Hasty Briefsbeta

Bilingual

This Week in Package Management: 11 July 2026

2 days ago
  • npm 12.0.0 defaults git and remote dependencies to none, removes npm shrinkwrap, and errors on unknown config.
  • pnpm 11.10 adds _auth setting for CI credentials; 11.11 adds access command and fixes path traversal vulnerabilities.
  • uv 0.11.28 hardens ZIP handling; 0.11.27 improves resolver performance with SIMD and caching.
  • Go 1.26.5 and Rust 1.97.0 release with security fixes and new Cargo features.
  • Security fixes: opam 2.5.2 fixes symlink traversal, pnpm fixes path traversals, ORAS fixes relative hardlink.
  • Packagist makes versions immutable; article warns against trusting Trusted Publishing as safety signal.
  • PyPI transparency logs proposal, Git 2.55 features, and study on GitHub SBOM completeness.
About|Login