GitHub, Inc.
Acquisitions
5
Major Deals Covered
This page covers 5 major deals from 2018 to 2020, each with its price where disclosed and the reason behind it.
| Company | Year | Price | Purpose |
|---|---|---|---|
| npm, Inc. | 2020 | Undisclosed | Acquired the world's premier JavaScript package manager and public package registry. |
| Semmle | 2019 | Undisclosed | Acquired the leading semantic code analysis and vulnerability scanning platform (CodeQL). |
| Dependabot | 2019 | Undisclosed | Acquired automated dependency vulnerability scanning and automated pull request patching technology. |
| Spectrum | 2018 | Undisclosed | Acquired developer community discussion and real-time chat platform. |
| Pull Panda | 2019 | Undisclosed | Acquired pull request analytics and Slack integration tools (Pull Reminders, Pull Analytics). |
2020
Acquired the world's premier JavaScript package manager and public package registry.
Brought the main JavaScript package registry under GitHub, giving it a central role in JavaScript supply chain security.
Integrated into GitHub Packages while maintaining npm as a free public registry.
2019
Acquired the leading semantic code analysis and vulnerability scanning platform (CodeQL).
Provided the core static analysis engine that powers GitHub Advanced Security (GHAS), enabling automated vulnerability detection directly inside pull requests.
Formed the foundational technology of GitHub Advanced Security.
2019
Acquired automated dependency vulnerability scanning and automated pull request patching technology.
Enabled GitHub to automatically scan repository dependency graphs and open automated fix PRs when vulnerabilities are discovered.
Integrated natively as a free core feature for all GitHub repositories.
2019
Acquired pull request analytics and Slack integration tools (Pull Reminders, Pull Analytics).
Enhanced code review collaboration and automated Slack/Teams notifications for pending pull requests.
Integrated into GitHub Notifications and Team Management.
2018
Acquired developer community discussion and real-time chat platform.
Helped design and architect GitHub Discussions, enabling community forums directly inside repositories.
Integrated into GitHub Discussions.
GitHub's growth plan centers on Copilot. It has expanded Copilot from code completion into chat, code review and a coding agent that can take a GitHub issue and return a pull request, and it lets users choose models from OpenAI, Anthropic, Google and others. Alongside AI, GitHub keeps selling Enterprise seats and Advanced Security into large companies, often bundled through Microsoft's enterprise sales channel.
GitHub runs a freemium subscription model. Public and private repositories are free for individuals, which keeps developers and open-source projects on the platform. Revenue comes from paid seats: GitHub Team and GitHub Enterprise (cloud or self-hosted Server) for companies that need SSO, audit logs and compliance controls; GitHub Copilot plans for individuals and businesses (Business at $19 and Enterprise at $39 per user per month); GitHub Advanced Security add-ons for code and secret scanning; and usage-based billing for Actions minutes, Codespaces compute, Packages and storage. Microsoft also sells GitHub through its enterprise agreements. GitHub does not publish a revenue breakdown by product.
In June 2018, Microsoft Corporation announced the acquisition of GitHub for $7.5 billion in Microsoft stock, completing the transaction in October 2018. The acquisition united the world's leading developer platform with Microsoft's global enterprise reach and cloud infrastructure.
Notable acquisitions by GitHub include Dependabot (2019, automated security dependency updates), Semmle (2019, CodeQL semantic code analysis), Pull Panda (2019, Slack PR notifications and analytics), npm, Inc. (2020, the JavaScript package manager registry), and Spectral (2022, developer secret scanning and security).
GitHub acquired npm, Inc. in April 2020 to bring the world's largest JavaScript open-source package ecosystem (powering millions of Node.js developers and over 1.3 million packages) directly into GitHub's developer platform, ensuring long-term stability, security, and integration with GitHub Packages.
Acquiring Semmle brought the major CodeQL semantic analysis engine to GitHub. CodeQL treats code as data, enabling developers and security researchers to write queries that scan codebases for complex security vulnerabilities and CVE variants before pull requests are merged.
Acquiring Dependabot allowed GitHub to automatically scan repository dependency manifests for known security vulnerabilities (via the GitHub Advisory Database) and automatically open automated pull requests with patched library versions, securing millions of software projects effortlessly.
GitHub acquired Pull Panda in 2019 to integrate automated team Slack reminders, round-robin pull request reviewer assignments, and team cycle-time analytics directly into GitHub, streamlining engineering code review turnaround times.
GitHub acquires developer-first startups that solve core friction in the developer lifecycle, rapidly baking their core technologies into GitHub's native user experience and making foundational security and automation capabilities freely accessible to open-source maintainers.
Early acquisitions of bot automation and monitoring tools allowed GitHub to pioneer chatops (controlling infrastructure deployments and CI workflows directly from Slack and chat channels), establishing GitHub as an interactive hub for DevOps teams.
Yes. In 2020, GitHub executed a massive, highly strategic acquisition of NPM (Node Package Manager). NPM is the massive, absolute backbone of the global JavaScript ecosystem. By owning NPM, GitHub secured complete control over how millions of web developers download and manage code dependencies.
Compare corporate acquisition records, deal values, and strategic targets
Explore GitHub
Core profile pages, founders and related research hubs for this company.