September 2026
This Week in Package Management: 26 September 2026
Releases, advisories, and articles from across the package management world
Package Manager Sandboxing
A survey of sandbox usage across package manager clients.
Unfinished Work in Package Security
Some assembly required.
Package Manager Threat Model, Revisited
Path traversal via a manifest field appeared in eight of ten package managers audited and thirty-three times in four months of everyone else's advisories.
This Week in Package Management: 19 September 2026
Releases, advisories, and articles from across the package management world
Good Morning, Your Toaster Is Compromised
Rise & Grind goes live to the software supply chain.
Shadowing the Standard Library
export PYTHONSAFEPATH=1
This Week in Package Management: 12 September 2026
Releases, advisories, and articles from across the package management world
Package Manager Trends
min-release-age, minimum-release-age, -Zmin-publish-age, cooldown.
What's new in git-pkgs
Small Go modules for people who build package-manager tooling.
This Week in Package Management: 5 September 2026
Releases, advisories, and articles from across the package management world
How much should you trust your OSS data?
Every second, open source shapes our software, yet our view of this ecosystem is surprisingly opaque. How much can you really trust OSS data?
Git Submodules as a Package Manager
.gitmodules is a manifest and the gitlink is a lockfile entry.