package-manager

vlt, a JavaScript package manager built by npm's original developers, ships 1.0 with hosted registries that block malware and phased installs that stop scripts from running automatically.

pnpm 12 replaces the package manager's TypeScript/Node.js implementation with Rust, with independent Vercel Turborepo testing showing median install-time cuts of 64.4% to 90.5%.

RPM 6.1.0 adds PKCS11 hardware-token signing and macro modifiers, the first release under a new versioning scheme modeled on the Linux kernel.

Bun 1.4, released August 20, is the first stable version built entirely on the runtime's contested Rust rewrite, delivering 30x faster package installs and 5x lower idle CPU usage.

CachyOS's August 2026 release rewrites the Shelly package manager from C# to Zig, moves the kernel-manager backend and Cachy-Update applet to Rust, and adds experimental Server Edition installer profiles.

Dependabot now waits three days before proposing new dependency versions by default. GitHub says the delay keeps freshly compromised releases out of update pull requests; security updates are exempt and repositories can opt out.

Bundler 4.0.13's cooldown filter excludes brand-new gem versions from dependency resolution to blunt supply-chain attacks that exploit the minutes after a malicious release.

GitHub's npm registry makes staged publishing generally available: packages must pass a human-approved, 2FA-gated queue before consumers can install them.

pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.