Changelog Interviews The world of open source metadata
Nov 5, 2025
Andrew Nesbitt, a trailblazer in open source metadata, discusses his journey from creating Libraries.io to building ecosyste.ms, which tracks millions of packages and dependencies. He dives into the significance of package metadata for understanding real-world usage and the challenges of maintaining accurate dependency graphs. Andrew also explores who utilizes this wealth of data, from researchers to maintainers, and the critical role of SBOM enrichment in enhancing security. His insights on sustainability and funding in open source provide a thought-provoking window into the future of digital infrastructure.
AI Snips
Chapters
Transcript
Episode notes
Dependency Graphs Reveal Real Usage
- Mining dependency data from repositories reveals real usage signals that stars and downloads miss.
- Dependencies that disappear are strong indicators of projects becoming unused or broken.
From 24 PRs To Libraries.io
- Andrew started with 24 Pull Requests and built tooling to help people find healthy projects to contribute to.
- That work led to Libraries.io and a decade of open source metadata effort.
Microservices For Open Metadata
- Ecosyste.ms rearchitects Libraries.io as many focused services instead of one monolith.
- Splitting by repo, packages, advisories, commits, and issues makes contribution and scaling easier.