mp | Coding Alone

kept by eddie oct 13

The article shows open-source collaboration is declining, with solo-maintained repos rising from 27% to 44% and AI tools worsening isolation, urging community‑centric use of AI development.

GitHub Actions is the weakest link
GitHub Actions' default features—mutable tags, pull_request_target, template injection, and write-scoped tokens—have enabled a chain of supply-chain attacks on open-source registries, and GitHub's opt-in security roadmap won't fix the root causes.
also on PyPI, npm, #open-source, #software-engineering
GitHub - cased/kit: The toolkit for AI devtools context engineering. Build with codebase mapping, symbol extraction, and many kinds of code search.
Kit provides a Python toolkit for codebase mapping, symbol extraction, and code search to build LLM-powered developer tools and agents.
also on PyPI, GitHub, #open-source, #ai-coding, #software-engineering, #developer-tools
Before GitHub | Armin Ronacher's Thoughts and Writings
Armin Ronacher argues that as GitHub declines due to instability and product churn, open source must preserve its history by moving to decentralized, archivally-funded homes that avoid the pre-GitHub era's fragility.
also on npm, GitHub, #tech-community, #open-source, #software-engineering, #developer-tools
How to Evaluate an npm Package - 2026 Edition
A practical checklist for evaluating npm packages in 2026 covering security, maintenance, provenance, CI quality, and incident response to make informed dependency decisions.
also on npm, GitHub, #open-source, #software-engineering, #developer-tools