#dependencies

[$] Portable Python scripts with dependencies

A basic Python script is portable: it can be copied between machines with little concern about compatibility. A script that depends on third-party packages requires quite a bit more care and consideration, however. In 2023, PEP 723 ("Inline script metadata") introduced a standard for declaring a Python script's dependencies inside the script itself. Several third-party tools can now automatically install and manage those dependencies, but there is still little official support for this standard within Python itself.

LWN.net · EN

Surgical Transitive Updates with pnpm: audit --fix

pnpm's audit --fix can now update vulnerable transitives directly in the lockfile instead of reaching for overrides first, and it even plays nicely with minimumReleaseAge. Let's dig in.

Nicolas Charpentier's Blog · EN

The Bun CVE Gap, Closed: Surgical Updates Land in Bun 1.4

Three months ago, I wrote that Bun was the only mainstream package manager that couldn't do surgical CVE remediation. Bun 1.4 ships in-place transitive updates, bun audit fix, and nested overrides. Time to re-run the original reproductions.

Nicolas Charpentier's Blog · EN

The Bun Dependabot Gap: Dependabot Alerts Don't See bun.lock

GitHub's dependency graph doesn't read bun.lock yet, so in Bun projects Dependabot alerts only cover what's written in package.json, and never a transitive dependency. Here's how to check if you're affected, and how I closed the gap with a GitHub Action.

Nicolas Charpentier's Blog · EN