Post

Dependency Management revisited paluch.biz/2026/07/07/d...

paluch.bizDependency Management revisitedTen or fifteen years ago, dependency management was mostly periodic maintenance. A framework release here, a library release there, an occasional build plugin update, and usually enough time to make a...

7/7/26, 10:05 pm4 reposts9 likes

Stefano Cordio

@scordio.github.io

8 July

Related to SHA pinning and their entropy, GitHub is working on dependency locking: github.com/orgs/communi...

github.comHelp Shape Workflow Dependency Locking 👋 🔒 · community · Discussion #194494Actions / Workflow Dependency Locking TLDR; This discussion is focused on feedback for: the new dependencies: workflow contract naming and shape of the lock data resolution and enforcement behavior...

Mark Paluch 👨‍💻,🎹&✈️

@mp911.de

8 July

In-yaml Lockfiles, more clutter and more noise. The exact opposite of what’s needed.

Kevin Deyne

@kevindeyne.bsky.social

8 July

I struggle with this as well. Only thing that has worked so far is filtering out which dependencies matter (major versions, EPSS) + sacrifice some build reproducibility (org managed parent pom that forces patches) + have less stuff (modulith your many microservices). But I want better.

Kevin Deyne

@kevindeyne.bsky.social

8 July

Speaking of NPM, there is also a danger in automating too well and opening yourself up to supply chain attacks. Like you said, so much depends on trust. Security vendors, in my experience, are still too reactive on this front.