The home for great developer writing.

We surface the best developer writing from thousands of independent blogs, updated daily.

github: Dependabot no longer infers .npmrc

1 · Sujith Quintelier · July 1, 2026, 7:06 a.m.

Summary

GitHub's Dependabot will no longer infer .npmrc settings from lockfile URLs for npm private registries, stopping the practice of guessing configurations based on potentially incorrect data.

Read full post on quintelier.dev →

MORE POSTS LIKE THIS

github: npm bulk trusted publishing config and script security now generally available

Sujith Quintelier · Feb 18, 2026

npm oidc

How to put your Python project on GitHub

Python Developer Tooling Handbook – pydevtools.com · Jul 27, 2026

Python Git

I've Moved Back to GitHub

Kevquirk · Jul 19, 2026

Article github

Socket: PyPI and npm payment SDK malware compromises CI/CD

Developer Tech · Jul 8, 2026

APIs Build & Ship

Finding active GitHub forks from the command line

kjk · Jun 18, 2026

github forks

What is npm doing to protect the JavaScript ecosystem – and is it enough?

Thestack · Jun 16, 2026

Cybersecurity npm

Discover more posts →

AUTHOR