Package Management Nerd, working on mapping the world of open source software https://ecosyste.ms and blogging about package managers at https://nesbitt.io
Andrew Nesbitt boosted
zizmor 1.29.0 is released!
this release comes with a number of enhancements and bug fixes, but the big one is that we now support auditing pre-commit inputs! support is limited to just a single audit for now, but will expand over subsequent releases.
full notes: https://docs.zizmor.sh/release-notes/#1290
docs.zizmor.sh/release-notes/#1290Andrew Nesbitt boosted
Let’s Play “htmx 4: the game” 🐴
#htmx 4 was published exclusively for the Game Boy and Game Boy Color platforms. I recorded my play-through including the source code. This game is tough!
https://sethmlarson.dev/htmx-4-the-game
#web #gameboy #gbdev #retrogaming
sethmlarson.dev/htmx-4-the-game
sethmlarson.devLet’s Play “htmx 4: the game”Moments ago I just finished playing “htmx 4: the game”, the first
JavaScript library published exclusively for Game Boy and Game Boy Color.
I've recorded my play session and published the video to ...Andrew Nesbitt boosted
This Week in Package Management: 1 August 2026
https://nesbitt.io/2026/08/01/this-week-in-package-management.html
Andrew NesbittThis Week in Package Management: 1 August 2026Releases, advisories, and articles from across the package management worldThis Week in Package Management: 1 August 2026
https://nesbitt.io/2026/08/01/this-week-in-package-management.html
Andrew NesbittThis Week in Package Management: 1 August 2026Releases, advisories, and articles from across the package management worldReplying to @wolf480pl@mstdn.io
@wolf480pl yep!
Picked up a little project to keep me away from the computer this summer.
Andrew Nesbitt boosted
The AI Phrasebook
https://nesbitt.io/2026/07/31/the-ai-phrasebook.html
nesbitt.io/2026/07/31/the-ai-phrasebook.html
Andrew NesbittThe AI PhrasebookWe have autonomous agents at home.Replying to @sharlatan@mastodon.social
@sharlatan I’ve started looking but not got anything concrete yet, working on it though
The AI Phrasebook
https://nesbitt.io/2026/07/31/the-ai-phrasebook.html
nesbitt.io/2026/07/31/the-ai-phrasebook.htmlAndrew NesbittThe AI PhrasebookWe have autonomous agents at home.Andrew Nesbitt boosted
Reference same-repository actions with self-repository syntax https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax
#github
The GitHub BlogReference same-repository actions with self-repository syntax - GitHub ChangelogYou can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your…Andrew Nesbitt boosted
Wheels, Bottles and Images
Andrew NesbittWheels, Bottles and ImagesAny sufficiently advanced package manager is indistinguishable from a container registry.Andrew Nesbitt boosted
I wrote a blog post
You don't have a supply chain, you have a supply soup
This is something I want to spend some time investigating in the future, it's all vastly more complicated and weird than we think it is
https://opensourcesecurity.io/2026/07-supply-soup/
opensourcesecurity.io/2026/07-supply-soup/
Open Source SecurityBlog - You don't have a supply chain, you have supply soup2026 has been a wild year. There are more vulnerabilities than anyone can count. We seem to keep talking about the number itself instead of things like how we got here or what we’re going to do about it, which is neat. The number of attacks against open source is basically an uncountable mess. Also very neat. And the cherry on top of this poop sundae is number of companies that have promised us they are going to “fix” open source, and when they use the word fix they really mean sell you a solution for a problem they mostly made up. Very cool, very cool.Andrew Nesbitt boosted
diffoscope 326 just released 💠 https://diffoscope.org/news/diffoscope-326-released/ by @lamby
Replying to @bupd@mastodon.social
@bupd related issue you might want to track: https://github.com/git-pkgs/git-pkgs/issues/294
GitHublicenses: option to emit full license text per dependency (--license-text) · Issue #294 · git-pkgs/git-pkgsUse case We generate attribution artifacts for a few hundred internal repos (Go, Ruby, npm, Python). For every resolved dependency we need the SPDX identifier and the verbatim license text (plus NO...Working on a license scanner for git-pkgs, uses the scancode license rule corpus but much, much faster and less resource intensive: https://github.com/git-pkgs/licenses
My plan is to eventually use it to scan every version of every package with it soon.
GitHubGitHub - git-pkgs/licenses: Fast exact license matching against ScanCode's rule corpus in pure Go.Fast exact license matching against ScanCode's rule corpus in pure Go. - git-pkgs/licensesReplying to @Di4na@hachyderm.io
@Di4na @Zimm_i48 @joshbressers I have some data on usage of FOSS libraries within private code bases if someone wants to do this research, also paging @vlad
Wheels, Bottles and Images
Andrew NesbittWheels, Bottles and ImagesAny sufficiently advanced package manager is indistinguishable from a container registry.Andrew Nesbitt boosted
When people wonder why I wrote https://www.softwaremaxims.com/blog/open-source-hobbyists-turf and why I am angry...
I just received the OpenSource Summit schedule from a LF newsletter.
And it is fascinating how much it can be all stuff from Alpha Centauri that have nothing to do with the realities of FOSS.
Like, I know for who it is. I get it. But also, why do you happily pay to be misinformed if you are in a decision making position?
I mean, I know why. I get it. But still, this is such a waste of money and time that is precious for everyone.