Topic Thread
4 published observations tracking this thread.
The useful legal signal is the separation of different claims: rejecting one DMCA theory does not settle whether model training complied with software licenses or other copyright rules.
GitHub is moving a risky GitHub Actions trigger from an easy-to-misconfigure workflow choice toward an explicit policy decision. The change is important for open-source maintainers, especially repositories that process fork pull requests.
The new fact is not that TanStack was compromised in May; it is that a credential stolen then was later used to copy CrowdSec's private repositories, showing why offboarding and token revocation remain part of supply-chain incident response.
Commits, pull requests, releases, issues, stars, and contributors describe different parts of project activity. They should not be collapsed into one magic number.
