Who contributed to Agentic Coding on September 23, 2026?

16 developers shipped this update, including GitHub Actions, viyatb-oai, copyberry, Ian MacLeod, vaprdev, dc85, DavidAPierce, and dependabot, and 8 more.

What were the notable Agentic Coding updates?

Bound inbound exec-server requests across client transports (#47362), Enforce network policy throughout HTTP and WebSocket requests, and Feat/gemini 3.8 flash 3.5 flash lite.

Sep 23, 2026

$ the-wire · showcase

Codex caps inbound exec-server messages, Gemini CLI adds 3.8 Flash

By RepoJournal · Filed 07:02 UTC on September 23, 2026 · About Agentic Coding · Composed from the cited sources · methodology

16 people shipped this

github-actions[bot] @github-actions[bot] 2 cited

viyatb-oai @viyatb-oai 1 cited

copyberry @copyberry 1 cited

DavidAPierce @DavidAPierce 1 cited

GitHub Actions @actions-user

Ian MacLeod @imac-oai

vaprdev @vaprdev

dc85 @dc85

dependabot @dependabot

tofarr @tofarr

hieptl @hieptl

mkondratek @mkondratek

lifeizhou-ap @lifeizhou-ap

jamadeo @jamadeo

github-actions @github-actions

jbg @jbg

A security-hardening day for Codex agents that drive external transports, a model-tier refresh in Gemini CLI, and Cline fixing the run-killing output-token limit across desktop, CLI, and SDK.

Bound inbound exec-server requests across client transports (#47362) openai/codex

by viyatb-oai

Requests, unrecognized notifications, and malformed messages arriving at exec-server clients over stdio, WebSocket, relay, and Noise relay are now capped at an 8 KiB encoded message, while process output, exit, close, and HTTP request body notifications get up to 2 MiB. If you run agents behind any of those transports, oversized inbound traffic now fails fast instead of being buffered.

Enforce network policy throughout HTTP and WebSocket requests openai/codex

by copyberry

Destination restrictions are now checked at each redirect destination and during response body reads, and policy denials survive error handling so a revoked operation cannot be reported as success or quietly retried. Operators relying on network policy to fence off destinations should confirm their policy coverage now extends to redirects and long-lived WebSocket traffic.

Feat/gemini 3.8 flash 3.5 flash lite google-gemini/gemini-cli

by DavidAPierce

gemini-3.8-flash and gemini-3.5-flash-lite arrive as the new GA Flash and Flash Lite tiers, promoting gemini-3.5-flash and gemini-3.1-flash-lite to the base tiers behind the experiment-gated flag LATEST_FLASH_GA_LAUNCHED. If you pin model names in config, your old selections keep working but no longer sit at the top of the tier.

CLI v3.0.64 cline/cline

by github-actions[bot]

A model turn that burns its whole output allowance on reasoning before making a tool call no longer ends the run with an output-token-limit error; the turn is retried up to three times with a reminder to be concise and split work across tool calls, with a bigger default output budget of 30% of the advertised limit instead of a flat 32,000 tokens. The same fix shipped in the SDK and desktop builds.

Desktop v0.0.34 cline/cline

by github-actions[bot]

Composio connectors now load their full tool list rather than the first 20, so Google Calendar's 47 tools all appear and the Installed view stops reporting "20/20", and connecting to a Mac host as an SSH remote from a Mac no longer fails with "Remote target darwin/arm64 is unsupported in SSH". Elsewhere in the long tail: cline normalized @-mention search paths to forward slashes on Windows, goo...