Software Supply Chain19 October 2026
Undeclared dependencies: what an LLM plugin break teaches about supply-chain hygiene
A small fix in llm-tools-datasette 0.1.1 shows how a core library's HTTP client swap can break plugins that never declared the dependency. It is a low-severity bug, and a useful reminder for anyone running AI tooling in production.
supply-chainpythonllm-tooling
3 min readRead
Software Supply Chain12 October 2026
Python 3.15 ships and 3.10 is unsupported: a security upgrade checklist
Python 3.15 adds explicit lazy imports and a sampling profiler that can attach to a running process. With Python 3.10 now out of support, teams still pinned to it have a security reason to move.
pythonsupply-chaindevsecops
3 min readRead
Software Supply Chain28 June 2026
Strict Dependency Pinning in Python Libraries: Why == Hurts Your Users
A one-line fix to datasette-export-database illustrates a pervasive Python packaging mistake with real supply-chain security implications.
pythonpypidependency-management
4 min readRead