Record · corpus.blog/posts/01a08ccc-392f-708f-82ae-3ec83ae98ce4

Package Manager Trends

Andrew Nesbitt | Software Engineer and Package Management Nerd · published 10 September 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at nesbitt.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 63
Words captured: 903

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://github.com/ecosyste-ms/package-managers-opml

github.com

Deno 2.8 Read at the source ↗

deno.com

Cool down before you install: give new gems a few days to be vetted Read at the source ↗

blog.rubygems.org

https://github.com/npm/cli/releases/tag/v11.17.0

github.com

https://github.com/yarnpkg/berry/releases/tag/%40yarnpkg%2Fcli%2F4.17.0

github.com

https://github.com/jdx/mise/releases/tag/v2026.6.3

github.com

Hex v2.5 released Read at the source ↗

hex.pm

https://github.com/mamba-org/mamba/releases/tag/2.9.0

github.com

https://github.com/rust-lang/rfcs/pull/3923

github.com

https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0

github.com

Postmortem: Nx Console v18.95.0 supply-chain compromise Read at the source ↗

nx.dev

https://github.com/npm/cli/releases/tag/v12.0.0

github.com

What's different in pnpm 12 Read at the source ↗

pnpm.io

Bun 1.4 Read at the source ↗

bun.com

https://github.com/pnpm/pnpm/releases/tag/v11.11.0

github.com

https://blog.packagist.com/composer-2-10-release/

blog.packagist.com

https://github.com/astral-sh/uv/releases/tag/0.11.22

github.com

https://github.com/astral-sh/uv/releases/tag/0.11.31

github.com

https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/

github.blog

Vulnerability and malware checks in uv Read at the source ↗

astral.sh

https://github.com/Homebrew/brew/releases/tag/6.0.11

github.com

https://github.com/pnpm/pnpm/releases/tag/v11.4.0

github.com

https://github.com/pnpm/pnpm/releases/tag/v11.5.3

github.com

pnpm 11.15-11.19 Read at the source ↗

pnpm.io

https://github.com/pnpm/pnpm/releases/tag/v11.22.0

github.com

https://github.com/jdx/mise/releases/tag/v2026.6.5

github.com

https://github.com/jdx/mise/releases/tag/v2026.7.12

github.com

https://github.com/renovatebot/renovate/releases/tag/43.282.0

github.com

https://github.com/pnpm/pnpm/releases/tag/v10.34.1

github.com

https://github.com/astral-sh/uv/releases/tag/0.12.0

github.com

https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens

github.blog

https://blog.packagist.com/immutable-versions-on-packagist/

blog.packagist.com

Releases now reject new files after 14 days Read at the source ↗

blog.pypi.org

https://devblogs.microsoft.com/dotnet/strengthening-nuget-supply-chain-security-reducing-api-key-lifetime/

devblogs.microsoft.com

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/DRDEU3JUSC72CB265XHXPFA3DFSLXPBP/

lists.archlinux.org

Preliminary analysis of AUR malware Read at the source ↗

ioctl.fail

https://github.com/pdm-project/pdm/releases/tag/2.28.0

github.com

https://github.com/conan-io/conan/releases/tag/2.31.0

github.com

https://github.com/prefix-dev/pixi/releases/tag/v0.73.0

github.com

https://github.com/pypa/hatch/releases/tag/hatch-v1.18.0

github.com

https://github.com/jdx/mise/releases/tag/v2026.7.0

github.com

pnpm 12.0 Read at the source ↗

pnpm.io

https://github.com/renovatebot/renovate/releases/tag/44.30.3

github.com

https://blog.rust-lang.org/2026/05/25/cve-2026-5222/

blog.rust-lang.org

https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0

github.com

https://github.com/oras-project/oras/releases/tag/v1.3.4

github.com

https://github.com/composer/composer/releases/tag/2.10.3

github.com

https://github.com/renovatebot/renovate/discussions/45495

github.com

Security advisory: Possible leak of legacy API keys via improper cache configuration Read at the source ↗

blog.rubygems.org

https://github.com/moby/moby/releases/tag/docker-v29.6.2

github.com

https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/

thephp.foundation

https://rubycentral.org/news/strengthening-security-for-the-ruby-ecosystem/

rubycentral.org

https://blog.rust-lang.org/2026/06/02/launching-the-rust-foundation-maintainers-fund/

blog.rust-lang.org

Announcing our first Maintainers in Residence Read at the source ↗

blog.rust-lang.org

https://modal.cx/blog/announcing-flatpak-sta/

modal.cx

https://blog.packagist.com/announcing-the-composer-packagist-sponsorship-program/

blog.packagist.com

https://engineering.nyu.edu/news/nyu-tandon-launches-initiative-close-critical-gap-open-source-security-and-train-students-who

engineering.nyu.edu

Python Packaging Council Inaugural Election Dates Read at the source ↗

pyfound.blogspot.com

Helm 3 End of Life Read at the source ↗

helm.sh

https://go.dev/doc/go1.27

go.dev

https://github.com/pypa/pip/releases/tag/26.2

github.com

https://discourse.nixos.org/t/the-nixpkgs-core-team-has-disbanded/79413

discourse.nixos.org

https://github.com/apache/maven/releases/tag/archive%2Fmaven-3.8.x

github.com