The followers, following, and mutuals lists behind every profile now ask for GitHub sign-in, on the web and in the API. Commit search joins them, while developer search stays open to everyone.
Top storyTook the lead from Member roll call arrives in organization settings#1304. To stop scrapers, follower, following, and mutual lists now require GitHub sign-in, unsigned API calls fail, and commit search is members-only.
mnapoli, who filed the change, pictured in the contributor’s own avatar.
You open a profile and click the follower count. Instead of names, you get GitHub's sign-in page. The count still shows, and the profile still reads fine, but the list behind it now waits for a member. Signed in, it opens as before. It shows 30 people a page, newest follow first.
Credit goes to mnapoli, who put the follow graph behind sign-in so scrapers cannot walk it page by page. Followers, following, and mutuals all need a session now. The API's follower and following endpoints moved behind signed requests too, so an unsigned call gets a 401. Commit search is members-only as well, at 15 searches a minute per person, since each query pays for an embedding and an AI relevance check. In the search box, guests still find developers. A topic query offers a Sign in to search commits row instead.
One wrinkle. Clicking a follower count as a guest sends you to sign-in, but the link points at the plain login page, not the list, so nothing remembers where you were headed. After GitHub, you land on your own log, not the followers you meant to read.
Every commit now has a Share menu. Copy the link, or send it straight to a developer through Remotes. Choose a name, check the preview, and you finish in the conversation.
Also leadingThe biggest story by anyone else. Held off 4 challengers since.
MrPunyapal, who filed the change, pictured in the contributor’s own avatar.
Hover any commit and click the new Share icon. The old link button now lives in a menu. Two items wait there. They are Copy link, which still answers to your keyboard shortcut, and Send in Remotes. Pick the second, type a developer's name, and choose them. A dialog asks "Send commit to @handle?" with the commit card as a preview. Cancel sends nothing. Hit Send, and you land in that conversation with the link already posted.
Credit MrPunyapal, who wired the share menu, the developer picker, and the confirmation together. The picker returns up to eight matching developers per search. Send appears only when you are signed in, Remotes is on, and the commit is approved. Pending and rejected commits still offer Copy link. What travels is the commit's full permalink, host intact, sent as an ordinary message. The server also knows this is a share, so it can mark people you cannot reach yet.
There is one catch. The share picker is stricter than the ordinary message picker. If either of you has a request still waiting to be merged, that developer is greyed out with "can't push. Merge their request first" or "your request is waiting to be merged." The regular picker lets you start that conversation anyway. Sharing waits until the request is accepted.
Your organization now has a Members tab in its settings. Admins add people by handle, make them admins or members, and remove them. Everyone in the organization can read the list or leave.
The Report commit dialog now takes up to three screenshots, picked, pasted, or dropped, so moderators can see what you saw. Only you and the moderation desk can open them.
Every reply now opens with a Replying to line that pre-ticks everyone on the commit you are answering. Uncheck a name and that person stops getting the notification.
The rail under a commit now matches posts the way search does, then asks a model whether the subjects actually connect. A "that's so cool" about a dog photo no longer lands under your feature announcement.
Click the Image quote under a reply and the chat scrolls back to the original photo, then rings it for a moment. If the picture is buried in older history, the app loads that first.
The site used to keep only the last day you were around, so a visit on day 60 looked the same as a visit on day 7. Now every day is written down, one row at a time.
Posts written in Latin used to die at the translate button, then ask the model again on every visit. Now any two- or three-letter language code gets through, so quod erat demonstrandum reads in English.
The chat composer now boxes its attachment, ping, mic, and call buttons together, and Push only appears once you type, attach an image, or record a voice note. #1336
Browsers that admit they're driven by a program no longer send the guest-visit event, so crawlers stop denting the conversion rate on the Growth page. #1315
Org lookups now skip organizations that block GitHub access with an IP allow list, SAML SSO, or OAuth restrictions, while other 403s still retry the job. #1327
Internals 2
Organizations now live in their own table, so a user's profile no longer carries the member list and lane color that only orgs ever used. #1316
When Tom fails to reply, the error now names the cause's exception class and code, so timeouts, refusals and HTTP errors are told apart, still without the provider's message. #1326
Docs 1
Agent guidelines now state that transactions and row locks guarding a write belong in actions, never in HTTP middleware, with a re-check under the lock as the one allowed exception. #1314
