Andrew Nesbitt

This Week in Package Management: 15 August 2026

https://nesbitt.io/2026/08/15/this-week-in-package-management.html

https://nesbitt.io/2026/08/14/how-this-blog-is-built.html

If you want to be involved in the Python Packaging Council elections, register to vote before August 25! I'm there, along with 16 other fantastic choices. https://blog.python.org/2026/08/2026-packaging-council-nominees/ and ask me questions at https://discuss.python.org/t/ppc-nomination-ama-for-henry-schreiner !

What's the difference between a package index and a package registry? One helps you discover packages, the other hosts and serves them. 📦 A new post explains how they fit together. Read more: https://swiftpackageindex.com/blog/what-is-a-package-registry

Richard Scarry already summarized everything there is to know about cyber security, about 50 years ago.

Ethics aside, we can clearly no longer deny the utility of necromancy. Perhaps a year ago, when the pathetic shambling of the animated dead so often made a hollow mockery of our arts. But now! Incantations that once took weeks of toil can be wrested from their tormented souls in mere minutes!

Without the awesome power of the newly dead coursing through our veins, how are we to solve the great problems of our age, like the mysterious disappearance of so many of our elderly and sick friends, or the festering piles of rotten flesh that now clog our streets and homes?

If you still have qualms about using the large soul providers, you can always obtain your own local, free range specimens, although of course they won’t obey quite as faithfully as ones from the leading charnel houses.

Honestly, do you want to be left behind?

@andrewnez You’ve missed out on a perfectly good opportunity to overengineer something simple.

https://nesbitt.io/2026/08/14/how-this-blog-is-built.html

https://nesbitt.io/2026/08/13/supplier-security-questionnaire.html

https://nesbitt.io/2026/08/13/supplier-security-questionnaire.html

@andrewnez MY EYES

Tripped over this cursed bit of software today, look at that massive readme diagram: https://github.com/raydac/mvn-golang

So much of the critical infrastructure that we all rely on contains open source projects that are under-resourced and struggling. One way to help these projects is by funding development and maintenance so that contributors can focus on this work, but it can be hard to justify continuing to fund open source projects. Measuring the impact of open source funding is the best way to continue to fund open source because it allows you to show leadership and other stakeholders the impact of that funding. Here's a blog post to get you started, and I'm available for consulting engagements on this topic.

https://fastwonderblog.com/2026/06/02/how-ospos-can-measure-the-impact-of-oss-funding/

A line I'm going to 100% steal from the meeting I'm in right now: "our circle is now a pretzel".

@sundaram123krishnan wrote "PyPI dependencies, resolved and built for you" about the new tool 'coprtree' that utilizes data from ecosyste.ms.
https://fedora-copr.github.io//posts/pypi-dependencies-resolved-and-built-for-you

⋆。 ̊ ☁︎ ̊。⋆。 ̊☽ ̊。⋆

Something I've been working on recently to improve testing around dependencies: https://github.com/alpha-omega-security/hyrum

Reuses a lot of pieces of git-pkgs and scrutineer

following PEP 833, Python packaging now considers the HTML index representation frozen!

I’m really happy we got this out: IMO it’s a small but very important step towards nudging clients to prefer the JSON index, which is better in every regard.

https://blog.pypi.org/posts/2026-08-11-html-index-is-frozen/

Shared Code Between Package Managers

https://nesbitt.io/2026/08/11/package-manager-library-reuse.html

Shared Code Between Package Managers

https://nesbitt.io/2026/08/11/package-manager-library-reuse.html