Post

Mark Paluch 👨‍💻,🎹&✈️

Dependency Management revisited paluch.biz/2026/07/07/d...

paluch.bizDependency Management revisitedTen or fifteen years ago, dependency management was mostly periodic maintenance. A framework release here, a library release there, an occasional build plugin update, and usually enough time to make a...

@scordio.github.io

Related to SHA pinning and their entropy, GitHub is working on dependency locking: github.com/orgs/communi...

github.comHelp Shape Workflow Dependency Locking 👋 🔒 · community · Discussion #194494Actions / Workflow Dependency Locking TLDR; This discussion is focused on feedback for: the new dependencies: workflow contract naming and shape of the lock data resolution and enforcement behavior...

8/7/26, 7:04 pm0 reposts3 likes

Mark Paluch 👨‍💻,🎹&✈️

In-yaml Lockfiles, more clutter and more noise. The exact opposite of what’s needed.