Andrew Nesbitt

@andrewnez@mastodon.social · Joined ⁨Apr⁩ ⁨2017⁩

Package Management Nerd, working on mapping the world of open source software ecosyste.ms and blogging about package managers at nesbitt.io

GitHub
github.com/andrew verified
Twitter
twitter.com/teabass
Homepage
nesbitt.io verified
bsky
bsky.app/profile/andrewnez.bsk
3083Posts
0Following1Followers

Andrew Nesbitt boosted

yossarian@yossarian@infosec.exchange

Replying to @⁨yossarian@infosec.exchange⁩

(this officially loosens zizmor's "GHA only" policy. if there are other platforms you care about, help me understand them better here: github.com/orgs/zizmorcore/dis)

github.com/orgs/zizmorcore/discussions/2253
Starting with 1.29.0, I've decided to relax zizmor's unofficial "GitHub Actions" only support policy by adding support for auditing pre-commit hooks and configurations. In a sense this opens the fl...GitHubWhat platforms would you like zizmor to support? · zizmorcore · Discussion #2253Starting with 1.29.0, I've decided to relax zizmor's unofficial "GitHub Actions" only support policy by adding support for auditing pre-commit hooks and configurations. In a sense this opens the fl...

Andrew Nesbitt boosted

yossarian@yossarian@infosec.exchange

zizmor 1.29.0 is released!

this release comes with a number of enhancements and bug fixes, but the big one is that we now support auditing pre-commit inputs! support is limited to just a single audit for now, but will expand over subsequent releases.

full notes: docs.zizmor.sh/release-notes/#

docs.zizmor.sh/release-notes/#1290
docs.zizmor.shRelease Notes - zizmorAbbreviated change notes about each zizmor release.

Andrew Nesbitt boosted

Seth Larson@sethmlarson@mastodon.social

Let’s Play “htmx 4: the game” 🐴

#htmx 4 was published exclusively for the Game Boy and Game Boy Color platforms. I recorded my play-through including the source code. This game is tough!

sethmlarson.dev/htmx-4-the-game

#web #gameboy #gbdev #retrogaming

sethmlarson.dev/htmx-4-the-game
sethmlarson.devLet’s Play “htmx 4: the game”Moments ago I just finished playing “htmx 4: the game”, the first JavaScript library published exclusively for Game Boy and Game Boy Color. I've recorded my play session and published the video to ...by Seth Michael Larson

Andrew Nesbitt boosted

Unofficial GitHub Changelog@githubchangelog@mastodon.social

Reference same-repository actions with self-repository syntax github.blog/changelog/2026-07-
#github

github.blog/changelog/2026-07-30-reference-same-repository-actions-with-self-repository-syntax
The GitHub BlogReference same-repository actions with self-repository syntax - GitHub ChangelogYou can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your…

Andrew Nesbitt boosted

Josh Bressers@joshbressers@infosec.exchange

I wrote a blog post

You don't have a supply chain, you have a supply soup

This is something I want to spend some time investigating in the future, it's all vastly more complicated and weird than we think it is

opensourcesecurity.io/2026/07-

opensourcesecurity.io/2026/07-supply-soup/
Open Source SecurityBlog - You don't have a supply chain, you have supply soup2026 has been a wild year. There are more vulnerabilities than anyone can count. We seem to keep talking about the number itself instead of things like how we got here or what we’re going to do about it, which is neat. The number of attacks against open source is basically an uncountable mess. Also very neat. And the cherry on top of this poop sundae is number of companies that have promised us they are going to “fix” open source, and when they use the word fix they really mean sell you a solution for a problem they mostly made up. Very cool, very cool.
Andrew Nesbitt@andrewnez@mastodon.social

Working on a license scanner for git-pkgs, uses the scancode license rule corpus but much, much faster and less resource intensive: github.com/git-pkgs/licenses

My plan is to eventually use it to scan every version of every package with it soon.

Fast exact license matching against ScanCode's rule corpus in pure Go. - git-pkgs/licensesGitHubGitHub - git-pkgs/licenses: Fast exact license matching against ScanCode's rule corpus in pure Go.Fast exact license matching against ScanCode's rule corpus in pure Go. - git-pkgs/licenses

Andrew Nesbitt boosted

Thomas Depierre@Di4na@hachyderm.io

When people wonder why I wrote softwaremaxims.com/blog/open-s and why I am angry...

I just received the OpenSource Summit schedule from a LF newsletter.

And it is fascinating how much it can be all stuff from Alpha Centauri that have nothing to do with the realities of FOSS.

Like, I know for who it is. I get it. But also, why do you happily pay to be misinformed if you are in a decision making position?

I mean, I know why. I get it. But still, this is such a waste of money and time that is precious for everyone.

Musings about softwareYou Are All On The Hobbyists Maintainers’ Turf NowFor quite some time, I have felt some unease at the public discourse around OpenSource. In the past few years, we have seen a growing discourse around the sustainability and security of the large body of OpenSource software.

Andrew Nesbitt boosted

Unofficial GitHub Changelog@githubchangelog@mastodon.social

npm publish-time malware scanning and dual-use metadata github.blog/changelog/2026-07-
#github

github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata
The GitHub Blognpm publish-time malware scanning and dual-use metadata - GitHub ChangelogAs part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…

Andrew Nesbitt boosted

Hugo van Kemenade@hugovk@mastodon.social

Lots of new stuff in pip 26.2:

🍊 Support for Python 3.15
🍊 Selecting only dependencies
🍊 Experimental: venv based build isolation
🍊 Faster repeated resolves by caching index simple responses
🍊 No more progress bar spam in CI
🍊 Deprecation to remove the legacy dependency resolver (--use-deprecated=legacy-resolver)

See @ichard26's post for more!

sichard.ca/blog/2026/07/whats-
#Python #pip

sichard.ca/blog/2026/07/whats-new-in-pip-26.2/
sichard.caWhat's new in pip 26.2 - only-deps and venv isolation! pip 26.2 adds support for installing dependencies exclusively (--only-deps), hashed and non-hashed requirements together (--no-require-hashes), experimental venv-based build isolation, faster repeated dependency resolves, and Python 3.15. Also included are a smattering of bugfixes.

Andrew Nesbitt boosted

Matthew Vernon@demoographics@wikis.world

Can you help me out with some citations? I'd love reliable articles that support or refute these #AI statements:
0) AI-generated code's harder to review (because it looks plausible but you can't try and work on a "the author meant [thing]" basis)
1) People are less good at reviewing AI-generated code (because they're inclined to trust what the computer says)
2) AI-generated code has high environmental costs (e.g. figures about DC capacity?)
3) Using AI is cognitively harmful

Boosts very welcome

Andrew Nesbitt boosted

Unofficial GitHub Changelog@githubchangelog@mastodon.social

GitHub Actions holds potentially malicious workflows for approval github.blog/changelog/2026-07-
#github

github.blog/changelog/2026-07-28-github-actions-holds-unproven-workflows-for-approval
The GitHub BlogGitHub Actions holds potentially malicious workflows for approval - GitHub ChangelogRecent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these…

Andrew Nesbitt boosted

James Smith 💾@Floppy@mastodon.me.uk

RE: mastodon.me.uk/@Floppy/1169400

This is actually happening; we're building a community to execute a bigotry-free #Rails fork (29 people and increasing at time of writing). Come join us, we need your help and expertise.

matrix.to/#/#amiko:matrix.org

James Smith 💾@Floppy@mastodon.me.uk

I am ashamed of the fact that I’m stuck on #Rails because of the sunk costs of what I’ve already built, as are *so many* other project like Mastodon.

We cannot “just move”, the cost is enormous.

The Rails core team seem utterly compromised and under his spell. Nobody will speak out.

We need a hard #RailsFork. Now. And we need to coordinate to do it together and build a team.

I’m in. Who else?