How to get the security basics right at your organization.
The post 3 strategies to expand your threat model and secure your supply chain appeared first on The GitHub Blog. ⌘ Read more
How to get the security basics right at your organization.
The post 3 strategies to expand your threat model and secure your supply chain appeared first on The GitHub Blog. ⌘ Read more
For this year’s Cybersecurity Awareness Month, the GitHub bug bounty team is excited to feature another spotlight on a talented security researcher who participates in the GitHub Security Bug Bounty Program—@inspector-ambitious!
The post [Cybersecurity spotlight on bug bounty researcher @inspector-ambitious](https://github.blog/2023-10-02-cybersecurity-spotlight-on-bug-bounty-researcher-inspector-a ... ⌘ Read more
Speed up your GitHub Actions jobs on macOS with all new, faster Apple silicon powered M1 macOS larger runner for arm64.
The post Introducing the new, Apple silicon powered M1 macOS larger runner for GitHub Actions appeared first on [The GitHub Blog](ht ... ⌘ [Read more](https://github.blog/2023-10-02-introducing-the-new-apple-silicon-powered-m1-macos-larger-runner-for-github-actions/)
Game Bytes is our monthly series taking a peek at the world of gamedev on GitHub—featuring game engine updates, game jam details, open source games, mods, maps, and more. Game on!
The post Game Bytes · September 2023 appeared first on The GitHub Blog. ⌘ Read more
Gain expertise and insights from top organizations through guided tutorials, boosting productivity, enhancing security, and enabling seamless collaboration.
The post GitHub Learning Pathways: Learn from the best appeared first on The GitHub Blog. ⌘ Read more
GitHub Copilot Chat can help developers create prototypes, understand code, make UI changes, troubleshoot errors, make code more accessible, and generate unit tests.
The post How I used GitHub Copilot Chat to build a ReactJS gallery prototype appeared first on The GitHub Blog. ⌘ Read more
Recently, we’ve been working to make our CI experience better by leveraging the newly released GitHub feature, Actions larger runners, to run our CI.
The post [How GitHub uses GitHub Actions and Actions larger runners to build and test GitHub.com](https://github.blog/2023-09-26-how-github-uses-github-actions-and-actions-larger-runners-to-build-and-test-github-com/ ... ⌘ Read more
Get a sneak peek into the must-attend sessions, speakers, workshops, and GitHub certifications available at our global developer event.
The post Your ultimate guide to the GitHub Universe ‘23 agenda appeared first on The GitHub Blog. ⌘ Read more
In this post, I'll exploit CVE-2023-3420, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
The post Getting RCE in Chrome with incorrect side effect in the JIT compiler appeared first on [The GitHub Blog](ht ... ⌘ [Read more](https://github.blog/2023-09-26-getting-rce-in-chrome-with-incorrect-side-effect-in-the-jit-compiler/)
In this step-by-step tutorial, we’ll dive into how you can become the next open source contributor to the GitHub Classroom CLI, building commands that you can use to improve your workflow as an educator!
The post [Calling all teachers! Learn how to build new commands on the GitHub Classroom CLI](https://github.blog/2023-09-25-calling-all-teachers-learn-how-to-build-new-comma ... ⌘ Read more
The GitHub Security Lab audits open source projects for security vulnerabilities and helps maintainers fix them. Recently, we passed the milestone of 500 CVEs disclosed. Let’s take a trip down memory lane with a review of some noteworthy CVEs!
The post [The GitHub Security Lab’s journey to disclosing 500 CVEs in open source projects](https://github.blog/2023-09-21-the-github-s ... ⌘ Read more
All GitHub.com users can now register a passkey to sign in without a password.
The post Passkeys are generally available appeared first on The GitHub Blog. ⌘ Read more
Explore a universe of data about how the world is building software together on GitHub.
The post Announcing the GitHub Innovation Graph appeared first on The GitHub Blog. ⌘ Read more
All GitHub Copilot for Individuals users now have access to GitHub Copilot Chat beta, bringing natural language-powered coding to every developer in all languages.
The post GitHub Copilot Chat beta now available for all individuals appeared first on The GitHub Blog. ⌘ Read more
Guiding student developers through skill building foundations, a building block in their learning journey with GitHub Education.
The post Introducing Learning Paths on Global Campus appeared first on The GitHub Blog. ⌘ Read more
GitHub Advanced Security for Azure DevOps is now generally available. Enable secret scanning, dependency scanning, and code scanning on your organization directly in Azure DevOps configuration settings.
The post [Announcing general availability of GitHub Advanced Security for Azure DevOps](https://github.blog/2023-09-20-announcing-general-availability-of-github-advanced-security-for- ... ⌘ Read more
Starting today, GitHub Enterprise Importer supports repository migrations from Bitbucket Server and Bitbucket Data Center, and GitHub Actions Importer offers CI/CD migrations from Bitbucket and Bamboo.
The post Switching from Bitbucket Server and Bamboo to GitHub just got easier appeared first on ... ⌘ Read more
Make quick work of alerts with preset and custom rules.
The post Introducing auto-triage rules for Dependabot appeared first on The GitHub Blog. ⌘ Read more
In August, we experienced two incidents that resulted in degraded performance across GitHub services.
The post GitHub Availability Report: August 2023 appeared first on The GitHub Blog. ⌘ Read more
As part of our ongoing commitment to accelerate human progress through Social Impact initiatives, we’re offering students 30-minute, 1:1 micro-mentoring sessions with GitHub employees ahead of Universe.
The post Apply now for GitHub Universe 2023 micro-mentoring appeared first on The GitHub Blog. ⌘ Read more
Learn how GitHub’s CodeQL leveraged AI modeling and multi-repository variant analysis to discover a new CVE in Gradle.
The post CodeQL team uses AI to power vulnerability detection in code appeared first on The GitHub Blog. ⌘ Read more
The team behind GitHub Copilot shares its lessons for building an LLM app that delivers value to both individuals and enterprise users at scale.
The post How to build an enterprise LLM application: Lessons from GitHub Copilot appeared first on The GitHub Blog. ⌘ Read more
Edge computing practitioners answer your questions about when and why to build applications at the edge.
The post Getting started with edge computing appeared first on The GitHub Blog. ⌘ Read more
See how much more you can get out of GitHub Codespaces by taking advantage of the improved processing power and increased headroom the RAM provides.
The post How GitHub reduces costs with upgraded Codespaces appeared first on The GitHub Blog. ⌘ Read more
Rust continues to top the charts as the most admired and desired language by developers, and in this post, we dive a little deeper into how (and why) Rust is stealing the hearts of developers around the world.
The post Why Rust is the most admired language among developers appeared first on The GitHub Blog. ⌘ Read more
Customers using GHES can now ensure secure development is a top priority with enhanced security and compliance controls for their repositories.
The post GitHub Enterprise Server 3.10 is now generally available appeared first on The GitHub Blog. ⌘ Read more
Learn how to optimize your usage of GitHub Projects to plan and track your work from idea to production.
The post 10 things you didn’t know you could do with GitHub Projects appeared first on The GitHub Blog. ⌘ Read more
Game Bytes is our monthly series taking a peek at the world of gamedev on GitHub—featuring game engine updates, game jam details, open source games, mods, maps, and more. Game on!
The post Game Bytes · August 2023 appeared first on The GitHub Blog. ⌘ Read more
Now, you can group multiple version updates in a single pull request.
The post A faster way to manage version updates with Dependabot appeared first on The GitHub Blog. ⌘ Read more
Learn how to leverage templating features in GitHub Codespaces to streamline your project setup, improve consistency, and simplify collaboration within your development team.
The post Unleashing GitHub Codespaces templates to ignite your development appeared first on The GitHub Blog. ⌘ Read more
How GitHub Social Impact is working with nonprofit organizations, employees, and more to create positive, lasting change in global communities.
The post AI-powered impact: GitHub Social Impact’s year ahead appeared first on The GitHub Blog. ⌘ Read more
Another new release of Git is here! Take a look at some of our highlights on what's new in Git 2.42.
The post Highlights from Git 2.42 appeared first on The GitHub Blog. ⌘ Read more
In this post, we'll deep dive into some interesting attacks on mTLS authentication. We'll have a look at implementation vulnerabilities and how developers can make their mTLS systems vulnerable to user impersonation, privilege escalation, and information leakages.
The post mTLS: When certificate authentication is done wrong appeared first on [The Gi ... ⌘ [Read more](https://github.blog/2023-08-17-mtls-when-certificate-authentication-is-done-wrong/)
Get tickets to our global developer and customer event for 30% off during our Super-Early Bird special, only for a limited time.
The post Build for today, transform for tomorrow at GitHub Universe 2023 appeared first on The GitHub Blog. ⌘ Read more
After the last Release Radar, I promised the next one wouldn’t be far away, so here it is. This is the low down on some of the best open source projects that shipped major version updates in July. There’s lots of cool stuff from natural language processing, to APIs, money, and SDKs. I won’t spoil […]
The post Release Radar · July 2023 Edition appeared first on The GitHub Blog. ⌘ Read more
Some best practices and important defenses to prevent common attacks against GitHub Actions that are enabled by stolen personal access tokens, compromised accounts, or compromised GitHub sessions.
The post Hardening repositories against credential theft appeared first on The GitHub Blog. ⌘ Read more
It was another record year for our Security Bug Bounty program! We're excited to highlight some achievements we’ve made together with the bounty community in 2022!
The post Nine years of the GitHub Security Bug Bounty program appeared first on The GitHub Blog. ⌘ Read more
Introducing two new secret scanning push protection features that will enable individual developers to protect all their pushes and organizations to gain insights and trends across their repositories.
The post Enhanced push protection features for developers and organizations appeared first on [The GitH ... ⌘ [Read more](https://github.blog/2023-08-09-enhanced-push-protection-features-for-developers-and-organizations/)
In July, we experienced one incident that resulted in degraded performance across GitHub services.
The post GitHub Availability Report: July 2023 appeared first on The GitHub Blog. ⌘ Read more
Researchers from Purdue and NCSU have found a large number of command injection vulnerabilities in the workflows of projects on GitHub. Follow these four tips to keep your GitHub Actions workflows secure.
The post Four tips to keep your GitHub Actions workflows secure appeared first on The GitHub Blog. ⌘ Read more
GitHub’s design experts share 10 tips and lessons for designing magical user experiences for AI applications and AI coding tools. ⌘ Read more
In the world of software development, collaboration can make the difference between a brittle last-minute release and a reliable, maintainable, pain-free project. Whether you’ve been coding for a day or a decade, your colleagues are there to help strengthen your work. But they can only help if you’ve given them the tools to do so. ⌘ Read more
Today, we’re announcing a private beta of GitHub Copilot with code referencing that includes a filter to detect code suggestions matching public code on GitHub. ⌘ Read more
Learn how you can structure your enterprise to get the most value out of GitHub and provide the best experience for your developers! ⌘ Read more
Learn about how we build containerized services that power microservices on the GitHub.com platform and many internal tools. ⌘ Read more
We're thrilled to announce two major updates to GitHub Copilot Code Complete's AI capabilities that will help developers work even more efficiently and effectively. ⌘ Read more
This blog post describes two security vulnerabilities in Decidim, a digital platform for citizen participation. Both vulnerabilities were addressed by the Decidim team with corresponding update releases for the supported versions in May 2023. ⌘ Read more
GitHub switched to performing merges and rebases using merge-ort. Come behind the scenes to see why and how we made this change. ⌘ Read more
Sharing our coalition paper to inform the final negotiation of the EU AI Act. ⌘ Read more
Game Bytes is our monthly series taking a peek at the world of gamedev on GitHub—featuring game engine updates, game jam details, open source games, mods, maps, and more. Game on! ⌘ Read more
In this step-by-step tutorial, you will learn how to use GitHub Copilot to build an application with OpenAI’s gpt-3.5-turbo model. ⌘ Read more
We’re launching the GitHub Copilot Trust Center to provide transparency about how GitHub Copilot works and help organizations innovate responsibly with generative AI. ⌘ Read more
Repository rules provide an easy, flexible way to define branch protections and ensure consistency in code across repositories. ⌘ Read more
All GitHub Copilot for Business users now have access to a limited GitHub Copilot Chat beta, bringing the power of conversational coding right to the IDE. ⌘ Read more
As a design organization, we have the opportunity to make a significant impact on designing the platform for all developers. How does the emergence of creative AI impact our work? How can we achieve an inclusive experience for a spectrum of all abilities? What does designing for developer happiness look like? ⌘ Read more
With the new Issue Metrics GitHub Action, you can now track and monitor important metrics related to issues, pull requests, and discussions, such as time to first response, time to close, and more! ⌘ Read more
GitHub has identified a low-volume social engineering campaign that targets the personal accounts of employees of technology firms. No GitHub or npm systems were compromised in this campaign. We’re publishing this blog post as a warning for our customers to prevent exploitation by this threat actor. ⌘ Read more
Prompt engineering is the art of communicating with a generative AI model. In this article, we’ll cover how we approach prompt engineering at GitHub, and how you can use it to build your own LLM-based application. ⌘ Read more
It’s been a while since we’ve published our Release Radar. You can blame IRL conferences coming back, getting influenza, and being struck down by the weather. But those are just me problems. While I’ve been down or travelling, the community has been hard at work shipping new releases and new projects. So, we thought we’d […] ⌘ Read more
Navigating the ebb and flow of programming paradigms–from the shifts in the JavaScript ecosystem and TypeScript's rise, to AI's role in advancing accessibility, and strategies for encouraging non-code contributions–tune in to the latest episode of The ReadME Podcast for more. ⌘ Read more
Thanks to DevOps, cloud computing and other industry trends, many organizations are shifting from a product mindset to a service mindset. Here’s how you can implement a service-led strategy. ⌘ Read more
In June, we experienced two incidents that resulted in degraded performance across GitHub services. June 7 16:11 UTC (lasting 2 hours 28 minutes) On June 7 at 16:11 UTC, GitHub started experiencing increasing delays in an internal job queue used to process Git pushes. Our monitoring systems alerted our first responders after 19 minutes. During […] ⌘ Read more
Have your say to protect open source in the EU. ⌘ Read more
Supercharge pull request merges on your busiest branches by enabling your team to queue. ⌘ Read more
Passkeys are now available in public beta. Opting in lets you upgrade security keys to passkeys, and use those in place of both your password and your 2FA method. ⌘ Read more
Passkeys are now available in public beta. Opting in lets you upgrade security keys to passkeys, and use those in place of both your password and your 2FA method. ⌘ Read more
Level up your use of GitHub Projects on the command line and in GitHub Actions with the new project CLI command. ⌘ Read more
Reduce developer and auditor friction involved in demonstrating compliance and maintaining end-to-end traceability by focusing your efforts around the pull request. ⌘ Read more
A look at how we improved the readability of code on GitHub. ⌘ Read more
Deciding whether or not to adopt a tool can be hard enough, but what about when it seems to break the paradigms you know? ⌘ Read more
GitHub’s Information Security and Privacy Management System (ISPMS) has been certified against ISO/IEC 27701:2019 (PII Processor) and 27018:2019 standards, as well as the Cloud Controls Matrix (CCM). These standards and frameworks are internationally recognized for security and privacy program best practices. ⌘ Read more
SELinux is the most popular Linux Security Module used to isolate and protect system components from one another. Learn about different access control systems and Linux security as I introduce the foundations of a popular type system. ⌘ Read more
Developer experience (DevEx) is a key theme when it comes to transforming businesses with GitHub. ⌘ Read more
Game Bytes is our monthly series taking a peek at the world of gamedev on GitHub—featuring game engine updates, game jam details, open source games, mods, maps, and more. Game on! ⌘ Read more
GitHub Enterprise Server 3.9 is now generally available. Organizations can now take advantage of more features that enable deeper collaboration, greater observability and faster workflows. ⌘ Read more
Today at Collision Conference we unveiled breaking new research on the economic and productivity impact of generative AI–powered developer tools. The research found that the increase in developer productivity due to AI could boost global GDP by over $1.5 trillion. ⌘ Read more
Introducing a new tool to monitor and control the permissions of the repository token for GitHub Actions. ⌘ Read more
Highlighting 13 of the top games plus source from the latest Gamedev.js jam–by GitHub Star and event organizer, Andrzej Mazur. ⌘ Read more
Explore the impact of non-code contributions—and why they are often undervalued, the challenges of using open source in regulated environments, and the art of managing projects at the scale of Kubernetes, now on The ReadME Podcast. ⌘ Read more
The new GitHub Code View brings users many new features to improve the code reading and exploration experiences, and we overcame a number of unique technical hurdles in order to deliver those features without compromising performance. ⌘ Read more
In this prompt guide for GitHub Copilot, two GitHub developer advocates, Rizel and Michelle, will share examples and best practices for communicating your desired results to the AI pair programmer. ⌘ Read more
The United States Patent and Trademark Office (USPTO) recently proposed rule changes that will make it harder to challenge low quality patents. Without the ability to quickly and efficiently challenge wrongly granted patents, innovation and developers suffer. ⌘ Read more
GitHub’s redesigned navigation is enabled for all users as a public beta. ⌘ Read more
Learn the basics of CodeQL and how to use it for security research! In this blog, we will teach you how to leverage GitHub’s static analysis tool CodeQL to write custom CodeQL queries. ⌘ Read more
In May, we experienced four incidents that resulted in degraded performance across GitHub services. This report also sheds light into three April incidents that resulted in degraded performance across GitHub services. ⌘ Read more
We surveyed 500 U.S.-based developers at companies with 1,000-plus employees about how managers should consider developer productivity, collaboration, and AI coding tools. ⌘ Read more
GitHub’s VIP Bug Bounty Program has been updated to include a clear and accessible criteria for receiving an invitation to the program and more. Learn more about the program and how you can become a Hacktocat, and join our community of researchers who are contributing to GitHub’s security with fun perks and access to staff and beta features! ⌘ Read more
We surveyed 500 U.S.-based developers at companies with 1,000-plus employees about how managers should consider developer productivity, collaboration, and AI coding tools. ⌘ Read more
The accessibility-alt-text-bot leaves automated reminders in a comment when a user shares an image without providing meaningful alt text. ⌘ Read more
With GitHub Enterprise Importer, you can seamlessly move to GitHub Enterprise Cloud, bringing your code and collaboration history with you so your team doesn’t miss a beat. ⌘ Read more
Maintainer Month is a time for open source maintainers to gather, share, and be celebrated. Over 31 days, 16 organizations came together to offer 42 activities convening and celebrating maintainers. ⌘ Read more
Explore how investing in a better developer experience frees developers to do what matters most: building great software. ⌘ Read more
Take part in All in for Maintainers' new pilot program that helps open source project maintainers highlight ongoing efforts in advancing diversity, equity, and inclusion within their communities. ⌘ Read more
We’ve launched the beta of code scanning support for Swift. This launch, paired with our launch of Kotlin support in November, means that CodeQL covers both IOS and Android development languages, bringing a heightened level of security to the mobile application development process. ⌘ Read more
A tool to help you keep your open source catalog organized and up to date. ⌘ Read more
Could we use our Git repository as the source of truth for operational tasks, and somehow reconcile changes with our real-world view? ⌘ Read more
Experts explain how to recruit and onboard co-maintainers. ⌘ Read more
The open-source Git project just released Git 2.41. Take a look at our highlights on what’s new in Git 2.41. ⌘ Read more
Help quantify the state of enterprise open source by taking the 2023 OSPO survey. ⌘ Read more
In this blog, I’ll look at CVE-2022-46395, a variant of CVE-2022-36449 (Project Zero issue 2327), and use it to gain arbitrary kernel code execution and root privileges from the untrusted app domain on an Android phone that uses the Arm Mali GPU. I’ll also explain how root cause analysis of CVE-2022-36449 led to the discovery of CVE-2022-46395. ⌘ Read more