Another story: www.linkedin.com/posts/dirk-l.... A story of exploiting PR comment handling in GitHub Actions to achieve command execution, followed by disclosure, remediation, and practical workflow hardening guidance.

Thanking myself for leaving a breaking build so I know where I should start today... I really did not forget what I was doing 🤫

When you are installing the new @visualstudio.com 2026 and you get stuck in some sign in loop then switch to the "Embedded web browser" instead of the "Windows authentication broker". The 2026 installation did not seem to remember that setting from the 2022 installation.

Last week I wrote a short story about how I configured my @imagemagick.org #WASM to use Trusted Publishing: www.linkedin.com/feed/update/...

Hack.Commit.Push Switzerland is just one week away! 🇨🇭 This is a great opportunity to get involved in Open Source projects like @assertj.github.io, with direct guidance from the maintainers!

#AdventOfCode 2025 sponsorship is now open! If your organization might be interested in sponsoring, please have them email sponsorship at [the Advent of Code domain name]. adventofcode.com/2025/sponsors

Just published version 0.0.37 of the @imagemagick.org #WASM library (npmjs.com/package/@ima...) that includes the following changes: github.com/dlemstra/mag... This was published with Trusted Publisher. You can read more about that here: dlemstra.github.io/github-stori...

Published Magick.NET 14.9.1 for .NET Standard 2.0 and .NET 8.0: github.com/dlemstra/Mag.... The NuGet packages can be found here: nuget.org/packages?q=M....

I will be going to remove support for x64 on MacOS in Magick.NET later this year because @github.com will discontinue their macos-13 runners. I suspect most of the people using my library are already on #arm64 so that should not be a problem.

This weekend I took part in a CTF of #HackTheBox: www.linkedin.com/feed/update/... and I finished 57th out of a 2893 participants. 🥂🎉🧙‍♂️. Got a lot of help from @github.com #copilot inside @vscode.dev

Did not realize @nuget.org also shows warning for medium severity's. I will publish a new version of MagickNET later this day that includes a fix for this vulnerability. It is very specific so you are probably not affected but a release with fix will become available later today.

Published Magick.NET 14.9.0 for .NET Standard 2.0 and .NET 8.0: github.com/dlemstra/Mag.... The NuGet packages can be found here: nuget.org/packages?q=M....

We are now also publishing our @imagemagick.org binaries for Windows on @github.com in a release: github.com/ImageMagick/...! It's no longer just on our own server but also archived on GitHub. And we will soon be going to also make these release immutable: docs.github.com/en/code-secu...!

Do you happen to know why the tree in the test explorer of @visualstudio.com collapses when retrying a failed unit test @gusperez.com? This doesn't seem to happen when retrying a unit test that succeeded.

Just published version 0.0.36 of the @imagemagick.org #WASM library (npmjs.com/package/@ima...) that includes the following changes: github.com/dlemstra/mag...

In 2013 I started working on the @imagemagick.org project as an open source developer. In 2014 I published my first open source package in the @nuget.org Gallery. It has taken a while but I finally hit 100 million downloads! 🧙‍♂️🥂🎉

I haven't updated MagickViewer for a while now because I had a complicated setup for signing that no longer worked and the pipeline was not running in @github.com but in #AzureDevOps. I thought it would take a quite an effort to fix the publishing of this ClickOnce application but it wasn't!

Published Magick.NET 14.8.2 for .NET Standard 2.0 and .NET 8.0: github.com/dlemstra/Mag.... The NuGet packages can be found here: nuget.org/packages?q=M....

It finally happened! The insider edition of @vscode.dev keeps trying to update itself when it's closed down for a shutdown of my machine. This has been going well for ages but it looks like Friday when I shut my work laptop down it finally broke the installation. Reinstall fixed it!

It looks like @github.com #copilot is broken in my @visualstudio.com installation because of an issue in the Source Control - Git window: Root element is missing. Root element is missing. Root element is missing. I have no clue where this is happening or what is causing this. Anyone?

It looks like @visualstudio.com doesn't search (ctrl+f) or code search in files that are ignored by git even though they are part of the project and the solution. Does anyone know if there is an option to allow searching in these files?

Published Magick.NET 14.8.1 for .NET Standard 2.0 and .NET 8.0: github.com/dlemstra/Mag.... The NuGet packages can be found here: nuget.org/packages?q=M....

I got the feeling that @visualstudio.com changed something that causes it to ignore all files that are excluded by the .gitignore file when searching in files or finding files with ctrl+T in a C++ project. But I cannot find an option to turn this off. Does anyone know how I can change this?

Published Magick.NET 14.8.0 for .NET Standard 2.0 and .NET 8.0: github.com/dlemstra/Mag.... The NuGet packages can be found here: nuget.org/packages?q=M....

Great to see there is finally some news about the @github.com Secure Open Source Fund: www.linkedin.com/feed/update/.... Hoping that @imagemagick.org will be included in the third session!

Got another macOS build issue with my project on @github.com. Looks like I will need to play around with my runner codespace again today so I can try fixing it in a shell on the macOS agent. I don't need the project that often but when I do I am happy that I created it.

Published Magick.NET 14.7.0 for .NET Standard 2.0 and .NET 8.0: github.com/dlemstra/Mag.... The NuGet packages can be found here: nuget.org/packages?q=M....

My @microsoft.com MVP award got renewed for another year! 🎉🥂🎉🥂

Today is not the first time my brain read 6:30PM as 16:30. I knew it was in the afternoon so my brain just assumed it should be interpreted as 16:30....

Seeing a tiny difference in double calculation with our #arm64 build of ImageMagick. Going to debug this with a @github.com actions #arm64 runner and a lot of printf statements 😉😁

Broke some code today because I thought I removed an unused constructor. But this was used by: ActivatorUtilities.CreateInstance<TRepo>(HttpContext.RequestServices) 😭😭😭😭😭😭😭😭😭😭

I never realized that I could use the Transitive packages list in @visualstudio.com to figure out which @nuget.org package brings in a certain dependency. Much easier than the scripts that I used to have to figure this out.

Always nice when I see a bug happening in the application logs and I am able to reproduce the issue with a failing unit test before making the fix.

If some of your builds are failing today it might be because you are using ubuntu:20.04 and that just ran out of standard support.

Look what happened! The @imagemagick.org project received a $50k donation from @zerodha.com: www.linkedin.com/posts/dirk-l...

Just got a message on LinkedIn with this text: Time investment from you : 30min, cost $0 English is not my native language but I am reading this as "your time is worthless".

That moment when you come back from diner and take another look at the problem that has been bothering you for hours and suddenly you know the solution....

I bough myself some more art. Thank you for helping me with this @github.com sponsors.

Bit odd that @github.com copilot needs my permission in @vscode.dev to fetch data from @microsoft.com #learn. Microsoft doesn't trust Microsoft?

I really hope this isn't really happening but it looks like something broke the search all files option in the @vscode.dev insiders edition. I had a hang in that window yesterday and today. I always use it to search through my code files instead of Visual Studio.

This happens when your city has a military airport and you are visiting a place that is close to the runway where the jets land. There were 6 of them landing and this is one of them.

Hi!! What’s up!! I’ve been laid off from GitHub, so if I don’t respond to your emails, it’s FINALLY not my fault 😘 sorry in advance. The past 5 years were an honor and a joy, because wow, OSS maintainers are a kind bunch. Grateful I got to run one last Maintainer Summit before leaving 💓

Looks like the @imagemagick.org releases page on @github.com is marked as malicious again: github.com/ImageMagick/... in Chrome. This also happened last week no clue who keeps reporting this false positive.

I am listing to this on twitch @isaacrlevin.com : www.twitch.tv/videos/24519.... When you talk I only hear you in my left ear.

Looks like I will be working in my @github.com codespace where I have a shell on the actions hosted runner to fix these build errors instead of doing this with with multiple commits where I try to figure out how to fix the errors.

I was ignoring some warnings during the MSYS2 build of the @imagemagick.org project. But I really should not have done that. It looks like an upgrade of something on the @github.com build agent changed this into an error that I suddenly need to fix.

Wow @github.com #copilot just complained that the @imagemagick code that I was changing was similar code compared to a project on @github.com that just copied our code. Last time it was complaining about our own code but I don't think this is better.

If you also missed it then make sure you read this new info about Trusted Signing: techcommunity.microsoft.com/blog/microso.... You can now only use it in US and Canada. So you should wait with recommending this to organizations that are located somewhere else. Hope this is changed back soon. 😢

I am a big fan of @github.com copilot but I am getting really close to disabling the code completion in @vscode.dev because it's blocking my work instead of helping. And yes I am on the preview versions of both so that might not help. I should probably open an issue about it.

I just got a new @github.com private sponsor and that person (or company?) created their account just so they could me sponsor me (and others?).