Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 22 August 2026
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
- Author
- Andrew Nesbitt
- Generator
- Jekyll
- Public lists
- davewiner/hackerNewsStars
- Fetched
Andrew Nesbitt
• Andrew Nesbitt
Issues in the Repo
refs/bugs, refs/notes, refs/heads/ticgit, or a directory full of YAML.
Andrew Nesbitt
• Andrew Nesbitt
Two-Factor Authentication Across Package Registries
Something you have, something you know, and someone else's OAuth.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 15 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
How This Blog Is Built
A full walkthrough of the custom static site generator, content pipeline, and edge deployment behind nesbitt.io.
Andrew Nesbitt
• Andrew Nesbitt
Supplier Security Questionnaire
Estimated time to complete: 20 minutes.
Andrew Nesbitt
• Andrew Nesbitt
Shared Code Between Package Managers
Which package-management libraries twenty package managers reuse from each other.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 8 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
The Software Stewardship Lab
A new applied research lab for open source sustainability, launching today
Andrew Nesbitt
• Andrew Nesbitt
A year of AI disclosure in critical packages
Assisted-By: Daniel Stenberg
Andrew Nesbitt
• Andrew Nesbitt
brew install actions/checkout
Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 1 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
The AI Phrasebook
We have autonomous agents at home.
Andrew Nesbitt
• Andrew Nesbitt
Wheels, Bottles and Images
Any sufficiently advanced package manager is indistinguishable from a container registry.
Andrew Nesbitt
• Andrew Nesbitt
Why npm Dependency Trees Are So Big
Two versions of lodash walk into a tree
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 25 July 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Interview with a Maintainer
Episode 214 of Green Squares.
Andrew Nesbitt
• Andrew Nesbitt
Package Name Prefixes
django plugins, cloud SDKs, and 1,999 homework submissions.
Andrew Nesbitt
• Andrew Nesbitt
–end-of-options
The git flag I assumed was an LLM hallucination
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 18 July 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Plumbing Homebrew into the vulnerability ecosystem
One command, six repos, three standards bodies, an advisory database, and a version comparator written in the wrong language.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 11 July 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Package Management as Org Chart
Conway's Law applied to dependency management designs.
Andrew Nesbitt
• Andrew Nesbitt
Unboxed: Zig
Zig's package manager: mechanics, categorisation, governance, threat model.
Andrew Nesbitt
• Andrew Nesbitt
Content addressing in package managers
Names are for humans, hashes are for everything else
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 4 July 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
The CRA is not about open source
The CRA created an open-source steward role, then left maintenance unfunded.
Andrew Nesbitt
• Andrew Nesbitt
Taking Roads and Bridges literally
Reflections on UN Open Source Week 2026
Andrew Nesbitt
• Andrew Nesbitt
Unbundling the standard library
Batteries no longer included, available separately on aisle four
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 27 June 2026
Releases, advisories, and articles from across the package management world