GitHub Blog

> Was there some notification of this change sent directly to all github users? I checked email and didn't find any references to the change from github. Same here. No notification email as far as I can find. (Through this might depend on your notification settings? I have mine set to the minimal.) >Is there some other automated system to become aware of changes like this, other than stumbling upon a HN post? Github offer the web changelog, their RSS changelog, and the Twitter account @GHchangelog. These three all relay the same information, and ironically all three missed announcing this important change. Instead they posted a blog post[0] which was not linked at all by the changelogs. So to answer your question: you need to follow all updates on both https://github.blog/changelog AND https://github.blog. [0] https://github.blog/2021-09-01-improving-git-protocol-security-github/

It depends on how you found out what the new key value is. By the sounds of your description, you're fine. But in principle there's more than one way people could proceed from here. If you read the blog post on a verified domain and saw the new key and updated manually, or you deleted the known key and verified the key fingerprint when it warned you about an unknown key, you should be good to go. Here, you trust the people who issue TLS certificates and you trust github to be in control of their domain name, so you can be reasonably confident that the key they advertised on their website is the correct key. If your internet connection was compromised, you would have got an error message when you connected to https://github.blog (because they wouldn't have a certificate from a trusted certificate issuer) or when you connected to the git server (because they wouldn't have the key you just trusted). If you saw the blog post and then removed the old key and told ssh to save the new key it's receiving without checking it matches the value on the webpage, you might have a problem. The connection to github's ssl could have been compromised, and if you just accepted whatever it told you, you have no trusted intermediate to verify that the key is trustworthy. All you know is that each time you connect to github's server hereafter, you're either connecting to a server with the same key (no error), or you're connecting to one that doesn't have the same key (error message). But…

They don't do request based pricing anymore. Its just token based (1 credit = $0.01) plus some bonus credit based on which plan you subscribe. So for example a $39 plan get $70 of credits. https://github.com/features/copilot/plans https://github.blog/changelog/2026-08-06-kimi-k3-is-now-available-in-g…

> We still use GitHub Actions but our monthly bill is now flat because we pay for a server. Caveat here being that GitHub is exploring charging a usage-based fee for self-hosted GitHub Action runners [1]. While they've halted it for now, it's something worth being aware of as you assess your costs. This is probably a drop in the bucket compared to the order of magnitude savings you've described. [1]: https://github.blog/changelog/2025-12-16-coming-soon-simpler-pricing-a…

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://www.githubstatus.com/

> If I clone a repo, I want a pretty limited history for that repo when I clone. If I start to go back in time, spin up a worker to go fetch that stuff from the VCS when I need it. You want blobless clones: git clone --filter=blob:none <url> Gets history and only fetches blobs on demand. Github has a great article on it https://github.blog/open-source/git/get-up-to-speed-with-partial-clone…

It was four years ago that GitHub had major enough outages with their database that they had to issue a press release (https://github.blog/news-insights/company-news/an-update-on-recent-ser… Five months ago I was actually still recommending GitHub. Then a month ago I left the platform, because I couldn't get shit done anymore. The alternatives aren't great. If any VCs wanna send a couple hundred grand my way, I'd be willing to start a GitHub alternative, if only so I could have a not-crappy place to host my own repos.

Github has recently changed the way their status page tracks uptime in the name of "transparency"[0]. "Partial Outages" are now only worth 30% of their duration, and "Degraded Performance" is worth none, so their uptime values are now wildly inflated. [0] https://github.blog/news-insights/company-news/bringing-more-transpare…

Agreed. Good news is GitHub will address that with Immutable Releases https://github.blog/news-insights/product-news/whats-coming-to-our-git… You won't even need to use commit SHA as long as the maintainer follows this approach.

Link to the announcement for anyone else like me who hasn't gotten the email yet: https://github.blog/news-insights/company-news/github-copilot-is-movin… Not really sure why I would stick with Copilot after this, and increasing Sonnet from 1x to 9x for annual subscribers is highway fucking robbery. Very glad I didn't commit myself to an annual plan.

Opus just got killed in Copilot. I always found it great, FWIW. https://github.blog/news-insights/company-news/changes-to-github-copil…

I use Github Copilot because it's what my job provides to me. But 95% of my usage is via OpenCode (which is officially supported [0]), not copilot-cli or their IDE plugins. The rest is autocomplete in the IDE. I actually find it to be a great deal, especially because they charge by request rather than token. So if you provide detailed prompts a lot of work can get done for very little cost. [0] https://github.blog/changelog/2026-01-16-github-copilot-now-supports-o…

No we won’t. Details here https://github.blog/news-insights/company-news/updates-to-github-copil… For users of Free, Pro and Pro+ Copilot, if you don’t opt out then we will start collecting usage data of Copilot for use in model training. If you are a subscriber for Business or Pro we do not train on usage. The blog post covers more details but we do not train on private repo data at rest, just interaction data with Copilot. If you don’t use Copilot this will not affect you. However you can still opt out now if you wish and that preference will be retained if you decide to start using Copilot in the future. Hope that helps.

No its not. 121M repos added on github in 2025, and overall they have 630 million now. There is probably at best 2x increased in output (mostly trash output), but no where near 100x https://github.blog/news-insights/octoverse/octoverse-a-new-developer-…

TypeScript is the most popular programming language on the most popular software hosting platform though, owning the best runtime for that seems like it would fit Pareto's rule well enough: https://github.blog/news-insights/octoverse/octoverse-a-new-developer-…

I am sure I never subscribed to this repo. However I came across https://github.blog/changelog/2025-04-14-sunset-notice-for-automatic-w… which possibly means one of the teams I had actually been a part of is the issue.

> It has done literally nothing to improve anything whatsoever, in any country That’s because of malicious compliance from all the websites/advertisers. I guess that is partly the lawmakers’ fault for not pre-empting that; but much larger blame lies on the industry that refuses to grant user privacy. As an example for a site that followed the intent of the law instead: https://github.blog/news-insights/company-news/updates-to-our-privacy-… Github removed excess tracking so they didn’t need to show a cookie banner and that’s what GDPR’s intent was.

In meantime, I recommend to read their availability reports on their blog, published monthly: https://github.blog/news-insights/company-news/

> GitHub is completely unrecognizable compared to how it was before being gamified and turned into social media. Huh? The whole premise on which Github was founded was that it was "social coding". The phrase was even in the logo in the early days [0]. Social features like stars, following, and the activity feed have been there from very early on. If anything, I feel like Github has become a lot more corporate and enterprisey since getting bought by Microsoft. [0] https://github.blog/wp-content/uploads/2009/02/3e6c0720-b15a-11e4-8bd1…

Looks like a v0.dev competitor. Announcement: https://github.blog/changelog/2025-07-23-github-spark-in-public-previe… Post from Satya with video: https://x.com/satyanadella/status/1948101877486452897 Copilot Pro+ plan quotas according to https://github.com/github-spark/pro-plus: - Up to 375 Spark messages included per month - The option to purchase more Spark messages as you go - 10 active app building sessions at a time - Build an unlimited number of apps - Unlimited manual edits 1 message consumes 4 premium requests.

Would make a great submission to https://github.blog/open-source/for-the-love-of-code-2025/ ;)

More information here (https://github.blog/open-source/git/git-security-vulnerabilities-annou… on the new CVE: > When reading a configuration value, Git will strip any trailing carriage return (CR) and line feed (LF) characters. When writing a configuration value, however, Git does not quote trailing CR characters, causing them to be lost when they are read later on. When initializing a submodule whose path contains a trailing CR character, the stripped path is used, causing the submodule to be checked out in the wrong place. > If a symlink already exists between the stripped path and the submodule’s hooks directory, an attacker can execute arbitrary code through the submodule’s post-checkout hook. Along with a bunch of other git CVEs that are worth a look.

I think you're probably thinking of Copilot Workspace (<https://github.blog/news-insights/product-news/github-copilot-workspac… Copilot Workspace could take a task, implement it and create a PR - but it had a linear, highly structured flow, and wasn't deeply integrated into the GitHub tools that developers already use like issues and PRs. With Copilot coding agent, we're taking all of the great work on Copilot Workspace, and all the learnings and feedback from that project, and integrating it more deeply into GitHub and really leveraging the capabilities of 2025's models, which allow the agent to be more fluid, asynchronous and autonomous. (Source: I'm the product lead for Copilot coding agent.)

Mermaid is also supported in GitHub, GitLab, and IntelliJ. Use it; a diagram is worth a thousand words. https://github.blog/developer-skills/github/include-diagrams-markdown-… https://handbook.gitlab.com/handbook/tools-and-tips/mermaid/ https://plugins.jetbrains.com/plugin/20146-mermaid

> Corporations have been attacking the GPL for decades... So your take on the corporate part is rather disingenuous and ignores much of recent history. Corporations do not like the GPL on its merits, but it's also worth remembering that the GPL is also not that popular compared to MIT among developers. Developers have not been choosing the GPL for new projects. See: https://github.blog/open-source/open-source-license-usage-on-github-co…

It may be worth checking the price and performance numbers; it might be worth running builds on ARM and cross-compiling your x86 binaries (based on https://github.blog/news-insights/product-news/arm64-on-github-actions… claiming 37% cheaper).

I'd rephrase and simplify this article a bit. `git switch` and `git restore` are better alternatives to the `git checkout` command, as they have a lower cognitive overhead and fewer footguns to avoid. Although these commands are marked in the documentation as experimental, they work extremely well in practice. Experimental in this sense means that these may gain or lose behavior over time, not that these commands are unstable for use. As a community, we should use `switch` and `restore` commands rather than `checkout` when documenting / teaching git so that newer users start with a greater ability to reason about how the commands affect their workflow. For more about the introduction of these commands and the details of the above see https://github.blog/open-source/git/highlights-from-git-2-23/#experime…

There's a longer thread here: https://news.ycombinator.com/item?id=42453341 I don't think anyone has directly answered your question, but it might be worth browsing or re-asking there. I also haven't tried Copilot yet but looking at the free plan announcement it seems like it likely depends on how much you're doing as a hobby coder. "Now automatically integrated into VS Code, all of you have access to 2,000 code completions and 50 chat messages per month, simply by signing in with your personal GitHub account. Or by creating a new one. And just last week, we passed the mark of 150M developers on GitHub." https://github.blog/news-insights/product-news/github-copilot-in-vscod… They also mention free unlimited access to Copilot Pro for open source maintainers, students, and educators if you qualify for any of those.

The article mentions Derick Stolee who dig the digging and shipped the necessary changes. If you're interested in git internals, shrinking git clone sizes locally and in CI etc, Derrick wrote some amazing blogs on GitHub blog: https://github.blog/author/dstolee/ See also his website: https://stolee.dev/ Kudos to Derrick, I learnt so much from those!