Cognition

Devin Review now supports Bitbucket Cloud, with automatic review webhook installation and personal account linking so reviews post as the member. Devin Review analytics now count a finding as resolved only when fixed in code, so resolved numbers will be lower.

Devin Oncall is now available to all organizations, with responders triaging Slack, Microsoft Teams, and PagerDuty alerts and posting root-cause analysis. Enterprise admins can configure Microsoft Teams attachment classification once per enterprise so files are shared or rejected by Microsoft sensitivity label.

Messages can now start multiple side chats, and Devin's /devin review and /devin prompt commands work on GitLab merge requests. Devin Review also shows merge readiness for Bitbucket Cloud pull requests and word-level highlights for edited lines, and Devin can list and search pull requests across several hosts. Numerous smaller additions cover archived-session search, editable queued messages, Teams access controls, and Bitbucket Data Center webhooks.

Admins can assign a new org-level Review manager role that grants Manage Devin Review without full account, org, or Git integrations admin rights, and code-scan findings can now be exported as SARIF 2.1.0 from the scan page and the findings export API. Also added Chat width preference, persistent partial replies when interrupting Devin, per-repository merge method memory in Review, Splunk/Elastic/Dynatrace/Chronosphere/Google Cloud Monitoring observability plugins, and promotion of the repositories and blueprint endpoints to the stable v3 API.

Devin now remembers what it learns about you across sessions, with memory files reviewable and toggleable under Settings > Customization > Memory and a nightly review of recent sessions listed as recent dreaming sessions. Sessions can now be resumed for 14 days after going to sleep, down from 30. Plus a long tail of updates: font and font size settings, command palette shortcuts, real transcript diff cards for large edits, per-type notification switches, server-synced user preferences, AGENTS.md loaded on repo setup, and non-expiring PR attachment links on Enterprise.

Devin now has a notification inbox with a bell in the sidebar and a Settings > Notifications page for choosing inbox and phone delivery, the ⌘K palette mirrors sidebar pages and exposes pull request review actions, and saved secrets containing a private key are redacted line by line in command output. Other changes cover Microsoft Teams and Slack messaging, merge queue status, Devin Review permissions for custom roles, security profiles for Teams group chats, analytics corrections, and plugin row and Settings dialog styling.

The session workspace gains a Terminal tab for running commands on Devin's machine, with Files and Terminal now waking a sleeping session, and the Settings keyboard shortcuts page is available to everyone. Also adds single code scan fetch via API and MCP, Bitbucket Data Center PR reviewer assignment, and Azure DevOps review summary threads posted as closed.

Fixed transcript flickering or going blank when returning to a background tab, self-scrolling while reading older history, and skill content not loading from an "Activated skill" entry, alongside Perforce snapshot builds given up to 3 hours to sync instead of failing after 10 minutes. Microsoft Teams access settings for allowed channels, group chats, and direct messages now take effect, and security scan findings can be selected in bulk by severity including ones not yet loaded.

Devin is now available as a native agent inside Jira, starting sessions when a work item is assigned or mentioned, and automations can run a preflight script after each trigger before the agent starts. Messages sent right before a connection drop are now saved by the server instead of being lost, and Devin Review findings on PRs opened by a running session go to that session for auto-fix before being posted as review comments.

View preferences — search mode, changed-files tree layout, sidebar Review/Ask filters, and wiki language/view choices — now sync across browsers and devices instead of staying on one machine. Also added Option+J/Option+K session navigation, interactive HTML reports, child sessions that carry a summary of their parent, and Bitbucket Data Center and Azure DevOps pipeline log support.

Automatic reviews can now be triggered by custom rules that enroll accounts, SCM orgs, repos, repo prefixes or individual members and narrow each trigger with filters on PR author, reviewer, label, title, branch, changed files, author type and diff size, with exclusions overriding triggers. Devin Review can also be triggered from Helix Swarm reviews and reads the shelved or submitted changelist directly from the Perforce depot.

The standalone npx devin-review command-line tool and its unauthenticated review page are removed, and installed copies will no longer work. Devin Review can now be enabled for Bitbucket Data Center repositories, Microsoft 365 Mail, Calendar, Teams, and Directory MCP servers are available in the MCP marketplace, and Devin fixes merge conflicts on its PRs automatically more often.

Code scan findings can be selected in bulk to assign several to one Devin session or update their status at once, and scan-new-commits runs now skip starting a session when the repository has no new commits, recording the run as completed with no ACU usage. Also added lightbox arrow-key navigation with Mermaid diagrams, AWS and Braintrust MCP servers in the marketplace, and an enterprise setting allowing partial snapshot builds when a repository clone fails.

The Enterprise API audit-logs list response no longer populates the total field, returning null, so pagination must use has_next_page and end_cursor. Also added Origin session filters, an MCP server Reconnect action that redoes authentication without uninstalling, per-PR Devin Review from the Cmd+K palette, Azure DevOps Server 2020/2022 connections, the ActiveCampaign MCP, and Grafana (OAuth) MCP support.

Voice calls with Devin now run on a live speech model, with call controls and Slack thread call attribution. Devin Review always checks for security bugs and the Security scan toggle was removed, GitLab connections gained an Automation scope setting for public repos, MCP credentials moved to each server's page, and the v3 blueprint API can manage blueprints from git or Devin's database.

Devin can now trigger automations on PagerDuty incident events and act as an oncall responder that triages incidents and posts investigation notes, alongside 21 new one-click OAuth MCP marketplace integrations. The v1 Sessions API accepts an optional idempotency_key (repeating a key returns the original session, and 409 while creation is in progress), deprecating the legacy idempotent boolean.

Archiving a session now also closes open pull requests of child sessions archived with it. Plugins bundle skills, rules, hooks, and MCP servers into a single installable package, installable from the marketplace or a repository, with security notices on every install. Also includes faster tab switching, queued messages surviving idle/resume, Git Bash as default on Windows, and improved Teams sync controls.

Session sidebar can now group by pull request status or repository, and session filters include Devin mode. A new cleanup scan type finds dead code, automations support scheduled code scans via a new /scan composer command, and the findings tab was redesigned for easier triage.

Session sidebar gains multi-select tag filters with per-tag counts, the workspace editor supports split groups, and Gmail, Google Calendar, Gamma, and Supabase MCP servers hit the marketplace. Code scan history and validation severities are also new, alongside clearer MCP install approvals and a new org permission.

Smarter @mention routing in Slack threads now directs replies to the subscribed session, and new Slack channel sessions use the mentioning user's default working org. Code scan pages moved from /code-scan to /security, with old links redirecting, and adding the "Scan now" button and batch remediation v3 API routes.