| Homepage | https://ecosyste.ms |
Deploying some more aggressive caching to @ecosystems, especially on the html pages as some people are smashing it with headless chrome browsers atm.
Some things may be a bit more stale than before, but can't really be helped on such a small budget.
Annoucing git-pkgs, explore the dependency history of your git repositories.
git pkgs init
git pkgs blame
git pkgs history rails
git pkgs diff --from=v2.0
git pkgs stats
git pkgs why rails
git pkgs diff --from=HEAD~10
git pkgs diff --from=main --to=feature
https://nesbitt.io/2026/01/01/git-pkgs-explore-your-dependency-history.html
One last coding experiment for 2025: https://github.com/ecosyste-ms/critical a daily updated sqlite database of metadata for the top 10k most used packages from @ecosystems published to github and npm.
You can then use that with https://github.com/ecosyste-ms/mcp a local mcp server for package metadata, it runs instantly for the cached packages and then falls back to querying the ecosyste.ms APIs.
Wolf Vollprecht and Andrew Nesbitt are co-organizing the Package Managers devroom at FOSDEM 2026, and the schedule is now live. We have nine talks covering supply chain security, dependency resolution, build reproducibility, and the economics of running package registries.
There's still time to get a proposal in for the package manager dev room at @fosdem 2026, cfp closes end of day 1st December:
https://blog.ecosyste.ms/2025/11/06/fosdem-2026-package-managers-devroom-cfp.html
New on the blog: Documenting Package Manager Data
https://blog.ecosyste.ms/2025/11/17/documenting-package-manager-data.html
Package managers are the quiet workhorses of computing. They make installing software on a machine trivial, but they have their differences, and as recent events have shown, those differences can lead to vulnerabilities and provide opportunities for attackers to disrupt public and private services alike.
Andrew Nesbitt
