Andrew Nesbitt

@andrewnez@mastodon.social · Joined ⁨Apr⁩ ⁨2017⁩

Package Management Nerd, working on mapping the world of open source software ecosyste.ms and blogging about package managers at nesbitt.io

GitHub
github.com/andrew verified
Twitter
twitter.com/teabass
Homepage
nesbitt.io verified
bsky
bsky.app/profile/andrewnez.bsk
3083Posts
0Following1Followers
Andrew Nesbitt@andrewnez@mastodon.social

Something I've been working on recently to improve testing around dependencies: github.com/alpha-omega-securit

Reuses a lot of pieces of git-pkgs and scrutineer

Generate hermetic tests that capture how a repository uses each of its dependencies. Built on git-pkgs and alpha-omega-security/harness. - alpha-omega-security/hyrumGitHubGitHub - alpha-omega-security/hyrum: Generate hermetic tests that capture how a repository uses each of its dependencies. Built on git-pkgs and alpha-omega-security/harness.Generate hermetic tests that capture how a repository uses each of its dependencies. Built on git-pkgs and alpha-omega-security/harness. - alpha-omega-security/hyrum

Andrew Nesbitt boosted

yossarian@yossarian@infosec.exchange

following PEP 833, Python packaging now considers the HTML index representation frozen!

I’m really happy we got this out: IMO it’s a small but very important step towards nudging clients to prefer the JSON index, which is better in every regard.

blog.pypi.org/posts/2026-08-11

blog.pypi.org/posts/2026-08-11-html-index-is-frozen/
blog.pypi.orgThe HTML representation of the index API is now frozen - The Python Package Index BlogPyPI has adopted PEP 833, which

Andrew Nesbitt boosted

Dr. Dawn Foster@geekygirldawn@hachyderm.io

I have some availability for consulting engagements starting in November. I can help you get more value out of your open source efforts by collaborating with you to align your open source contributions with your organization's strategies. I also work with clients to better understand the impact of funding for open source projects, improve open source project governance, and do custom research projects. Reach out now to book consulting engagements starting in November or December. For more details visit fastwonder.com/

Fast WonderConsulting by Dawn FosterLeverage Dr. Dawn Foster’s decades of experience working in open source to help your organization make the most out of their open source engagements.
Andrew Nesbitt@andrewnez@mastodon.social

Replying to @⁨voxpelli.com@bsky.brid.gy⁩

@voxpelli.com one small part: github.com/git-pkgs/downstream another I'm hoping to publish tomorrow

the index will be the most challenging as it could end up huge, will likely focus on the top 1% of packages to begin with.

Tests a library against the projects that depend on it. - git-pkgs/downstreamGitHubGitHub - git-pkgs/downstream: Tests a library against the projects that depend on it.Tests a library against the projects that depend on it. - git-pkgs/downstream

Andrew Nesbitt boosted

Emma Irwin@sunnydeveloper@mastodon.social

Slides from our #FOSSY Talk:

"AI depends on #OpenSource to function, both as a technical dependency and as a source of data. Model builders who consume the output of our labour MUST also be aligned with the values, norms and governance of those communities. Our hypothesis, being that AI builders who prioritize alignment with open source communities will have an advantage built through trust."

sunnydeveloper.com/ai-alignmen

sunnydeveloper.com/ai-alignment-metrics-for-open-source-communities/
Emma's open notesAI Alignment Metrics for Open Source CommunitiesHere is a link to a PDF of our FOSSY Talk of this title. We focused on metric models as a mechanisms for open source communities to influence AI Alignment through community governance and feedback. To move from reactiveness to directing and influencing this technology in our spaces. We are
Andrew Nesbitt@andrewnez@mastodon.social

Thinking of adding support for vendored dependencies to git-pkgs: github.com/git-pkgs/git-pkgs/i

I would like git-pkgs to report dependencies whose package contents or cached artifacts are committed to a repository. Working-directory scans honor .gitignore, but historical scans inspect every t...GitHubDetect and report vendored dependencies · Issue #317 · git-pkgs/git-pkgsI would like git-pkgs to report dependencies whose package contents or cached artifacts are committed to a repository. Working-directory scans honor .gitignore, but historical scans inspect every t...by andrew

Andrew Nesbitt boosted

Greg Wilson@gvwilson@mastodon.social

Geng et al 2026: "Mapping the Emerging Curriculum for AI-Assisted Software Engineering via Syllabus Analysis" arxiv.org/abs/2608.05898 interesting to see what people are trying… If anyone knows of a similar analysis for data science curricula, I'd be grateful for a pointer.

arxiv.org/abs/2608.05898
arXiv logoarXiv.orgMapping the Emerging Curriculum for AI-Assisted Software Engineering via Syllabus AnalysisAs Generative AI coding tools reshape professional software development, universities have begun designing courses to prepare students for AI-assisted development workflows. By analyzing the syllabi of these courses, we can gather empirical evidence about these courses, reveal how this emerging curricular area is being defined, and gain guidance for future curriculum design. We analyzed 23 publicly available syllabi and course materials of upper-division, credit-bearing courses that meet specific criteria, including explicitly addressing Generative AI in software engineering. Through iterative qualitative coding, we characterized courses' learning objectives, assessments, topics, and documented AI tools. Our analysis reveals commonalities and differences among these courses that allow researchers and educators to study and develop future courses.

Andrew Nesbitt boosted

Anil Madhavapeddy@avsm@amok.recoil.org

I updated my website to the latest oxcaml-5.2.0-minus39 and made some notes about how the opam packaging works anil.recoil.org/notes/oxcaml-o : this might be helpful if you're trying out the performance extensions with your own non-Jane Street codebases

Anil MadhavapeddyUpdating to the OxCaml 5.2.0-minus39 opam packagingHow the OxCaml overlay's guard packages keep incompatible releases out, and how to contribute to it with your own packages.