Record · nesbitt.io

The Fragmented World of Dependency Policy

Andrew Nesbitt | Software Engineer and Package Management Nerd · 19 March 2026 · 8 min read

A post on nesbitt.io, published 19 March 2026, is cited by 1 distinct blog to date (corpus.blog, measured 11 October 2026).

A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.

Read at nesbitt.io Wayback capture

1blog citing

Citing blogs and links by period
Period	Blogs	Links
All time	1	1
Last 90 days	1	1
Last 30 days	0	0
Last 7 days	0	0

Figures for this page
First cited	15 Jul 2026
Latest citation	15 Jul 2026
Words blogs link it with	1
External links	46
Length	1,719

Words blogs link it with

The words blogs link this page with, by how many different blogs use them.

how fragmented the policy formats of the various package managers are1 blog

Cited by 1 blog in 1 post

One row per blog, the most recently citing first. Each shows the blog's newest citing post; open a row for the others.

Blog

Newest citing post

Date

phpunit.expert1 post

Composer and Packagist under supply chain stress

linked as “how fragmented the policy formats of the various package managers are”

Read at phpunit.expert

15 Jul 2026

Links from this post

Link

Host

https://codeberg.org/ Who cites this page

codeberg.org

https://github.com/EmbarkStudios/cargo-deny Who cites this page

github.com

https://github.com/pivotal/LicenseFinder/ Who cites this page

github.com

https://github.com/actions/dependency-review-action Who cites this page

github.com

https://pypi.org/project/liccheck/ Who cites this page

pypi.org

https://packagist.org/packages/metasyntactical/composer-plugin-license-check Who cites this page

packagist.org

https://fossa.com/?ref=content.strategyofsecurity.com Who cites this page

fossa.com

https://snyk.io Who cites this page

snyk.io

https://trivy.dev/ Who cites this page

trivy.dev

https://github.com/anchore/grype Who cites this page

github.com

https://google.github.io/osv-scanner/ Who cites this page

google.github.io

OWASP Dependency-Check | OWASP Foundation Read at owasp.org

owasp.org

https://github.com/pyupio/safety Who cites this page

github.com

https://maven.apache.org/enforcer/enforcer-rules/bannedDependencies.html Who cites this page

maven.apache.org

https://github.com/rubysec/bundler-audit Who cites this page

github.com

https://socket.dev/ Who cites this page

socket.dev

https://github.com/jk1/Gradle-License-Report Who cites this page

github.com

Mend Renovate: Automated Dependency Updates Read at mend.io

mend.io

https://www.mend.io/ Who cites this page

mend.io

https://www.blackduck.com/ Who cites this page

blackduck.com

https://www.veracode.com/products/software-composition-analysis Who cites this page

veracode.com

https://checkmarx.com Who cites this page

checkmarx.com

https://www.sonatype.com/products/open-source-security-dependency-management Who cites this page

sonatype.com

https://jfrog.com/xray/ Who cites this page

jfrog.com

https://github.com/oss-review-toolkit/ort Who cites this page

github.com

https://dependencytrack.org/ Who cites this page

dependencytrack.org

https://github.com/aboutcode-org/scancode-toolkit Who cites this page

github.com

http://www.fossology.org/ Who cites this page

fossology.org

https://github.com/licensee/licensed Who cites this page

github.com

https://github.com/sigstore/policy-controller Who cites this page

github.com

https://kyverno.io/ Who cites this page

kyverno.io

https://github.com/notaryproject/ratify Who cites this page

github.com

https://www.openpolicyagent.org/ Who cites this page

openpolicyagent.org

https://www.conftest.dev/ Who cites this page

conftest.dev

https://github.com/package-url/purl-spec Who cites this page

github.com

https://cyclonedx.org/ Who cites this page

cyclonedx.org

https://spdx.dev/ Who cites this page

spdx.dev

https://ossf.github.io/osv-schema/ Who cites this page

ossf.github.io

https://github.com/openvex/spec Who cites this page

github.com

https://slsa.dev/?ref=abacusnoir.com Who cites this page

slsa.dev

https://in-toto.io/ Who cites this page

in-toto.io

https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act Who cites this page

digital-strategy.ec.europa.eu

https://digital-strategy.ec.europa.eu/en/policies/cra-summary Who cites this page

digital-strategy.ec.europa.eu

https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03183/TR-03183_node.html Who cites this page

bsi.bund.de

https://github.com/oasis-tcs/csaf Who cites this page

github.com

Standards Read at xkcd.com

xkcd.com

Elsewhere on nesbitt.io (2)

https://nesbitt.io/2026/03/11/git-pkgs-actions.html Read at nesbitt.io

nesbitt.io

https://nesbitt.io/2026/01/20/the-lesser-evil-of-compliance.html Read at nesbitt.io

nesbitt.io

The Fragmented World of Dependency Policy

Words blogs link it with

Cited by 1 blog in 1 post

Links from this post

Similar posts