Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 31 October 2026
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
- Author
- Andrew Nesbitt
- Generator
- Jekyll
- Public lists
- davewiner/hackerNewsStars
- Fetched
Andrew Nesbitt
• Andrew Nesbitt
Signing and Attestations Across Package Registries
A survey of signing, provenance attestations and trusted publishing across package registries.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Source Control: 28 October 2026
Releases, advisories, and articles from across version control and forges
Andrew Nesbitt
• Andrew Nesbitt
Package Management Devroom at FOSDEM 2027: Call for Participation
Submissions close 1 December.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 24 October 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
One Small Bug
Want me to fix that too?
Andrew Nesbitt
• Andrew Nesbitt
Trust Stores Are Dependencies Too
26 of 29 CA bundles in critical packages contain roots Mozilla has removed.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 17 October 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Now That’s What I Call Technical Debt!
15 chart-topping hits about unpaid maintainers and overconfident AI agents.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 10 October 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Package Management RFCs
Which package management specs exist and where do they live?
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 3 October 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Software Heritage Identifiers
Notes from CodeCommons: SWHIDs, the SWH archive, and connecting both to package metadata.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 26 September 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Package Manager Sandboxing
A survey of sandbox usage across package manager clients.
Andrew Nesbitt
• Andrew Nesbitt
Package Manager Threat Model, Revisited
Path traversal via a manifest field appeared in eight of ten package managers audited and thirty-three times in four months of everyone else's advisories.
Andrew Nesbitt
• Andrew Nesbitt
Unfinished Work in Package Security
Some assembly required.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 19 September 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Good Morning, Your Toaster Is Compromised
Rise & Grind goes live to the software supply chain.
Andrew Nesbitt
• Andrew Nesbitt
Shadowing the Standard Library
export PYTHONSAFEPATH=1
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 12 September 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Package Manager Trends
min-release-age, minimum-release-age, -Zmin-publish-age, cooldown.
Andrew Nesbitt
• Andrew Nesbitt
What’s new in git-pkgs
Small Go modules for people who build package-manager tooling.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 5 September 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
How much should you trust your OSS data?
Every second, open source shapes our software, yet our view of this ecosystem is surprisingly opaque. How much can you really trust OSS data?
Andrew Nesbitt
• Andrew Nesbitt
Git Submodules as a Package Manager
.gitmodules is a manifest and the gitlink is a lockfile entry.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 29 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Now Hiring: Senior Open Source Maintainer
A rare opportunity to make a real impact in a fast-paced, high-visibility role.
Andrew Nesbitt
• Andrew Nesbitt
Bazel Module Versions Aren’t SemVer
According to strict SemVer, protobuf's latest Bazel release is from 2022.
Andrew Nesbitt
• Andrew Nesbitt
Hardening the Override Flag
export PIP_BREAK_SYSTEM_PACKAGES=1