package management

Bilingual

Package Name Prefixes
2 months ago
- PEP 752 reserves package name prefixes on PyPI to prevent impersonation, allowing only the grant holder to publish new packages under that prefix, with existing packages grandfathered.
- Common prefixes like django- (17,450 packages), flask- (2,815), and pytest- (2,137) are used by many authors under open conventions, raising questions about the impact of prefix reservation.
- Comparing registries, between 32% and 70% of packages share a first token with others, highlighting the prevalence of prefix patterns across ecosystems.
- Open plugin conventions (e.g., django-, react-, jekyll-) are the largest category among major prefixes, while generated SDK families (e.g., google-cloud-, aws-sdk-) are also significant.
- Bulk publication and tutorial derivatives (e.g., topsis- with 1,999 packages) contribute to many prefixes, and the companion PEP 755 will define who can apply for reserved prefixes, including for popular open-convention ones.
Content addressing in package managers
2 months ago
- Content addressing uses cryptographic hashes to identify data, enabling integrity verification, deduplication, and tamper evidence across package management systems.
- Hashing occurs at multiple levels: individual files, single artifacts, dependency graphs, package versions, registry indices, metadata, and build inputs, each with specific use cases.
- Identical extracted content can produce different hashes due to archive metadata; solutions include canonical formats (e.g., Nix NAR) or hashing file trees directly (e.g., Go's dirhash).
- Hash function choice and encoding vary (e.g., SRI, OCI sha256, go.sum h1:), and self-describing identifiers ease migration between algorithms.
- Hashes serve verification, addressing (fetch by hash), deduplication, build caching, and tamper evidence via Merkle structures, separating trust in names from trust in data delivery.
- Trust in the name-to-hash binding is critical; supply chain attacks exploit account takeover or typo-squatting rather than the hash itself.
Ad-Hoc Emacs Packages with Nix
2 months ago
- Nix can be used as an Emacs package manager to manage packages from MELPA or nixpkgs.
- Users can create ad-hoc packages for software not in MELPA, like inform7-mode, using trivialBuild.
- Nix handles commit pinning, security (SHA-256 hashes), and dependencies for custom packages.
- Examples of custom packaged modes include cabal-mode, xcompose-mode, eat, and lean4-mode.
- For packages needing non-ELisp files (like JSON), melpaBuild is used instead of trivialBuild.
- Nix offers a cleaner alternative to git submodules or Makefiles for vendoring Emacs packages.
PyPI now rejects new files after 14 days
2 months ago
- PyPI now rejects new files uploaded to releases older than 14 days to prevent poisoning of old releases if publishing tokens or workflows are compromised.
- The policy discussion began during PEP 740 (Digital Attestations) in January 2024 and was restarted after the LiteLLM and Telnyx packages were compromised in March 2026 due to a mutable reference in the Trivy GitHub Action.
- Some projects relied on the ability to add support for new Python versions to already-published releases, but a PyPI database query showed only 56 of the top 15,000 packages published a 3.14-compatible wheel more than 14 days after a release.
NPM's release cooldown is security theater
2 months ago
- Release cooldowns (e.g., 7 days for npm, 3 days for pnpm) are being adopted as a security measure, but they are ineffective and constitute security theater.
- The assumption that the community will vet packages during the cooldown is flawed: no one is incentivized to be the early adopter, leading to a situation where everyone waits for someone else (waiting for Godot).
- CI/CD pipelines that automatically update packages do not help because malicious code either goes unnoticed or succeeds before detection, and developers often install without scrutiny.
- The recommended solution is to actively scan and audit code (Do Your Own Research) using static analysis tools, sandboxes, HIPS, and LLM-assisted audits before installation.
Two new experimental MELPA channels
3 months ago
- MELPA introduced two new experimental channels: MELPA Snapshots and MELPA Releases, which will eventually replace the traditional MELPA unstable and stable channels.
- The new snapshots channel uses version strings in the format RELEASE.0.YYYYMMDD.COUNT to avoid the issue where snapshot versions incorrectly appear greater than release versions.
- MELPA now consults both git/mercurial tags and library headers to determine the latest release, increasing package coverage in the releases channel to 6207 packages.
- Package maintainers are advised to align version tags with library header bumps to ensure consistent release identification across different ELPAs.
- Users switching to the new snapshots channel must remove and reinstall packages due to version string changes, using specific configuration updates.
- MyELPA is introduced as a simplified project for publishing personal ELPAs, reducing the need to add all packages to MELPA and easing maintainer workload.
- Financial support for MELPA and related projects is requested from users who benefit from the work.
Zig: All Package Management Functionality Moved from Compiler to Build System
3 months ago
- Package management functionality moved from compiler to build system, improving modularity and allowing patching without compiler rebuild.
- SPIR-V backend progressed with new @SpirvType builtin, execution mode via calling convention, and multi-threaded codegen.
- New @bitCast semantics defined by logical bit layout, making behavior endian-agnostic and enabling new operations like integer to vector conversion.
- ELF linker improvements enable fast incremental compilation and linking with external libraries, though DWARF debug info support is pending.
- Build system reworked to separate configurer and maker processes, significantly speeding up build times and improving caching.
- Incremental compilation now works with LLVM backend, speeding up error feedback during development.
- Type resolution redesign made compiler lazier, improved dependency loop error messages, and enhanced incremental compilation.
- io_uring and Grand Central Dispatch std.Io implementations landed, allowing easy swapping of I/O implementations.
- Package management enhancements: dependencies stored locally in zig-pkg directory and --fork flag added for easy dependency forking.
- Windows standard library now prefers native ntdll APIs over kernel32 to avoid unnecessary overhead and improve reliability.
- zig libc project replaces C source files with Zig wrappers, reducing redundancy and improving optimization.
NixOS 26.05
3 months ago
- NixOS 26.05 "Yarara" has been publicly released.
- It will receive bugfixes and security updates until December 31, 2026.
- The previous release, 25.11 "Xantusia", is deprecated and will reach end-of-life on June 30, 2026.
- The release involved 2,842 contributors and 59,703 commits.
- Nixpkgs added 20,442 new packages, updated 20,641, and removed 17,532 outdated ones.
- NixOS added 85 new modules and 1,547 configuration options, while removing 25 modules and 355 options.
- Stage 1 (initrd) now uses systemd by default, deprecating the old scripted implementation.
- This is the last Nixpkgs release to support x86_64-darwin, with support ending in late 2026.
- GNOME has been updated to version 50 "Tokyo" with accessibility and display improvements.
- GCC is updated to version 15, while LLVM remains at version 21.
Zig – SPIR-V Backend Progress
3 months ago
- Package management functionality moved from compiler to build system, improving safety and allowing easier patching.
- SPIR-V backend updated with new @SpirvType builtin, execution mode handling via calling convention, and multi-threaded codegen.
- @bitCast semantics redefined to use logical bit layout, making operations endian-agnostic and more consistent.
- ELF linker improvements support fast incremental compilation and can build the self-hosted Zig compiler with LLVM and LLD.
- Build system reworked to separate configurer and maker processes, speeding up builds and enabling better caching.
- io_uring and Grand Central Dispatch std.Io implementations added for experimental evented I/O.
- Package management enhancements include local zig-pkg directory and --fork flag for easier dependency management.
- Windows standard library prefers native ntdll APIs over kernel32 to avoid overhead and improve reliability.
- zig libc project replaces vendored C code with Zig wrappers, reducing dependency on third-party projects.

package management

Package Name Prefixes

Content addressing in package managers

Ad-Hoc Emacs Packages with Nix

PyPI now rejects new files after 14 days

NPM's release cooldown is security theater

Two new experimental MELPA channels

Zig: All Package Management Functionality Moved from Compiler to Build System

NixOS 26.05

Zig – SPIR-V Backend Progress