Andrew Nesbitt

The author also posted a follow up about forge-specific repository folders ("magic folders" I suppose): https://nesbitt.io/2026/02/22/forge-specific-repository-folders.html

I think he has a great list of answers in that post: https://nesbitt.io/2026/01/19/a-jepsen-test-for-package-managers.html

https://nesbitt.io - mostly writing about package management

Andrew is on a tear recently, see also https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html

I thought this was a good explainer on what In-toto is, when to use it, and how it's different from e.g. Sigstore: https://nesbitt.io/2026/05/24/signing-is-for-the-bad-days.html

Ah yes. It is clear that the root cause of this CVE last month is a lack of spend. Lessons learned: 2.1 trillion tokens is insufficient to detect obvious malware; increase token spend by 10x. https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html

IIRC Go had to deal with a bunch of issue related to their initial source based package management system. The URL imports remain, but I believe fetches are served through the pkg.go.dev proxy now. Andrew Nesbitt has a good write [0] up on why using Git as a database is a bad idea [0] https://nesbitt.io/2025/12/24/package-managers-keep-using-git-as-a-dat…

Because @apache/solr would be easier to disambiguate vs @randomuser/solr. You should really build namespaces in from the start, or at least reserve the capability to do so in the future. Unless you want to speed run all the lessons already learned. https://nesbitt.io/2026/02/14/package-management-namespaces.html

I like the formatting and readability of https://nesbitt.io/2026/05/28/protestware-for-coding-agents.html though I wish it loaded faster.

Relevant reading: https://nesbitt.io/2026/02/16/changelog.html > Removed: mathjs dependency. 14MB, 200+ functions. Twelve functions used. Added: Custom math utilities module (src/math-utils.js). Addition, subtraction, multiplication, division, a handful of trig functions. Co-authored-by: chatgpt. Changed: Bundle size reduced by 68%. Build time down from 12s to 4s. Module: 47 lines across 1 file. 0 tests. 0 dependencies.

Rust isn't the main reason it's fast. The main reason is willingness to break backwards compatibility. https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html

These satire articles on cybersecurity are really entertaining. The other one a few days ago was also good: https://nesbitt.io/2026/02/03/incident-report-cve-2024-yikes.html

So I've been thinking about this a lot since it happened. I've already added dependency cooldowns https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html to every part of our monorepo. The obvious next thought is "am I just dumping the responsibility onto the next person along"? But as you point out it just needs to give automated scanners enough time to pick up on obvious signs like the .pth file in this case.

This is true specifically for actions/checkout, but composite actions can have other actions as dependencies, and unless the composite action pins the versions of its dependencies, it is vulnerable for this attack. This article[0] gives a good overview of the challenges, and also has a link to a concrete attack where this was exploited. [0]: https://nesbitt.io/2025/12/06/github-actions-package-manager.html

Its a pretty well-supported claim. uv skips doing a number of things that generate file I/O. File I/O is far more costly than the difference in raw computation. pip can't drop those for compatibility reasons. https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html

UV also has the distinct advantage in dependency resolution that it didn't have to implement the backwards compatible stuff Pip does, I think Astral blogged on it. If I can find it, I'll edit the link in. edit wasn't Astral, but here's the blog post I was thinking of. https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html That said, your point is very much correct, if you watch or read the Jane Street tech talk Astral gave, you can see how they really leveraged Rust for performance like turning Python version identifiers into u64s.

All of them (well - no HPUX in 15+ years, and I've never used uv in Solaris, or AIX) - but the major two client side environments that I use 'uv' in would be WSL2+Ubuntu/ext4 (work) and macOS/APFS at home. But - neither the speed nor constant issues with pip/virtualenvwrappers are really a function of the OS/File System. A frequent theme in this thread (probably most clearly described in https://news.ycombinator.com/item?id=47444936) is that relying on your Python Environment to manager your Python Environment - always ends up in pain. Poetry had this issue as well. One of the key architectural decisions of Astral was to write the Python Environment Management tooling in rust - so that it could never footgun itself. It also benefited from very enlightened engineering decisions described here: https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html

I was using poetry pretty happily before uv came along. I’d probably go back. Note that uv is fast because — yes, Rust, but also because it doesn’t have to handle a lot of legacy that pip does[1], and some smart language independent design choices. If uv became unavailable, it’d suck but the world would move on. [1] https://nesbitt.io/2025/12/26/how-uv-got-so-fast.html

Andrew Nesbitt's gitgres is also adjacent. And a real git. https://github.com/andrew/gitgres There's a nice write up on "why" too. https://nesbitt.io/2026/02/26/git-in-postgres.html

For a deeper dive on git ignore files, see: https://nesbitt.io/2026/02/12/the-many-flavors-of-ignore-files.html

> You’re looking at the number of dependents. The React package has no dependencies. Indeed. My apologies for misinterpreting the link that I posted. Consider "devDependencies" here https://github.com/facebook/react/blob/main/package.json As far as I know, these 100+ dev dependencies are installed by default. Yes, you can probably avoid it, but it will likely break something during the build process, and most people just stick to the default anyway. > Reproducible builds, or don’t use those packages. A lot of things are not reproducible/hermetic builds. Even GitHub Actions is not reproducible https://nesbitt.io/2025/12/06/github-actions-package-manager.html Most frontend frameworks are not reproducible either. > don’t use those packages. And do what?

Maybe with this "investment" will get an actual solution for Github Actions sh*t version management of actions[1] after just closing the Immutable Actions issue with a "sucks to be you" comment[2]. AI-Native Github action Agentic package management for Copilot /s [1] https://nesbitt.io/2025/12/06/github-actions-package-manager.html [2] https://github.com/github/roadmap/issues/592

> Yeah, and ultimately no body cares. More like hiding their heads in the sand in circumstances that are outside of their ability to fix. None of the tooling or practices out there push you in the direction of not being at risk, or even provide you with easy ways to stay completely safe: no external packages needed to develop software with everything you NEED being provided out of the box, or a flow where pulling in a new package makes you review all of its source code line by line and compile everything instead of any binary tooling blobs, or built in vulnerability and configuration scanning so you don't get pwned by Trivy or don't leave an open S3 bucket somewhere, which also means that obviously you'd need thorough observability and alerting for any of the cloud stuff you do. And even when they exist, your org projects might be painfully out of date, too much to use those approaches, or the org culture might not be there, or any number of other issues I can't even imagine. On one hand, people are running out of date software and those have CVEs, on the other using dependencies that are too new also puts you at risks of compromised packages - it's like we're being squeezed by rocks on both sides in a landslide or something. Even at the OS level, the fact that everyone is not running something like Qubes OS or regular VMs for development is absolutely insane. The fact that all software isn't sandboxed and that desktop OSes don't prompt for permissions like mobile apps do…

Related post: https://nesbitt.io/2026/02/27/xkcd-2347.html

There are two solutions GitHub Actions people will tell you about. Both are fundamentally flawed because GitHub Actions Has a Package Manager, and It Might Be the Worst [1]. One thing people will say is to pin the commit SHA, so don't do "uses: randomAuthor/some-normal-action@v1", instead do "uses: randomAuthor/some-normal-action@e20fd1d81c3f403df57f5f06e2aa9653a6a60763". Alternatively, just fork the action into your own GitHub account and import that instead. However, neither of these "solutions" work, because they do not pin the transitive dependencies. Suppose I pin the action at a SHA or fork it, but that action still imports "tj-actions/changed-files". In that case, you would have still been pwned in the "tj-actions/changed-files" incident [2]. The only way to be sure is to manually traverse the dependency hierarchy, forking each action as you go down the "tree" and updating every action to only depend on code you control. In other package managers, this is solved with a lockfile - go.sum, yarn.lock, ... [1] https://nesbitt.io/2025/12/06/github-actions-package-manager.html [2] https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack…