Package Managers Need to Cool Down

Dependency cooldowns turn you into a free-rider

Against dependency cooldowns as a response to supply chain attacks

Homebrew

The Package Manager for Everywhere.

A GitHub for maintainers

Giving dependencies the same treatment the fork got

research!rsc: Our Software Dependency Problem

For decades, discussion of software reuse was far more common than actual software reuse. Today, the situation is reversed: developers reuse software written by others every day, in the form of software dependencies, and the situation goes mostly unexamined.

Code Galaxies Visualization

Code galaxies visualization allows you to explore huge graphs of software package managers (npm, go, ruby gems, composer, etc.)

Yarn

Fast, reliable, and secure dependency management.

Yarn: A new package manager for JavaScript

Visit the post for more.

What If npm Ran on AT Protocol?

A thought experiment about what a package registry would look like if built on atproto.

ATPM

Distributed package management powered by AT Protocol.

Drips | Fund Open Source In Your Ecosystem

Drips is the easiest way to fund Open Source in your ecosystem. Fund your dependencies with built-in dependency splitting, run RetroPGF rounds, and achieve any

Depot | Software Delivery built for machine scale

Depot provides fast source control, builds, CI runners, sandboxes, caches, and registries to ship reliable software at machine scale.

Patchwork

Studying version control in a malleable software context.

backfill package - github.com/jcalabro/atmos/backfill - Go Packages

Package backfill provides a concurrent engine for downloading and processing all repositories from an ATProto relay or PDS.

atpkgs

Atpkgs is compatible with the NPM Registry API, so it works with most Node.js package managers.

Features everyone should steal from npmx

What happens when users design their own package registry frontend