NuGet caps new API keys at 30 days as Symfony, Grafana, DeepSeek and Dropstone ship developer tooling

NuGet forces 30-day key rotation; GitHub Actions goes keyless, Azure DevOps cannot

Every .NET developer who publishes packages to NuGet.org from an automated pipeline now has a hard rotation deadline. As of August 17, 2026, any newly created API key on NuGet.org is capped at a 30-day maximum lifetime. Every existing key — regardless of when it was created or when it was set to expire — stops working on November 1, 2026.

Maintainers who silently relied on a 365-day secret stored earlier in the year will see their pipelines break without warning on that date unless they automate monthly rotation or migrate off keys entirely. The 365-day option is removed. GitHub Actions users have a documented keyless migration path; Azure DevOps does not, leaving those pipelines to manage the rotation manually.

Symfony ships an official language server for VS Code and Neovim

The PHP framework now has a maintained LSP server for the editors most Symfony projects actually live in. Symfony Language Tools, released August 17, 2026, adds Symfony-aware completion, hover, navigation, references, rename support, diagnostics, quick fixes and code lenses to PHP, Twig and YAML files. It ships as a native VS Code extension and supports Neovim out of the box.

The motivation is concrete: strings such as route names, service ids, template paths, translation keys and environment variables mean something to Symfony but nothing to a generic PHP editor, so `redirectToRoute('order_confirmaton')` went unflagged. Until now, JetBrains users had a community Symfony Plugin; VS Code and Neovim users had nothing comparable. Teams can move their PHP, Twig and YAML editor setup onto a single maintained implementation rather than a third-party plugin that lags the framework.

Grafana makes gcx and MCP server generally available for telemetry-driven agent work

Two pieces of agent infrastructure from the observability vendor moved out of preview on August 17, 2026. The gcx CLI and the Grafana MCP server are now generally available, and both let AI coding agents query metrics, logs, traces, SLOs and Synthetic Monitoring results from Grafana Cloud or a self-hosted stack during development. The vendor's stated target is the failure mode where a developer plans, implements and reviews a change with an LLM, merges the PR, and never actually understood it.

By grounding the agent in live telemetry, the tools aim to keep the human in the loop on what the system is doing in production. Engineers wiring agents into Grafana can now point those agents at GA interfaces instead of preview endpoints.

DeepSeek releases DeepSeek Harness v0.1 under MIT, with everything as a plugin

DeepSeek published the full source of DeepSeek Harness v0.1 in developer preview and released it under the MIT license on August 17, 2026, shipping as `dsh` at deepseek-ai/deepseek-harness. A harness is the layer between a model and the environment it acts in — tools, files, sandboxes and the control loop. The project's framing is "Agent = Model + Harness", and the design point is that most harnesses hard-code the agent loop, tool registry and session store, leaving extension to whatever hooks the authors exposed. DeepSeek positions the whole thing as a plugin surface, which matters for teams that want to swap a tool, sandbox or session backend without forking the loop.

Dropstone SDK 1.0 ships one persistent agent memory across CLI, chat and pipelines

The TypeScript SDK for the Dropstone agent runtime reached 1.0 on August 17, 2026, exposing the same agent that runs in the Dropstone CLI and chat to programmatic callers. The headline feature is one persistent memory per account, shared across every surface the agent runs on. Anything learned in the CLI is present in an SDK session; anything observed in a CI run is there when chat opens next. There is nothing to export and nothing to sync because there was never more than one memory. The release post covers limits developers should know about before building on it, including what the continuity guarantee does and does not cover.

What to do next

Audit every NuGet publishing pipeline before November 1, 2026 and decide whether to automate monthly key rotation or migrate to the GitHub Actions keyless flow; Azure DevOps users have no keyless option and must script rotation. Try Symfony Language Tools in VS Code or Neovim on a Twig-heavy project to catch route, service and translation-key typos that previously slipped through. Point an AI agent at gcx and the MCP server once they are wired into your Grafana stack, and evaluate DeepSeek Harness v0.1 against your existing agent loop if MIT-licensed plugin extension is a requirement.

Dropstone SDK 1.0 is worth a spike for any team whose CLI, chat and CI jobs each maintain their own agent state.