Rise & Grind goes live to the software supply chain.
Andrew Nesbitt
• Andrew Nesbitt
Good Morning, Your Toaster Is Compromised
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
- Author
- Andrew Nesbitt
- Generator
- Jekyll
- Public lists
- davewiner/hackerNewsStars
- Fetched
Andrew Nesbitt
• Andrew Nesbitt
Shadowing the Standard Library
export PYTHONSAFEPATH=1
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 12 September 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Package Manager Trends
min-release-age, minimum-release-age, -Zmin-publish-age, cooldown.
Andrew Nesbitt
• Andrew Nesbitt
What’s new in git-pkgs
Small Go modules for people who build package-manager tooling.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 5 September 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
How much should you trust your OSS data?
Every second, open source shapes our software, yet our view of this ecosystem is surprisingly opaque. How much can you really trust OSS data?
Andrew Nesbitt
• Andrew Nesbitt
Git Submodules as a Package Manager
.gitmodules is a manifest and the gitlink is a lockfile entry.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 29 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Now Hiring: Senior Open Source Maintainer
A rare opportunity to make a real impact in a fast-paced, high-visibility role.
Andrew Nesbitt
• Andrew Nesbitt
Bazel Module Versions Aren’t SemVer
According to strict SemVer, protobuf's latest Bazel release is from 2022.
Andrew Nesbitt
• Andrew Nesbitt
Hardening the Override Flag
export PIP_BREAK_SYSTEM_PACKAGES=1
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 22 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Issues in the Repo
refs/bugs, refs/notes, refs/heads/ticgit, or a directory full of YAML.
Andrew Nesbitt
• Andrew Nesbitt
Two-Factor Authentication Across Package Registries
Something you have, something you know, and someone else's OAuth.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 15 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
How This Blog Is Built
A full walkthrough of the custom static site generator, content pipeline, and edge deployment behind nesbitt.io.
Andrew Nesbitt
• Andrew Nesbitt
Supplier Security Questionnaire
Estimated time to complete: 20 minutes.
Andrew Nesbitt
• Andrew Nesbitt
Shared Code Between Package Managers
Which package-management libraries twenty package managers reuse from each other.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 8 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
The Software Stewardship Lab
A new applied research lab for open source sustainability, launching today
Andrew Nesbitt
• Andrew Nesbitt
A year of AI disclosure in critical packages
Assisted-By: Daniel Stenberg
Andrew Nesbitt
• Andrew Nesbitt
brew install actions/checkout
Using Homebrew's tap machinery as a curated distribution layer for GitHub Actions.
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 1 August 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
The AI Phrasebook
We have autonomous agents at home.
Andrew Nesbitt
• Andrew Nesbitt
Wheels, Bottles and Images
Any sufficiently advanced package manager is indistinguishable from a container registry.
Andrew Nesbitt
• Andrew Nesbitt
Why npm Dependency Trees Are So Big
Two versions of lodash walk into a tree
Andrew Nesbitt
• Andrew Nesbitt
This Week in Package Management: 25 July 2026
Releases, advisories, and articles from across the package management world
Andrew Nesbitt
• Andrew Nesbitt
Interview with a Maintainer
Episode 214 of Green Squares.
Andrew Nesbitt
• Andrew Nesbitt
Package Name Prefixes
django plugins, cloud SDKs, and 1,999 homework submissions.