Dependabot Alerts Pause on Inactive Repos From December 8, Copilot CLI Sets Up MSBuild, and Qwen Code Ships a Preview

At a glance

• GitHub will turn off Dependabot alerts on most repositories with no activity in a year.
• A push can bring those alerts back, and some policy covered repositories stay on.
• C++ developers on MSBuild projects get language server navigation in Copilot CLI without an extra setup step.
• Qwen Code has a newer stable build and a preview, and the preview is for a test machine only.

GitHub posted the Dependabot note at about 9:20 AM ET on Tuesday and the C++ language server note at about 12:04 PM ET the same day. Qwen Code v0.27.2 landed that afternoon, the v1.0 Preview followed that night, and Codex latest moved to v0.167.2 on Wednesday evening. Both Cursor changelogs, Claude Code, and Gemini CLI are unchanged since yesterday.

Treat today as a calendar and cleanup day: list your quiet repositories before Dependabot alerts pause on 8 December, open an MSBuild C++ project in Copilot CLI and check that navigation works, and stay on Qwen Code v0.27.2, with the preview on a test machine only.

Top Stories

1. Dependabot alerts will pause on inactive repositories from 8 December

GitHub said on 10 November that starting 8 December 2026 it will turn off Dependabot alerts on most repositories with no activity in the past year. Existing alerts are archived, not deleted, and you can restore them at any time. GitHub counts any of these as activity: pushing to any branch or tag, creating the repository, or turning on Dependabot alerts.

Any push to the repository automatically turns Dependabot alerts back on. You can also turn them on in the repository's settings. Either way, GitHub restores the archived alerts, and the one year clock starts over.

GitHub will not turn off alerts on repositories with an enforced security configuration that enables Dependabot alerts. It also skips repositories in enterprises whose Dependabot alerts policy does not allow repository administrators to enable or disable alerts. The change applies to all plans on github.com and to GitHub Enterprise Cloud with data residency. For data residency customers, archived alerts are stored in the same region as the rest of the enterprise's data. It does not apply to GitHub Enterprise Server.

Practical dev impact: List repositories you still ship from but rarely push to. Our read: a library people still install can still look inactive. Decide whether each one needs an enforced security configuration, a push, or a settings change before 8 December, so alerts do not go quiet where you still depend on them.

2. Copilot CLI's C++ language server now configures MSBuild builds automatically

GitHub posted on 10 November that the Microsoft C++ Language Server for GitHub Copilot CLI now bundles its MSBuild compile commands extractor and runs it automatically. Before this change, go to definition, find references, and other language server features on an MSBuild C++ project meant either supplying your own compile_commands.json or waiting while Copilot found and ran a configuration skill to generate one.

Now the extractor ships with the language server, and Copilot invokes it when the language server starts on project open. GitHub says compilation database generation for MSBuild projects is now deterministic, which reduces the tokens spent on setup. Other build systems keep the older path. CMake projects use the earlier generate compile commands skill when you ask Copilot CLI to "load project", and custom builds still need your own compile_commands.json or a custom extractor skill. An active Copilot subscription is required. See the changelog for the full note.

Practical dev impact: If you work in a Visual Studio style MSBuild solution, open it in Copilot CLI and check that navigation works without a setup prompt.

3. Qwen Code v0.27.2 is the stable line, and v1.0 Preview is test machine only

Since our 9 November note on Qwen Code v0.27.0, the stable channel has moved to v0.27.2, posted on GitHub at about 2:22 PM ET on Tuesday, and npm latest for @qwen-code/qwen-code points to it. The new highlights are pending approvals in the live panel, with a terminal bell or desktop notification when the terminal is unfocused, replay of the last 20 answered /btw side questions, and Web Shell stats for turns, output speed, total tokens, and cache hit rate.

Qwen Code v1.0 Preview followed at about 10:55 PM ET on Tuesday as a GitHub prerelease. The notes say it brings together the agent capabilities of Qoder and Qwen Code, supports Qwen and Qoder accounts, multiple model providers, and custom compatible endpoints, and supports session resumption and non interactive runs. It ships as native packages for macOS, Linux, and Windows that do not need a separate Node.js install, and the team warns that interfaces, configuration options, and behaviors may change during Preview. It was not on the npm registry as of this morning.

Practical dev impact: Stay on v0.27.2 for daily work, especially if you want the approval notifications. Try the v1.0 Preview package on a test machine only, and do not script against its configuration until the preview label comes off.

Practical Impact Analysis

Our read: the Dependabot change is the only item with a date attached, so it deserves ten minutes this week even though nothing happens until 8 December. Teams with many old repositories are most exposed, because a library with users can still look inactive.

The C++ change is narrow but useful, since it removes a setup step that cost tokens before Copilot could read the project at all. Qwen Code v1.0 Preview belongs on a spare machine for now. On the rest of the board, Copilot CLI is still v1.0.109 on npm latest, while the prerelease tag now points to v1.0.110-3. The v1.0.110-2 notes say /compact now respects the session AI credit limit and that the CLI warns when the allow all flags are ignored because bypass permissions mode is disabled. Codex latest moved to v0.167.2, whose notes list one provider specific change. Both Cursor changelogs, Claude Code, and Gemini CLI are unchanged. If you have one hour, list your quiet repositories and check one MSBuild project.

Tutorial

1. Open a test shell. The active commands below only print registry tags, versions, and repository lists.
2. Set the owner name in step 2 to your user or organization before you run it.
3. Run step 3 from the root of a C++ project to see whether it is MSBuild based.
4. Uncomment an install line in step 4 only if you want the pinned builds.

# We have not run this script end to end on every platform. It prints and checks, and changes no files.
# Run it in a test shell. Nothing is written to your shell profile.

# 1. Snapshot at 5:54 AM ET Thu 12 Nov 2026, npm registry channel:
#    @github/copilot latest v1.0.109, prerelease v1.0.110-3
#    @qwen-code/qwen-code latest v0.27.2
npm view @github/copilot dist-tags.latest dist-tags.prerelease
npm view @qwen-code/qwen-code dist-tags.latest
if command -v copilot >/dev/null; then copilot --version; else echo "no copilot CLI on PATH"; fi

# 2. Last push dates vs a one year cutoff from today. GitHub has not stated the exact evaluation date.
#    Needs the GitHub CLI. Set the owner name, then rerun.
OWNER="your-user-or-org"
python3 - "$OWNER" <<'PY'
from calendar import isleap; from datetime import date; from shutil import which; from subprocess import CalledProcessError, check_output; import json, sys
t = date.today(); y = t.year - 1
d = 28 if t.month == 2 and t.day == 29 and not isleap(y) else t.day
print("One year before today:", date(y, t.month, d).isoformat())
print("Compare each repository's last push date to this cutoff yourself.")
owner = sys.argv[1]
if owner == "your-user-or-org" or which("gh") is None:
    print("Set the owner name, or put the GitHub CLI on PATH, then rerun.")
    raise SystemExit(0)
try:
    raw = check_output(["gh", "repo", "list", owner, "--limit", "100", "--json", "name,pushedAt"], text=True)
except CalledProcessError:
    print("gh repo list failed"); raise SystemExit(1)
for row in json.loads(raw):
    print(row.get("name", ""), row.get("pushedAt", ""))
PY
# 3. MSBuild project files, max depth 3.
find . -maxdepth 3 \( -name "*.sln" -o -name "*.vcxproj" \) -print
if [ -f compile_commands.json ]; then echo "existing compile_commands.json found"; fi
# 4. Optional pinned installs at 5:54 AM ET Thu 12 Nov 2026, npm registry channel:
# npm install -g @github/copilot@1.0.109
# npm install -g @qwen-code/qwen-code@0.27.2
# Test machine only: npm install -g @github/copilot@1.0.110-3
# Qwen v1.0 Preview is a GitHub download, test machine only:
# https://github.com/QwenLM/qwen-code/releases/tag/v1.0.0-preview
echo "Done. Nothing was installed or changed on disk."

If npm view shows newer tags, refresh before you pin.

Sources:

• Dependabot alerts will pause on inactive repositories
• C++ language server MSBuild update, GitHub Changelog
• Qwen Code v0.27.2 release
• Qwen Code v1.0.0 Preview release
• Copilot CLI v1.0.110-2 release
• Copilot CLI v1.0.110-3 release
• Codex v0.167.2 release
• Cursor changelog
• Cursor CLI changelog
• GitHub Changelog

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.