A survey of dependency cooldown support across package managers and update tools.
Dependency cooldowns turn you into a free-rider
Against dependency cooldowns as a response to supply chain attacks
Dependency Cultures - Richard Feldman | SSW 2026
Code Galaxies Visualization
Code galaxies visualization allows you to explore huge graphs of software package managers (npm, go, ruby gems, composer, etc.)
What If npm Ran on AT Protocol?
A thought experiment about what a package registry would look like if built on atproto.
Drips | Fund Open Source In Your Ecosystem
Drips is the easiest way to fund Open Source in your ecosystem. Fund your dependencies with built-in dependency splitting, run RetroPGF rounds, and achieve any
backfill package - github.com/jcalabro/atmos/backfill - Go Packages
Package backfill provides a concurrent engine for downloading and processing all repositories from an ATProto relay or PDS.
atpkgs
Atpkgs is compatible with the NPM Registry API, so it works with most Node.js package managers.
Features everyone should steal from npmx
What happens when users design their own package registry frontend
Popular npm Packages in the keyv and Cacheable Namespaces Co...
Popular npm packages keyv and cacheable compromised.
Burnout in Open Source: A Structural Problem We Can Fix Together ✸ Software Stewardship Lab
Burnout is affecting the entire Open Source ecosystem. Here's what we could do to make things better.
'Almost every Apple device' vulnerable to CocoaPods
Dependency manager used in millions of apps leaves a bitter taste
singi-labs/barazo-workspace
pnpm workspace root for Barazo forum development — shared configuration, tooling, and cross-package dependency management
Just Fucking Use Go - Blain Smith
Hey, dipshit. You know what compiles in two seconds, deploys as a single binary, and doesn't shit itself when a transitive dependency gets yanked from npm at 3am? Go. The same way HTML has been sitting there since the dawn of the goddamn internet waiting for you to stop overcomplicating the frontend, Go has been sitting there for over a decade waiting for you to stop overcomplicating the backend.