GitHub redesigned the API that powers star-history charts for repositories after restricting access to stargazer identity lists, which had been scraped for spam and phishing campaigns, according to a post on the GitHub Blog.
The original design counted every star on a repository for each paginated request even though only one page of results was returned, GitHub said. In the week before access was restricted, nearly 37,000 of the resulting count queries ran slowly enough to be logged, averaging close to three seconds each.
The new endpoint returns daily star counts over up to 30 weeks in a single request, with no identity data exposed, GitHub said. Instead of counting all of a repository's stars before applying pagination, the system converts the requested page into an indexed date range, filters stars to those weeks, and groups the results into daily counts.
For the react/react repository, the change cut the number of API requests needed to render a star-history chart from 2,511 to 24, GitHub said, while eliminating the slow count queries entirely on repository pages.
The fix is a reminder that scraping defenses and performance problems are often the same bug wearing two hats. Restricting an endpoint to stop abuse forced GitHub to look at how it was built, and the fix that stopped the abuse also made the endpoint faster for everyone still allowed to use it.