<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv" -->

---
title: This Week in Source Control: 28 October 2026 | daily.dev
description: This roundup covers two weeks of source control news, from 11 October, now split out from a package management newsletter into its own Wednesday post....
canonical: https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: This Week in Source Control: 28 October 2026 | daily.dev
og:description: This roundup covers two weeks of source control news, from 11 October, now split out from a package management newsletter into its own Wednesday post....
og:url: https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv
og:image: https://api.daily.dev/og/posts/FMPnfLOFv.png
og:image:alt: This Week in Source Control: 28 October 2026
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# This Week in Source Control: 28 October 2026

**[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 8 min read · 0 upvotes · 0 comments

## Summary

This roundup covers two weeks of source control news, from 11 October, now split out from a package management newsletter into its own Wednesday post. Anthropic's new in-house VCS Scion replaced git for its monorepo in five months, handling over 30,000 merges a day with 200x less CPU and memory than its old git mirror fleet. GitHub is moving Git infrastructure to Azure and switching Spokes to per-reference locking for 3-4x write throughput. Enroute's git-on-S3 design claims over 7,600 pushes per second to one repo. Security fixes include four Git LFS CVEs, two critical unauthenticated RCE flaws in GitLab's regex compiler, 13 CVEs in Gitea, and a backdoored OVHcloud CLI release caused by a compromised GitHub account.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://nesbitt.io/2026/10/28/this-week-in-source-control.html>

## Questions this post answers

### What is Anthropic's Scion version control system and why did they build it instead of using git?

Scion is an in-house version control system that replaced git for Anthropic's monorepo, built in five months to handle the scale of coding agent activity. Merges rose from about 2,500 a day in May to over 30,000 a day in September, with roughly 25 million CI checkouts daily. It stores changesets in a write-ahead log on Spanner, runs blame and merge queries server-side, and uses 200 times less CPU and memory than the git mirror fleet it replaced.

_Teams hitting git's scaling limits with agent-driven workloads can track infrastructure rewrites like this one on daily.dev._

### What CVEs were fixed in Git LFS 3.8.1?

Git LFS 3.8.1 fixes four CVEs: unquoted arguments in remote commands sent over SSH, Cookie headers forwarded to other hosts after a redirect, arbitrary program execution from a malicious repository via line feeds in a submodule URL, and arbitrary program execution via a custom transfer adapter set in .lfsconfig. All stem from processing untrusted repository configuration or network data.

_Developers patching git tooling against supply chain risks can follow advisories like these on daily.dev._

### What caused the GitLab unauthenticated remote code execution vulnerabilities patched in October 2026?

Two critical GitLab patches fixed integer overflows in its regular expression compiler that allowed unauthenticated code execution. The first, released October 12, fixed CVE-2026-97229 in CI configuration patterns; a second release on October 21 fixed CVE-2026-110264, affecting every version from 7.0 onward and backported as far as 18.11.13. Both underlying bugs trace back to flaws in Ruby's Onigmo regex engine.

_Admins deciding when to patch GitLab RCE flaws can check severity and backport details on daily.dev._

## Similar posts on daily.dev

- [Redesigning source control at Anthropic](https://daily.dev/posts/redesigning-source-control-at-anthropic-h0zfzbh1m) · Reid Burke · 0 upvotes · 1 comments
- [An online-first version control system in this agentic era](https://daily.dev/posts/an-online-first-version-control-system-in-this-agentic-era-j2oxfrzb2) · Amit Merchant · 27 upvotes · 2 comments
- [Self-Host Weekly \(1 May 2026\)](https://daily.dev/posts/self-host-weekly-1-may-2026--qm77asloy) · selfh.st · 59 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#git](https://daily.dev/tags/git), [#version-control](https://daily.dev/tags/version-control), [#gitlab](https://daily.dev/tags/gitlab)

[View this post on daily.dev](https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"This Week in Source Control: 28 October 2026","url":"https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv"},"datePublished":"2026-10-28T10:39:41.509Z","dateModified":"2026-10-28T14:54:24.028Z","description":"This roundup covers two weeks of source control news, from 11 October, now split out from a package management newsletter into its own Wednesday post....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,git,version-control,gitlab","timeRequired":"PT8M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"This Week in Source Control: 28 October 2026"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-source-control-28-october-2026-fmpnflofv#faq","mainEntity":[{"@type":"Question","name":"What is Anthropic's Scion version control system and why did they build it instead of using git?","acceptedAnswer":{"@type":"Answer","text":"Scion is an in-house version control system that replaced git for Anthropic's monorepo, built in five months to handle the scale of coding agent activity. Merges rose from about 2,500 a day in May to over 30,000 a day in September, with roughly 25 million CI checkouts daily. It stores changesets in a write-ahead log on Spanner, runs blame and merge queries server-side, and uses 200 times less CPU and memory than the git mirror fleet it replaced. Teams hitting git's scaling limits with agent-driven workloads can track infrastructure rewrites like this one on daily.dev."}},{"@type":"Question","name":"What CVEs were fixed in Git LFS 3.8.1?","acceptedAnswer":{"@type":"Answer","text":"Git LFS 3.8.1 fixes four CVEs: unquoted arguments in remote commands sent over SSH, Cookie headers forwarded to other hosts after a redirect, arbitrary program execution from a malicious repository via line feeds in a submodule URL, and arbitrary program execution via a custom transfer adapter set in .lfsconfig. All stem from processing untrusted repository configuration or network data. Developers patching git tooling against supply chain risks can follow advisories like these on daily.dev."}},{"@type":"Question","name":"What caused the GitLab unauthenticated remote code execution vulnerabilities patched in October 2026?","acceptedAnswer":{"@type":"Answer","text":"Two critical GitLab patches fixed integer overflows in its regular expression compiler that allowed unauthenticated code execution. The first, released October 12, fixed CVE-2026-97229 in CI configuration patterns; a second release on October 21 fixed CVE-2026-110264, affecting every version from 7.0 onward and backported as far as 18.11.13. Both underlying bugs trace back to flaws in Ruby's Onigmo regex engine. Admins deciding when to patch GitLab RCE flaws can check severity and backport details on daily.dev."}}]}
```