Best of GitHub — May 2026

1. 1
   Article

   The Githubers·13w

   GitHub Copilot is officially DEAD (and my wallet almost died with it)!

   GitHub is transitioning from a flat monthly fee to a usage-based 'AI Credits' billing model starting June 2026, ending the $10/month unlimited plan. A simulation using GitHub's official billing preview tool shows one developer's costs jumping from ~$105/month to ~$2,757/month under the new model — a $2,650+ increase for identical usage. The shift is attributed to the financial unsustainability of flat-rate pricing as AI agents that analyze entire codebases become more common. Heavy users, indie developers, and small agencies are expected to be hit hardest.

   289

   124
2. 2
   Article

   LeadDev·16w

   What’s gone wrong at GitHub?

   GitHub's reliability has deteriorated sharply, with 257 incidents tracked between May 2025 and April 2026, including 48 major outages. GitHub Actions alone suffered 57 outages in that period. The root cause, per GitHub's CTO, is the explosive growth of agentic AI workflows demanding 30x the platform's designed capacity. High-profile users like Mitchell Hashimoto (Ghostty) and the Zig project have migrated away. Compounding the scaling crisis are engineering failures like an incomplete feature flag that silently reverted thousands of merged pull requests. Microsoft's absorption of GitHub into its CoreAI org and commercial pressure around Copilot are seen as contributing factors. GitHub has declared an 'availability first' mandate, but community patience is running thin as comparable platforms like GitLab and npm handle the same AI-driven growth without comparable disruptions.

   211

   19
3. 3
   Article

   Collections·14w

   GitHub confirms internal repository breach via poisoned VS Code extension

   A malicious version of the Nx Console VS Code extension (v18.95.0) was live on the Visual Studio Marketplace for 11–18 minutes on May 18, 2026, long enough for a GitHub employee with auto-update enabled to have their credentials stolen. The breach gave attackers (TeamPCP/UNC6780) access to roughly 3,800 internal GitHub repositories. The attack chain started a week earlier with a compromised TanStack npm package that stole a contributor's GitHub CLI token, which was then used to publish the backdoored extension. The payload targeted GitHub, npm, AWS/GCP, SSH, and Vault credentials, exfiltrating data over HTTPS and DNS tunneling. GitHub confirmed no customer data was affected. TeamPCP has a documented history of rapid supply chain attacks against developer infrastructure. The incident highlights systemic weaknesses in the VS Code Marketplace: no security review, no kill-switch for installed versions, default auto-update, and broad extension permissions. Developers who had Nx Console installed around that date should rotate all credentials and audit repository activity.

   203

   33
4. 4
   Article

   It's Foss·16w

   Go Away Microsoft! The Netherlands is Quietly Building Its Own GitHub Replacement

   The Netherlands is building a sovereign, self-hosted Git platform for government source code using Forgejo, a fully open source forge licensed under GPLv3+. GitHub was ruled out for being proprietary, and GitLab for its open-core model. The platform, code.overheid.nl, soft-launched on April 24, 2026, and is already hosting repositories from the Dutch Electoral Council, the Ministry of the Interior, and several municipalities. Still in pilot phase, it aims to reduce duplicate development across agencies and give the government full control over its infrastructure.

   199

   22
5. 5
   Article

   Drew DeVault·15w

   I can't cancel GitHub Copilot

   Drew DeVault shares a frustrating experience trying to cancel a free GitHub Copilot subscription obtained through a FOSS community program. Despite never using the tool after a brief 15-minute test, he receives monthly renewal emails and cannot find any way to cancel the subscription in GitHub settings. GitHub support has also been unhelpful in resolving the issue.

   150

   18
6. 6
   Article

   Hacker News·15w

   Why I'm leaving GitHub for Forgejo

   A developer explains their migration from GitHub to a self-hosted Forgejo instance, driven by concerns about digital sovereignty rather than reliability. Key reasons include GitHub's absorption into Microsoft's CoreAI division (losing independent leadership), the April 2026 opt-out flip for Copilot training data, and unresolvable US jurisdictional risk under FISA 702 and the CLOUD Act. The post details the technical architecture: Forgejo v15 LTS on a single NUC with Postgres and Traefik, plus a hardened CI runner using KVM isolation, gVisor, weekly destructive rebuilds, nftables egress filtering, and scope-bound tokens. The Dutch government's choice of Forgejo for code.overheid.nl is cited as institutional validation. Honest trade-offs are covered: loss of GitHub's social graph, Actions ecosystem friction, no Dependabot (replaced by Renovate), and lack of enterprise support.

   145

   30
7. 7
   Article

   sean goedecke·14w

   How I use LLMs as a staff engineer in 2026

   A staff engineer shares how their LLM usage has evolved over the past 15 months. The biggest shift: AI agents are now good enough to draft entire PRs, investigate most bugs autonomously, handle testing, and assist with local setup tasks. The author now starts every code change by asking an agent to solve it first, then does a single editing pass. They still write all public communications (PR descriptions, ADRs, Slack messages) by hand and carefully review all agent-produced code. The key insight is that the core skill is finding the right balance — delegating as much as possible to agents without over-trusting them on things requiring human judgment or communication.

   98

   7
8. 8
   Article

   Visual Studio Code·16w

   Visual Studio Code 1.120

   VS Code 1.120 (Insiders) release notes covering updates from May 4–7, 2026. Key changes include grouping chat sessions by recency, a context size picker in the model picker, hiding archived chat sessions by default, surfacing GitHub pull request metadata in agent host UI, secure handling of password prompts in chat agent terminal commands (secrets never routed through the model), Copilot CLI plugin discovery, agent terminals respecting user shell preferences, a new customDiffEditorProvider proposed API for extensions, restored ability to copy code from chat edit removal suggestions, a custom snooze duration for inline suggestions, and reduced CSS context when attaching DOM elements to chat.

   90

   1
9. 9
   Article

   Product Hunt·16w

   Your AI agent doesn't know what your senior engineer knew. - KodHau: Tribal Knowledge for AI Agents

   KodHau is an MCP server that injects tribal knowledge from GitHub PR history into AI coding agents before they write code. It surfaces architecture decisions, rejected approaches, and undocumented constraints that typically live only in developers' heads or buried in PR discussions. The founder, a 17-year-old from Kazakhstan, demonstrated its value by using it to fix an 8-month-old bug in the .NET runtime in 7 lines — where a previous attempt took 200 lines and failed. It runs locally, works with Cursor, Claude Code, and any MCP client, and requires a 2-minute setup.

   87

   1
10. 10
    Article

    The Art of Simplicity·14w

    GitHub Copilot Is changing how it bills you

    GitHub Copilot is switching from premium request units (PRUs) to a token-based AI Credits system on June 1, 2026. Base subscription prices remain unchanged, but heavy users of agentic workflows, frontier models, and code review features may see significantly higher costs. GitHub has released a billing preview tool at copilot-billing-preview.github.com where individuals and admins can download a CSV of their usage and project their costs under the new system. Code completions and Next Edit Suggestions remain unlimited. Recommended actions include reviewing model usage, switching to lighter models where appropriate, and setting budget controls before the transition.

    114

    9
11. 11
    Article

    GitHub Blog·15w

    Dungeons & Desktops: Building a procedurally generated roguelike with GitHub Copilot CLI

    A GitHub employee built a terminal roguelike game called GitHub Dungeons as a GitHub CLI extension using Go and GitHub Copilot CLI. The game procedurally generates dungeon layouts from a repository's commit SHA using Binary Space Partitioning (BSP), meaning every codebase produces a unique dungeon that evolves with each commit. The post explains how BSP works for dungeon generation, how the /delegate command in Copilot CLI was used to asynchronously build features via pull requests, and how to install and play the extension. A 'danger mode' pre-commit hook that deletes unsaved work if you lose the game is included as a (strongly discouraged) bonus.

    70
12. 12
    Article

    GitHub Changelog·16w

    GitHub Copilot in Visual Studio Code, April releases

    GitHub Copilot in VS Code shipped four weekly stable releases (v1.116–v1.119) throughout April and early May 2026. Key additions include semantic search across any workspace, a grep-style GitHub repo/org search tool, and an experimental /chronicle feature that lets you query your own chat history. Token usage is reduced via smarter prompt caching and deferred tool loading. Agents now show inline diffs in chat, can read/write to open terminals, and share live browser tabs as context. Bring-your-own-key support expands to Copilot Business and Enterprise, allowing teams to connect OpenAI, Anthropic, Google, OpenRouter, and local models like Ollama. Copilot CLI sessions can be monitored and steered remotely from GitHub.com or the mobile app, and agent debug logs now persist across sessions.

    68

    5
13. 13
    Article

    GitHub Changelog·16w

    Enterprise Live Migrations is now in public preview

    GitHub has launched Enterprise Live Migrations (ELM) in public preview, offering a new way to migrate repositories from GitHub Enterprise Server (GHES) to GitHub Enterprise Cloud with data residency. Unlike traditional migrations requiring code freezes, ELM continuously syncs data so developers can keep working throughout the process, with cutover taking minutes rather than days. It is purpose-built for large monorepos with deep git history and high activity. ELM runs as a CLI-driven service on the GHES appliance and is available in GHES versions 3.17.14+, 3.18.8+, 3.19.5+, and 3.20.2+. It complements the existing GitHub Enterprise Importer (GEI) tool and can be run concurrently with it.

    65
14. 14
    Article

    selfh.st·17w

    Self-Host Weekly (1 May 2026)

    A weekly roundup covering the self-hosting and open source ecosystem. Key highlights include Anthropic's pricing changes affecting Claude Code access, GitHub Copilot moving to usage-based billing, and several projects (BookStack, Ghostty, Endurain) migrating away from GitHub to alternatives. Other notable items: a critical Linux vulnerability disclosure, MinIO archiving its repo again, Fider returning to open source, and the Grimmory digital library platform (a Booklore fork) as the content spotlight. Also includes software updates, video links, and a command-line tip.

    60
15. 15
    Article

    It's Foss·16w

    Typical Microsoft! Turns Out VS Code Was Adding Copilot as a Git Co-Author Without Telling Anyone

    VS Code quietly began adding a 'Co-authored-by: Copilot' trailer to git commits after a pull request in April changed the default value of the git.addAICoAuthor setting from 'off' to 'all'. This meant any user who hadn't manually configured the setting had Copilot credited in their git history — even on commits written entirely without AI assistance. The trailer also appeared when Copilot features were explicitly disabled, and was appended after commit finalization with no chance to review it. A VS Code team member acknowledged the mistake on Hacker News, apologized, and a fix reverting the default back to 'off' has been merged and is expected in VS Code 1.119.

    56

    8
16. 16
    Article

    Career Digest·15w

    Cloudflare cuts 1,100 jobs citing AI, GitHub keeps breaking under agent load

    A roundup of major tech industry news: Cloudflare cut 1,100 jobs (20% of workforce) explicitly attributing the move to AI productivity gains despite record Q1 revenue. GitHub logged 257 incidents over the past year and its CTO revealed the platform needs 30x its designed capacity to handle AI agent workloads. Google DeepMind UK workers voted 98% to unionize after a classified Pentagon AI deal contradicted the company's ethics pledges. Coinbase had a brutal week — layoffs, weak earnings, and a seven-hour outage caused by an AWS thermal failure. Additional items cover Stack Overflow's abandoned redesign, Julia Liuson leaving Microsoft, Oracle's severance dispute, vibe coding security risks (secrets leaked at 2x the rate of human code), junior developer employment down 13%, and the April 2026 tech job market showing a 39% drop in software engineer roles alongside surges in DevOps and ML Engineer positions.

    55
17. 17
    Article

    The Next Web·13w

    Microsoft’s quiet Claude Code retreat and the real cost of enterprise AI

    Microsoft is cancelling most Claude Code licences inside its Experiences and Devices division, redirecting engineers to GitHub Copilot CLI by June 30. The move is framed as toolchain unification but the real driver is cost: agentic AI coding tools consume tokens at a rate that breaks enterprise budget models. Uber's CTO revealed his company burned through its entire 2026 AI coding budget in four months, with individual engineers spending $500–$2,000/month on tokens. The core problem is that token-based pricing behaves like a metered utility, not a per-seat licence — and agentic systems consume more tokens per task with each generation, not fewer. Gartner places generative AI in the trough of disillusionment, with 25% of 2026 AI budgets expected to slip. The analysis argues this signals the end of the experimental 'absorb arbitrary costs for learning' phase, with enterprises moving toward capped budgets, tiered access, and AWS-style billing rather than flat-seat models.

    44

    6
18. 18
    Article

    Career Digest·16w

    AI tool costs spiral out of control, junior developer pipeline hollows out

    AI coding tool costs are spiraling beyond budgets — Uber burned its entire 2026 AI budget by April, GitHub Copilot moves to token-based billing June 1, and some developers are spending $500/day on Claude Code. Meanwhile, entry-level developer hiring is down 67% since 2022, with Microsoft and Anthropic research showing AI tools hurt junior skill development. Actual productivity gains are modest: a DX study across 400+ orgs found only 8% median PR throughput increase despite 65% more AI tool usage, partly because coding is only ~14% of developer time. Chinese courts have ruled AI replacement isn't legal grounds for firing workers, while 78,000 tech workers were laid off globally in early 2026. Additional signals include Google generating 75% of new code via AI, agentic workflow burnout capping productive hours at 4–5/day, and LLMs showing bias toward AI-generated resumes in hiring.

    37

    5
19. 19
    Video

    Hak5·13w

    The GitHub Leak Situation Just Got Worse | Threat Wire

    GitHub faced a severe week of security incidents attributed to threat actor Team PCP. The Megalodon campaign pushed 5,718 malicious commits across 5,561 repositories via compromised personal access tokens, stealing CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code. Hudson Rock analysis found 33% of attacker usernames matched known info-stealer victims. Separately, a GitHub employee downloaded a malicious VS Code extension (NX Console, poisoned via the Tanstack compromise), leading to exfiltration of ~38,000 private internal repos and customer support data. Team PCP is selling the stolen GitHub source code for a minimum of $50,000, hinting at retirement. Additional stories include a CISA contractor's public GitHub repo exposing government credentials, Discord standardizing E2E encryption for calls, and OpenAI partnering with 1Password for AI coding agent credential management.

    47

    2
20. 20
    Article

    ASP.NET Blog·13w

    Doing More with GitHub Copilot as a .NET Developer

    A practical guide for .NET developers on getting more value from GitHub Copilot by matching the right tool surface to the right task. Covers when to use chat (for understanding, planning, and drafting) versus agentic workflows (for multi-step execution and reviewable changes). Includes concrete prompt examples for Visual Studio, VS Code, the Copilot CLI, and the cloud coding agent across common .NET scenarios like refactoring legacy services, generating tests, fixing failing builds, and cross-stack changes. Also outlines habits for writing effective prompts, such as naming constraints, defining scope, and specifying output shape.

    34

    4
21. 21
    Article

    The Pragmatic Engineer·16w

    The Pulse: AI load breaks GitHub – why not other vendors?

    GitHub has been experiencing severe reliability issues, including a data integrity incident affecting 2,092 pull requests, multiple outages causing PRs and issues to disappear, and a critical security vulnerability. GitHub's CTO attributes the problems to a 3.5x increase in load driven by AI agents, compounded by an ongoing migration from own data centers to Azure and 18 years of accumulated tech debt. The company only began planning for a 10x capacity increase in October 2025, later revising the target to 30x. Notably, competitors like GitLab and Bitbucket, as well as other infra vendors experiencing similar AI-driven growth, have not suffered comparable outages — raising questions about how much of GitHub's pain is self-inflicted. Mitchell Hashimoto, founder of HashiCorp, publicly announced he is leaving GitHub after months of daily disruptions. Alternatives discussed include GitLab, Bitbucket, and self-hosted solutions like Forgejo.

    24
22. 22
    Article

    Collections·14w

    CISA contractor left AWS GovCloud credentials and plaintext passwords in a public GitHub repo for six months

    A contractor working for CISA maintained a public GitHub repository named 'Private-CISA' containing plaintext passwords, AWS GovCloud credentials, SSH private keys, authentication tokens, and Kubernetes config files for roughly six months. The repository held ~844 MB of sensitive data with obviously named files. GitGuardian researcher Guillaume Valadon discovered it via automated scanning on May 14, confirmed credentials granted high-privilege access to three AWS GovCloud accounts and CISA's GitHub enterprise org. After responsible disclosure was ignored, journalist Brian Krebs was contacted, and the repo came down within a day — but exposed AWS keys remained valid for 48 more hours, and a critical RSA private key stayed active for days. The contractor had deliberately disabled GitHub's built-in secret scanning and was using a personal account to sync work files. CISA, whose mandate is advising the US government on cybersecurity, has pledged additional safeguards. Basic preventive measures — password managers, separate work/personal accounts, secret scanning, short-lived credentials — would have prevented the incident entirely.

    23

    2
23. 23
    Article

    The Register·14w

    Megalodon chums the waters in 5.5K+ GitHub repo poisonings

    A threat actor dubbed 'Megalodon' has poisoned over 5,500 GitHub repositories in a supply chain attack campaign. The operation targets developers and CI/CD pipelines by injecting malicious code into public repositories, posing significant risks to anyone cloning or depending on affected projects.

    41

    1
24. 24
    Article

    Andrew Nesbitt·16w

    A GitHub for maintainers

    A wishlist for what a next-generation code forge should offer open source maintainers, focused on cross-project coordination rather than single-repo UX improvements. Key proposals include downstream testing (running dependents' test suites against a release candidate, similar to Rust's crater runs), a feed for dependents subscribed by lockfile to receive deprecation notices and CVE alerts, smarter fork network surfacing when upstream projects go quiet, package version distribution stats on repo pages, safer CI defaults with pinned actions and isolated caches, and a forge-run package caching proxy to reduce load on public registries. The author argues GitHub has modeled only the fork relationship while ignoring the dependency relationship, which is now the primary way code is reused.

    18

    1
25. 25
    Article

    DEVCLASS·15w

    GitHub previews Agentic Workflows as part of continuous AI concept

    GitHub has launched a technical preview of Agentic Workflows, a new feature developed with Microsoft Research that runs AI agents automatically inside GitHub Actions. Defined in markdown and compiled to GitHub Actions YAML, these workflows are triggered by repository events like new issues, pull requests, or comments. Supported agents include GitHub Copilot, Claude Code, and OpenAI Codex. Typical use cases include issue triage, documentation updates, test coverage monitoring, and CI failure investigation. The feature is positioned as a complement to traditional CI/CD rather than a replacement, since agentic workflows are non-deterministic. Security is a central concern: workflows run in isolated containers with read-only repo access, internet access restricted by firewall, sanitized user content, and a Safe Outputs subsystem for write operations. GitHub warns the product is in early development and should be used with caution.

    17

    1