# Package Manager Trends

I'm on holiday this week, so I'm phoning it in and doing a roundup of the trends I've seen across sixteen weeks of [This Week in Package Management](/search#weekly). Those posts are built from about eighty [RSS feeds](https://github.com/ecosyste-ms/package-managers-opml) and whatever I've boosted on Mastodon. The short version: the same defensive features keep shipping in tool after tool, and the same three bug classes keep getting fixed.

## Features

Release-age cooldowns appeared in more tools than any other feature: Deno [2.8](https://deno.com/blog/v2.8) added `min-release-age` to its `.npmrc` handling in May, and by early September equivalent gates had shipped in [Bundler](https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html), [npm](https://github.com/npm/cli/releases/tag/v11.17.0), [Yarn](https://github.com/yarnpkg/berry/releases/tag/%40yarnpkg%2Fcli%2F4.17.0), [mise](https://github.com/jdx/mise/releases/tag/v2026.6.3), [Hex](https://hex.pm/blog/hex-v25-released), [Mamba](https://github.com/mamba-org/mamba/releases/tag/2.9.0), and Cargo via the nightly [`-Zmin-publish-age`](https://github.com/rust-lang/rfcs/pull/3923) flag. Dependabot made a three-day cooldown its [unconditional default](https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0) in August. The interaction between cooldowns and security updates recurred as a special case: Dependabot, Renovate and Hex each added a way to lift the gate when an advisory is published against the held-back version. The [Nx compromise postmortem](https://nx.dev/blog/nx-console-v18-95-0-postmortem) noted an old pnpm ignoring `minimum-release-age`, and both [npm 12](https://github.com/npm/cli/releases/tag/v12.0.0) and [pnpm 12](https://pnpm.io/blog/whats-different-in-pnpm-12) now error on unrecognised config keys rather than skip them.

Install-script blocking became the default in the JavaScript tools. npm 12 [blocks lifecycle scripts by default](https://github.com/npm/cli/releases/tag/v12.0.0) with an `allowScripts` allowlist, [Bun 1.4](https://bun.com/blog/bun-v1.4) restricts auto-trust to packages fetched from the npm registry, and pnpm extended `allowBuilds` to [git-hosted dependencies](https://github.com/pnpm/pnpm/releases/tag/v11.11.0). Related install-source restrictions shipped alongside: npm 12's `allow-git` and `allow-remote` [default to `none`](https://github.com/npm/cli/releases/tag/v12.0.0), and Composer 2.10 [disables](https://blog.packagist.com/composer-2-10-release/) the fallback from dist to source on download failure.

Malware checks at install and publish time shipped in Composer 2.10 (native filtering against [an Aikido-supplied feed](https://blog.packagist.com/composer-2-10-release/), on by default), uv (via [`UV_MALWARE_CHECK`](https://github.com/astral-sh/uv/releases/tag/0.11.22) and later a [config setting](https://github.com/astral-sh/uv/releases/tag/0.11.31)), and the npm registry, which now [scans at publish time](https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/) and can attach a `contentPolicy` verdict to package metadata. Five tools added or expanded a built-in audit command: [Deno](https://deno.com/blog/v2.8) (`deno audit fix`), [uv](https://astral.sh/blog/uv-audit) (`uv audit`, later `uv tool audit`), [Homebrew](https://github.com/Homebrew/brew/releases/tag/6.0.11) (`brew vulns` merged into core), [Bun](https://bun.com/blog/bun-v1.4) (`bun audit fix`), and [Hex](https://hex.pm/blog/hex-v25-released), which now surfaces advisories during `mix deps.get`.

pnpm and mise separated checked-in project config from machine-level trust across several releases each. pnpm progressively stopped project-level `.npmrc` and `pnpm-workspace.yaml` from [redirecting credentials](https://github.com/pnpm/pnpm/releases/tag/v11.4.0), [expanding environment variables](https://github.com/pnpm/pnpm/releases/tag/v11.5.3), [influencing self-update](https://pnpm.io/blog/releases/11.15-11.19), or [relocating machine-level state directories](https://github.com/pnpm/pnpm/releases/tag/v11.22.0). mise made [`credential_command` global-only](https://github.com/jdx/mise/releases/tag/v2026.6.5), added a [`MISE_SAFE=1` inert-reader mode](https://github.com/jdx/mise/releases/tag/v2026.7.12), and Renovate [adopted it](https://github.com/renovatebot/renovate/releases/tag/43.282.0) for lockfile updates.

pnpm made [tarball integrity mismatch a hard failure](https://github.com/pnpm/pnpm/releases/tag/v11.4.0) and started [rejecting lockfile entries missing an `integrity` field](https://github.com/pnpm/pnpm/releases/tag/v10.34.1), while uv 0.12 [enforces `--require-hashes`](https://github.com/astral-sh/uv/releases/tag/0.12.0) and refuses MD5-only sources. [Bun 1.4](https://bun.com/blog/bun-v1.4) records SHA-512 for GitHub and tarball dependencies.

Registry-side controls tightened at npm (staged publishing, [2FA-bypass token restrictions](https://github.blog/changelog/2026-07-31-restricting-npm-bypass-2fa-granular-access-tokens)), Packagist ([immutable versions](https://blog.packagist.com/immutable-versions-on-packagist/), transparency log), PyPI ([rejecting new files](https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days) added to releases older than fourteen days), NuGet.org ([API key lifetime cut](https://devblogs.microsoft.com/dotnet/strengthening-nuget-supply-chain-security-reducing-api-key-lifetime/) from 365 to 30 days), and AUR, which [disabled orphaned-package adoption](https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/message/DRDEU3JUSC72CB265XHXPFA3DFSLXPBP/) after two takeover incidents starting with [`alvr`](https://ioctl.fail/preliminary-analysis-of-aur-malware/).

Outside the security cluster, workspace and monorepo support shipped or graduated in [PDM](https://github.com/pdm-project/pdm/releases/tag/2.28.0), [Conan](https://github.com/conan-io/conan/releases/tag/2.31.0), [pixi](https://github.com/prefix-dev/pixi/releases/tag/v0.73.0), [Hatch](https://github.com/pypa/hatch/releases/tag/hatch-v1.18.0), [uv](https://github.com/astral-sh/uv/releases/tag/0.11.31) and [mise](https://github.com/jdx/mise/releases/tag/v2026.7.0), and the pnpm 12 [Rust rewrite](https://pnpm.io/blog/releases/12.0) reached stable. GitHub Actions references started being treated as managed dependencies: [pnpm](https://pnpm.io/blog/releases/11.15-11.19), [Dependabot](https://github.com/dependabot/dependabot-core/releases/tag/v0.390.0) and [Renovate](https://github.com/renovatebot/renovate/releases/tag/44.30.3) each added update or lockfile support for workflow `uses:` entries.

## Vulnerabilities

Path traversal on archive extraction or install was fixed at least once in fourteen of the sixteen weeks, across uv, pnpm, RubyGems, Podman, Composer, Guix, opam, ORAS, Docker, Flatpak and Poetry. Symlinks pointing outside the target directory, `../` in package names or lockfile keys, hardlinks with relative targets, and `bin` entries resolving outside the package all appeared. pnpm alone shipped four separate traversal fixes; Docker shipped three and Composer two.

Credentials sent to the wrong host or output came up almost as often: [Cargo 1.96](https://blog.rust-lang.org/2026/05/25/cve-2026-5222/) fixed authentication against normalised registry URLs; [Dependabot](https://github.com/dependabot/dependabot-core/releases/tag/v0.382.0) fixed npm registry credentials sent to sibling paths on the same host; [ORAS 1.3.4](https://github.com/oras-project/oras/releases/tag/v1.3.4) fixed mTLS certificates presented to any HTTPS peer, custom headers forwarded across origins, and pre-signed URLs logged in debug output; [Composer 2.10.3](https://github.com/composer/composer/releases/tag/2.10.3) fixed GitLab URL matching that could send credentials to the wrong domain; [Renovate](https://github.com/renovatebot/renovate/discussions/45495) disclosed four exfiltration paths via malicious `Link` headers and TLS private key exposure in logs. The RubyGems.org CDN [served one account's legacy API key to another](https://blog.rubygems.org/2026/07/22/security-advisory-legacy-api-key-leak.html) via a caching misconfiguration.

Command injection via a VCS URL or reference appeared in [pnpm](https://github.com/pnpm/pnpm/releases/tag/v11.4.0) (git commit field allowing `--upload-pack` injection), [Docker](https://github.com/moby/moby/releases/tag/docker-v29.6.2) (git bundle checkout), and [Composer](https://github.com/composer/composer/releases/tag/2.10.3) (Perforce URL). Four of the ten [Renovate advisories](https://github.com/renovatebot/renovate/discussions/45495) fell into this class as well.

## Sustainability

Alpha-Omega funded security-engineer residencies at the [PHP Foundation](https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/) and [Ruby Central](https://rubycentral.org/news/strengthening-security-for-the-ruby-ecosystem/), and the [Rust Foundation](https://blog.rust-lang.org/2026/06/02/launching-the-rust-foundation-maintainers-fund/) launched a Maintainers Fund that named its [first residents](https://blog.rust-lang.org/2026/08/26/announcing-our-first-maintainers-in-residence/) in August with backing from Google, AWS and OpenAI. The Sovereign Tech Agency [invested €508,640 in Flatpak](https://modal.cx/blog/announcing-flatpak-sta/) and appears in the new [Composer sponsorship programme](https://blog.packagist.com/announcing-the-composer-packagist-sponsorship-program/) via the PHP Foundation. NYU Tandon [launched](https://engineering.nyu.edu/news/nyu-tandon-launches-initiative-close-critical-gap-open-source-security-and-train-students-who) a Software Supply Chain Security Operations Center placing master's students in open source projects for year-long security work.

The Python Software Foundation announced the [first Python Packaging Council election](https://pyfound.blogspot.com/2026/06/packaging-council-inaugural-election.html), with seventeen candidates by mid-August. On the deprecation side, [Helm v3](https://helm.sh/blog/helm-v3-end-of-life) set an EOL schedule ending February 2027, [Go dropped Bazaar](https://go.dev/doc/go1.27) VCS support, pip [deprecated the legacy resolver](https://github.com/pypa/pip/releases/tag/26.2) for 2027 removal, the [Nixpkgs core team disbanded](https://discourse.nixos.org/t/the-nixpkgs-core-team-has-disbanded/79413), and [Maven 3.8.x](https://github.com/apache/maven/releases/tag/archive%2Fmaven-3.8.x) reached end of life.

---

By Andrew Nesbitt (https://nesbitt.io). Markdown version of https://nesbitt.io/2026/09/10/package-manager-trends.html