It’s been a long time coming but the new turbo kit we’ve been developing for my BRZ is almost ready and it’s looking and sounding amazing. Heading to the Dyno on Wednesday to tune it and see how much power it can make.

This Week in Package Management: 13 June 2026 nesbitt.io/2026/06/13/t...

Joint Guidance on Vulnerability Naming and Disclosure: nesbitt.io/2026/06/12/j...

What Happened to tea.xyz nesbitt.io/2026/06/11/w...

Forms of Open Source Government nesbitt.io/2026/06/09/f...

I had never really thought about it before, but it turns out that there are a number of package manager related patents: nesbitt.io/2026/06/08/p...

Happy to see OSS maintainer burnout in the public discourse—good job Matthew! 'Heath believes governments should invest more in open source' - that she does 😘

This Week in Package Management: 6 June 2026 nesbitt.io/2026/06/06/t...

This Week in Package Management: 6 June 2026 nesbitt.io/2026/06/06/t...

I've been working on a jekyll plugin to make it easier to implement @standard.site: github.com/andrew/jekyl...

A survey of install-script allowlist mechanisms across package managers and language ecosystems: nesbitt.io/2026/06/05/i...

gittuf - a signed log for git refs nesbitt.io/2026/06/04/g...

Skills Registry Threat Models nesbitt.io/2026/06/03/s...

The Infosec Phrasebook nesbitt.io/2026/06/01/t...

Current status

This Week in Package Management: 30 May 2026 nesbitt.io/2026/05/30/t...

Hacktoberfest only runs for a month, which seems like an arbitrary limitation given that the agents opening the pull requests don't ever sleep. Fixed that. nesbitt.io/clawtoberfest/

Composer's dependency policies nesbitt.io/2026/05/29/c...

REOPEN THE REPOS! > Keep open by default. Making everything private adds additional delivery and policy costs, and can reduce reuse and scrutiny. Openness should remain the default posture, with closure used sparingly and deliberately. www.gov.uk/guidance/ai-...

Protestware for coding agents nesbitt.io/2026/05/28/p...

Package managers that package package managers: nesbitt.io/2026/05/28/p...

forget about npmx, this is the future of package browsing

A new way to explore your node modules folder: nesbitt.io/heap

A new way to explore your node modules folder: nesbitt.io/heap

CHAOSS Metrics in 2026 nesbitt.io/2026/05/27/c...

GitHub Actions security in Python packages - a written version of the talk I gave at @pycon.us last week. nesbitt.io/2026/05/25/g...

Signing is for the bad days nesbitt.io/2026/05/24/s...

the replacements.fyi site now lets you drop a package.json into it to see which dependencies can be replaced with native functionality, or more performant choices 🎉

Updated my dependency cooldown post with all the ongoing work to enable cooldown features in various ecosystems: nesbitt.io/2026/03/04/p...

This Week in Package Management: 23 May 2026 nesbitt.io/2026/05/23/t...

A new report from Bloomberg explains why companies should move “from passive consumption to active stewardship” of the Open Source packages they rely on: “you cannot have sustainable code without sustaining the humans who write it (…) if you live in the house, you help fix the roof”.

Silently ignoring unrecognized configuration options is a security risk and should be treated as such. nx.dev/blog/nx-cons...

RFC: Artificial Contributors to Open Source nesbitt.io/2026/05/21/r...

I'm pretty surprised there haven't been many major compromises of VS Code extensions (that I know of). It seems like a case where compromise would be pretty severe, fast to impact users, hard to detect/audit/prevent at an org level, and which doesn't have enough protections in place.

OSS burnout claims another project. On 2 Apr, an entitled user angrily asked the burned-out maintainer of nvim-treesitter to “go switch to something that doesn't require interacting with people”. The maintainer replied “OK” — and archived the repo, stopping development of nvim-treesitter.

Dumb Ways for an Open Source Project to Die: nesbitt.io/2026/05/19/d...

Just published my notes from this year's Python Packaging Summit at PyCon US. If you've ever been curious what one of these is like from the inside: Wheel 2.0 + Zstandard, PyPI abuse vectors, conda vs pip, nab as a pip-resolver candidate. 🐍📦 bernat.tech/posts/pycon-... #PyConUS

reading " I find the recurring surprise harder to justify than the incidents themselves" and nodding vigorously it's me the 'release candidates' and 'release channels' appreciator

Language Registries Are Unstable by Default: nesbitt.io/2026/05/15/l...

We're hosting a forum on AI, FLOSS, and Sustainability. If you're interested in exploring how AI is impacting FLOSS software and all those who work on it: join us for the next SustainOSS Virtual Forum on Thursday 11 June 2026. sustainoss.org/events/ai-fl...

Just opened an npm RFC to make dependency install scripts opt-in by default. The thing about install scripts: they run the moment a package lands in your dep tree. No require, no review. That's why Shai-Hulud, chalk/debug, and Axios all used them. github.com/npm/rfcs/pul...

Open source maintainers at profitable companies: stop asking permission to fix what your employer already depends on. No paperwork. No programme. No manager’s blessing. Just maintain it on the clock.

Andrew has been building tools to understand the Open Source ecosystem for over a decade, and a new independent paper confirms the effectiveness of his approach to supporting maintainers. I want to celebrate his work today! 🎉

Showing our work: nesbitt.io/2026/05/13/s...

💡 Security Track Spotlight: In his talk “GitHub Actions Security in Python Packages” at #PyConUS 2026 @andrewnez.bsky.social shares findings from scanning thousands of workflows and practical ways to harden Python package releases. #security us.pycon.org/2026/schedul...

This talk from @andrewnez.bsky.social grows more and more important as the days go on... it's a must watch! #Python #PyPI #PyConUS #PyConUS2026 #security

@patak.cat Here's an up-to-date chart! And there's more info here: discover.opencollective.com/opensource We need to get these numbers up 💪

Not a Security Issue: nesbitt.io/2026/05/12/n...