A wishlist for what a next-generation code forge should offer open source maintainers, focused on cross-project coordination rather than single-repo UX improvements. Key proposals include downstream testing (running dependents' test suites against a release candidate, similar to Rust's crater runs), a feed for dependents subscribed by lockfile to receive deprecation notices and CVE alerts, smarter fork network surfacing when upstream projects go quiet, package version distribution stats on repo pages, safer CI defaults with pinned actions and isolated caches, and a forge-run package caching proxy to reduce load on public registries. The author argues GitHub has modeled only the fork relationship while ignoring the dependency relationship, which is now the primary way code is reused.
Table of contents
Downstream testing #A feed for dependents #Fork networks #Borrowed from the npmx list #Safer CI defaults #A package cache in CI #Rename “issues” #Out of scope #23.3K Impressions1 Comment