The Inedo Team on September 29th, 2026.
Starting with ProGet 2026.12, you can now create Open VSX feeds alongside the many other feed types ProGet already supports. This feed type lets you host Open VSX-compatible extensions that work with VSCodium and other open-source forks of Visual Studio Code. Once the feed is configured in the editor, developers can browse and install...
The Inedo Team on September 2nd, 2026.
Some open-source vulnerabilities don’t give you the luxury of waiting. Not until the next sprint. Not until the next release window. They demand action now. We call these Category 5 vulnerabilities. Most security teams are drowning in reported vulnerabilities in OSS packages marked “critical.” The real difficulty isn’t discovering...
The Inedo Team on August 12th, 2026.
Some OSS vulnerabilities require immediate action. Not tomorrow. Not after the next release cycle. Immediately. Most teams face thousands of vulnerability findings, all labeled “critical.” Among these there are those that represent the highest level of real-world risk: actively exploitable, exposed in critical systems, and capable of...
The Inedo Team on July 9th, 2026.
Newly published packages carry a degree of uncertainty. Regressions, breaking changes, and other defects often aren’t discovered until a version has been used by a wider audience in real-world environments. In ProGet 2026, two additional compliance rules to help you vet and monitor open-source packages in your organization. These...
The Inedo Team on June 18th, 2026.
Are your vulnerability management practices actually reducing risk, or are they quietly disrupting your ability to deliver software? That is the main question behind this year’s research. Most organizations now have some kind of process for detecting and responding to vulnerabilities in open-source...
The Inedo Team on May 22nd, 2026.
ProGet 2026 is now available! This major release introduces the Package Vulnerability Remediation Scale (PVRS); a fundamentally new approach to vulnerability management, helping organizations move beyond theoretical severity scores and focus on what actually matters: whether a vulnerability poses real risk in their environment and what...
The Inedo Team on May 14th, 2026.
Modern software teams are inundated with vulnerability alerts. Although open-source dependencies make up most applications, many organizations still prioritize remediation based on worst-case severity rather than real-world risk. This leading to unnecessary upgrades, avoidable regressions, delayed releases, and wasted effort on...
The Inedo Team on April 23rd, 2026.
Modern applications rely heavily on open-source dependencies, which make up most codebases. Organizations rely on tools like repository scanning or automated dependency updating, treating vulnerabilities based on theoretical worst-case severity rather than real-world risk. This can introduce behavior changes that lead to regressions, or...
The Inedo Team on March 3rd, 2026.
Back in 2012, a feature flag at Knight Capital accidentally turned on dormant code, triggering uncontrollable trades and a $440 million loss. This kind of failure shows how risky feature flags can be when they’re misused. If teams rely on them to feel safe instead of really understanding the change, even routine deployments can go badly...
The Inedo Team on February 19th, 2026.
Last year, we sent out the Inedo Snack Box to our members, and we’ll be doing the same again in 2026! Whether you run ProGet, BuildMaster, or Otter, are exploring our products for the first time, or provided feedback during evaluation, your input has helped shape what we build. At Inedo, we describe ourselves as a user-driven company....