package-managers

Bilingual

This Week in Package Management: 11 July 2026
2 months ago
- npm 12.0.0 defaults git and remote dependencies to none, removes npm shrinkwrap, and errors on unknown config.
- pnpm 11.10 adds _auth setting for CI credentials; 11.11 adds access command and fixes path traversal vulnerabilities.
- uv 0.11.28 hardens ZIP handling; 0.11.27 improves resolver performance with SIMD and caching.
- Go 1.26.5 and Rust 1.97.0 release with security fixes and new Cargo features.
- Security fixes: opam 2.5.2 fixes symlink traversal, pnpm fixes path traversals, ORAS fixes relative hardlink.
- Packagist makes versions immutable; article warns against trusting Trusted Publishing as safety signal.
- PyPI transparency logs proposal, Git 2.55 features, and study on GitHub SBOM completeness.
git's –end-of-options Flag
2 months ago
- Git's --end-of-options flag, introduced in 2019, marks the end of option parsing for revisions, distinct from -- which separates revisions from pathspecs.
- Argument injection (CWE-88) occurs when untrusted strings starting with a dash are passed as arguments to git, hg, or ssh, even without a shell involved.
- Only one of 17 package managers that fork git uses --end-of-options; others rely on -- or dash checks, often added as vulnerability fixes.
- Minimum git version requirements for --end-of-options vary by subcommand, with support ranging from 2.24.0 to 2.43.1, making adoption challenging for older distributions.
- Git libraries like libgit2 avoid argument injection by not using an argv interface, but must track all checkout-safety patches from upstream git.
Dependencies should be fetched directly from VCS
3 months ago
- Go's dependency management uses URLs to fetch directly from VCS, enhancing security by avoiding a separate package publishing step.
- Ruby and other package managers (like npm) rely on published packages (.gem, .tar.gz), which are harder to audit due to lack of commit history and potential for tampering.
- Auditing Go dependencies is easier: review commit logs via git, while auditing RubyGems requires downloading and diffing package files, a more cumbersome process.
- Recent security incidents (e.g., npm compromises, xz exploit) often involve injecting malicious code during the package publishing step, not the source repo.
- The author suggests modifying Ruby's Bundler to enforce fetching dependencies directly from git to improve transparency and auditing, mimicking Go's approach.

package-managers

This Week in Package Management: 11 July 2026

git's –end-of-options Flag

Dependencies should be fetched directly from VCS