- GitHub’s new API shows how a repository’s stars grow over time without revealing who starred it.
- The tool cuts the requests needed to rebuild React’s star history from about 2,511 to 24.
- The change tackles privacy worries and database slowdowns caused by scraping public stargazer lists.
GitHub has launched a new API that tracks repository star history without revealing user identities. An API is a tool that lets one program request data from another. Maintainers and analytics tools can now measure rising interest in open-source projects more easily. The feature gives them a faster route to the same answer. It also cuts unnecessary database work.
GitHub explained the change in an engineering post on October 14, 2026. The company first announced the new endpoint on September 4, 2026. That announcement followed earlier limits on access to stargazer lists. Both the engineering post and the changelog describe the endpoint. An endpoint is simply a set address that handles one kind of request.
Why GitHub Replaced Stargazer Scraping
Developers use stars to show interest in a repository. People who start a project are called stargazers. Maintainers, who manage the project, track those stars over time. This helps them judge whether a product launch, software release, or public announcement drew more attention.
GitHub’s older GET /repos/{owner}/{repo}/stargazers endpoint had a different job. It lists users who currently start a repository. GitHub did not design it to give a complete historical record. When someone removes a star, the matching record disappears. That limits the history this method can show.
Many developers wanted that history anyway. Third-party tools still used the endpoint to build star-growth charts. They pulled individual stargazer records and extracted the timestamps. A timestamp records the exact time someone started a project. These tools needed the timing, not the people, so they discarded the usernames. Large projects meant collecting a huge number of records.
GitHub found two major problems with this approach. First, public user lists can support bulk data collection. That includes scraping for spam and phishing campaigns. Second, pulling pages of records from popular repositories placed unnecessary pressure on its databases.
GitHub has also taken action against malicious code hosted on its platform. In a separate incident, the company disabled repositories linked to Microsoft after researchers discovered malware.
New Endpoint Turns 2,511 Requests Into 24
The new endpoint is GET /repos/{owner}/{repo}/stargazers/history. It returns star counts grouped by calendar week. Daily counts come with every week, so tools can show growth day by day. One request can retrieve up to 30 weeks of history.
Developers can then move backward through earlier periods using pagination. Pagination means reading results one page at a time. The official docs cover the endpoint in more detail.
The API provides counts without returning individual stargazer identities. Developers see totals, not names. Analytics tools can still draw growth charts from those totals. Nobody gets a list of people to scrape. The endpoint avoids the old problem by never exposing a user list. It also changes how GitHub processes the data underneath.
The old method counted all matching stars before limiting the response. The new system filters records first. It uses an indexed creation-time range for this step. An index helps a database find records without checking every row. The system then groups the matching records into daily counts. This reduces the data the database must examine for each request.
GitHub used react/react as its example. That repository had about 251,000 stars. Rebuilding its star history with the previous approach took around 2,511 requests. According to GitHub’s estimate, the new endpoint needs about 24 requests for the same job. That is a much smaller load for one popular repository. Tools no longer have to collect every stargazer record.
Database Strain Drops, but Limits Remain
GitHub also shared numbers on database strain. It logged nearly 37,000 slow count queries during the week before it restricted access to stargazer lists. Each query averaged almost three seconds. Database safeguards terminated more than 1,000 of them.
Slow queries add heavy work for a database. The restrictions made a clear difference. After they took effect, stargazer requests fell by about 60%. The total time spent on the count query dropped by about 80%.
The two changes work together. The restrictions reduced traffic to stargazer lists. The new endpoint gives developers a safer way to get the history they need. The new endpoint still has limits. It does not preserve every historical event. GitHub’s underlying model tracks current stars. Removed stars therefore leave no complete record of past activity. Calendar boundaries also affect how the API groups historical data. Unusually busy weeks can still generate expensive queries.
GitHub made a separate update too. The repository stargazers page now uses cached star counts. Cached counts are saved numbers that the page reuses. The page no longer works them out each time someone visits. Before, the page calculated them on demand. According to the company, this change eliminated hundreds of slow queries each week.
GitHub’s changes address privacy and speed at the same time. The change gives developers a more practical way to measure repository growth. They no longer need to collect unnecessary personal data. It also shows how API design can improve database efficiency. A service works better when it returns information tailored to what users actually need.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
US Flags China-Linked Hackers in Breach of Pacific Regional Organization
The U.S. Embassy says hackers linked to China infiltrated the systems of a regional group in Suva fo...
French Police Shut Down Reacher and Stryx, Arrest Three 17-Year-Olds
French police arrested three 17-year-olds for allegedly operating the Reacher and Stryx stolen data ...
Privacy Concerns Grow Over Meta Muse Profiles of People Who Never Use the App
WIRED and independent researcher Karan Joshi report that Muse’s instructions tell it to build a page...
ICANN Switches DNS Root to KSK-2024 in Major Internet Security Update
The root zone KSK rollover took place on October 11, the second time since the first one nearly a de...
Florida Sues TP-Link Over Router Security Risks and Alleged China Links
Florida’s Attorney General James Uthmeier sued TP-Link, saying the company hid risks tied to i...
Microsoft Warns Hackers are Using AI to Speed Up Cyberattacks
Microsoft declared that threat actors are presently reaping AI advantages at a faster pace with rega...
