Andrew Nesbitt

@wolf480pl yep!

Picked up a little project to keep me away from the computer this summer.

@sharlatan I’ve started looking but not got anything concrete yet, working on it though

The AI Phrasebook

https://nesbitt.io/2026/07/31/the-ai-phrasebook.html

@CyReVolt @joshbressers 🍜

@mhoye @david_chisnall 🤔

@bupd related issue you might want to track: https://github.com/git-pkgs/git-pkgs/issues/294

Working on a license scanner for git-pkgs, uses the scancode license rule corpus but much, much faster and less resource intensive: https://github.com/git-pkgs/licenses

My plan is to eventually use it to scan every version of every package with it soon.

@Di4na @Zimm_i48 @joshbressers I have some data on usage of FOSS libraries within private code bases if someone wants to do this research, also paging @vlad

Wheels, Bottles and Images

https://nesbitt.io/2026/07/30/wheels-bottles-images.html

@defuneste I’m still very dependent on https://octobox.io to stay on top of everything all these years later

@defuneste notifications is such a mess 🫠

Why npm Dependency Trees Are So Big

https://nesbitt.io/2026/07/28/why-npm-dependency-trees-are-so-big.html

@gvwilson I’m amazed they managed to find that many in the wild, no-one in oss uses them

@jacques syncing details for all the packages, repos, registries etc

@veganstraightedge fun research though, I’ve been meaning to do more classification of packages using https://github.com/ecosyste-ms/oss-taxonomy to aid discovery

@veganstraightedge I think there’s some legacy ones there, you can’t register new ones that clash with different cases, similar thing in the first 1k npm packages

@jezdez yep, will get it added for next weeks, also fascinating to read, shame I couldn’t be there

Anyone else get the fear when they get a dependabot update for anything called xz? https://github.com/git-pkgs/archives/pull/18

This Week in Package Management: 25 July 2026

https://nesbitt.io/2026/07/25/this-week-in-package-management.html