1,692 articles from GitHub.
Today we’re introducing enhanced login verification to the npm registry, and we will begin a staged rollout to maintainers beginning Dec 7.
This lesser-known OWASP project aims to help developers prevent vulnerabilities from being introduced in the first place.
GitHub has partnered with the OpenSSF and Project Sigstore to add container image signing to our default “Publish Docker Container” workflow.
The end of the year is getting closer, and our communities are busy working away on their projects. While you’ve all been busy maintaining open source projects and shipping releases,…
In November, we experienced one incident resulting in significant impact and degraded state of availability for multiple services.
You can multiply the impact of your domain experts by building their common workflows into ChatOps.
Are you a student in India? Applications are open for the GitHub Externships Winter Cohort!
From learning YAML to scripting with Bash, here are a few simple tips for developers who want to speed up their workflows.
DRY your Actions configuration with reusable workflows (and more!)
GitHub Actions now supports OpenID Connect for secure deployment to different cloud providers via short-lived, auto-rotated tokens.
OSS-Fuzz is Google’s awesome fuzzing service for open source projects. GitHub Security Lab’s @kevinbackhouse describes enrolling a project.
Recently, the Copyright Office responded to the calls to clarify the scope of protected security research.
The GitHub Services Engineers have released the Advanced Security Enforcer GitHub Action to enable organizations to utilize code scanning in a consistent and automated way.
A recap of all the GitHub Education news from Universe 2021, including the new Intro to Web Dev Experience.
A public beta of the new GitHub Issues, a “security manager” role for organizations, a command palette beta, and lots more.
Check out some advanced automation and CI/CD capabilities you can use today with GitHub Actions on any GitHub account.
In this post, I’ll use three bugs that I reported to Qualcomm in the NPU (neural processing unit) driver to gain arbitrary kernel code execution as root user and disable SELinux from the untrusted app sandbox in an Android phone.
GitHub puts the needs of developers at the core of our content moderation policies. Learn more about our approach and how you can contribute.
All newly created GraphQL objects now have IDs that conform to a new format, which we refer to as “next IDs.” Learn how to migrate older IDs to the new format and why we’re making the change.
The Exiv2 team tightened our security by enabling GitHub’s code scanning feature and adding custom queries tailored to the Exiv2 code base.
The State of the Octoverse analyzes data from millions of developers & repos to share trends across working habits, productivity, and career satisfaction.
We’re sharing details of recent incidents on the npm registry, our investigations, and how we’re continuing to invest in the security of npm.
To celebrate this most recent release, here’s GitHub’s look at some of the most interesting features and changes introduced since last time.
What an incredible month it’s been for GitHub and our communities. Whilst we’ve been busy with GitHub Universe, our communities have been busy coding. It’s been a successful year for…
During Universe, we received a number of security questions ranging from our strategy to our advisories. Here’s what we’ve got planned!
Here are a few ways our teams use GitHub Discussions internally to build community, simplify workflows, and get key insights into our work.
The new sparse index feature makes it feel like you are working in a small repository when working in a focused portion of a monorepo.
This latest release sees the introduction of a new role, a new webhook for GitHub Actions, and a bright edge to dark mode.
When you’re fixing a bug, especially a security vulnerability, you should add a regression test, fix the bug, and find & fix variants.
In October, we experienced one incident resulting in significant impact and degraded state of availability for the GitHub Codespaces service.
Tips on how to get started using GitHub Actions and resources to learn more about making it work for you.
This morning, I shared the following post with Hubbers in response to Nat’s announcement about his next adventure. I am thrilled to take on the role of CEO to build the next phase of GitHub for our global community of software developers.
This morning, I sent the following post to the GitHub team. TL;DR: I’m moving on to my next adventure, and Thomas Dohmke (currently Chief Product Officer) will be GitHub’s next CEO.
This blog post is the first in a series about hardening the security of the Exiv2 project. My goal is to share tips that will help you harden the security of your own project.
The theme for this year’s Game Off is… …BUG! Your challenge, should you choose to accept it, is to create a game between now and December 1 incorporating the theme…
We’re excited to highlight another top contributing researcher to GitHub’s Bug Bounty Program: @yvvdwf
Maintainers can now limit who can approve and request changes on pull requests. You can also close issues and block users via your phone.
It’s that time of year again where I like to share seasonally spooktacular games plus source code—a goldmine of material for (a) those looking for coffee-break entertainment, (b) those interested…
Since last year’s GitHub Universe, we’ve shipped more than 20,000 improvements to GitHub for developers, open source communities, and enterprise teams. Here’s a comprehensive overview of what we’re announcing at Universe this week.
The 49th Ludum Dare game jam just wrapped up with almost 3000 entries. Here’s a peek at some of the highest-rated entries that you can play, plus their source code…
GitHub Actions can automate several common security and compliance tasks, even if your CI/CD pipeline is managed by another tool.
GitHub Marketplace just passed 10,000 published actions! Learn about contributing to this growing open source ecosystem.
In the past two years, GitHub has doubled in size, welcoming more than 760 new Hubbers in 2021 alone. This past year we particularly focused on our goal of making GitHub more equitable. We saw growth in our diversity representation, whose population increased at a higher rate than the company itself.
Catch up on 44 ships, including a colorblind-accessible theme, a public README.md for organizations, and customization of code review settings.
This post is a technical analysis of a recently disclosed Chrome vulnerability in the garbage collector of v8 (CVE-2021-37975) that was believed to be exploited in the wild. This vulnerability was reported by an anonymous researcher and was patched on September 30, 2021 in Chrome version 94.0.4606.71. I’ll cover the root cause analysis of the bug, as well as detailed exploitation.
We sat down with Universe hosts Lorena Mesa and Jarryd McCree for a quick Q&A to help you make the most out of your conference experience this year.
Game Off is an annual game jam (or “hackathon for building games”) that’s a little different from most—it lasts for the entire month of November—not just a weekend or a…
Heading back to school? Did you just graduate? The GitHub Education Stream Team (GEST) is sharing resources, tools, and more to help emerging developers land a job.
As part of our ongoing commitment to ensure GitHub’s conferences are accessible and inclusive to people from all walks of life, we’re offering 30-minute, 1:1 micro-mentoring sessions with GitHub employees.
On September 28, 2021, we received notice from the developer Axosoft regarding a vulnerability in a dependency of their popular git GUI client – GitKraken. An underlying issue with a dependency, called `keypair`, resulted in the GitKraken client generating weak SSH keys.
The Northern Hemisphere has hit fall, and the southern is starting to warm into summer. September has been a busy time for our community. Maintainers have been getting their repositories…
Giving back to open source projects is a great way to practice skills you don’t get to use in your day job. Check out ways to get involved!
Today, we’re adding a proxy on top of the GitHub Advisory Database that speaks the `npm audit` protocol. This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database.
In September, we experienced no incidents resulting in service downtime to our core services.
If you think about it, 13kB isn’t really a lot. The image above is 81kB. This page weighs over 3MB (waaay more if you include the videos). That’s why it’s…
GitHub Releases has a new look and updated tools to make it easier for open source communities to create and share high-quality releases with auto-generated release notes.
GitHub’s bug bounty team is excited to kick off Cybersecurity Awareness Month with a spotlight on two security researchers who participate in the GitHub Security Bug Bounty Program.
Manage your company in the cloud with more control and governance using enterprise managed users.
In this post, I’ll exploit a use-after-free (CVE-2021-30528) in the Chrome browser process that I reported to escape the Chrome sandbox. This is a fairly interesting bug that shows some of the subtleties involved in the interactions between C++ and Java in the Android version of Chrome.
This release brings over 70 new features and changes that improve developer experience and deliver new security capabilities.
