I'm a software engineer based in the UK, mostly working with Ruby. I’ve spent over a decade working in the world of package management and software dependencies — building tools to make open source more understandable, discoverable, and sustainable.

These days I'm focused on Ecosyste.ms, a project that maps dependency networks across open-source ecosystems to identify the projects that really matter. It builds on ideas from Libraries.io, which I started and later sold to Tidelift, and takes the concept further with broader data coverage and deeper analysis.

I'm also building git-pkgs, a git subcommand that tracks dependency changes across your repository's history. It indexes lockfiles over time so you can see who added each dependency, when, and why, along with vulnerability scanning and supply chain security features.

I also created Octobox, which helps developers manage GitHub notifications, and 24 Pull Requests, an initiative to encourage open-source contributions during December.

I write about package managers, dependency resolution, and software supply chains at nesbitt.io/package-managers.

• Two-Factor Authentication Across Package Registries
• This Week in Package Management: 15 August 2026
• How This Blog Is Built
• Supplier Security Questionnaire
• Shared Code Between Package Managers
• This Week in Package Management: 8 August 2026
• The Software Stewardship Lab
• A year of AI disclosure in critical packages
• brew install actions/checkout
• This Week in Package Management: 1 August 2026

• package-manager-library-reuse - Survey of which libraries package managers themselves depend on, vendor, or link against
• homebrew-actions - Install GitHub Actions from a Homebrew tap
• critical-ai-scan - Survey of explicitly disclosed AI involvement in the git history of critical open source repositories, using the CHAOSS disclosure detectors
• package-name-prefixes - Prefix analysis of package names across PyPI, npm, crates.io, rubygems, hex, hackage and NuGet
• bundler-resolver-logger - Experimental structured tracing for Bundler's PubGrub resolver
• jekyll-standard-site - Jekyll plugin that emits standard.site verification artifacts
• pycon - Data collection and analysis for a PyCon talk on GitHub Actions security across Python packages.
• weekend-at-bernies - Data collection for Weekend at Bernie's blog post
• vid - Content-addressed vulnerability identifiers
• omni_git - A PostgreSQL extension that stores git repositories in database tables and serves the git smart HTTP protocol, turning Postgres into a git remote.