GitHub introduces new API endpoint for repository star history without stargazer identities

New Star History API Endpoint Launched

GitHub has introduced a new API endpoint designed to provide repository star history. This endpoint returns up to 30 weeks of daily star counts in a single request. Crucially, it does not include any individual stargazer identities, focusing solely on the numerical trend of stars over time.

Addressing Previous Issues with Stargazer Data

The previous method for obtaining star history involved requesting pages of stargazer records, which included timestamps and user identities. This design led to two main problems: bad actors scraped public stargazer lists for spam and phishing campaigns, and for highly starred repositories, the endpoint caused the database to process thousands of entries for a single page, impacting performance.

Improved Performance and Security

The new endpoint improves database efficiency by filtering stars by time before counting them, reducing the amount of data processed. This contrasts with earlier attempts to simply return less data, which did not make the query cheaper. The removal of identity data also mitigates the security risks associated with bulk collection of user information.

Impact on Maintainers and Tool Builders

Initially, GitHub restricted stargazer and watcher lists to repository administrators and collaborators to address immediate risks. This change disrupted existing tools that relied on the old API to calculate star history. After consulting with maintainers and tool builders, GitHub developed the new aggregate endpoint to provide the curve of star counts, which was the essential data point for understanding project trajectory and interest, without the unnecessary user identities.