Gonçalo Valério3d ago

"Lock the Ghost: In the software world, “remove” is not equal to "gone.""

https://www.cert.at/en/blog/2026/3/lock-the-ghost

#pypi #dependencies #supplychain #lockfiles #python

CERT.at - Lock the Ghost

In the software world, “remove” is not equal to "gone." This is crystal clear. There is always a good reason for that. Let’s take a short trip through how Python Package Index handles removals and how we can lock the ghost in an uv.lock file – forever!

|7eter l-|. l3oling 🧰Feb 18

🐠 ANN: appraisal2 v3.0.6 - support frozen appraisal lockfiles

 Appraise your gems and apps like never before. Now with support for frozen lockfiles, and inherent bundler version switching at runtime!  

#Ruby #Rails #Appraisals #Lockfiles
https://dev.to/galtzo/ann-appraisal2-v306-support-frozen-appraisal-lockfiles-20ml

🐠 ANN: appraisal2 v3.0.6 - support frozen appraisal lockfiles

An issue was reported by Richard Kramer, and made me aware of a use case that I had never personally...

DEV Community
Show threadAndrii Mishkovskyi 🇺🇦Feb 11
It's otherwise a fine article, I should not be so up in arms about a small timeline issue https://nesbitt.io/2026/02/10/lockfiles-killed-vendoring.html #packaging #vendoring #lockfiles
Lockfiles Killed Vendoring

Why almost nobody vendors their dependencies anymore.

Andrew Nesbitt
N-gated Hacker NewsDec 24
Andrew Nesbitt takes us on a thrilling journey through the dazzling world of #lockfiles, asking the earth-shattering question: could they be SBOMs? 🚀✨ Spoiler alert: the answer is yes, but in formats as unique as snowflakes. ❄️ Meanwhile, the rest of the world waits with bated breath for the EU to dictate our digital lives! 🇪🇺🔒
https://nesbitt.io/2025/12/23/could-lockfiles-just-be-sboms.html #SBOMs #digitaltransformation #EUregulations #cybersecurity #HackerNews #ngated
Could lockfiles just be SBOMs?

Lockfiles and SBOMs record the same information in different formats. What if package managers used SBOMs directly, instead of converting later?

Andrew Nesbitt
Hacker NewsDec 24

Could lockfiles just be SBOMs?

https://nesbitt.io/2025/12/23/could-lockfiles-just-be-sboms.html

#HackerNews #lockfiles #SBOMs #softwaredevelopment #cybersecurity #open_source

Could lockfiles just be SBOMs?

Lockfiles and SBOMs record the same information in different formats. What if package managers used SBOMs directly, instead of converting later?

Andrew Nesbitt
N-gated Hacker NewsDec 20
Oh boy, another tool to generate and verify #lockfiles for GitHub Actions, because we all know life's too short to trust those pesky mutable tags. 🔒✨ Let's spend our precious time pinning every single action to exact commit SHAs, because who doesn't love a good game of dependency whack-a-mole? 🎯🛠️
https://gh-actions-lockfile.net #GitHubActions #dependencyManagement #automation #tools #HackerNews #ngated
gh-actions-lockfile

Generate and verify lockfiles for GitHub Actions dependencies. Pin all actions to exact commit SHAs with integrity hashes.

N-gated Hacker NewsOct 12
🎉 Four years to write a lock file spec? Surely a riveting saga of #procrastination, misunderstandings, and the inevitable battle with the "Trivial Task That Could've Been Done Yesterday" monster. 🐢🔒 Python: where nothing is ever done quickly or without #drama. 🐍✨
https://snarky.ca/why-it-took-4-years-to-get-a-lock-files-specification/ #lockfiles #Python #softwaredevelopment #techhumor #HackerNews #ngated
Why it took 4 years to get a lock files specification

(This is the blog post version of my keynote from EuroPython 2025 in Prague, Czechia.) We now have a lock file format specification. That might not sound like a big deal, but for me it took 4 years of active work to get us that specification. Part education, part therapy,

Tall, Snarky Canadian
Hacker NewsOct 12

Why it took 4 years to get a lock files specification

https://snarky.ca/why-it-took-4-years-to-get-a-lock-files-specification/

#HackerNews #lockfiles #specification #development #technology #software #engineering #programming

Why it took 4 years to get a lock files specification

(This is the blog post version of my keynote from EuroPython 2025 in Prague, Czechia.) We now have a lock file format specification. That might not sound like a big deal, but for me it took 4 years of active work to get us that specification. Part education, part therapy,

Tall, Snarky Canadian
Hugo van KemenadeJul 25, 2024

🐍🔐 Python lockfiles are back!

Read @brettcannon's new PEP 751 – "A file format to list Python dependencies for installation reproducibility":

https://peps.python.org/pep-0751/

Discuss it:

https://discuss.python.org/t/pep-751-lock-files-again/59173

#Python #lockfiles #PEP751

PEP 751 – A file format to record Python dependencies for installation reproducibility | peps.python.org

This PEP proposes a new file format for specifying dependencies to enable reproducible installation in a Python environment. The format is designed to be human-readable and machine-generated. Installers consuming the file should be able to calculate wha...

Python Enhancement Proposals (PEPs)
Luis FerreiraMay 13, 2024
If you don't know or perhaps kinda think you know how to use lockfiles, read this please lsferreira.net/posts/lockfile-…
The controversy and misconception around package managers lockfile in libraries

This post describes the common misconception and controversy around package managers philosophy about the abomination of lockfiles in packages, more specifically in libraries.

luis space