github

GitHub froze new Copilot Pro, Pro+, and Student sign-ups on April 20 and announced a June 1 switch to AI Credits, with the Opus 4.7 multiplier rising from 7.5x to 27x.

Intel archived the GitHub repository that anchored its Open Ecosystem Community and Evangelism program on April 20, 2026, and shuttered several community-facing projects — the most visible step in a multi-quarter pullback that began with executive comments last October.

Git 2.54, released April 20, introduces a new history-editing command inspired by Jujutsu, config-based hooks, geometric repacking by default, and a pluggable object database built over two years and roughly 400 commits.

The new public-preview command installs, pins, updates, and publishes portable skills for Copilot, Claude Code, Cursor, Codex, Gemini CLI, and Antigravity — with git-backed provenance and an explicit prompt-injection warning.

The Copilot SDK, now in public preview with support for five languages and bring-your-own-key authentication, exposes the same agent runtime powering GitHub Copilot CLI as a programmable library for building custom AI-driven tools and workflows.

Check Point and BeyondTrust disclose two distinct vulnerabilities in OpenAI products that allowed covert data theft through DNS queries and GitHub token compromise via branch name injection.

GitHub's new opt-out policy lets it use code snippets, prompts, and context from Free, Pro, and Pro+ users to train AI models, drawing sharp criticism from developers who call it a bait-and-switch.

A coordinated supply-chain campaign abused Open VSX extension dependencies and invisible Unicode payloads to compromise developer environments across VS Code and GitHub.

GitHub's Octoverse data and a new academic study show AI coding tools are creating self-reinforcing adoption cycles that favor typed languages, with TypeScript adding over a million contributors in a single year.

The open-source AI agent went from zero to 250,000 GitHub stars in four months, but critical vulnerabilities exposed over 135,000 instances across 82 countries.

From cURL killing its bug bounty to Godot maintainers burning out, the flood of low-quality AI-generated pull requests and security reports is forcing open source communities to fundamentally rethink how contributions are accepted.

Researchers say Git-sourced dependencies can re-enable code execution paths even when npm is run with --ignore-scripts, undermining a widely recommended mitigation after 2025’s Shai-Hulud worm.