Signal
12 articles covering "package-manager"
Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.
pnpm 12.17.0 adds pnpm peers check --global, :prod, :optional and :peer override selectors, and Cargo and Python updates in pnpm outdated, per its release notes.
The first 1.14 alpha adds cancellation tokens for tasks, a Project.toml key that selects the syntax version, labeled blocks, and a new exact package resolver.
vlt, a JavaScript package manager built by npm's original developers, ships 1.0 with hosted registries that block malware and phased installs that stop scripts from running automatically.
pnpm 12 replaces the package manager's TypeScript/Node.js implementation with Rust, with independent Vercel Turborepo testing showing median install-time cuts of 64.4% to 90.5%.
RPM 6.1.0 adds PKCS11 hardware-token signing and macro modifiers, the first release under a new versioning scheme modeled on the Linux kernel.
Bun 1.4, released August 20, is the first stable version built entirely on the runtime's contested Rust rewrite, delivering 30x faster package installs and 5x lower idle CPU usage.
CachyOS's August 2026 release rewrites the Shelly package manager from C# to Zig, moves the kernel-manager backend and Cachy-Update applet to Rust, and adds experimental Server Edition installer profiles.
Dependabot now waits three days before proposing new dependency versions by default. GitHub says the delay keeps freshly compromised releases out of update pull requests; security updates are exempt and repositories can opt out.
Bundler 4.0.13's cooldown filter excludes brand-new gem versions from dependency resolution to blunt supply-chain attacks that exploit the minutes after a malicious release.
GitHub's npm registry makes staged publishing generally available: packages must pass a human-approved, 2FA-gated queue before consumers can install them.
pnpm 11's release candidate ships minimumReleaseAge=1 day, blockExoticSubdeps, and strictDepBuilds as defaults, baking lessons from the March 2026 Trivy and axios attacks into the package manager itself.