Hey 👋
I'm a software engineer based in the UK, mostly working with Ruby. I’ve spent over a decade working in the world of package management and software dependencies — building tools to make open source more understandable, discoverable, and sustainable.
These days I'm focused on Ecosyste.ms, a project that maps dependency networks across open-source ecosystems to identify the projects that really matter. It builds on ideas from Libraries.io, which I started and later sold to Tidelift, and takes the concept further with broader data coverage and deeper analysis.
I'm also building git-pkgs, a git subcommand that tracks dependency changes across your repository's history. It indexes lockfiles over time so you can see who added each dependency, when, and why, along with vulnerability scanning and supply chain security features.
I also created Octobox, which helps developers manage GitHub notifications, and 24 Pull Requests, an initiative to encourage open-source contributions during December.
I write about package managers, dependency resolution, and software supply chains at nesbitt.io/package-managers.
Latest Blog Posts
Latest Repos
- managing-dependencies - Claude Code skill for evaluating packages and managing dependencies securely
- swhid-go - A Go library and CLI for computing Software Heritage Identifiers (SWHIDs).
- brew-vulns - A Homebrew subcommand that checks installed packages for vulnerabilities
- sarif - A Ruby SDK for SARIF (Static Analysis Results Interchange Format) 2.1.0.
- diffoscope - Ruby bindings for diffoscope - Compare packages, tarballs, files, URLs, or package URLs
- gitlab-faraday - Ruby wrapper for the GitLab REST API, a fork of github.com/NARKOZ/gitlab updated to use Faraday
- grass-ruby - A fast Sass compiler for Ruby, powered by grass (Rust)
- dirhash - Generate Go module zip digests compatible with sum.golang.org
- go-bundler - Go-style imports for Ruby
- changelog-parser - Parse changelog files into structured data