Ruff Author Slams pnpm Over Disabling Private Vulnerability Reporting
charliermarsh · x · 2026-10-05
charliermarsh (author of Ruff) criticizes pnpm's decision to disable private vulnerability reporting: users and the ecosystem stay exposed between report and remediation, and 'no project of this maturity' lacks a private disclosure channel.
Related event: pnpm Criticized for Closing Private Vulnerability Reporting Channel(2 posts)→
More from coding & agent
- CacheBack cuts 75% of agent-to-agent KV cache state, +14.7 points accuracy on FanOutQA — Maximillian Rossi · 2026-10-05
- OpenAI launches Codex Cloud with reusable environments at DevDay — Dimillian · 2026-10-05
- Google makes stateful Interactions API the default for Gemini models and Agent Platform — rseroter · 2026-10-05
- Day 3 of running an AI agent team building its own version control system — Al_Grigor · 2026-10-05
- django-admin-mcp: Expose Django admin to AI agents with a single mixin — gorenbarbaros · 2026-10-05
- Dev ports 90s Bungie game Myth to WebAssembly in a weekend using Claude Opus 5.5 — garrytan · 2026-10-05