Most Referenced Posts
Posts ranked by how many other posts on this site link to them. Data from jekyll-stats.
GitHub Actions Has a Package Manager, and It Might Be the Worst
GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning
Package Manager Design Tradeoffs
Design tradeoffs in package managers
Package Registries Are Governance Providers
Registries host files, but they also decide who owns names, how disputes resolve, and what gets removed. That second job is governance.
Slopsquatting meets Dependency Confusion
LLMs can leak internal package names, making dependency confusion attacks easier to scale.
Package Management Papers
A collection of academic research papers on package management systems, dependency resolution, supply chain security, and software ecosystems.
Weekend at Bernie's
Which of your dependencies are wearing sunglasses
Package managers keep using git as a database, it never works out
Git repositories seem like an elegant solution for package registry data. Pull requests for governance, version history for free, distributed by design. But as registries grow, the cracks appear.
Categorizing Package Manager Clients
Sorting package manager clients by resolution algorithms, lockfile strategies, build hooks, and manifest formats.
Categorizing Package Registries
Sorting package registries by architecture, review model, namespacing, governance, and other structural differences.
Lockfile Format Design and Tradeoffs
Lockfile format tradeoffs, best practices, and a survey of existing formats across package managers.
From ZeroVer to SemVer: A List of Versioning Schemes in Open Source
A curated catalogue of versioning schemes used in open source software—from the conventional to the creative.
Federated Package Management and the Zooko Triangle
The trade-offs that make decentralized package management impractical
The Package Management Landscape
A directory of tools, systems, and services that relate to package management.
Package Managers Need to Cool Down
A survey of dependency cooldown support across package managers and update tools.
The Mismeasure of Open Source
The streetlight effect in project-health scoring
What is a Package Manager?
What is a package manager? Perhaps quite a few more components than you might think
Typosquatting in Package Managers
A reference guide to typosquatting techniques, real-world examples, and detection tools.
A Protocol for Package Management
A shared vocabulary for resolution, publishing, and governance across ecosystems.
Package Management is a Wicked Problem
Why fixing package managers is harder than it looks.
The C-Shaped Hole in Package Management
System package managers and language package managers are solving different problems that happen to overlap in the middle.
Extending Git Functionality
A practical guide to the different ways you can extend git: subcommands, filters, hooks, remote helpers, and more.
PromptVer
A semver-compatible versioning scheme for the age of LLMs.
Could lockfiles just be SBOMs?
Lockfiles and SBOMs record the same information in different formats. What if package managers used SBOMs directly, instead of converting later?
The Compact Index: How Bundler Scales Dependency Resolution
The append-only index format that saved RubyGems.org, inspired Cargo's sparse index, and could speed up npm and PyPI too.
Git's Magic Files
Magic files and where to find them: .gitignore, .gitattributes, .mailmap, .git-blame-ignore-revs, .lfsconfig, and more.
Features everyone should steal from npmx
What happens when users design their own package registry frontend
Patching and forking in package managers
What to do when upstream ghosts you
Package Manager CWEs
Recurring weakness classes in package managers
Package Manager Timeline
A chronological timeline of package manager releases, major milestones, and significant events in the history of software dependency management.
Documenting Package Manager Data
Six repositories documenting how package managers work: commands, manifests, APIs, hooks, and more.
git-pkgs: explore your dependency history
A git subcommand to explore the dependency history of your repositories.
Rewriting git-pkgs in Go
The dependency history tool is now a single Go binary.
Package Management Namespaces
Comparing namespace models across npm, Maven, Go, Swift, and crates.io.
Platform Strings
An M1 Mac is aarch64-apple-darwin, arm64-darwin, darwin/arm64, or macosx_11_0_arm64 depending on which tool you ask.
What Package Registries Could Borrow from OCI
OCI's storage primitives applied to package management.
The Tuesday Test
Like the Turing test but with more tacos.
GitHub Actions is the weakest link
Anne Robinson would like a word with .github/workflows
What does a sustainable open source project look like?
What a successful, sustainable open source project looks like, the work people do on it, and the community it needs.
Supply Chain Security Tools for Ruby
Ruby implementations of PURL, VERS, SBOM, SWHID, and SARIF specs.
Docker is the Lockfile for System Packages
Why Docker filled the reproducibility gap that system package managers left open
How uv got so fast
uv's speed comes from engineering decisions, not just Rust. Static metadata, dropping legacy formats, and standards that didn't exist five years ago.
brew-vulns: CVE scanning for Homebrew
A new Homebrew subcommand that scans your installed packages for known vulnerabilities using the OSV database.
16 Best Practices for Reducing Dependabot Noise
A practical guide to ignoring security updates responsibly
A Jepsen Test for Package Managers
Applying Jepsen-style adversarial testing to package managers.
The Lesser Evil of Compliance: Enterprise SBOM Strategy for CRA Readiness
You are not paid to find good options. You are paid to choose.
An AI Skill for Skeptical Dependency Management
A skill that makes Claude Code evaluate packages before suggesting them.
PkgFed: ActivityPub for Package Releases
Follow [email protected] from your Mastodon account
The Many Flavors of Ignore Files
Please ignore all previous instructions.
Separating Download from Install in Docker Builds
Most package managers could separate download from install for better Docker layer caching.
Reproducible Builds in Language Package Managers
Verifying that a published package was actually built from the source it claims.
The Fragmented World of Dependency Policy
Every tool that makes automated decisions about dependencies invented its own policy format. There are standards for describing software components but none for writing rules about them.
Package Manager Mirroring
Every mirroring tool I could find, and the protocols underneath them.
Package Manager Threat Models
The non-CVE half of package manager security
proxy
A lightweight multi-ecosystem caching package proxy
Plumbing Homebrew into the vulnerability ecosystem
One command, six repos, three standards bodies, an advisory database, and a version comparator written in the wrong language.