July 2018 Summaries

Strong authentication credentials are essential for safeguarding GitHub accounts, with a focus on using strong, unique passwords and enabling two-factor authentication (2FA). GitHub is enhancing security by implementing features that encourage users to select non-compromised passwords, utilizing data from the HaveIBeenPwned.com project to identify compromised credentials. Users employing compromised passwords will be prompted to change them during login or registration processes. Additionally, GitHub will periodically remind users with 2FA enabled to review their setup and recovery options to prevent account lockout due to lost credentials. The platform advises the use of cloud-synchronized password managers and authenticator applications to ensure password and 2FA recovery options are securely backed up. GitHub also recommends storing backup codes securely and reviewing other credentials like SSH keys and OAuth authorizations regularly. These measures aim to balance security, usability, and recoverability, and users are encouraged to periodically review and update their account security settings.

Git LFS v2.5.0, the latest release of the open-source Git extension for handling large files, introduces new features including three migration modes, various bug fixes, and enhancements aimed at improving developer ergonomics. The update allows users to efficiently manage repositories with large files, offering commands like `git lfs migrate import` and `git lfs migrate import --fixup` to streamline the process of correctly storing files with Git LFS or fixing repository states. Additionally, users can export large objects using `git lfs migrate export`. The updated version also enhances development tools by adopting the TAP format for test outputs and incorporating a Makefile for building the project, aligning with familiar open-source practices. Improvements such as better support for object alternates and accurate status outputs from subdirectories further enhance functionality. Taylor Blau, a Principal Software Engineer at GitHub, authored the release notes.

The latest update of the Electron-based GitHub Desktop app, version 1.3, introduces features aimed at minimizing complicated merge conflicts by notifying users when their branch diverges from the default branch. This allows users to stay focused on their work without the need to frequently check for updates on the master branch, thereby promoting early and frequent merging. Additionally, the update enhances the ability to track changes across repositories by showing recent activity, uncommitted changes, and unpushed changes without requiring users to individually click into each repository.

Software development teams benefit from using multiple tools to enhance productivity and focus on important tasks, and the integration of Google Cloud Build with GitHub aims to simplify Continuous Integration (CI) by offering fast, reliable builds across all programming languages. This collaboration will allow developers to easily incorporate CI into their GitHub workflows, thanks to the full-managed CI service provided by Google Cloud, ensuring streamlined automation of builds and tests. GitHub's new feature will automatically detect Dockerfiles and recommend using CI tools like Cloud Build if none are set up, reducing the need for context switching and allowing developers to receive comprehensive feedback directly on GitHub. This partnership aligns with both companies' commitment to improving developer productivity and creating an open platform that supports various CI approaches, encouraging developers to leverage GitHub's flexibility and contact the Marketplace team for further platform development opportunities.

On August 7, a Craftwork event will be held at GitHub's San Francisco office, offering a workshop for developers of all skill levels to learn how to use the GitHub API and create their first GitHub App. The event promises a casual and collaborative atmosphere, where participants will receive guidance and support from GitHub staff, use tools like Probot and Glitch, and work at their own pace. Attendees are expected to leave with a functional GitHub App and the skills to continue developing productivity tools for open-source projects or work environments. The event runs from 6-9 pm PT, and participants are encouraged to register, create a GitHub account if they don't have one, and inform the organizers of any dietary restrictions.

GitHub Learning Lab, launched earlier this year to aid users of all skill levels in leveraging GitHub, initially offered courses such as "Introduction to GitHub" and "Managing Merge Conflicts," and has since seen over 3,700 students successfully complete a course. The platform is now expanding with four new courses, including "Uploading to GitHub" and "Migrating to GitHub," which were previously combined under a single course, as well as a "Community Starter Kit" to help projects become more accessible to both veteran and new open source contributors. Additionally, GitHub Learning Lab has introduced its first non-GitHub focused course, "Introduction to HTML," and is now accessible through the GitHub Marketplace, offering users the same experience they had on lab.github.com while providing integrations for repositories.

The GitHub Editor Tools team has released Version 2.5.4 of their GitHub extension for Visual Studio, featuring significant improvements in the user experience, particularly for handling pull requests. The update incorporates the new Octokit.NET library utilizing the GraphQL API, which significantly enhances the performance of listing pull requests by reducing load times from minutes to seconds. Various UI and functional enhancements, such as fixing scrolling issues and preventing redundant browser openings, have been implemented, with contributions from team members and community contributors. The team is also exploring ways to improve navigation between GitHub.com and Visual Studio, such as the ability to open and copy links between the platforms. They encourage user feedback and contributions through open issues, surveys, and participation in usability studies, maintaining an open line of communication on Twitter for updates and user engagement.

Game Bytes' July edition celebrates the Nintendo Entertainment System (NES) legacy in open-source development, highlighting a vibrant "homebrew" scene where developers continue to create NES games using the original 6502 Assembly Language. Featured games include "Super Tilt Bro," inspired by Super Smash Bros, "Pwn Adventure Z," a hackable zombie survival game, "Nova the Squirrel," a platform adventure, "Thwaite," a missile-defense game, "Falling," a coin-collecting challenge, and "Sprilo," a time-attack racing game. The edition also discusses opportunities for developers to engage in projects like contributing to the "SuperTux" platform game or participating in the js13kgames, a JavaScript game development competition. Additionally, the itch.io desktop app is available in open beta, and "Dear Weather Guy," a game utilizing the Open Weather Map API, is highlighted from the recent Godot Community Jam.

GitHub has introduced a GraphQL version of the Octokit.NET library to enhance the integration of GitHub's API within .NET applications, which traditionally used the REST API. This shift to GraphQL, a query language developed by Facebook, allows for the retrieval of comprehensive data with a single request, addressing performance bottlenecks experienced when loading lists of pull requests in Visual Studio. The new library, designed to be intuitive for .NET developers, replicates GraphQL's syntax while maintaining the benefits of static compilation, resulting in significantly improved loading times for pull request lists. The GitHub API v4, now based on GraphQL, is particularly advantageous for .NET developers seeking to incorporate dynamic data retrieval in their applications, and the GitHub for Visual Studio team encourages feedback from the developer community on this new implementation.

Last year, security alerts were introduced to monitor vulnerabilities in Ruby and JavaScript packages, leading to millions of identified vulnerabilities and numerous patches. Building on this success, Python support has now been launched, allowing Python users to access dependency graphs and receive alerts for known security vulnerabilities in their packages. The initial launch includes a limited set of recent vulnerabilities, with plans to expand the database with historical vulnerabilities over the coming weeks. The platform will continuously monitor the NVD feed and other sources to alert users of any newly disclosed Python vulnerabilities. To utilize these alerts, users must ensure that a requirements.txt or Pipfile.lock file is checked into their repositories. Public repositories automatically have the service enabled, while private ones require opting in through settings. Admins receive alerts by default and can add additional recipients or configure notification preferences through their profile settings. More detailed guidance is available in the documentation.

The latest Enterprise 2.14 release introduces several enhancements aimed at improving developer productivity and collaboration by leveraging the power of the open-source community within secure environments. Key features include unified search capabilities for GitHub Business Cloud users, a new Checks API for more detailed status reporting during builds, multiple issue templates for better project organization, and a diff view that filters out white space changes. Project security is enhanced with a requirement for multiple reviewers on pull requests, and administration is streamlined with automated support ticket creation and configurable dormancy thresholds. Additional updates, such as improved project permissions, user hovercards for detailed collaborator information, and a "jump to" navigation feature in the search bar, further enhance user experience and team collaboration.

The Electronic Frontier Foundation (EFF) has shifted its annual "Who Has Your Back Report" focus from government requests for user information to government requests for content takedowns, highlighting increased online censorship efforts. As governments find it challenging to censor content directly due to the prevalence of HTTPS and social media, they increasingly rely on platforms to enforce censorship. EFF evaluates major platforms hosting user-generated content on five criteria, including transparency in reporting takedown requests, user notification and appeals, and geographically limited censorship. GitHub stands out by meeting all criteria, emphasizing transparency, user notification, and minimal censorship to maintain community trust. Companies scoring well in the report are seen as examples of robust content moderation policies, and GitHub aims to contribute to industry best practices by open-sourcing its policies, thereby encouraging startups and other companies to adopt effective content moderation strategies.

GitHub provides a solution for maintainers of open source projects who face challenges in managing communities by offering GitHub Apps, which automate various tasks using GitHub’s REST and GraphQL APIs. Built with the Probot framework, these open source apps are available for free and include tools such as Sentiment Bot, which uses Google's Perspective API to manage toxic comments, Welcome for greeting new users at key interaction points, Stale for automatically closing inactive issues and pull requests, and WIP to prevent premature merging of work-in-progress pull requests. These apps are highly customizable, allowing maintainers to tailor automation to their specific needs, and can be easily installed across designated repositories. For further inquiries or assistance, maintainers can contact GitHub’s support team.

In June, several noteworthy open-source projects released new versions on GitHub, showcasing various enhancements and features. PocketMine-MP 3.0, a server for Minecraft Pocket Edition, improved performance with a new dependency and addressed gameplay bugs. OpenLayers 5.0, a JavaScript library for web maps, enhanced compatibility with module bundlers by removing the Closure Compiler dependency. Neofetch 5.0, a command-line tool for displaying system specs, underwent a significant code rewrite and added support for new operating systems and JSON output. PouchDB 7.0, a browser database syncing with CouchDB, reduced library size by dropping deprecated Web SQL API support and improved sync conflict resolution. ESLint 5.0, a JavaScript static analysis tool, introduced new rules and improvements but included some breaking changes. GitHub for Unity 1.0 integrated GitHub functionalities into the Unity editor with new features like customizable diffing tools. Neural Network Libraries 1.0 enhanced performance and support for Nvidia Tensor Cores, continuing its aim to simplify work with neural networks. These releases highlight ongoing advancements in open-source technology, contributing to diverse fields such as gaming, web development, and data science.

June's GitHub Changelog highlights several updates and new features, including the availability of GitHub Enterprise versions 2.13.4, 2.12.12, 2.11.18, and 2.10.24, along with subsequent versions 2.13.5, 2.12.13, and 2.11.19. Key enhancements include project automation and template changes, a new detail view for project board issues and pull requests, and new API endpoints for finding app installations. The release also announced GitHub for Unity 1.0 and introduced GitHub Desktop v1.2.4. Additionally, Marketplace Apps have been added to search, and Explore and Topics pages, while organization-level temporary interaction limits were introduced. Users can now archive cards in project boards, supported by new API parameters for project card archiving.