I'm a software engineer based in the UK and a maintainer of Homebrew. I've spent over a decade working in the world of package management and software dependencies, building tools to make open source more understandable, discoverable, and sustainable.
These days I'm focused on Ecosyste.ms, a project that maps dependency networks across open-source ecosystems to identify the projects that really matter. It builds on ideas from Libraries.io, which I started and later sold to Tidelift, and takes the concept further with broader data coverage and deeper analysis.
I'm also building git-pkgs, a family of tools and Go libraries for working with software dependencies. The core git pkgs command indexes lockfiles across your repository's history so you can see who added each dependency, when, and why, with vulnerability scanning and supply chain checks on top. Alongside it sit standalone tools like brief, forge, and proxy.
With Alpha-Omega I work on Scrutineer, a tool for scanning open source repositories for security vulnerabilities and managing the disclosure process end to end.
I created Octobox, which helps developers manage GitHub notifications, and 24 Pull Requests, an initiative to encourage open-source contributions during December.
I write about package managers, dependency resolution, and software supply chains at nesbitt.io/package-managers.
- This Week in Source Control: 11 November 2026
- Introducing Ninety
- This Week in Package Management: 7 November 2026
- Weekend at Bernie’s II
- This Week in Source Control: 4 November 2026
- This Week in Package Management: 31 October 2026
- Signing and Attestations Across Package Registries
- This Week in Source Control: 28 October 2026
- Package Management Devroom at FOSDEM 2027: Call for Participation
- This Week in Package Management: 24 October 2026
- clone - Clone git repositories into ~/code//, skipping ones you already have
- swh-go - Go client for the Software Heritage Web API, generated from an OpenAPI description with hand-written pagination, rate limiting and auth
- swh-openapi - An OpenAPI description of the Software Heritage Web API, generated from swh-web's own endpoint documentation
- swhid-wasm - Calculate Software Heritage identifiers for package archives in the browser with Go and WebAssembly.
- swh-git - Clone archived repositories from Software Heritage using ordinary Git.
- code-commons - Slides for my CodeCommons talk on linking package identities and ecosyste.ms metadata to archived source in Software Heritage.
- swh-critical - Software Heritage coverage checks for critical package repositories
- embedded-rust-packages - Find critical open-source packages that ship Rust code inside a non-Rust ecosystem
- package-manager-library-reuse - Survey of which libraries package managers themselves depend on, vendor, or link against
- homebrew-actions - Install GitHub Actions from a Homebrew tap