Kind replies

Thanks for https://nesbitt.io/2026/05/27/chaoss-metrics-in-2026.html - some good stuff in there in, and a number of metrics I'd not seen before, but some good commentary

Ended up having quite a few thought, so I've written them up in long-form - interested to hear your thoughts!

(Ironic that I talk about how verbose LLMs can be 🫣)

No, not heard that before! (Grew up in London, UK)

Very fair! Do you have any recommended alternatives (if any) for folks who prefer to have a metric when discussing things like this?

I've been enjoying hledger for this sort of thing - and it's something a lot of LLMs understand so should give you some opportunities to build on top of

Which harnesses are you finding you're enjoying more? (if any)

But you need to specify a ref! Any git fetch will lead to you being able to force over - giving you a false sense of security - https://www.jvt.me/posts/2018/09/18/safely-force-git-push/

GitHub's title for their reviewed version of the GHSA looks a bit odd 🤔

Far too many package managers provide ways to execute arbitrary code 😅🙄

I'm a big fan of having done it / often the few mins before + being on stage, but sometimes the prep is tough 😅

And we had too many releases last year to be able to do any more updates!

Yep! Claude Code, not Claude: https://www.techradar.com/pro/security/anthropic-confirms-it-leaked-512-000-lines-of-claude-code-source-code-spilling-some-of-its-biggest-secrets

Rego + OPA is what I used for Dependency Management Data and aside from a bit of a learning curve to get started, it was really quite nice to be able to provide more complex rules for your policies

Thank you 💜

Seen https://bsky.app/profile/justingarrison.com/post/3mfpyz5nob224? (not a reusable skill/agent as far as I know)

Yeah on my desktop I've only got it set up to use the GPU's VRAM, from what I've read it's not very efficient to try and get it to use system RAM, whereas Apple's Unified RAM means they can use system RAM and VRAM together for better overall performance

(Just pushed a fix for that link 404ing woops!)

Hopefully https://www.jvt.me/posts/2026/02/28/local-ai-usage/ helps answer some of that - happy to share anything else of note!

What are you both wanting details of? Models? What I'm using to run / interact with them? Use cases?

++ to Andy! Andy designed Dependency Management Data and deps.fyi and really enjoyed the collaboration

I've also got a public review that may be of interest

https://www.jvt.me/kind/articles/feed.xml

(see also: https://www.jvt.me/subscribe/)

I wonder if [the DependencyReportTask task] (https://www.jvt.me/posts/2020/07/27/gradle-list-all-dependencies/) might be something you can use? I've not tested it, but it might need to pull the dependencies to then list them?

🤗

Haha yes thank you! Good spot 😂

Fairly well, yes! I did end up losing lvm2 in the process of 11 ➡️ 12, but managed to reinstall it and then things were otherwise working

For a second I was worried you meant Renovate was AI enshittified 😅

I will say I didn't disagree with DHH's use of "open source" as I will generally let it slide as its not "Open Source", the version that I attribute to following the Open Source Definition as set out by the Open Source Initiative

I agree that there are many who don't understand the distinction and assume that "Open Source" == "open source", and so I do agree that avoiding the use of "open source" where it instead means "non-OSD" makes sense

The trouble of being such a prolific maintainer, well done 😹

I've done a couple of virtual conferences with it which was fun, but mainly for the novelty - not sure how many events it would work for / for a regular workplace

For the Christmas period, McDonald's are doing "Grinch salt shaker" chips with all(?) orders 👀 surprisingly nice! (in the UK it's called "gherkin flavour" but same difference)

Does the CFP end at the end of 2025-12-01, or do submissions need to be in by the 2025-11-30 end-of-day?

Got a source?

Note that both Renovate and Dependabot will still update for security patches, it's "non-security" updates that would be gated

Are those libraries that stay internal to your project (ie in an internal/pointerutil or similar) or small libraries that can then be imported by other projects?

Thanks for sharing - what sort of things do you disagree with? Would be interested to hear!

I guess that'd mean ie

sed 's/this/that/g' file | sponge file

To allow you to modify the same file as the input?

I am 👀 It's bridged from my website, but I browse through another account so I can use the standard Bluesky app

👋🏽 If you're taking submissions, I write about a whole host of things!

It is now! https://www.jvt.me/podcasts/

Thank you for being open and sharing 💜 ADHD can really suck, especially once we learn what it is and have to unpack how it's shaped us

Congrats! They're super lucky to have you and your expertise, looking forward to seeing what y'all do 🙌🏽

Very much recommend it - colleagues (and managers) have found it super useful as a "cheat sheet" for some things about working with me

Nice! Mine (and on GitHub pulls blog posts and other information like my current job, how many steps I walked the day before, etc!

Nice! They're also markup-able in Microformats2 in your HTML, via

Would you be interested in hearing from any of the Renovate maintainers? (either freelance maintainers or paid maintainers at Mend)

I enjoy your blog's "share this post on... [social media]" links 😂

Have you seen the Blind app for anonymous discussion with your colleagues?

I do see folks every so often asking for referrals on the public (but still anonymous) boards, might be worth a look? But I'm not sure if there's much uptick

The worst is when someone says something, a conversation starts and then they take a few days to reply!

(it's me, hi, I'm the problem it's me)

Ooh see you there 👀

As a data point, I've seen a lot of left-leaning folks discussing it on TikTok

Do we need to have Fallthrough, Break and Panic as a third show that's a more time constrained option? 😂