This Week in Dev Tools: GitHub Copilot App Adds Free AI & Lovable Projects Now Have a (Week of Jul 20, 2026)

Welcome to the ToolPick weekly digest for the week of Jul 20, 2026. This roundup condenses the 5 dev tool news stories we published and fact-checked this week into one page. Every claim below is lifted directly from our original briefs and their vendor sources - nothing new was introduced for this summary, and each section links back to the full verified brief.

GitHub Copilot App Adds Free AI Security Scans With /security-review

A new slash command scans in-flight code changes for injection, XSS, and other common flaws across every Copilot tier, including Free -- here's what it replaces and what it doesn't. GitHub Copilot's app now runs an AI-driven vulnerability scan of your current code changes with a single /security-review command, in public preview across every tier including Free. It catches injection, XSS, insecure data handling, path traversal, and weak crypto with severity scores and fixable suggestions. It's a real lightweight pre-merge check, but GitHub itself frames it as a complement to code scanning and Dependabot, not a SAST replacement. The key detail: /security-review is now available across Copilot Free, Pro, Business, and Enterprise in public preview. Also worth knowing: Scans catch injection, XSS, insecure data handling, path traversal, and weak cryptography with severity-scored findings. Read the full brief at /blog/github-copilot-app-security-reviews-2026, or go straight to the primary source: Security reviews now available in the GitHub Copilot app.

Lovable Projects Now Have a Zero-Config Framework Path into Vercel

After the required GitHub handoff, Vercel detects TanStack Start for Lovable projects and turns later Lovable changes into normal Vercel deployments. Vercel calls its new Lovable support zero-configuration after the required GitHub handoff: sync the project, import the repository, and Vercel detects TanStack Start. Changes made in Lovable then sync back through GitHub and trigger normal Vercel deployments. It simplifies framework setup, but it does not remove source control or production configuration. The key detail: GitHub is the handoff between Lovable and Vercel. Also worth knowing: Vercel detects TanStack Start automatically. Read the full brief at /blog/lovable-apps-vercel-2026, or go straight to the primary source: Vercel Changelog: You can now deploy Lovable apps to Vercel.

Self-Hosted Supabase v0.7.0 Brings Three API Gateway Compatibility Changes

Supabase's self-hosted v0.7.0 release changes anonymous OpenAPI access, auth URL construction, and the default protected storage schema. Self-hosted Supabase v0.7.0 is a compatibility release for the API gateway. The Data API OpenAPI document at /rest/v1 no longer accepts anon or publishable keys, API_EXTERNAL_URL now includes /auth/v1 with SAML paths moved underneath it, and the default PGRST_DB_SCHEMAS value drops the protected storage schema. Check clients and environment templates before upgrading. The key detail: Anon and publishable keys no longer open /rest/v1. Also worth knowing: API_EXTERNAL_URL now includes /auth/v1. Read the full brief at /blog/supabase-self-hosted-v070-api-gateway-2026, or go straight to the primary source: Supabase GitHub Release: self-hosted/v0.7.0.

This Week in Dev Tools: Cloudflare Lets AI Agents & GitHub Copilot Adds GPT-5.6 (Week of Jul 13, 2026)

The 5 dev tool stories that mattered this week, from Cloudflare Lets AI Agents to GitHub Copilot Adds GPT-5.6 - one verified roundup, every fact re-checked against vendor sources. Cloudflare now lets AI agents deploy a live Worker with no pre-existing account via wrangler deploy --temporary (Wrangler 4.102.0+): the deployment runs for up to 60 minutes, during which a human can claim it into a permanent account, otherwise everything auto-expires. GitHub Copilot rolled out three GPT-5.6 model tiers on Pro, Pro+, Max, Business, and Enterprise: Sol for heavy reasoning and long agentic runs (Pro+/Max/Business/Enterprise only), Terra as the balanced daily driver, and Luna for cheap, fast small tasks. GitHub Copilot moved to usage-based billing on June 1, 2026: every plan gets monthly AI Credits ($10 on Pro, $39 on Pro+, $19/seat Business, $39/seat Enterprise) that drain by token consumption at published API rates. The key detail: Cloudflare Lets AI Agents Deploy: Zero signup, OAuth, dashboard, token, or MFA before an agent's first deploy. Also worth knowing: GitHub Copilot Adds GPT-5.6 Sol: Sol needs Pro+, Max, Business, or Enterprise - base Pro users don't get it. Read the full brief at /blog/weekly-digest-2026-07-13, or go straight to the primary source: Cloudflare Blog - Temporary Cloudflare Accounts for AI agents (primary announcement).

Vercel CLI Can Now Rewrite Project Settings Without the Dashboard

vercel project update lets you fix a broken framework preset, build command, or output directory from a terminal or a CI script - here's what it changes for teams and agents. Vercel CLI v54.21.1+ adds vercel project update, letting you set or reset framework preset, build command, and output directory from the terminal, with --auto-detect to revert and --format=json for scripting. It removes a long-standing annoyance: previously, correcting a misdetected framework meant a dashboard trip. Useful for multi-project setups and deploy-repair scripts; skippable if you rarely touch these settings by hand. The key detail: New command: vercel project update (CLI v54.21.1+). Also worth knowing: Supports --auto-detect revert and --format=json for scripts. Read the full brief at /blog/vercel-cli-project-settings-update-2026, or go straight to the primary source: Vercel Changelog: Update project settings from the Vercel CLI.

Fact-check status

Our accuracy oracle re-verified 44 of 47 tracked vendor pricing facts in its latest run on 2026-07-19; 2 drifted and are under re-review. 1 source fetches failed and will be retried. Any figure quoted in the briefs above is covered by that loop, so if a vendor changes a price, the underlying article gets flagged for repair rather than silently going stale.

That is the week of Jul 20, 2026 in dev tools. Daily briefs land on the ToolPick news hub as stories break, each one verified against primary vendor sources before it goes live - check back there for coverage between digests.