The GitHub Blog
type: channel
description: Updates, ideas, and inspiration from GitHub to help developers build and design software.
date: 2026-01-06T18:34:23Z
update period: hourly
update frequency: 1
update base: 2000-01-01T12:00+00:00
generator agent: https://wordpress.org/
items: Agentic AI, MCP, and spec-driven development: Top blog posts of 2025
items: Bugs that survive the heat of continuous fuzzing
items: WRAP up your backlog with GitHub Copilot coding agent
items: Strengthening supply chain security: Preparing for the next malware campaign
items: 5 podcast episodes to help you build with confidence in 2026
items: This year’s most influential open source projects
items: The future of AI-powered software optimization (and how it can help your team)
items: Let’s talk about GitHub Actions
items: GitHub Availability Report: November 2025
items: MCP joins the Linux Foundation: What this means for developers building the next era of AI tools and agents

Agentic AI, MCP, and spec-driven development: Top blog posts of 2025
type: item
creator: Natalie Guevara
date: 2025-12-30T17:20:10Z
subject: AI & ML
subject: Developer skills
subject: agentic AI
subject: AI
subject: GitHub Copilot
subject: MCP
subject: Spec-driven development
description: Explore the GitHub Blog’s top posts covering the biggest software development topics of the year. The post Agentic AI, MCP, and spec-driven development: Top blog posts of 2025 appeared first on The GitHub Blog.
encoded: As the editor of the GitHub Blog, I get a front-row seat to everything that’s published here. As we wrap up 2025, I’m marking the occasion by looking back at the most popular blog posts of the year as well as some of my favorite interviews. While AI models were the big topic of 2024, this year saw AI become your coding partner. AI agents and agentic tools were top among our most popular posts of the year. Below, you’ll find some of our biggest announcements of the year, plus some examples of how to use these features. Cozy up at your desk or on your couch, grab a blanket and a mug of coffee, and let’s dive in. Here’s what you read the most in 2025: Agent mode GitHub Copilot agent mode, announced in February, can iterate on its own code, recognize errors, and fix its mistakes in real time, right in your IDE. More simply, it’s a problem solver that understands your intent, builds a solution, and iterates until it gets it right. You also read all about it in our agent mode 101 guide. Here you can learn what agent mode is, how to use it, some common use cases, and how to get started. Coding agent In May, the GitHub Copilot coding agent was announced. Embedded directly into GitHub, the agent starts its work when you, for example, assign a GitHub issue to Copilot or prompt it in VS Code. Coding agent will explore the repository, write code, pass tests, and open a pull request for your review. Agent HQ Wrapping up a year of AI agents, during GitHub Universe in October, GitHub announced an ecosystem for all of your agents to work together. Agent HQ unites all of your agents on a single platform. Coding agents from Anthropic, OpenAI, Google, Cognition, xAI, and more became available directly within GitHub as part of your paid GitHub Copilot subscription. Most read tutorials of 2025 Looking for more ways to use GitHub Copilot? Check out these tutorials, the ones you read the most in 2025: How to write a great agents.md: Lessons from over 2,500 repositories Copilot ask, edit, …

Bugs that survive the heat of continuous fuzzing
type: item
creator: Antonio Morales
date: 2025-12-29T22:01:14Z
subject: Security
subject: Vulnerability research
subject: fuzzing
subject: GitHub Security Lab
subject: open source
description: Learn why some long-enrolled OSS-Fuzz projects still contain vulnerabilities and how you can find them. The post Bugs that survive the heat of continuous fuzzing appeared first on The GitHub Blog.
encoded: Even when a project has been intensively fuzzed for years, bugs can still survive. OSS-Fuzz is one of the most impactful security initiatives in open source. In collaboration with the OpenSSF Foundation, it has helped to find thousands of bugs in open-source software. Today, OSS-Fuzz fuzzes more than 1,300 open source projects at no cost to maintainers. However, continuous fuzzing is not a silver bullet. Even mature projects that have been enrolled for years can still contain serious vulnerabilities that go undetected. In the last year, as part of my role at GitHub Security Lab, I have audited popular projects and have discovered some interesting vulnerabilities. Below, I’ll show three open source projects that were enrolled in OSS-Fuzz for a long time and yet critical bugs survived for years. Together, they illustrate why fuzzing still requires active human oversight, and why improving coverage alone is often not enough. What is fuzz testing? Fuzz testing (or fuzzing) is an automated software testing technique that involves feeding a program random or mutated input values and monitoring it for exceptions or crashes. If you want to learn more on fuzzing, check out our fuzzing101 course. Check out the five step fuzzing workflow below > Gstreamer GStreamer is the default multimedia framework for the GNOME desktop environment. On Ubuntu, it’s used every time you open a multimedia file with Totem, access the metadata of a multimedia file, or even when generating thumbnails for multimedia files each time you open a folder. In December 2024, I discovered 29 new vulnerabilities, including several high-risk issues. To understand how 29 new vulnerabilities could be found in a software that has been continuously fuzzed for seven years, let’s have a look at the public OSS-Fuzz statistics available here. If we look at the GStreamer stats, we can see that it has only two active fuzzers and a code coverage of around 19%. By comparison, a heavily researched project like OpenSSL ha…

WRAP up your backlog with GitHub Copilot coding agent
type: item
creator: Brittany Ellich
date: 2025-12-26T17:56:38Z
subject: AI & ML
subject: GitHub Copilot
subject: agent mode
subject: agentic AI
description: An easy-to-remember acronym, WRAP will help you write effective issues, refine your instructions, and get the most out of Copilot coding agent. The post WRAP up your backlog with GitHub Copilot coding agent appeared first on The GitHub Blog.
encoded: Engineers at GitHub have been using GitHub Copilot coding agent for over a year now, studying through experience where it can help save developers real time and energy. Through our work, we have developed a handy acronym: WRAP, which stands for: W – Write effective issues R – Refine your instructions A – Atomic tasks P – Pair with the coding agent WRAP will help you get the most out of coding agent. For example, you likely have a backlog full of issues that have been tough to prioritize. Perhaps you’ve had to push off some tech debt improvements in favor of shipping a new feature. Or perhaps your development time has been split between fixing customer bugs and larger passion projects. WRAP can help you quickly get up to speed, using coding agent to tackle tasks that you may not have had time for in the past. Write effective issues The first step of WRAP is to make sure you are writing effective issues to assign to GitHub Copilot coding agent. In essence, you are trying to set coding agent up for success by adding context for the agent, just like you would for a new team member. Here are a set of guidelines you should consider: Write an issue as though it’s for someone brand new to the codebase. If you consider what context a newcomer might need, you’re likely to include enough context for the coding agent to complete the task effectively. Craft a descriptive title that explains where the work is being done. One of the best things about the coding agent is that you can assign it as many tasks as you want. But assigning many tasks means you might be juggling a lot of pull request reviews! Make sure your issue title clearly describes the nature of your work and where it occurs so you can keep your agent panel easy to navigate. Add examples of what you want. If you already know what you’d like the coding agent to implement, such as a specific error-handling pattern, include an example in the issue! This additional context will make it much more likely that you’ll get th…

Strengthening supply chain security: Preparing for the next malware campaign
type: item
creator: Madison Oliver
date: 2025-12-23T23:52:08Z
subject: Security
subject: Supply chain security
subject: GitHub Security Lab
subject: npm
subject: supply chain security
description: Security advice for users and maintainers to help reduce the impact of the next supply chain malware attack. The post Strengthening supply chain security: Preparing for the next malware campaign appeared first on The GitHub Blog.
encoded: The open source ecosystem continues to face organized, adaptive supply chain threats that spread through compromised credentials and malicious package lifecycle scripts. The most recent example is the multi-wave Shai-Hulud campaign. While individual incidents differ in their mechanics and speed, the pattern is consistent: Adversaries learn quickly, target maintainer workflows, and exploit trust boundaries in publication pipelines. This post distills durable lessons and actions to help maintainers and organizations harden their systems and prepare for the next campaign, not just respond to the last one. We also share more about what’s next on the npm security roadmap over the next two quarters. Recent Shai-Hulud Campaigns Shai-Hulud is a coordinated, multi-wave campaign targeting the JavaScript supply chain and evolved from opportunistic compromises to engineered, targeted attacks. The first wave focused on abusing compromised maintainer accounts. It injected malicious post install scripts to slip malicious code into packages, exfiltrate secrets, and self-replicate, demonstrating how quickly a single foothold can ripple across dependencies. The second wave, referred to as Shai-Hulud 2.0, escalated the threat: Its ability to self-replicate and spread via compromised credentials was updated to enable cross-victim credential exposure. The second wave also introduced endpoint command and control via self-hosted runner registration, harvesting a wider range of secrets to fuel further propagation, and destructive functionality. This wave added a focus on CI environments, changing its behavior when it detects it is running in this context and including privilege escalation techniques targeted to certain build agents. It also used a multi-stage payload that was harder to detect than the previous wave payload. The shortened timeline between variants signals an organized adversary studying community defenses and rapidly iterating around them. Rather than isolated breaches, the…

5 podcast episodes to help you build with confidence in 2026
type: item
creator: Cassidy Williams
date: 2025-12-23T00:15:00Z
subject: Maintainers
subject: Open Source
subject: GitHub Podcast
subject: open source
description: Looking ahead to the New Year? These GitHub Podcast episodes help you cut through the noise and build with more confidence across AI, open source, and developer tools. The post 5 podcast episodes to help you build with confidence in 2026 appeared first on The GitHub Blog.
encoded: The end of the year creates a rare kind of quiet. It is the kind that makes it easier to reflect on how you have been building, what you have been learning, and what you want to do differently next year. It is also the perfect moment to catch up on the mountain of browser tabs you’ve kept open and podcast episodes you’ve bookmarked. Speaking of podcasts, we have one! (Wow, smooth transition, Cassidy). If you’re looking to level-up your thinking around AI, open source software sustainability, and the future of software, we have some great conversations you can take on the road with you. This year on the GitHub Podcast, we talked with maintainers, educators, data experts, and builders across the open source ecosystem. These conversations were not just about trends or tools. They offered practical ways to think more clearly about where software is headed and how to grow alongside it. If 2026 is about building with more intention, these five episodes are a great place to start. Understand where AI tooling is actually heading If this year left you feeling overwhelmed by the pace of change in AI tooling, you are not alone. New models, new agents, and new workflows seemed to appear every week, often without much clarity on how they fit together or which ones would actually last. Our Unlocking the power of MCP episode slows things down. It introduces the Model Context Protocol (MCP) as a way to make sense of that chaos, explaining how an open standard can help AI systems interact with tools in consistent and transparent ways. Rather than adding to the noise, the conversation gives you a clearer mental model for how modern AI tools are being built and why open standards matter for trust, interoperability, and long-term flexibility. Most importantly, MCP makes building better for everyone. Learn about how the standard works (and you can check out GitHub’s open sourced MCP server, too). Ship smaller, smarter software—faster Not every meaningful piece of software needs a pitch …

This year’s most influential open source projects
type: item
creator: Lee Reilly
date: 2025-12-22T23:48:52Z
subject: Maintainers
subject: Open Source
subject: GitHub Universe
subject: maintainers
subject: open source
subject: open source community
description: From Appwrite to Zulip, Universe 2025’s Open Source Zone was stacked with standout projects showing just how far open source can go. Meet the maintainers—and if you want to join them in 2026, you can now apply for next year’s cohort. The post This year’s most influential open source projects appeared first on The GitHub Blog.
encoded: From Appwrite to Zulip, the Open Source Zone at Universe 2025 was stacked with projects that pushed boundaries and turned heads. These twelve open source teams brought the creativity, the engineering craft, and the “I need to try that” demos that make Universe special. Here’s a closer look at what they showcased this year. If you want to join them in 2026, applications for next year’s Open Source Zone are open now! Appwrite: Backend made simple Appwrite is an open source backend platform that helps developers build secure and scalable apps without boilerplate. With APIs for databases, authentication, storage, and more, it’s become a go-to foundation for web and mobile developers who want to ship faster. <img data-recalc-dims="1" loading="lazy" decoding="async" height="550" width="1024" src="https://github.blog/wp-content/uploads/2025/12/appwrite.png?resize=1024%2C550" alt="Screenshot of Appwrite." class="wp-image-93058" srcset="https://github.blog/wp-content/uploads/2025/12/appwrite.png?w=1600 1600w, https://github.blog/wp-content/uploads/2025/12/appwrite.png?w=300 300w, https://github.blog/wp-content/uploads/2025/12/appwrite.png?w=768 768w, https://github.blog/wp-content/uploads/2025/12/appwrite.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/12/appwrite.png?w=1536 1536w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /> Origin story: Appwrite Appwrite was created in 2019 by Eldad Fux as a side project, and it quickly grew from a weekend project to one of the fastest-growing developer platforms on GitHub, with over 50,000 stars and hundreds of contributors worldwide. <img data-recalc-dims="1" loading="lazy" decoding="async" height="682" width="1024" src="https://github.blog/wp-content/uploads/2025/12/appwrite2.png?resize=1024%2C682" alt="Photo of Appwrite's @divanov11 and @stnguyen90 in the Open Source Zone." class="wp-image-93059" srcset="https://github.blog/wp-content/uploads/2025/12/appwrite2.png?w=1600 1600w, https://github.blog/wp-content/upload…

The future of AI-powered software optimization (and how it can help your team)
type: item
creator: Paull Young
date: 2025-12-12T20:43:37Z
subject: News & insights
subject: Policy
subject: Continuous Efficiency
description: We envision the future of AI-enabled tooling to look like near-effortless engineering for sustainability. We call it Continuous Efficiency. The post The future of AI-powered software optimization (and how it can help your team) appeared first on The GitHub Blog.
encoded: When was the last time you heard someone ask in a standup, “How could we do this more sustainably?” Topics like green software and carbon efficiency are unfortunately rarely at the top of busy development teams’ priority lists. What’s more, there are very few “green software practitioners” out there. But we believe we’re at a unique moment in time where this can all change. The next generation of AI-enabled developer tooling has the opportunity to create near-effortless, always-on engineering for sustainability. The GitHub Next and GitHub Sustainability teams have been collaborating to prove this concept and value through a series of internal and external pilot projects. We call it Continuous Efficiency. Making the case for Continuous Efficiency We believe that once it’s ready for broader adoption, Continuous Efficiency will have the potential to make a significant positive impact for developers, businesses, and sustainability. For developers Digital sustainability and green software are intrinsically aligned to “efficiency,” which is at the core of software engineering. Many developers would benefit from performant software, better standardization of code, change quality assurance, and more. For businesses Building for sustainability has measurable business value, including: Reducing power and resource consumption Increasing efficiency Better code quality Improved user experience Lower costs Despite this, sustainability rarely makes it onto the roadmap, priority list, or even the backlog. But imagine a world in which the codebase could continuously improve itself… <img data-recalc-dims="1" loading="lazy" decoding="async" height="320" width="1024" src="https://github.blog/wp-content/uploads/2025/12/image1_c8a727.png?resize=1024%2C320" alt="A graphic showing Continuous Efficiency = Green Software + Continuous AI" class="wp-image-92828" srcset="https://github.blog/wp-content/uploads/2025/12/image1_c8a727.png?w=1324 1324w, https://github.blog/wp-content/uploads/2025/12…

Let’s talk about GitHub Actions
type: item
creator: Ben De St Paer-Gotch
date: 2025-12-11T17:40:52Z
subject: News & insights
subject: Product
subject: CI/CD
subject: community
subject: GitHub Actions
subject: product feedback
description: A look at how we rebuilt GitHub Actions’ core architecture and shipped long-requested upgrades to improve performance, workflow flexibility, reliability, and everyday developer experience. The post Let’s talk about GitHub Actions appeared first on The GitHub Blog.
encoded: GitHub Actions has grown massively since its release in 2018; in 2025 alone, developers used 11.5 billion GitHub Actions minutes in public and open source projects, up 35% year over year from 2024. At the same time, this has not been without its growing pains, and you’ve made clear to us what improvements matter most: faster builds, improved security, better caching, more workflow flexibility, and rock-solid reliability. Meeting that level of demand first required a deliberate investment in re-architecting the core backend services powering every GitHub Actions job and runner. This was a substantial effort that laid the foundation for the long-term performance, scalability, and feature delivery you’ve been asking for. That new architecture is rolled out, powering 71 million jobs per day and giving us deeper visibility into developer experience across the platform. With that work behind us, we shift our attention back to your top requests for much needed, long-standing quality-of-life improvements. Below, we’ll walk through what we’ve shipped this year, how you can get started with these upgrades today, and what’s coming in 2026. Let’s jump in. Rebuilding the core of GitHub Actions In early 2024, the GitHub Actions team faced a problem. The platform was running about 23 million jobs per day, but month-over-month growth made one thing clear: our existing architecture couldn’t reliably support our growth curve. In order to increase feature velocity, we first needed to improve reliability and modernize the legacy frameworks that supported GitHub Actions. The solution? Re-architect the core backend services powering GitHub Actions jobs and runners. Our goals were to improve uptime and resilience against infrastructure issues, improve performance and reduce internal throttles, and leverage GitHub’s broader platform investments and developer experience improvements. We aimed to scale 10x over existing usage. This effort was a big bet and consumed a significant part of our …

GitHub Availability Report: November 2025
type: item
creator: Jakub Oleksy
date: 2025-12-11T16:03:53Z
subject: Company news
subject: News & insights
subject: GitHub Availability Report
description: In November, we experienced three incidents that resulted in degraded performance across GitHub services. The post GitHub Availability Report: November 2025 appeared first on The GitHub Blog.
encoded: In November, we experienced three incidents that resulted in degraded performance across GitHub services. November 17 16:52 UTC (lasting 2 hours and 16 minutes) On November 17, 2025, from 16:52 to 19:08 UTC, Dependabot was hitting a rate limit in GitHub Container Registry (GHCR) and was unable to complete about 57% of jobs within SLO. To mitigate the issue, we lowered the rate at which Dependabot started jobs and increased the GHCR rate limit. This mitigated the circumstances and led to the resolution of the incident. Longer term, we’re adding new monitors and alerts to help prevent this in the future. November 18 20:30 UTC (lasting 1 hour and 4 minutes) On November 18, 2025, from 20:30 to 21:34 UTC, we experienced failures on all Git operations, including both SSH and HTTP Git client interactions, as well as raw file access. These failures also impacted products that rely on Git operations. The root cause was an expired TLS certificate used for internal service-to-service communication. We mitigated the incident by replacing the expired certificate and restarting impacted services. Once those services were restarted we saw a full recovery. We have updated our alerting to cover the expired certificate, and we are performing an audit of other certificates in this area to ensure they also have the proper alerting and automation before expiration. In parallel, we are accelerating efforts to eliminate our remaining manually managed certificates, ensuring all service-to-service communication is fully automated. November 28 05:59 UTC (lasting 2 hours and 24 minutes) On November 28, 2025, between approximately 05:59 and 08:24 UTC, Copilot experienced an outage affecting the Claude Sonnet 4.5 model. Users attempting to use this model received an HTTP 400 error indicating no model was available until an alternative model was selected. Other models were not impacted. The issue was caused by a misconfiguration deployed to an internal service, which made Claude Sonnet 4.5 erron…

MCP joins the Linux Foundation: What this means for developers building the next era of AI tools and agents
type: item
creator: Martin Woodward
date: 2025-12-09T21:00:13Z
subject: Maintainers
subject: Open Source
subject: agentic AI
subject: agentic workflows
subject: Linux Foundation
subject: MCP
subject: open source
description: MCP is moving to the Linux Foundation. Here's how that will affect developers. The post MCP joins the Linux Foundation: What this means for developers building the next era of AI tools and agents appeared first on The GitHub Blog.
encoded: Over the past year, AI development has exploded. More than 1.1 million public GitHub repositories now import an LLM SDK (+178% YoY), and developers created nearly 700,000 new AI repositories, according to this year’s Octoverse report. Agentic tools like vllm, ollama, continue, aider, ragflow, and cline are quickly becoming part of the modern developer stack. As this ecosystem expands, we’ve seen a growing need to connect models to external tools and systems—securely, consistently, and across platforms. That’s the gap the Model Context Protocol (MCP) has rapidly filled. Born as an open source idea inside Anthropic, MCP grew quickly because it was open from the very beginning and designed for the community to extend, adopt, and shape together. That openness is a core reason it became one of the fastest-growing standards in the industry. That also allowed companies like GitHub and Microsoft to join in and help build out the standard. Now, Anthropic is donating MCP to the Agentic AI Foundation, which will be managed by the Linux Foundation, and the protocol is entering a new phase of shared stewardship. This will provide developers with a foundation for long-term tooling, production agents, and enterprise systems. This is exciting for those of us who have been involved in the MCP community. And given our long-term support of the Linux Foundation, we are hugely supportive of this move. The past year has seen incredible growth and change for MCP. I thought it would be great to review how MCP got here, and what its transition to the Linux Foundation means for the next wave of AI development. Before MCP: Fragmented APIs and brittle integrations LLMs started as isolated systems. You sent them prompts and got responses back. We would use patterns like retrieval-augmented generation (RAG) to help us bring in data to give more context to the LLM, but that was limited. OpenAI’s introduction of function calling brought about a huge change as, for the first time, you could call an…