小红花·文摘

Instead of immediately opening pull requests when newer dependency versions are released, Dependabot now waits three days before suggesting upgrades, thus increasing the likelihood that malicious...

GitHub Introduces Default "Cooldown" Policy for Dependabot Version Updates

InfoQ ·

Disrupting supply chain attacks on npm and GitHub Actions

The GitHub Blog ·

GitHub 热门项目周刊 · 第 21 期 · 2026 年第 31 周

浅时光博客 ·

印度政府要求GitHub在3小时内屏蔽基于蓝牙聊天应用BitChat 理由是无法监管

蓝点网 ·

GitLost is a prompt-injection exploit discovered by Noma Security that tricks GitHub's new Agentic Workflows into leaking private data. By embedding concealed instructions within public GitHub...

Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data

InfoQ ·

受AI冲击GitHub改革漏洞奖励计划大幅度下调奖励金额但升级VIP后奖励翻四倍

蓝点网 ·

GitHub tools are now an installable eve extension

Vercel News ·

Next chapter: Restructuring GitHub’s bug bounty program

The GitHub Blog ·

GitHub redesigned GitHub Issues navigation using a client-side architecture that combines caching, predictive prefetching, and service workers to reduce perceived latency. The approach uses...

GitHub Increased Instant Navigation from 4% to 22% by Rethinking Client Side Architecture

InfoQ ·

使用 GitHub Actions 全自动发布 Safari 扩展

rxliuli blog ·

GitHub 热门项目周刊 · 第 20 期 · 2026 年第 30 周

浅时光博客 ·

跟AI发闹骚学到的 https://github.com/isaacs/github/issues/330 Allowing CORS for the endpoint you mentioned would mean that you could complete this step of the Web flow from a browser: And this would mean...