GitHub news and engineering summaries

Mitchell Hashimoto, a long-time GitHub user and creator of Ghostty, announced that the project will leave GitHub due to recurring infrastructure outages that hinder productivity. Citing frequent downtime for pull requests and GitHub Actions, Hashimoto is planning to migrate independently while maintaining a read-only mirror, emphasizing that the decision stems from a desire to prioritize reliable software development.

A recent VS Code Git extension update enabled 'git.addAICoAuthor' by default, automatically adding 'Co-authored-by: Copilot' trailers to commits. This change faced severe community backlash due to privacy concerns, lack of transparency, and reports of the trailer being injected even when Copilot features were disabled or not used, leading to widespread dissatisfaction among developers.

Slug, a GPU-based font and vector graphics rendering algorithm developed by Eric Lengyel, celebrates its tenth anniversary. The technique renders directly from Bézier curves without precomputed textures. Key improvements include 'dynamic dilation' for precision, while legacy optimizations were removed to simplify shaders. The Slug patent is now dedicated to the public domain, with reference shaders available on GitHub.

A developer received a fake job offer on LinkedIn leading to a malicious GitHub repository. The project contained a backdoor hidden in a test file, triggered during npm install via the prepare script. The recruiter and developer identities were impersonated. The author highlights the importance of sandboxing and using automated tools for security reviews.

GitHub is investigating degraded performance affecting multiple services, including API Requests, Webhooks, Actions, Issues, and Pull Requests. The incident began on August 17, 2026, with an approximate 20% error rate reported across numerous experiences. Updates indicate ongoing investigation, with no resolution announced.

GitHub introduces Stacked PRs, enabling developers to break large code changes into chains of focused, independently reviewable pull requests. Managed via the gh stack CLI and native GitHub UI integration, this system allows for cascading rebases, improved review workflows, and efficient single-click merges, ultimately reducing conflicts and improving code quality through structured, incremental delivery.

A GitHub discussion highlights the humorous behavior of an LLM that impulsively asks to implement a task before being told not to. Users emphasize that providing longer, positive instructions—telling the model what to do rather than what not to do—helps mitigate this 'bias for action' and improves overall performance.

GitHub has launched public preview support for Stacked Pull Requests. This feature allows developers to break large tasks into smaller, dependency-ordered pull requests. Teams can review individual layers in parallel, improve code quality, and merge entire stacks in one operation, significantly reducing friction in complex software development workflows.

Little Snitch for Linux monitors network activity using eBPF technology. It offers a web-based UI to track traffic, manage connectivity rules, and utilize domain-based blocklists. Designed for transparency rather than high-security hardening, it provides visibility into application behavior. Advanced configurations are managed via TOML files, and the source code is hosted on GitHub.

Lore is a centralized, content-addressed version control system utilizing Merkle trees and immutable revision chains. Designed for binary-first storage, it excels in deduplication and efficient, large-scale data management through on-demand hydration. The platform's repositories are publicly available on the Epic Games GitHub for further exploration.

A researcher identified 10,000 GitHub repositories distributing Trojan malware by analyzing commit patterns. These malicious repositories clone legitimate projects and use cyclic commit updates to bypass detection. Despite alerting support, the issue persists at scale, highlighting vulnerabilities in GitHub's automated security filtering and the platform’s role in malware distribution through search indexing.

Researchers discovered that the Bitwarden CLI npm package version 2026.4.0 was compromised through a malicious GitHub Action. The attack, linked to the broader Checkmarx supply chain campaign, harvests GitHub tokens, cloud credentials, and SSH keys. Affected users should rotate all credentials and audit CI/CD pipelines immediately for unauthorized modifications or secondary infections.

A vulnerability in VSCode’s webview security allows for unauthorized GitHub token exfiltration. By exploiting keydown events within webviews, an attacker can trick users into installing malicious extensions via linked repositories. This flaw enables access to private repositories and full code execution. Users are advised to clear browser site data for github.dev to mitigate risks.

GitHub’s August 17 outage lasted 7 hours and 47 minutes, disrupting authentication, GitHub Actions, APIs, pull requests, issues, and Copilot. A Central US infrastructure component failed to scale during peak traffic, causing cascading capacity pressure and retry storms. GitHub is adding hardware, expanding Azure migration, improving observability and rollouts, isolating dependencies, and standardizing retry controls.

On May 11, 2026, TanStack suffered a supply chain attack where 84 malicious package versions were published. Attackers chained GitHub Actions cache poisoning, pull_request_target misuse, and OIDC token theft to bypass CI/CD security. No npm credentials were stolen, but local installations may be compromised. All affected versions were deprecated, and security hardening is underway.

A CISA contractor accidentally exposed highly privileged AWS GovCloud credentials and internal system passwords on a public GitHub repository. The leak included plaintext credentials and software deployment configurations, described as a severe security failure. While the repository was removed, experts warn that the exposure of such internal assets poses significant risks for potential lateral movement and long-term compromise.

On May 19, 2026, the 'atool' npm account was compromised, leading to 637 malicious versions across 317 packages. The attack used the 'Mini Shai-Hulud' toolkit to harvest credentials, hijack AI coding agents, and establish persistent backdoors via GitHub API dead-drops. The payload targeted cloud environments, CI/CD pipelines, and local developer machines through automated, obfuscated Bun scripts.

GitHub is scaling its infrastructure and enhancing reliability to handle the rapid surge in agentic development workflows. To minimize service disruptions, the team is prioritizing system isolation, cloud migration, and performance optimization. Recent incidents involving merge queues and search failures have prompted deeper process improvements and a stronger commitment to transparent incident communication with the developer community.

Microsoft has open-sourced Comic Chat, the 1996 IRC client famous for introducing the Comic Sans font. By transforming text conversations into real-time comic panels with automated characters and expressions, it pioneered visual communication. The source code, written in C++ and MFC, is now available on GitHub for historical study and modernization on modern Windows systems.

Legalize-es is an open-source project that archives Spanish legislation as a Git repository. With over 8,600 laws sourced from the official BOE API, each document is a Markdown file where every amendment is recorded as a Git commit, allowing developers to track legal changes via standard command-line tools.