vlt v1.6.1 is out with a handful of bug fixes.

22% of packages arrive on the npm registry without their dependencies available yet.

vlt v1.6.0 adds global installs with vlt install -g, links the workspaces that npm monorepos reference by plain ranges, and fixes a round of CLI bugs.

Our benchmarks got a fresh look, better ways to explore performance, and a few new capabilities for agents. Here are some of our favourite improvements.

Introducing v1.5.0: with this release, vlt now links the agent skills your dependencies ship into the dirs your coding agents read.

Deno is joining Cloudflare & winding down its investment in the runtime. We're all better off because of its existence.

vlt v1.4.0 brings the global store to macOS for up to 3x faster installs on Node 26, plus a new --save-types flag.

We shipped the "vlt outdated" command. Find out what packages need upgrading and if you're vulnerable.

Package managers download megabytes of package metadata on every clean install. Here is how vlt.io serves the same installs at a fraction of the size.

Explore the JavaScript ecosystem without an account, and publish packages from your own registry for anyone to install.

Since 1.0, vlt has shipped install-speed wins, security hardening, and quality-of-life CLI fixes.

Stable client release and general availability of hosted JavaScript registries & ecosystem mirrors.

Consuming JavaScript packages safely just got more complicated.

Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.

As part of its planned 12th release, the npm CLI drops automatically running lifecycle scripts on installs as part of multiple planned breaking changes

Drizzle ORM recently hit a 100 MB limit in the npm registry and couldn't ship new releases for weeks. What is this limit?

We've doubled our open source pledge contribution to $14,000 ($3,500 per full-time engineer)

When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.

Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.

Compose queries visually in the GUI, without needing to know the dependency selector syntax.

Release subsets of your monorepo with the new version, pack, and publish commands using powerful selectors and a publish directory.

Run scripts across your dependency graph using powerful query selectors and the --scope config.

Managing dependencies in complex JavaScript projects just got easier. vlt now offers Graph Modifiers, a new way to take precise control of your dependency graph.

We are excited to share catalog support - a powerful new feature for centralized dependency management that reduces duplication and simplifies version orchestration across your projects.

Introducing `jsr:` Support

Introducing the New `vlt exec` Command

Unlock deep, actionable insights into your dependencies with vlts new security-first selectors — powered by metadata from Socket.

We launched a new tool to detect package integrity issues in the JavaScript ecosystem. Learn how `reproduce` is changing the game.

A look under the hood of a vlt install.

Recapping the HalfStack Phoenix conference.

Recapping the vlt team's week in Ireland.

Announcing our foundational Package Manager Client & Serverless Registry.

vlt joins Sentry, Astral, Val Town & more in contributing back to the open source ecosystem!

Luke Karrys joins vlt!

Join vlt in Toronto for Collision Conf 2024!

We put together an incredible team, with top-notch investors & a bold product vision.

An article detailing the massive bug at the heart of the npm ecosystem; encompassing a lack of validation by the public registry, package manifest inconsistancies & assumptions about package managers & security products