Meet the GitHub Universe hosts, and start building your schedule
We sat down with Universe hosts Lorena Mesa and Jarryd McCree for a quick Q&A to help you make the most out of your conference experience this year.
💾 Save the date for GitHub Game Off 2021
Game Off is an annual game jam (or “hackathon for building games”) that’s a little different from most—it lasts for the entire month of November—not just a weekend or a…
Student developer resources you won’t find in the classroom
Heading back to school? Did you just graduate? The GitHub Education Stream Team (GEST) is sharing resources, tools, and more to help emerging developers land a job.
Apply now for GitHub Universe 2021 micro-mentoring
As part of our ongoing commitment to ensure GitHub’s conferences are accessible and inclusive to people from all walks of life, we’re offering 30-minute, 1:1 micro-mentoring sessions with GitHub employees.
GitHub security update: revoking weakly-generated SSH keys
On September 28, 2021, we received notice from the developer Axosoft regarding a vulnerability in a dependency of their popular git GUI client – GitKraken. An underlying issue with a dependency, called `keypair`, resulted in the GitKraken client generating weak SSH keys.
Release Radar
The Northern Hemisphere has hit fall, and the southern is starting to warm into summer. September has been a busy time for our community. Maintainers have been getting their repositories…
GitHub’s guide to Hacktoberfest 2021
Giving back to open source projects is a great way to practice skills you don’t get to use in your day job. Check out ways to get involved!
GitHub Advisory Database now powers npm audit
Today, we’re adding a proxy on top of the GitHub Advisory Database that speaks the `npm audit` protocol. This means that every version of the npm CLI that supports security audits is now talking directly to the GitHub Advisory Database.
13 tiny and terrific entries from the js13kGames competition
If you think about it, 13kB isn’t really a lot. The image above is 81kB. This page weighs over 3MB (waaay more if you include the videos). That’s why it’s…
A new public beta of GitHub Releases: How we’re improving the release experience
GitHub Releases has a new look and updated tools to make it easier for open source communities to create and share high-quality releases with auto-generated release notes.
Cybersecurity spotlight on bug bounty researchers @chen-robert and @ginkoid
GitHub’s bug bounty team is excited to kick off Cybersecurity Awareness Month with a spotlight on two security researchers who participate in the GitHub Security Bug Bounty Program.
Enterprise managed users are now generally available for GitHub Enterprise Cloud
Manage your company in the cloud with more control and governance using enterprise managed users.
The fugitive in Java: Escaping to Java to escape the Chrome sandbox
In this post, I’ll exploit a use-after-free (CVE-2021-30528) in the Chrome browser process that I reported to escape the Chrome sandbox. This is a fairly interesting bug that shows some of the subtleties involved in the interactions between C++ and Java in the Android version of Chrome.
GitHub Enterprise Server 3.2 is now generally available
This release brings over 70 new features and changes that improve developer experience and deliver new security capabilities.
Revised enterprise DPA with new standard contractual clauses
As part of GitHub’s strong commitment to developer privacy, we are excited to announce updates to our privacy agreements in line with new legal requirements and our own robust data protection practices.
Chrome in-the-wild bug analysis: CVE-2021-30632
This post is a technical analysis of a recently disclosed Chrome JIT vulnerability (CVE-2021-30632) that was believed to be exploited in the wild. This vulnerability was reported by an anonymous researcher and was patched on September 13, 2021 in Chrome version 93.0.4577.82. I’ll cover the root cause analysis of the bug, as well as detailed exploitation.
Partitioning GitHub’s relational databases to handle scale
In 2019, to meet GitHub’s growth and availability challenges, we set a plan in motion to improve our tooling and ability to partition relational databases.
Announcing npm’s new access token format
npm access tokens will now follow the established format of GitHub authentication tokens.
GitHub Advisory Database now supports Rust
We’re excited to announce that the GitHub Advisory Database now includes curated security advisories on the Rust ecosystem!
Apache Dubbo: All roads lead to RCE
During an audit of Apache Dubbo v2.7.8 source code, I found multiple vulnerabilities enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers. In this blog post I detailed how I leveraged CodeQL as an audit oracle to help me find these issues.
Audit log streaming is now in public beta
If you’re a GitHub Enterprise Cloud customer, you can now set up a stream of audit log and Git events to Splunk or an Azure Event Hub.
The ReadME Project: A look back at the community stories that shape us
In August of 2020, we started highlighting stories that showcase how developers, maintainers, and organizations are moving humanity forward through The ReadME Project.
What’s new from GitHub Changelog? August 2021 Recap
What did we ship in August? Codespaces, Discussions, and lots of other updates, from the general availability of the dark high contrast theme to an auto-generated table of contents for wikis.
Announcing recipients of the GitHub Open Source Grants and GitHub Sponsors now open in India
Announcing recipients of the GitHub Open Source Grants and opening of GitHub Sponsors in India.
GitHub Enterprise Server 3.2 brings new color modes and added security capabilities
GitHub Enterprise Server 3.2 is available today as a release candidate.
An analysis on developer-security researcher interactions in the vulnerability disclosure process
We put out a call to open source developers and security researchers to talk about the security vulnerability disclosure process. Here’s what we found.
GitHub security update: Vulnerabilities in tar and @npmcli/arborist
Between July 21, 2021 and August 13, 2021 we received reports through one of our private security bug bounty programs from researchers regarding vulnerabilities in tar and @npmcli/arborist.
Increasing developer happiness with GitHub code scanning
How GitHub uses code scanning to increase developer happiness, and how you can too.
Release Radar
The end of financial year is complete, tax time is over, and everyone is back to shipping awesome projects. During August, our community has been super busy shipping lots of…
Introducing the MLH Fellowship: GitHub Externship Track
Applications are now open for the MLH Fellowship: GitHub Externship Track. Apply by September 13.
GitHub Availability Report: August 2021
In August, we experienced two distinct incidents resulting in significant impact and degraded state of availability for Git operations, API requests, webhooks, issues, pull requests, GitHub Pages, GitHub Packages, and GitHub Actions services.
Improving Git protocol security on GitHub
We’re changing which keys are supported in SSH and removing unencrypted Git protocol. Only users connecting via SSH or git:// will be affected. If your Git remotes start with https://, nothing in this post will affect you. If you’re an SSH user, read on for the details and timeline.
Introducing GitHub Global Campus
Calling all students! Get the most out of your GitHub Education experience by joining the GitHub student community on our new digital campus.
Vague infringement allegations considered harmful
Ensuring that software copyright allegations are specific and actionable benefits the entire developer ecosystem. That’s why GitHub submitted a “friend of the court” brief in the SAS Institute, Inc. v. World Programming Ltd. case before a Federal Court of Appeals.
Request for proposals: Defining standardized GitHub metrics
The GitHub Social Impact and Policy teams are issuing a Request for Proposal (RFP) for a researcher to define a list of publicly available GitHub platform usage metrics by country for international development, public policy and economics disciplines.
30 free and open source Linux games – part 3
With Linux celebrating it’s 30 year anniversary, I thought I’d use that as an excuse to highlight 30 of my favorite free and open source Linux games, their communities, and…
30 free and open source Linux games – part 2
Linux is celebrating its 30-year anniversary, so I’m taking the opportunity to highlight 30 of my favorite free and open source Linux games, their communities, and their stories. I…
2021 Transparency Report: January to June
We’re reporting on a six-month period rather than annually to increase our level of transparency. For this report, we’ve added more granularity to our 2020 stats.
30 free and open source Linux games – part 1
Linux is celebrating its 30-year anniversary today, so I’m taking the opportunity to highlight 30 of my favorite free and open source Linux games, their communities, and their stories! If…
GitHub CLI 2.0 includes extensions!
GitHub CLI 2.0 is now available, making it easy to create and share your own custom commands to make your experience even more powerful.
The npm registry is deprecating TLS 1.0 and TLS 1.1
Beginning October 4, 2021, all connections to npm websites and the npm registry, including for package installation, must use TLS 1.2 or higher.
Enhanced support for citations on GitHub
We’re excited to support researchers and academics on GitHub with enhanced citation support through `CITATION.cff` files.
GitHub Discussions is out of beta
GitHub Discussions is now out of beta, with features that include labels, Discussions GraphQL API and webhooks, and mobile functionality.
Highlights from Git 2.33
The open source Git project just released Git 2.33, with features and bug fixes from over 74 contributors. Here’s a look at some of the most interesting features and changes.
Securing your GitHub account with two-factor authentication
The benefits of multifactor authentication are widely documented, and there are a number of options for using 2FA on GitHub.
What’s new from GitHub Changelog? July 2021 Recap
A public beta for CodeQL package manager, additional options to manage Actions runs from first-time contributors, GitHub Discussions translation, and more.
Seamless teaching and learning through GitHub Classroom and Visual Studio Code
This GitHub Classroom extension for Visual Studio Code provides a simplified introduction to Git, GitHub Classroom, and Visual Studio Code.
GitHub’s Engineering Team has moved to Codespaces
Over the past months, we’ve left our macOS model behind and moved to Codespaces for the majority of GitHub.com development.
August 2021 Campus Experts applications are open!
The GitHub Campus Expert applications are officially open for the August 2021 generation!
Release Radar
It’s been a busy time of the year for our Hubbers (GitHub employees). We’ve been shipping products, getting ready for launches, and taking some much needed time off for the…
15+ new code scanning integrations with open source security tools
Today, we’re happy to announce more than 15 new integrations with open source security tools that broaden our language coverage to include PHP, Swift, Kotlin, Ruby, and more.
Standing up for developers: the GitHub Developer Rights Fellowship at Stanford Law School
GitHub’s Developer Defense Fund will enable independent legal support from the Stanford Juelsgaard Clinic to review and handle appropriate DMCA cases for developers on GitHub and across the software ecosystem.
Minimum Viable Governance: lightweight community structure to grow your FOSS projects
When you move from 1 maintainer to 1+N maintainers of your project, things can get complicated. Minimum Viable Governance (MVG) is a simple, easy-to-implement governance framework for your free and open source projects.
GitHub brings supply chain security features to the Go community
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report, and prevent security vulnerabilities.
Student leaders are taking GitHub Campus TV to the next level
The GitHub Education Stream Team is adding new shows. Job-hunting graduate? New to coding? No matter where you are, there’s a show for you.
What’s new from GitHub Changelog? June 2021 Recap
This month, we have some exciting updates to share. A lot of you have welcomed the improvements to your ability to sync a forked repo with upstream from the web…
Adding support for cross-cluster associations to Rails 7
At GitHub, we recently added a new feature to Rails that will be available in 7.0: support for handling associations across database clusters.
GitHub Copilot research recitation
GitHub Copilot: Parrot or Crow? A first look at rote learning in GitHub Copilot suggestions.
Introducing GitHub Copilot: your AI pair programmer
Today, we’re launching a technical preview of GitHub Copilot, a new AI pair programmer that helps you write better code.
Seven years of the GitHub Security Bug Bounty program
GitHub’s bug bounty program is now a mature component of how we improve product security. We’re excited to highlight some achievements (and interesting vulnerabilities)!
