rolling out on web and desktop.
On screen: Claude chat with Confluence, Adobe and Box opening as live panels next to the conversation.
After watching you can: Know what interactive connectors look like in Claude and which kinds of edits you can ask for.
Short on time? Watch just:
MCP reference servers
Update before your agent reads another repository. The latest reference servers release fixes six vulnerabilities across the filesystem, Git and fetch servers, including a repository’s own Git config making a read-only call run a program.
If you run a date version of the filesystem server, install 2.3.0 by name, because package managers won’t offer it as an upgrade.
Context7 MCP
Let your agent read a library’s source at the version its docs describe. Upstash’s Context7 adds a query-code tool and a get-upgrade-guide tool that compares two versions, both in a research preview that stays hidden until you switch it on.
MongoDB MCP server
If you choose read-only in setup, that choice now sticks for every client. MongoDB’s official server writes the --readOnly flag into the configs it generates for Cursor, VS Code, Claude Code and others, dials a preconfigured connection on startup and accepts named connection strings.
Most of this week’s news came with a switch attached
- Four more Dailies are worth a catch-up. Secret scanning now reads GitHub Actions workflow logs, Gemini 4 Carbon joined Copilot’s model picker, Images 2.6 added GIFs and SVG in Codex, and Copilot reached Xcode’s coding assistant in preview.
- Two Main Courses from this week are also worth your time. Let your dot borrow a computer covers what one Allow hands over to a ChatGPT dot, and FlashProve asks how you would prove which model answered.
That’s the pack. Pass a snack to a friend.