2 months ago
- npm 12.0.0 defaults git and remote dependencies to none, removes npm shrinkwrap, and errors on unknown config.
- pnpm 11.10 adds _auth setting for CI credentials; 11.11 adds access command and fixes path traversal vulnerabilities.
- uv 0.11.28 hardens ZIP handling; 0.11.27 improves resolver performance with SIMD and caching.
- Go 1.26.5 and Rust 1.97.0 release with security fixes and new Cargo features.
- Security fixes: opam 2.5.2 fixes symlink traversal, pnpm fixes path traversals, ORAS fixes relative hardlink.
- Packagist makes versions immutable; article warns against trusting Trusted Publishing as safety signal.
- PyPI transparency logs proposal, Git 2.55 features, and study on GitHub SBOM completeness.