GitHub Dependabot now supports automatic version updates for Microsoft's Agent Package Manager (APM) dependencies via a new entry in dependabot.yml. Updates respect pinning strategy (SemVer, commit SHA, or branch) and apply to the apm.yml/lock.yaml workflow, with certain entries excluded. APM, built on the AGENTS.md/Agent Skills standard, enables cross-harness deployment across multiple AI tools, and its ecosystem has seen broad adoption and significant usage. The handling of security updates for APM remains to be clarified.
The article explains how Microsoft’s free APM package manager can distribute shared coding-agent setup across nine tools from one manifest. It covers setup, security controls, estimated team savings, a cautious rollout, and limits such as a changing format and tool-specific behavior.
The document details installing the learningmachine package from GitHub, including dependency resolution and environment specifics, with versioned packages and a Pip upgrade notice.
A reproducible study tests methods to detect non-existent Python packages during automated installs. The guard system, combining models and a Claude Code hook, blocks ghost packages with high accuracy while preserving real installs; results include AUROC ~0.975 and open-source data.
DepGate is an open-source proxy and policy engine that sits between package managers and public registries to control what gets downloaded, enforcing malware and policy checks at download time and recording decisions. It supports multiple ecosystems, runs via Docker or Kubernetes, and positions itself as an open-source alternative to repository firewall products.
A coder documents a supply-chain risk in using MCP tooling with uvx, showing how local packages, repository names, and PyPI ownership can diverge and create unsafe bridge practices between trusted sources and unmanaged registries.
The tutorial describes building a bounded TypeScript AI agent that investigates a vulnerability alert for Next.js (CVE-2025-29927) using Valyu to fetch evidence, compares versions to advisories, and produces a cited brief for human review without applying patches or scanning the app.
The document provides a Python GitHub release watcher that polls configured repositories and sends desktop notifications through Plyer. It includes configuration examples and code extension points for later asset checks and installed-version comparisons.
A self-hosted platform for managing LLM infrastructure with monitoring, control, tuning, and alerting; supports multiple backends, various installation methods, and feature modules for automation and model management.
Software Release Radar is a self-hosted dashboard that tracks GitHub releases against the versions you run, using Portainer/Dockhand inventories to inform upgrade decisions and alerts. It supports optional AI release summaries and runs as a Python 3.13 app in Docker with a guided setup.