Skills Registry Threat Models
https://nesbitt.io/2026/06/03/skills-registry-threat-models.html
| GitHub | https://github.com/andrew |
| https://twitter.com/teabass | |
| Homepage | https://nesbitt.io |
| bsky | https://bsky.app/profile/andrewnez.bsky.social |
Andrew Nesbitt
@andrewnez
- 1.7K Followers
- 726 Following
- 2.7K Posts
Package Management Nerd, working on mapping the world of open source software https://ecosyste.ms and blogging about package managers at https://nesbitt.io
Skills Registry Threat Models
https://nesbitt.io/2026/06/03/skills-registry-threat-models.html
Bernát Gábor🌳 pipdeptree 3.0 is out. New: render a dependency tree straight from PyPI (needs index extra) or a PEP 751 lockfile without installing anything, render it in a Jupyter notebook, and see extras by default. Try it 👉 https://pipdeptree.readthedocs.io/en/latest/tutorial/getting-started.html#render-a-lock-file
Can you guess what I've been investigating again 😓
Seth Larson@andrewnez pkg:markdown/SKILL.md?content=data:base64;deadbeef...
How long until we see a CVE filed against a markdown file?
Magyk@andrewnez
Chore: bump version
Chore: bump version
I love it when the first line of a changelog entry is "Updated changelog"
mudge“Bundler 4.0.13 introduces cooldown, a time-based filter that refuses to resolve to a version until it has been public for at least N days. Releases too new to have been scrutinized are passed over in favor of ones that have aged past the window.” — https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html
Dr. Dawn FosterSo much of the critical infrastructure that we rely on contains open source projects that are under-resourced and struggling. One (of many) ways to help these projects is by funding development and maintenance so that contributors can focus on this work, but times are tough. OSPOs are feeling the pinch, and it can be hard to justify continuing to fund open source projects. Measuring the impact of funding open source isn’t easy, and there is no one approach, so I just wrote this blog post to help you get started.
https://fastwonderblog.com/2026/06/02/how-ospos-can-measure-the-impact-of-oss-funding/