DevRel This Week, 2 November: Agents Start 40% of Pull Requests

DevRel this week, 2 November 2026: GitHub says agents (software that does a task on its own) now start more than 40% of pull requests, the proposed code changes people review before they go in. Ruby Central rejected 120 of the 134 AI scanner findings it reviewed, and curl now sends low and medium security reports to its public issue tracker. OpenAI DevDay Exchange reaches London tomorrow, and talk submissions for FOSDEM in Brussels are open.

Where can developers in Europe go this month?

OpenAI DevDay Exchange is in London tomorrow, Tuesday 3 November, from 2pm. Berlin and Paris went first. You can still apply, but the venue and programme only go to people who get approved. São Paulo is on 6 November and Mexico City on 10 November (OpenAI).

FOSDEM 2027 is on 30 and 31 January, and the list of accepted developer rooms (themed tracks run by volunteers) came out on 21 October (FOSDEM). The Package Management room runs on the Sunday afternoon at the Université libre de Bruxelles and takes talks until 1 December. Talks that mainly promote a product won’t get in, and popular subjects like using AI to help with security get lower priority (Stewardship Lab).

Why are maintainers pushing back on security reports?

Michał Górny, who works on the Gentoo Linux distribution, wrote on 27 October that “vulnerabilities are reported at unprecedented rates”, and that a lot of it is AI-generated junk someone still has to sort through. Once a bug is logged as a vulnerability, security scanners flag it whether it affects you or not. Górny says Gentoo has shipped updates for bugs that never affected Gentoo, only to stop those scanners complaining (Górny).

Ruby Central’s AI scanner has been through about 317 of the 619 gems (Ruby packages) on its list. People reviewed 134 of the findings and rejected 120, because an attacker couldn’t reach the code, the code was meant to work that way, or someone had already reported it. One real find: rubyntlm was checking every login against an empty password, so anyone with a valid username could log in, and 0.6.6 fixes it (Ruby Central, 28 October).

curl now sends low and medium issues to its public issue tracker, and only high and critical ones stay private until a fix ships. The same policy says “Do not lazily paste massive, AI-generated explanations” (curl). Josh Bressers backed it on 27 October and told maintainers (the volunteers who look after a project) “It’s OK to push back on demands from strangers” (Open Source Security).

What does Octoverse 2026 say about agents?

GitHub published Octoverse 2026, its yearly report, on 28 October. Agents started more than 40% of pull requests in September, up from 17% in March, which is 110 million in one month.

Over the 12 months to 30 September there were 17.9 billion pushes (uploads of code), up from 6.7 billion the year before, and 1.3 billion merged pull requests, up from 538 million. Public open source contributions went from 1.12 billion to 2.5 billion. GitHub counts more than 225 million developers, with 6.47 million in the UK, 6.30 million in Germany and 4.75 million in France (GitHub).

What did GitHub Universe change for developers?

Universe ran on 28 and 29 October in San Francisco. Copilot Fusion is now on all Copilot plans. You pick it in the model menu and it chooses a model for you. You pay each model’s normal rate, and paid plans get 30% off “for a limited time”, with no end date given (GitHub changelog).

Companies buying through a sales team can now get Copilot included in their GitHub Enterprise licence. There’s no monthly allowance, so every request comes out of the company’s budget from the first one. If the budget runs out, code completion keeps working, but chat, code review and cloud agents stop (GitHub changelog).

Japan’s Cloud Watch reported the target Microsoft’s Jay Parikh gave in the keynote (the main talk) for GitHub’s new Git setup: 5,000 agents on one repository (one project’s code) and 7,200 pushes a second, about 180 times what it does now (Cloud Watch, 29 October). GitHub’s own engineering post says “thousands of agents” and up to 35 times the write speed in internal tests (GitHub).

Also in DevRel this week, 2 November: Ollama, Apiary and Hacktoberfest

Ollama Cloud dropped its free plan and starter credits between 26 and 27 October. The $0 plan now charges per token (the chunks of text a model reads and writes) for every cloud model, and running models on your own machine is still included (Ollama, AgentDeals).

Oracle shut down Apiary, its tool for designing APIs (the way programs talk to each other), on 31 October, a year after announcing it. What’s left gets permanently deleted, and anyone on the API Blueprint format has to convert to OpenAPI, a more common one (Oracle).

The Rust Project said on 26 October that “only a fraction” of its contributors are funded. You can give to the Rust Foundation Maintainers Fund, sponsor the RustNL Maintainers Team, pay for a named project goal or sponsor a person directly (Rust blog).

Hacktoberfest ended on Saturday with no final numbers on the site yet. Stickers and prizes get posted 8 to 12 weeks after the end, so late December to late January (hacktoberfest.com). Cloudflare’s Cold Start page still names no winner two weeks on (Cloudflare), and I can’t find a recording or write-up of the “Still open” session on AI and open source from Universe.

The hiring note in DevRel this week, 2 November, is empty. I found open roles but no DevRel team cut or senior hire I could put a source on.

FAQ

What share of GitHub pull requests do agents start?

GitHub’s Octoverse 2026, published on 28 October, says agents started more than 40% of pull requests in September 2026, up from 17% in March. That comes to 110 million pull requests in one month. Merged pull requests across the 12 months to 30 September reached 1.3 billion, up from 538 million the year before.

How does curl handle low and medium security reports now?

curl asks reporters to file low and medium severity issues in its public issue tracker, and it stops handling them privately on HackerOne, the bug report site it uses. High and critical reports stay private until a fix ships in a release. curl’s policy also tells reporters not to paste long AI-generated explanations.

When is OpenAI DevDay Exchange in London and how do you get in?

London is on Tuesday 3 November 2026 from 2pm local time. You apply on the OpenAI events site, and the venue and programme only go to people who are approved. The page says applications are being reviewed but you can still apply. São Paulo follows on 6 November and Mexico City on 10 November.

Agents start the pull requests now, and people still have to read them.