Ideas that connect.
Work that moves forward.

GitHub published its September roundup for Copilot in Visual Studio 2026 on October 22, covering a custom-model transition, pull request exploration and assistance with NuGet warnings. The announcement includes all Copilot plans, including Free. GitHub announcement.

BYOM moves to a new experience and remains in preview

Bring Your Own Model (BYOM) remains in preview and is enabled by default in Community, Professional and Enterprise. It now requires Agent (Preview); the previous Ask and Agent modes no longer support it. Microsoft also warns that previously configured Ollama models must be added again after this update. Visual Studio blog.

Supported providers include Microsoft Foundry, OpenAI, Anthropic and Ollama, with custom endpoints for OpenAI and Ollama. BYOM can be configured without signing in to GitHub through Add a model or Manage Models in the chat model picker. Agent capabilities depend on the chosen model. Using BYOM without signing in does not remove the prerequisites for other connected features. Official BYOM introduction.

Versions and channels: availability needs qualification

The release notes place the September update in Visual Studio 18.10.0, released on September 8, 2026. Their BYOM instructions, labelled BYOK there, point to Insiders 18.10, while the September 29 blog invites users to install Stable. These references do not establish a uniform minimum channel. Release notes, Microsoft roundup.

The notes detail one Ollama reconfiguration case: moving from 18.10 Insiders 1 to Insiders 2. That specific case does not narrow the blog's general warning. Check the starting build, whether Agent (Preview) is present and the model configuration before updating. The date of GitHub's roundup does not mean every feature launched simultaneously. Transition details.

Pull requests: context connected to the repository

To explore a pull request, select the Git agent in Copilot Chat and attach the PR from Git Repository. The response includes links to comments and files. This requires connecting the Git provider's MCP servers; GitHub and Azure DevOps are supported. GitHub announcement.

MCP, Model Context Protocol, connects the agent to tools and services outside the IDE. Microsoft documents authentication, tool permissions and organizational server allow lists. A configured connection can still be blocked by those policies. Visual Studio MCP documentation.

NuGet: proposals need review

Starting with Visual Studio 2026 18.10, NuGet Audit warnings NU1901–NU1904 raised during dependency restore offer an action in the Error List's Fixer column. It opens Copilot Chat in agent mode to request changes. This requires signing in to GitHub Copilot and enabling the NuGet MCP server. The documentation instructs users to review and apply the proposals. Error List guide.

The server is built into Visual Studio 2026 but must be enabled through the chat tools menu. Its documentation requires .NET 10 SDK or later. NuGet MCP server requirements.

Practical interpretation: a proposed update still needs diff review, a build and relevant tests before treating the issue as resolved. These documentary checks do not demonstrate that Copilot has fixed a vulnerability in any particular project.

Nexo's interpretation: preparing the team's transition

The practical consequence is to examine the model connection and access to project tools. This is an editorial interpretation of the published prerequisites; the sources do not quantify a team's migration work or guarantee that a generated response is correct. We propose these checks:

• Record the installed version and channel, and inventory providers, endpoints and models before making the change.
• Try the configuration in a test project, defining success criteria for the connection, required tools and review of the result.
• Check repository access, server authentication and applicable policies with the account the team will use.
• Review proposed changes and run the build and relevant tests before integrating them.

Proposed examples, with no tests performed

These scenarios illustrate a possible evaluation. They do not describe sessions performed, responses received or verified security outcomes.

• Pull request: “Summarize this PR, link to the comments and files supporting your conclusions, and identify any missing context.” Then check each link against the original PR.
• NuGet: “Explain which dependencies you would change, why, and which tests would be needed before applying the proposal.” Then assess the diff and repeat the project's checks.