dependency-management

In the latest uv release, you can now install directly from a uv lockfile without needing a pyproject.toml, enabling better Docker/CI layer caching since dependency layers are no longer invalidated by pyproject.toml changes.

Introduces Toolpak, a tool designed to address developer tooling and dependency management gaps in image-based operating systems, comparing it with existing approaches like Flatpak and Toolbox.

DSPy 3.4 release candidate is announced, moving off litellm to improve import speed and reduce dependencies.

The article argues that long-running development agents should be event-driven to detect useful changes from unexpected sources via broadcasts like EigenFlux, rather than polling repositories daily, and stresses verifying sources before acting.

GitHub's Dependabot now implements a three-day cooldown for non-security version updates to give security scanners time to detect poisoned releases, helping mitigate supply chain attacks.

Bumply is a tool that allows developers to update their software dependencies and revert changes if needed.

sqlite-utils 4.2.1 fixes a crashing bug caused by an unlisted typing-extensions dependency, and adds a smoke test to verify CLI works without dev dependencies.

A blog post presenting a vision for improving Cargo, covering workflows like dependency management, build performance, adaptability, and maintenance, and inviting community input.

A blog post demonstrating a Nix pattern that makes package overrides warn when they become obsolete, based on conditional version or metadata checks during evaluation.

Google Devs announces a new developer challenge focused on a tricky dependency version conflict scenario involving three packages sharing one dependency.

Richard Feldman compares dependency graphs of different programming language websites and games, pointing out that most dependency choices are cultural norms rather than technical necessities.

GitHub's Dependabot now defaults to a three-day cooldown before opening version update pull requests, requiring no configuration.

This article explores how different package management strategies and tools reflect organizational communication structures, illustrating Conway's Law through monorepos, workspaces, Bazel, Nix, Docker, and more.

The author argues that fetching dependencies directly from VCS (as done in Go) is more secure and easier to audit than using package registries with a publish step (as in Ruby, npm, PyPI).

Collider 1.3.0 adds path traversal protection for repository indices and strips bearer tokens on cross-origin redirects to prevent security vulnerabilities.

Cross Repo Review is a tool that maps inter-repo dependencies and surfaces downstream impacts, breaking changes, and blast radius on PRs, tracking code, service, data, and pipeline dependencies.

Google Devs presents a CI pipeline challenge where a dependency change made the build faster but broke production, prompting a debugging puzzle.

A blog post advocating for package managers to support global hooks as a more secure and flexible alternative to current package security measures like registries or shell wrappers.

ty-pre-commit is a new tool that simplifies pre-commit hooks for type checkers by automatically installing dependencies using uv.

Bundler 4.0.13 introduces a cooldown feature that blocks resolution to gems published less than N days ago, mitigating supply-chain attacks. It is opt-in and configurable per source, setting, or command-line flag.