15 chart-topping hits about unpaid maintainers and overconfident AI agents. “I haven’t listened to it, but you’re absolutely right to release it.” MC OpenClaw 1. All Star (Maintainer’s Version) Smash Mouth: All Star The PRs start coming and they don’t stop coming, Bots keep shipping and the tests keep running. Only made sense to automate, Now I’m reviewing slop at a staggering rate. So much to mer

Releases, advisories, and articles from across the package management world This week’s package management news, gathered from the package manager OPML feed collection , my posts and boosts on Mastodon , and anything people sent me. The collection now includes the vlt blog and vlt CLI releases . Releases uv 0.13.0 makes Python 3.15 the default download, prefers native ARM64 interpreters on Windows

Which package management specs exist and where do they live? Package registries, manifest formats, lockfiles, version ranges and identifiers all have written specifications of some kind, spread across six kinds of venue. Specifications show up in package management mostly as an invisible layer of the dependency tree , where an HTTP library is built against RFC 9110 and a JSON parser against ECMA-4

Releases, advisories, and articles from across the package management world Week twenty of the roundup, built from the package manager OPML feed collection and whatever I’ve posted or boosted on Mastodon . Releases mise 2026.10.0 requires keyless cosign bundles to match a pinned signer identity and stops GitHub attestation workflow checks accepting partial matches. 2026.9.18 added an include key t

Notes from CodeCommons: SWHIDs, the SWH archive, and connecting both to package metadata. I spent Monday at the Software Heritage offices in Paris speaking at the CodeCommons plenary, and the slides are on GitHub . The talk was about connecting package identities to archived source code. Getting ready for it meant a couple of weeks poking at the SWH archive and its identifier scheme with a to-do l

Releases, advisories, and articles from across the package management world Week nineteen of the roundup, built from the package manager OPML feed collection and whatever I’ve posted or boosted on Mastodon . Releases pnpm 12.6 adds an autoDedupe setting that resolves compatible dependency versions to a single one during install, and pnpm add --save-types for the matching @types/* package. 12.7 has

A survey of sandbox usage across package manager clients. Homebrew 7.0.0 shipped on September 13th with “stronger sandboxing” in the opening line of the release notes. Installation is being split into a fetch phase that has network access and writable caches, and an install phase that runs offline with read-only caches. Sandboxed builds are blocked from reading your home directory by default. Cask

Path traversal via a manifest field appeared in eight of ten package managers audited and thirty-three times in four months of everyone else's advisories. I’ve spent a fair chunk of the last four months pointing the package manager CWE list and the threat model questions at real package managers, in some cases with help . Ten targets, mostly clients, a couple of registries, a mix of tools I’d used

Some assembly required. In May 2026, an Nx contributor installed a malicious dependency that had been published 77 minutes earlier. The repository had a seven-day cooldown configured, but its pinned pnpm version predated support for the setting. The client skipped the check and installed the package. The stolen credentials contributed to a malicious Nx Console extension release a week later. Packa

Releases, advisories, and articles from across the package management world Week eighteen of the roundup, built from the package manager OPML feed collection and whatever I’ve posted or boosted on Mastodon . I added nineteen feeds to the OPML this week, mostly project blogs, plus GNU Guix, Zig and the Reproducible Builds monthly reports. Releases Homebrew 7.0.0 overlaps package preparation with do