https://vlt.io Dedicated blog for vlt /vōlt/ design, engineering & thoughts en support@vlt.sh (vlt /vōlt/) support@vlt.sh (vlt /vōlt/) Tue, 06 Oct 2026 16:00:00 GMT https://vlt.io/blog/registry-metadata-70-percent-smaller https://vlt.io/blog/registry-metadata-70-percent-smaller Package managers download megabytes of package metadata on every clean install. Here is how vlt.io serves the same installs at a fraction of the size.]]> Tue, 06 Oct 2026 16:00:00 GMT luke@vlt.sh (Luke Karrys) registry packages https://vlt.io/blog/public-packages https://vlt.io/blog/public-packages Explore the JavaScript ecosystem without an account, and publish packages from your own registry for anyone to install.]]> Thu, 24 Sep 2026 10:00:00 GMT jason@vlt.sh (Jason Korol) features https://vlt.io/blog/vlt-cli-updates https://vlt.io/blog/vlt-cli-updates Since 1.0, vlt has shipped install-speed wins, security hardening, and quality-of-life CLI fixes.]]> Tue, 15 Sep 2026 12:00:00 GMT ruy@vlt.sh (Ruy Adorno) client open source security https://vlt.io/blog/1-0 https://vlt.io/blog/1-0 Stable client release and general availability of hosted JavaScript registries & ecosystem mirrors.]]> Tue, 04 Aug 2026 09:00:00 GMT darcy@vlt.sh (Darcy Clarke) announcement registry client https://vlt.io/blog/slopsquatting-trust-problem https://vlt.io/blog/slopsquatting-trust-problem Consuming JavaScript packages safely just got more complicated.]]> Thu, 30 Jul 2026 13:00:00 GMT registry security packages https://vlt.io/blog/hang-onto-your-lockfile https://vlt.io/blog/hang-onto-your-lockfile Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.]]> Thu, 23 Jul 2026 10:00:00 GMT security packages https://vlt.io/blog/npm-12-breaking-changes https://vlt.io/blog/npm-12-breaking-changes As part of its planned 12th release, the npm CLI drops automatically running lifecycle scripts on installs as part of multiple planned breaking changes]]> Wed, 08 Jul 2026 12:00:00 GMT ruy@vlt.sh (Ruy Adorno) open source security https://vlt.io/blog/packument-size-limits https://vlt.io/blog/packument-size-limits Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?]]> Tue, 23 Jun 2026 12:00:00 GMT registry packages https://vlt.io/blog/doubling-down-on-open-source https://vlt.io/blog/doubling-down-on-open-source We've doubled our open source pledge contribution to $14,000 ($3,500 per full-time engineer)]]> Wed, 29 Apr 2026 12:00:00 GMT darcy@vlt.sh (Darcy Clarke) open source sustainability https://vlt.io/blog/vlt-build https://vlt.io/blog/vlt-build When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.]]> Wed, 19 Nov 2025 09:00:00 GMT ruy@vlt.sh (Ruy Adorno) darcy@vlt.sh (Darcy Clarke) security dss selectors query client https://vlt.io/blog/host-context https://vlt.io/blog/host-context Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.]]> Thu, 18 Sep 2025 09:00:00 GMT ruy@vlt.sh (Ruy Adorno) security dss selectors query client https://vlt.io/blog/point-click-discover https://vlt.io/blog/point-click-discover Compose queries visually in the GUI, without needing to know the dependency selector syntax.]]> Thu, 04 Sep 2025 10:00:00 GMT jason@vlt.sh (Jason Korol) vlt gui features query interactive https://vlt.io/blog/pack-publish-version https://vlt.io/blog/pack-publish-version Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.]]> Thu, 21 Aug 2025 09:00:00 GMT luke@vlt.sh (Luke Karrys) vlt features client https://vlt.io/blog/run-exec-query-support https://vlt.io/blog/run-exec-query-support Run scripts across your dependency graph using powerful query selectors and the --scope config.]]> Wed, 13 Aug 2025 09:00:00 GMT luke@vlt.sh (Luke Karrys) vlt features https://vlt.io/blog/introducing-graph-modifiers https://vlt.io/blog/introducing-graph-modifiers Managing dependencies in complex JavaScript projects just got easier. vlt now offers Graph Modifiers, a new way to take precise control of your dependency graph.]]> Wed, 06 Aug 2025 09:00:00 GMT ruy@vlt.sh (Ruy Adorno) vlt client features modifiers dss query selectors security packages https://vlt.io/blog/centralized-dependency-management-made-simple https://vlt.io/blog/centralized-dependency-management-made-simple We are excited to share catalog support - a powerful new feature for centralized dependency management that reduces duplication and simplifies version orchestration across your projects.]]> Wed, 30 Jul 2025 09:00:00 GMT darcy@vlt.sh (Darcy Clarke) catalogs https://vlt.io/blog/jsr-support https://vlt.io/blog/jsr-support Introducing `jsr:` Support]]> Tue, 27 May 2025 16:27:53 GMT vlt https://vlt.io/blog/new-vlt-exec https://vlt.io/blog/new-vlt-exec Introducing the New `vlt exec` Command]]> Fri, 09 May 2025 16:32:14 GMT vlt https://vlt.io/blog/insights-selectors https://vlt.io/blog/insights-selectors Unlock deep, actionable insights into your dependencies with vlts new security-first selectors — powered by metadata from Socket.]]> Thu, 17 Apr 2025 09:00:00 GMT ruy@vlt.sh (Ruy Adorno) insights security dss selectors socket query client registry https://vlt.io/blog/reproducibility https://vlt.io/blog/reproducibility We launched a new tool to detect package integrity issues in the JavaScript ecosystem. Learn how `reproduce` is changing the game.]]> Wed, 26 Feb 2025 10:00:00 GMT darcy@vlt.sh (Darcy Clarke) vlt research reproduce packages security provenance ci https://vlt.io/blog/rolling-out-new-gui-features https://vlt.io/blog/rolling-out-new-gui-features A look under the hood of a vlt install.]]> Thu, 13 Feb 2025 10:00:00 GMT jason@vlt.sh (Jason Korol) vlt gui features labels query save filter interactive https://vlt.io/blog/halfstack-phoenix-2025 https://vlt.io/blog/halfstack-phoenix-2025 Recapping the HalfStack Phoenix conference.]]> Tue, 04 Feb 2025 12:07:57 GMT luke@vlt.sh (Luke Karrys) conference recap announcements https://vlt.io/blog/nodeconf-eu-collab-summit-recap-2024 https://vlt.io/blog/nodeconf-eu-collab-summit-recap-2024 Recapping the vlt team's week in Ireland.]]> Thu, 21 Nov 2024 18:05:45 GMT luke@vlt.sh (Luke Karrys) recap conference announcements https://vlt.io/blog/introducing-vlt-and-vsr https://vlt.io/blog/introducing-vlt-and-vsr Announcing our foundational Package Manager Client & Serverless Registry.]]> Tue, 05 Nov 2024 12:00:00 GMT darcy@vlt.sh (Darcy Clarke) ruy@vlt.sh (Ruy Adorno) luke@vlt.sh (Luke Karrys) vlt vsr announcement https://vlt.io/blog/making-open-source-more-sustainable https://vlt.io/blog/making-open-source-more-sustainable vlt joins Sentry, Astral, Val Town & more in contributing back to the open source ecosystem!]]> Tue, 08 Oct 2024 12:00:00 GMT darcy@vlt.sh (Darcy Clarke) sustainability https://vlt.io/blog/welcome-luke-karrys https://vlt.io/blog/welcome-luke-karrys Luke Karrys joins vlt!]]> Mon, 17 Jun 2024 12:00:00 GMT luke@vlt.sh (Luke Karrys) team announcements https://vlt.io/blog/collision-conf https://vlt.io/blog/collision-conf Join vlt in Toronto for Collision Conf 2024!]]> Thu, 13 Jun 2024 15:00:00 GMT darcy@vlt.sh (Darcy Clarke) conference https://vlt.io/blog/the-team https://vlt.io/blog/the-team We put together an incredible team, with top-notch investors & a bold product vision.]]> Wed, 20 Mar 2024 09:00:00 GMT darcy@vlt.sh (Darcy Clarke) team announcements https://vlt.io/blog/the-massive-hole-in-the-npm-ecosystem https://vlt.io/blog/the-massive-hole-in-the-npm-ecosystem An article detailing the massive bug at the heart of the npm ecosystem; encompassing a lack of validation by the public registry, package manifest inconsistancies & assumptions about package managers & security products]]> Tue, 27 Jun 2023 09:00:00 GMT darcy@vlt.sh (Darcy Clarke) security