Andrew Nesbitt
Andrew Nesbitt — Open source infrastructure builder, creator of Ecosyste.ms and Libraries.io
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
nesbitt.ioEven a perfect PR with a note saying 'no rush' creates a low-grade obligation the moment it appears.
One of the foremost voices on open source package management and software supply chains. Andrew writes with deep, hands-on knowledge — he built Libraries.io and Ecosyste.ms — and his posts often compare how different language ecosystems solve the same problems. A rare blog that makes dependency management genuinely interesting to read about.
Written by Andrew Nesbitt.
Very Active
Publishes multiple times per week
5
Independent Blog
English
How this blog's content is accessed through Blogs Are Back.
Full Content
RSS feed includes complete post content for reading in-app
Direct Access
Feed can be fetched directly from your browser
Direct Post Links
Post pages can be loaded directly in the reader
Embeddable
Posts can be displayed inline in the reader view
This blog appears in the following curated collections.
Recent posts from Andrew Nesbitt's RSS feed.
Package Management RFCs
Package registries, manifest formats, lockfiles, version ranges and identifiers all have written specifications of some kind, spread across six kinds of venue. Specifications show up in package management mostly as an invisible layer of the dependency tree, where an HTTP library is built against RFC 9110 and a JSON parser against ECMA-404, and the documents covering package management itself are spread just as thinly. I went looking for the IETF’s share, since wire protocols between independent...
This Week in Package Management: 3 October 2026
Week twenty of the roundup, built from the package manager OPML feed collection and whatever I’ve posted or boosted on Mastodon. Releases mise 2026.10.0 requires keyless cosign bundles to match a pinned signer identity and stops GitHub attestation workflow checks accepting partial matches. 2026.9.18 added an include key that lets mise.toml pull a shared config fragment from a git repository or OCI registry, limited to tools, env, vars, hooks and aliases, with paranoid mode requiring a full com...
Software Heritage Identifiers
I spent Monday at the Software Heritage offices in Paris speaking at the CodeCommons plenary, and the slides are on GitHub. The talk was about connecting package identities to archived source code. Getting ready for it meant a couple of weeks poking at the SWH archive and its identifier scheme with a to-do list that kept growing, and I’ve ended up with a small pile of tools that are now feeding into ecosyste.ms, starting with the research software service. Software Heritage Software Heritage h...
This Week in Package Management: 26 September 2026
Week nineteen of the roundup, built from the package manager OPML feed collection and whatever I’ve posted or boosted on Mastodon. Releases pnpm 12.6 adds an autoDedupe setting that resolves compatible dependency versions to a single one during install, and pnpm add --save-types for the matching @types/* package. 12.7 has the global node shim read .nvmrc and .node-version when devEngines.runtime is unset, and adds pnpm publish --publish-wait-timeout to block until a published package is availa...
Package Manager Sandboxing
Homebrew 7.0.0 shipped on September 13th with “stronger sandboxing” in the opening line of the release notes. Installation is being split into a fetch phase that has network access and writable caches, and an install phase that runs offline with read-only caches. Sandboxed builds are blocked from reading your home directory by default. Cask install hooks run confined, and a cask sandbox escape via LaunchServices was closed in the same release by denying app launching, Mach services, and Unix soc...
If you enjoy Andrew Nesbitt, you might also like these blogs.
Filippo Valsorda
words.filippo.ioGo security team member writing about cryptography and open source maintenance.
Seth Larson
sethmlarson.devPython security and open source infrastructure, plus retro gaming preservation and emulation.
the website of jyn
jyn.devTechnical blog on build systems, Rust, developer tools, and the human side of software engineering.
Lukáš Lalinský
lalinsky.comCreator of AcoustID and Picard, writing about music tech and Python.
Follow Andrew Nesbitt
If you care about how open source software actually gets distributed, maintained, and sustained, Andrew's perspective is essential reading.