Bug: Deleted spam repositories leave "ghost entries" in the 'Repository' dropdown filter of the Notifications > Subscriptions panel

[kirklestelle]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Other

Body

What happened?

When a user is forcefully auto-subscribed to a malicious repository via an automated spam @mention, and that repository is subsequently banned/nuked by GitHub Trust & Safety, there is still a "ghost entry" for the banned/nuked repository left behind in the filter UI of the Notifications / Subscriptions panel.

#180956 announced a fix clearing out spam notifications from the user Inbox, but the dead repo name still lingers in the Repository dropdown filter of the Subscriptions panel.

Selecting the banned repo in the dropdown menu attempts to filter the user's Subscriptions, but the page does not successfully display any results or any solution to manually 'Unsubscribe'. (see image below with dead repo param ?repository=R_kgDOTghvCw)

What did you expect to happen?

1. Banned or deleted repos should never appear as an entry in the Subscriptions' Repository filter menu.
2. At the very least, if a ghost entry remains, clicking it should update the filtered results with a message explaining that the selected repo cannot be found or no longer exists. Additionally, the button to 'Unsubscribe' should appear.

Related feedback

1. Users should not be auto-subscribed by simply receiving @mentions in any issues, pull requests, and discussions — especially for repos the user is not already watching. This should be the default functionality with an option to toggle on if the user enjoys spam.🥫 Users could receive Notifications with any @mentions, but that should not change their Subscriptions. See related feedback below:
   1. Warn or prevent mentioning (@'ing) a user not involved in a project/repo #75571
   2. Removing notifications for @mentions in commit messages #178738
   3. Suddenly got several scam notifications, are there any way to turn off mention in repos that I am not belong to? #162922
   4. [Feature request] Introduce "only @mentions" notifications setting #174465
   5. Idea: Stricter profile mention regulations, more options for personalization #174585

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[hoangperry]

Nice catch — and there's a user-side lever that usually clears these ghosts, because the dropdown is built from your notification subscriptions, not from live repositories:

1. Go to https://github.com/notifications/subscriptions (Notifications → the "Manage subscriptions" view).
2. The nuked repo should still appear there as a lingering subscription row — the spam @mention force-subscribed you, and the T&S takedown deleted the repo without cascading to your subscription record. That orphaned row is what keeps feeding the filter dropdown.
3. Unsubscribe from it there. Also check https://github.com/watching for the same residue.

Once the orphaned subscription is gone, the filter entry disappears (sometimes after a short cache delay). If the repo doesn't show in either list yet still haunts the dropdown, then you've found a deeper orphan — the dropdown reading from an index that neither UI exposes — and that's worth adding to your report here, because it means users have no self-service path at all for that state.

Your broader point stands regardless and is worth keeping in this thread: takedowns of spam repos should cascade cleanup to every user-facing surface they touched (inbox fixed in #180956, but subscriptions/filters clearly weren't included), especially since the ghost entries are artifacts of an attack on the user, not anything they opted into.