Latest posts
- Now Hiring: Senior Open Source MaintainerAug 28, 2026Andrew Nesbitt
Location: Lincoln, Nebraska, USA Employment type: Volunteer Term: Permanent Compensation: $0 Reports to: The community Direct reports: None Start date: Immediate We’re looking for a passionate, self-directed engineer to take full ownership of one of the most widely deployed libraries in the ecosystem. This is a rare opportunity to make a real impact on software that millions of developers depend o
- Bazel Module Versions Aren’t SemVerAug 27, 2026Andrew Nesbitt
Aman Sharma reported this week that packages.ecosyste.ms had the latest version of protobuf on the Bazel Central Registry (BCR, the default package index for Bazel’s built-in dependency manager) as 3.19.6. The current release is 36.0.bcr.1. Protobuf dropped the leading 3. in 2022 and has shipped 21.x through 36.x since, so 3.19.6 is four years behind. The root cause is that the “latest release” qu
- Hardening the Override FlagAug 25, 2026Andrew Nesbitt
I’ve been reading through the recent run of incidents where package-manager infrastructure was the attack surface, as one does on a Sunday afternoon. One question I kept coming back to was whether the tools have any defences at the flag and config level. Every package manager has an override that turns off a check: --allow-unauthenticated, --break-system-packages, --ignore-scripts, an env var that
- This Week in Package Management: 22 August 2026Aug 22, 2026Andrew Nesbitt
Week fourteen of the roundup, built from the package manager OPML feed collection and whatever I’ve posted or boosted on Mastodon. Releases Go 1.27 is out. On the module side, go mod tidy now consolidates duplicate require blocks into the canonical direct/indirect pair for modules declaring go 1.27 or later, go doc accepts package@version to fetch documentation for a specific module version, and t
- Issues in the RepoAug 20, 2026Andrew Nesbitt
GitHub had a rough Monday this week, with git operations, Actions, and the issue tracker all unavailable for several hours. Code being unreachable during a forge outage is annoying but survivable because every contributor already has a full clone. Issues and pull request threads going dark is a different matter, since for most projects those exist only in GitHub’s database and nowhere else. I aske
- Two-Factor Authentication Across Package RegistriesAug 18, 2026Andrew Nesbitt
This month npm stopped accepting bypass-2FA tokens for account-governance actions, one of the steps in the plan GitHub set out last September to close the remaining routes that let a reusable credential bypass 2FA on npm. I went through the other registries ecosyste.ms tracks with more than ten thousand packages to see where each is on the same question, and the answer mostly follows from whose ac
- This Week in Package Management: 15 August 2026Aug 15, 2026Andrew Nesbitt
Week thirteen of the roundup, built from the package manager OPML feed collection and whatever I’ve posted or boosted on Mastodon. Releases pnpm 12, the Rust rewrite, reached RC 5 and the project published What’s different in pnpm 12: commands, flags, settings and the lockfile format are unchanged from pnpm 11, so upgrading is not a migration. RC 5 breaks dependency cycles canonically during peer
- Supplier Security QuestionnaireAug 13, 2026Andrew Nesbitt
From: Third-Party Risk Management To: [address extracted from package metadata] Subject: ACTION REQUIRED: Annual Supplier Security Assessment Due: 5 business days from receipt Hi, Our software inventory has identified you as the supplier of a software component in our production estate (the “Component”). All such suppliers are required to complete our standard security assessment annually. We were
- Shared Code Between Package ManagersAug 11, 2026Andrew Nesbitt
Writing up the package manager CWEs list and then the --end-of-options survey, both of which come down to the same bug being fixed independently in tool after tool, left me wondering how much code these tools share with each other in the first place. So I went through the direct dependencies of twenty package managers1, each with at least two same-language peers in the set, looking for package-man