What Happened
GitHub CLI v2.103.0 added an opt-in preview of expiring OAuth access tokens that the CLI refreshes automatically. Teams can enable it during login or for future sign-ins, and inspect expiry with the CLI. The feature is available on github.com, ghe.com and GitHub Enterprise Server 3.23 or newer; unsupported servers retain nonexpiring tokens. [3]
Dependabot now supports version updates for npm 12, pnpm 11 and 12, and Bun 1.4 on github.com, with GitHub Enterprise Server support planned for 3.24. Its dependency graph does not yet recognize a two-document lockfile format used by some pnpm 12 projects. In those projects, version updates may work while alerts and security updates are missing or existing alerts close. [5]
A Sourcegraph security note describes using Deep Search to locate PHP runtimes affected by two critical remote-code-execution vulnerabilities, then Agentic Batch Changes to coordinate upgrades. That is a useful example of repository-wide discovery followed by assisted remediation, not evidence that an agent can verify a patch on its own. [4] The available VS Code 1.143 and 1.144 notes contain no release details; they do not support claims about new editor features. [1][2]
Why It Matters to Businesses
These changes affect two controls that developer tools increasingly sit beside: credential lifetime and software-supply-chain visibility. Short-lived CLI tokens reduce the useful life of a leaked access token, but scripts that save the output of gh auth token can later fail when it expires. A Dependabot version-update PR is also not proof that dependency alerts cover the same project. [3][5]
Kimbodo Engineering Perspective
We would treat coding assistants as a way to accelerate inventory, edits and review preparation—not as the authority on whether an environment is secure. The important distinction is between making a change and proving coverage: find every affected runtime or lockfile, make reviewable changes, then check builds, security findings and deployment inventories independently. [4][5]
How We Would Implement It
- Inventory where developers, CI jobs and integrations use GitHub CLI credentials. Pilot expiring credentials with supported GitHub instances; have automation request tokens when needed rather than store CLI token output. For Git over HTTPS, use GitHub’s recommended credential setup with Git 2.46 or newer. [3]
- Identify projects using the affected pnpm 12 lockfile format. Keep Dependabot version updates enabled, but use an additional dependency inventory or scanner until graph detection—and the resulting alert coverage—is confirmed. [5]
- For urgent runtime upgrades, search across repositories and deployment definitions, generate small batches of changes, and require tests, code-owner review and post-deployment version checks. [4]
Risks, Costs and Security
Expiring credentials can break unattended jobs that cache tokens; rotating refresh tokens still require careful protection. Unsupported GitHub servers do not gain the new expiry behavior. Pnpm 12’s lockfile gap creates a more subtle risk: a healthy version-update workflow can coexist with missing security alerts. Broad agent-assisted patches also consume review and test capacity, so rollout scope should match the team’s ability to validate each affected service. [3][4][5]
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
