Congratulations!

[Valid RSS] This is a valid RSS feed.

Recommendations

This feed is valid, but interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: https://github.blog/feed/

  1. <?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
  2. xmlns:content="http://purl.org/rss/1.0/modules/content/"
  3. xmlns:wfw="http://wellformedweb.org/CommentAPI/"
  4. xmlns:dc="http://purl.org/dc/elements/1.1/"
  5. xmlns:atom="http://www.w3.org/2005/Atom"
  6. xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
  7. xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
  8. >
  9.  
  10. <channel>
  11. <title>The GitHub Blog</title>
  12. <atom:link href="https://github.blog/feed/" rel="self" type="application/rss+xml" />
  13. <link>https://github.blog/</link>
  14. <description>Updates, ideas, and inspiration from GitHub to help developers build and design software.</description>
  15. <lastBuildDate>Thu, 10 Jul 2025 17:38:15 +0000</lastBuildDate>
  16. <language>en-US</language>
  17. <sy:updatePeriod>
  18. hourly </sy:updatePeriod>
  19. <sy:updateFrequency>
  20. 1 </sy:updateFrequency>
  21. <generator>https://wordpress.org/?v=6.8.1</generator>
  22.  
  23. <image>
  24. <url>https://github.blog/wp-content/uploads/2019/01/cropped-github-favicon-512.png?fit=32%2C32</url>
  25. <title>The GitHub Blog</title>
  26. <link>https://github.blog/</link>
  27. <width>32</width>
  28. <height>32</height>
  29. </image>
  30. <site xmlns="com-wordpress:feed-additions:1">153214340</site> <item>
  31. <title>Modeling CORS frameworks with CodeQL to find security vulnerabilities</title>
  32. <link>https://github.blog/security/application-security/modeling-cors-frameworks-with-codeql-to-find-security-vulnerabilities/</link>
  34. <dc:creator><![CDATA[Kevin Stubbings]]></dc:creator>
  35. <pubDate>Thu, 10 Jul 2025 17:38:14 +0000</pubDate>
  36. <category><![CDATA[Application security]]></category>
  37. <category><![CDATA[Security]]></category>
  38. <category><![CDATA[CodeQL]]></category>
  39. <category><![CDATA[GitHub Security Lab]]></category>
  40. <category><![CDATA[security research]]></category>
  41. <guid isPermaLink="false">https://github.blog/?p=89417</guid>
  42.  
  43. <description><![CDATA[<p>Discover how to increase the coverage of your CodeQL CORS security by modeling developer headers and frameworks.</p>
  44. <p>The post <a href="https://github.blog/security/application-security/modeling-cors-frameworks-with-codeql-to-find-security-vulnerabilities/">Modeling CORS frameworks with CodeQL to find security vulnerabilities</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  45. ]]></description>
  46. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  47. <html><body><p>There are many <a href="https://github.blog/security/application-security/localhost-dangers-cors-and-dns-rebinding/">different types of vulnerabilities</a> that can occur when setting up CORS for your web application, and insecure usage of CORS frameworks and logic errors in homemade CORS implementations can lead to serious security vulnerabilities that allow attackers to bypass authentication. What&rsquo;s more, attackers can utilize CORS misconfigurations to escalate the severity of other existing vulnerabilities in web applications to access services on the intranet.</p>
  48.  
  49.  
  50.  
  51. <figure class="wp-block-image size-large"><img data-recalc-dims="1" fetchpriority="high" decoding="async" height="847" width="1024" src="https://github.blog/wp-content/uploads/2025/07/cors1.jpg?resize=1024%2C847" alt="A CORS diagram showing communication between two websites in the browser." class="wp-image-89421" srcset="https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=1600 1600w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=300 300w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=768 768w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=1024 1024w, https://github.blog/wp-content/uploads/2025/07/cors1.jpg?w=1536 1536w" sizes="(max-width: 1000px) 100vw, 1000px" /></figure>
  52.  
  53.  
  54.  
  55. <p>In this blog post, I&rsquo;ll show how developers and security researchers can use CodeQL to model their own libraries, using work that I&rsquo;ve done on CORS frameworks in Go as an example. Since the techniques that I used are useful for modeling other frameworks, this blog post can help you model and find vulnerabilities in your own projects. Because static analyzers like CodeQL have the ability to get the detailed information about structures, functions, and imported libraries, they&rsquo;re more versatile than simple tools like grep. Plus, since CORS frameworks often use set configurations via specific structures and functions, using CodeQL is the easiest way to find misconfigurations in your codebases.</p>
  56.  
  57.  
  58.  
  59. <h2 class="wp-block-heading" id="h-modeling-headers-in-codeql">Modeling headers in CodeQL</h2>
  60.  
  61.  
  62.  
  63. <p>When adding code to CodeQL, it&rsquo;s best practice to always check the related queries and frameworks that are already available so that we&rsquo;re not reinventing the wheel. For most languages, CodeQL already has a CORS query that covers many of the default cases. The easiest and simplest way of implementing CORS is by manually setting the&nbsp; <code>Access-Control-Allow-Origin</code> and <code>Access-Control-Allow-Credentials</code> <a href="https://developer.mozilla.org/en-US/docs/Glossary/Response_header">response headers</a>. By modeling the frameworks for a language (e.g., Django, FastAPI, and Flask), CodeQL can identify where in the code those headers are set. Building on those models by looking for specific header values, CodeQL can find simple examples of CORS and see if they match vulnerable values.</p>
  64.  
  65.  
  66.  
  67. <p>In the following Go example, unauthenticated resources on the servers could be accessed by arbitrary websites.</p>
  68.  
  69.  
  70.  
  71. <pre class="wp-block-code language-go"><code>func saveHandler(w http.ResponseWriter, r *http.Request) {
  72.    w.Header().Set("Access-Control-Allow-Origin", "*")
  73. }</code></pre>
  74.  
  75.  
  76.  
  77. <p>This may be troublesome for web applications that do not have authentication, such as tools intended to be hosted locally, because any dangerous endpoint could be accessed and exploited by an attacker.</p>
  78.  
  79.  
  80.  
  81. <p>This is a snippet of the Go http framework where CodeQL models the <code>Set</code> method to find security-related header writes for this framework. Header writes are modeled by the <code>HeaderWrite</code> class in <code>HTTP.qll</code>, which is extended by other modules and classes in order to find all header writes.</p>
  82.  
  83.  
  84.  
  85. <pre class="wp-block-code language-go"><code> /** Provides a class for modeling new HTTP header-write APIs. */
  86.  module HeaderWrite {
  87.    /**
  88.     * A data-flow node that represents a write to an HTTP header.
  89.     *
  90.     * Extend this class to model new APIs. If you want to refine existing API models,
  91.     * extend `HTTP::HeaderWrite` instead.
  92.     */
  93.    abstract class Range extends DataFlow::ExprNode {
  94.      /** Gets the (lower-case) name of a header set by this definition. */
  95.      string getHeaderName() { result = this.getName().getStringValue().toLowerCase() }</code></pre>
  96.  
  97.  
  98.  
  99. <p>Some useful methods such as <code>getHeaderName</code> and <code>getHeaderValue</code> can also&nbsp; help in developing security queries related to headers, like CORS misconfiguration. Unlike the previous code example, the below pattern is an example of a CORS misconfiguration whose effect is much more impactful.</p>
  100.  
  101.  
  102.  
  103. <pre class="wp-block-code language-go"><code>func saveHandler(w http.ResponseWriter, r *http.Request) {
  104.    w.Header().Set("Access-Control-Allow-Origin",
  105.    r.Header.Get("Origin"))
  106.    w.Header().Set("Access-Control-Allow-Credentials",
  107.    "true")
  108. }</code></pre>
  109.  
  110.  
  111.  
  112. <p>Reflecting the request origin header and allowing credentials permits an attacking website to make requests as the current logged in user, which could compromise the entire web application.</p>
  113.  
  114.  
  115.  
  116. <p>Using CodeQL, we can model the headers, looking for specific headers and methods in order to help CodeQL identify the relevant security code structures to find CORS vulnerabilities.</p>
  117.  
  118.  
  119.  
  120. <pre class="wp-block-code language-plaintext"><code>/**
  121. * An `Access-Control-Allow-Credentials` header write.
  122. */
  123. class AllowCredentialsHeaderWrite extends Http::HeaderWrite {
  124.    AllowCredentialsHeaderWrite() {
  125.        this.getHeaderName() = headerAllowCredentials()
  126.    }
  127. }
  128.  
  129. /**
  130. * predicate for CORS query.
  131. */
  132. predicate allowCredentialsIsSetToTrue(DataFlow::ExprNode allowOriginHW) {
  133.        exists(AllowCredentialsHeaderWrite allowCredentialsHW |
  134.                allowCredentialsHW.getHeaderValue().toLowerCase() = "true"</code></pre>
  135.  
  136.  
  137.  
  138. <p>Here, the <code>HTTP::HeaderWrite</code> class, as previously discussed, is used as a superclass for <code>AllowCredentialsHeaderWrite</code>, which finds all header writes of the value <code>Access-Control-Allow-Credentials</code>. Then, when our CORS misconfiguration query checks whether credentials are enabled, we use AllowCredentialsHeaderWrite as one of the possible sources to check.</p>
  139.  
  140.  
  141.  
  142. <p>The simplest way for developers to set a CORS policy is by setting headers on HTTP responses in their server. By modeling all instances where a header is set, we can check for these CORS cases in our CORS query.&nbsp;</p>
  143.  
  144.  
  145.  
  146. <p>When modeling web frameworks using CodeQL, creating classes that extend more generic superclasses such as <code>HTTP::HeaderWrite</code> allows the impact of the model to be used in all CodeQL security queries that need them. Since headers in web applications can be so important, modeling all the ways they can be written to in a framework can be a great first step to adding that web framework to CodeQL.</p>
  147.  
  148.  
  149.  
  150. <h2 class="wp-block-heading" id="modeling-frameworks-in-codeql">Modeling frameworks in CodeQL</h2>
  151.  
  152.  
  153.  
  154. <figure class="wp-block-image size-full"><img data-recalc-dims="1" decoding="async" width="961" height="877" src="https://github.blog/wp-content/uploads/2025/07/cors2.png?resize=961%2C877" alt="A computer with two windows open showing secure code." class="wp-image-89422" srcset="https://github.blog/wp-content/uploads/2025/07/cors2.png?w=961 961w, https://github.blog/wp-content/uploads/2025/07/cors2.png?w=300 300w, https://github.blog/wp-content/uploads/2025/07/cors2.png?w=768 768w" sizes="(max-width: 961px) 100vw, 961px" /></figure>
  155.  
  156.  
  157.  
  158. <p>Rather than setting the CORS headers manually, many developers use a CORS framework instead.&nbsp; Generally, CORS frameworks use middleware in the router of a web framework in order to add headers for every response. Some web frameworks will have their own CORS middleware, or you may have to include a third-party package. When modeling a CORS framework in CodeQL, you&rsquo;re usually modeling the relevant structures and methods that signify a CORS policy. Once the modeled structure or methods have the correct values, the query should check that the structure is actually used in the codebase.</p>
  159.  
  160.  
  161.  
  162. <p>For frameworks, we&rsquo;ll look into Go as our language of choice since it has great support for CORS. Go provides a couple of CORS frameworks, but most follow the structure of Gin CORS, a CORS middleware framework for the Gin web framework. Here&rsquo;s an example of a Gin configuration for CORS:</p>
  163.  
  164.  
  165.  
  166. <pre class="wp-block-code language-go"><code>package main
  167.  
  168. import (
  169.  "time"
  170.  
  171.  "github.com/gin-contrib/cors"
  172.  "github.com/gin-gonic/gin"
  173. )
  174.  
  175. func main() {
  176.  router := gin.Default()
  177.  router.Use(cors.New(cors.Config{
  178.    AllowOrigins:     []string{"https://foo.com"},
  179.    AllowMethods:     []string{"PUT", "PATCH"},
  180.    AllowHeaders:     []string{"Origin"},
  181.    ExposeHeaders:    []string{"Content-Length"},
  182.    AllowCredentials: true,
  183.    AllowOriginFunc: func(origin string) bool {
  184.      return origin == "https://github.com"
  185.    }
  186.  }))
  187.  router.Run()
  188. }</code></pre>
  189.  
  190.  
  191.  
  192. <p>Now that we&rsquo;ve modeled the <code>router.Use</code> method and <code>cors.New</code> &mdash; ensuring that <code>cors.Config</code> structure is at some point put into a <code>router.Use</code> function for actual use &mdash; we should then check all <code>cors.Config</code> structures for appropriate headers.</p>
  193.  
  194.  
  195.  
  196. <p>Next, we find the appropriate headers fields we want to model. For a basic CORS misconfiguration query, we would model <code>AllowOrigins</code>, <code>AllowCredentials</code>, <code>AllowOriginFunc</code>. My pull requests for adding GinCors and RSCors to CodeQL can be used as references if you&rsquo;re interested in seeing everything that goes into adding a framework to CodeQL. Below I&rsquo;ll discuss some of the most important details.</p>
  197.  
  198.  
  199.  
  200. <pre class="wp-block-code language-plaintext"><code> /**
  201.   * A variable of type Config that holds the headers to be set.
  202.   */
  203.  class GinConfig extends Variable {
  204.    SsaWithFields v;
  205.  
  206.    GinConfig() {
  207.      this = v.getBaseVariable().getSourceVariable() and
  208.      v.getType().hasQualifiedName(packagePath(), "Config")
  209.    }
  210.  
  211.    /**
  212.     * Get variable declaration of GinConfig
  213.     */
  214.    SsaWithFields getV() { result = v }
  215.  }</code></pre>
  216.  
  217.  
  218.  
  219. <p>I modeled the Config type by using SSAWithFields, which is a <a href="https://en.wikipedia.org/wiki/Static_single-assignment_form">single static assignment</a> with fields. By using <code>getSourceVariable()</code>, we can get the variable that the structure was assigned to, which can help us see where the config is used. This allows us to find track variables that contain the CORS config structure across the codebase, including ones that are often initialized like this:</p>
  220.  
  221.  
  222.  
  223. <pre class="wp-block-code language-go"><code>func main() {
  224. ...
  225. // We can now track the corsConfig variable for further updates,such as when one of the fields is updated.
  226. corsConfig:= cors.New(cors.Config{
  227. ...
  228. })}</code></pre>
  229.  
  230.  
  231.  
  232. <p>Now that we have the variable containing the relevant structure, we want to find all the instances where the variable is written to. By doing this, we can get an understanding of the relevant property values that have been assigned to it, and thus decide whether the CORS config is misconfigured.</p>
  233.  
  234.  
  235.  
  236. <pre class="wp-block-code language-plaintext"><code> /**
  237.   * A write to the value of Access-Control-Allow-Origins header
  238.   */
  239.  class AllowOriginsWrite extends UniversalOriginWrite {
  240.    DataFlow::Node base;
  242. // This models all writes to the AllowOrigins field of the Config type
  243.    AllowOriginsWrite() {
  244.  
  245.      exists(Field f, Write w |
  246.        f.hasQualifiedName(packagePath(), "Config", "AllowOrigins") and
  247.        w.writesField(base, f, this) and
  248.  
  249. // To ensure we are finding the correct field, we look for a write of type string (SliceLit)
  250.        this.asExpr() instanceof SliceLit
  251.      )
  252.  
  253.    }
  254.  
  255.    /**
  256.     * Get config variable holding header values
  257.     */
  258.    override GinConfig getConfig() {
  259.      exists(GinConfig gc |
  260.        (
  261.          gc.getV().getBaseVariable().getDefinition().(SsaExplicitDefinition).getRhs() =
  262.            base.asInstruction() or
  263.          gc.getV().getAUse() = base
  264.        ) and
  265.        result = gc
  266.      )
  267.    }
  268.  }</code></pre>
  269.  
  270.  
  271.  
  272. <p>By adding the <code>getConfig</code> function, we return the previously created <code>GinConfig</code>, which allows us to verify that any writes to relevant headers affect the same configuration structure. For example, a developer may create a config that has a vulnerable origin and another config that allows credentials. The config that allows credentials wouldn&rsquo;t be highlighted because only configs with vulnerable origins would create a security issue. By allowing CORS relevant header writes from different frameworks to all extend <code>UniversalOriginWrite</code> and <code>UniversalCredentialsWrite</code>, we can use those in our CORS misconfiguration query.&nbsp;</p>
  273.  
  274.  
  275.  
  276. <h2 class="wp-block-heading" id="writing-cors-misconfiguration-queries-in-codeql">Writing CORS misconfiguration queries in CodeQL</h2>
  277.  
  278.  
  279.  
  280. <p>CORS issues are separated into two types: those without credentials (where we&rsquo;re looking for * or null) and CORS with credentials (where we&rsquo;re looking for origin reflection or null). If you want to keep the CodeQL query simple, you can create one query for each type of CORS vulnerability and assign their severity accordingly. For the Go language, CodeQL only has a &ldquo;CORS with credentials&rdquo; type of query because it&rsquo;s applicable to all applications.&nbsp;</p>
  281.  
  282.  
  283.  
  284. <p>Let&rsquo;s tie in the models we just created above to see how they&rsquo;re used in the Go CORS misconfiguration query itself.&nbsp;</p>
  285.  
  286.  
  287.  
  288. <pre class="wp-block-code language-plaintext"><code>from DataFlow::ExprNode allowOriginHW, string message
  289. where
  290.  allowCredentialsIsSetToTrue(allowOriginHW) and
  291.  (
  292.    flowsFromUntrustedToAllowOrigin(allowOriginHW, message)
  293.    or
  294.    allowOriginIsNull(allowOriginHW, message)
  295.  ) and
  296.  not flowsToGuardedByCheckOnUntrusted(allowOriginHW)
  297. ...
  298. select allowOriginHW, message</code></pre>
  299.  
  300.  
  301.  
  302. <p>This query is only interested in critical vulnerabilities, so it checks whether credentials are allowed, and whether the allowed origins either come from a remote source or are hardcoded as null. In order to prevent false positives, it checks if there are certain guards &mdash; such as string comparisons &mdash;&nbsp; before the remote source gets to the origin. Let&rsquo;s take a closer look at the predicate <code>allowCredentialsIsSetToTrue</code>.</p>
  303.  
  304.  
  305.  
  306. <pre class="wp-block-code language-plaintext"><code>/**
  307. * Holds if the provided `allowOriginHW` HeaderWrite's parent ResponseWriter
  308. * also has another HeaderWrite that sets a `Access-Control-Allow-Credentials`
  309. * header to `true`.
  310. */
  311. predicate allowCredentialsIsSetToTrue(DataFlow::ExprNode allowOriginHW) {
  312.  exists(AllowCredentialsHeaderWrite allowCredentialsHW |
  313.    allowCredentialsHW.getHeaderValue().toLowerCase() = "true"
  314.  |
  315.    allowOriginHW.(AllowOriginHeaderWrite).getResponseWriter() =
  316.      allowCredentialsHW.getResponseWriter()
  317.  )
  318.  or
  319. ...</code></pre>
  320.  
  321.  
  322.  
  323. <p>For the first part of the predicate, we&rsquo;ll use one of the headers we previously modeled, AllowCredentialsHeaderWrite, in order to compare headers. This will help us filter out all header writes that don&rsquo;t have credentials set.</p>
  324.  
  325.  
  326.  
  327. <pre class="wp-block-code language-plaintext"><code>  exists(UniversalAllowCredentialsWrite allowCredentialsGin |
  328.    allowCredentialsGin.getExpr().getBoolValue() = true
  329.  |
  330.    allowCredentialsGin.getConfig() = allowOriginHW.(UniversalOriginWrite).getConfig() and
  331.    not exists(UniversalAllowAllOriginsWrite allowAllOrigins |
  332.      allowAllOrigins.getExpr().getBoolValue() = true and
  333.      allowCredentialsGin.getConfig() = allowAllOrigins.getConfig()
  334.    )
  335.    or
  336.    allowCredentialsGin.getBase() = allowOriginHW.(UniversalOriginWrite).getBase() and
  337.    not exists(UniversalAllowAllOriginsWrite allowAllOrigins |
  338.      allowAllOrigins.getExpr().getBoolValue() = true and
  339.      allowCredentialsGin.getBase() = allowAllOrigins.getBase()
  340.    )
  341.  )
  342. }</code></pre>
  343.  
  344.  
  345.  
  346. <p>If CORS is not set through a header, we check for CORS frameworks using <code>UniversalAllowCredentialsWrite</code>.To filter out all instances whose corresponding Origin value is set to &ldquo;*&rdquo;, we use the <code>not</code> CodeQL keyword on <code>UniversalAllowAllOriginsWrite</code>,&nbsp; since these are not applicable to this vulnerability. <code>flowsFromUntrustedToAllowOrigin</code> and <code>allowOriginIsNull</code> follow similar logic to ensure that the resulting header rights are vulnerable.</p>
  347.  
  348.  
  349.  
  350. <h2 class="wp-block-heading" id="extra-credit">Extra credit</h2>
  351.  
  352.  
  353.  
  354. <p>When you model CodeQL queries to detect vulnerabilities related to CORS, you can&rsquo;t use a one-size-fits-all approach. Instead, you have to tailor your queries to each web framework for two reasons:&nbsp;</p>
  355.  
  356.  
  357.  
  358. <ul class="wp-block-list">
  359. <li>Each framework implements CORS policies in its own way</li>
  360.  
  361.  
  362.  
  363. <li>Vulnerability patterns depend on a framework&rsquo;s behavior</li>
  364. </ul>
  365.  
  366.  
  367.  
  368. <p>For example, we saw before in Gin CORS that there is an <code>AllowOriginFunc</code>. After looking at the documentation or experimenting with the code, we can see that it may override <code>AllowOrigins</code>. To improve our query, we could write a CodeQL query that looks for <code>AllowOriginFunc</code>s that always return true, which will result in a high severity vulnerability if paired with credentials.</p>
  369.  
  370.  
  371.  
  372. <h2 class="wp-block-heading" id="take-this-with-you">Take this with you&nbsp;</h2>
  373.  
  374.  
  375.  
  376. <p>Once you understand the behavior of web frameworks and headers with CodeQL, it&rsquo;s simple to find security issues in your code and reduce the chance of vulnerabilities making their way into your work. The number of CodeQL languages that support CORS misconfiguration queries is still growing, and there is always room for improvement from the community .&nbsp;</p>
  377.  
  378.  
  379.  
  380. <p>If this blog has been helpful in helping you write CodeQL queries, please feel free to open anything you&rsquo;d like to share with the community in our <a href="https://github.com/GitHubSecurityLab/CodeQL-Community-Packs">CodeQL Community Packs</a>.</p>
  381.  
  382.  
  383.  
  384. <p>Finally, <a href="https://github.com/security/advanced-security/code-security">GitHub Code Security</a> can help you secure your project by detecting and suggesting a fix for bugs such as <a href="https://codeql.github.com/codeql-query-help/javascript/js-cors-misconfiguration-for-credentials/">CORS misconfiguration</a>!</p>
  385.  
  386.  
  387.  
  388. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  389. <p><strong>Explore more</strong> GitHub Security Lab <a href="https://github.blog/tag/github-security-lab/">blog posts &gt;</a></p>
  390. </div>
  391. </body></html>
  392. <p>The post <a href="https://github.blog/security/application-security/modeling-cors-frameworks-with-codeql-to-find-security-vulnerabilities/">Modeling CORS frameworks with CodeQL to find security vulnerabilities</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  393. ]]></content:encoded>
  397. <post-id xmlns="com-wordpress:feed-additions:1">89417</post-id> </item>
  398. <item>
  399. <title>Beyond prompt crafting: How to be a better partner for your AI pair programmer</title>
  400. <link>https://github.blog/ai-and-ml/github-copilot/beyond-prompt-crafting-how-to-be-a-better-partner-for-your-ai-pair-programmer/</link>
  402. <dc:creator><![CDATA[Christopher Harrison]]></dc:creator>
  403. <pubDate>Wed, 09 Jul 2025 16:00:00 +0000</pubDate>
  404. <category><![CDATA[AI & ML]]></category>
  405. <category><![CDATA[GitHub Copilot]]></category>
  406. <guid isPermaLink="false">https://github.blog/?p=89424</guid>
  407.  
  408. <description><![CDATA[<p>Ensuring quality code suggestions from Copilot goes beyond the perfect prompt. Context is key to success when working with your AI pair programmer.</p>
  409. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/beyond-prompt-crafting-how-to-be-a-better-partner-for-your-ai-pair-programmer/">Beyond prompt crafting: How to be a better partner for your AI pair programmer</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  410. ]]></description>
  411. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  412. <html><body><p>When a developer first starts working with <a href="https://github.com/features/copilot">GitHub Copilot</a> there&rsquo;s (rightly) a focus on prompt crafting &mdash; or the art of providing good context and information to generate quality suggestions.&nbsp;</p>
  413.  
  414.  
  415.  
  416. <p>But context goes beyond typing out a couple of lines into Copilot Chat in VS Code. We want to ensure Copilot is considering the right files when performing operations, that these files are easy for Copilot to read, and that we provide Copilot any extra guidance it may need about the project or specific task.&nbsp;</p>
  417.  
  418.  
  419.  
  420. <p>So let&rsquo;s explore taking the next step beyond prompt crafting, and think about how we can be a better partner for our AI pair programmer.</p>
  421.  
  422.  
  423.  
  424. <h2 class="wp-block-heading" id="h-context-is-key">Context is key</h2>
  425.  
  426.  
  427.  
  428. <p>I always like to talk about context by starting with a story. The other day my partner and I woke up and she said, &ldquo;Let&rsquo;s go to brunch!&rdquo; Fantastic! Who doesn&rsquo;t love brunch?&nbsp;</p>
  429.  
  430.  
  431.  
  432. <p>I recommended a spot, one of our favorites, and she said, &ldquo;You know&hellip; we&rsquo;ve been there quite a bit lately. I&rsquo;d like to try something different.&rdquo; I recommended another spot to which she replied, &ldquo;Now that I&rsquo;m thinking about it, I really want waffles. Let&rsquo;s find somewhere that does good waffles.&rdquo;</p>
  433.  
  434.  
  435.  
  436. <p>This conversation is, of course, pretty normal. My partner asked a question, I responded, she provided more context, and back and forth we went. All of my suggestions were perfectly reasonable based on the information I had, and when she didn&rsquo;t hear what she was expecting she provided a bit more guidance. As we continued talking, she realized she had a craving for waffles, which she discovered as she considered my suggestions.</p>
  437.  
  438.  
  439.  
  440. <p>This is very much how we both talk with other people, but also how we approach working with generative AI tools, including Copilot. We ask questions, get answers, and work back and forth providing more context and making decisions based on what we see.&nbsp;</p>
  441.  
  442.  
  443.  
  444. <p>If we don&rsquo;t receive the suggestions we&rsquo;re expecting, or if something isn&rsquo;t built to the specs we had in mind, it&rsquo;s very likely Copilot didn&rsquo;t have the context it needed &mdash; just as I didn&rsquo;t have the context to suggest somewhere new when I started the conversation with my partner.</p>
  445.  
  446.  
  447.  
  448. <h2 class="wp-block-heading" id="h-how-github-copilot-works-with-code">How GitHub Copilot works with code</h2>
  449.  
  450.  
  451.  
  452. <p>To understand how Copilot in the IDE gets its context, it&rsquo;s important to understand how it works. Except for <a href="https://github.blog/news-insights/product-news/from-pair-to-peer-programmer-our-vision-for-agentic-workflows-in-github-copilot/">agent mode, which performs external tasks</a>, Copilot doesn&rsquo;t build or run the code as it generates code suggestions. In fact, it behaves very similarly to, well, a pair programmer. It reads the code (and comments) of the files we&rsquo;ve pointed it at just as another developer would.&nbsp;</p>
  453.  
  454.  
  455.  
  456. <p>But unlike a teammate, Copilot doesn&rsquo;t have &ldquo;institutional knowledge,&rdquo; or the background information that comes with experience (although <a href="https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot">you can add custom instructions</a>, but more on that later). This could be the history of why things were built a certain way (which isn&rsquo;t documented somewhere but everyone just &ldquo;knows&rdquo; &#128580;), that an internal library or framework that should always be used, or patterns that need to be followed.</p>
  457.  
  458.  
  459.  
  460. <p>Obviously, all of this background info is important to get the right code suggestions from Copilot. If we&rsquo;re using a data abstraction layer (DAL), for instance, but Copilot is generating raw SQL code, the suggestions aren&rsquo;t going to be that helpful.&nbsp;</p>
  461.  
  462.  
  463.  
  464. <p>The problem isn&rsquo;t that Copilot is generating invalid code. Instead, it&rsquo;s lacking the context to generate the code in the format and structure we need. Basically, we want waffles and it&rsquo;s giving us an omelette. Let&rsquo;s see what we can do to get waffles.</p>
  465.  
  466.  
  467.  
  468. <h2 class="wp-block-heading" id="h-using-code-comments-to-improve-copilot-s-suggestions-through-better-context">Using code comments to improve Copilot&rsquo;s suggestions through better context</h2>
  469.  
  470.  
  471.  
  472. <p>There&rsquo;s a common belief that quality code shouldn&rsquo;t need comments, and that adding comments is a &ldquo;code smell,&rdquo; or an indication that something could be improved. While it&rsquo;s noble to strive to write code that&rsquo;s as readable as possible, it&rsquo;s something we often fall short of in our day-to-day work.</p>
  473.  
  474.  
  475.  
  476. <p>Even when we do &ldquo;hit the mark&rdquo;, we need to remember that just because code might be readable to one developer, it doesn&rsquo;t mean it&rsquo;s readable to all developers. A couple of lines of comments can go a long way to ensuring readability.</p>
  477.  
  478.  
  479.  
  480. <p>The same holds true for Copilot! As we highlighted above, Copilot doesn&rsquo;t run or compile your code except in specific situations. Instead, it &ldquo;reads&rdquo; your code much like a developer would.&nbsp;</p>
  481.  
  482.  
  483.  
  484. <p>Following the guidelines for having <a href="https://peps.python.org/pep-0257/">docstrings</a> in functions/modules in Python, for example, can help ensure Copilot has a better understanding of what the code does and how it does it. This allows Copilot to generate higher-quality suggestions by using your existing code to ensure any new code follows the same patterns and practices already in place.</p>
  485.  
  486.  
  487.  
  488. <figure class="wp-block-table"><table class="has-fixed-layout"><tbody><tr><td>&#128161; <strong>Pro tip</strong>: <strong>When you open a file, it&rsquo;s always a good idea to leave it in a better state than when you found it</strong>. One of the little improvements you could make is to add a few comments to places to help describe the code. You could always ask Copilot to generate the first draft of the comments, and you can add any additional details Copilot missed!</td></tr></tbody></table></figure>
  489.  
  490.  
  491.  
  492. <h2 class="wp-block-heading" id="the-benefit-of-using-custom-instructions-with-github-copilot-on-your-projects">The benefit of using custom instructions with GitHub Copilot on your projects</h2>
  493.  
  494.  
  495.  
  496. <p>To generate quality suggestions, Copilot benefits from having context around what you&rsquo;re doing and how you&rsquo;re doing it. Knowing the technology and frameworks you&rsquo;re using, what coding standards to follow, and even some background on what you&rsquo;re building helps Copilot raise the quality bar on its suggestions. This is where <a href="https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot">custom instructions</a> come into play.</p>
  497.  
  498.  
  499.  
  500. <p>Custom instructions help you provide all of this background information and set ground rules (things like what APIs you want to call, naming patterns you want followed, or even stylistic preferences).&nbsp;</p>
  501.  
  502.  
  503.  
  504. <p>To get started, you place everything that&rsquo;s important into a file named <strong>copilot-instructions.md</strong> inside your <strong>.github</strong> folder. It&rsquo;s a markdown file, so you can create sections like <strong>Project structure</strong>, <strong>Technologies</strong>, <strong>Coding standards</strong>, and any other notes you want Copilot to consider on every single chat request. You can also add any guidance on tasks where you see Copilot not always choosing the right path, like maybe using class-based React components instead of function-based components (all the cool kids are using function based-components).</p>
  505.  
  506.  
  507.  
  508. <p>Keep in mind that custom instructions are sent to Copilot on <strong>every single</strong> chat request. You want to keep your instructions limited to information that&rsquo;s relevant to the entire project. Providing too many details can make it a bit harder for Copilot to determine what&rsquo;s important.</p>
  509.  
  510.  
  511.  
  512. <p>In simpler terms, you can basically think about the one friend you have who maybe shares too much detail when they&rsquo;re telling a story, and how it can make it tricky to focus on the main plot points. It&rsquo;s the same thing with Copilot. Provide some project-level guidance and overviews, so it best understands the environment in which it&rsquo;s working.</p>
  513.  
  514.  
  515.  
  516. <p>A good rule of thumb is to have sections that highlight the various aspects of your project. An outline for a monorepo with a client and server for a web app might look like this:</p>
  517.  
  518.  
  519.  
  520. <pre class="wp-block-code language-plaintext"><code># Tailspin Toys Crowd Funding
  521.  
  522. Website for crowd funding for games.
  523.  
  524. ## Backend
  525.  
  526. The backend is written using:
  527.  
  528. - Flask for the API
  529. - SQLAlchemy for the ORM
  530. - SQLite for the database
  531.  
  532. ## Frontend
  533.  
  534. The frontend is written using:
  535.  
  536. - Astro for routing
  537. - Svelte for the components and interactivity
  538. - Tailwind CSS for styling
  539.  
  540. ## Code standards
  541.  
  542. - Use good variable names, avoiding abbreviations and single letter variables
  543. - Use the casing standard for the language in question (camelCasing for TypeScript, snake_casing for Python, etc.)
  544. - Use type hints in all languages which support them
  545.  
  546. ## Project structure
  547.  
  548. - `client` contains the frontend code
  549. - `docs` contains the documentation for the project
  550. - `scripts` contains the scripts used to install services, start the app, and run tests
  551. - `server` contains the backend code </code></pre>
  552.  
  553.  
  554.  
  555. <p>This is relatively abbreviated, but notice the structure. We&rsquo;re telling Copilot about the project we have, its structure, the techs in use, and some guidance about how we want our code to be created. We don&rsquo;t have anything specific to tasks, like maybe writing unit tests, because we have another way to tell Copilot that information!</p>
  556.  
  557.  
  558.  
  559. <h2 class="wp-block-heading" id="providing-specific-instructions-for-specific-tasks">Providing specific instructions for specific tasks</h2>
  560.  
  561.  
  562.  
  563. <p>Continuing our conversation about instruction files&hellip; (I&rsquo;m Gen-X, so <a href="https://www.reddit.com/r/GenX/comments/108t56v/so_umm_theres_that/">I&rsquo;m required to use the Gen-X ellipsis at least once</a>.)</p>
  564.  
  565.  
  566.  
  567. <p>VS Code and Codespaces also support <a href="https://code.visualstudio.com/docs/copilot/copilot-customization#_use-instructionsmd-files"><code>.instructions.md</code></a> files. These are just like the <code>copilot-instructions.md</code> file we spoke about previously, only they&rsquo;re designed to be used for specific types of tasks and placed in <code>.github/instructions</code>.</p>
  568.  
  569.  
  570.  
  571. <p>Consider a project where you&rsquo;re building out <a href="https://flask.palletsprojects.com/en/stable/blueprints/">Flask Blueprints</a> for the routes for an API. There might be requirements around how the file should be structured and how unit tests should be created. You can create a custom instructions file called <code>flask-endpoint.instructions.md</code>, place it in <code>.github/instructions</code>, then add it as context to the chat when you request Copilot to create a new endpoint. It might look something like:</p>
  572.  
  573.  
  574.  
  575. <pre class="wp-block-code language-plaintext"><code># Endpoint creation guidelines
  576.  
  577. ## Endpoint notes
  578.  
  579. - Endpoints are created in Flask using blueprints
  580. - Create a centralized function for accessing data
  581. - All endpoints require tests
  582.    - Use the `unittest` module for testing
  583.    - All tests must pass
  584.    - A script is provided to run tests at `scripts/run-server-tests.sh`
  585.  
  586. ## Project notes
  587.  
  588. - The Python virtual environment is located in the root of the project in a **venv** folder
  589. - Register all blueprints in `server/app.py`
  590. - Use the [test instructions](./python-tests.instructions.md) when creating tests
  591.  
  592. ## Prototype files
  593.  
  594. - [Endpoint prototype](../../server/routes/games.py)
  595. - [Tests prototype](../../server/tests/test_games.py)</code></pre>
  596.  
  597.  
  598.  
  599. <p>Notice how we&rsquo;re providing specific information about how we want our endpoints created. You&rsquo;ll also notice we&rsquo;re even linking out to other files <strong>in the project</strong> using hyperlinks &mdash; both existing files for Copilot to use as representative examples, and other instructions files for more information.</p>
  600.  
  601.  
  602.  
  603. <p>Additionally, you can also apply instructions to file types based on a pattern. Let&rsquo;s take the tests for example. If they were all located in <code>server/tests</code>, and started with <code>test_</code>, you could add metadata to the top to ensure Copilot always includes the instructions when working on a test file:</p>
  604.  
  605.  
  606.  
  607. <pre class="wp-block-code language-plaintext"><code>---
  608. applyTo: server/tests/test_*.py
  609. ---</code></pre>
  610.  
  611.  
  612.  
  613. <p>This gives you a lot of flexibility in ensuring Copilot is able to access the right information at the right time. This can be done explicitly by adding in the instructions file, or implicitly by providing a pattern for Copilot to use when building certain files.</p>
  614.  
  615.  
  616.  
  617. <p>Just as before, these are artifacts in your repository. It can take some time to build a collection of instruction files, but that investment will pay off in the form of higher-quality code and, in turn, improved productivity.</p>
  618.  
  619.  
  620.  
  621. <h2 class="wp-block-heading" id="fully-reusable-prompts">Fully reusable prompts</h2>
  622.  
  623.  
  624.  
  625. <p>The VS Code team recently published a new, experimental feature called prompt files. Because they&rsquo;re still in development I don&rsquo;t want to dig too deep into them, but you can read more about <a href="https://code.visualstudio.com/docs/copilot/copilot-customization#_prompt-files-experimental">prompt files in the docs</a> and see how to utilize them as they are currently implemented. In a nutshell, they allow you to effectively create scripted prompts for Copilot. You can choose the Copilot modes they&rsquo;re available in (ask, edit and agent), the tools to be called, and what questions to ask the developer. These can be created by the team for enhanced reuse and consistency.</p>
  626.  
  627.  
  628.  
  629. <h2 class="wp-block-heading" id="extending-github-copilots-capabilities-with-model-context-protocol-mcp">Extending GitHub Copilot&rsquo;s capabilities with Model Context Protocol (MCP)</h2>
  630.  
  631.  
  632.  
  633. <p>In an ever changing software development landscape, we need to ensure the information we&rsquo;re working with is accurate, relevant, and up to date. This is what MCP, or Model Context Protocol, is built for! Developed initially by Anthropic, MCP is an open source protocol that lets organizations expose their services or data to generative AI tools.&nbsp;</p>
  634.  
  635.  
  636.  
  637. <p>When you add an MCP server to your IDE, you allow Copilot to &ldquo;phone a friend&rdquo; to find information, or even perform tasks on your behalf. For example, the <a href="https://github.com/microsoft/playwright-mcp">Playwright MCP server</a> helps create <a href="https://playwright.dev/">Playwright</a> end-to-end tests, while the <a href="https://github.com/github/github-mcp-server">GitHub MCP server</a> provides access to GitHub services like repositories, issues, and pull requests.</p>
  638.  
  639.  
  640.  
  641. <p>Let&rsquo;s say, for instance, that you added the Playwright MCP server to your IDE. When you ask Copilot to create a new test to validate functionality on your website, Copilot can consult an authoritative source, allowing it to generate the best code it can.</p>
  642.  
  643.  
  644.  
  645. <p>You can even create your own MCP servers! One question I commonly hear is about how you can allow Copilot to look through an internal codebase or suite of libraries. With a custom MCP server, you could provide a facade for Copilot to perform these types of queries, then utilize the information discovered to suggest code based on your internal environment.</p>
  646.  
  647.  
  648.  
  649. <p>MCP is large enough to have its own blog post, which my colleague Cassidy wrote, sharing <a href="https://github.blog/ai-and-ml/llms/what-the-heck-is-mcp-and-why-is-everyone-talking-about-it/">tips, tricks, and insights about MCP</a>.</p>
  650.  
  651.  
  652.  
  653. <h2 class="wp-block-heading" id="thinking-beyond-prompts">Thinking beyond prompts</h2>
  654.  
  655.  
  656.  
  657. <p>Let me be clear: prompt crafting is important. It&rsquo;s one of the first skills any developer should learn when they begin using GitHub Copilot.&nbsp;</p>
  658.  
  659.  
  660.  
  661. <p>But writing a good prompt is only one piece Copilot considers when generating an answer. By using the best practices highlighted above &mdash; comments and good code, custom instructions, and MCP servers &mdash; you can help Copilot understand what you want it to do and how you want it to do it. To bring it back to my analogy, you can ensure Copilot knows when you want waffles instead of omelettes.</p>
  662.  
  663.  
  664.  
  665. <p>And on that note, I&rsquo;m off to brunch.</p>
  666.  
  667.  
  668.  
  669. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  670. <p><strong>Get started</strong> with <a href="https://github.com/features/copilot">GitHub Copilot &gt;</a></p>
  671. </div>
  672. </body></html>
  673. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/beyond-prompt-crafting-how-to-be-a-better-partner-for-your-ai-pair-programmer/">Beyond prompt crafting: How to be a better partner for your AI pair programmer</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  674. ]]></content:encoded>
  678. <post-id xmlns="com-wordpress:feed-additions:1">89424</post-id> </item>
  679. <item>
  680. <title>Git security vulnerabilities announced</title>
  681. <link>https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/</link>
  683. <dc:creator><![CDATA[Taylor Blau]]></dc:creator>
  684. <pubDate>Tue, 08 Jul 2025 17:02:11 +0000</pubDate>
  685. <category><![CDATA[Git]]></category>
  686. <category><![CDATA[Open Source]]></category>
  687. <category><![CDATA[security alert]]></category>
  688. <guid isPermaLink="false">https://github.blog/?p=89409</guid>
  689.  
  690. <description><![CDATA[<p>Today, the Git project released new versions to address seven security vulnerabilities that affect all prior versions of Git.</p>
  691. <p>The post <a href="https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/">Git security vulnerabilities announced</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  692. ]]></description>
  693. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  694. <html><body><p>Today, the Git project <a href="https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g/">released new versions</a> to address seven security vulnerabilities that affect all prior versions of Git.</p>
  695.  
  696.  
  697.  
  698. <h2 class="wp-block-heading" id="h-vulnerabilities-in-git">Vulnerabilities in Git</h2>
  699.  
  700.  
  701.  
  702. <h3 class="wp-block-heading" id="h-cve-2025-48384">CVE-2025-48384</h3>
  703.  
  704.  
  705.  
  706. <p>When reading a <a href="https://git-scm.com/book/en/v2/Customizing-Git-Git-Configuration">configuration</a> value, Git will strip any trailing carriage return (CR) and line feed (LF) characters. When writing a configuration value, however, Git does not quote trailing CR characters, causing them to be lost when they are read later on. When initializing a <a href="https://git-scm.com/docs/gitsubmodules">submodule</a> whose path contains a trailing CR character, the stripped path is used, causing the submodule to be checked out in the wrong place.</p>
  707.  
  708.  
  709.  
  710. <p>If a <a href="https://en.wikipedia.org/wiki/Symbolic_link">symlink</a> already exists between the stripped path and the submodule&rsquo;s <a href="https://git-scm.com/docs/githooks">hooks</a> directory, an attacker can execute arbitrary code through the submodule&rsquo;s <code>post-checkout</code> hook.</p>
  711.  
  712.  
  713.  
  714. <p>[<a href="https://github.com/git/git/compare/d2bc61fcabd6cfa582d286bed1ce20d5d7c58d52...05e9cd64ee23bbadcea6bcffd6660ed02b8eab89">source</a>]</p>
  715.  
  716.  
  717.  
  718. <h3 class="wp-block-heading" id="h-cve-2025-48385">CVE-2025-48385</h3>
  719.  
  720.  
  721.  
  722. <p>When cloning a repository, Git can optionally fetch a <a href="https://git-scm.com/docs/git-bundle">bundle</a>, allowing the server to offload a portion of the clone to a <a href="https://en.wikipedia.org/wiki/Content_delivery_network">CDN</a>. The Git client does not properly validate the advertised bundle(s), allowing the remote side to perform protocol injection. When a specially crafted bundle is advertised, the remote end can cause the client to write the bundle to an arbitrary location, which may lead to code execution similar to the previous CVE.</p>
  723.  
  724.  
  725.  
  726. <p>[<a href="https://github.com/git/git/compare/d61cfed2c23705fbeb9c0d08f59e75ee08738950...35cb1bb0b92c132249d932c05bbd860d410e12d4">source</a>]</p>
  727.  
  728.  
  729.  
  730. <h3 class="wp-block-heading" id="h-cve-2025-48386-windows-only">CVE-2025-48386 (Windows only)</h3>
  731.  
  732.  
  733.  
  734. <p>When cloning from an authenticated remote, Git uses a <a href="https://git-scm.com/docs/gitcredentials">credential helper</a> in order to authenticate the request. Git includes a handful of <a href="https://git-scm.com/doc/credential-helpers">credential helpers</a>, including <a href="https://github.com/git/git/tree/v2.43.7/contrib/credential/wincred">Wincred</a>, which uses the <a href="https://support.microsoft.com/en-us/windows/credential-manager-in-windows-1b5c916a-6a16-889f-8581-fc16e8165ac0">Windows Credential Manager</a> to store its credentials.</p>
  735.  
  736.  
  737.  
  738. <p>Wincred uses the contents of a static buffer as a unique key to store and retrieve credentials. However, it does not properly bounds check the remaining space in the buffer, leading to potential buffer overflows.</p>
  739.  
  740.  
  741.  
  742. <p>[<a href="https://github.com/git/git/compare/2d22f0cd07c308d7ff25bbf4ec8f1bb53b4bcda7...9de345cb273cc7faaeda279c7e07149d8a15a319">source</a>]</p>
  743.  
  744.  
  745.  
  746. <h1 class="wp-block-heading" id="h-vulnerabilities-in-git-gui-and-gitk">Vulnerabilities in Git GUI and Gitk</h1>
  747.  
  748.  
  749.  
  750. <p>This release resolves four new CVEs related to <a href="https://git-scm.com/docs/gitk">Gitk</a> and <a href="https://git-scm.com/docs/git-gui">Git GUI</a>. Both tools are <a href="https://en.wikipedia.org/wiki/Tcl">Tcl/Tk</a>-based graphical interfaces used to interact with Git repositories. Gitk is focused on showing a repository&rsquo;s history, whereas Git GUI focuses on making changes to existing repositories.</p>
  751.  
  752.  
  753.  
  754. <h3 class="wp-block-heading" id="h-cve-2025-27613-gitk">CVE-2025-27613 (Gitk)</h3>
  755.  
  756.  
  757.  
  758. <p>When running Gitk in a specially crafted repository without additional command-line arguments, Gitk can write and truncate arbitrary writable files. The &ldquo;Support per-file encoding&rdquo; option must be enabled; however, the operation of &ldquo;Show origin of this line&rdquo; is affected regardless.</p>
  759.  
  760.  
  761.  
  762. <p>[<a href="https://github.com/git/git/compare/4e7e3b792e6973e09de6ddc191b86bbc245c53dd...67a128b91e25978a15f9f7e194d81b441d603652">source</a>]</p>
  763.  
  764.  
  765.  
  766. <h3 class="wp-block-heading" id="h-cve-2025-27614-gitk">CVE-2025-27614 (Gitk)</h3>
  767.  
  768.  
  769.  
  770. <p>If a user is tricked into running <code>gitk filename</code> (where <code>filename</code> has a particular structure), they may run arbitrary scripts supplied by the attacker, leading to arbitrary code execution.</p>
  771.  
  772.  
  773.  
  774. <p>[<a href="https://github.com/git/git/compare/664d4fa692cb8637a7c9297c94abf0de8593e585...8e3070aa5e331be45d4d03e3be41f84494fce129">source</a>]</p>
  775.  
  776.  
  777.  
  778. <h3 class="wp-block-heading" id="h-cve-2025-46334-git-gui-windows-only">CVE-2025-46334 (Git GUI, Windows only)</h3>
  779.  
  780.  
  781.  
  782. <p>If a malicious repository includes an executable <code>sh.exe</code>, or common <a href="https://git-scm.com/docs/gitattributes#_performing_text_diffs_of_binary_files">textconv</a> programs (for e.g.,&nbsp; <code>astextplain</code>, <code>exif</code>, or <code>ps2ascii</code>), path lookup on Windows may locate these executables in the working tree. If a user running Git GUI in such a repository selects either the &ldquo;Git Bash&rdquo; or &ldquo;Browse Files&rdquo; from the menu, these programs may be invoked, leading to arbitrary code execution.</p>
  783.  
  784.  
  785.  
  786. <p>[<a href="https://github.com/git/git/compare/27fbab4898620183e608865beffd960139c04d58...a1ccd2512072cf52835050f4c97a4fba9f0ec8f9">source</a>]</p>
  787.  
  788.  
  789.  
  790. <h3 class="wp-block-heading" id="h-cve-2025-46335-git-gui">CVE-2025-46335 (Git GUI)</h3>
  791.  
  792.  
  793.  
  794. <p>When a user is tricked into editing a file in a specially named directory in an untrusted repository, Git GUI can create and overwrite arbitrary writable files, similar to CVE-2025-27613.</p>
  795.  
  796.  
  797.  
  798. <p>[<a href="https://github.com/git/git/compare/a7d1716fa648f6557ea9c91e0f04bae2e8738e6a...a437f5bc93330a70b42a230e52f3bd036ca1b1da">source</a>]</p>
  799.  
  800.  
  801.  
  802. <h2 class="wp-block-heading" id="h-upgrade-to-the-latest-git-version">Upgrade to the latest Git version</h2>
  803.  
  804.  
  805.  
  806. <p>The most effective way to protect against these vulnerabilities is to upgrade to Git 2.50.1, the newest release containing fixes for the aforementioned vulnerabilities. If you can&rsquo;t upgrade immediately, you can reduce your risk by doing the following:</p>
  807.  
  808.  
  809.  
  810. <ul class="wp-block-list">
  811. <li>Avoid running <code>git clone</code> with <code>--recurse-submodules</code> against untrusted repositories.</li>
  812.  
  813.  
  814.  
  815. <li>Disable auto-fetching bundle URIs by setting the <code>transfer.bundleURI</code> configuration value to &ldquo;false.&rdquo;</li>
  816.  
  817.  
  818.  
  819. <li>Avoid using the <code>wincred</code> credential helper on Windows.</li>
  820.  
  821.  
  822.  
  823. <li>Avoid running Gitk and Git GUI in untrusted repositories.</li>
  824. </ul>
  825.  
  826.  
  827.  
  828. <p>In order to protect users against attacks related to these vulnerabilities, GitHub has taken proactive steps. Specifically, we have scheduled releases of <a href="https://github.com/apps/desktop">GitHub Desktop</a>. <a href="https://github.com/features/codespaces">GitHub Codespaces</a> and <a href="https://github.com/features/actions">GitHub Actions</a> will update their versions of Git shortly. GitHub itself, including <a href="https://github.com/enterprise">Enterprise Server</a>, is unaffected by these vulnerabilities.</p>
  829.  
  830.  
  831.  
  832. <hr class="wp-block-separator has-alpha-channel-opacity">
  833.  
  834.  
  835.  
  836. <p>CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386 were discovered by <a href="https://github.com/dgl">David Leadbeater</a>. <a href="https://github.com/jltobler">Justin Tobler</a> and <a href="https://github.com/pks-t">Patrick Steinhardt</a> provided fixes for CVEs 2025-48384 and 2025-48385 respectively. The fix for CVE-2025-48386 is joint work between <a href="https://github.com/ttaylorr">Taylor Blau</a> and <a href="https://github.com/peff">Jeff King<br><br></a>CVE-2025-46835 was found and fixed by <a href="https://github.com/j6t">Johannes Sixt</a>. <a href="https://github.com/mark987">Mark Levedahl</a> discovered and fixed CVE-2025-46334. <a href="https://github.com/avih">Avi Halachmi</a> discovered both CVE-2025-27613 and CVE-2025-27614, and fixed the latter. CVE-2025-27613 was fixed by Johannes Sixt.</p>
  837. </body></html>
  838. <p>The post <a href="https://github.blog/open-source/git/git-security-vulnerabilities-announced-6/">Git security vulnerabilities announced</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  839. ]]></content:encoded>
  843. <post-id xmlns="com-wordpress:feed-additions:1">89409</post-id> </item>
  844. <item>
  845. <title>CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre</title>
  846. <link>https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre/</link>
  848. <dc:creator><![CDATA[Kevin Backhouse]]></dc:creator>
  849. <pubDate>Thu, 03 Jul 2025 20:52:20 +0000</pubDate>
  850. <category><![CDATA[Security]]></category>
  851. <category><![CDATA[Vulnerability research]]></category>
  852. <category><![CDATA[CVE]]></category>
  853. <category><![CDATA[GitHub Security Lab]]></category>
  854. <category><![CDATA[linux]]></category>
  855. <category><![CDATA[open source]]></category>
  856. <guid isPermaLink="false">https://github.blog/?p=89368</guid>
  857.  
  858. <description><![CDATA[<p>DjVuLibre has a vulnerability that could enable an attacker to gain code execution on a Linux Desktop system when the user tries to open a crafted document.</p>
  859. <p>The post <a href="https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre/">CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  860. ]]></description>
  861. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  862. <html><body><p><a href="https://sourceforge.net/projects/djvu/">DjVuLibre</a> version 3.5.29 was released today. It fixes CVE-2025-53367 (GHSL-2025-055), an out-of-bounds (OOB) write in the <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l570"><code>MMRDecoder::scanruns</code></a> method. The vulnerability could be exploited to gain code execution on a Linux Desktop system when the user tries to open a crafted document.</p>
  863.  
  864.  
  865.  
  866. <p>DjVu is a document file format that can be used for similar purposes to PDF. It is supported by <a href="https://gitlab.gnome.org/GNOME/evince">Evince</a> and <a href="https://gitlab.gnome.org/GNOME/papers">Papers</a>, the default document viewers on many Linux distributions. In fact, even when a DjVu file is given a filename with a .pdf extension, Evince/Papers will automatically detect that it is a DjVu document and run DjVuLibre to decode it.</p>
  867.  
  868.  
  869.  
  870. <p>Antonio found this vulnerability while researching the Evince document reader. He found the bug with fuzzing.</p>
  871.  
  872.  
  873.  
  874. <p>Kev has developed a proof of concept exploit for the vulnerability, as demoed in this video.</p>
  875.  
  876.  
  877.  
  878. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  879. <iframe title="CVE-2025-53367: Exploitable OOB write in DjVuLibre" width="500" height="281" src="https://www.youtube.com/embed/32kROHYhYVM?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  880. </div></figure>
  881.  
  882.  
  883.  
  884. <p>The POC works on a fully up-to-date Ubuntu 25.04 (x86_64) with all the standard security protections enabled. To explain what&rsquo;s happening in the video:</p>
  885.  
  886.  
  887.  
  888. <ol class="wp-block-list">
  889. <li>Kev clicks on a malicious DjVu document in his <code>~/Downloads</code> directory.</li>
  890.  
  891.  
  892.  
  893. <li>The file is named <code>poc.pdf</code>, but it&rsquo;s actually in DjVu format.</li>
  894.  
  895.  
  896.  
  897. <li>The default document viewer (<code>/usr/bin/papers</code>) loads the document, detects that it&rsquo;s in DjVu format, and uses DjVuLibre to decode it.</li>
  898.  
  899.  
  900.  
  901. <li>The file exploits the OOB write vulnerability and triggers a call to <code>system("google-chrome https://www.youtube.com/&hellip;")</code>.</li>
  902.  
  903.  
  904.  
  905. <li>Rick Astley appears.</li>
  906. </ol>
  907.  
  908.  
  909.  
  910. <p>Although the POC is able to bypass <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization">ASLR</a>, it&rsquo;s somewhat unreliable: it&rsquo;ll work 10 times in a row and then suddenly stop working for several minutes. But this is only a first version, and we believe it&rsquo;s possible to create an exploit that&rsquo;s significantly more reliable.</p>
  911.  
  912.  
  913.  
  914. <p>You may be wondering: why Astley, and not a calculator? That&rsquo;s because <code>/usr/bin/papers</code> runs under an <a href="https://apparmor.net/">AppArmor</a> profile. The profile prohibits you from starting an arbitrary process but makes an exception for google-chrome. So it was easier to play a YouTube video than pop a calc. But the AppArmor profile is not particularly restrictive. For example, it lets you write arbitrary files to the user&rsquo;s home directory, except for the really obvious one like <code>~/.bashrc</code>. So it wouldn&rsquo;t prevent a determined attacker from gaining code execution.</p>
  915.  
  916.  
  917.  
  918. <h1 class="wp-block-heading" id="h-vulnerability-details">Vulnerability Details</h1>
  919.  
  920.  
  921.  
  922. <p>The <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l570"><code>MMRDecoder::scanruns</code></a> method is affected by an OOB-write vulnerability, because it doesn&rsquo;t check that the <code>xr</code> pointer stays within the bounds of the allocated buffer.</p>
  923.  
  924.  
  925.  
  926. <p>During the decoding process, run-length encoded data is written into two buffers: <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.h#l207"><code>lineruns</code></a> and <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.h#l209"><code>prevruns</code></a>:</p>
  927.  
  928.  
  929.  
  930. <pre class="wp-block-code"><code>//libdjvu/MMRDecoder.h
  931. class DJVUAPI MMRDecoder : public GPEnabled
  932. {
  933. ...
  934. public:
  935.  
  936.  unsigned short *lineruns;
  937. ...
  938.  unsigned short *prevruns;
  939. ...
  940. }</code></pre>
  941.  
  942.  
  943.  
  944. <p>The variables named <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l583"><code>pr</code></a> and <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/42029c33b2fb25bc1fa98c80b2be83a2fa23cce1/tree/libdjvu/MMRDecoder.cpp#l584"><code>xr</code></a> point to the current locations in those buffers.&nbsp;</p>
  945.  
  946.  
  947.  
  948. <p><code>scanruns</code> does not check that those pointers remain within the bounds of the allocated buffers.</p>
  949.  
  950.  
  951.  
  952. <pre class="wp-block-code"><code>//libdjvu/MMRDecoder.cpp
  953. const unsigned short *
  954. MMRDecoder::scanruns(const unsigned short **endptr)
  955. {
  956. ...
  957.  // Swap run buffers
  958.  unsigned short *pr = lineruns;
  959.  unsigned short *xr = prevruns;
  960.  prevruns = pr;
  961.  lineruns = xr;
  962. ...
  963.  for(a0=0,rle=0,b1=*pr++;a0 &lt; width;)
  964.    {
  965.     ...
  966.            *xr = rle; xr++; rle = 0;
  967.     ...
  968.            *xr = rle; xr++; rle = 0;
  969. ...
  970.          *xr = inc+rle-a0;
  971.          xr++;
  972. }</code></pre>
  973.  
  974.  
  975.  
  976. <p>This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with <code>pr</code> is also possible for the same reason.</p>
  977.  
  978.  
  979.  
  980. <p>We will publish the source code of our proof of concept exploit in a couple of weeks&rsquo; time in the <a href="https://github.com/github/securitylab">GitHub Security Lab repository</a>.</p>
  981.  
  982.  
  983.  
  984. <h1 class="wp-block-heading" id="h-acknowledgements">Acknowledgements</h1>
  985.  
  986.  
  987.  
  988. <p>We would like to thank L&eacute;on Bottou and Bill Riemers for responding incredibly quickly and releasing a fix less than two days after we first contacted them!</p>
  989.  
  990.  
  991.  
  992. <h1 class="wp-block-heading" id="h-timeline">Timeline</h1>
  993.  
  994.  
  995.  
  996. <ul class="wp-block-list">
  997. <li>2025-07-01: Reported via email to the authors: L&eacute;on Bottou, Bill Riemers, Yann LeCun.</li>
  998.  
  999.  
  1000.  
  1001. <li>2025-07-01: Responses received from Bill Riemers and L&eacute;on Bottou.</li>
  1002.  
  1003.  
  1004.  
  1005. <li>2025-07-02: Fix commit added by L&eacute;on Bottou: <a href="https://sourceforge.net/p/djvu/djvulibre-git/ci/33f645196593d70bd5e37f55b63886c31c82c3da/">https://sourceforge.net/p/djvu/djvulibre-git/ci/33f645196593d70bd5e37f55b63886c31c82c3da/</a></li>
  1006.  
  1007.  
  1008.  
  1009. <li>2025-07-03: DjVuLibre version 3.5.29 released: <a href="https://sourceforge.net/p/djvu/www-git/ci/9748b43794440aff40bae066132aa5c22e7fd6a3/">https://sourceforge.net/p/djvu/www-git/ci/9748b43794440aff40bae066132aa5c22e7fd6a3/</a>&nbsp;</li>
  1010. </ul>
  1011. </body></html>
  1012. <p>The post <a href="https://github.blog/security/vulnerability-research/cve-2025-53367-an-exploitable-out-of-bounds-write-in-djvulibre/">CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1013. ]]></content:encoded>
  1017. <post-id xmlns="com-wordpress:feed-additions:1">89368</post-id> </item>
  1018. <item>
  1019. <title>5 ways to transform your workflow using GitHub Copilot and MCP</title>
  1020. <link>https://github.blog/ai-and-ml/github-copilot/5-ways-to-transform-your-workflow-using-github-copilot-and-mcp/</link>
  1022. <dc:creator><![CDATA[Klint Finley]]></dc:creator>
  1023. <pubDate>Wed, 02 Jul 2025 17:44:02 +0000</pubDate>
  1024. <category><![CDATA[AI & ML]]></category>
  1025. <category><![CDATA[GitHub Copilot]]></category>
  1026. <category><![CDATA[agent mode]]></category>
  1027. <category><![CDATA[MCP]]></category>
  1028. <guid isPermaLink="false">https://github.blog/?p=89268</guid>
  1029.  
  1030. <description><![CDATA[<p>Learn how to streamline your development workflow with five different MCP use cases. </p>
  1031. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/5-ways-to-transform-your-workflow-using-github-copilot-and-mcp/">5 ways to transform your workflow using GitHub Copilot and MCP</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1032. ]]></description>
  1033. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  1034. <html><body><p>Traditional AI coding assistants typically operate in isolation, limited to the code in your current workspace. Now with the introduction of the Model Context Protocol (MCP), AI development workflows are further evolving to incorporate more tools and context.&nbsp;</p>
  1035.  
  1036.  
  1037.  
  1038. <p>MCP can enable AI assistants to interact with external systems like knowledge bases, data stores, and testing applications.</p>
  1039.  
  1040.  
  1041.  
  1042. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--1" style="border-top-width:4px">
  1043. <h3 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-what-is-mcp-anyway" style="margin-top:0">What is MCP, anyway?</h3>
  1044.  
  1045.  
  1046.  
  1047. <p>The Model Context Protocol (MCP) is an open standard developed by Anthropic that helps AI assistants like GitHub Copilot securely connect to external data sources and tools. MCP addresses a common challenge with Large Language Models (LLMs): providing the right context to generate accurate and useful responses. MCP standardizes how AI tools access external context&mdash;such as your codebase, documentation, or design specifications&mdash;and makes it easier to bring this context into your development workflow. For a deeper dive into MCP and why it&rsquo;s gaining popularity, check out <a href="https://github.blog/ai-and-ml/llms/what-the-heck-is-mcp-and-why-is-everyone-talking-about-it/">Cassidy Williams&rsquo;s article on the GitHub Blog</a>.</p>
  1048. </aside>
  1049.  
  1050.  
  1051.  
  1052. <p>The real value of MCP integration is that you can now perform tasks that previously required multiple tools, context switching, and manual effort&mdash;all directly in your IDE. That means you can save time, maintain focus, and ship code faster.</p>
  1053.  
  1054.  
  1055.  
  1056. <p>In this article, we&rsquo;ll explore five practical ways MCP integrations with GitHub Copilot can streamline your workflow. We&rsquo;ll follow a realistic scenario: implementing a secure JWT (JSON Web Token) authentication system for a web application, illustrating an end-to-end workflow with MCP.</p>
  1057.  
  1058.  
  1059.  
  1060. <p>Let&rsquo;s jump in.&nbsp;</p>
  1061.  
  1062.  
  1063.  
  1064. <h2 class="wp-block-heading" id="1-using-mcp-to-bridge-design-and-development-with-figma">1. Using MCP to bridge design and development with Figma&nbsp;</h2>
  1065.  
  1066.  
  1067.  
  1068. <p>The gap between design and development has long been a source of friction in product teams. MCP provides a standardized way for GitHub Copilot to securely access and interpret design specifications directly.&nbsp;</p>
  1069.  
  1070.  
  1071.  
  1072. <p>Instead of manually translating design details into code, MCP enables Copilot to automatically retrieve exact design parameters&mdash;such as colors, spacing, typography, and component states&mdash;and generate accurate, ready-to-use code. This integration reduces guesswork and streamlines the handoff between designers and developers.</p>
  1073.  
  1074.  
  1075.  
  1076. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--2" style="border-top-width:4px">
  1077. <h3 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-explore-github-copilot-s-agentic-capabilities" style="margin-top:0">Explore GitHub Copilot&rsquo;s agentic capabilities</h3>
  1078.  
  1079.  
  1080.  
  1081. <p>GitHub Copilot comes with two powerful agentic workflows that can be used with MCP:</p>
  1082.  
  1083.  
  1084.  
  1085. <ul class="wp-block-list">
  1086. <li><strong>Agent mode (in your IDE):</strong> Turn Copilot Chat into a real-time collaborator that works with you. Give it a goal (&ldquo;add OAuth &amp; tests&rdquo;), and it plans, edits files, runs the suite, reads failures, fixes them, and loops until everything is green&mdash;all right in front of you, with the option to pause or steer at any step.</li>
  1087.  
  1088.  
  1089.  
  1090. <li><strong>Coding agent (in your GitHub projects)</strong>: Hand an Issue to Copilot and walk away. It spins up a protected workspace with GitHub Actions, writes code, runs linters/tests, and opens a pull request for you to review. Perfect for well-scoped tickets you&rsquo;d give a junior dev (docs, tests, small refactors) while you stay focused elsewhere.<a href="https://github.blog/news-insights/product-news/github-copilot-meet-the-new-coding-agent/?utm_source=chatgpt.com">&nbsp;</a></li>
  1091. </ul>
  1092.  
  1093.  
  1094.  
  1095. <p><strong>TL;DR: </strong>Think of Agent mode as a co-driver at your keyboard; the Coding agent is the valet that brings the finished work to your repo.</p>
  1096.  
  1097.  
  1098.  
  1099. <p><a href="https://github.blog/news-insights/product-news/from-pair-to-peer-programmer-our-vision-for-agentic-workflows-in-github-copilot/">Learn more &gt;</a></p>
  1100. </aside>
  1101.  
  1102.  
  1103.  
  1104. <p>We&rsquo;ll start developing our new JWT authentication system by taking a look at the user-facing side. Let&rsquo;s say the design team updated the authentication UI components in Figma, including login forms, error states, loading spinners, and success messages. Now, you need to implement these changes to match the new design system.</p>
  1105.  
  1106.  
  1107.  
  1108. <p>Start by asking Copilot, &ldquo;What are the latest design updates for the login form and authentication components?&rdquo; It will then retrieve specs for the elements that need to change. Then you can prompt it to create React components for each element:</p>
  1109.  
  1110.  
  1111.  
  1112. <ul class="wp-block-list">
  1113. <li><code>LoginForm</code> with exact spacing, colors, typography</li>
  1114.  
  1115.  
  1116.  
  1117. <li><code>AuthErrorMessage</code> component with proper error styling</li>
  1118.  
  1119.  
  1120.  
  1121. <li><code>TokenRefreshNotification</code> component</li>
  1122. </ul>
  1123.  
  1124.  
  1125.  
  1126. <p>Copilot will then give you ready-to-use code that maintains consistency with the design specifications from Figma.</p>
  1127.  
  1128.  
  1129.  
  1130. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1131. <p><strong><strong>Learn more </strong></strong>about <a href="https://help.figma.com/hc/en-us/articles/32132100833559-Guide-to-the-Dev-Mode-MCP-Server">Figma&rsquo;s MCP server beta &gt;</a></p>
  1132. </div>
  1133.  
  1134.  
  1135.  
  1136. <h2 class="wp-block-heading" id="2-tap-into-your-obsidian-knowledge-base-with-mcp">2. Tap into your Obsidian knowledge base with MCP</h2>
  1137.  
  1138.  
  1139.  
  1140. <p>When implementing complex features like JWT authentication, you often need to reference past decisions, architectural notes, and research findings scattered across your knowledge base. The unofficial, community-maintained Obsidian MCP server bridges this gap by connecting GitHub Copilot directly to your Obsidian vault.</p>
  1141.  
  1142.  
  1143.  
  1144. <p>Let&rsquo;s say you&rsquo;re implementing JWT token validation and need to understand your team&rsquo;s previous security decisions. You tell Copilot: &ldquo;Search for all files where JWT or token validation is mentioned and explain the context.&rdquo;</p>
  1145.  
  1146.  
  1147.  
  1148. <p>With that, Copilot can:</p>
  1149.  
  1150.  
  1151.  
  1152. <ul class="wp-block-list">
  1153. <li>Search across all Markdown files in your vault for relevant security patterns</li>
  1154.  
  1155.  
  1156.  
  1157. <li>Retrieve contents from specific architecture decision records (ADR)</li>
  1158.  
  1159.  
  1160.  
  1161. <li>Access meeting notes from previous security reviews</li>
  1162.  
  1163.  
  1164.  
  1165. <li>Pull implementation guidelines from your team&rsquo;s coding standards</li>
  1166. </ul>
  1167.  
  1168.  
  1169.  
  1170. <p>You might follow up with the following prompt: &ldquo;Get the contents of the last architecture call note about authentication and summarize the key decisions.&rdquo; Copilot will locate the relevant file and extract the critical information you need to inform your implementation approach.</p>
  1171.  
  1172.  
  1173.  
  1174. <p>Once you&rsquo;ve gathered the necessary context, you can ask Copilot to synthesize this information: &ldquo;Create a new note called &lsquo;jwt-implementation-summary.md&rsquo; that combines our authentication standards with the new JWT approach.&rdquo; Copilot will create this documentation directly in your vault, helping maintain your team&rsquo;s knowledge base.</p>
  1175.  
  1176.  
  1177.  
  1178. <p><strong>Setup note</strong>: This integration requires the community &ldquo;Obsidian Local REST API&rdquo; plugin and an API key.</p>
  1179.  
  1180.  
  1181.  
  1182. <p>With your research complete and documented, you can proceed to test your application.</p>
  1183.  
  1184.  
  1185.  
  1186. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1187. <p><strong>Learn more</strong> about <a href="https://github.com/MarkusPfundstein/mcp-obsidian">accessing Obsidian through MCP &gt;</a></p>
  1188. </div>
  1189.  
  1190.  
  1191.  
  1192. <h2 class="wp-block-heading" id="3-test-your-code-with-playwright">3. Test your code with Playwright</h2>
  1193.  
  1194.  
  1195.  
  1196. <p>Integrating MCP with Playwright transforms test creation from a manual, error-prone process into a simple, guided experience.</p>
  1197.  
  1198.  
  1199.  
  1200. <p>Modern web applications often involve complex user journeys, asynchronous operations, and dynamic content. Authentication flows are particularly challenging to test comprehensively.</p>
  1201.  
  1202.  
  1203.  
  1204. <p>Continuing with our JWT authentication system, you need to test the complete authentication flow including login, token refresh, and secure route access. To do this, you&rsquo;ll start by giving Copilot a prompt like this: &ldquo;Test the JWT authentication flow including login, automatic token refresh, and access to protected routes.&rdquo;</p>
  1205.  
  1206.  
  1207.  
  1208. <p>From there, Copilot will analyze your authentication implementation and generate comprehensive test coverage. But it doesn&rsquo;t stop there. Copilot then runs the tests with Playwright and provides immediate feedback on failures, suggesting fixes for common issues, like timing problems or selector changes.</p>
  1209.  
  1210.  
  1211.  
  1212. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1213. <p><strong>Learn more </strong>about the <a href="https://github.com/microsoft/playwright-mcp">Playwright MCP server &gt;</a></p>
  1214. </div>
  1215.  
  1216.  
  1217.  
  1218. <h2 class="wp-block-heading" id="4-file-pull-requests-faster">4. File pull requests faster</h2>
  1219.  
  1220.  
  1221.  
  1222. <p>Pull requests are the cornerstone of collaborative development. GitHub&rsquo;s remote MCP server, <a href="https://github.blog/changelog/2025-06-12-remote-github-mcp-server-is-now-available-in-public-preview/">now in public beta for VS Code or Visual Studio</a>, helps transform the process into an intelligent, automated workflow.</p>
  1223.  
  1224.  
  1225.  
  1226. <p>Turning back to our JWT authentication example, you can prompt Copilot: &ldquo;Create a pull request for my authentication feature changes&rdquo;</p>
  1227.  
  1228.  
  1229.  
  1230. <p>Copilot will then analyze:</p>
  1231.  
  1232.  
  1233.  
  1234. <ul class="wp-block-list">
  1235. <li>Code changes across multiple files&nbsp;&nbsp;</li>
  1236.  
  1237.  
  1238.  
  1239. <li>Related issues and project context&nbsp;&nbsp;</li>
  1240.  
  1241.  
  1242.  
  1243. <li>Team review patterns and expertise areas&nbsp;&nbsp;</li>
  1244.  
  1245.  
  1246.  
  1247. <li>Previous similar implementations</li>
  1248. </ul>
  1249.  
  1250.  
  1251.  
  1252. <p>Copilot returns Markdown with an overview, changes made, a testing strategy, and even related issues.</p>
  1253.  
  1254.  
  1255.  
  1256. <p>It will then suggest appropriate reviewers for each aspect of the change based on code ownership, expertise mapping, and current workload.</p>
  1257.  
  1258.  
  1259.  
  1260. <p>Once your application is deployed, you can move on to monitoring it.</p>
  1261.  
  1262.  
  1263.  
  1264. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1265. <p><strong>Get started</strong> with <a href="https://docs.github.com/en/copilot/tutorials/enhancing-copilot-agent-mode-with-mcp">GitHub&rsquo;s MCP server &gt;</a></p>
  1266. </div>
  1267.  
  1268.  
  1269.  
  1270. <h2 class="wp-block-heading" id="5-monitor-application-performance">5. Monitor application performance</h2>
  1271.  
  1272.  
  1273.  
  1274. <p>With the core authentication logic handled, now it&rsquo;s time to ensure that our application performs well by monitoring how it behaves in production. Using MCP to connect to Grafana through the open-source Grafana MCP server makes this easier&mdash;though setup requires a few configuration steps.</p>
  1275.  
  1276.  
  1277.  
  1278. <p>Let&rsquo;s say you need to analyze the JWT authentication system&rsquo;s latency metrics and error rates. You tell Copilot: &ldquo;Show me auth latency and error-rate panels for the auth-service dashboard for the last 6 hours.&rdquo;</p>
  1279.  
  1280.  
  1281.  
  1282. <p>After configuring the Grafana MCP server with your API key and host URL, Copilot can then query your Grafana instance to:</p>
  1283.  
  1284.  
  1285.  
  1286. <ul class="wp-block-list">
  1287. <li>Examine authentication latency metrics and p95 response times</li>
  1288.  
  1289.  
  1290.  
  1291. <li>Analyze error rates for login endpoints over time</li>
  1292.  
  1293.  
  1294.  
  1295. <li>Review existing alert rules for authentication services</li>
  1296.  
  1297.  
  1298.  
  1299. <li>Identify patterns in failed authentication attempts</li>
  1300. </ul>
  1301.  
  1302.  
  1303.  
  1304. <p>Copilot returns panel data as base64-encoded images and can extract raw time-series data when needed. If you need a longer time range, you can specify: &ldquo;Show me the same metrics for the last 24 hours&rdquo; and Copilot will adjust the query parameters accordingly.</p>
  1305.  
  1306.  
  1307.  
  1308. <p>For more advanced monitoring workflows, you can enable write operations by launching the server with the <code>--enable-write</code> flag and an Editor-role API key. This allows Copilot to create new alert rules or modify dashboard configurations based on your authentication metrics analysis.</p>
  1309.  
  1310.  
  1311.  
  1312. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1313. <p><strong>Learn more </strong>about the <a href="https://github.com/grafana/mcp-grafana">Grafana MCP server &gt;</a></p>
  1314. </div>
  1315.  
  1316.  
  1317.  
  1318. <h2 class="wp-block-heading" id="whats-next">What&rsquo;s next?</h2>
  1319.  
  1320.  
  1321.  
  1322. <p>Before diving into these powerful integrations, you&rsquo;ll need to configure your development environment. Here&rsquo;s how:</p>
  1323.  
  1324.  
  1325.  
  1326. <ol class="wp-block-list">
  1327. <li><strong>Install MCP extensions</strong>: Enable MCP support in your IDE through official extensions</li>
  1328.  
  1329.  
  1330.  
  1331. <li><strong>Configure API access</strong>: Set up authentication for each service (GitHub, Obsidian, Figma, etc.)</li>
  1332.  
  1333.  
  1334.  
  1335. <li><strong>Define context boundaries</strong>: Establish what information should be accessible to AI</li>
  1336.  
  1337.  
  1338.  
  1339. <li><strong>Security considerations</strong>: Implement proper access controls and data privacy measures</li>
  1340. </ol>
  1341.  
  1342.  
  1343.  
  1344. <p>A few best practices:</p>
  1345.  
  1346.  
  1347.  
  1348. <ul class="wp-block-list">
  1349. <li><strong>Start small</strong>: Begin with one integration and gradually expand your usage</li>
  1350.  
  1351.  
  1352.  
  1353. <li><strong>Maintain documentation</strong>: Keep your knowledge bases and documentation current for optimal AI assistance</li>
  1354.  
  1355.  
  1356.  
  1357. <li><strong>Regularly review Copilot&rsquo;s outputs</strong>: Periodically audit AI-generated suggestions to ensure quality and security</li>
  1358.  
  1359.  
  1360.  
  1361. <li><strong>Build team alignment</strong>: Ensure your team understands and adopts consistent MCP usage patterns</li>
  1362. </ul>
  1363.  
  1364.  
  1365.  
  1366. <p>The five integration patterns we&rsquo;ve explored represent just the beginning of what&rsquo;s possible. As MCP&rsquo;s ecosystem grows, new tools and integrations will continue to expand what&rsquo;s possible.</p>
  1367.  
  1368.  
  1369.  
  1370. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1371. <p><strong>Get started</strong> with our <a href="https://docs.github.com/en/copilot/tutorials/enhancing-copilot-agent-mode-with-mcp">remote MCP server &gt;</a></p>
  1372. </div>
  1373. </body></html>
  1374. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/5-ways-to-transform-your-workflow-using-github-copilot-and-mcp/">5 ways to transform your workflow using GitHub Copilot and MCP</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1375. ]]></content:encoded>
  1379. <post-id xmlns="com-wordpress:feed-additions:1">89268</post-id> </item>
  1380. <item>
  1381. <title>From idea to PR: A guide to GitHub Copilot’s agentic workflows</title>
  1382. <link>https://github.blog/ai-and-ml/github-copilot/from-idea-to-pr-a-guide-to-github-copilots-agentic-workflows/</link>
  1384. <dc:creator><![CDATA[Chris Reddington]]></dc:creator>
  1385. <pubDate>Tue, 01 Jul 2025 18:57:22 +0000</pubDate>
  1386. <category><![CDATA[AI & ML]]></category>
  1387. <category><![CDATA[GitHub Copilot]]></category>
  1388. <category><![CDATA[agentic AI]]></category>
  1389. <category><![CDATA[generative AI]]></category>
  1390. <guid isPermaLink="false">https://github.blog/?p=89198</guid>
  1391.  
  1392. <description><![CDATA[<p>A practical guide to GitHub Copilot’s agentic coding agent, chat modes, and remote MCP server so you turn issues into tested PRs with clear steps (and no hype).</p>
  1393. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/from-idea-to-pr-a-guide-to-github-copilots-agentic-workflows/">From idea to PR: A guide to GitHub Copilot’s agentic workflows</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1394. ]]></description>
  1395. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  1396. <html><body><p>I got into software to ship ideas, not to chase down hard-coded strings after a late-breaking feature request. Unfortunately, many of our day-to-day tasks as developers involve branches working on boilerplate code, refactoring, and the &ldquo;pre-work&rdquo; to get to the fun stuff: shipping new features.</p>
  1397.  
  1398.  
  1399.  
  1400. <p>So I turned to Copilot&rsquo;s agentic workflows to help speed along some of that grunt work. In my latest <strong>Rubber Duck Thursdays</strong> live stream, I put that theory to the test in a project where I wanted to localize an application that used:</p>
  1401.  
  1402.  
  1403.  
  1404. <ul class="wp-block-list">
  1405. <li><strong>Tech stack:</strong> a <strong>Next.js</strong> web app and a matching <strong>SwiftUI</strong> iOS app living in two separate GitHub repos.</li>
  1406.  
  1407.  
  1408.  
  1409. <li><strong>Environment:</strong> spun up rapidly in <strong>Codespaces</strong> (on-demand dev environment) and <strong>Xcode 16</strong> for the mobile portion.</li>
  1410.  
  1411.  
  1412.  
  1413. <li><strong>Task:</strong> an issue built from a couple of paragraphs to &ldquo;Add English, French, and Spanish localization.&rdquo;</li>
  1414.  
  1415.  
  1416.  
  1417. <li><strong>Copilot tools:</strong> <a href="https://docs.github.com/en/copilot/concepts/about-assigning-tasks-to-copilot"><strong>coding agent</strong></a> (to turn that issue into a PR), a <a href="https://code.visualstudio.com/docs/copilot/chat/chat-modes#_chat-mode-file-example">custom <strong>planning chat mode</strong></a><strong> </strong>(to try out the new preview capabilities in VS Code), and the new <strong>remote </strong><a href="https://github.com/github/github-mcp-server?tab=readme-ov-file#usage-with-vs-code"><strong>GitHub MCP server</strong></a> (so we can avoid managing those dependencies in our dev environment).</li>
  1418. </ul>
  1419.  
  1420.  
  1421.  
  1422. <p>By the end of my stream, that idea became a GitHub issue, which turned into a fully tested, review-ready PR while I fielded chat questions, and learned about the preview custom chat mode features in VS Code.</p>
  1423.  
  1424.  
  1425.  
  1426. <p>Let&rsquo;s dive in.</p>
  1427.  
  1428.  
  1429.  
  1430. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  1431. <iframe loading="lazy" title="Rubber Duck Thursdays - Let's build" width="500" height="281" src="https://www.youtube.com/embed/UXAbtYbxD_w?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  1432. </div></figure>
  1433.  
  1434.  
  1435.  
  1436. <h2 class="wp-block-heading" id="h-why-i-use-agentic-workflows">Why I use agentic workflows</h2>
  1437.  
  1438.  
  1439.  
  1440. <p>Even seasoned developers and teams still burn hours on jobs like:</p>
  1441.  
  1442.  
  1443.  
  1444. <ul class="wp-block-list">
  1445. <li>Turning vague requests into well-scoped issues</li>
  1446.  
  1447.  
  1448.  
  1449. <li>Hunting down every file in a cross-cutting refactor</li>
  1450.  
  1451.  
  1452.  
  1453. <li>Writing the same unit-test scaffolding again and again</li>
  1454. </ul>
  1455.  
  1456.  
  1457.  
  1458. <p>Copilot&rsquo;s ability to create issues, along with its coding agent, custom chat modes in VS Code, and the new remote MCP backend fold those chores into one tight loop&mdash;issue to PR&mdash;while you stay firmly in the driver&rsquo;s seat. You still review, tweak, and decide when to merge, but you skip the drudgery.</p>
  1459.  
  1460.  
  1461.  
  1462. <h2 class="wp-block-heading" id="h-key-capabilities-covered-in-this-livestream-nbsp">Key capabilities covered in this livestream&nbsp;</h2>
  1463.  
  1464.  
  1465.  
  1466. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>Capability</strong></th><th><strong>What it does</strong></th><th><strong>Why it matters</strong></th><th><strong>How to enable and use it</strong></th></tr></thead><tbody><tr><td>Coding agent</td><td>Turns any GitHub Issue you assign to Copilot into a PR, and works on that task asynchronously.</td><td>Allows you to offload the boilerplate work while you focus on reviews and edge case logic.</td><td><a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-coding-agent/enabling-copilot-coding-agent">Learn how to enable Copilot coding agent</a>.&nbsp;</td></tr><tr><td>Create issues with Copilot</td><td>Converts a natural-language prompt into a well-structured Issue with title, body, acceptance criteria, and file hints.</td><td>Saves PM/eng refining and sets team members, or Copilot coding agent, up with the context they need to work effectively.</td><td>Navigate to <a href="http://github.com/copilot">github.com/copilot</a> and write a prompt to create an issue. <a href="https://docs.github.com/en/copilot/how-tos/github-flow/using-github-copilot-to-create-issues">Learn more about using Copilot to create issues.</a></td></tr><tr><td>Custom chat modes (in preview in VS Code)</td><td>Lets you script repeatable AI workflows (e.g., <em>Planning</em>, <em>Refactor</em>, <em>Test-Writer</em>) that appear alongside the default <em>Ask</em> / <em>Edit</em> / <em>Agent</em> chat modes.</td><td>Allows you to package instructions and relevant tools for easier use, helping your team follow similar conventions.</td><td>Add a <code>.chatmode.md</code> file to your repo; available in preview in VS Code release 1.101. <a href="https://code.visualstudio.com/docs/copilot/chat/chat-modes#_custom-chat-modes">Learn more about custom chat modes in VS Code</a>.<br></td></tr><tr><td>Remote GitHub MCP Server</td><td>Allows AI tools to access live GitHub context and tools, like issues, pull requests and code files. With the remote GitHub MCP server, you don&rsquo;t need to install it locally, and can even authenticate with OAuth 2.0.</td><td>Provides a smooth experience to accessing the GitHub MCP server, reducing the management overhead of a local server.</td><td>Update your MCP configuration with <a href="https://github.com/github/github-mcp-server?tab=readme-ov-file#usage-with-vs-code">the example shown in the remote GitHub MCP Server documentation</a>.&nbsp;</td></tr><tr><td>Copilot agent mode</td><td>Copilot agent mode is a real&#8209;time collaborator that sits in your editor, works with you, and edits files based on your needs. Unlike the coding agent, Copilot agent mode works synchronously with you.</td><td>Think of agent mode as the senior dev pair programming with you. It has access to several tools (like reading/writing code, running commands in the terminal, executing tools on MCP servers), and works alongside you.</td><td>Copilot agent mode is available in several IDEs including <a href="https://code.visualstudio.com/docs/copilot/chat/chat-agent-mode">VS Code</a>, <a href="https://learn.microsoft.com/en-us/visualstudio/ide/copilot-agent-mode?view=vs-2022">Visual Studio</a>, <a href="https://plugins.jetbrains.com/plugin/17718-github-copilot">JetBrains</a> (public preview), <a href="https://marketplace.eclipse.org/content/github-copilot">Eclipse</a> (public preview) and <a href="https://github.com/github/copilotforXcode/">Xcode</a> (public preview).</td></tr></tbody></table></figure>
  1467.  
  1468.  
  1469.  
  1470. <h2 class="wp-block-heading" id="h-what-you-need-to-achieve-a-similar-outcome">What you need to achieve a similar outcome</h2>
  1471.  
  1472.  
  1473.  
  1474. <ol class="wp-block-list">
  1475. <li>A GitHub repo you can push to</li>
  1476.  
  1477.  
  1478.  
  1479. <li>A Copilot subscription with <strong>coding agent</strong> enabled. (Did you know it&rsquo;s now available for all paid tiers of GitHub Copilot including <a href="https://github.blog/changelog/2025-06-24-github-copilot-coding-agent-is-now-available-for-copilot-business-users/">Copilot Business</a> and <a href="https://github.blog/changelog/2025-06-25-github-copilot-coding-agent-is-available-for-copilot-pro-users-in-public-preview/">Copilot Pro</a>?)</li>
  1480.  
  1481.  
  1482.  
  1483. <li>VS Code 1.101+ with the latest Copilot extension.</li>
  1484.  
  1485.  
  1486.  
  1487. <li>Either: <strong>GitHub Remote MCP server</strong> (update your MCP configuration), or a local GitHub MCP server.</li>
  1488. </ol>
  1489.  
  1490.  
  1491.  
  1492. <h2 class="wp-block-heading" id="h-walk-through-localizing-a-next-js-app">Walk-through: localizing a Next.js app</h2>
  1493.  
  1494.  
  1495.  
  1496. <p>Here&rsquo;s the exact flow I demoed on the most recent <em>Rubber Duck Thursdays</em> stream.</p>
  1497.  
  1498.  
  1499.  
  1500. <h3 class="wp-block-heading" id="h-1-capture-the-request-as-a-github-issue">1. Capture the request as a GitHub Issue</h3>
  1501.  
  1502.  
  1503.  
  1504. <p>Go to the <a href="https://github.com/copilot">immersive view of Copilot Chat</a>. At the bottom of the page, in the &ldquo;Ask Copilot&rdquo; box, describe what you want. For example, below is the prompt that I used.&nbsp;</p>
  1505.  
  1506.  
  1507.  
  1508. <pre class="wp-block-code language-plaintext"><code>Create a GitHub Issue that brings i11n capability to the application. We must support English, French and Spanish.
  1509.  
  1510. The user must be able to change their language in their profile page. When they change the language, it must apply immediately across the site.
  1511.  
  1512. Please include an overview/problem statement in the issue, a set of acceptance criteria, and pointers on which files need updating/creating.</code></pre>
  1513.  
  1514.  
  1515.  
  1516. <p>Copilot drafts that into an issue, which includes a title, acceptance criteria, and a loose action plan. From there, you can assign that issue to Copilot, and let it cook in the background.&nbsp;</p>
  1517.  
  1518.  
  1519.  
  1520. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  1521. <iframe loading="lazy" title="Create an Issue with GitHub Copilot" width="500" height="281" src="https://www.youtube.com/embed/QtVr1SjLYzA?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  1522. </div></figure>
  1523.  
  1524.  
  1525.  
  1526. <h3 class="wp-block-heading" id="h-2-let-the-coding-agent-turn-the-issue-into-a-pr">2. Let the coding agent turn the issue into a PR</h3>
  1527.  
  1528.  
  1529.  
  1530. <p>Shortly after assignment, the coding agent:</p>
  1531.  
  1532.  
  1533.  
  1534. <ol class="wp-block-list">
  1535. <li>Creates a branch</li>
  1536.  
  1537.  
  1538.  
  1539. <li>Starts a new session. If you <a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-coding-agent/customizing-the-development-environment-for-copilot-coding-agent">have a copilot-setup-steps.yml configured</a>, then a development environment will be configured before Copilot gets to work.</li>
  1540.  
  1541.  
  1542.  
  1543. <li>Reviews the task at hand, explores the current state of the codebase, and forms a plan to complete the task.</li>
  1544.  
  1545.  
  1546.  
  1547. <li>If you have <a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-coding-agent/best-practices-for-using-copilot-to-work-on-tasks#adding-custom-instructions-to-your-repository">any custom instructions configured</a>, then the coding agent will also use those as context. For example, we specify that npm run lint and npm run test should pass before committing.</li>
  1548.  
  1549.  
  1550.  
  1551. <li>Once complete, it opens a draft PR for your review.</li>
  1552. </ol>
  1553.  
  1554.  
  1555.  
  1556. <p>While that runs, you can keep coding, use it as an opportunity to learn (like we learned about custom chat modes) or grab a coffee.</p>
  1557.  
  1558.  
  1559.  
  1560. <h3 class="wp-block-heading" id="h-3-review-the-pr-like-you-normally-would">3. Review the PR like you normally would</h3>
  1561.  
  1562.  
  1563.  
  1564. <p>Whether it&rsquo;s a colleague, collaborator, or Copilot writing the code, you still need a reviewer. So it&rsquo;s important to make sure you look the code over carefully, just like you would any other pull request.</p>
  1565.  
  1566.  
  1567.  
  1568. <ol class="wp-block-list">
  1569. <li>Start by reviewing the body of the pull request, which Copilot will have helpfully kept up to date.</li>
  1570.  
  1571.  
  1572.  
  1573. <li>Then, review the code changes in the files changed tab, understanding what has changed and why. I also like to take a look at the coding agent session to understand the approach Copilot took to solving the problem.</li>
  1574.  
  1575.  
  1576.  
  1577. <li>Once you are comfortable, you may want to try the code out manually in a GitHub Codespace. Or, you may want to run any existing CI checks through your GitHub Actions workflows. But again, make sure you have carefully reviewed the code before executing it.</li>
  1578.  
  1579.  
  1580.  
  1581. <li>All being well, you will have green check marks being returned from your CI.&nbsp;</li>
  1582. </ol>
  1583.  
  1584.  
  1585.  
  1586. <p>However, there&rsquo;s always a possibility that you encounter failures, or spot some changes in your manual testing. For example, I spotted some hard-coded strings that the agent hadn&rsquo;t addressed. Once again, we approach this just like we would any other pull request. We can post our feedback in a comment. For example, here&rsquo;s the comment I used:</p>
  1587.  
  1588.  
  1589.  
  1590. <p>That&rsquo;s a great start. However, there are a lot of pages which are hardcoded in English still. For example, the flight search/bookings page, the check reservation page. Can you implement the localization on those pages, please?</p>
  1591.  
  1592.  
  1593.  
  1594. <p>Copilot will react to the comment once again, and get to work in another session.&nbsp;</p>
  1595.  
  1596.  
  1597.  
  1598. <h2 class="wp-block-heading" id="h-level-up-your-workflows-with-custom-chat-modes">Level up your workflows with custom chat modes</h2>
  1599.  
  1600.  
  1601.  
  1602. <p>If you&rsquo;re using VS Code as your daily driver with GitHub Copilot, then you&rsquo;re probably used to the <a href="https://github.blog/ai-and-ml/github-copilot/copilot-ask-edit-and-agent-modes-what-they-do-and-when-to-use-them/">ask, edit and agent chat modes</a>. But in the <a href="https://code.visualstudio.com/updates/v1_101">VS Code 1.101 release</a>, the team has added custom chat modes in preview. This allows you to package instructions and relevant tools for easier use. For example, I built upon <a href="https://code.visualstudio.com/docs/copilot/chat/chat-modes#_chat-mode-file-example">the VS Code team&rsquo;s &ldquo;Plan&rdquo; chat mode example</a>:</p>
  1603.  
  1604.  
  1605.  
  1606. <ol class="wp-block-list">
  1607. <li>Open the command palette in Visual Studio Code</li>
  1608.  
  1609.  
  1610.  
  1611. <li>Type <strong>Configure Chat Modes</strong></li>
  1612.  
  1613.  
  1614.  
  1615. <li>Select <strong>Create new custom chat mode file</strong>.<strong> </strong>You&rsquo;ll be asked to save it either in the workspace (to allow collaborating with others), or in the local user data folder (for your use). We opted for the workspace option.</li>
  1616.  
  1617.  
  1618.  
  1619. <li>Enter the name. This is the name that will appear in the chat mode selection box, so pay attention to any capitalization.</li>
  1620.  
  1621.  
  1622.  
  1623. <li>You should see a new file has been created with the extension <code>.chatmode.md</code>. This is where you can configure the instructions, and the available tools for your new custom chat mode.</li>
  1624. </ol>
  1625.  
  1626.  
  1627.  
  1628. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  1629. <iframe loading="lazy" title="GitHub Copilot Chat in VS Code" width="500" height="281" src="https://www.youtube.com/embed/v5Wqs7s5scg?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  1630. </div></figure>
  1631.  
  1632.  
  1633.  
  1634. <p>Below is the example that we used in the livestream, slightly modified from the VS Code team&rsquo;s docs example. We&rsquo;ve added the create_issue tool to the list of allowed tools, adjusted our expectations of what&rsquo;s included in the issue and added an instruction about creating the issue with the `create_issue` tool once revisions are complete and approved by the user.</p>
  1635.  
  1636.  
  1637.  
  1638. <pre class="wp-block-code language-plaintext"><code>---
  1639.  
  1640. description: Generate an implementation plan for new features or refactoring existing code.
  1641.  
  1642. tools: ['codebase', 'fetch', 'findTestFiles', 'githubRepo', 'search', 'usages', 'github', 'create_issue']
  1643.  
  1644. ---
  1645.  
  1646. # Planning mode instructions
  1647.  
  1648. You are in planning mode. Your task is to generate an implementation plan for a new feature or for refactoring existing code.
  1649.  
  1650. Don't make any code edits, just generate a plan.
  1651.  
  1652. The plan consists of a Markdown document that describes the implementation plan, including the following sections:
  1653.  
  1654. * Overview: A brief description of the feature or refactoring task.
  1655.  
  1656. * Requirements: A list of requirements for the feature or refactoring task.
  1657.  
  1658. * Implementation Steps: A detailed list of steps to implement the feature or refactoring task.
  1659.  
  1660. * Testing: A list of tests that need to be implemented to verify the feature or refactoring task.
  1661.  
  1662. Once the plan is complete, ask the user if they would like to create a GitHub issue for this implementation plan. If they respond affirmatively, proceed to create the issue using the `create_issue` tool.</code></pre>
  1663.  
  1664.  
  1665.  
  1666. <p>When the file is available in your teammate&rsquo;s local repositories (so they&rsquo;ve pulled the changes locally), VS Code surfaces the mode in the chat dropdown, allowing you to configure chat modes that are consistent and convenient across your team.</p>
  1667.  
  1668.  
  1669.  
  1670. <h2 class="wp-block-heading" id="h-remote-mcp-removing-the-local-setup">Remote MCP: removing the local setup</h2>
  1671.  
  1672.  
  1673.  
  1674. <p>You may be used to running MCP locally through npm packages or as docker containers. However, remote MCP servers allow you to reduce the management overhead of running these tools locally. There may be other benefits too. For example, the remote GitHub MCP Servers allows you to authenticate using OAuth 2.0 instead of Personal Access Tokens.</p>
  1675.  
  1676.  
  1677.  
  1678. <p>To use the GitHub Remote MCP Server in VS Code, you&rsquo;ll need to update the MCP configuration. You can find the instructions on how to do that <a href="https://github.com/github/github-mcp-server?tab=readme-ov-file#remote-github-mcp-server">in the GitHub MCP Server repository</a>.</p>
  1679.  
  1680.  
  1681.  
  1682. <figure class="wp-block-table"><table class="has-fixed-layout"><tbody><tr><td>&#128161; <strong>Note:</strong> Did you know that <a href="https://github.com/github/github-mcp-server">the GitHub MCP Server is open source</a>? Take a look through the codebase or raise an issue. Who knows? Maybe you&rsquo;ll even end up becoming a contributor!</td></tr></tbody></table></figure>
  1683.  
  1684.  
  1685.  
  1686. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  1687. <iframe loading="lazy" title="GitHub Remote MCP Server" width="500" height="281" src="https://www.youtube.com/embed/IZ0UICnVQwU?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  1688. </div></figure>
  1689.  
  1690.  
  1691.  
  1692. <h2 class="wp-block-heading" id="h-going-mobile-copilot-agent-mode-in-xcode">Going mobile: Copilot agent mode in Xcode</h2>
  1693.  
  1694.  
  1695.  
  1696. <p>While we didn&rsquo;t show it in depth, I quickly walked through one of my previous agent mode sessions in Xcode. It showed how I gave a similar prompt to Copilot, asking to add internationalization to the app, which we were able to see in the main navigation bar of the app running in the simulator.</p>
  1697.  
  1698.  
  1699.  
  1700. <pre class="wp-block-code language-plaintext"><code>We need to implement internationalization in the app. Please make the following changes:
  1701.  
  1702. 1. The user can select from suported languages (English, Spanish, French) from a dropdown in their profile.
  1703.  
  1704. 2. The main tab view should support internationalization. No other parts of the app should be changed for now.
  1705.  
  1706. 3. When the user changes the language, it should update the rendered text instantly.</code></pre>
  1707.  
  1708.  
  1709.  
  1710. <h2 class="wp-block-heading" id="h-dos-and-don-ts">Dos and don&rsquo;ts</h2>
  1711.  
  1712.  
  1713.  
  1714. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>&#9989; Do</strong></th><th><strong>&#10060; Don&rsquo;t</strong></th></tr></thead><tbody><tr><td>Keep issues tightly scoped</td><td>Ask the agent to &ldquo;re-architect the app&rdquo;</td></tr><tr><td>Provide acceptance criteria</td><td>Assume the agent knows your intent</td></tr><tr><td>Carefully review the changes made</td><td>Execute code or merge a PR without a review</td></tr><tr><td>Iterate with Copilot. How often do you get something right on the first shot?</td><td>Expect perfection first time</td></tr></tbody></table></figure>
  1715.  
  1716.  
  1717.  
  1718. <h2 class="wp-block-heading" id="h-try-it-yourself">Try it yourself</h2>
  1719.  
  1720.  
  1721.  
  1722. <ul class="wp-block-list">
  1723. <li><a href="https://docs.github.com/en/copilot/how-tos/agents/copilot-coding-agent/enabling-copilot-coding-agent">Enable Copilot coding agent</a> and assign work to Copilot in the background.</li>
  1724.  
  1725.  
  1726.  
  1727. <li><a href="https://code.visualstudio.com/docs/copilot/chat/chat-modes#_custom-chat-modes">Configure custom chat modes</a> in VS Code Release 1.101.</li>
  1728.  
  1729.  
  1730.  
  1731. <li><a href="https://github.com/github/github-mcp-server?tab=readme-ov-file#remote-github-mcp-server">Configure the Remote GitHub MCP server</a> to reduce local management efforts.</li>
  1732.  
  1733.  
  1734.  
  1735. <li>Use Copilot agent mode in <a href="https://code.visualstudio.com/docs/copilot/chat/chat-agent-mode">VS Code</a>, <a href="https://learn.microsoft.com/en-us/visualstudio/ide/copilot-agent-mode?view=vs-2022">Visual Studio</a>, <a href="https://plugins.jetbrains.com/plugin/17718-github-copilot">JetBrains</a> (public preview), <a href="https://marketplace.eclipse.org/content/github-copilot">Eclipse</a> (public preview) and <a href="https://github.com/github/copilotforXcode/">Xcode</a> (public preview).</li>
  1736. </ul>
  1737.  
  1738.  
  1739.  
  1740. <h2 class="wp-block-heading" id="h-next-steps">Next steps</h2>
  1741.  
  1742.  
  1743.  
  1744. <ul class="wp-block-list">
  1745. <li><a href="https://www.youtube.com/watch?v=UXAbtYbxD_w"><strong>Watch the full replay</strong> of the stream</a> for a step-by-step walkthrough.</li>
  1746.  
  1747.  
  1748.  
  1749. <li>Dive into the Copilot coding agent and MCP docs for more details.</li>
  1750.  
  1751.  
  1752.  
  1753. <li>Tell me what you automate first&mdash;let us know on social by tagging <code>@github</code> with what you&rsquo;ve been working on!</li>
  1754.  
  1755.  
  1756.  
  1757. <li><a href="https://gh.io/rubberduckthursdays">Join us for the next episode of Rubber Duck Thursdays</a>.</li>
  1758. </ul>
  1759.  
  1760.  
  1761.  
  1762. <p>Agentic workflows within GitHub Copilot aren&rsquo;t magic; they&rsquo;re tools. When a single click can help reduce technical debt (or knock out any other repetitive task you dread), why not let Copilot handle the boilerplate while you tackle the more challenging, fun, and creative problems?</p>
  1763. </body></html>
  1764. <p>The post <a href="https://github.blog/ai-and-ml/github-copilot/from-idea-to-pr-a-guide-to-github-copilots-agentic-workflows/">From idea to PR: A guide to GitHub Copilot’s agentic workflows</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1765. ]]></content:encoded>
  1769. <post-id xmlns="com-wordpress:feed-additions:1">89198</post-id> </item>
  1770. <item>
  1771. <title>Understand your software’s supply chain with GitHub’s dependency graph</title>
  1772. <link>https://github.blog/security/supply-chain-security/understand-your-softwares-supply-chain-with-githubs-dependency-graph/</link>
  1774. <dc:creator><![CDATA[Andrea Griffiths]]></dc:creator>
  1775. <pubDate>Tue, 01 Jul 2025 16:00:00 +0000</pubDate>
  1776. <category><![CDATA[Security]]></category>
  1777. <category><![CDATA[Supply chain security]]></category>
  1778. <category><![CDATA[Dependabot]]></category>
  1779. <category><![CDATA[dependency graph]]></category>
  1780. <category><![CDATA[supply chain]]></category>
  1781. <guid isPermaLink="false">https://github.blog/?p=89188</guid>
  1782.  
  1783. <description><![CDATA[<p>The GitHub dependency graph maps every direct and transitive dependency in your project, so you can identify risks, prioritize fixes, and keep your code secure.</p>
  1784. <p>The post <a href="https://github.blog/security/supply-chain-security/understand-your-softwares-supply-chain-with-githubs-dependency-graph/">Understand your software’s supply chain with GitHub’s dependency graph</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1785. ]]></description>
  1786. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  1787. <html><body><p>What if you could spot the weakest link in your software supply chain before it breaks?</p>
  1788.  
  1789.  
  1790.  
  1791. <p>With GitHub&rsquo;s <a href="https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph">dependency graph</a>, you can. By providing a clear, complete view of the external packages your code depends on, both directly and indirectly, it allows you to understand, secure, and manage your project&rsquo;s true footprint.</p>
  1792.  
  1793.  
  1794.  
  1795. <p>If you&rsquo;re like me and sometimes lose track of what&rsquo;s actually powering your applications (we&rsquo;ve all been there!), GitHub&rsquo;s dependency graph is about to become your new best friend.&nbsp;</p>
  1796.  
  1797.  
  1798.  
  1799. <h2 class="wp-block-heading" id="h-what-is-the-dependency-graph">What is the dependency graph?</h2>
  1800.  
  1801.  
  1802.  
  1803. <p>Here&rsquo;s the thing: Every modern software project is basically an iceberg. That small manifest file with your direct dependencies seems quite harmless at first glance. But underneath? There&rsquo;s this massive, hidden world of transitive dependencies that most of us never think about. The GitHub dependency graph maps this entire underwater world. Think of it like a family tree, but for your code. Each package is a family member, and each dependency relationship shows who&rsquo;s related to whom (and trust me, some of these family trees get <em>really</em> complicated).</p>
  1804.  
  1805.  
  1806.  
  1807. <p>Each package is a node. Each dependency relationship is an edge. The result? A full visual and structured representation of your software&rsquo;s external codebase.</p>
  1808.  
  1809.  
  1810.  
  1811. <blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
  1812. <p>In some cases, 95&ndash;97% of your code is actually someone else&rsquo;s. The dependency graph helps you make sense of that reality.</p>
  1813. <cite>GitHub engineer <a href="https://github.com/ahpook">Eric Sorenson</a></cite></blockquote>
  1814.  
  1815.  
  1816.  
  1817. <p>Let that sink in for a moment. We&rsquo;re basically curators of other people&rsquo;s work, and the dependency graph finally helps us make sense of that reality.</p>
  1818.  
  1819.  
  1820.  
  1821. <h2 class="wp-block-heading" id="h-why-it-matters">Why it matters</h2>
  1822.  
  1823.  
  1824.  
  1825. <p>When vulnerabilities are discovered in open source packages, the consequences ripple downstream. If you don&rsquo;t know a vulnerable dependency is part of your project, it&rsquo;s hard to take action.</p>
  1826.  
  1827.  
  1828.  
  1829. <p>The dependency graph isn&rsquo;t just a cool visualization (though it is pretty neat to look at). It&rsquo;s the foundation that makes <a href="https://github.com/dependabot">Dependabot</a> alerts possible. When a security issue is found in any of your dependencies (even a transitive one), GitHub notifies you. You get the full picture of what&rsquo;s in your supply chain, how it got there, and what you can actually do about it.</p>
  1830.  
  1831.  
  1832.  
  1833. <h2 class="wp-block-heading" id="h-see-it-in-action-from-21-to-1-000-dependencies">See it in action: From 21 to 1,000 dependencies</h2>
  1834.  
  1835.  
  1836.  
  1837. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  1838. <iframe loading="lazy" title="How 21 dependencies become 1,000: Understanding your software supply chain | GitHub Checkout" width="500" height="281" src="https://www.youtube.com/embed/gGQXIfLNmB0?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  1839. </div></figure>
  1840.  
  1841.  
  1842.  
  1843. <p>Eric showed us a project that looked innocent enough:</p>
  1844.  
  1845.  
  1846.  
  1847. <ul class="wp-block-list">
  1848. <li><strong>21 direct dependencies</strong> (the ones actually listed in package.json)</li>
  1849.  
  1850.  
  1851.  
  1852. <li><strong>1,000 total dependencies</strong> (including everything that got pulled in along the way)</li>
  1853. </ul>
  1854.  
  1855.  
  1856.  
  1857. <p>With the dependency graph, you can finally:</p>
  1858.  
  1859.  
  1860.  
  1861. <ul class="wp-block-list">
  1862. <li><strong>Understand which dependencies are direct vs. transitive</strong></li>
  1863.  
  1864.  
  1865.  
  1866. <li><strong>Trace how a package like Log4j ended up in your codebase.</strong> (Spoiler: it probably came along for the ride with something else.)</li>
  1867.  
  1868.  
  1869.  
  1870. <li><strong>Know what&rsquo;s yours to fix and what depends on an upstream maintainer</strong></li>
  1871. </ul>
  1872.  
  1873.  
  1874.  
  1875. <h2 class="wp-block-heading" id="h-tighten-your-supply-chain-with-dependabot">Tighten your supply chain with Dependabot</h2>
  1876.  
  1877.  
  1878.  
  1879. <p>Dependabot runs on top of the dependency graph&mdash;so enabling the graph is what makes Dependabot&rsquo;s vulnerability alerts and automatic fix suggestions possible.&nbsp;</p>
  1880.  
  1881.  
  1882.  
  1883. <p>Pro tip: Filter for direct dependencies first. These are the ones you can actually control, so focus your energy there instead of pulling your hair out over transitive dependencies that are someone else&rsquo;s responsibility.</p>
  1884.  
  1885.  
  1886.  
  1887. <h2 class="wp-block-heading" id="h-how-to-enable-the-dependency-graph">How to enable the dependency graph</h2>
  1888.  
  1889.  
  1890.  
  1891. <p>You can enable the dependency graph in your repository settings under <strong>Security &gt; Dependency Graph</strong>. If you turn on <strong>Dependabot</strong>, the graph will be enabled automatically.</p>
  1892.  
  1893.  
  1894.  
  1895. <p>Using GitHub Actions? Community-maintained actions can generate a Software Bill of Materials (SBOM) and submit it to GitHub&rsquo;s Dependency submission API, even if your language ecosystem doesn&rsquo;t support auto-discovery.</p>
  1896.  
  1897.  
  1898.  
  1899. <p>&#9989; <strong>The best part?</strong> Dependency graph and Dependabot alerts are free for all repositories.</p>
  1900.  
  1901.  
  1902.  
  1903. <h2 class="wp-block-heading" id="h-tl-dr">TL;DR</h2>
  1904.  
  1905.  
  1906.  
  1907. <p>You can&rsquo;t secure what you can&rsquo;t see. GitHub&rsquo;s dependency graph gives you visibility into the 90%+ of your codebase that comes from open source libraries and helps you take action when it counts.</p>
  1908.  
  1909.  
  1910.  
  1911. <ul class="wp-block-list">
  1912. <li><strong>Enable it today </strong>(seriously, do it now)</li>
  1913.  
  1914.  
  1915.  
  1916. <li><strong>Use it with Dependabot for automated alerts and fixes</strong></li>
  1917.  
  1918.  
  1919.  
  1920. <li><strong>Finally discover what&rsquo;s actually in your software supply chain</strong></li>
  1921. </ul>
  1922.  
  1923.  
  1924.  
  1925. <p>Your future self (and your security team) will thank you.</p>
  1926.  
  1927.  
  1928.  
  1929. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  1930. <p>Want to learn more about the GitHub dependency graph? <a href="https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph">Explore the documentation &gt;</a></p>
  1931. </div>
  1932. </body></html>
  1933. <p>The post <a href="https://github.blog/security/supply-chain-security/understand-your-softwares-supply-chain-with-githubs-dependency-graph/">Understand your software’s supply chain with GitHub’s dependency graph</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1934. ]]></content:encoded>
  1938. <post-id xmlns="com-wordpress:feed-additions:1">89188</post-id> </item>
  1939. <item>
  1940. <title>GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them</title>
  1941. <link>https://github.blog/security/github-advisory-database-by-the-numbers-known-security-vulnerabilities-and-what-you-can-do-about-them/</link>
  1943. <dc:creator><![CDATA[Jonathan Evans]]></dc:creator>
  1944. <pubDate>Fri, 27 Jun 2025 16:00:00 +0000</pubDate>
  1945. <category><![CDATA[Security]]></category>
  1946. <category><![CDATA[CNA]]></category>
  1947. <category><![CDATA[Community Contribution]]></category>
  1948. <category><![CDATA[CVE]]></category>
  1949. <category><![CDATA[CVE Numbering Authority]]></category>
  1950. <category><![CDATA[CVSS]]></category>
  1951. <category><![CDATA[CWE]]></category>
  1952. <category><![CDATA[EPSS]]></category>
  1953. <category><![CDATA[GitHub Security Lab]]></category>
  1954. <category><![CDATA[open source security]]></category>
  1955. <guid isPermaLink="false">https://github.blog/?p=89136</guid>
  1956.  
  1957. <description><![CDATA[<p>Use these insights to automate software security (where possible) to keep your projects safe.</p>
  1958. <p>The post <a href="https://github.blog/security/github-advisory-database-by-the-numbers-known-security-vulnerabilities-and-what-you-can-do-about-them/">GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  1959. ]]></description>
  1960. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  1961. <html><body><p>The <a href="https://github.com/advisories">GitHub Advisory Database</a> (Advisory DB) is a vital resource for developers, providing a comprehensive list of known security vulnerabilities and malware affecting open source packages. This post analyzes trends in the Advisory DB, highlighting the growth in reviewed advisories, ecosystem coverage, and source contributions in 2024. We&rsquo;ll delve into how GitHub provides actionable data to secure software projects.</p>
  1962.  
  1963.  
  1964.  
  1965. <h2 class="wp-block-heading" id="h-advisories">Advisories</h2>
  1966.  
  1967.  
  1968.  
  1969. <p>The GitHub Advisory Database contains a list of known security vulnerabilities and malware, grouped in three categories:&nbsp;</p>
  1970.  
  1971.  
  1972.  
  1973. <ul class="wp-block-list">
  1974. <li><strong>GitHub-reviewed advisories:</strong> Manually reviewed advisories in software packages that GitHub supports.</li>
  1975.  
  1976.  
  1977.  
  1978. <li><strong>Unreviewed advisories:</strong> These are automatically pulled from the National Vulnerability Database (NVD) and are either in the process of being reviewed, do not affect a supported package, or do not discuss a valid vulnerability.</li>
  1979.  
  1980.  
  1981.  
  1982. <li><strong>Malware advisories:</strong> These are specific to malware threats identified by the npm security team.</li>
  1983. </ul>
  1984.  
  1985.  
  1986.  
  1987. <h3 class="wp-block-heading" id="h-reviewed-advisories">Reviewed advisories</h3>
  1988.  
  1989.  
  1990.  
  1991. <p>GitHub-reviewed advisories are security vulnerabilities that have been mapped to packages in ecosystems we support. We carefully review each advisory for validity and ensure that they have a full description, and contain both ecosystem and package information.</p>
  1992.  
  1993.  
  1994.  
  1995. <p>Every year, GitHub increases the number of advisories we publish. We have been able to do this due to the increase in advisories coming from our sources (see Sources section below), expanding our ecosystem coverage (also described below), and review campaigns of advisories published before we started the database.&nbsp;</p>
  1996.  
  1997.  
  1998.  
  1999. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory1.png?resize=1024%2C633" alt="The bar graph shows the number of reviewed advisories added each year. The graph starts with 385 advisories added in 2019, shows an increase over time, and ends with 5256 advisories added in 2024." class="wp-image-89147" srcset="https://github.blog/wp-content/uploads/2025/06/advisory1.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory1.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory1.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory1.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory1.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory1.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2000.  
  2001.  
  2002.  
  2003. <p>In the past five years, the database has gone from fewer than 400 reviewed advisories to over 20,000 reviewed advisories in October of 2024.</p>
  2004.  
  2005.  
  2006.  
  2007. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="601" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory2.png?resize=1024%2C601" alt="The line graph shows the total reviewed advisories steadily increasing from 0 in 2019 to 20607 at the end of 2024." class="wp-image-89148" srcset="https://github.blog/wp-content/uploads/2025/06/advisory2.png?w=1308 1308w, https://github.blog/wp-content/uploads/2025/06/advisory2.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory2.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory2.png?w=1024 1024w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2008.  
  2009.  
  2010.  
  2011. <h3 class="wp-block-heading" id="unreviewed-advisories">Unreviewed advisories</h3>
  2012.  
  2013.  
  2014.  
  2015. <p>Unreviewed advisories are security vulnerabilities that we publish automatically into the GitHub Advisory Database directly from the National Vulnerability Database feed. The name is a bit of a misnomer as many of these advisories have actually been reviewed by a GitHub analyst. The reason why they fall into this category is because they are not found in a package in one of the supported ecosystems or are not discussing a valid vulnerability, and all have been reviewed by analysts other than someone from the GitHub Security Lab. Even though most of these advisories will never turn into a reviewed advisory, we still publish them so that you do not have to look in multiple databases at once.</p>
  2016.  
  2017.  
  2018.  
  2019. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="386" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory3.png?resize=1024%2C386" alt="The line graph shows the total number of advisories overtime. The graph shows a sudden jump in April 2022, when GitHub started publishing all vulnerabilities from the National Vulnerability Database feed. It then shows a gradual increase over time." class="wp-image-89149" srcset="https://github.blog/wp-content/uploads/2025/06/advisory3.png?w=1600 1600w, https://github.blog/wp-content/uploads/2025/06/advisory3.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory3.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory3.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory3.png?w=1536 1536w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2020.  
  2021.  
  2022.  
  2023. <h3 class="wp-block-heading" id="malware">Malware</h3>
  2024.  
  2025.  
  2026.  
  2027. <p>Malware advisories relate to vulnerabilities caused by malware, and are security advisories that GitHub publishes automatically into the GitHub Advisory Database directly from information provided by the npm security team. Malware advisories are currently exclusive to the npm ecosystem. GitHub doesn&rsquo;t edit or accept community contributions on these advisories.</p>
  2028.  
  2029.  
  2030.  
  2031. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="509" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory4.png?resize=1024%2C509" alt="The line graph shows the total malware advisories over time, from May 2022 to December 2024. The line shows a general upward trend in malware advisories over the period, ending at 13405 advisories." class="wp-image-89150" srcset="https://github.blog/wp-content/uploads/2025/06/advisory4.png?w=1494 1494w, https://github.blog/wp-content/uploads/2025/06/advisory4.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory4.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory4.png?w=1024 1024w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2032.  
  2033.  
  2034.  
  2035. <h2 class="wp-block-heading" id="ecosystem-coverage">Ecosystem coverage</h2>
  2036.  
  2037.  
  2038.  
  2039. <p>GitHub-reviewed advisories include security vulnerabilities that have been mapped to packages in ecosystems we support. Generally, we name our supported ecosystems after the software programming language&rsquo;s associated package registry. We review advisories if they are for a vulnerability in a package that comes from a supported registry.</p>
  2040.  
  2041.  
  2042.  
  2043. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>Ecosystem</strong></th><th><strong>Total advisories</strong></th><th><strong>Vulnerable packages</strong></th><th><strong>First added</strong></th></tr></thead><tbody><tr><td>pip (registry: <a href="https://pypi.org/">https://pypi.org/</a>)</td><td>3378</td><td>1044</td><td>2019-04-19</td></tr><tr><td>Maven (registry: <a href="https://repo.maven.apache.org/maven2">https://repo.maven.apache.org/maven2</a>)</td><td>5171</td><td>955</td><td>2019-04-22</td></tr><tr><td>Composer (registry: <a href="https://packagist.org/">https://packagist.org/</a>)</td><td>4238</td><td>812</td><td>2019-04-26</td></tr><tr><td>npm (registry: <a href="https://www.npmjs.com/">https://www.npmjs.com/</a>)</td><td>3653</td><td>2652</td><td>2019-04-26</td></tr><tr><td>RubyGems (registry: <a href="https://rubygems.org/">https://rubygems.org/</a>)</td><td>840</td><td>371</td><td>2019-04-26</td></tr><tr><td>NuGet (registry: <a href="https://www.nuget.org/">https://www.nuget.org/</a>)</td><td>651</td><td>489</td><td>2019-04-26</td></tr><tr><td>Go (registry: <a href="https://pkg.go.dev/">https://pkg.go.dev/</a>)</td><td>2011</td><td>865</td><td>2021-04-01</td></tr><tr><td>Rust (registry: <a href="https://crates.io/">https://crates.io/</a>)</td><td>857</td><td>553</td><td>2021-05-25</td></tr><tr><td>Erlang (registry: <a href="https://hex.pm/">https://hex.pm/</a>)</td><td>31</td><td>26</td><td>2022-01-27</td></tr><tr><td>GitHub Actions (<a href="https://github.com/marketplace?type=actions/">https://github.com/marketplace?type=actions/</a>)</td><td>21</td><td>21</td><td>2022-07-29</td></tr><tr><td>Pub (registry: <a href="https://pub.dev/packages/registry">https://pub.dev/packages/registry</a>)</td><td>10</td><td>9</td><td>2022-08-04</td></tr><tr><td>Swift (registry: N/A)</td><td>33</td><td>21</td><td>2023-05-10</td></tr></tbody></table></figure>
  2044.  
  2045.  
  2046.  
  2047. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory5.png?resize=1024%2C633" alt="The pie chart shows the proportion of advisories across different software ecosystems. Maven, Composer, npm, Pip, and Go are the largest ecosystems." class="wp-image-89151" srcset="https://github.blog/wp-content/uploads/2025/06/advisory5.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory5.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory5.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory5.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory5.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory5.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2048.  
  2049.  
  2050.  
  2051. <p>Vulnerabilities in Maven and Composer packages are nearly half of the advisories in the database. npm, pip, and Go make up much of the rest, while the other ecosystems have a much smaller footprint.</p>
  2052.  
  2053.  
  2054.  
  2055. <p>This has not always been the case. When the database was initially launched, NPM advisories dominated the database, but as we have expanded our coverage and added support for new ecosystems, the distribution mix has changed.</p>
  2056.  
  2057.  
  2058.  
  2059. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="539" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory7.png?resize=1024%2C539" alt="The stacked area line graph shows the percentage distribution of various ecosystems from 2019 to 2024. The graph starts with half the advisories being for NPM but over time, other ecosystems like Maven and Composer become more prominent." class="wp-image-89152" srcset="https://github.blog/wp-content/uploads/2025/06/advisory7.png?w=1600 1600w, https://github.blog/wp-content/uploads/2025/06/advisory7.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory7.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory7.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory7.png?w=1536 1536w, https://github.blog/wp-content/uploads/2025/06/advisory7.png?w=400 400w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2060.  
  2061.  
  2062.  
  2063. <h2 class="wp-block-heading" id="sources-where-do-the-advisories-come-from">Sources: Where do the advisories come from?</h2>
  2064.  
  2065.  
  2066.  
  2067. <p>We add advisories to the GitHub Advisory Database from the following sources:</p>
  2068.  
  2069.  
  2070.  
  2071. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>Source</strong></th><th><strong>Advisories</strong></th><th><strong>Reviewed advisories</strong></th><th><strong>Sole source</strong></th><th><strong>Coverage</strong></th></tr></thead><tbody><tr><td><a href="https://nvd.nist.gov/">NVD</a></td><td>267429</td><td>18295</td><td>7450</td><td>6.84%</td></tr><tr><td><a href="https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories">GitHub Repository Advisories</a></td><td>12247</td><td>5311</td><td>564</td><td>43.37%</td></tr><tr><td><a href="https://github.com/github/advisory-database/pulls">Community Contributions</a></td><td>4512</td><td>4160</td><td>10</td><td>92.20%</td></tr><tr><td><a href="https://github.com/pypa/advisory-database">PyPA Advisories</a></td><td>3040</td><td>2739</td><td>14</td><td>90.10%</td></tr><tr><td><a href="https://pkg.go.dev/vuln/">Go Vulncheck</a></td><td>1581</td><td>1528</td><td>7</td><td>96.65%</td></tr><tr><td><a href="https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm">NPM Advisories</a></td><td>1411</td><td>1408</td><td>629</td><td>99.79%</td></tr><tr><td><a href="https://github.com/FriendsOfPHP/security-advisories">FriendsOfPHP</a></td><td>1406</td><td>1396</td><td>400</td><td>99.29%</td></tr><tr><td><a href="https://rustsec.org/">RustSec</a></td><td>943</td><td>849</td><td>171</td><td>90.03%</td></tr><tr><td><a href="https://rubysec.com/">RubySec</a></td><td>873</td><td>861</td><td>4</td><td>98.63%</td></tr></tbody></table></figure>
  2072.  
  2073.  
  2074.  
  2075. <ul class="wp-block-list">
  2076. <li><strong>NVD:</strong> This is a huge source of vulnerabilities covering all types of software. We publish all NVD advisories but only review those relevant to our supported ecosystems, which reduces noise for our users.</li>
  2077.  
  2078.  
  2079.  
  2080. <li><strong>GitHub Repository Advisories:</strong> The second largest source is made up of advisories published through GitHub&rsquo;s repository security advisory feature. Similar to NVD, these aren&rsquo;t restricted to our supported ecosystems. However, we provide better coverage of the repository advisories because they focus exclusively on open source software.</li>
  2081.  
  2082.  
  2083.  
  2084. <li><strong>Community Contributions:</strong> These are reports from the community that are almost exclusively requesting updates to existing advisories.</li>
  2085.  
  2086.  
  2087.  
  2088. <li><strong>Other Specialized Sources:</strong> Sources like PyPA Advisories (for Python) and Go Vulncheck (for Go) that focus on specific ecosystems. Because they only cover packages within our supported ecosystems, most of their advisories are relevant to us and get reviewed.</li>
  2089. </ul>
  2090.  
  2091.  
  2092.  
  2093. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory8.png?resize=1024%2C633" alt="The pie graph shows the proportion of advisories by the number of sources they have. This shows that 46% of the advisories have only one source and 85% have three or fewer." class="wp-image-89153" srcset="https://github.blog/wp-content/uploads/2025/06/advisory8.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory8.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory8.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory8.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory8.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory8.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2094.  
  2095.  
  2096.  
  2097. <p>If you add up the number of reviewed advisories from each source, you will find that total is more than the total reviewed advisories. This is because each source can publish an advisory for the same vulnerability. In fact, over half of our advisories have more than one source.</p>
  2098.  
  2099.  
  2100.  
  2101. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory9.png?resize=1024%2C633" alt="The pie graph shows the proportion of advisories that have a single source by the source they came from. The graph shows that 80% of all single sourced advisories come from the National Vulnerability Database." class="wp-image-89154" srcset="https://github.blog/wp-content/uploads/2025/06/advisory9.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory9.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory9.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory9.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory9.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory9.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2102.  
  2103.  
  2104.  
  2105. <p>Of the advisories with a single source, nearly all of them come from NVD/CVE. This justifies NVD/CVE as a source, even though it is by far the noisiest.</p>
  2106.  
  2107.  
  2108.  
  2109. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory10.png?resize=1024%2C633" alt="The line graph shows the number of advisories imported over time. The graph shows an increase in imports over time." class="wp-image-89155" srcset="https://github.blog/wp-content/uploads/2025/06/advisory10.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory10.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory10.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory10.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory10.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory10.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2110.  
  2111.  
  2112.  
  2113. <p>2024 saw a significant increase (39%) in the number of advisories imported from our sources. This is for the most part caused by an increase in the number of CVE records published.</p>
  2114.  
  2115.  
  2116.  
  2117. <h2 class="wp-block-heading" id="cve-numbering-authority">CVE Numbering Authority</h2>
  2118.  
  2119.  
  2120.  
  2121. <p>In addition to publishing advisories in the GitHub Advisory Database, we are also a <a href="https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories#cve-identification-numbers">CVE Numbering Authority (CNA)</a> for any repository on GitHub. This means that we issue CVE IDs for vulnerabilities reported to us by maintainers, and we publish the vulnerabilities to the CVE database once the corresponding repository advisory is published.</p>
  2122.  
  2123.  
  2124.  
  2125. <p>GitHub published over 2,000 CVE records in 2024, making us the fifth-largest CNA in the CVE Program.</p>
  2126.  
  2127.  
  2128.  
  2129. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory11.png?resize=1024%2C633" alt="The bar graph shows the number of CVE records published by the Advisory Database CNA over time. Every year shows an increase in the number published." class="wp-image-89156" srcset="https://github.blog/wp-content/uploads/2025/06/advisory11.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory11.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory11.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory11.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory11.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory11.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2130.  
  2131.  
  2132.  
  2133. <p>The GitHub CNA is open to <strong>all repositories</strong> on GitHub, not just ones in a supported ecosystem.</p>
  2134.  
  2135.  
  2136.  
  2137. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="585" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory12.png?resize=1024%2C585" alt="The pie graph shows the proportion of CVEs assigned by the Advisory Database that in a supported ecosystem. 58% are in a supported ecosystem and 42% are not." class="wp-image-89157" srcset="https://github.blog/wp-content/uploads/2025/06/advisory12.png?w=1298 1298w, https://github.blog/wp-content/uploads/2025/06/advisory12.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory12.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory12.png?w=1024 1024w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2138.  
  2139.  
  2140.  
  2141. <h2 class="wp-block-heading" id="advisory-prioritization">Advisory prioritization</h2>
  2142.  
  2143.  
  2144.  
  2145. <p>Given the constant deluge of reported vulnerabilities, you&rsquo;ll want tools that can help you prioritize your remediation efforts. To that end, GitHub provides additional data in the advisory to allow readers to prioritize their vulnerabilities. In particular, there are:</p>
  2146.  
  2147.  
  2148.  
  2149. <ul class="wp-block-list">
  2150. <li><strong>Severity Rating/CVSS:</strong> A low to critical rating for how severe the vulnerability is likely to be, along with a corresponding CVSS score and vector.</li>
  2151.  
  2152.  
  2153.  
  2154. <li><strong>CWE:</strong> CWE identifiers provide a programmatic method for determining the type of vulnerability.</li>
  2155.  
  2156.  
  2157.  
  2158. <li><strong>EPSS:</strong> The Exploit Prediction Scoring System, or EPSS, is a system devised by the global Forum of Incident Response and Security Teams (FIRST) for quantifying the likelihood a vulnerability will be attacked in the next 30 days.</li>
  2159. </ul>
  2160.  
  2161.  
  2162.  
  2163. <p>GitHub adds a severity rating to every advisory. The severity level is one of four possible levels defined in the <a href="https://www.first.org/cvss/specification-document">Common Vulnerability Scoring System (CVSS), Section 5</a>.</p>
  2164.  
  2165.  
  2166.  
  2167. <ul class="wp-block-list">
  2168. <li>Low</li>
  2169.  
  2170.  
  2171.  
  2172. <li>Medium/Moderate</li>
  2173.  
  2174.  
  2175.  
  2176. <li>High</li>
  2177.  
  2178.  
  2179.  
  2180. <li>Critical</li>
  2181. </ul>
  2182.  
  2183.  
  2184.  
  2185. <p>Using these ratings, half of all vulnerabilities (15% are Critical and 35% are High) warrant immediate or near-term attention. By focusing remediation efforts on these, you can significantly reduce risk exposure while managing workload more efficiently.</p>
  2186.  
  2187.  
  2188.  
  2189. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory13.png?resize=1024%2C633" alt="The stacked area line graph shows the severity rating ration by year of advisory publication. The graph shows that critical vulnerabilities were more common (20 - 25 percent) early on and moderates becoming more common over the years." class="wp-image-89158" srcset="https://github.blog/wp-content/uploads/2025/06/advisory13.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory13.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory13.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory13.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory13.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory13.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2190.  
  2191.  
  2192.  
  2193. <p>The CVSS specification says the base score we provide, &ldquo;reflects the severity of a vulnerability according to its intrinsic characteristics which are constant over time and assumes the reasonable worst-case impact across different deployed environments.&rdquo; However, the worst-case scenario for your deployment may not be the same as CVSS&rsquo;s. After all, a crash in a word processor is not as severe as a crash in a server. In order to give more context to your prioritization, GitHub allows you to filter alerts based on the type of vulnerability or weakness using CWE identifiers. So you have the capability to never see another regular expression denial of service (<a href="https://cwe.mitre.org/data/definitions/1333.html">CWE-1333</a>) vulnerability again or always see SQL injection (<a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89</a>) vulnerabilities.</p>
  2194.  
  2195.  
  2196.  
  2197. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>Rank</strong></th><th><strong>CWE ID</strong></th><th><strong>CWE name</strong></th><th><strong>Number of advisories in 2024</strong></th><th><strong>Change in rank from 2023</strong></th></tr></thead><tbody><tr><td>1</td><td><a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79</a></td><td>Improper Neutralization of Input During Web Page Generation (&lsquo;Cross-site Scripting&rsquo;)</td><td>936</td><td>+0</td></tr><tr><td>2</td><td><a href="https://cwe.mitre.org/data/definitions/200.html">CWE-200</a></td><td>Exposure of Sensitive Information to an Unauthorized Actor</td><td>320</td><td>+0</td></tr><tr><td>3</td><td><a href="https://cwe.mitre.org/data/definitions/22.html">CWE-22</a></td><td>Improper Limitation of a Pathname to a Restricted Directory (&lsquo;Path Traversal&rsquo;)</td><td>259</td><td>+2</td></tr><tr><td>4</td><td><a href="https://cwe.mitre.org/data/definitions/20.html">CWE-20</a></td><td>Improper Input Validation</td><td>202</td><td>+0</td></tr><tr><td>5</td><td><a href="https://cwe.mitre.org/data/definitions/94.html">CWE-94</a></td><td>Improper Control of Generation of Code (&lsquo;Code Injection&rsquo;)</td><td>188</td><td>+2</td></tr><tr><td>6</td><td><a href="https://cwe.mitre.org/data/definitions/89.html">CWE-89</a></td><td>Improper Neutralization of Special Elements used in an SQL Command (&lsquo;SQL Injection&rsquo;)</td><td>181</td><td>+3</td></tr><tr><td>7</td><td><a href="https://cwe.mitre.org/data/definitions/352.html">CWE-352</a></td><td>Cross-Site Request Forgery (CSRF)</td><td>161</td><td>-4</td></tr><tr><td>8</td><td><a href="https://cwe.mitre.org/data/definitions/284.html">CWE-284</a></td><td>Improper Access Control</td><td>153</td><td>+4</td></tr><tr><td>9</td><td><a href="https://cwe.mitre.org/data/definitions/400.html">CWE-400</a></td><td>Uncontrolled Resource Consumption</td><td>149</td><td>-3</td></tr><tr><td>10</td><td><a href="https://cwe.mitre.org/data/definitions/287.html">CWE-287</a></td><td>Improper Authentication</td><td>124</td><td>+11</td></tr></tbody></table></figure>
  2198.  
  2199.  
  2200.  
  2201. <p>Still drowning in vulnerabilities? Try using EPSS to focus on vulnerabilities likely to be attacked in the next 30 days. EPSS uses data from a <a href="https://www.first.org/epss/partners">variety of sources</a> to create a probability of whether exploitation attempts will be seen in the next 30 days for a given vulnerability. As you can see from the chart below, if you focus on vulnerabilities with EPSS scores of 10% or higher (approx. 7% of all vulnerabilities in the Advisory DB), you can cover nearly all of the vulnerabilities that are likely to see exploit activity.</p>
  2202.  
  2203.  
  2204.  
  2205. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="633" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory14.png?resize=1024%2C633" alt="The bar graph shows the number of advisories by EPSS probability. Most of the advisories are in the Low or Very Low probability." class="wp-image-89159" srcset="https://github.blog/wp-content/uploads/2025/06/advisory14.png?w=1200 1200w, https://github.blog/wp-content/uploads/2025/06/advisory14.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory14.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory14.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory14.png?w=512 512w, https://github.blog/wp-content/uploads/2025/06/advisory14.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2206.  
  2207.  
  2208.  
  2209. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>EPSS probability</strong></th><th><strong>Vulnerabilities in range</strong></th><th><strong>Percentage of overall vulnerabilities</strong></th><th><strong>Expected vulnerabilities in range attacked within the next 30 days</strong></th><th><strong>Percentage of total attacked vulnerabilities</strong></th></tr></thead><tbody><tr><td>High ( &gt;= 10%)</td><td>1440</td><td>7.17%</td><td>741</td><td>85.96%</td></tr><tr><td>Moderate ( &gt;= 1%, &lt; 10%)</td><td>2687</td><td>13.37%</td><td>84</td><td>9.74%</td></tr><tr><td>Low ( &gt;= 0.1%, &lt; 1%)</td><td>10264</td><td>51.09%</td><td>35</td><td>4.06%</td></tr><tr><td>Very Low ( &lt; 0.1%)</td><td>5701</td><td>28.37%</td><td>2</td><td>0.23%</td></tr></tbody></table></figure>
  2210.  
  2211.  
  2212.  
  2213. <p>Important caveats to remember when using EPSS:</p>
  2214.  
  2215.  
  2216.  
  2217. <ul class="wp-block-list">
  2218. <li>Low probability events occur.</li>
  2219.  
  2220.  
  2221.  
  2222. <li>EPSS does not tell you whether a vulnerability is exploited; it only claims how likely it is.</li>
  2223.  
  2224.  
  2225.  
  2226. <li>EPSS scores are updated daily and will change as new information comes in, so a low-probability vulnerability today may become high probability tomorrow.</li>
  2227. </ul>
  2228.  
  2229.  
  2230.  
  2231. <p>For more details on how to use CVSS and EPSS for prioritization, see our <a href="https://github.blog/security/application-security/cutting-through-the-noise-how-to-prioritize-dependabot-alerts/">blog</a> on prioritizing Dependabot alerts.</p>
  2232.  
  2233.  
  2234.  
  2235. <h2 class="wp-block-heading" id="actionable-data">Actionable data</h2>
  2236.  
  2237.  
  2238.  
  2239. <p>The GitHub Advisory DB isn&rsquo;t just a repository of vulnerabilities. It powers tools that help developers secure their projects. Services like Dependabot use the Advisory DB to:</p>
  2240.  
  2241.  
  2242.  
  2243. <ul class="wp-block-list">
  2244. <li><strong>Identify vulnerabilities:</strong> It checks if your projects use any software packages with known vulnerabilities.</li>
  2245.  
  2246.  
  2247.  
  2248. <li><strong>Suggest fixes:</strong> It recommends updated versions of packages that fix those vulnerabilities when available.</li>
  2249.  
  2250.  
  2251.  
  2252. <li><strong>Reduce noise:</strong> You&rsquo;ll only get notified about vulnerabilities that affect the version of the package you are using.</li>
  2253. </ul>
  2254.  
  2255.  
  2256.  
  2257. <figure class="wp-block-image size-large"><img data-recalc-dims="1" loading="lazy" decoding="async" height="632" width="1024" src="https://github.blog/wp-content/uploads/2025/06/advisory15.png?resize=1024%2C632" alt="The bar graph shows the number of advisories published with a patch each year next to the number of advisories without a patch. For every year, nearly all of the advisories have a patch." class="wp-image-89160" srcset="https://github.blog/wp-content/uploads/2025/06/advisory15.png?w=1600 1600w, https://github.blog/wp-content/uploads/2025/06/advisory15.png?w=300 300w, https://github.blog/wp-content/uploads/2025/06/advisory15.png?w=768 768w, https://github.blog/wp-content/uploads/2025/06/advisory15.png?w=1024 1024w, https://github.blog/wp-content/uploads/2025/06/advisory15.png?w=1536 1536w, https://github.blog/wp-content/uploads/2025/06/advisory15.png?w=1416 1416w, https://github.blog/wp-content/uploads/2025/06/advisory15.png?w=288 288w" sizes="auto, (max-width: 1000px) 100vw, 1000px" /></figure>
  2258.  
  2259.  
  2260.  
  2261. <h2 class="wp-block-heading" id="take-this-with-you">Take this with you</h2>
  2262.  
  2263.  
  2264.  
  2265. <p>The GitHub Advisory Database is a powerful resource for tracking open source software vulnerabilities, with over 22,000 reviewed advisories to date. By focusing on popular package registries, GitHub allows you to definitively connect vulnerabilities to the packages you are using. Additional data such as CVSS and EPSS scores help you properly prioritize your mitigation efforts.</p>
  2266.  
  2267.  
  2268.  
  2269. <p>GitHub&rsquo;s role as a CVE Numbering Authority extends beyond the Advisory Database, ensuring that thousands of vulnerabilities each year reach the broader CVE community. Want to ensure your vulnerability fix reaches your users? <a href="https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/editing-a-repository-security-advisory">Create a GitHub security advisory</a> in your repository to take advantage of both the GitHub Advisory Database and GitHub&rsquo;s CNA services.</p>
  2270.  
  2271.  
  2272.  
  2273. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2274. <p><strong>Want to dive deeper?</strong> Explore <a href="https://github.blog/security/">security blog posts &gt;</a></p>
  2275. </div>
  2276. </body></html>
  2277. <p>The post <a href="https://github.blog/security/github-advisory-database-by-the-numbers-known-security-vulnerabilities-and-what-you-can-do-about-them/">GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2278. ]]></content:encoded>
  2282. <post-id xmlns="com-wordpress:feed-additions:1">89136</post-id> </item>
  2283. <item>
  2284. <title>From pair to peer programmer: Our vision for agentic workflows in GitHub Copilot</title>
  2285. <link>https://github.blog/news-insights/product-news/from-pair-to-peer-programmer-our-vision-for-agentic-workflows-in-github-copilot/</link>
  2287. <dc:creator><![CDATA[Tim Rogers]]></dc:creator>
  2288. <pubDate>Wed, 25 Jun 2025 16:00:00 +0000</pubDate>
  2289. <category><![CDATA[News & insights]]></category>
  2290. <category><![CDATA[Product]]></category>
  2291. <category><![CDATA[agentic AI]]></category>
  2292. <category><![CDATA[generative AI]]></category>
  2293. <category><![CDATA[GitHub Copilot]]></category>
  2294. <guid isPermaLink="false">https://github.blog/?p=88977</guid>
  2295.  
  2296. <description><![CDATA[<p>AI agents in GitHub Copilot don’t just assist developers but actively solve problems through multi-step reasoning and execution. Here’s what that means.</p>
  2297. <p>The post <a href="https://github.blog/news-insights/product-news/from-pair-to-peer-programmer-our-vision-for-agentic-workflows-in-github-copilot/">From pair to peer programmer: Our vision for agentic workflows in GitHub Copilot</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2298. ]]></description>
  2299. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  2300. <html><body><p>Software development has always been a deeply human, collaborative process. When we introduced <a href="https://github.com/features/copilot">GitHub Copilot</a> in 2021 as an &ldquo;<a href="https://github.blog/news-insights/product-news/introducing-github-copilot-ai-pair-programmer/">AI pair programmer</a>,&rdquo; it was designed to help developers stay in the flow, reduce boilerplate work, and accelerate coding.</p>
  2301.  
  2302.  
  2303.  
  2304. <p>But what if Copilot could be more than just an assistant? What if it could actively collaborate with you&mdash;working alongside you on synchronous tasks, tackling issues independently, and even reviewing your code?</p>
  2305.  
  2306.  
  2307.  
  2308. <p>That&rsquo;s the future we&rsquo;re building.</p>
  2309.  
  2310.  
  2311.  
  2312. <h2 class="wp-block-heading" id="h-our-vision-for-what-s-next-nbsp">Our vision for what&rsquo;s next&nbsp;</h2>
  2313.  
  2314.  
  2315.  
  2316. <p>Today, AI agents in GitHub Copilot don&rsquo;t just assist developers but actively solve problems through multi-step reasoning and execution. These agents are capable of:</p>
  2317.  
  2318.  
  2319.  
  2320. <ul class="wp-block-list">
  2321. <li><strong>Independent problem solving:</strong> Copilot will break down complex tasks and take the necessary steps to solve them, providing updates along the way.</li>
  2322.  
  2323.  
  2324.  
  2325. <li><strong>Adaptive collaboration:</strong> Whether working in sync with you or independently in the background, Copilot will iterate on its own outputs to drive progress.</li>
  2326.  
  2327.  
  2328.  
  2329. <li><strong>Proactive code quality:</strong> Copilot will proactively assist with tasks like issue resolution, testing, and code reviews, ensuring higher-quality, maintainable code.</li>
  2330. </ul>
  2331.  
  2332.  
  2333.  
  2334. <p>Rather than fitting neatly into synchronous or asynchronous categories, the future of Copilot lies in its ability to flexibly transition between modes&mdash;executing tasks independently while keeping you informed and in control. This evolution will allow you to focus on higher-level decision-making while Copilot takes on more of the execution.</p>
  2335.  
  2336.  
  2337.  
  2338. <p>Let&rsquo;s explore what&rsquo;s already here&mdash;and what&rsquo;s coming next.</p>
  2339.  
  2340.  
  2341.  
  2342. <aside data-color-mode="light" data-dark-theme="dark" data-light-theme="light_dimmed" class="wp-block-group post-aside--large p-4 p-md-6 is-style-light-dimmed has-global-padding is-layout-constrained wp-block-group-is-layout-constrained is-style-light-dimmed--3" style="border-top-width:4px">
  2343. <h3 class="wp-block-heading h5-mktg gh-aside-title is-typography-preset-h5" id="h-why-independent-agents-and-why-now" style="margin-top:0">Why independent agents&mdash;and why now?</h3>
  2344.  
  2345.  
  2346.  
  2347. <p>Modern development isn&rsquo;t linear. We context switch between features, bug fixes, dependency bumps, and reviews every day. A truly useful AI must:</p>
  2348.  
  2349.  
  2350.  
  2351. <ol class="wp-block-list">
  2352. <li><strong>Act independently</strong>: plan multi&#8209;step tasks and execute them without hand holding.</li>
  2353.  
  2354.  
  2355.  
  2356. <li><strong>Stay transparent</strong>: share its plan and progress, so you can intervene instantly.</li>
  2357.  
  2358.  
  2359.  
  2360. <li><strong>Earn trust</strong>: test its own work and explain every change.</li>
  2361. </ol>
  2362.  
  2363.  
  2364.  
  2365. <p>Copilot&rsquo;s new <strong>agentic architecture</strong> is designed around these guardrails.</p>
  2366. </aside>
  2367.  
  2368.  
  2369.  
  2370. <h2 class="wp-block-heading" id="h-copilot-in-action-taking-steps-toward-our-vision-nbsp">Copilot in action: Taking steps toward our vision&nbsp;</h2>
  2371.  
  2372.  
  2373.  
  2374. <h3 class="wp-block-heading" id="h-agent-mode-a-real-time-ai-teammate-inside-your-ide">Agent mode: A real-time AI teammate inside your IDE</h3>
  2375.  
  2376.  
  2377.  
  2378. <p>If you&rsquo;ve used <a href="https://github.blog/news-insights/product-news/github-copilot-the-agent-awakens/">agent mode with GitHub Copilot</a> (and you should, because it&rsquo;s fantastic), you&rsquo;ve already experienced an independent AI agent at work.&nbsp;</p>
  2379.  
  2380.  
  2381.  
  2382. <p>Agent mode lives where you code and feels like handing your computer to a teammate for a minute: it types on your screen while you look on, and can grab the mouse. When you prompt it, the agent takes control, works through the problem, and reports its work back to you with regular check-in points. It can:</p>
  2383.  
  2384.  
  2385.  
  2386. <ul class="wp-block-list">
  2387. <li><strong>Read your entire workspace</strong> to understand context.</li>
  2388.  
  2389.  
  2390.  
  2391. <li><strong>Plan multi&#8209;step fixes or refactors</strong> (and show you the plan first).</li>
  2392.  
  2393.  
  2394.  
  2395. <li><strong>Apply changes, run tests, and iterate</strong> in a tight feedback loop.</li>
  2396.  
  2397.  
  2398.  
  2399. <li><strong>Ask for guidance</strong> whenever intent is ambiguous.</li>
  2400.  
  2401.  
  2402.  
  2403. <li><strong>Run and refine its own work</strong> through an &ldquo;agentic loop&rdquo;&mdash;planning, applying changes, testing, and iterating.</li>
  2404. </ul>
  2405.  
  2406.  
  2407.  
  2408. <p>Rather than just responding to requests, Copilot in agent mode actively works toward your goal. You define the outcome, and it determines the best approach&mdash;seeking feedback from you as needed, testing its own solutions, and refining its work in real time.&nbsp;</p>
  2409.  
  2410.  
  2411.  
  2412. <p>Think of it as pair programming in fast forward: you&rsquo;re watching the task unfold in real time, free to jump in or redirect at any step. &#10024;</p>
  2413.  
  2414.  
  2415.  
  2416. <figure class="wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio"><div class="wp-block-embed__wrapper">
  2417. <iframe loading="lazy" title="GitHub Copilot now supports agent mode" width="500" height="281" src="https://www.youtube.com/embed/Bla9JsYGIRw?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
  2418. </div></figure>
  2419.  
  2420.  
  2421.  
  2422. <h3 class="wp-block-heading" id="h-coding-agent-an-ai-teammate-that-works-while-you-don-t-nbsp">Coding agent: An AI teammate that works while you don&rsquo;t&nbsp;</h3>
  2423.  
  2424.  
  2425.  
  2426. <p>Not all coding happens in real time. Sometimes, you need to hand off tasks to a teammate and check back later.</p>
  2427.  
  2428.  
  2429.  
  2430. <p>That&rsquo;s where <strong>our coding agent</strong> comes in&mdash;and it&rsquo;s our first step in transforming Copilot into an independent agent. Coding agent spins up its <strong>own secure dev environment</strong> in the cloud. You can assign multiple issues to Copilot, then dive into other work (or grab a cup of coffee!) while it handles the heavy lifting. It can:</p>
  2431.  
  2432.  
  2433.  
  2434. <ul class="wp-block-list">
  2435. <li><strong>Clone your repo and bootstrap tooling</strong> in isolation.</li>
  2436.  
  2437.  
  2438.  
  2439. <li><strong>Break the issue into steps</strong>, implement changes, and write or update tests.</li>
  2440.  
  2441.  
  2442.  
  2443. <li><strong>Validate its work </strong>by running your tests and linter.</li>
  2444.  
  2445.  
  2446.  
  2447. <li><strong>Open a draft PR</strong> and iterate based on your PR review comments.</li>
  2448.  
  2449.  
  2450.  
  2451. <li><strong>Stream progress updates</strong> so you can peek in&mdash;or jump in&mdash;any time.</li>
  2452. </ul>
  2453.  
  2454.  
  2455.  
  2456. <p>Working with coding agent is like asking a teammate in another room&mdash;with their own laptop and setup&mdash;to tackle an issue. You&rsquo;re free to work on something else, but you can pop in for status or feedback whenever you like.</p>
  2457.  
  2458.  
  2459.  
  2460. <figure class="wp-block-video"><video controls poster="https://github.blog/wp-content/uploads/2025/06/Screenshot-2025-06-20-at-12.35.06&#8239;PM.png" src="https://github.blog/wp-content/uploads/2025/06/Copilot-Coding-Agent-Overview-v3-Burned.mp4"></video></figure>
  2461.  
  2462.  
  2463.  
  2464. <h2 class="wp-block-heading" id="h-less-todo-more-done-the-next-stage-of-copilot-s-agentic-future">Less TODO, more done: The next stage of Copilot&rsquo;s agentic future</h2>
  2465.  
  2466.  
  2467.  
  2468. <p>The next stage of Copilot is being built on three converging pillars:</p>
  2469.  
  2470.  
  2471.  
  2472. <ol class="wp-block-list">
  2473. <li><strong>Smarter, leaner models.</strong> Ongoing breakthroughs in large language models keep driving accuracy up while pushing latency and cost down. Expanded context windows now span entire monoliths, giving Copilot the long-range &ldquo;memory&rdquo; it needs to reason through complex codebases and return answers grounded in your real code.<br></li>
  2474.  
  2475.  
  2476.  
  2477. <li><strong>Deeper contextual awareness.</strong> Copilot increasingly understands the full story behind your work&mdash;issues, pull-request history, dependency graphs, even private runbooks and API specs (via MCP). By tapping this richer context, it can suggest changes that align with project intent, not just syntax.<br></li>
  2478.  
  2479.  
  2480.  
  2481. <li><strong>Open, composable foundation.</strong> We&rsquo;re designing Copilot to slot into <em>your</em> stack&mdash;not the other way around. You choose the editor, models, and tools; Copilot plugs in, learns your patterns, and amplifies them. You&rsquo;re in the driver&rsquo;s seat, steering the AI to build, test, and ship code faster than ever.</li>
  2482. </ol>
  2483.  
  2484.  
  2485.  
  2486. <p>Taken together, these pillars move Copilot beyond a single assistant toward a flexible AI teammate&mdash;one that can help any team, from three developers in a garage to thousands in a global enterprise, plan, code, test, and ship with less friction and more speed.</p>
  2487.  
  2488.  
  2489.  
  2490. <p>So, get ready for what&rsquo;s next. The next wave is already on its way.&nbsp;</p>
  2491.  
  2492.  
  2493.  
  2494. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2495. <p><strong>Learn more</strong> about <a href="https://github.com/features/copilot">GitHub Copilot &gt;</a></p>
  2496. </div>
  2497. </body></html>
  2498. <p>The post <a href="https://github.blog/news-insights/product-news/from-pair-to-peer-programmer-our-vision-for-agentic-workflows-in-github-copilot/">From pair to peer programmer: Our vision for agentic workflows in GitHub Copilot</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2499. ]]></content:encoded>
  2503. <post-id xmlns="com-wordpress:feed-additions:1">88977</post-id> </item>
  2504. <item>
  2505. <title>Why developer expertise matters more than ever in the age of AI</title>
  2506. <link>https://github.blog/developer-skills/career-growth/why-developer-expertise-matters-more-than-ever-in-the-age-of-ai/</link>
  2508. <dc:creator><![CDATA[Laura Lindeman]]></dc:creator>
  2509. <pubDate>Tue, 24 Jun 2025 17:04:47 +0000</pubDate>
  2510. <category><![CDATA[Career growth]]></category>
  2511. <category><![CDATA[Developer skills]]></category>
  2512. <category><![CDATA[AI]]></category>
  2513. <category><![CDATA[productivity]]></category>
  2514. <guid isPermaLink="false">https://github.blog/?p=89040</guid>
  2515.  
  2516. <description><![CDATA[<p>AI can help you code faster, but knowing why the code works—and sharpening your human-in-the-loop skills—is what makes you a great developer.</p>
  2517. <p>The post <a href="https://github.blog/developer-skills/career-growth/why-developer-expertise-matters-more-than-ever-in-the-age-of-ai/">Why developer expertise matters more than ever in the age of AI</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2518. ]]></description>
  2519. <content:encoded><![CDATA[<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
  2520. <html><body><figure class="wp-block-table"><table class="has-fixed-layout"><tbody><tr><td><em>Editor&rsquo;s note: This piece was originally published in our LinkedIn newsletter, Branching Out_. </em><a href="https://www.linkedin.com/newsletters/branching-out-6958196028076429312/"><em>Sign up now for more career-focused content &gt;&nbsp;</em></a></td></tr></tbody></table></figure>
  2521.  
  2522.  
  2523.  
  2524. <p>AI tools seem to be everywhere. With the tap of a key, they provide ready answers to queries, autocomplete faster than our brains can, and even suggest entire blocks of code. Research has shown that <a href="https://github.com/features/copilot">GitHub Copilot</a> enables developers to <a href="https://github.blog/news-insights/research/research-quantifying-github-copilots-impact-on-developer-productivity-and-happiness/">code up to 55% faster</a>. Junior developers, specifically, <a href="https://mitsloan.mit.edu/ideas-made-to-matter/how-generative-ai-affects-highly-skilled-workers?utm_source=chatgpt.com">may see a 27% to 39% increase in output with AI assistance according to MIT</a>, showing even greater productivity gains from their adoption of AI than more experienced developers.&nbsp;</p>
  2525.  
  2526.  
  2527.  
  2528. <p><strong>But here&rsquo;s the question: you may be coding faster with AI, but when was the last time you asked yourself </strong><strong><em>why</em></strong><strong> before adopting a suggestion from an AI coding assistant?&nbsp;</strong></p>
  2529.  
  2530.  
  2531.  
  2532. <p>Being a developer is not just about producing code. It&rsquo;s about understanding <em>why</em> the code works, how it fits into the bigger picture, and what happens when things break down. The best developers know how to think critically about new problems and take a systems view of solving them. That kind of expertise is what keeps software resilient, scalable, and secure, especially as AI accelerates how quickly we ship. Without it, we risk building faster but breaking more.</p>
  2533.  
  2534.  
  2535.  
  2536. <p><a href="https://timesofindia.indiatimes.com/technology/tech-news/github-ceo-thomas-dohmke-to-startups-your-companies-would-struggle-without-developers-as-ai-coding-assistants-can-only-/articleshow/121844990.cms?utm_source=chatgpt.com">Our CEO, Thomas Dohmke, put it bluntly at VivaTech</a>: &ldquo;Startups can launch with AI&#8209;generated code, but they can&rsquo;t scale without experienced developers.&rdquo; Developer expertise is the multiplier on AI, not the bottleneck.</p>
  2537.  
  2538.  
  2539.  
  2540. <p>We&rsquo;re not saying you have to reject AI to be a great developer. At GitHub, we believe AI is a superpower, one that helps you move faster and build better when used thoughtfully. Your role as a developer in the age of AI is to be the human-in-the-loop: the person who knows why code works, why it sometimes doesn&rsquo;t, what the key requirements in your environment are, and how to debug, guide AI tools, and go beyond vibe coding.&nbsp;</p>
  2541.  
  2542.  
  2543.  
  2544. <p>After all, AI can help you write code a lot faster, but only developer expertise turns that speed into resilient, scalable, and secure software.</p>
  2545.  
  2546.  
  2547.  
  2548. <figure class="wp-block-table"><table class="has-fixed-layout"><tbody><tr><td><strong>TL;DR:</strong> AI pair&#8209;programming makes you faster, but it can&rsquo;t replace the judgment that keeps software safe and maintainable. This article offers three concrete ways to level&#8209;up your expertises.</td></tr></tbody></table></figure>
  2549.  
  2550.  
  2551.  
  2552. <h2 class="wp-block-heading" id="h-ai-s-productivity-dividend-developer-experience-greater-impact">AI&rsquo;s productivity dividend + developer experience = greater impact</h2>
  2553.  
  2554.  
  2555.  
  2556. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>Benefit</strong></th><th><strong>How human judgment multiplies the value</strong></th></tr></thead><tbody><tr><td>&#9201;&#65039; Faster commits (up to 55&#8239;% quicker task completion)</td><td>Devs run thoughtful code reviews, write tests, and surface edge cases so speed never comes at the cost of quality.</td></tr><tr><td>&#129504; Lower cognitive load</td><td>Freed-up mental bandwidth lets developers design better architectures, mentor teammates, and solve higher-order problems.</td></tr><tr><td>&#127793; Easier onboarding for juniors</td><td>Senior engineers provide context, establish standards, and turn AI suggestions into teachable moments building long-term expertise.</td></tr><tr><td>&#129302; Automated boilerplate</td><td>Devs tailor scaffolding to real project needs, question assumptions, and refactor early to keep tech-debt in check and systems secure.</td></tr></tbody></table></figure>
  2557.  
  2558.  
  2559.  
  2560. <p>Speed without judgment can mean:</p>
  2561.  
  2562.  
  2563.  
  2564. <ul class="wp-block-list">
  2565. <li>Security vulnerabilities that static analysis can&rsquo;t spot on its own.</li>
  2566.  
  2567.  
  2568.  
  2569. <li>Architecture choices that don&rsquo;t scale beyond the demo.</li>
  2570.  
  2571.  
  2572.  
  2573. <li>Documentation drift that leaves humans and models guessing.</li>
  2574. </ul>
  2575.  
  2576.  
  2577.  
  2578. <p>The remedy? Double down on the fundamentals that AI still can&rsquo;t master.</p>
  2579.  
  2580.  
  2581.  
  2582. <h2 class="wp-block-heading" id="h-mastering-the-fundamentals-3-key-parts-of-your-workflow-to-focus-on-when-using-ai">Mastering the fundamentals: 3 key parts of your workflow to focus on when using AI</h2>
  2583.  
  2584.  
  2585.  
  2586. <p>As the home for all developers, we&rsquo;ve seen it again and again: becoming AI-savvy starts with the old-school basics. You know, the&nbsp;classic tools and features you used before AI became a thing (we know, it&rsquo;s hard to remember such a time!). We believe that only by mastering the fundamentals can you get the most value, at scale, out of&nbsp;AI developer tools like GitHub Copilot.&nbsp;</p>
  2587.  
  2588.  
  2589.  
  2590. <p>A junior developer who jumps into their first AI-assisted project without having a foundational understanding of the basics (like pull requests, code reviews, and documentation) may ship fast, but without context or structure, they risk introducing bugs, missing edge cases, or confusing collaborators. That&rsquo;s not an AI problem. It&rsquo;s a fundamentals problem.</p>
  2591.  
  2592.  
  2593.  
  2594. <p>Let&rsquo;s revisit the core skills every developer should bring to the table, AI or not. With the help of a few of our experts, we&rsquo;ll show you how to level them up so you can dominate in the age of AI.</p>
  2595.  
  2596.  
  2597.  
  2598. <h3 class="wp-block-heading" id="h-1-push-for-excellence-in-the-pull-request">1. Push for excellence in the pull request</h3>
  2599.  
  2600.  
  2601.  
  2602. <p>At the heart of developer collaboration, pull requests are about clearly communicating your intent, explaining your reasoning, and making it easier for others (humans and AI alike!) to engage with your work.</p>
  2603.  
  2604.  
  2605.  
  2606. <p>A well&#8209;scoped PR communicates <em>why</em> a change exists&mdash;not just <em>what</em> changed. That context feeds human reviewers and Copilot alike.</p>
  2607.  
  2608.  
  2609.  
  2610. <p>As GitHub developer advocate <a href="https://github.com/ladykerr">Kedasha Kerr</a> advises, start by keeping your pull requests small and focused. A tight, purposeful pull request is easier to review, less likely to introduce bugs, and faster to merge. It also gives your reviewers, as well as AI tools like Copilot, a clean scope to work with.</p>
  2611.  
  2612.  
  2613.  
  2614. <p>Your pull request description is where clarity counts. Don&rsquo;t just list what changed&mdash;explain <em>why</em> it changed. Include links to related issues, conversations, or tracking tickets to give your teammates the full picture. If your changes span multiple files, suggest where to start reviewing. And be explicit about what kind of feedback you&rsquo;re looking for: a quick sanity check? A deep dive? Let your reviewers know.</p>
  2615.  
  2616.  
  2617.  
  2618. <p>Before you ask for a review, review it yourself. Kedasha recommends running your tests, previewing your changes, and catching anything unclear or unpolished. This not only respects your reviewers&rsquo; time, it improves the quality of your code and deepens your understanding of the work.</p>
  2619.  
  2620.  
  2621.  
  2622. <p>A thoughtful pull request is a signal of craftsmanship. It builds trust with your team, strengthens your communication skills, and gives Copilot better context to support you going forward. That&rsquo;s a win for you, your team, and your future self.</p>
  2623.  
  2624.  
  2625.  
  2626. <p><strong>Here&rsquo;s a quick 5&#8209;item PR checklist to reference as you work:&nbsp;</strong></p>
  2627.  
  2628.  
  2629.  
  2630. <ol class="wp-block-list">
  2631. <li><strong>Scope &le; 300 lines</strong> (or break it up).</li>
  2632.  
  2633.  
  2634.  
  2635. <li><strong>Title = verb + object</strong> (e.g., <em>Refactor auth middleware to async</em>).</li>
  2636.  
  2637.  
  2638.  
  2639. <li><strong>Description answers &ldquo;why now?&rdquo;</strong> and links to the issue.</li>
  2640.  
  2641.  
  2642.  
  2643. <li><strong>Highlight breaking changes</strong> with &#9888;&#65039; BREAKING in bold.</li>
  2644.  
  2645.  
  2646.  
  2647. <li><strong>Request specific feedback</strong> (e.g., <em>Concurrency strategy OK?</em>).</li>
  2648. </ol>
  2649.  
  2650.  
  2651.  
  2652. <p>Drop this snippet into <strong><code>.github/pull_request_template.md</code></strong> and merge.</p>
  2653.  
  2654.  
  2655.  
  2656. <p><a href="https://github.blog/developer-skills/github/beginners-guide-to-github-creating-a-pull-request/"><em>Learn more about creating a great pull request &gt;</em></a><em>&nbsp;</em></p>
  2657.  
  2658.  
  2659.  
  2660. <h3 class="wp-block-heading" id="h-2-rev-up-your-code-reviews">2. Rev up your code reviews</h3>
  2661.  
  2662.  
  2663.  
  2664. <p>AI can generate code in seconds, but knowing how to review that code is where real expertise develops. Every pull request is a conversation: &ldquo;I believe this improves the codebase, do you agree?&rdquo; As GitHub staff engineer <a href="https://github.com/cheshire137">Sarah Vessels</a> explains, good code reviews don&rsquo;t just catch bugs; they teach, transfer knowledge, and help teams move faster with fewer costly mistakes.</p>
  2665.  
  2666.  
  2667.  
  2668. <p>And let&rsquo;s be honest: as developers, we often read and review far more code than we actually write (and that&rsquo;s ok!). No matter if code comes from a colleague or an AI tool, code reviews are a fundamental part of being a developer&mdash;and building a strong code review practice is critical, especially as the volume of code increases.&nbsp;</p>
  2669.  
  2670.  
  2671.  
  2672. <p>You should start by reviewing your own pull requests before assigning them to others. Leave comments where you&rsquo;d have questions as a reviewer. This not only helps you spot problems early, but also provides helpful context for your teammates. Keep pull requests small and focused. The smaller the diff, the easier it is to review, debug, and even roll back if something breaks in production. In DevOps organizations, especially large ones, small, frequent commits also help reduce merge conflicts and keep deployment pipelines flowing smoothly.&nbsp;</p>
  2673.  
  2674.  
  2675.  
  2676. <p>As a reviewer, focus on clarity. Ask questions, challenge assumptions, and check how code handles edge cases or unexpected data. If you see a better solution, offer a specific example rather than just saying &ldquo;this could be better.&rdquo; Affirm good choices too: calling out strong design decisions helps reinforce shared standards and makes the review process less draining for authors.</p>
  2677.  
  2678.  
  2679.  
  2680. <p>Code reviews give you daily reps to build technical judgement, deepen your understanding of the codebase, and earn trust with your team. In an AI-powered world, they&rsquo;re also a key way to level up by helping you slow down, ask the right questions, and spot patterns AI might miss.</p>
  2681.  
  2682.  
  2683.  
  2684. <p><strong>Here are some heuristics to keep in mind when reviewing code:</strong></p>
  2685.  
  2686.  
  2687.  
  2688. <ul class="wp-block-list">
  2689. <li><strong>Read the tests first</strong>. They encode intent.</li>
  2690.  
  2691.  
  2692.  
  2693. <li><strong>Trace data flow</strong> for user input to DB writes to external calls.</li>
  2694.  
  2695.  
  2696.  
  2697. <li><strong>Look for hidden state</strong> in globals, singletons, and caches.</li>
  2698.  
  2699.  
  2700.  
  2701. <li><strong>Ask &ldquo;What happens under load?&rdquo;</strong> even if performance isn&rsquo;t in scope.</li>
  2702.  
  2703.  
  2704.  
  2705. <li><strong>Celebrate good patterns</strong> to reinforce team standards.</li>
  2706. </ul>
  2707.  
  2708.  
  2709.  
  2710. <p><a href="https://github.blog/developer-skills/github/how-to-review-code-effectively-a-github-staff-engineers-philosophy/"><em>Learn more about how to review code effectively &gt;</em></a></p>
  2711.  
  2712.  
  2713.  
  2714. <h3 class="wp-block-heading" id="h-3-invest-in-documentation">3. Invest in documentation&nbsp;</h3>
  2715.  
  2716.  
  2717.  
  2718. <p>Strong pull requests and code reviews help your team build better software today. But documentation makes it easier to build better software tomorrow. In the AI era, where code can be generated in seconds, clear, thorough documentation remains one of the most valuable&mdash;and overlooked&mdash;skills a developer can master.</p>
  2719.  
  2720.  
  2721.  
  2722. <p>Good documentation helps everyone stay aligned: your team, new contributors, stakeholders, and yes, even AI coding agents (docs make great context for any AI model, after all). The clearer your docs, the more effective AI tools like Copilot can be when generating code, tests, or summaries that rely on understanding your project&rsquo;s structure. As GitHub&rsquo;s software engineer <a href="https://github.com/brittanyellich">Brittany Ellich</a> and technical writer <a href="https://github.com/sabrowning1">Sam Browning</a> explain, well-structured docs accelerate onboarding, increase adoption, and make collaboration smoother by reducing back and forth.</p>
  2723.  
  2724.  
  2725.  
  2726. <p>The key is to keep your documentation clear, concise, and structured. Use plain language, focus on the information people actually need, and avoid overwhelming readers with too many edge cases or unnecessary details. Organize your docs with the <a href="https://diataxis.fr/">Di&aacute;taxis framework</a>, which breaks documentation into four categories:</p>
  2727.  
  2728.  
  2729.  
  2730. <ul class="wp-block-list">
  2731. <li>Tutorials for hands-on learning with step-by-step guides</li>
  2732.  
  2733.  
  2734.  
  2735. <li>How-to guides for task-oriented steps with bulleted or numbered list</li>
  2736.  
  2737.  
  2738.  
  2739. <li>Explanations for deeper understanding</li>
  2740.  
  2741.  
  2742.  
  2743. <li>Reference for technical specs such as API specs</li>
  2744. </ul>
  2745.  
  2746.  
  2747.  
  2748. <p>When your docs follow a clear structure, contributors know exactly where to find what they need and where to add new information as your project evolves.</p>
  2749.  
  2750.  
  2751.  
  2752. <p>In short: great documentation forces you to sharpen your own understanding of the system you&rsquo;re building. That kind of clarity compounds over time and is exactly the kind of critical thinking that makes you a stronger developer.</p>
  2753.  
  2754.  
  2755.  
  2756. <p><a href="https://github.blog/developer-skills/documentation-done-right-a-developers-guide/"><em>Learn more about how to document your project effectively &gt;</em></a></p>
  2757.  
  2758.  
  2759.  
  2760. <h3 class="wp-block-heading" id="h-a-level-up-dev-toolkit">A level&#8209;up dev toolkit</h3>
  2761.  
  2762.  
  2763.  
  2764. <p>To make things simple, here&rsquo;s a skills progression matrix to keep in mind no matter what level you&rsquo;re at.&nbsp;</p>
  2765.  
  2766.  
  2767.  
  2768. <figure class="wp-block-table"><table class="has-fixed-layout"><thead><tr><th><strong>Skill</strong></th><th><strong>Junior</strong></th><th><strong>Mid&#8209;level</strong></th><th><strong>Senior</strong></th></tr></thead><tbody><tr><td>Pull requests</td><td>Describes <em>what</em> changed</td><td>Explains <em>why</em> and links issues</td><td>Anticipates perf/security impact &amp; suggests review focus</td></tr><tr><td>Code reviews</td><td>Leaves &#128077;/&#128078;</td><td>Gives actionable comments</td><td>Mentors, models architecture trade&#8209;offs</td></tr><tr><td>Documentation</td><td>Updates README</td><td>Writes task&#8209;oriented guides</td><td>Curates docs as a product with metrics</td></tr></tbody></table></figure>
  2769.  
  2770.  
  2771.  
  2772. <p><strong>And here are some quick&#8209;wins you can copy today:</strong></p>
  2773.  
  2774.  
  2775.  
  2776. <ul class="wp-block-list">
  2777. <li><code>.github/CODEOWNERS</code> to auto&#8209;route reviews</li>
  2778.  
  2779.  
  2780.  
  2781. <li>PR and issue templates for consistent context</li>
  2782.  
  2783.  
  2784.  
  2785. <li>GitHub Skills course: <a href="https://github.com/skills/communicate-using-markdown">Communicating with Markdown</a></li>
  2786. </ul>
  2787.  
  2788.  
  2789.  
  2790. <h2 class="wp-block-heading" id="h-the-bottom-line">The bottom line</h2>
  2791.  
  2792.  
  2793.  
  2794. <p>In the end, AI is changing how we write code, and curiosity, judgment, and critical thinking are needed more than ever. The best developers don&rsquo;t just accept what AI suggests. They ask why. They provide context. They understand the fundamentals. They think in systems, write with intention, and build with care.&nbsp;</p>
  2795.  
  2796.  
  2797.  
  2798. <p>So keep asking why. Stay curious. Continue learning. That&rsquo;s what sets great developers apart&mdash;and it&rsquo;s how you&rsquo;ll survive and thrive in an AI-powered future.</p>
  2799.  
  2800.  
  2801.  
  2802. <div class="wp-block-group post-content-cta has-global-padding is-layout-constrained wp-block-group-is-layout-constrained">
  2803. <p><strong>Want to get started?</strong> <a href="https://github.com/features/copilot/?utm_source=newsletter&amp;utm_medium=social&amp;utm_campaign=copilot_free_launch">Explore GitHub Copilot &gt;</a></p>
  2804. </div>
  2805. </body></html>
  2806. <p>The post <a href="https://github.blog/developer-skills/career-growth/why-developer-expertise-matters-more-than-ever-in-the-age-of-ai/">Why developer expertise matters more than ever in the age of AI</a> appeared first on <a href="https://github.blog">The GitHub Blog</a>.</p>
  2807. ]]></content:encoded>
  2811. <post-id xmlns="com-wordpress:feed-additions:1">89040</post-id> </item>
  2812. </channel>
  2813. </rss>
  2814.  

If you would like to create a banner that links to this page (i.e. this validation result), do the following:

  1. Download the "valid RSS" banner.

  2. Upload the image to your own server. (This step is important. Please do not link directly to the image on this server.)

  3. Add this HTML to your page (change the image src attribute if necessary):

If you would like to create a text link instead, here is the URL you can use:

http://www.feedvalidator.org/check.cgi?url=https%3A//github.blog/feed/

Home · About · News · Docs · Terms

 
Copyright © 2002-9 Sam Ruby, Mark Pilgrim, Joseph Walton, and Phil Ringnalda