Paraphrasing an email from a security company : We copied one of your blog posts and turned into an advert for one of our products. Please add a link to our blog post to the end of yours. 🥉
Andrew Nesbitt
Package Management Nerd, working on mapping the world of open source software https://ecosyste.ms and blogging about package managers at https://nesbitt.io
- GitHub
- https://github.com/andrew verified
- https://twitter.com/teabass
- Homepage
- https://nesbitt.io verified
This Week in Package Management: 1 August 2026
https://nesbitt.io/2026/08/01/this-week-in-package-management.html
Andrew NesbittThis Week in Package Management: 1 August 2026Releases, advisories, and articles from across the package management worldPicked up a little project to keep me away from the computer this summer.
The AI Phrasebook
https://nesbitt.io/2026/07/31/the-ai-phrasebook.html
nesbitt.io/2026/07/31/the-ai-phrasebook.html
Andrew NesbittThe AI PhrasebookWe have autonomous agents at home.Working on a license scanner for git-pkgs, uses the scancode license rule corpus but much, much faster and less resource intensive: https://github.com/git-pkgs/licenses
My plan is to eventually use it to scan every version of every package with it soon.
GitHubGitHub - git-pkgs/licenses: Fast exact license matching against ScanCode's rule corpus in pure Go.Fast exact license matching against ScanCode's rule corpus in pure Go. - git-pkgs/licensesWheels, Bottles and Images
Andrew NesbittWheels, Bottles and ImagesAny sufficiently advanced package manager is indistinguishable from a container registry.Why npm Dependency Trees Are So Big
https://nesbitt.io/2026/07/28/why-npm-dependency-trees-are-so-big.html
Andrew NesbittWhy npm Dependency Trees Are So BigTwo versions of lodash walk into a treeAnyone else get the fear when they get a dependabot update for anything called xz? https://github.com/git-pkgs/archives/pull/18
GitHubBump github.com/ulikunitz/xz from 0.5.15 to 0.5.16 by dependabot[bot] · Pull Request #18 · git-pkgs/archivesBumps github.com/ulikunitz/xz from 0.5.15 to 0.5.16.
Commits
024f909 isterminal_fallback.go: ensure +build and go:build lines are consistent
ba40d80 Prepare release v0.5.16
82b346c internal/term:...This Week in Package Management: 25 July 2026
https://nesbitt.io/2026/07/25/this-week-in-package-management.html
Andrew NesbittThis Week in Package Management: 25 July 2026Releases, advisories, and articles from across the package management worldRE: https://mastodon.social/@andrewnez/116974498919761167
This one really touched a nerve, I’ve had a number of emails from real maintainers today sharing their stories that end up being way too similar 🥲
Andrew Nesbitt@andrewnez@mastodon.socialInterview with a Maintainer
https://nesbitt.io/2026/07/24/interview-with-a-maintainer.html
Seems that Google AI Overviews still doesn't quite understand satire.
ALT
I could not write this homebrew thread as a satire piece if i wanted to, real life is much more cursed: https://github.com/Homebrew/homebrew-core/issues/289444#issuecomment-5050717674
GitHubGemini-cli improperly deprecated · Issue #289444 · Homebrew/homebrew-corebrew config AND brew doctor output OR brew gist-logs <formula> link ○ → brew config bHOMEBREW_VERSION: 6.0.3 rORIGIN: https://github.com/Homebrew/brew HEAD: 5c38c6b3fc42281af432cda526dd0509172f681b...This is like the mother of all escape hatches: https://github.com/dtolnay/semver-trick
GitHubGitHub - dtolnay/semver-trick: How to avoid complicated coordinated upgradesHow to avoid complicated coordinated upgrades. Contribute to dtolnay/semver-trick development by creating an account on GitHub.Interview with a Maintainer
https://nesbitt.io/2026/07/24/interview-with-a-maintainer.html
Andrew NesbittInterview with a MaintainerEpisode 214 of Green Squares.The packages.ecosyste.ms database migration is complete, but now have 1.2M jobs in the queue to chew through 😅
Fun satire blog post coming tomorrow, and by fun I mean way to close to the bone that it could almost be true 😬
Replying to @andrewnez@mastodon.social
Looking at both totals:
GHS: $100M in 7 years (~$14M/yr). OSC: $42M in 9 years (~$4.7M/yr)
~$20M/yr combined = payroll of one mid-size software company, for the whole ecosystem
$100M across 70k maintainers = ~$1,400 each, lifetime
Corporate share: ~$5-6M/yr, from every company in the world combined
Replying to @andrewnez@mastodon.social
Similar looking data for Open Source Collective:
- $41.9M in total contributions to OSS collectives
- 1.8% ($763k) flows collective-to-collective at all
- 0.17% ($69,647) is in an actual loop
- The loops are dependency funding: eslint/jest/vite/webdriverio/verdaccio/11ty, parcel/rspack/swc
So on both platforms, 98%+ of open source funding is net new money in, not recirculation
Ever wondered how much circular funding there is within GitHub Sponsors?
Active Mutual Pairs: 155
Total Mutual Pairs: 845
Accounts Sponsoring Each Other: 255
Sponsorship Triangles: 42
Sponsorship Clusters: 26
Largest Cluster: 27 accounts
You can replace "LLM" with "JavaScript" in https://blog.codeberg.org/protecting-our-floss-commons-from-llms.html and it all still makes perfect sense.