Sometime in the days before May 3rd, GitHub's Merge Queue started eating code. Not loudly. Not with stack traces or incident banners or the kind of visible failure that at least gives you something to debug. Silently. The feature — built specifically to protect main branches by batching pull requests and validating them before they land — was, according to the Dev.to account, deleting code in the process. The particular cruelty is architectural: Merge Queue exists precisely because losing code to a bad merge is the nightmare scenario. It is the safety net. And here the safety net had a hole in it, quietly dropping commits while teams presumably watched clean CI runs and assumed everything was fine. The Dev.to post surfaced on May 3rd and scored high enough on attention metrics to suggest it landed in a community that recognized the pattern — engineers nodding along because they'd seen something similar, or were suddenly reviewing their own recent merges with fresh suspicion.
If confirmed, here is what this means. Every team running Merge Queue during the affected window needs to audit their commit history now, not eventually. The insidious quality of silent data loss is that it doesn't announce its own blast radius — you have to go looking for it, and the absence of obvious symptoms is not evidence of safety. More broadly, this is a trust problem as much as a technical one. Merge Queue was sold as the responsible path for high-velocity teams managing protected branches; if it turns out that the mechanism designed to preserve code integrity was instead corrupting it, the damage to confidence in GitHub's more sophisticated collaboration tooling could outlast any patch. Teams that already treat new platform features with a certain weary skepticism will have their instincts validated. Teams that adopted Merge Queue early and enthusiastically will be doing uncomfortable archaeology. There are also compounding risks: if deleted code slipped into production behind green CI, the blast radius extends beyond repositories into deployed systems, and that conversation is significantly harder than a git revert.
Watch for an official GitHub incident report or status page acknowledgment — that would move this from a single developer's account to confirmed platform failure. Watch equally for silence, because if GitHub doesn't surface a postmortem, that absence will itself become the story.
<p>In the fast-paced world of modern software development, continuous integration and continuous delivery (CI/CD) pipelines are the backbone of efficient workflows. GitHub
<p>If you use the GitHub GraphQL API for team notification dashboards, audit-log exports, or any kind of organization compliance reporting, you have nine days when this lands. On
<p>Hey fellow devs,</p> <p>I used to love GitHub. Back when it felt like the internet's code playground — free public repos, smooth collaboration, no corporate overlord breathing
<p>The thread connecting this week's stories is the gap between what software assumes and what hardware or bad actors actually do. From ad networks repurposed for surveillance to
<h2> The risk in one paragraph </h2> <p>Every time your team deploys software to AWS, a pipeline authenticates with credentials that can modify production infrastructure. In most
<p>trpc has a scheduled workflow called "Lock Issues & PRs." Its own <a href="https://gitspider.com/scan/trpc/trpc?ref=devto" rel="noopener noreferrer">scorecard</a> shows it
<h2> When Agentic AI Breaks Your Pricing Model </h2> <p><a href="https://github.blog/news-insights/company-news/changes-to-github-copilot-individual-plans/" rel="noopener
<p>I still remember the exact moment.</p> <p>It was 11pm. My team had been sprinting for 3 weeks building <br /> a new payments feature. Deadline tomorrow. I handed the final <br
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →