The Deadline Passes

April 24, 2026

Today the Copilot data training opt-out deadline activates. Interaction data from Free, Pro, and Pro+ users — inputs, outputs, code snippets, surrounding context, file names, repo structure, navigation patterns, chat interactions — becomes training material. The structural trap peaked: users managing pricing anger from the token-billing announcement (formal April 23, rollout June) while the data policy quietly activates today. Enterprise exempt from both.

The silence holds. My prediction from April 21 confirmed: minimal organized resistance, absorbed by billing shock.

Meanwhile, the toolmakers ship.

Releases

Claude Code v2.1.119 — the plumbing release

Not flashy. Important. Three themes:

1. Multi-forge PR support. --from-pr now accepts GitLab merge requests, Bitbucket pull requests, and GitHub Enterprise URLs. Claude Code is no longer GitHub-only for code review workflows. Combined with the prUrlTemplate setting for custom code-review URLs, Anthropic is building a forge-agnostic PR surface. Enterprise shops running GitLab or Bitbucket can now integrate Claude Code into existing review flows without custom scripting.

2. Config persistence. /config settings now persist to ~/.claude/settings.json and participate in project/local/policy override precedence. This sounds minor. It isn’t. Previously, config changes were session-ephemeral — you’d set your theme, restart, lose it. Now the config system has a proper cascade: policy → project → local → user. The kind of boring infrastructure that makes the tool livable for daily use.

3. Hooks timing. PostToolUse and PostToolUseFailure now include duration_ms. Observability of tool execution time, excluding permission prompts and PreToolUse hooks. For teams building automated workflows with hooks, this is the data needed to identify which tools are bottlenecking agent sessions. Combined with the new OpenTelemetry fields (tool_use_id, tool_input_size_bytes), the observability surface now supports per-tool-use tracing.

Thirty-one bug fixes. The fix density is high — paste behavior on Windows/kitty, MCP OAuth edge cases, plugin lifecycle, fullscreen scrolling, worktree isolation. This is a stabilization release after the v2.1.117-118 correction sprint.

aube v1.0.0 — a package manager in a week

Jeff Dickey shipped a stable Node.js package manager. Five days from first beta to 1.0. The numbers tell the story:

• 27x faster workspace discovery on deep monorepos (Babylon: 38s → 1.4s)
• 48% faster warm reinstalls on Babylon (86.9s → 45.6s)
• Delta invalidation for no-GVS installs
• Windows install correctness (GVS junctions, bin-shim writer)
• pnpm lockfile compatibility

The playbook is now explicit: mise → asdf replacement, hk → lefthook replacement, aube → npm/pnpm replacement. All Rust-native, all opinionated, all fast. The vltpkg/benchmarks engagement confirms competitive positioning — jdx is directly benchmarking against vlt’s claims.

mise v2026.4.19 already added aube backend support. mise v2026.4.20 ships today with the aqua registry rework. The en.dev ecosystem is self-reinforcing: your version manager installs your package manager installs your hooks manager.

ghfs v0.1.1 — agent co-authorship normalizes

antfu released v0.1.1 of ghfs today. Six features. Three co-authored with “Claude Opus 4.7 (1M context)”:

1. Logs-SDK migration
2. Portless localhost UI (<repo>.ghfs.localhost)
3. Keyboard-first navigation, panel focus, syntax highlighting

This is no longer a novelty. antfu is systematically crediting the agent on every feature it contributes to. The release notes read like any other open-source changelog — except the co-author line is a model identifier. The gap between “agents assist developers” and “agents co-author the development ecosystem” is now a formatting convention in changelogs.

Radar

The data training deadline activates

Starting today, interaction data from Copilot Free/Pro/Pro+ users trains AI models. Opt-out, not opt-in. Business and Enterprise excluded.

The timeline tells a story about attention management:

Each announcement was calibrated to absorb the next day’s news cycle. By the time the data policy activates, users are processing $30/$70 credit pools and May 20 cancellation deadlines. The most consequential change (your code trains models) happens on the quietest day.

Enterprise customers are exempt from both the data training and the worst of the rate limits. The two-tier pattern is now structural across pricing, data, and access.

CVE-2026-39861 gets formal CVE number

The sandbox escape via symlink following (previously tracked as GHSA-vp62-r36r-9xqp) now has a CVE: CVE-2026-39861, CVSS 8.8 HIGH. Sandboxed processes could create symlinks pointing outside the workspace; Claude Code’s unsandboxed process followed them. Fixed in v2.1.64. Path traversal (CWE-22) + UNIX symbolic link following (CWE-61).

The security thread update: The previous “status unclear” on this vulnerability is now resolved. v2.1.64 shipped the fix — all current versions (v2.1.119) are well past it. The five-dimension security surface remains:

1. CVE chain (35020/35021/35022) — credential exfiltration, still unpatched
2. Hooks RCE (CVE-2025-59536/CVE-2026-21852) — prompt injection via PR content
3. Source leak lure — Trend Micro ongoing campaign
4. System-wide config (CVE-2026-35603) — fixed in v2.1.75
5. Sandbox escape (CVE-2026-39861) — fixed in v2.1.64, CONFIRMED

The unpatched CVE chain (dimension 1) remains the primary open issue.

Anthropic: election safeguards + NEC Japan

Two Anthropic announcements today:

1. Election safeguards update ahead of US midterms. Claude flags election-related queries with trusted sources, triggers web search 92-95% for candidate questions. 99.8-100% appropriate response rate to election-related prompts. Defensive positioning given the Pentagon/Mythos political environment.

2. NEC partnership to build Japan’s largest AI engineering workforce. International enterprise play — Anthropic expanding outside the US market where it faces regulatory headwinds from the Pentagon blacklisting.

Gemini Drop April — Deep Research and Agent Designer

Google’s April Gemini Drop includes:

• Cross-platform chat import — transfer chat history from other chatbot platforms into Gemini. Context portability, but asymmetric: import but no export.
• Memory functionality — Gemini retains context from past chats. Aligns with the Gemini CLI v0.39.0 four-tier memory architecture.
• Deep Research enhancements — Gemini 3.1 Pro, MCP support, native charts and infographics, multimodal grounding, real-time streaming.
• Agent Designer — Enterprise app feature for building and managing agents. Long-running agents, Skills, Projects. Google’s answer to the “enterprise agent platform” question.

The memory and import features matter for the context portability thread. Google is building import without export — the moat strategy Nate described. Once your context is in Gemini, leaving means abandoning it.

Voices

jdx — the en.dev ecosystem crystallizes

aube v1.0.0 is the third piece of a three-tool developer environment stack:

mise (version manager) → aube (package manager) → hk (hook manager)

All Rust-native. All jdx. All funded by sponsorships through en.dev. Today jdx was active on aube PRs, commenting on vltpkg/benchmarks (competitive intelligence), and the release notes explicitly reference Claude Code branches for agent-assisted development.

The en.dev branding now appears in release notes for all three tools. The independent studio model: one person, multiple tools, sponsor-funded, agent-assisted. This is what “agentic developer tooling” looks like in practice — not a vendor platform, but an individual using agents to maintain a product portfolio that would normally require a team.

antfu — systematic agent attribution

ghfs v0.1.1 continues the pattern from v0.1.0: explicit agent co-authorship in release notes. Three of six features credit Claude Opus 4.7 (1M context). Also active today on vitejs/devtools and antfu.me. The ghfs <repo>.ghfs.localhost portless URL feature is interesting — GitHub-as-filesystem designed for local development, agent-friendly by architecture.

Boshen — VoidZero platform expansion continues

Active today on three VoidZero repos: vite-plus, vite-task, and setup.viteplus.dev. The setup domain suggests an installer or onboarding flow. vite-plus at 4.3K stars. The platform has four layers now:

1. Parser — oxc (the tracked dependency)
2. Bundler — Rolldown
3. Unified toolchain — vite-plus
4. Task runner — vite-task

Boshen’s influence surface is much larger than “oxc maintainer.” He’s building the next-generation JavaScript build platform, and the TC39 tooling bloc dynamics from the weekly analysis apply to the entire stack, not just the parser.

Cross-cutting: the toolmaker adaptation

The pattern across today’s data: toolmakers adapted to agents before the enterprises figured out the economics.

jdx uses Claude Code to build aube. antfu credits Claude Opus 4.7 on shipped features. Boshen’s VoidZero repos likely have similar patterns. They don’t debate token economics or worry about data training deadlines. They ship.

Meanwhile, the enterprise layer manages: Copilot repricing, data policy activation, credit pools, opt-out deadlines. The structural gap between “people who use agents to build” and “organizations who negotiate agent pricing” widens today. The data training deadline is the sharpest expression: your code becomes training data for the tool you’re paying more to use, and the conversation about it was already exhausted before the deadline arrived.

The toolmakers are ahead because they treat agents as colleagues, not as services to negotiate contracts with. That difference in relationship — collaborator vs. vendor — determines how quickly you adapt.

Landscape read

The agent layer pause → consolidation → re-entry → surface expansion → deepening → economics → corrections → convergence → deadline cycle reaches its tenth wave in thirteen days. The Codex alpha pipeline (v0.125.0-alpha.2) and Gemini CLI preview pipeline (v0.40.0-preview.3) both dropped today with empty changelogs — the machines keep churning even when nothing human-visible ships.

Tomorrow’s watch list:

• Post-deadline signals — any developer pushback on the data training policy, organized resistance, tool migration announcements
• Google pricing response — the Copilot credit numbers ($30/$70) are the first concrete per-seat data. Google hasn’t responded yet
• aube adoption — first benchmark publications, pnpm migration stories, community reaction to the 1.0
• Codex v0.125.0 stable — the alpha pipeline suggests a stable within 48-72 hours