case studies
A TorchServe Commit Pointed pip at Two Extra Package Indexes
TorchServe, the model server in pytorch/serve, keeps its Python requirements in a requirements/ folder, one file per platform and accelerator. In June 2023 commit …
Tag
Dependencies
use cases
Five Tested Recipes for the Remixware Dependency Gate
These are short setups for remixware deps, the check that compares a pull request’s lockfiles with main’s. Each one was run before it went on this page. The …
case studies
How One esbuild Line in TypeScript Became 23 Lockfile Packages and an Install Script
In 2022 the TypeScript team moved the compiler’s own build to esbuild, a fast JavaScript bundler written in Go. The first commit of that work, 4139807e7 in …
releases
Remixware Now Fails Pull Requests That Bring In Risky Dependencies
A pull request that adds one line to package.json can add forty packages to the lockfile. Reviewers read the line. Hardly anyone reads the lockfile, and that’s …
case studies
The Hugo Deploy Command Brought In 18 New Go Modules Including the AWS SDK and gRPC
Hugo, the static site generator written in Go, has a hugo deploy command that uploads a built site to Amazon S3, Google Cloud Storage or Azure Blob Storage. It arrived in …