15 chart-topping hits about unpaid maintainers and overconfident AI agents.

Releases, advisories, and articles from across the package management world

Releases, advisories, and articles from across the package management world

Add git pkgs vulns scan --fail-on high to fail CI for high or critical findings. The command writes the complete text, JSON, or SARIF report before exiting 1. --severity filters the report independ...

Changelog 5f53947 Add and align CI security and dependency automation 8e75365 Apply gopls modernize fixes (#192) 73f926f Bump github.com/git-pkgs/archives from 0.7.0 to 0.7.1 (#191) e635e97 Bump g...

Changelog c1f420a Add and align CI security and dependency automation 73a9863 Assert omitted Helm releases are not downloadable 8d3dacf Bump azure/setup-helm from 4.3.1 to 5.0.1 (#332) f0580d9 Bum...

Notes from CodeCommons: SWHIDs, the SWH archive, and connecting both to package metadata.

Releases, advisories, and articles from across the package management world

A survey of sandbox usage across package manager clients.

Path traversal via a manifest field appeared in eight of ten package managers audited and thirty-three times in four months of everyone else’s advisories.

Miranda is on a connect mission for ViteConf 2026. Create your own credential.

Sometimes, it's more important to be good than it is to be nice.

Releases, advisories, and articles from across the package management world

Empowering everyone to build reliable and efficient software.

Rise & Grind goes live to the software supply chain.

export PYTHONSAFEPATH=1

Today, I’m proud to announce Homebrew 7.0.0. The most significant changes since 6.0.0 are faster installations and upgrades, stronger sandboxing, a native macOS app, built-in vulnerability checks and an advisory database, the end of macOS 10.15 support and Intel Macs moving to Tier 3.

266,249,669,118

Releases, advisories, and articles from across the package management world

min-release-age, minimum-release-age, -Zmin-publish-age, cooldown.

Small Go modules for people who build package-manager tooling.

Scan Git history for detected SPDX license changes - git-pkgs/git-spdx

Josh chats with Jaya Baloo from AISLE about their vulnerability scanner. If you follow open source vulnerabilities AISLE is a name you’ve seen popping up recently. They have a vulnerability scanner th...

Releases, advisories, and articles from across the package management world

Every second, open source shapes our software, yet our view of this ecosystem is surprisingly opaque. How much can you really trust OSS data?

Every second, open source shapes our software, yet our view of this ecosystem is surprisingly opaque. How much can you really trust OSS data?

Thinking through how the conventional OSS security embargoes no longer buy us time, and what open source maintainers might do instead to respond

.gitmodules is a manifest and the gitlink is a lockfile entry.

Episode Links Erik’s LinkedIn Sovereign Tech Agency Meet the First Sovereign Tech Standards Cohort Incident Report: unsanctioned agent behaviour during cyber testing STA on Mastodon This episode is al...

Releases, advisories, and articles from across the package management world

A rare opportunity to make a real impact in a fast-paced, high-visibility role.

A rare opportunity to make a real impact in a fast-paced, high-visibility role.

According to strict SemVer, protobuf’s latest Bazel release is from 2022.

export PIP_BREAK_SYSTEM_PACKAGES=1

Releases, advisories, and articles from across the package management world

Something you have, something you know, and someone else's OAuth.