vlt /vōlt/

A consistent(ish) NPM dependency graph: www.vlt.io/blog/consist... In which @evertpot.com explains how we re-order NPM's replication log to give a more consistent dependency graph.

🚀 vlt v1.6.0 is out with Global installs! Now you can use the vlt CLI to get all your CLI tools: #javascript #packages #release #vlt

Our benchmarks got a fresh look, with new ways to explore performance, and a few new capabilities for agentic tooling. Read about some of our favourite changes ↓ www.vlt.io/blog/more-th...

Agent Skills are also dependencies

vlt 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile. The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents. socket.dev/blog/vlt-ski... @vlt.io

Github: the poison is free but you can pay for the antidote: github.blog/changelog/20...

🚀 Just shipped a new `vlt skills` cmd as part of v1.5.0 of the vlt CLI so that we can properly manage these skills that are already being shipped in packages. #javascript #packages #vlt

🚀 vlt@1.4.0 is out with faster installs for macos and a new `--save-types` option to automatically add type dependencies. And more! Read more about it here: www.vlt.io/blog/vlt-1-4

I thought I'd share some of my thoughts/feelings about the recent Deno acquisition... tl;dr competition is a very good thing & we're all better off because people take risks to innovate & disrupt the status quo. www.vlt.io/blog/competi...

The #vlt client now has an 'outdated' command! Read all about it: www.vlt.io/blog/vlt-out...

Fun fact about the NPM replication feed. If you just follow the feed to get updates for ever package, you will miss packages because they retroactively insert changes in the *past* of the feed.

on the ⚡️ @vlt.io ⚡️ registry we serve metadata that is 70% smaller which is one reason (out of many!) that we're able to do clean installs in 20-70% less time when you point to our registry vs npmjs.org. i wrote about how we did it:

Thanks @vlt.io for contributing! 🔈 audio on to hear it from @nodeland.dev

Your private JavaScript registry can now publish to the public. Public packages are now GA. Publish and install the packages you want to share with the ecosystem. Read the full announcement here ↓ www.vlt.io/blog/public-...

10 versions of @7nohe/openapi-react-query-codegen was published to npm in an ongoing attack. They contained provenance. buff.ly/LHuOYgw

Are you talking about paths in a tar escaping the base path? A good package manager should prevent this. I know both npm and vlt do.

vlt 1.0.5 just dropped 🚢 ⚓️ → Dependency-deduping cuts installs with duplicated deps 40% smaller → Warm cache skips the network entirely → Safe by default: tar decompression-bomb caps & path-traversal hardening before anything writes to disk github.com/vltpkg/vltpk...

I've 1.0.0'd my Danger JS re-write today: Risk If you use Danger in GitHub + GitHub Actions then it should be a simple dependency switch and you'd end up with substantially less moving parts I've been using it daily in Puzzmo for 6 months with no issues npmx.dev/package/risk

When you need to fix a typo, not an upgrade

Your package.json lists 20 dependencies. Your node_modules has 800. The 780 you didn't add are where supply-chain risk actually lives. How many transitive deps are in your last install?

Every JS dev has run `npm audit fix --force` and watched their build break. Automated security fixes don't understand your dep graph. The fix that 'solves' the CVE creates three new problems. What did `--force` break for you?

Linux users: watch out for these trojan npm packages masquerading as working calendar and streak utils thehackernews.com/2026/08/14-t...

Friends don't let friends let AI name things.

RSS is... RDF Site Summary? Rich Site Summary? Really Simple Syndication? well, we're on it. www.vlt.io/rss.xml #iykyk

My cowoker dropped 'load bearing' in a conversation 😭

vlt v1.03 dropped with faster installs at every layer. 158x faster packument generation. A warm cache that skips the network entirely on your second install. Tarball extraction, parallelized. github.com/vltpkg/vltpk...

A developer's dilemma: Your security audit flags a CVE. You have to upgrade to the next version to fix it. If you upgrade, you'll have to refactor your whole app to adapt to breaking changes. If you don't upgrade, the CVE alert persists. Maintaining prod is full of hairy decisions.

We made a huge mistake with the Fetch API. We brought it to the server.

This weekend I read over the vlt team's dependency graph code and it blew my mind. Package management and install time safety is a very difficult problem space because all tools resolve dependencies differently.

“coding is largely solved” okay make a new cross platform web browser that supports every web platform spec to 100% compliance

I am a big fan of building *on* existing systems over *replacing* them. I am still processing some of the stuff on semver.xyz, but I am a HUGE fan of the @vlt.io team's *approach* to engineering the future of package management.

How do you prove whoever published your dependencies is who they say they are? Did the maintainer publish this, or did someone compromise the registry? With agents installing packages you can't read, that gap matters. How do you verify package integrity? #supplychainSecurity

Your AI agent just installed 47 packages you didn't read. One might be malicious, but the registry will served it anyway. When agents control dependencies, the trust chain breaks. Where does security live? #supplychainSecurity #JavaScript

Dependency hell!! Oh no, w @darcyclarke.me at @nodejs.org Interactive at @renderatl.com #NodeJSInteractive

Changesets is using tsdown

TypeScript, now downloaded... 1G a month?

What if Semantic Versioning solved "is this compatible?" but not "is this safe?" SBOMs, provenance, lifecycle safety—all fragmented across ecosystems. Can we build *on* semver instead replacing it? Check out Darcy Clarke's talk, "Beyond Semver" at Node.js Interactive, Render ATL, Wed 2pm ET.

ShinyHunters claims Metabase hacking spree

Came here to say it's much easier to pull bluesky than x metrics

Who's got frontend frameworks? Trying to collect some stats on update efficiency (rather than rendering new dom en-masse (which js-framework-benchmark heavily favors <3))

Everyday is a day for JavaScript

HTML Day 2026 is tomorrow ❇️ 2026.html.energy Start your text editors !

vlt 1.0 and Hosted Package Registries, by @darcyclarke.me (@vlt.io): https://www.vlt.io/blog/1-0?ref=frontenddogma.com #releasenotes