Co-founder @GitHits_com - Equip your agents to use open source right. | Scaled opencv-python to 100m+ downloads as a side hustle
Tampere, Finland
Joined July 2010
- Tweets10.8K
- Following2.3K
- Followers1K
- Likes11.5K
Pinned Tweet
After ~5 years of maintainership and over 100 million downloads, I'm happy to announce that my opencv-python packaging project has been adopted by the OpenCV organization.
It can be found in the future from github.com/opencv/opencv-pyt…. #OpenCV #python
Olli-Pekka Heinisuo retweeted
We released githits-scan today. It turns the lockfiles in your repo into an SBOM, a dependency audit, or a license report.
brew install githits-com/tap/githits-scan
It's an alpha, and I'd love brutally honest feedback.
githits.com/blog/introducing…
Breaking news: we just open sourced every enterprise legal team’s wet dream.
SBOMs, dependency audits, and license reports. Straight from your lockfiles.
githits.com/blog/introducing…
Repo: github.com/githits-com/githi…
GitHub Action coming soon.
GitHits is now available as a plugin for ChatGPT & Codex chatgpt.com/plugins/plugin_a…
Olli-Pekka Heinisuo retweeted
Your agents can now pull the full OSV writeup on a vuln without leaving their terminal!
New in the GitHits CLI and MCP: pkg vulns --details. Try it on [email protected] and you’ll get CVE-2026-4800
GitHits tool deep dives continue: code_diff - compare any two refs, commits or tags of a repo with single command.
githits.com/blog/diff-compar…
Olli-Pekka Heinisuo retweeted
It's been a brutal few weeks for exploits.
Your agent should be able to check a CVE before it ships code, not after.
New in the GitHits CLI and MCP: give it a CVE or GHSA ID, get every affected package, the vulnerable ranges, and the fix.
npx githits vulns CVE-2020-8203
After the GitHits tools that help locate relevant code in open source we can finally introduce the true workhorse that the agents use to retrieve pinpoint context: read
githits.com/blog/read-source…
Olli-Pekka Heinisuo retweeted
From a startup founder: “it’s now a red flag for me if I don’t see side projects on someone’s resume / application, because it signals lack of autonomy. Because it’s now so trivial to build anything on the side, vs before.”
Olli-Pekka Heinisuo retweeted
GitHits now works on Googlesource repos and Dart packages.
Point it at any go.googlesource.com repo. We asked Research when an oauth2 token counts as expired: 10 seconds before its actual expiry, cited to token.go.
Dart works too. Grep on pub:[email protected] is pinned to the exact v1.2.2 tag. Live in the CLI and MCP 0.38.1.
Olli-Pekka Heinisuo retweeted
lodash 4.17.21 shipped with no release notes. It's also the release that fixed a command injection bug in _.template.
GitHits now generates release notes from commits when none are published, and it flagged that fix as a security change.
Run githits pkg changelog npm:[email protected] and see for yourself.
Olli-Pekka Heinisuo retweeted
"You don't need a 5 trillion parameter model to write a JSON object."
Nathan Burg (@NathanBurg) on where agent tokens go: writing queries. So @GitHits_com is building small specialized models just for that.
The next event is on the calendar: lu.ma/oss4ai
#AIAgents
After search, the next GitHits deep dive is the one everyone knows: grep githits.com/blog/grep-find-e…
