Geoffrey Huntley

When a certificate authority is compromised, a compression library is vulnerable, or a package is poisoned, patching the one copy you own is easy. Patching every copy buried in transitive dependencies is not. Each ecosystem, base image, and runtime carries its own, and each needs its own patch, release, and redeploy.

Most teams open a pull request upstream and wait. The maintainer never signed up to be their vendor, is already drowning in AI-generated PRs, and owes them nothing under an “as is” license. Or they fork it, then own the build pipeline, the artifact registry, and a divergence that starts rotting the moment they stop looking.

Your supply chain moves at the speed of the slowest maintainer you depend on. That’s a hostage situation.

This talk shows another way. Define a single source of truth for every dependency across the stack, from the developer laptop to CI, container images, agent sandboxes, and the operating system that enables an agent to patch the world.

One prompt to an AI agent answers “are we affected?” across the fleet. One patch, written once by an agent, fixes everything that depends on the broken component. No fork. No waiting. No PR queue.