Devolutions shipped UniGetUI v2026.3.4 today, rolling up 66 commits from 13 contributors into a patch that reaches into AI coding tools for the first time. The headline additions are an "Agent Skills" extension for Claude Code, Codex, Copilot, and Cursor, plus a new Xcode manager for macOS 13 and later, both off by default. The release also hardens security by checking downloaded installers against published hashes and displaying their signer, while finally fixing a long-standing leak that let the operation history file balloon into gigabytes of RAM. UniGetUI, the open-source package-manager front end originally created by Martí Climent, is available now via GitHub, winget, or the Microsoft Store.
Visual Studio Code 1.146.0 shipped today as the latest stable release, and its headline move is deprecating the legacy Local agent harness, which will be fully removed by February 2027. Microsoft is standardizing on the Copilot harness, the default for new sessions since 1.143, since it runs on the Agent Host and enforces managed sandbox policies the old runtime can't. Beyond the sunset, the update adds session triage tools like Inbox mode and OS-level chat windows, plus more granular permission prompts and environment-variable masking for sandboxed agents. As always under the now-weekly cadence, it lands as a consolidation step rather than a single marquee feature, cementing VS Code's shift from editor into an agent orchestration platform.
Microsoft has shipped VS Code 1.145.3, a security-only patch covering 17 vulnerabilities, all of which were fixed on November 10, 2026. The biggest theme is the AI-agent attack surface, with six of the fixes addressing remote code execution holes in MCP integrations, the integrated browser and agent command execution. The most alarming is a JS debugger auto-attach flaw that lets a malicious folder run code with zero user interaction. Microsoft says the fix is already out, so updating to 1.145.3 or later is the obvious move.
Microsoft shipped Visual Studio Code 1.145.1 today, a patch that adds just two targeted corrections to the existing 1.145 feature set. Both fixes target telemetry inside the Copilot Agent Host, correcting bugs that could misattribute model-call pairing IDs and lose account identity after an account switch. The update also patches two user-facing issues: read-only chats when an agent is disabled by policy, and a governance gap where a failed MCP refresh could drop registry-only restrictions. Together, the release marks another step in VS Code's shift from a text editor into a fully managed AI-agent platform.
VS Code 1.145 reached the Stable channel today, pushing the editor further into "agent host" territory with sessions that survive across windows, machines, and folder closures. The biggest additions are remote agents that feel local, cron-powered scheduling for recurring automations, verbosity controls to mute chat noise, and the ability to mix different AI harnesses in a single session. On the enterprise side, organizations now get authoritative MCP allowlisting, blocked uninstall for managed plugins, and clearer sandboxing guidance. Microsoft also trimmed several tools from the Local harness, shipped two bug fixes, and included a throwaway Blobby jump game.
UniGetUI v2026.3.3 lets organizations serve their own software installers directly through the catalog, marking a clear pivot toward enterprise IT buyers. The free, MIT-licensed Windows tool, now owned by Devolutions since March 2026, keeps its single-window approach to managing WinGet, Chocolatey, Scoop, and other package managers while adding extensions, customizable columns, and safety prompts. Backing from Devolutions has accelerated the release line to nearly weekly, with roughly 34 versions shipping in 2026 alone. The update also delivers a long list of bug fixes, including a Linux shutdown bug that previously left the app blocking logouts.
Microsoft and GitHub released Visual Studio Code 1.144 as a Stable build today, reframing the editor as a hub for coordinating teams of AI agents across machines and clouds. The architectural centerpiece is the new open Agent Host Protocol (AHP) 1.0, which keeps sessions alive through a background process so they carry over between VS Code, the Copilot app, GitHub.com, and the mobile client. Highlights include Copilot Fusion, image generation via GPT Image 2.5 Flare, experimental Computer Use and Working set features, GA assisted permissions, and a long-awaited native Markdown editor, much of it funneled toward paid Copilot subscriptions. The release also pairs a long-delayed UI modernization with a Compact layout option, while Microsoft reassures users that core editing features remain front and center.
Visual Studio Code 1.143 makes the Copilot harness the default for new agent sessions, folding Microsoft's AI-agent strategy into the stable build. The release also adds side-by-side model comparison, on-device coding via MAI Code 1.1 Flash, and a tool to reclaim disk space from abandoned worktrees. A big chunk of the update targets IT admins, with managed model defaults, automatic plugin installs, and rules that can force Copilot while disabling Local, Claude, and Codex. Performance upgrades cut the time to open huge chats from up to 35 seconds down to single-digit seconds.
PeaZip 11.4.0, released today by developer Giorgio Tani, is primarily a security-focused update that adds stricter input validation and enables range checking. Its biggest move drops the use of full console subprocesses for archiving and extraction, shutting down a class of command-injection flaws. The patch also improves file-browser auto-refresh, adds Windows .lnk navigation via Ctrl+P, and bumps backends to 7z/p7zip 26.04 and Pea 1.34. This follows 11.3.0's fixes for several exploitable RCE bugs, including a cross-platform out-of-bounds write (CVE-2026-102514).
Devolutions released UniGetUI 2026.3.2 on October 15, and its headline feature is a new experimental Software Catalog that lets administrators build a curated list of approved software users can install with one click. The update also adds drag-and-drop sidebar reordering, a macOS Liquid Glass look, and small usability wins like scroll-position retention and better screen-reader announcements. Most practically, it fixes a bug that let pip updates corrupt Python environments by serializing those operations, alongside fixes for PowerShell module uninstalls, Chocolatey admin elevation, and several crashes. Built in about a week by six contributors, the release is the first major product milestone under Devolutions' 2026 acquisition and sits comfortably past the CVE-2026-10696 package-correlation fix from 2026.2.1.
Visual Studio Code 1.142 quietly makes the Copilot agent harness the default for new sessions and auto-migrates enterprise workspaces that use sandboxing or permissions. The update introduces preview Canvases for co-editing artifacts with agents and lets you move a chat between folders and Git worktrees without rebuilding its context. Smaller upgrades include a substantially expanded Markdown editor, harness names in chat titles, background shell controls, and a redesigned model picker. Taken together, the release cements Microsoft's strategy of steering developers toward its own SDK runtime while leaving third-party harnesses like Claude and Codex as opt-in alternatives.
Microsoft shipped another Visual Studio Code update today as one-PR patch by engineer Alex Ross that closed 14 user-filed issues in a single week. The culprit was a security change from the earlier 1.141.1 release, which made extension webviews go blank for anyone whose remote connection used an authority with uppercase letters. The fix restores case-insensitive authority matching while keeping resource containment and OS checks intact. Small by the numbers, but those 14 linked issues reveal just how many WSL and SSH users got caught out.
Visual Studio Code 1.141 shipped on October 7, 2026, transforming the editor into an AI agent control center with a unified Copilot harness, a session grid, cross-app handoffs, and cross-platform sandboxing. Microsoft followed up just six days later with Update 1.141.1, a security patch that closes two path-traversal vulnerabilities, including a Critical 9.6 remote code execution flaw (CVE-2026-102238). That RCE requires user interaction to exploit and shows no signs of wild use, but it affects every version from 1.0.0 through 1.141.0. Microsoft recommends upgrading to 1.141.1 immediately and reviewing your sandbox settings before handing agents broad access to files and the network.
Devolutions released UniGetUI v2026.3.1 today, a patch shipped just three weeks after its last major feature drop. The headline additions are a terminal UI (uniget tui) that shares your desktop profile, a cross-platform uniget command-line launcher, and a Devolutions Agent policy editor that enforces rules before package requests go out. Beyond the features, the release cleans up a broad swath of regressions, including WinGet post-upgrade fixes and crashes from Windows-only commands running on macOS and Linux. It's a small, responsive update that leans toward reach and reliability rather than another wave of big new capabilities.
Visual Studio Code 1.141 makes cross-platform sandboxing generally available in the Copilot agent host across Windows, macOS, and Linux to limit what autonomous agents can reach on your machine. The update also lets you continue agent sessions live between VS Code, the Copilot app, and the Codex CLI without reloading, while a new grid layout helps you juggle multiple conversations at once. Microsoft is tightening enterprise control with enforceable sandboxing, session attribution telemetry, and a smoother migration to unified managed settings, and finally retired the single-value github-enterprise.uri setting in favor of a list-based alternative. It's a consolidating release that doubles down on VS Code's pivot from a code editor to a control center for code-writing agents.
Microsoft released Visual Studio Code 1.140.0 today, folding the Copilot agent harness into a first-class role that runs on the persistent Agent Host for portable, window-independent sessions. The release's most ambitious feature is HydraFusion, a research preview that orchestrates multiple AI models to draft, critique, and revise code while cutting estimated costs compared to a Claude Opus 5 baseline.
PeaZip 11.3.0 shipped today as a security-focused release from developer Giorgio Tani that the project explicitly recommends you upgrade to. The biggest change makes a master password mandatory for the built-in Password Manager, closing a hole where stored credentials went unprotected. It also brings improved ZPAQ handling for encrypted archives, a new "Open With" picker behind Shift+F12, two new Blue-themed looks, and updated 7z/p7zip and PEA backends. You can grab it now from GitHub and SourceForge, or via Flathub on Linux — just download from the official repos and verify the SHA-256 hashes.
VS Code 1.139.1 shipped on September 25, 2026 as a patch release, so the remote agent sessions and faster session lists you may have seen advertised had already arrived in 1.139. Only one of its four commits changes product behavior, fixing how managed settings behave when a server refresh fails. Before the patch, a failed refresh silently dropped enterprise policy controls for as long as the gap lasted, leaving restrictions quietly lifted every hour. The remaining three commits are release housekeeping: a version bump, a merge, and a skip for a flaky Linux test whose real fix sits on main.
Visual Studio Code 1.139 bringing large agent session lists that load up to 12x faster by using a central catalog instead of scanning every database. The release extends Dev Container support to remote SSH, Tunnel, and WSL hosts so agents can build and test projects with the correct toolchain without duplication. Alongside those agent upgrades, VS Code adds a compact session view, in-place renaming, word wrap indicators, and smarter bracket auto-closing to smooth out everyday editing. The update is available now for Windows, macOS, and Linux, with an Insiders build already at v1.140 for early testers.
Visual Studio Code 1.138 launched today, pushing Microsoft's Agent Host architecture into everyday use. The update lets agent sessions run inside local Dev Containers, jump between the ChatGPT app and VS Code, and switch between Copilot and ChatGPT subscriptions mid-conversation. Microsoft also added session hygiene features like auto-archiving merged sessions, a completion confetti animation, and badges that flag sessions needing attention. Not everything lands immediately, since much of it sits behind Preview toggles and settings, so it's worth knowing before you expect the full stack on launch.
