How does MSIX service a package while it’s in use?

Simple: It doesn’t.

A core principle of MSIX servicing is:

Do not service a package while it’s in use.

Deployment provides several ways to deal with that constraint. Options range from terminating applications to deferring servicing until the package is no longer in use.

How hard can it be?

‘Servicing a package’ means any deployment activity modifying software, including update, remove, repair and other operations.

Altering installed software can be highly disruptive if the software is in use. Executables and DLLs may be mapped into running processes. File and registry writes may be in progress. Processes may be connected through COM, named pipes, or other IPC mechanisms.

There are ways to handle it, but how is unique to each application. There’s no generally applicable solution for all applications. Other than “Don’t do that”.

How hard can it be? Hard enough for any single app. Across the spectrum of apps on Windows? Very.

One size can’t fit all, so MSIX offers several options.

Default Behavior: Fail with ERROR_PACKAGES_IN_USE

In the simplest case, Deployment rejects a request to service a package while in use. For example, assume Contoso.PointOfSale-v1.msix declares an application using Contoso.PointOfSale.exe. The application is running. A deployment request to update the package to v2 will detect the Contoso.PointOfSale.exe process is using the v1 package and fail the request e.g.

Add-AppxPackage 'C:\Packages\Downloads\Contoso.PointOfSale-v2.msix'
...
Add-AppxPackage : Deployment failed with HRESULT: 0x80073D02, The package could not be installed because resources it modifies are currently in use.
...

Deployment returns ERROR_PACKAGES_IN_USE (0x80073D02), indicating the deployment operation cannot proceed because it would service a package while in use.

Option 1: Shut Down the Application

One option is to quit the app using the v1 package to unblock the update.

Another option is to terminate the app via TerminateProcess(), TASKKILL, PowerShell cmdlets or similar utilities.

PackageManager provides an option to do exactly this: ForceTargetAppShutdown.

var packageUri = new Uri("C:\\Packages\\Contoso.PointOfSale-v2.msix");
var options = new AddPackageOptions();
options.ForceTargetAppShutdown = true;
var packageManager = new PackageManager();
var result = await packageManager.AddPackageByUriAsync(packageUri, options);

Or use the similarly named -ForceTargetApplicationShutdown option with the Add-AppxPackage PowerShell cmdlet:

Add-AppxPackage 'C:\Packages\Contoso.PointOfSale-v2.msix' -ForceTargetApplicationShutdown

This deployment request checks for processes using the target package. It shuts them down, forcibly if necessary, to unblock the deployment operation.¹

Option 2: Defer the Update

Failure and TerminateProcess() are rather stark options. Not every process can quit or be terminated harmlessly. For example, it would be disruptive if Terminal is running a batch job that takes hours to complete.

MSIX offers an opt-in solution in AppxManifest.xml: defer</>.

When a package sets uap17:UpdateWhileInUse² to defer, Windows defers the update rather than shutting down the application. This also takes precedence over force-update options such as ForceTargetAppShutdown: Windows ignores those options for a package that declares deferred update behavior. Windows defers the update until the package is no longer in use. Deployment completes it at the next opportunity.

Alternatively, deferred registration can be requested at runtime for an individual deployment operation via DeferRegistrationWhenPackagesAreInUse. If a package is currently in use, registration is delayed and completed when the package can be updated, such as on the application’s next activation.

For example, using the PackageManager API:

var packageUri = new Uri("C:\\Packages\\Contoso.PointOfSale-v2.msix");
var options = new AddPackageOptions();
options.DeferRegistrationWhenPackagesAreInUse = true;
var packageManager = new PackageManager();
var result = await packageManager.AddPackageByUriAsync(packageUri, options);

or the Add-AppxPackage PowerShell cmdlet:

Add-AppxPackage 'C:\Packages\Contoso.PointOfSale-v2.msix' -DeferRegistrationWhenPackagesAreInUse

Many apps, packaged and unpackaged, offer this sort of update experience. When an update is available, the app offers an ‘Update now’ option: “Hey buddy, I’ve got an update. If you want it now, great. If not, I’ll take care of it later when you’re not using me.”

This gives developers two ways to request deferred updates: a package can opt in to the behavior through its manifest, or an individual deployment request can opt in through an API or tool.

Detect a Deferred Update

Can you detect if a package has an update deferred?

Yes!

PackageDeploymentManager.IsPackageRegistrationPending returns true if the package family has a pending (previously deferred) update for the current user.

PackageDeploymentManager.IsPackageRegistrationPendingForUser returns true if the package family has a pending (previously deferred) update for the specified user. As usual, admin privilege is required if the specified user isn’t the caller.

Defer Removal While In Use

Remove operations implicitly have ‘Force’ semantics so they have no explicit [ForceTargetApplicationShutdown] option.

But what if an application is busy?

MSIX offers similar deferred behavior for removal via PackageManager.RemovePackageAsync(packageFullName, RemovalOptions.DeferRemovalWhenPackagesAreInUse):

var packageManager = new PackageManager();
string packageFullName = "Contoso.PointOfSale_2.3.4.5_arm64__1234567890abc";
var options = RemovalOptions.DeferRemovalWhenPackagesAreInUse;
var result = await packageManager.RemovePackageAsync(packageFullName, options);

If the package is in use, Deployment marks it for removal at the next opportunity³ instead of terminating processes to unblock the removal. The algorithm is effectively:

IF package is in use
    IF options.DeferRemovalWhenPackagesAreInUse is set
        Mark the package for deferred removal
        return SUCCESS
    ELSE
        Ask app to shutdown
        IF app still running
            TerminateProcess()
        ENDIF
        IF app still running
            return ERROR_PACKAGES_IN_USE
        ENDIF
    ENDIF
ENDIF

// package is not in use
Remove the package
return SUCCESS

---

¹ Processes are requested to shut down and, if necessary, may be forcibly terminated via TerminateProcess().

² uap17:UpdateWhileInUse requires Windows 11 version 24H2 (build 26100) or later.

³ Deployment completes a deferred removal when it gets an opportunity after the package is no longer in use. Depending on how the package is used, that may not occur until a later user session.

The post Servicing While In Use and ERROR_PACKAGES_IN_USE appeared first on Inside MSIX.

Microsoft 365 and Outlook are still seeing service degradations on Tuesday, the company's status page indicates.

Executive Summary, Day One
📁 Inbox 5:05AM
To: Ternus, John <jternus@apple.com>
Reply-to: CEO-transition-team@apple.com

Welcome to your first day as CEO! Hopefully you're finding your new office spacious and comfortable. If you have trouble with any of the doors just ping us - being a Jony Ive design, you won't find anything as unsightly as a door handle here!

Today's memo includes a summary of the business, broken out by division. The day's schedule is also attached; please note that the Apple Intelligence team needed to delay the new Siri discussion until a later date, but they promise they're "for real" this time.

Hardware
Everything …

Read the full story at The Verge.

Today, Microsoft published its 2026 Responsible AI Transparency Report. The report highlights the progress we’ve made in building and deploying AI responsibly, supporting our customers, and strengthening our responsible AI governance, tools, and practices. You can explore the report in its entirety here.

AI is moving fast, and so are societal expectations. The boundaries of what people can accomplish with AI are expanding, and communities are asking more questions about how AI systems are designed, built, and used. As AI becomes more integral to how we live and work, confidence that AI systems are operating reliably and securely is becoming an essential prerequisite to their broad and beneficial adoption.

At Microsoft, we have been building a responsible AI program for nearly a decade, rooted in two core beliefs: that trust is foundational to realizing the benefits of AI and that the empowerment of people and organizations must remain at the center of our strategy. As capabilities advance and adoption accelerates, that experience is helping us meet this moment and adapt for what comes next.

Our third annual Responsible AI Transparency Report shares how our program is evolving and the priorities that continue to shape our work. Over the last year, investing in three specific areas has enabled us to embed trust more deeply and at greater scale: adaptive governance and technical risk management, practical tools and capabilities, and shared practices and strong partnerships. These investments cut across five trends shaping the AI landscape, including the rapid expansion of agentic AI.

Taken together, these trends and investments underscore our view that model capability alone will not determine the impact of AI. That will depend on organizations that develop and deploy AI technologies that deliver real value—and govern them with the rigor and adaptability needed to earn and sustain trust.

Adaptive governance and technical risk management

As the frontiers of AI advance, we are making our governance more adaptive and more tightly integrated with engineering workflows. In practice, this means that we have updated our policies to better match the AI tech stack and AI value chain, evolved our risk management practices to address emerging AI capabilities and risks, and strengthened the readiness of our responsible AI community: the people who operationalize our program at enterprise scale.

This year, we re-engineered our Responsible AI Standard to make it more adaptive to evolving technical realities, uses, risks, and regulatory requirements. The new Standard is structured by reference to different components of the tech stack—models, platform services, and applications—and the role that Microsoft plays in developing or deploying those components. It combines core requirements that always apply with more targeted, scenario-specific requirements that can evolve as capabilities and risks change. For example, we apply some of our most rigorous risk management measures to AI systems with the most significant cyber capabilities, helping ensure that advances in AI favor the defenders responsible for securing critical digital infrastructure.

We are also evolving our technical risk management practices. Increasingly capable systems can retain memory, use tools, access data, and take actions on behalf of users. Governing these systems requires us to think beyond the behavior of an individual model or application to interactions among models, agents, applications, tools, data, and people. Our work increasingly focuses on controls such as agent identities, tool permissions, and monitoring of actions.

And governance only works when people can put it into practice. We have continued to build responsible AI capabilities across Microsoft, equipping thousands of engineers and product managers with training on topics such as agentic AI threat modeling and prompt injection defenses.

Together, these investments are helping us move toward a more continuous, lifecycle-based approach to AI governance. With agentic AI, risks can evolve as systems interact with their environments, users, and other systems. Our governance needs to evolve with these agentic capabilities—and incorporate what we learn from their testing and deployment.

Practical tools and capabilities

Effective governance depends on tools that help translate policy goals into action. As developers and organizations navigate a more complex technical and regulatory environment, they need practical ways to identify risks, evaluate systems, establish controls, and monitor how AI behaves in the real world.

We are applying what we learn from governing AI at Microsoft into tools, capabilities, and resources that help developers and organizations beyond Microsoft do just that—whether they build on our platforms or leverage open-source projects.

We have expanded tools to evaluate AI systems across the lifecycle. A new AI Red Teaming Agent helps accelerate the identification and evaluation of risks. Agent evaluators help developers measure the quality, safety, and performance of agentic applications. RAMPART turns red team findings into repeatable tests, enabling more continuous coverage as systems change.

We are also building greater visibility and control into agentic systems. With ASSERT and Agent Control Specification, developers can evaluate agents against their policies, place runtime controls at critical points in an agent’s workflow, and monitor behavior.

These tools and capabilities reflect a shift: as systems become more dynamic, governance needs to become more operational. Organizations need to be able to see what their systems are doing, test how they behave, and intervene when necessary—not just assess them before deployment.

Organizations also need confidence—and increasingly need to demonstrate—that responsible AI practices are being implemented consistently. Microsoft is one of the few companies certified against ISO 42001 across a broad portfolio, including Microsoft 365 Copilot, Foundry, and GitHub Copilot. Over the last year, we have simplified and strengthened our internal processes that support that certification.

Ultimately, responsible AI governance is a shared responsibility across the AI value chain. Our goal is to help make the practices and capabilities needed to meet that responsibility more accessible, practical, and scalable.

Shared practices and strong partnerships

The challenges of governing AI are bigger than any one company, and increasingly interconnected AI systems make collaboration even more essential.

As AI adoption expands across borders and sectors, we need shared expectations for how systems are evaluated, monitored, and governed, as well as interoperable standards that enable visibility into interactions across tools, data, and systems. We also need to keep advancing the underlying science and technical practices so that we can benefit from rigorous, applied insights into what effective governance looks like and where the remaining gaps are.

That starts with research. Over the past year, we advanced our work with the US Center for AI Standards and Innovation and AI Safety and Security Institutes in Australia, Singapore, and the UK to strengthen the science and practice of AI evaluation. We also launched an External Red Team Alliance with 18 universities across six continents to expand understanding of priority risks.

Common technical practices and standards are critical. Through the Frontier Model Forum, OpenTelemetry, and the Appia Foundation, we are helping develop approaches spanning frontier cyber benchmarks, end-to-end observability for increasingly agentic systems, and AI assurance across supply chains and sectors. We are also contributing to efforts that make transparency reporting more interoperable across organizations and jurisdictions, including through an OECD-led informal task force that developed the Hiroshima AI Process Reporting Framework version 2.0.

We also need shared ways to measure progress. We cannot meaningfully assess progress if every organization measures AI risks differently. Through our work with MLCommons, we are helping expand AILuminate into a broader suite of reliability benchmarks, creating common approaches for evaluating areas such as jailbreak resilience, multilingual performance, and psychosocial risk in conversational AI.

Shared learning, shared practices and standards, and shared measurement can help the entire ecosystem develop while raising shared expectations for trust.

Meeting the moment and investing for the future

Our experience over the past year has reinforced that responsible AI cannot be static. It has to be embedded in development processes, supported by practical tools, and continually informed by what we learn. That is why our responsible AI investments extend from the systems we build, to the tools we provide our customers, to the research, practices, and measurement approaches we help develop with the broader ecosystem.

Our 2026 Responsible AI Transparency Report explores this work in more depth—from how we re-engineered our Responsible AI Standard to how we are strengthening governance for agentic AI, advancing evaluation, and addressing AI misuse. We invite you to explore the report to see what we have learned, what we have changed, and how we are putting our priorities into practice.

As AI becomes more powerful and more present in people’s lives, our commitment is to keep listening and learning, to keep strengthening our safeguards, and to keep putting the empowerment of people and organizations at the center of our strategy.

The post Responsible AI in 2026: How we are adapting for what’s ahead appeared first on Microsoft On the Issues.

Coauthored with Claude

Midway through each month, I think “The next Trends is going to be small. Not much is happening.” This is the first time that I’ve been right. Was everyone on vacation in August? Am I becoming jaded? There were many model releases, though few of them seemed significant. Then again, it may be time to get over the one-upmanship by the frontier vendors and spend more time thinking about the myriad small and open-weight models. Every month, the best laptop-scale models (30B and smaller) seem closer to the leading frontier models. And every month, we’re seeing organizations realize that paying premium per-token prices for the latest frontier models gives at best a small advantage over the best open-weight models.

AI models

Capability and model size are decoupling. Several models here run comfortably on a laptop or a single accelerator while claiming performance close to much larger frontier systems. While it can be hard to work with a smaller model without thinking that you’re choosing “second best,” the biggest model isn’t always the right choice. Major releases aside, the most important news from August might be Anthropic’s deployment of watermarks for text. If the watermarking scheme works, it will be possible to tell which parts of an article like this were written by AI.

• OpenAI has announced that, beginning November 12, 2026, Cursor will no longer have access to their models.
• A mysterious model named Ox Alpha quickly became the most heavily used model on OpenRouter. Z.ai recently confirmed that Ox Alpha was GLM-5.3-Flash, a 320B open weight model that claims performance similar to Opus 4.8 and that has been deployed running entirely on Chinese chips.
• IBM’s Granite 4.2 is a small open-weight reasoning model that has been tuned for multistep tasks. It comes in 3B, 8B, and 30B sizes. It’s another model making the argument that small local models can be competitive with frontier models. 
• The team that developed Ornith-1.5 claims that they have made a major step toward self-improvement. The model supports a self-improvement loop in which it proposes new tasks, generates solutions, and uses reinforcement learning to apply the results to itself.
• DeepSeek-V4-Flash-Vision adds vision to DeepSeek V4’s capabilities. Images can be mixed with text; the model can describe images, extract text from images, and do other things that we expect from a leading LLM.
• Anthropic is now embedding watermarks into all of the text that its models generate or edit. The watermarks are apparently based on word choice; the algorithm “changes the source of randomness used to pick words.” We don’t (yet) know of any tools to detect the presence of a watermark, but there are already tools that claim to remove them. It isn’t clear that these tools work.
• A new benchmark, SWE-Bench ProMax, tests the ability of LLMs to do large-scale refactoring. It’s a multilingual benchmark based on real-world code in seven languages.
• Qwen3.8-27B is a small open-weight model that claims performance similar to Opus 4.6 max. It runs easily on a reasonably well-equipped laptop.
• Google has released Gemini 3.7 Flash, claiming improved coding and debugging.
• Z.ai has released GLM-5.3. It’s very similar to GLM-5.2, differing only in that it has received additional post-training. Z.ai claims that it’s better at code generation and long-running tasks.
• NVIDIA has released Nemotron 3.5 Lightning, an open-weight mixture-of-experts model with 30B parameters and 3B active parameters. Like many recent models, it’s optimized for long-running agents such as OpenClaw.
• Cactus Compute has released Needle 2, another small model that’s worth a look. It’s a 45B-parameter model that has been designed for “tool calling, device use, and structured extraction.” Needle requires only 28 MB of RAM, so it will run on many laptops and small devices and microcontrollers.
• Meta open-sourced Muse Glimmer, a 30B model designed for agentic applications. It can run on consumer hardware. Meta also released Muse Code and Muse Spark 1.2. Muse Code is a model designed for code generation. It implements an agent loop and a local event log that allows exact replays and restarts. Spark is a general-purpose model with near-frontier performance—Meta describes it as “a step towards the frontier.”

Software Development

Features that we associate with agents or harnesses, such as the ability to spawn subagents and delegate tasks to less-expensive models, are continuing to find their way into the models themselves. There’s also a countertrend: Individuals and organizations are building their own agents that are closely integrated into their working environment. Are we headed for walled gardens controlled by the leading providers? Or will a thousand flowers bloom, each reflecting an idiosyncratic way of working with AI? Don’t avoid tools from the major AI labs, like Claude Code and Codex, but don’t lock yourself into thinking that they’re the only option.

• DeepSeek has open-sourced Harness, its agent harness. What makes Harness unique is that almost everything is a plugin, so it’s extremely flexible. It can be used with many models, and can delegate work to Claude Code and Codex.
• TrueForge is an open source agent harness that can be used with any model. It includes tools to debug and govern agents in production.
• Computer History is a new feature of ChatGPT Work and Codex that records how you use your computer. It’s similar to Microsoft’s controversial Windows Recall, but it’s based on key clicks and other actions rather than screenshots. Data is stored locally rather than sent to OpenAI. It’s off by default.
• Zed’s Delta is a “multiplayer environment for coding with agents and reviewing what they build.” It’s a new take on Git and GitHub, designed specifically for the AI world. The company’s big insight is that the conversation about the code is as important as the code itself, and must be captured along with the source.
• Companies are now building their own agents (a.k.a. harnesses). While they’re still using AI services from Anthropic, OpenAI, and other providers, many organizations are finding that custom agents are a useful way to incorporate their own workflows into an AI-driven development process.
• Anthropic has added cross-session messaging to Claude Code. Messaging allows one agent to inform others about actions it has taken that might affect another agent’s work, reducing the need for a programmer to act as a communications medium.
• Agent Plugins is a standard for extending agents with plugins built from reusable components. It’s supported by OpenAI, Microsoft, Cursor, and AWS, though not by Google or Anthropic.
• OpenAI now has a hardware product. Codex Micro is a small terminal (certainly the wrong word) for remote AI work; it has 13 keys, a rotary encoder, a touch sensor, a joystick, and some status lights, and it hints at voice control (though I see no mention of a microphone). Its purpose is to allow you to control Codex workflows remotely.
• “Just because a feature is easy to build doesn’t mean that it is worth shipping”: Good advice on using AI effectively for software development.
• An update to the Model Context Protocol (MCP) addresses one of the most significant barriers to adoption by making it stateless.
• Software developers who didn’t grow up with Linux frequently haven’t discovered the art of the command line. Atomic Object recommends four terminal tools: Ghostty, tmux, lazygit, and lazydocker. Try one of them—or all.

Infrastructure and operations

Optimizing AI usage has become its own discipline, sometimes called “tokenomics.” Tokenomics can’t be separated from safety, which has also been much in the news. Disposable containers built for agents, GPU scheduling that treats accelerators as a heterogeneous pool, and infrastructure providers publishing how they actually serve open models at scale all match workloads to hardware without waste or risk. AI performance isn’t just about models; it’s about infrastructure. Understanding how the model is run will prove more important than the model’s specs and benchmarks.

• Taalas has built a chip that incorporates Llama 3.1 8B. All the weights are on the chip, which can’t be used for any other models. It’s extremely fast. Whether single-model chips make sense when new models are released almost daily is a good question.
• Docker Sandboxes are isolated disposable containers that are designed for running AI agents safely.
• Kubernetes’s Device Resource Allocation (DRA) makes it much easier to schedule jobs on heterogeneous clusters of GPUs.
• Cloudflare has published a description about how it runs the Kimi and GLM models at scale. It’s worth reading.
• WARP (formerly Waste) is an inference engine with one purpose: run Kimi K3 on a laptop. K3 is a 2.8T parameter model with 104B active parameters, typically requiring a small fleet of GPUs. WARP requires a 64 GB Macbook Pro with a few TB of disk. It’s slow (about 0.5 tokens/second), but it runs.

Security

Security work is inseparable from AI development, not a layer added afterward—but security professionals have been saying that about traditional software for years. Artificial intelligence is spawning new attacks as well as new defenses. While it’s always fascinating to look at new attacks, the most significant shift is in defense: rethinking security in terms of actions and resources rather than user identities, a change we’ve also covered on the Radar blog.

• Anthropic, OpenAI, Google and many other AI companies have signed an open letter saying that defense against cyberattacks has to become a priority for governments, and that governments and organizations need to act collectively to build defenses. 
• The Chrome browser has adopted device-bound service credentials (DBSC) to prevent session cookie theft, a critical step in account takeovers. DBSC stores an encryption key in a secure enclave or other trusted storage.
• There is now a Python library that supports ML-KEM and ML-DSA, NIST-standard key encapsulation and digital signature algorithms for postquantum cryptography.
• Simon Willison has published a timeline of OpenAI’s inadvertent attack against HuggingFace. His timeline is based on a postmortem that OpenAI presented at Black Hat. OpenAI has published a full incident report.
• The ChainDrop credential stealing malware has compromised over 1,300 packages on npm, the Node package manager. The malware is self-propagating, and compromised packages appear to have legitimate provenance.
• OpenAI has open-sourced Codex Security, a command-line tool and API that uses ChatGPT to analyze code for vulnerabilities. Their documentation says that the CLI and API are both in “limited beta,” possibly because of the model used to do the analysis.
• Context Collapse is a three-part series that discusses context poisoning attacks against Copilot, culminating with self-propagating attacks against Word. Microsoft collaborated on the analysis and mitigations.
• Google has introduced Beyond Zero, a new security model that takes zero trust a step further. Beyond Zero makes decisions on the basis of specific actions and resources, not just users or applications. Decisions are governed by both static policies and dynamic controls that can respond to changes in the environment.

People and Organizations

How do people use AI? Does AI use lead to greater productivity? We know surprisingly little about either question. We’re still learning how to use AI effectively; the best metric isn’t a simple measure of productivity but whether you can do things you couldn’t do before.

• The AI Observatory collects data about how people use AI. What we know about the ways people use AI is surprisingly limited. We know that usage patterns vary from model to model, but model providers only publish the data they want to see; we still don’t understand the big picture.
• How do you measure AI productivity? “Why AI Productivity Is a Faulty Metric” has some good ideas. Develop metrics around code quality and whether AI-generated code survives review, rather than counting lines of code.

Web

There’s now a specialized version of ChatGPT for teens; a site that serves different content to scrapers and humans; and an AI-generated animation of the start of The Lord of the Rings. The web is proving that it can adapt to anything that’s thrown at it. It’s where we learn and play, and AI isn’t changing that.

• OpenAI has launched ChatGPT for Teens, a specialized mode for users between 13 and 17 years old. This new product stresses learning and studying rather than using AI to get answers, has stronger content safeguards, and tries not to become a surrogate for human interaction.
• A theremin in the browser is something you don’t see every day! Use your mouse or your webcam to control it.
• TIME magazine has started giving AI scrapers a minimal Markdown version of articles with additional advertisements. The site’s behavior depends on the User-Agent HTTP header. Some user agents are denied access, while humans are given HTML with graphics and layout.
• Tired of pelicans on bicycles? Andrej Karpathy had Claude Opus animate the first paragraph of The Lord of the Rings with Three.js. The result isn’t great, but it’s certainly fun and points to some areas where the best current models aren’t yet strong enough.

Biology

• The National University of Singapore’s Life Sciences Institute now has a server rack where the computational power comes from 16 million lab-grown human neurons. Life support is a problem, but power consumption is a small fraction of the power required by GPUs.
• Claude has successfully run a complete protein design workflow, generating new designs for proteins that have been synthesized and tested in labs.
• There could be a fly on your desktop. This one is driven by a simulation of over 23,000 neurons from a fly’s connectome. It behaves like the real thing (macOS only).

If you've pushed to GitHub and gotten smacked with remote: Support for password authentication was removed, you're not alone, and you're not doing anything wrong. GitHub officially retired password auth over HTTPS back in August 2021 in favor of token- or SSH-based authentication. It's not a bug, it's not your firewall, it's just the old way not working anymore. I'd been getting by on Personal Access Tokens, but fine-grained PATs come with their own overhead: picking scopes per repo, watching...