1
How uv got so fast
uv’s speed comes from engineering decisions, not just Rust. Static metadata, dropping legacy formats, and standards that didn’t exist five years ago.
Andrew Nesbitt
Package management and open source metadata expert. Building Ecosyste.ms, open datasets and tools for critical open source infrastructure.
- Popular posts
- 12
- Total points
- 5,209
- HN comments
- 2,000
- Rank
- #201 personal
Visit nesbitt.io → RSS feedOn Hacker News Dec 2025 – Jul 2026
Infrastructure & DevOps 8Software Engineering 6Security & Privacy 3Tools & Productivity 2Open Source 2Career & Management 1
2
Package managers keep using Git as a database, it never works out
Git repositories seem like an elegant solution for package registry data. Pull requests for governance, version history for free, distributed by design. But as registries grow, the cracks appear.
3
Incident Report: CVE-2024-YIKES
A series of unfortunate events.
4
Incident CVE-2026-LGTM
A series of unfortunate agents.
5
GitHub Actions has a package manager, and it might be the worst
GitHub Actions has a package manager that ignores decades of supply chain security best practices: no lockfile, no integrity verification, no transitive pinning
6
GitHub Actions is the weakest link
Anne Robinson would like a word with .github/workflows
7
Sandwich Bill of Materials
SBOM 1.0: A specification for sandwich supply chain transparency.
8
Dumb ways for an open source project to die
How your dependencies became Bernies
9
Git's Magic Files
Magic files and where to find them: .gitignore, .gitattributes, .mailmap, .git-blame-ignore-revs, .lfsconfig, and more.
10
git's –end-of-options Flag
The git flag I assumed was an LLM hallucination
11
How to attract AI bots to your open source project
A practical guide to getting the engagement your project deserves.
12
Package management is a wicked problem
Why fixing package managers is harder than it looks.