vlt /vōlt/

JavaScript package registries & tooling for teams that move fast.

[vlt /vōlt/ @vltpkg]

Agent Skills are also dependencies

[Ruy Adorno @ruyadorno]

🚀 Just shipped a new `vlt skills` cmd as part of v1.5.0 of the vlt CLI so that we can properly manage these skills that are already being shipped in packages.

[Socket @SocketSecurity]

.@vltpkg 1.5.0 links agent skills from your dependencies to coding agents, with versions pinned by your lockfile.

The default skills filter uses Socket data to exclude packages flagged as malware before their instructions reach your agents.

https://t.co/bNunYgaJwn

[vlt /vōlt/ @vltpkg]

Github: the poison is free, but you can pay for the antidote

https://t.co/GfFHON3kU5

[Ruy Adorno @ruyadorno]

🚀 Just shipped a new `vlt skills` cmd as part of v1.5.0 of the vlt CLI so that we can properly manage these skills that are already being shipped in packages.

[Ruy Adorno @ruyadorno]

🚀 [email protected] is out with faster installs for macos and a new `--save-types` option to automatically add type dependencies.

[vlt /vōlt/ @vltpkg]

https://t.co/tFvp7zVAlR

[vlt /vōlt/ @vltpkg]

I thought I'd share some of my thoughts/feelings about the recent Deno acquisition... tl;dr competition is a very good thing & we're all better off because people take risks to innovate & disrupt the status quo. [link below]

[vlt /vōlt/ @vltpkg]

The #vlt client now has an 'outdated' command!

Read all about it: https://t.co/XxX6MgvyNK

What do you want from an 'outdated' command?

[luke @lukekarrys]

on the ⚡️@vltpkg ⚡️registry we serve metadata that is 70% smaller which is one reason (out of many!) that we're able to do clean installs in 20-70% less time when you point to our registry vs npmjs․org. i wrote about how we did it: https://t.co/8KENtzX4qN

[vlt /vōlt/ @vltpkg]

Your private JavaScript registry can now publish to the public.
Public packages are now GA. Publish and install the packages you want to share with the ecosystem. Read the full announcement here ↓ https://t.co/A0ddNeGrfv

[cody @codybrouwers]

Some more data for CI cold installs after switching to vlt's registry from npm.

35% faster at p90!

[NodeConf EU @NodeConfEU]

🚀 Thrilled to announce @vltpkg as a #Silver #Sponsor of #NodeConfEU 2026!

Thank you! 💛
Your partnership is helping us create something truly special in the #Node.js #community!

🎟️ https://t.co/rDKt7ktI66

[Darcy Clarke @darcy]

vlx hunkdiff # <3

[vlt /vōlt/ @vltpkg]

@thdxr nvim!

[Darcy Clarke @darcy]

This can't be overstated. Funny enough, dual support outpaces esm-only (expected, as maintainers want the broadest interop). We're almost a decade in & esm-only pkgs are only growing at ~2% /yr; at that pace, it'd take another decade to hit ~50%.

refs. https://t.co/y2Ml96Iru2

[vlt /vōlt/ @vltpkg]

@darcy such a travesty!

[vlt /vōlt/ @vltpkg]

10 versions of @7nohe/openapi-react-query-codegen was published to npm in an ongoing attack.

They contained provenance.

https://t.co/qUfLAZH0Uq

[vlt /vōlt/ @vltpkg]

@HeyGarrison ... what am I reading?!

[vlt /vōlt/ @vltpkg]

Thanks to @drawliin for 2 wonderful contributions 😊

[vlt /vōlt/ @vltpkg]

vlt 1.0.5 is here 🚀
Faster installs when package.json declares duplicated depedencies: up to 40% smaller.
Safer installation and package publishing by default: tar decompression caps & path-traversal hardening enforced. https://t.co/uMbIAfO30e

[vlt /vōlt/ @vltpkg]

You've all solved centering a div with agents. Now what about package management?