Package Management Nerd, working on mapping the world of open source software https://ecosyste.ms and blogging about package managers at https://nesbitt.io
Andrew Nesbitt boosted
Restricting npm bypass-2FA granular access tokens https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens
#github
The GitHub BlogRestricting npm bypass-2FA granular access tokens - GitHub Changelognpm granular access tokens (GATs) configured to bypass 2FA can no longer perform sensitive account, org, and package management actions. These now require an interactive 2FA challenge, closing one of…Andrew Nesbitt boosted
Replying to @yossarian@infosec.exchange
(this officially loosens zizmor's "GHA only" policy. if there are other platforms you care about, help me understand them better here: https://github.com/orgs/zizmorcore/discussions/2253)
github.com/orgs/zizmorcore/discussions/2253
GitHubWhat platforms would you like zizmor to support? · zizmorcore · Discussion #2253Starting with 1.29.0, I've decided to relax zizmor's unofficial "GitHub Actions" only support policy by adding support for auditing pre-commit hooks and configurations. In a sense this opens the fl...Andrew Nesbitt boosted
zizmor 1.29.0 is released!
this release comes with a number of enhancements and bug fixes, but the big one is that we now support auditing pre-commit inputs! support is limited to just a single audit for now, but will expand over subsequent releases.
full notes: https://docs.zizmor.sh/release-notes/#1290
docs.zizmor.sh/release-notes/#1290Andrew Nesbitt boosted
Let’s Play “htmx 4: the game” 🐴
#htmx 4 was published exclusively for the Game Boy and Game Boy Color platforms. I recorded my play-through including the source code. This game is tough!
https://sethmlarson.dev/htmx-4-the-game
#web #gameboy #gbdev #retrogaming
sethmlarson.dev/htmx-4-the-game
sethmlarson.devLet’s Play “htmx 4: the game”Moments ago I just finished playing “htmx 4: the game”, the first
JavaScript library published exclusively for Game Boy and Game Boy Color.
I've recorded my play session and published the video to ...Andrew Nesbitt boosted
This Week in Package Management: 1 August 2026
https://nesbitt.io/2026/08/01/this-week-in-package-management.html
Andrew NesbittThis Week in Package Management: 1 August 2026Releases, advisories, and articles from across the package management worldThis Week in Package Management: 1 August 2026
https://nesbitt.io/2026/08/01/this-week-in-package-management.html
Andrew NesbittThis Week in Package Management: 1 August 2026Releases, advisories, and articles from across the package management worldPicked up a little project to keep me away from the computer this summer.
Andrew Nesbitt boosted
The AI Phrasebook
https://nesbitt.io/2026/07/31/the-ai-phrasebook.html
nesbitt.io/2026/07/31/the-ai-phrasebook.html
Andrew NesbittThe AI PhrasebookWe have autonomous agents at home.The AI Phrasebook
https://nesbitt.io/2026/07/31/the-ai-phrasebook.html
nesbitt.io/2026/07/31/the-ai-phrasebook.htmlAndrew NesbittThe AI PhrasebookWe have autonomous agents at home.Andrew Nesbitt boosted
Reference same-repository actions with self-repository syntax https://github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax
#github
The GitHub BlogReference same-repository actions with self-repository syntax - GitHub ChangelogYou can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your…Andrew Nesbitt boosted
Wheels, Bottles and Images
Andrew NesbittWheels, Bottles and ImagesAny sufficiently advanced package manager is indistinguishable from a container registry.Andrew Nesbitt boosted
I wrote a blog post
You don't have a supply chain, you have a supply soup
This is something I want to spend some time investigating in the future, it's all vastly more complicated and weird than we think it is
https://opensourcesecurity.io/2026/07-supply-soup/
opensourcesecurity.io/2026/07-supply-soup/
Open Source SecurityBlog - You don't have a supply chain, you have supply soup2026 has been a wild year. There are more vulnerabilities than anyone can count. We seem to keep talking about the number itself instead of things like how we got here or what we’re going to do about it, which is neat. The number of attacks against open source is basically an uncountable mess. Also very neat. And the cherry on top of this poop sundae is number of companies that have promised us they are going to “fix” open source, and when they use the word fix they really mean sell you a solution for a problem they mostly made up. Very cool, very cool.Andrew Nesbitt boosted
diffoscope 326 just released 💠 https://diffoscope.org/news/diffoscope-326-released/ by @lamby
Working on a license scanner for git-pkgs, uses the scancode license rule corpus but much, much faster and less resource intensive: https://github.com/git-pkgs/licenses
My plan is to eventually use it to scan every version of every package with it soon.
GitHubGitHub - git-pkgs/licenses: Fast exact license matching against ScanCode's rule corpus in pure Go.Fast exact license matching against ScanCode's rule corpus in pure Go. - git-pkgs/licensesWheels, Bottles and Images
Andrew NesbittWheels, Bottles and ImagesAny sufficiently advanced package manager is indistinguishable from a container registry.Andrew Nesbitt boosted
When people wonder why I wrote https://www.softwaremaxims.com/blog/open-source-hobbyists-turf and why I am angry...
I just received the OpenSource Summit schedule from a LF newsletter.
And it is fascinating how much it can be all stuff from Alpha Centauri that have nothing to do with the realities of FOSS.
Like, I know for who it is. I get it. But also, why do you happily pay to be misinformed if you are in a decision making position?
I mean, I know why. I get it. But still, this is such a waste of money and time that is precious for everyone.
Andrew Nesbitt boosted
npm publish-time malware scanning and dual-use metadata https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata
#github
The GitHub Blognpm publish-time malware scanning and dual-use metadata - GitHub ChangelogAs part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…Andrew Nesbitt boosted
Lots of new stuff in pip 26.2:
🍊 Support for Python 3.15
🍊 Selecting only dependencies
🍊 Experimental: venv based build isolation
🍊 Faster repeated resolves by caching index simple responses
🍊 No more progress bar spam in CI
🍊 Deprecation to remove the legacy dependency resolver (--use-deprecated=legacy-resolver)
See @ichard26's post for more!
https://sichard.ca/blog/2026/07/whats-new-in-pip-26.2/
#Python #pip
Andrew Nesbitt boosted
Can you help me out with some citations? I'd love reliable articles that support or refute these #AI statements:
0) AI-generated code's harder to review (because it looks plausible but you can't try and work on a "the author meant [thing]" basis)
1) People are less good at reviewing AI-generated code (because they're inclined to trust what the computer says)
2) AI-generated code has high environmental costs (e.g. figures about DC capacity?)
3) Using AI is cognitively harmful
Boosts very welcome
Andrew Nesbitt boosted
GitHub Actions holds potentially malicious workflows for approval https://github.blog/changelog/2026-07-28-github-actions-holds-unproven-workflows-for-approval
#github
The GitHub BlogGitHub Actions holds potentially malicious workflows for approval - GitHub ChangelogRecent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these…