Developer Tools Watch: AI Coding, GitHub Security and the Next Developer Stack

Developer Tools watch · October 16, 2026

GitHub hardens the build pipeline, Google folds Code Assist into Antigravity, Bun absorbs the type checker, and Figma puts code on the canvas.

Developer Tools Watch: AI Coding, GitHub Security and the Next Developer Stack

EXECUTIVE BRIEF

Developer tools are absorbing verification: security, type checking, and design handoff are moving into the platforms developers already use.

Five developments matter this week, and none of them is strictly an October 16 launch. GitHub shipped workflow lockfiles (preview, October 14) and AI Scan for pull requests (general availability, October 15). Figma opened code layers and Specs in beta (announced October 14, detailed October 15). Bun released v1.4.3 on October 10, and Google stopped selling new Gemini Code Assist Standard and Enterprise subscriptions on October 9. We treat October 16 as the publication date and label each item with its original date.

This edition sits alongside our Technology Intelligence coverage; the supply-chain thread connects to our DevOps Watch and Cybersecurity Watch work.

1. GitHub Actions Adds Workflow Lockfiles

Source: GitHub Changelog · Oct 14 · Public preview

On October 14, GitHub put workflow dependency lockfiles into public preview. A file at .github/workflows/actions.lock records the exact commit behind every action a workflow uses, including transitive dependencies. Once a workflow is onboarded, Actions runs the recorded commits even if a tag or branch later moves.

The file is generated by the gh actions-lock extension for the GitHub CLI and is not meant to be hand-edited. Administrators can also turn on a Require lockfile policy, also in preview, at enterprise, organization, or repository level.

The limits are real. The preview covers only GitHub Enterprise Cloud and Enterprise Cloud with data residency. Transitive coverage excludes dependencies of reusable-workflow calls; Dependabot can keep a lockfile current but will not onboard a workflow for you, and GitHub says the feature is subject to change.

GitHub previewed this in its March 26 Actions security roadmap, which followed the 2025 tj-actions/changed-files compromise that exposed how fragile mutable tags are.

What It Means: SHA pinning has been advised for years. A lockfile makes it something the platform checks at runtime, and it reaches nested actions that teams cannot see in their own YAML.

The CODEW Lens: The shift is from a habit reviewers must remember to a gate the runner enforces.

2. GitHub AI Scan for Pull Requests Reaches General Availability

Source: GitHub Changelog · Oct 15 · Generally available

AI Scan runs on pull requests to find vulnerabilities in languages and frameworks CodeQL does not cover, including PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP for Java and Blazor for C#. Findings appear next to CodeQL results, carry an “AI” marker, and can include an explanation and a suggested autofix.

It is not new news that the capability exists: the public preview began July 14, when it required a Copilot license. The GA change is licensing and scope. A Copilot license is no longer required, public repositories are covered, and private or internal organization repositories need GitHub Code Security or Advanced Security.

The caveats matter. Findings are advisory and do not block merges. AI Scan does not run on pull requests from forks or from Dependabot, and it consumes Code Security AI Credits, which show up in enterprise billing under “Advanced Security.” GitHub also listed agentic autofix for code scanning alerts as generally available on October 15; we have not reviewed that release in detail.

What It Means: Infrastructure repositories (deploy scripts, Dockerfiles, Terraform) finally get a native security read in review. Treat findings as a reviewer's prompt, not a verdict, and watch false-positive rates before making it a gate.

The CODEW Lens: Security coverage is following the pull request, and now it is metered.

3. Google Ends New Gemini Code Assist Sales and Points to Antigravity

Source: Google Cloud Docs · Oct 9 (not Oct 16) · End of sale

Google's release note dated October 9 says new Gemini Code Assist Standard and Enterprise subscriptions can no longer be purchased (release notes). Our assignment lead listed this as reported October 16; the official notice is a week older, so we date it October 9.

Existing customers are not cut off. Per Google's sunset page, current subscriptions run to the end of their contracts; extra licenses can be added until January 31, 2027; annual plans can auto-renew until January 31, 2027; and monthly plans until December 31, 2027. Google points agentic coding users to Antigravity, included in eligible Gemini Enterprise editions and available through the Gemini Enterprise Agent Platform.

Earlier, on June 18, Gemini CLI and the IDE extensions stopped serving individual, AI Pro and AI Ultra users, while Google said enterprise Code Assist access would continue. Google's notice, as published, gives no transition pricing, migration tooling, or feature-parity statement.

What It Means: Seat-holders need a contract calendar and an Antigravity evaluation, not a panic. The question is whether the Gemini Enterprise bundle fits their budget and workflows.

The CODEW Lens: A standalone coding assistant became a feature of an enterprise bundle.

4. Bun 1.4.3 Adds a Built-In TypeScript Checker

Source: Bun Blog · Oct 10 · Stable release

Bun v1.4.3, released October 10, adds bun check, a type checker built on a port of typescript-go. Bun reports it passes all 51,210 baseline tests in TypeScript 7.0.2's conformance suite and runs 3x to 6.4x faster than tsc 7.0.2 on its benchmark projects. Those figures are Bun's own.

Type checking can also gate other commands: bun run --check, bun test --check and bun build --check. The release also cuts idle server CPU by 67–89% in Bun's tests, adds, and ships security hardening, including TLS certificate-name matching (CVE-2026-48618) and stricter fetch() behavior.

Know the boundaries. bun check Only type checks: it does not emit JavaScript or declaration files, and there is no language server, so editors keep using TypeScript. Bun's own testing found one mismatch in 1,103 misconfigured-project runs, and 12 mismatches across 752 runs under alternate compiler options. Stricter fetch() validation could surface in code that relied on lenient behavior.

Disclosure: Bun is now part of Anthropic, the company behind Claude, which The CODEW uses in its editorial workflow.

What It Means: Teams can trial it in CI beside tsc and diff the output (Bun publishes a one-line comparison). Upgrade a runtime in a test lane first; the fetch and TLS changes are the likeliest surprises.

The CODEW Lens: The JavaScript toolchain keeps collapsing into one binary.

5. Figma Opens Code Layers and Specs in Beta

Source: Figma Blog, Release Notes · Oct 14–15 · Open beta

Figma announced code layers moving to open beta at its Config India event on October 14, and detailed them in an October 15 Figma blog post. Code layers put working code on the design canvas: teams can convert a design frame, import a GitHub repo, capture a website, or prompt from scratch. “Extract designs” converts a code layer's state back to editable design layers.

Specs is a Markdown-based document for written intent, visual exploration, and technical details, readable by teammates and by AI agents. It is open beta on paid plans. Code layers use AI credits, with creation and editing free on paid plans through November 4, and Figma's help center says rollout continues over the coming weeks. Code sources, which import real components from GitHub or npm, remain a closed beta.

Figma has not published adoption or reliability data, and these are betas. The open question is how code-backed prototypes line up with production repositories.

What It Means: The designer-to-engineer handoff is shifting from static specs to shared artifacts that both humans and agents can read. Engineers should check what a prototype actually commits them to.

The CODEW Lens: Design tools are moving toward the repository; repositories are moving toward the canvas.

Developer Impact

Coding. The coding surface keeps widening, from GitHub's agent workflow (GitHub's own October 15 essay calls the next interface “ambient intelligence,” an editorial framing rather than a product milestone; via GitHub Blog) to Figma code layers. Bun's --check flags make type safety a default gate for scripts and tests.

CI/CD and security. Lockfiles change how workflows resolve dependencies, so expect new review steps: who approves a lockfile change, and what happens when an action's tag legitimately moves. AI Scan adds a second reviewer for scripts and infrastructure code, with the false-positive tuning that implies.

Collaboration. Specs and code layers give designers and engineers a shared artifact. The risk is two sources of truth if prototype code drifts from the repository.

Enterprise Implications

Adoption: Lockfile enforcement is limited to GitHub Enterprise Cloud for now. Teams on other plans can keep pinning SHAs manually.
Security: AI Scan is advisory and skips forks and Dependabot PRs. Keep CodeQL and existing scanners in place.
Cost: AI Scan and Figma code layers both consume AI credits. Model usage before widening rollout, and note Figma's free period ends November 4 for paid plans.
Vendor dependence: Google's move ties agentic coding to Gemini Enterprise; GitHub's features deepen reliance on Advanced Security and Actions.
Migration: Code Assist customers should map contract end dates against the January 31, 2027 and December 31, 2027 renewal cutoffs, and ask Google about pricing and feature parity in writing.

The Developer Tools Stack at a Glance

Development	Status	Date	Availability	Layer
GitHub Actions lockfiles	Public preview	Oct 14	GitHub Enterprise Cloud only	CI/CD, supply chain
GitHub AI Scan for PRs	General availability	Oct 15	Public repos; private needs Code Security/GHAS	Code review, security
Gemini Code Assist sale ends	End of new sales	Oct 9	Existing contracts supported	AI coding, procurement
Bun 1.4.3	Stable release	Oct 10	Open source runtime/toolkit	Runtime, type checking
Figma code layers / Specs	Open beta	Oct 14–15	Paid plans (Specs); rollout ongoing	Design-to-dev handoff

THE CODEW TAKEAWAY

Developer tools are consolidating around the platform. Verification (lockfiles, AI Scan, type checking) is moving into the places code already lives, while standalone products fold into bundles, as Code Assist is doing inside Gemini Enterprise.

Metering is the new pricing layer. AI Scan and Figma code layers both draw on credits, so teams will need usage forecasts alongside seat counts.

Watch next: GitHub Universe (October 28–29), any expansion of lockfiles beyond Enterprise Cloud, Figma's November 4 credit promotion, and Google's Antigravity pricing.

Sources

THE CODEW STAT

5 stories · 1 GA · 1 stable release · 2 betas/previews · 1 end-of-sale

Counts are CODEW-calculated from each vendor's own announcement; none of the five was first announced on October 16.

THE CODEW · DEVELOPER TOOLS WATCH

Editorial Note

Developer Tools Watch tracks software development platforms, coding tools, AI-assisted programming, developer infrastructure, APIs and engineering workflows, focusing on what changes how teams build, test, deploy, secure and maintain software.

Educational content only, not investment or business advice. Coverage draws on GitHub, Google Cloud, Bun, and Figma announcements and documentation, plus TechCrunch and Tenki for context, as of October 16, 2026; products are in preview or beta where stated and may change. Bun is owned by Anthropic, which makes Claude, an AI assistant used in The CODEW's editorial workflow. Referenced products may be affiliate partners; see the Affiliate Disclosure.

ABOUT THE AUTHOR

Erwin Castro

Founder, Publisher & SEO Writer at The CODEW

Erwin Castro is the founder and publisher of The CODEW, an independently operated technology and business intelligence publication covering Tech M&A, AI, enterprise software, SaaS, cloud infrastructure, startups, business operations, and digital strategy.

About Author · LinkedIn · X

The CODEW