Build1 publisher2 min readPublished
Hacktoberfest's spam fix moves the unpaid hours from PR reviewers to Fest organizers
The 2026 event drops the four-pull-request quota that cheap generation made meaningless and rebuilds around one-day in-person Fests, so a T-shirt now depends on a local organizer finding a venue and Wi-Fi.
The Engineer · Build desk

What happened
- Hacktoberfest 2026 has dropped the format in which four pull requests against any public repo earned a T-shirt or a planted tree.
- Participation is now built around Fests: one-day, in-person Hack Days or Meetups hosted by local organizers, running 3 to 12 hours around open-source AI and open-weight models.
- Online participants get an individual Swag Envelope instead, earned by participation milestones the FAQ has not published, saying only that more details are coming.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost The unpaid work moved: a Fest costs its organizer a venue, Wi-Fi and a 3-to-12-hour day, where the quota years cost maintainers review time.
- constraint Swag eligibility is now a geography test, so a contributor in a country with no registered Fest cannot earn a shirt however much code they write.
- exposure A User-Agent string is the only gate on the Fest feed, so any scraper that sets a header reads the full event list while default library clients are the ones locked out.
- precedent Rewarding attendance gives other swag-driven programs with a generated-submission problem a filter that does the screening itself.
The endpoint is the part you can test from a keyboard. The Fest-finder page tells scripts where to go in plain words, asking outright whether the reader is an LLM and directing it to pull every Fest from the API [8]. Send a bare request and it answers 403, because nothing set a User-Agent header; plain curl and Python's default urllib both get rejected [9]. Any string in that header gets you the JSON. An event that dropped its quota because generated submissions got cheap now publishes a machine-readable index and points LLMs at it, and the Fests themselves are organized around hands-on work with open-source AI and open-weight models [4].
The feed held 217 events worldwide on the day the dev.to author queried it [10]. The number that matters is the one for your own country. It transfers to your October only if one of the 217 sits within travel distance. The author's stake in the exercise was on the record: "I already own more Hacktoberfest shirts than occasions to wear them, so none of this was really about the cotton," the dev.to author wrote [13].
T-shirts exist only at in-person Fests, are not guaranteed there, and ship to organizers who hand them out at their own discretion based on on-site supply [6]. Online-only participants are not eligible for one [7]. A Fest runs 3 to 12 hours on a single day [4], so the longest window anyone has to qualify at a given Fest is 12 hours [14].
Major League Hacking and DEV run the 2026 event in partnership with DigitalOcean [3]. The FAQ's stated reason for the rebuild is that AI tools made low-effort pull requests trivial to generate at scale, and maintainers burned out reviewing the flood [2]. Attendance is harder to generate than a diff, so it works as a filter where a PR count stopped working. A Fest needs a venue, Wi-Fi and 3 to 12 hours from whoever hosts it, and hosting is open to anyone through the site [12]. For a city with nothing on the list, the site's answer is "that's your cue" [16].
The country filter, run across seven countries near Bulgaria, came back with nothing in Bulgaria, and the closest hits were the UK and Ankara, Turkey [11]. For a contributor in that slice, the routes to swag are travel to another country or the online Swag Envelope, whose participation milestones the FAQ has not published [5].
What to watch
- The Swag Envelope milestones: the FAQ promises more details soon, and the numbers decide whether the online path is participation or a mailing-list signup.
- Whether the 217-event total grows as local organizers register through the host page, and which countries stay empty.
- Whether a User-Agent string remains the only gate on the events feed once scrapers start reading it at volume.