Private vulnerability reporting now generally available
Open source maintainers and security researchers embrace a new best practice to report and fix vulnerabilities. ⌘ Read more
Introducing npm package provenance
How to verifiably link npm packages to their source repository and build instructions. ⌘ Read more
GitHub joins industry commitment to curb cyber mercenaries
GitHub is proud to join 40 companies endorsing the Cybersecurity Tech Accord principles limiting offensive operations in cyberspace. ⌘ Read more
Multi-repository enablement: effortlessly scale code scanning across your repositories
We’ve gotten great feedback on default setup, a simple way to set up code scanning on your repository. Now, you have the ability to use default setup across your organization’s repositories, in just one click. ⌘ Read more
3 benefits of migrating and consolidating your source code
Explore how migrating your source code and collaboration history to GitHub can lead to some surprising benefits. ⌘ Read more
How generative AI is changing the way developers work
Rapid advancements in generative AI coding tools like GitHub Copilot are accelerating the next wave of software development. Here’s what you need to know. ⌘ Read more
Ensuring compliance in developer workflows
How GitHub Enterprise ensures secure and compliant developer workflows for highly regulated industries. ⌘ Read more
GitHub Accelerator: our first cohort and what’s next
Meet the individuals that make up the first GitHub Accelerator cohort and learn about how GitHub is helping bring their visions to reality. ⌘ Read more
Introducing the newest GitHub Shop collection
From dog bowl bottles to fanny packs, explore the latest and greatest GitHub merchandise. ⌘ Read more
Generative AI-enabled compliance for software development
Explore how generative AI may soon help enable optimizing some of the foundational components of compliance. ⌘ Read more
How enabling developers can help drive financial inclusion
Explore how creating a great developer experience can help provide a more inclusive financial services environment. ⌘ Read more
What developers need to know about generative AI
Generative AI has been dominating the news lately—but what exactly is it? Here’s what you need to know, and what it means for developers. ⌘ Read more
Game Bytes · April 2023
Game Bytes is our monthly series taking a peek at the world of gamedev on GitHub—featuring game engine updates, game jam details, open source games, mods, maps, and more. Game on! ⌘ Read more
Building GitHub with Ruby and Rails
Since the beginning, GitHub.com has been a Ruby on Rails monolith. Today, the application is nearly two million lines of code and more than 1,000 engineers collaborate on it daily. We deploy as often as 20 times a day, and nearly every week one of those deploys is a Rails upgrade. Upgrading Rails weekly Every […] ⌘ Read more
Pwning Pixel 6 with a leftover patch
In this post, I’ll look at a security-related change in version r40p0 of the Arm Mali driver that was AWOL in the January update of the Pixel bulletin, where other patches from r40p0 was applied, and how these two lines of changes can be exploited to gain arbitrary kernel code execution and root from a malicious app. This highlights how treacherous it can be when backporting security changes. ⌘ Read more
Bring your enterprise together with enterprise accounts for all
With enterprise accounts for all, your organization can take advantage of all that GitHub Enterprise has to offer, from GitHub Actions and GitHub Advanced Security, to Copilot. ⌘ Read more
GitHub Availability Report: March 2023
In March, we experienced six incidents that resulted in degraded performance across GitHub services. This report also sheds light into a February incident that resulted in degraded performance for GitHub Codespaces. ⌘ Read more
Building organization-wide governance and re-use for CI/CD and automation with GitHub Actions
Many of us are aware of the benefits that a strong focus on automation can bring, particularly in our development workflow and DevOps lifecycle. But silos across businesses can lead to duplication of effort, and potential to lose out on best practices. In this post, we’ll explore how CI/CD can be shared across your entire organization alongside polici … ⌘ Read more
What’s new with GitHub Sponsors
GitHub Sponsors is now generally available for organizations. Also, new tooling for bulk sponsorships and an update on how we’re ensuring sustainability for GitHub Sponsors. ⌘ Read more
Level up monitoring and reporting for your enterprise
A high-quality audit log is an essential tool for enterprises to ensure compliance, maintain security, investigate issues, and promote accountability. ⌘ Read more
Calling all open source maintainers
We are building a private space for maintainers to connect with peers, preview features, and learn from each other! ⌘ Read more
CodeQL zero to hero part 1: the fundamentals of static analysis for vulnerability research
Learn more about static analysis and how to use it for security research!
In this blog post series, we will take a closer look at static analysis concepts, present GitHub’s static analysis tool CodeQL, and teach you how to leverage static analysis for security research by writing custom CodeQL queries. ⌘ Read more
Improvements to CodeQL’s data flow library for C++
These changes will improve the experience for custom query authors and enable better precision in some of our standard queries. Learn how to enable them for your custom queries. ⌘ Read more
Introducing self-service SBOMs
Developers and compliance teams get a new SBOM generation tool for cloud repositories. ⌘ Read more
GitHub Galaxy 2023: Empower developer teams with a new developer experience
Learn how GitHub’s one, integrated platform–powered by AI and secure at every step—helps developer teams be more productive, collaborative, and efficient. ⌘ Read more
Announcing the GitHub Actions extension for VS Code
Today, we’re excited to announce the release of the public beta of the official GitHub Actions VS Code extension, which provides support for authoring and editing workflows and helps you manage workflow runs without leaving your IDE. ⌘ Read more
We updated our RSA SSH host key
At approximately 05:00 UTC on March 24, out of an abundance of caution, we replaced our RSA SSH host key used to secure Git operations for GitHub.com. ⌘ Read more
Build a secure code mindset with the GitHub Secure Code Game
Writing secure code is as much of an art as writing functional code, and it is the only way to write quality code. Learn how our Secure Code Game can provide you with hands-on training to spot and fix security issues in your code so that you can build a secure code mindset. ⌘ Read more
GitHub Copilot X: The AI-powered developer experience
GitHub Copilot is evolving to bring chat and voice interfaces, support pull requests, answer questions on docs, and adopt OpenAI’s GPT-4 for a more personalized developer experience. ⌘ Read more
Partnering with EU policymakers to ensure the Cyber Resilience Act works for developers
We’re looking forward to working with policymakers to improve cybersecurity and support developers. ⌘ Read more
Godot 4.0 Release Party 🎉
We are delighted to host the Godot 4.0 Release Party at GitHub HQ on Wednesday, March 22 from 6:30 pm to 9:30 pm. And you’re invited! ⌘ Read more
How the Grafana Alerting team scales their issue management with GitHub Projects
Hear from Grafana’s Armand Grillet about how his team uses GitHub Projects. ⌘ Read more
GitHub celebrates the ingenuity of developers with disabilities in new video series
Learn how developers with disabilities are pushing the boundaries of accessibility with ingenuity, open source, and generative AI on The ReadME Project. ⌘ Read more
Highlights from Git 2.40
The first Git release of the year is here! Take a look at some of our highlights on what’s new in Git 2.40. ⌘ Read more
An open source project to empower OSPOs everywhere
We are open sourcing our own OSPO policies, tools, and guides to help other OSPOs get started. ⌘ Read more
Introducing Activating Developers and the new Digital Public Goods Open Source Community Manager Program
The Social Impact, Tech for Social Good team is launching a new Open Source Community Manager Program to support digital public goods. This is part of their new Activating Developers initiative. ⌘ Read more
Introducing GitHub vulnerability management integrations for security professionals
Learn about using GitHub Advanced Security alerts with vulnerability management tools. Check out the integrations and learn about how to get started. ⌘ Read more
Don’t leave developers behind in the Section 230 debate
Developers are at the heart of our online world and at the forefront of creating solutions for global challenges, working to make the software that underpins our digital infrastructure more secure, reliable, and safe. ⌘ Read more
How GitHub accelerates development for embedded systems
In a world where software and hardware is ubiquitous, GitHub can help enable secure development for mission-critical embedded systems. ⌘ Read more
Raising the bar for software security: GitHub 2FA begins March 13
On March 13, we will officially begin rolling out our initiative to require all developers who contribute code on GitHub.com to enable one or more forms of two-factor authentication (2FA) by the end of 2023. Read on to learn about what the process entails and how you can help secure the software supply chain with 2FA. ⌘ Read more
How GitHub Docs’ new search works
GitHub Docs recently changed its site-search to Elasticsearch. Here’s how it was implemented. ⌘ Read more
Multi-repository variant analysis: a powerful new way to perform security research across GitHub
Multi-repository variant analysis lets you scale security research across thousands of repositories, giving you a powerful tool to find and respond to newly discovered vulnerabilities. ⌘ Read more
Application security orchestration with GitHub Advanced Security
Learn how teams can leverage the power of GitHub Advanced Security’s code scanning and GitHub Actions to integrate the right security testing tools at the right time. ⌘ Read more
GitHub Galaxy 2023: your guide to building a more flexible and productive software development cycle
Join us virtually on March 28-31 for GitHub Galaxy, a global enterprise event focused on improving efficiency, security, and developer productivity. ⌘ Read more
GitHub Enterprise Server 3.8 is now generally available
With updates to GitHub Actions, repositories, and GitHub Advanced Security, this new version of GitHub Enterprise Server is focused on bringing the best developer experience to companies. ⌘ Read more
File editing on GitHub Mobile keeps leveling up
Commit an update to a pull request, or start a new branch to squash a bug at any time, wherever you are using the GitHub Mobile apps. ⌘ Read more
Unleash your potential with GitHub Octernships: a path to a thriving tech career
Empowering the next generation of students in tech with real-world industry experience. ⌘ Read more
How to automate your dev environment with dev containers and GitHub Codespaces
GitHub Codespaces enables you to start coding faster when coupled with dev containers. Learn how to automate a portion of your development environment by adding a dev container to an open source project using GitHub Codespaces. ⌘ Read more
Release Radar · February 2023 Edition
Our community—along with ourselves—took a much needed break over the festive season. Now everyone is back into the full swing of work, and the open source community is showing us it’s all hands on deck. We had dozens of submissions for the February Release Radar—a testament to the amount of code being shipped by the […] ⌘ Read more
GitHub Security Lab audited DataHub: Here’s what they found
The GitHub Security Lab audited DataHub, an open source metadata platform, and discovered several vulnerabilities in the platform’s authentication and authorization modules. These vulnerabilities could have enabled an attacker to bypass authentication and gain access to sensitive data stored on the platform. ⌘ Read more
GitHub Desktop 3.2: Preview your pull request
GitHub Desktop helps you feel confident in your Git and GitHub workflows. ⌘ Read more
Why Python keeps growing, explained
A deep dive into why more people are using Python than ever, its key use cases, and why it’s still so popular 30-plus years after it was first released. ⌘ Read more
GitHub Availability Report: February 2023
In February, we experienced three incidents that resulted in degraded performance across GitHub services. This report also sheds light into a January incident that resulted in degraded performance for GitHub Packages and GitHub Pages and another January incident that impacted Git users. ⌘ Read more
GitHub Actions Importer is now generally available
We’re excited to announce the general availability of GitHub Actions Importer. GitHub Actions Importer helps you plan, forecast, and automate migrations from Azure DevOps, CircleCI, GitLab, Jenkins, and Travis CI to GitHub Actions. This product is an extension of the official GitHub CLI and is available for free to any GitHub user starting today. Migrating […] ⌘ Read more
GitHub Actions: Introducing faster GitHub-hosted x64 macOS runners
Speed up your GitHub Actions jobs on macOS with all new, faster GitHub-hosted macOS runners for x64. ⌘ Read more
How to build a consistent workflow for development and operations teams
Explore how using GitHub and HashiCorp together enables enterprises to develop and ship to their customers faster and more secure with consistent workflows and actions. ⌘ Read more
10 things you didn’t know you could do with GitHub Codespaces
Unlock the full potential of GitHub Codespaces with these 10 tips and tricks! From generating AI images to running self-guided coding workshops, discover how to optimize your software development workflow with this powerful tool. ⌘ Read more
Secret scanning alerts are now available (and free) for all public repositories
Secret scanning alerts are now generally available for all public repositories. Admins can now turn on the alert experience with one click. ⌘ Read more
3 ways to meet compliance needs without slowing down agility
Learn how to enable developer productivity and collaboration while staying secure and compliant. Stay compliant without slowing down your business. From security to CI/CD, automate every step of your software workflow—so your developers can stay focused on what matters most: building. ⌘ Read more
Measuring government policy on open source with a new dataset
Policymakers around the world are developing policies that impact how software gets built and who gets to build it, see the latest now. ⌘ Read more
The code that wasn’t there: Reading memory on an Android device by accident
CVE-2022-25664, a vulnerability in the Qualcomm Adreno GPU, can be used to leak large amounts of information to a malicious Android application. Learn more about how the vulnerability can be used to leak information in both the user space and kernel space level of pages, and how the GitHub Security Lab used the kernel space information leak to construct a KASLR bypass. ⌘ Read more
Responsible AI pair programming with GitHub Copilot
GitHub Copilot boosts developer productivity, but using it responsibly still requires good developer and DevSecOps practices. ⌘ Read more
Update on the future stability of source code archives and hashes
A look at what happened on January 30, what measures we’re putting in place to prevent surprises, and how we’ll handle future changes. ⌘ Read more
ICYMI: CodeQL enhancements
Learn about CodeQL’s improved user experience and enhancements that let you scan new languages, detect new types of CWEs, and perform deeper analyses of your applications. ⌘ Read more
2022 Transparency Report
Looking back over a year’s worth of developer-first content moderation and, new in this report, making our data more accessible to researchers. ⌘ Read more
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git apply` or `git clone` against untrusted patches or repositories. ⌘ Read more
GitHub Copilot now has a better AI model and new capabilities
We’re launching new improvements to GitHub Copilot to make it more powerful and more responsive for developers. ⌘ Read more
GitHub Copilot for Business is now available
GitHub Copilot is the world’s first at-scale AI developer tool and we’re now offering it to every developer, team, organization, and enterprise. ⌘ Read more
Yout amicus: fighting for developers’ right to innovate
Our mission to accelerate human progress through developer collaboration requires us, from time to time, to fight against legal developments that would needlessly impair developers’ right to innovate. That’s why GitHub has filed an amicus brief in the appeal of Yout LLC v. Recording Industry of America, Inc. ⌘ Read more
Release Radar, Festive Edition · December 2022 – January 2023
Welcome to our special edition of the Release Radar 🎄. Between Christmas festivities, end of the year parties, Chinese New Year, or simply enjoying some time off, almost everyone has been celebrating – us too! Now we’re taking a moment to celebrate these awesome open source projects that shipped major version releases during December and […] ⌘ Read more
The technology behind GitHub’s new code search
A look at what went into building the world’s largest public code search index. ⌘ Read more
How to mitigate OWASP vulnerabilities while staying in the flow
Explore how GitHub Advanced Security can help address several of the OWASP Top 10 vulnerabilities ⌘ Read more
Ludum Dare 52 staff picks 🕹
We’ve got ten top games from the latest Ludum Dare game jam plus source code for you to check out. Pun intended. ⌘ Read more
Europe’s chance to be a leader in the age of AI
Below are my prepared remarks delivered at the EU Open Source Policy Summit in Brussels on Feb 3rd. ⌘ Read more
How the GitHub Docs team uses GitHub Projects
Explore how the GitHub Docs team uses GitHub Projects for content coordination, reviews, and publishing. ⌘ Read more
Enabling branch deployments through IssueOps with GitHub Actions
What if developers want to leverage branch deployments but don’t have a full ChatOps stack integrated with their repositories? We wanted to set out to find a way for all developers to be able to take advantage of branch deployments with ease, right from their GitHub repository, and so the branch-deploy Action was born! ⌘ Read more
Announcing the launch of the All In for Maintainers DEI Resource Hub
The DEI Resource Hub is a vetted collection of resources, tools, and best practices designed to help open source maintainers create and maintain inclusive and diverse open source communities. ⌘ Read more
Open source’s impact on the world’s 100 million developers
We’re taking a look at how open source software has evolved on GitHub, and how the role of a maintainer and contributor has changed alongside the massive growth in open source software. ⌘ Read more
GitHub Availability Report: January 2023
In January, we experienced two incidents, one that resulted in degraded performance for Packages and Pages and another that impacted Git users. ⌘ Read more
Skilling for the future: How GitHub is advancing diversity, equity, and inclusion within open source communities
In the coming months, we’re scaling, expanding, and launching new programming to further DEI within open source communities. ⌘ Read more
Action needed for GitHub Desktop and Atom users
Update to the latest version of Desktop and previous version of Atom before February 2. ⌘ Read more
Bypassing OGNL sandboxes for fun and charities
Object Graph Notation Language (OGNL) is a popular, Java-based, expression language used in popular frameworks and applications, such as Apache Struts and Atlassian Confluence. Learn more about bypassing certain OGNL injection protection mechanisms including those used by Struts and Atlassian Confluence, as well as different approaches to analyzing this form of protection so you can harden similar systems. ⌘ Read more
Setting the foundations for compliance
Laying the groundwork for developer-enabled compliance. ⌘ Read more
100 million developers and counting
There are now 100 million developers around the world using GitHub. Here’s what this means—and why it’s just the beginning. ⌘ Read more
Introducing the GitHub Bug Bounty swag store
We’re excited to share the newest addition to our GitHub Bug Bounty Program! ⌘ Read more
Pwning the all Google phone with a non-Google bug
It turns out that the first “all Google” phone includes a non-Google bug. Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. Join me on my journey through reporting the vulnerability to the Android security team, and the exploit that used this vulnerability to gain arbitrary kernel code execution and root on a Pixel 6 from an Android app. ⌘ Read more
Unpacking the value of open source and code collaboration
We’re more excited than ever about what the future holds and the role open source will continue to play in solving critical societal challenges. ⌘ Read more
Sunsetting Subversion support
On January 8, 2024, GitHub will remove support for Subversion. ⌘ Read more
Bringing GitHub Actions to GitHub Mobile
How to tap into the power of GitHub Actions from anywhere with GitHub Mobile! ⌘ Read more
Unlocking security updates for transitive dependencies with npm
How Dependabot integrated with npm to address security vulnerabilities on transitive dependencies and increase the likelihood of success for JavaScript security updates by 40%. ⌘ Read more
How GitHub coordinates product releases with GitHub Projects and GitHub Actions
When teams work cross-functionally, good things happen. See how our teams use GitHub Projects to coordinate and ship new products and features. ⌘ Read more
Remediation made simple: Introducing new validity checks for GitHub tokens
GitHub now tells you whether GitHub tokens found by secret scanning are active so you can prioritize and escalate remediation efforts. ⌘ Read more
Dependabot alerts are now visible to more developers
Default settings will allow developers with write and maintain access to see and resolve Dependabot alerts. ⌘ Read more
Git security vulnerabilities announced
Git users are encouraged to upgrade to the latest version, especially if they use `git archive`, work in untrusted repositories, or use Git GUI on Windows. ⌘ Read more
3 common DevOps antipatterns and cloud native strategies that can help
Explore how GitHub and cloud native strategies can help you address common DevOps pipeline and team antipatterns. ⌘ Read more
Game Off 2022 winners 🏆
All of the winners and some of the best games from Game Off 2022. ⌘ Read more
New GitHub CLI extension tools
Support for GitHub CLI extensions has been expanded with new authorship tools and more ways to discover and install custom commands. Learn how to write powerful extensions in Go and find new commands to install. ⌘ Read more
A smarter, quieter Dependabot
Dependabot is getting a little smarter—and, a little quieter—by reducing bot-based noise from repositories based on your interaction with Dependabot. ⌘ Read more
Passwordless deployments to the cloud
Discovering passwords in our codebase is probably one of our worst fears. But what if you didn’t need passwords at all, and could deploy to your cloud provider another way? In this post, we explore how you can use OpenID Connect to trust your cloud provider, enabling you to deploy easily, securely and safely, while minimizing the operational overhead associated with secrets (for example, key rotations). ⌘ Read more
Introducing required workflows and configuration variables to GitHub Actions
Now, you can standardize and enforce CI/CD best practices across all repositories in your organization to reduce duplication and secure your DevOps processes. ⌘ Read more