Package manager feeds

Combined feed from package-managers-opml. 215 items from 83 feeds, generated 2026-09-06T04:30:14Z.

Sat 5 Sep 2026

Verdaccio releases v6.10.3

Patch Changes 98b58ef : fix: do not fetch client-controlled dist.tarball urls off-uplink Only fetch a tarball url that a configured uplink actually serves. Off-uplink urls are fetched without uplink credentials and only for uplink-synced packages (recorded in _distfiles ); a locally published package returns 404 instead of being fetched. Prevents sending an uplink Authorization header to an unrelated host.
NuGet Client releases 7.12.0.4

Insert 7.12.0.4 into main on 09/05/2026 12:17:09
Renovate releases 44.65.5

44.65.5 (2026-09-05) Build System deps: update dependency @renovatebot/pep440 to v5.0.1 (main) ( #45689 ) ( 2b4f433 )
Renovate releases 44.65.4

44.65.4 (2026-09-05) Build System deps: update dependency @renovatebot/pgp to v1.3.18 (main) ( #45727 ) ( f4c9195 )
Renovate releases 44.65.3

44.65.3 (2026-09-05) Bug Fixes deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.8 (main) ( #45726 ) ( 295d2e3 ) Miscellaneous Chores deps: update dependency memfs to v4.68.2 (main) ( #45725 ) ( 0a30d5b )
Poetry releases 2.4.3

Fixed Fix an issue where Poetry could not extract sdists on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 ( #11037 ).
Homebrew releases 6.0.22

What's Changed Use quarterly reports for role suggestions by @MikeMcQuaid in #23726 cask/audit: reject verified parameter on all casks by @AlternateRT in #23718 doctor: remove grep_v(String) from JSON output by @hyuraku in #23727 Target Intel Clang under Rosetta by @MikeMcQuaid in #23723 formula: update cargo fetch example by @cho-m in #23728 formula_creator: add deny network to some modes by @cho-m in #23730 formula_creator: add deny network for go and rust by @cho-m in #23734 bump-cask-pr: lo…
Bun releases Bun v1.4.2

To install Bun v1.4.2 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.2: bun upgrade Read Bun v1.4.2's release notes on Bun's blog Thanks to 3 contributors! @dylan-conway @jarred-sumner @robobun
Renovate releases 44.65.2

44.65.2 (2026-09-05) Build System deps: update dependency @renovatebot/detect-tools to v4.0.13 (main) ( #45718 ) ( b3977ea )
Renovate releases 44.65.1

44.65.1 (2026-09-05) Bug Fixes deps: update ghcr.io/renovatebot/base-image docker tag to v13.95.7 (main) ( #45717 ) ( 074020e ) Miscellaneous Chores deps: update dependency astral-sh/uv to v0.12.10 (main) ( #45714 ) ( cee2d1f ) deps: update dependency uv to v0.12.10 (main) ( #45715 ) ( 60e655e ) Build System deps: update dependency zod to v4.5.2 (main) ( #45716 ) ( 623793d )

Fri 4 Sep 2026

uv releases 0.12.10

Release Notes Released on 2026-09-04. Enhancements Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails ( #21423 ) Preview features Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature ( #21455 ) Show terminal dependency cycles in uv tree --invert output ( #21404 ) Performance Speed up locking large workspaces with conflicts by excluding…
Renovate releases 44.65.0

44.65.0 (2026-09-04) Features onboarding: note that vulnerabilityAlerts can be rate limited ( #45686 ) ( a806d2f ) Continuous Integration check TODOs for closed issues ( #45575 ) ( 26fe7b0 )
Renovate releases 44.64.3

44.64.3 (2026-09-04) Build System deps: update dependency @renovatebot/detect-tools to v4.0.12 (main) ( #45710 ) ( b380f44 )
Renovate releases 44.64.2

44.64.2 (2026-09-04) Build System deps: update dependency zod to v4.5.1 (main) ( #45709 ) ( 5717d3e )
Cabal releases cabal-head

No release body provided.
Verdaccio releases @verdaccio/[email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases @verdaccio/[email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases @verdaccio/[email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases @verdaccio/[email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases [email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases [email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases [email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases [email protected]

chore: update versions (next-9) ( #6189 )
Verdaccio releases [email protected]

chore: update versions (next-9) ( #6189 )
Renovate releases 44.64.1

44.64.1 (2026-09-04) Bug Fixes deps: promote tar to a prod dependency ( #45699 ) ( 5ee51fd ), closes #40250 #45697
pnpm releases pnpm 12.3.3

Patch Changes Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file #14353 . Sped up writing the lockfile in large workspaces #14352 . Sped up dependency resolution in large workspaces #14352 . pnpm now runs through Node.js when it was installed by a tool that skips build scripts, such as Vercel's packageManager provisioning, Bun, Deno, or npm install --ignore-scripts . Those installs previously failed with syntax error near unexpecte…
pnpm releases pnpm 12.3.4

Patch Changes Sped up dependency resolution in large workspaces #14352 . pnpm 12 now accepts the boolean settings as command-line flags on every command that takes them in pnpm 11, for example pnpm install --unsafe-perm , pnpm add foo --offline , and pnpm install --dangerously-allow-all-builds . pnpm 12 rejected them with unexpected argument , which failed every install on Vercel, whose build runs pnpm install --unsafe-perm #14346 . pnpm remove now accepts --unsafe-perm , the same flag pnpm ins…
Conda releases 26.7.2

Bug fixes Allow individual sharded-repodata package shards up to 64 MiB after decompression. ( #16575 ) Contributors @jezdez Full Changelog : 26.7.1...26.7.2
Renovate releases 44.64.0

44.64.0 (2026-09-04) Features preset: @octokit group preset ( #45643 ) ( 10c5232 )
Bun releases Bun v1.4.1

To install Bun v1.4.1 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.1: bun upgrade Read Bun v1.4.1's release notes on Bun's blog Thanks to 7 contributors! @alii @dylan-conway @jarred-sumner @jvitormelo @marshallofsound @robobun @sosukesuzuki
pnpm releases pnpm 12.3.2

Patch Changes pnpm audit --fix update no longer aborts when a vulnerable package has no safe version inside its declared range #14508 . The run updates every package it can and lists the rest as remaining. pnpm install no longer reruns root lifecycle scripts when the global virtual store contains an unfinished-build marker in a package slot that the current lockfile does not use pnpm/pnpm#14485 . Sped up installs that have no lockfile. pnpm now links packages whose dependency subtree has no pee…

Thu 3 Sep 2026

Docker Engine releases v29.8.0

29.8.0 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: docker/cli, 29.8.0 milestone moby/moby, 29.8.0 milestone New Add HostConfig.Umask option and a corresponding --umask <octal> flag to docker create / docker run to set the umask for a container's main process, execs, and healthchecks. moby/moby#53463 , docker/cli#7108 Add support for attaching service names, environments, and custom CloudWatch entity attributes to logs from the awslogs l…
Docker Engine releases v2.0.0-beta.23

v2.0.0-beta.23
Docker Engine releases v2.0.0-beta.22

v2.0.0-beta.22
Docker Engine releases client/v0.6.0

0.6.0 Changelog pkg/jsonmessage: add new WithMessagePrinter option to use a custom printer for messages. moby/moby#53489 api: Bump to 1.56. moby/moby#53425 minor cleanups, refactors. moby/moby#53509
Docker Engine releases api/v1.56.0

1.56.0 Changelog GET /containers/json now supports an annotation filter to filter containers by annotation, either by key ( annotation=key ) or by key and value ( annotation="key=value" ), similar to the existing label filter. moby/moby#53538 POST /containers/create now supports HostConfig.Umask to set the initial umask for a Unix container. When set, the daemon includes the value in the OCI process configuration for the container's entrypoint, exec processes, and healthchecks. When omitted, th…
pixi releases v0.79.0

[0.79.0] - 2026-09-03 ✨ Highlights Pixi now has better support for RISC-V by setting the default virtual packages. And we've extended the CLI to include pixi install --script and pixi workspace dependencies add . Added Add pixi workspace dependencies CLI by @ruben-arts in #6917 Install script environments without running by @manzt in #6923 Set __glibc default to 2.39 on linux-riscv64 by @pavelzw in #6914 Changed Restore static MSVC CRT in Windows builds by @baszalmstra in #6919 Documentation Me…
pixi releases pixi-build-ros-v0.7.5

chore: bump backend versions ( #6947 )
Snapd releases New release 2.77

Account for differences in names of the binaries in the snapd FIPS build Add code to calculate canonical subject name hash Add commands for debugging or accessing snap mount namespaces Add helpers for listing and iterating device mediation groups Add package ebpf with helpers wrapping eBPF exposed objects with dependency on github.com/cilium/ebpf Add secondary prerequisites task that acts as the synchronization point, which ensures that a snap's prerequisites are available before it's installed…
pub.dev releases 20260903t123900-all

Deployment at 2026-09-03T12:39:06.842287Z.
Snapd releases 2.77.1

tagging package snapd version 2.77.1
Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-09-01-a

Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-09-01-a
pnpm releases pnpm 12.3.1

Patch Changes Sped up installs in large workspaces: the anchor for re-rendering workspace link: targets is now derived once per project instead of once per dependency edge, and project ordering hashes paths by their raw bytes #14352 . After a self-update from pnpm 12.2 to 12.3, global commands such as node , npm , and yarn failed with unexpected argument '--shim' found . Global commands now launch normally, and their first launch migrates the global bin directory to native shims. When self-upda…
Rust Blog Announcing Rust 1.98.1

The Rust team has published a new point release of Rust, 1.98.1. Rust is a programming language that is empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup, getting Rust 1.98.1 is as easy as: rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website. What's in 1.98.1 Rust 1.98.1 fixes a miscompilation in vtable generation . In Rust 1.98.0, in some circumstances, rustc would…

Wed 2 Sep 2026

Podman releases v6.1.1

Security This release addresses CVE-2026-17106 , where a crafted tar archive could write outside the extraction directory through the use of malicious links ( GHSA-hfg8-hc9c-6c3h ). Bugfixes Fixed broken rootlessport bind behavior with -p 0.0.0.0:... -p [::]:... which failed instead of binding both v4 and v6 separately. Podman Machine on WSL should now correctly forward ports again by binding separate IPv4 and IPv6 sockets to make the WSL forwarder logic work again ( #29377 ).
pnpm releases pnpm 12.3

Minor Changes Every context-aware global command ( node , deno , bun , and the shims created with pnpm shim add ) is now a native executable on every platform, so environment variables whose names are not valid shell identifiers reach these commands. On Windows, <name>.exe replaces the .cmd and .ps1 shims for them. Shims written by earlier pnpm 12 releases are migrated on the next global install or self-update. pnpm remove and pnpm update now accept --trust-lockfile , --no-trust-lockfile , --tr…
Terraform releases v1.16.1

1.16.1 (September 2, 2026) BUG FIXES: cloud: Fixed a bug causing the CLI to pause indefinitely after a run task failure with pending policy evaluations ( #38751 ) Support referencing modules containing dynamic sources in Terraform Test ( #38950 ) stacks: Fixed validation to ensure the provider versions in the lock file and configuration are compatible. ( #38829 ) Fix panic when import identity references sensitive value ( #39013 ) import: Fixed a bug where import blocks would be ignored when mu…
mise releases v2026.9.1: Bootstrap firewall limiting, scoped locked mode, and lazy tools in tasks

This release expands bootstrap system setup with firewall rate limiting and more systemd directives, adds a scoped locked mode for mixing distribution and user tool policies, and fixes lazy tools so they install when invoked from tasks and mise x . Added bootstrap: New action = "limit" for incoming TCP firewall rules rate-limits connections per source. It maps to UFW's native limiting and bounded per-source IPv4/IPv6 nftables meters; firewalld fails closed since it cannot express safe per-sourc…
mise releases aqua-registry-v2026.9.0

Release aqua-registry 2026.9.0
mise releases vfox-v2026.9.1

Release vfox 2026.9.1
NuGet Client releases 7.12.0.3

Insert 7.12.0.3 into main on 09/02/2026 12:23:26
Composer releases 2.10.3

Security: Validate package bin paths against path traversal using symlinks ( GHSA-96h3-5x6v-m776 , CVE-2026-59944) Security: Fixed command injection via malicious Perforce url ( GHSA-rvx4-ffvw-m9q3 , CVE-2026-84361) Security: Sanitize URL-embedded usernames/token in a few more places ( #13044 ) Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain ( #12988 ) Fixed PHP 8.6 deprecation warnings ( #12967 , #13028 ) Fixed error output when a policy blocks a p…
Composer releases 2.2.30

Security: Validate package bin paths against path traversal using symlinks ( GHSA-96h3-5x6v-m776 , CVE-2026-59944) Security: Fixed command injection via malicious Perforce url ( GHSA-rvx4-ffvw-m9q3 , CVE-2026-84361) Security: Sanitize URL-embedded usernames/token in a few more places ( #13045 ) Security: Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain ( #13042 ) Full Changelog : 2.2.29...2.2.30
RubyGems releases v4.0.20

RubyGems 4.0.20 Enhancements: Print a release notes link instead of the whole changelog on gem update --system . Pull request #9794 by hsbt Installs bundler 4.0.20 as a default gem. Bug fixes: Only coerce exact true and false gemrc values to booleans. Pull request #9822 by hsbt Make the gem CLI work under RUBY_BOX=1. Pull request #9810 by hsbt Documentation: Document and test all available gemrc configuration keys. Pull request #9568 by junaruga Bundler 4.0.20 Enhancements: Avoid duplicate rela…
Go Blog Goroutine Leak Profiles

Go 1.27 includes new goroutine leak profiles.
RubyGems Blog 4.0.20 Released

RubyGems 4.0.20 includes enhancements, bug fixes and documentation and Bundler 4.0.20 includes enhancements, bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.20 RubyGems Release Notes Enhancements: Print a release notes link instead of the whole changelog on gem update --system . Pull request #9794 by hsbt Installs bundler 4.0.20 as a default…

Tue 1 Sep 2026

uv releases 0.12.9

Release Notes Released on 2026-09-01. Python Add CPython 3.15.0rc2 ( #21413 , #21415 ) Enhancements Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation ( #21408 ) Report the exact command-line lock-mode flag in warnings and errors ( #21402 ) Performance Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files ( #21372 ) Bug fixes Update async_http_range_reader to …
pipx releases 1.17.2

What's Changed Avoid KeyError in _REQUIRES_PYTHON_SCRIPT by @Cycloctane in #2026 Full Changelog : 1.17.1...1.17.2
Go releases [release-branch.go1.26] go1.26.8

Change-Id: Id4a4603dc387badef0164e9463093ccd636b67ac Reviewed-on: https://go-review.googlesource.com/c/go/+/825885 Reviewed-by: David Chase [email protected] TryBot-Bypass: Gopher Robot [email protected] Auto-Submit: Gopher Robot [email protected] Reviewed-by: Michael Pratt [email protected]
Go releases [release-branch.go1.27] go1.27.1

Change-Id: I14348d1dc655281274a8731f077ae62725175397 Reviewed-on: https://go-review.googlesource.com/c/go/+/825985 Reviewed-by: David Chase [email protected] Reviewed-by: Michael Pratt [email protected] TryBot-Bypass: Gopher Robot [email protected] Auto-Submit: Gopher Robot [email protected]
Homebrew releases 6.0.21

What's Changed Harden build prefix relocation of poured bottles by @MikeMcQuaid in #23667 Harden build prefix relocation of poured bottles by @MikeMcQuaid in #23670 Drop macOS Intel CI in Homebrew/core by @p-linnane in #23677 formula: use -Wno-author in std_cmake_args by @p-linnane in #23676 docs: update brew tap 's description by @AlternateRT in #23687 bundle/mac_app_store: Support upcoming mas 8.0.0 by @rgoldberg in #23690 Handle absent cask bundle version suffixes by @MikeMcQuaid in #23688 S…
mise releases v2026.9.0: Lazy Tool Shims

This release introduces lazy tool shims, which install a tool automatically the first time one of its commands is invoked, plus an opt-in Erlang precompiled OS override and a fix for nested mise calls during postinstall hooks. Added tools: Declare a tool as lazy in [tools] with lazy = true and mise generates bootstrap shims into its normal user/system shim farms. The provider is installed only when one of its commands is first called, then executes immediately; subsequent calls run the real bin…
mise releases vfox-v2026.9.0

Release vfox 2026.9.0
Conan releases 2.32.0 (31-Aug-2026)

Feature: Add basic LoongArch64 architecture support and host detection. ( #20288 ) Feature: Add support for Xcode 26.6 . ( #20280 ) Feature: Add support for gcc 16.2 . ( #20280 ) Feature: Parse reference attributes from --ref in workspace add . ( #20269 ) Feature: Add raise_on_errors=True arg to CommandAPI.run , it now raises on all errors returned by commands. ( #20266 ) Feature: XcodeToolchain now accepts arbitrary extra xcconfig settings via tc.build_settings , for build settings with no ded…
pnpm releases pnpm 12.2.1

Patch Changes Restored the pnpm executable target without a file extension so pnpm 12.1 and earlier can upgrade to newer pnpm 12 releases on POSIX systems. Platinum Sponsors Gold Sponsors
Pub releases SDK-3.14.0-184.0.dev

SDK 3.14.0-184.0.dev
Pub releases SDK-3.14.0-183.0.dev

SDK 3.14.0-183.0.dev
Pub releases SDK-3.14.0-182.0.dev

SDK 3.14.0-182.0.dev
Pub releases SDK-3.14.0-181.0.dev

SDK 3.14.0-181.0.dev
pnpm releases pnpm 12.2

Minor Changes Catalogs can now resolve workspace dependencies through the workspace: protocol. Patch Changes Fixed pnpm audit --fix failing with ERR_PNPM_INVALID_FIX_OPTION when used without a value, including when another flag follows it, as in pnpm audit --fix --json #13261 . Fixed pnpm audit --fix=override ignoring the saveExact and savePrefix settings when writing vulnerability overrides #11523 . Authenticate Node.js runtime downloads from nodeDownloadMirrors with URL-scoped npm registry cr…
Rust Blog Announcing rustup 1.29.1

The rustup team is happy to announce the release of rustup version 1.29.1. Rustup is the recommended tool to install Rust , a programming language that empowers everyone to build reliable and efficient software. What's new in rustup 1.29.1 The headlines of this release are: Concurrency in certain rustup operations has been improved: When running rustup update , rustup will first check for possible updates in parallel. pr#4752 When running rustup component add with multiple components, they will…

Mon 31 Aug 2026

pnpm releases pnpr 0.1.0-alpha.10

Patch Changes A shared build artifact publication that cannot unregister itself no longer stops the registry reclaiming space or refusing further publications. A publication says at intervals that it is still working, and a registration that has gone quiet for an hour is written off, so a publication whose bookkeeping write failed stops holding back the collector that reclaims unreferenced blobs and returns the compatibility scopes a failed publication claimed, and stops counting toward the lim…
Helm releases Helm v3.22.0-rc.1

Helm v3.22.0-rc.1 is a pre-release. It is to help gather feedback from the community as well as give users a chance to test Helm in staging environments before v3.22.0 is officially released. The official changelog will come out with the v3.22.0 release. For now, you can see the commit changes from v3.21.4 here . The community keeps growing, and we'd love to see you there! Join the discussion in Kubernetes Slack : for questions and just to hang out for discussing PRs, code, and bugs Hang out at…
uv releases 0.12.8

Release Notes Released on 2026-08-31. Enhancements Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all ( #21368 ) Preview features Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature ( #21327 ) Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files ( #21340 ) Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (…
Helm releases Helm v4.3.0-rc.1

Helm v4.3.0-rc.1 is a pre-release. It is to help gather feedback from the community as well as give users a chance to test Helm in staging environments before v4.3.0 is officially released. The official changelog will come out with the v4.3.0 release. For now, you can see the commit changes from v4.2.4 here . The community keeps growing, and we'd love to see you there! Join the discussion in Kubernetes Slack : for questions and just to hang out for discussing PRs, code, and bugs Hang out at the…
opam releases 2.6.0~beta2

This is the second beta release of opam 2.6.0. Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92 ). To verify the authenticity of one of these files, run the following commands: curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp gpg --import opam-dev-pubkey.pgp gpg --verify *.sig Please see our blog post for more details and the upgrade instructions. Changelog : Changes Install Fix a performance regression where opam pro…
CPAN Meta releases 2.150015

v2.150015
Dependabot Core releases v0.394.0

What's Changed Remove enable_corepack_for_npm_and_yarn and preserve direct execution by @ruben-pachecocaldera with @Copilot in #15945 Remove enable_private_registry_for_corepack flag and make private-registry corepack env permanent by @ruben-pachecocaldera with @Copilot in #15946 Nix: lock the selected revision by @JamieMagee in #15984 Remove allow_refresh_for_existing_pr_dependencies feature flag by @ruben-pachecocaldera with @Copilot in #15947 Remove allow_refresh_group_with_all_dependencies …
mise releases v2026.8.16: Command wrappers and Windows shell fixes

This release adds configurable command wrappers for intercepting ordinary commands, alongside a batch of shell and PATH fixes that make Windows activation more reliable and clearer upgrade and error messaging. Added shims: New [wrappers] config lets you intercept an ordinary command name with a different command, arguments, and environment. Wrappers take precedence over mise-managed tools, and mise strips its dispatch directories before delegating so the underlying tool still resolves from mise…
mise releases vfox-v2026.8.21

Release vfox 2026.8.21
Swift Package Manager releases swift-DEVELOPMENT-SNAPSHOT-2026-08-30-a

Tag build swift-DEVELOPMENT-SNAPSHOT-2026-08-30-a

Sun 30 Aug 2026

mise releases v2026.8.15: Dotfiles diff and capture, scoped config updates, and per-tool postinstall hooks

This release expands the dotfiles/bootstrap workflow with previews, bulk capture, git-tracked manifests, and profile reconciliation, adds scoped config collection updates and per-tool postinstall hooks, and rounds it out with a large batch of fixes across tasks, schema validation, Windows, lockfiles, and shims. Highlights Dotfiles management grows a full preview-and-capture workflow: mise bootstrap dotfiles diff , bulk add --changed , git-tracked directory manifests, and automatic reconciliatio…
CPAN Meta releases 2.150014

v2.150014
mise releases vfox-v2026.8.20

Release vfox 2026.8.20
mise releases mise-cache-core-v2026.8.9

Release mise-cache-core 2026.8.9
pipx releases 1.17.1

What's Changed tests: make utils_temp_dir work without symlink privilege by @iam-kira in #2023 fix(environment): report PIPX_MAX_LOGS by @dylanpulver in #2024 👷 test: keep the suite off the real internet by @gaborbernat in #2025 New Contributors @iam-kira made their first contribution in #2023 @dylanpulver made their first contribution in #2024 Full Changelog : 1.17.0...1.17.1
Maven releases archive/maven-3.8.x: Archive maven-3.8.x branch (EOL)

The 3.8.x release stream reached end-of-life; see dev@ discussion: https://lists.apache.org/thread/2t99pftq06j25rq7j3h1l0z5xsn57z6b This tag preserves the branch's final state (last real content is the maven-3.8.9 release plus the automatic next-development-iteration bump) before the branch itself is removed.
Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-28-a

Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-28-a
Pub releases SDK-3.14.0-180.0.dev

SDK 3.14.0-180.0.dev

Sat 29 Aug 2026

Poetry releases 2.4.2

Fixed Fix an issue where Poetry installs an artifact that is not listed in the lockfile when the package source does not provide a hash for this artifact ( #11030 ). Fix a path traversal vulnerability when downloading files from a compromised URL and/or package source ( #11029 ). Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory ( #11027 ).
pnpm releases pnpm 11.25

Minor Changes Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally. Configure it with the new remoteSideEffectsCache setting. A workspace names the eligible organization and packages ; everything describing the act of signing — publish , keyId , builderId , trustedKeys , privateKey and the provenance fields — is refused…
pnpm releases pnpm 12.1

Minor Changes pnpm login and pnpm adduser now record the granted token in the global config.yaml , under the _auth setting, with --scope 's scope routed to that registry under registries . pnpm logout removes it from there, and still from an auth.ini an earlier version wrote. Tokens already in auth.ini keep working. A scope set in a project's pnpm-workspace.yaml is now ignored, with a warning naming where to set it instead. pnpm login records the scope as a @scope:registry route in the machine-…
PDM releases v2.29.0

Features & Improvements Export editable local dependencies with relative paths in requirements files. ( #3294 ) Extend pdm run with --env , --env-file and --working-dir options to set or override the corresponding script options dynamically. ( #3829 ) Bug Fixes Restrict a locked package to the platform it was resolved for when it doesn't belong to every lock target, so pdm lock --platform ... --append no longer adds entries that get installed on the other targets. ( #3261 ) Keep Poetry include …
pipx releases 1.17.0

Release 1.17.0
Pub releases SDK-3.14.0-179.0.dev

SDK 3.14.0-179.0.dev
Pub releases SDK-3.14.0-178.0.dev

SDK 3.14.0-178.0.dev
Pub releases SDK-3.14.0-177.0.dev

SDK 3.14.0-177.0.dev
Pub releases SDK-3.14.0-176.0.dev

SDK 3.14.0-176.0.dev
Pub releases SDK-3.14.0-175.0.dev

SDK 3.14.0-175.0.dev
pnpm Blog pnpm 11.25

pnpm 11.25 replaces topological batches with a task scheduler, adds configurable
pnpm Blog pnpm 12.1

pnpm 12.1 brings the new workspace task scheduler to the Rust CLI, persists

Fri 28 Aug 2026

Docker Engine releases v29.8.0-rc.1

29.8.0-rc.1 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: docker/cli, 29.8.0 milestone moby/moby, 29.8.0 milestone Bug fixes and enhancements containerd image store: Fix docker image inspect reporting a smaller image size than docker image ls . moby/moby#53426 Do not log expected image signature identity misses as errors for containerd image store images. moby/moby#53495 dockerd now uses the embedded containerd if no system containerd ser…
Packagist Blog What's new in Private Packagist, August 2026 update

We've shipped a large batch of updates to Private Packagist over the past few months. A lot of our attention went to supply chain security, which we've covered in depth in our supply chain security series. In this post, we'll highlight the other improvements
Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-26-a

Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-26-a
pixi releases v0.78.0

[0.78.0] - 2026-08-28 ✨ Highlights You can now use the CLI to add path dependencies with the following command: pixi add --path ~ /dev/pixi pixi pixi add --path ~ /dev/vinca vinca --pypi pixi add --path ~ /dev/ros_ws/src/common/package.xml ros-jazzy-common Pixi now can also share the configuration with rattler-based tools like rattler-build and rattler-index . The PEP 723 script support has been improved with better caching and resolution of scripts. Added Write manifest platform names instead …
sbt releases 2.0.8

🐛 bug fixes fix: Fixes ThisBuild -scoped bare settings by @eed3si9n in #9674 fix: Fixes TestReportListener not receiving endGroup after a LinkageError by @unkarjedy in #9667 fix: Fixes the ability to extend TestResultLogger by @unkarjedy in #9655 fix: Fixes --addPluginSbtFile getting lost after reboot by @azdrojowa123 in #9669 fix: Fixes JDK 17 domain socket deadlocks by @eed3si9n in #9671 fix: Keep adhoc test classloader open in a forked test @stasimus in #9639 fix: Fixes Windows runner by @ee…

Thu 27 Aug 2026

uv releases 0.12.7

Release Notes Released on 2026-08-27. Python Replace managed Python installations when upgrading to a newer build of the same version ( #21323 ) Enhancements Support Linux s390x , ppc64le , and loongarch64 targets for cross-platform dependency resolution ( #21313 ) Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL ( #21318 ) Preview features Use content-based directory hashes to deduplicate extracted wheels…
ORAS releases v1.3.4

ORAS CLI v1.3.4 is a security-focused maintenance release. It scopes registry credentials — mTLS client certificates, custom --header values, and --debug trace output — strictly to the configured registry origin, and adds an opt-in --force copy mode for registries that report incomplete content as present. Highlights 🔒 Security: three credential-scoping advisories are fixed — mTLS client certificates ( GHSA-h3wm-jjqf-8jm2 ), custom request headers ( GHSA-whvf-jp7m-59f3 ), and --debug HTTP trace…
Flatpak releases 1.18.2

Bug fixes: Validate GVariant structure of summaries before using generated variant readers ( #6779 ) Fix crash in system helper when iterating cache directories ( #6780 ) Avoid corrupted output from non-UTF-8 characters in error messages ( #6795 ) Fix portal passing wrong file descriptor when sandbox-expose-fd-ro triggers fd remapping collision ( #6785 ) Fix system helper tracking wrong D-Bus sender for pulls ( #6781 ) Fix extensions not being populated in the sandbox due to unhandled EAGAIN fr…
OpenTofu releases v1.13.0-beta1

The v1.13.x release series is supported until August 1 2027 . 1.13.0 (Unreleased) UPGRADE NOTES: The "winrm" connection type for provisioners is no longer supported. ( #4012 ) This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this anymore. Modern Windows versions now support OpenSSH , and so we suggest that anyone currently rel…
Deno releases v2.9.6

2.9.6 / 2026.08.27 feat(compressible): add support for 'text/x-component' content type ( #36450 ) feat(desktop): clipboard api ( #35750 ) feat(desktop): support checked, icon, and tooltip on menu items ( #36649 ) fix(bundle): isolate esbuild downloads from workspace registries ( #36467 ) fix(cache): combine duplicate headers for Vary matching ( #36476 ) fix(cli_parser): remove orphaned sync-types parser fix(core): cap adaptive buffer initial allocations ( #36432 ) fix(core): make Unix pipe fd o…
Maven releases 3.10.0-rc-1

💥 Breaking changes Remove release-profile from super POM ( #11999 ) @slawekjaranowski Remove deprecated plugin management from super POM ( #11986 ) @slawekjaranowski 🚀 New features and improvements Feat: Align Maven 3.10.x and 4.0.x ( #12442 ) @cstamas Feat: Align CP ordering with Maven 4 ( #12327 ) @cstamas Feat: Apply latest Resolver 2.0.19 changes ( #12246 ) @cstamas Feat: Maven 3.10.x super POM ( #12032 ) @cstamas In failed build limit reactor summary to only failed modules ( #11977 ) @slaw…
NuGet Client releases 7.11.0.24

Insert 7.11.0.24 into main on 08/27/2026 12:32:03
Terraform releases v1.17.0-alpha20260827

1.17.0-alpha20260827 (August 27, 2026) NEW FEATURES: A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. ( #35290 ) ENHANCEMENTS: command/init: Enrich log messages with provider versions ( #38918 ) command/login: display warning after successful login if user is subject to an organization's TTL policy BUG FIXES: funcs: pow and log no longer panic when result is not a number ( #38912 ) ephemeral: Terraform will now use and display …
Homebrew releases 6.0.20

What's Changed generate-zap: resolve apps from package receipts by @loganrosen in #23623 cc shim: compare by canonicalizing both sides, fixing issues with symlinked HOMEs by @averms in #23637 pathname/disk_usage_extension: fix double path traversal by @krehel in #23632 Migrate analytics to brew.sh proxy by @SMillerDev in #23639 Add brew tests --load-only and break the install require cycle by @p-linnane in #23642 Run privileged cask install steps in the parent process by @p-linnane in #23641 Dr…
Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-25-a

Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-25-a

Wed 26 Aug 2026

npm CLI releases libnpmpack: v9.1.13

9.1.13 (2026-08-25) Bug Fixes 83b750d #9916 exempt explicit pack targets from allow-directory ( #9916 ) (@github-actions[bot], @ychampion , @ychampion )
npm CLI releases v11.19.1

11.19.1 (2026-08-25) Bug Fixes 83b750d #9916 exempt explicit pack targets from allow-directory ( #9916 ) (@github-actions[bot], @ychampion , @ychampion ) Dependencies 4791b27 #9872 [email protected] ( @martinrrm , @Copilot) 823d647 #9872 [email protected] ( @martinrrm , @Copilot) 04f8efe #9872 [email protected] ( @martinrrm , @Copilot) 1610280 #9842 [email protected] ( #9842 ) ( @martinrrm , @Copilot) workspace : [email protected]
Terraform releases v1.16.0

1.16.0 (August 26, 2026) NEW FEATURES: Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. ( #37986 ) terraform_data : The new store block can hold ephemeral and sensitive values across plan and apply. ( #38298 ) Providers can now use nested blocks as computed values ( #38305 ) import: import blocks inside modules are now supported. ( #38352 ) Terraform is now available as a pre-built binary for Linux s390x (zLinux). (…
NuGet Client releases 7.11.0.23

Insert 7.11.0.23 into main on 08/26/2026 12:40:13
Go Blog Generic Methods

Go 1.27 adds generic methods—a highly desired language feature.
Rust Blog Announcing our first Maintainers in Residence

We are very happy to announce the Rust Project's first round of Maintainers in Residence: Gen Li ( @rami3l ), Chris Denton ( @ChrisDenton ), Alejandra González ( @blyxyas ), León Liehr ( @fmease ), and Maintainer Grant recipients: Jason Newcomb ( @Jarcho ) and Jonas Böttiger ( @joboet ). These contributors will be funded for their rust-lang maintenance activities for (at least) the following 12 months! The funding of the Maintainer in Residence (MiR) and Maintainer Grantee roles is possible tha…
pnpm Blog pnpm 12.0

pnpm 12 is stable. It is a rewrite of pnpm in Rust. Upgrading should not feel like a migration. The commands, flags, settings, and lockfile format of pnpm 11 all carry over. The documentation now defaults to pnpm 12, with the pnpm 11 documentation available from the version selector.

Tue 25 Aug 2026

uv releases 0.12.6

Release Notes Released on 2026-08-25. Python Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295 ) Enhancements Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links ( #21261 ) Limit warnings about unbounded uv_build requirements to source-distribution builds ( #21078 ) Display byte counts below 1 KiB without a fractional part ( #21237 ) Preview features Add uv workspace metadata --sync --exact to remove packages outside the selected r…
MacPorts releases MacPorts 2.12.6

Changes since 2.12.5: Fixed potential unreliable application of network proxy settings with background fetches. (jmr in 6d9edb0 ) Fixed occasional failure to sync the PortIndex, which required portindex to run locally. (fhgwright in 928dc47 ) Added documentation for the 'none' option for 'port select'. (cvengler in 1552e82 ) Various reliability improvements for trace mode. (cal in 6dda4cc , 1db3e7f , bea36d7 )
NuGet Client releases 7.11.0.17

Insert 7.11.0.17 into main on 08/25/2026 12:30:54
pipx releases 1.16.8

Release 1.16.8

Mon 24 Aug 2026

winget releases Windows Package Manager 1.29.290

This is a servicing release of Windows Package Manager v1.29. If you find any bugs or problems, please help us out by filing an issue . New in v1.29 New Feature: Source Priority Note Experimental under sourcePriority ; defaulted to disabled. With this feature, one can assign a numerical priority to sources when added or later through the source edit command. Sources with higher priority are sorted first in the list of sources, which results in them getting put first in the results if other thin…
Dependabot Core releases v0.393.0

What's Changed Type common runtime boundaries by @JamieMagee in #15916 Type common provider clients by @JamieMagee in #15917 Type common repository fetching by @JamieMagee in #15918 Type common metadata boundaries by @JamieMagee in #15919 Type common pull request reads by @JamieMagee in #15920 Type common pull request writes by @JamieMagee in #15921 Bump erb from 6.0.1 to 6.0.1.1 in /updater by @dependabot [bot] in #14828 Bump erb from 6.0.1 to 6.0.1.1 by @dependabot [bot] in #14816 Terraform: …
pixi releases v0.77.1

[0.77.1] - 2026-08-24 Added Add pixi workspace preview subcommand by @ruben-arts in #6859 Update rattler, rattler-build, minijinja, and display channel notices by @wolfv in #6852 Add one consistent API for detecting host machine by @Hofer-Julian in #6864 Changed Use .mojoc with precompile by @sstadick in #6860 Render lists in the generated CLI docs by @Hofer-Julian in #6868 Documentation Fix lists that render as plain text by @Hofer-Julian in #6871 Add a social card for link previews by @Hofer-…
Snapd releases New release 2.76.3

FDE: support keyboard configuration at install-time for first-boot FDE: re-enable passphrases/PINs at install-time FDE: require volumes authentication if HWROT is missing FDE: bump secboot to rev 457b03a16d19 FDE: use new secboot API for reprovision TPM Cross-distro: modify SELinux policy to use init_named_socket_activation() for allowing systemd to start snapd through socket activation packaging: make sure that usr/bin/snap is built with correct build tags on debian sid Ensure profiles are set…
Snapd releases New release 2.76.2

interfaces: steam-support, docker-support | fix mountinfo denial Please note: the tarball generation did not happen in a pristine environment and as a result unintended content was incorporated which inflates the size.
Homebrew releases 6.0.19

What's Changed Set oldest GCC to 8 to enable -ffile-prefix-map by @cho-m in #23533 audit: resolve untapped core dependencies by @MikeMcQuaid in #23542 Skip duplicate /v2/ when artifact domain already contains it by @jouve in #23062 cli/parser: fix help crash with -- arguments by @krehel in #23544 sorbet: Add a Tapioca compiler for Cask::DSL to type some more tests by @issyl0 in #23534 Clarify outdated cask version display by @HaraldNordgren in #23543 cask/upgrade: mirror per-file quarantine app…
Gradle releases v9.8.0-M2

Defer signing wiring until projects are evaluated ( #38932 )
pnpm Blog pnpm 11.24

pnpm 11.24 brings back pnpm approve-builds --global, which isolated global installs took away in v11.0, and makes recursive batch publishing group its packages by registry so a credential mismatch is caught before anything is published. It also stops --frozen-lockfile from failing over the pnpm version the lockfile pins.

Sun 23 Aug 2026

pnpm Blog pnpm 11.23

pnpm 11.23 gives the registries setting a shape that describes each registry once — its tarball layout, the scopes routed to it, the prefix it answers to — so an Artifactory or GitLab registry can finally keep its tarball URLs out of pnpm-lock.yaml. It adds virtualStoreType, makes undeclared imports resolve under ESM with the global virtual store without a plugin, teaches pnpm config get to report the settings pnpm actually acts on, and warns about settings no pnpm version recognizes.

Sat 22 Aug 2026

Stack releases rc/v4.1.0.1 (release candidate)

Release notes: The change in major version from 3.x to 4.1 marks the introduction of Stack's support for GHC's Backpack module system for cross-package use. Changes since v3.11.1: Major changes: Stack now supports GHC's Backpack module system for cross-package use. (Private Backpack, where signatures and implementations are in the same package, was already supported.) When a package uses signatures and mixins to depend on an abstract interface provided by another package, Stack automatically cr…
opam releases 2.6.0~beta1

This is the first beta release of opam 2.6.0. Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92 ). To verify the authenticity of one of these files, run the following commands: curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp gpg --import opam-dev-pubkey.pgp gpg --verify *.sig Please see our blog post for more details and the upgrade instructions. Changelog : Changes Init Do not make opam init --reinit ask to retry the…
Swift Package Manager releases swift-DEVELOPMENT-SNAPSHOT-2026-08-21-a

Tag build swift-DEVELOPMENT-SNAPSHOT-2026-08-21-a
NuGet Client releases 7.11.0.16

Insert 7.11.0.16 into main on 08/22/2026 12:37:55

Fri 21 Aug 2026

DNF5 releases 5.4.3.0

=================================== !!!This release is broken - do not use!!! 5.4.3.0 unintentionally broke ABI (see #2869 for details) which crashes any application built against 5.4.2.1 or earlier when run against this release (e.g. PackageKit). Recommendation: skip 5.4.3.0 and upgrade directly to 5.4.4.0. ==================================== Update translations from weblate Port bootc functionality from DNF4 Add --[no-]allow-vendor-change option Warn when upgrades are silently skipped due to…
DNF5 releases 5.4.4.0

dnf5daemon-server: Validate locale strings Add systemd inhibitor lock plugin Add IPlugin2_2 plugin interface with cleanup hooks doc: Drop Sphinx <4 compatibility workarounds doc: Copy literalinclude sources into the processed dir doc: use version '1.2' in vendor change policy examples doc: Document vendor change policy config file version 1.2 vendor policy: Add cfg file version 1.2 with additional comparators Remove libdnf5::base::Transaction::persistence to restore ABI interaction_callbacks: a…
NuGet Client releases 7.11.0.14

Insert 7.11.0.14 into main on 08/21/2026 12:22:43
sbt releases 1.13.0

⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp , an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug. Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. …
sbt releases 2.0.7

⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-943m-f264-54p4 from @stasimus that when the serverConnectionType is set to Tcp , an attacker is able to execute arbitrary code remotely via BSP, similar to a recent bug that was found in JSON-RPC. sbt 1.13.0 and 2.0.7 fix this bug. Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. …
sbt releases 1.12.15

⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-m2pw-22cj-jq4v from @arpitjain099 that when the serverConnectionType is set to Tcp , an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug. We recommend removing the serverConnectionType setting, or upgrading to a patched version or later: Global / serverConnectionType := ConnectionType . Tcp The remediation was implemented by @eed3si9n and @anatoliykmetyuk…
sbt releases 2.0.6

⚠️ Remote code execution vulnerability fix sbt team received a security report GHSA-m2pw-22cj-jq4v from @arpitjain099 that when the serverConnectionType is set to Tcp , an attacker is able to execute arbitrary code remotely via the sbt server. sbt 1.12.15 and 2.0.6 fix this bug. Builds with the default serverConnectionType are not affected. In affected builds, we recommend removing the serverConnectionType setting, or upgrading to a patched version or later. In an affected build, the setting mi…
Rust Blog Enabling the next-generation trait solver on nightly

After nearly 4 years of active development, the next-generation trait solver is close to stabilization. We are enabling it by default on nightly to surface any remaining issues and plan to stabilize it in the next months. This is the largest single change to the Rust compiler since its initial release. It completely replaces how we prove where-clauses, normalize associated types, and much more. Please try out the latest nightly and open an issue if you encounter any bugs or regressions. This is…

Thu 20 Aug 2026

Cargo releases 0.99.0

0.99.0 release
Bun releases Bun v1.4

To install Bun v1.4 curl -fsSL https://bun.com/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.com/install.ps1|iex " To upgrade to Bun v1.4.0: bun upgrade Read the blog post : Thank you Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3. @190n @alanstott @alii @alinalihassan @amdad121 @ant-kurt @anthonybaldwin @avarayr @baboon-kin…
RubyGems releases v4.0.19

RubyGems 4.0.19 Enhancements: Reject SafeMarshal collection lengths longer than the remaining input. Pull request #9756 by hsbt Installs bundler 4.0.19 as a default gem. Bug fixes: Fix gem uninstall --user-install crash when GEM_HOME does not exist. Pull request #9749 by hsbt Documentation: Document SPDX license handling for license= and licenses=. Pull request #9766 by hsbt Bundler 4.0.19 Enhancements: Validate the platform field in Gem::Installer#verify_spec. Pull request #9780 by hsbt Restri…
RubyGems Blog 4.0.19 Released

RubyGems 4.0.19 includes enhancements, bug fixes and documentation and Bundler 4.0.19 includes enhancements, bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.19 RubyGems Release Notes Enhancements: Reject SafeMarshal collection lengths longer than the remaining input. Pull request #9756 by hsbt Installs bundler 4.0.19 as a default gem. Bug fi…
Rust Blog Announcing Rust 1.98.0

The Rust team is happy to announce a new version of Rust, 1.98.0. Rust is a programming language empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup , you can get 1.98.0 with: $ rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.98.0 . If you'd like to help us out by testing future releases, you might consider updating …
Rust Blog Supply chain attack on arrayref

What happened On 2026-08-20 at 7:15 UTC we got a report that the proc-macro1 crate was malicious. The Rust Security Response Team verified this to be the case: the crate had a build script that was downloading a malicious payload. This crate proc-macro1 and others like it ( proc-macro-en , aovine , arone , aronenao , tinymember ) have been deleted. Furthermore, we discovered that the popular arrayref crate had recently been republished and made to depend on this crate, with the most recent vers…

Wed 19 Aug 2026

Go releases [release-branch.go1.27] go1.27.0

Change-Id: I9ff6bc81cccdd7876e7b36c395151f70ab3ac654 Reviewed-on: https://go-review.googlesource.com/c/go/+/817701 Reviewed-by: Carlos Amedee [email protected] Auto-Submit: Gopher Robot [email protected] TryBot-Bypass: Gopher Robot [email protected] Reviewed-by: Dmitri Shuralyov [email protected]
Gradle releases 9.7.1

The Gradle team is excited to announce Gradle 9.7.1. This is a patch release for 9.7.0. We recommend using 9.7.1 instead of 9.7.0. Here are the highlights of 9.7.0 release: Isolated Projects graduates to incubating Broader Configuration Cache compatibility Resilient Sync helps you fix broken builds More source locations in problem reports Read the Release Notes We would like to thank the following community members for their contributions to this release of Gradle: Adam , Aman Gautam , Aman Kum…
Go releases [release-branch.go1.25] go1.25.14

Change-Id: I9e3fddf67829ff8d68e49f38b44e298327d554db Reviewed-on: https://go-review.googlesource.com/c/go/+/817740 Reviewed-by: Dmitri Shuralyov [email protected] Reviewed-by: Carlos Amedee [email protected] Auto-Submit: Gopher Robot [email protected] TryBot-Bypass: Gopher Robot [email protected]
Go releases [release-branch.go1.26] go1.26.7

Change-Id: Ia3e132d4c983f77f720a01d12ff0222a39d03c18 Reviewed-on: https://go-review.googlesource.com/c/go/+/817760 TryBot-Bypass: Gopher Robot [email protected] Reviewed-by: Carlos Amedee [email protected] Auto-Submit: Gopher Robot [email protected] Reviewed-by: Dmitri Shuralyov [email protected]
Terraform releases v1.15.9

1.15.9 (August 19, 2026) BUG FIXES: validate: Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. ( list , import , backend , and cloud ) ( #38994 ) NOTES: Update go-slug to v0.18.3 to mitigate CVE-2026-14978 , which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run ( #39036 )
NuGet Client releases 7.11.0.13

Insert 7.11.0.13 into main on 08/19/2026 12:48:29
Chocolatey releases 2.7.4

As part of this release we had 2 issues closed. Dependency Changes [Security] Upgrade log4net to 3.3.1 in chocolatey.lib. See #3915 by st3phhays , resolved in !3916 by st3phhays . [Security] Update bundled 7zip executables to 26.02. See #3918 by AdmiringWorm , resolved in !3924 by alexaveldanez . Contributors 3 contributors made this release possible.
Terraform releases v1.16.0-rc2

1.16.0-rc2 (August 19, 2026) NEW FEATURES: Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. ( #37986 ) terraform_data : The new store block can hold ephemeral and sensitive values across plan and apply. ( #38298 ) Providers can now use nested blocks as computed values ( #38305 ) import: import blocks inside modules are now supported. ( #38352 ) Terraform is now available as a pre-built binary for Linux s390x (zLinux…
OpenTofu releases v1.12.6

SECURITY ADVISORIES: When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ( #4422 ) When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the…
OpenTofu releases v1.11.14

SECURITY ADVISORIES: When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ( #4423 ) When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in th…
pixi releases pixi-build-mojo-v0.2.7

chore: bump backend versions ( #6863 )
Chocolatey releases 1.4.7

As part of this release we had 1 issue closed. Dependency Change [Security] Update bundled 7zip executables to 26.02. See #3928 by gep13 resolved in !3925 by alexaveldanez . Contributors 2 contributors made this release possible.
pub.dev releases 20260819t082900-all

Deployment at 2026-08-19T08:29:51.499574Z.
pixi releases v0.77.0

[0.77.0] - 2026-08-18 ✨ Highlights This release includes the API update for the backends such that we support pin-compatible and pin-subpackage specs in package manifests. For example: # Pin subpackage `mypkg` to the same version as the package itself, but allow any compatible version of `mypkg` to be used. [ package ] name = " mypkg " [ package . run-exports . weak ] mypkg = { pin-subpackage = { upper-bound = " x.x " } } # Pin `boltons` to a compatible version. [ package . host-dependencies ] …
Gradle releases v9.8.0-M1

Report invalid toolchain installation paths as warnings via Problems …
Go Blog Go 1.27 is released

Go 1.27 adds generic methods, encoding/json/v2 package, uuid package, faster memory allocation, goroutine leak profiles, and more.

Tue 18 Aug 2026

Conda releases 26.7.1

Bug fixes Fix DeprecationHandler version fallback when packaging raises InvalidVersion for unparseable versions (e.g. None under packaging >=26.3). ( #16495 ) Refresh cached empty channel notice responses and parse CEP 6 expires_at timestamps. ( #16500 , #16501 ) Fall back to threaded package extraction when process synchronization primitives are unavailable. ( #16512 ) Fix CondaHttpAuth.add_binstar_token mangling URLs that end in notices.json (or any filename without a platform subdir) by corr…
NuGet Client releases 7.11.0.12

Insert 7.11.0.12 into main on 08/18/2026 12:29:39
pixi releases pixi-build-ros-v0.7.4

chore: bump backend versions ( #6854 )
pub.dev releases 20260818t114400-all

Deployment at 2026-08-18T11:44:38.196169Z.
pixi releases pixi-build-rattler-build-v0.4.6

chore: bump backend versions ( #6845 )
pixi releases pixi-build-ros-v0.7.3

chore: bump backend versions ( #6845 )
pixi releases pixi-build-rust-v0.5.6

chore: bump backend versions ( #6845 )
PDM releases v2.28.2

Bug Fixes Keep environment inspection working for Python 3.9 targets when PDM uses dep-logic 0.7 or newer. ( #3838 ) Cache the update check timestamp even when the version lookup fails, so that pdm no longer appears to hang on every command when PyPI is unreachable. ( #3840 ) Don't crash with an IndexError when listing scripts and one of them is blank. A blank script is now listed as <BLANK_SCRIPT> . ( #3842 ) Keep the whole template URL when pdm new is given an ssh:// or credentialed Git URL, …
pnpm Blog pnpm 11.21-11.22

pnpm 11.21 and 11.22 teach pnpm install to update the lockfile in place for most everyday changes instead of re-resolving the whole dependency graph, stop recording SSH URLs that break installs on CI, make global installs switch over atomically and global interactive updates select whole install groups, add pnpm cache path, and take away a project's ability to relocate pnpm's machine-level state through pnpm-workspace.yaml.

Mon 17 Aug 2026

Dependabot Core releases v0.392.0

What's Changed Type shared Python requirement boundaries by @JamieMagee in #15837 Type Python requirement consumers by @JamieMagee in #15838 Type UV requirement access by @JamieMagee in #15839 Type Conda requirement access by @JamieMagee in #15840 Roll pub. Fix flutter/dart sdk constraint rewritten in lockfile by @svartalfheim in #15654 Use GitHub Artifact Attestations for container image signing by @codysoyland in #12116 Add artifact metadata permission by @JamieMagee in #15859 Bump the all-ac…
Harbor releases v2.15.2

Upgrade Notice: Internal PostgreSQL Upgrade Upgrading to Harbor v2.15.2 (Helm Chart v1.19.2) automatically updates the bundled internal database from PostgreSQL 15 to PostgreSQL 18 via pg_upgrade upon container startup. Action Items & Considerations Backup Data: Back up your database before applying the upgrade or restarting the database pod. Maintenance Downtime: pg_upgrade runs on pod startup and may temporarily extend initialization time depending on database size. Reindexing (Non-ASCII Data…
Homebrew releases 6.0.18

What's Changed Build and publish large runner docker image by @iMichka in #23345 Avoid nil cask versions during installation by @MikeMcQuaid in #23499 Use cask dependencies for platform support by @MikeMcQuaid in #23496 Fix role used to push to ECR by @iMichka in #23500 Report unavailable cask platforms accurately by @MikeMcQuaid in #23501 Add supported_platforms to cask API data by @p-linnane in #23503 cask: merge multiple conflicts_with stanzas by @hyuraku in #23506 Normalize hyphenated HOMEB…

Sun 16 Aug 2026

Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-14-a

Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-14-a

Sat 15 Aug 2026

Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-13-a

Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-13-a

Fri 14 Aug 2026

uv releases 0.12.5

Release Notes Released on 2026-08-14. Python Add CPython 3.10.21, 3.11.16, and 3.12.14 ( #21138 ) Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters ( #21134 ) Enhancements Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs ( #21130 ) Preview features Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature ( #17455 ) Include d…
APT releases 3.3.3

apt Debian release 3.3.3
Helm releases Helm v4.2.4

Helm v4.2.4 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! Join the discussion in Kubernetes Slack : for questions and just to hang out for discussing PRs, code, and bugs Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom Test, debug, and contribute charts: ArtifactHub/packages Notable Changes fix: Improve error reporting for helm template --debug with --show-only- #31185 by @kyokuping…
Helm releases Helm v3.21.4

Helm v3.21.4 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! Join the discussion in Kubernetes Slack : for questions and just to hang out for discussing PRs, code, and bugs Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom Test, debug, and contribute charts: ArtifactHub/packages Notable Changes fix(engine): prevent Files.Lines panic on empty file (backport to v3)- #32303 by @mahesh-sad…
Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-12-a

Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-08-12-a

Thu 13 Aug 2026

winget releases Windows Package Manager 1.30.100-preview

This is a preview build of WinGet for those interested in trying out upcoming features and fixes. While it has had some use and should be free of major issues, it may have bugs or usability problems. If you find any, please help us out by filing an issue . New in v1.30 --ignore-unavailable flag for install Added a new --ignore-unavailable flag to the install command. When installing multiple packages, this flag allows the operation to continue with the remaining packages instead of failing enti…
pipx releases 1.16.7

What's Changed 📄 docs: publish llms.txt from the docs build by @gaborbernat in #2000 🐛 fix(standalone): retry index fetch, resume dropped downloads by @gaborbernat in #2001 docs: correct the Windows default for PIPX_HOME by @aroh3006 in #2002 Handle multiple site-packages paths in virtual environments by @Cycloctane in #1999 New Contributors @aroh3006 made their first contribution in #2002 @Cycloctane made their first contribution in #1999 Full Changelog : 1.16.6...1.16.7
uv releases 0.12.4

Release Notes Released on 2026-08-13. Enhancements Prefer post-quantum key exchange and enable opt-in TLS diagnostics ( #21054 ) Accept whitespace before versions in noncompliant wildcard comparisons such as Requires-Python: >= 3.5.* ( #21012 ) Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content ( #20944 ) Omit source-span carets from diagnostics for empty PEP 508 requirements ( #21094 ) Preview features Add uv check --no-install-project and respect …
Podman releases v5.8.6

Security This release addressed CVE-2026-19730 where the podman quadlet install --replace command did not truncate the file being replaced, meaning replacing a longer file with a shorter one would result in content from the original file incorrectly being retained.
Go releases [release-branch.go1.27] go1.27rc3

Change-Id: I400bf6802223b50d5b0273153984e801a66bc317 Reviewed-on: https://go-review.googlesource.com/c/go/+/814825 Auto-Submit: Gopher Robot [email protected] Reviewed-by: Dmitri Shuralyov [email protected] Reviewed-by: Mark Freeman [email protected] TryBot-Bypass: Gopher Robot [email protected]
Go releases [release-branch.go1.25] go1.25.13

Change-Id: I4b70d995adc305fd68e4dfc6bc5c42cd001513b5 Reviewed-on: https://go-review.googlesource.com/c/go/+/814722 Reviewed-by: Mark Freeman [email protected] Reviewed-by: Dmitri Shuralyov [email protected] TryBot-Bypass: Gopher Robot [email protected] Auto-Submit: Gopher Robot [email protected]
Go releases [release-branch.go1.26] go1.26.6

Change-Id: I04258bea694def9a16dd544fba28fea45eeadbbb Reviewed-on: https://go-review.googlesource.com/c/go/+/814840 TryBot-Bypass: Gopher Robot [email protected] Reviewed-by: Mark Freeman [email protected] Auto-Submit: Gopher Robot [email protected] Reviewed-by: Dmitri Shuralyov [email protected]
Podman releases v6.0.0

Security This release addresses CVE-2026-57231, where a malicious image using malformed Env entries could cause host environment variables to leak into containers run based on the image, including the ability to use the * glob operator to leak large numbers of environment variables without knowing their exact names ( GHSA-4hq8-gpf5-8p68 ). This release addresses CVE-2026-19730 where the podman quadlet install --replace command did not truncate the file being replaced, meaning replacing a longer…

Wed 12 Aug 2026

Swift Package Manager releases swift-DEVELOPMENT-SNAPSHOT-2026-08-11-a

Tag build swift-DEVELOPMENT-SNAPSHOT-2026-08-11-a
Nix releases 2.35.2

Tagging release 2.35.2
Podman releases v6.1.0

Features A new command has been added, podman volume rename , to allow renaming volumes. Volumes created using volume drivers and volumes that are currently used by a container cannot be renamed ( #28189 ). A new command has been added, podman machine restart , to allow easy restart of VMs managed by podman machine ( #28366 ). The podman network rm command now includes a new option, --ignore , which suppresses errors when attempting to remove networks that do not exist ( #28363 ). The podman ma…
Terraform releases v1.16.0-rc1

1.16.0-rc1 (August 12, 2026) NEW FEATURES: Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. ( #37986 ) terraform_data : The new store block can hold ephemeral and sensitive values across plan and apply. ( #38298 ) Providers can now use nested blocks as computed values ( #38305 ) import: import blocks inside modules are now supported. ( #38352 ) Terraform is now available as a pre-built binary for Linux s390x (zLinux…
NuGet Client releases 7.11.0.8

Insert 7.11.0.8 into main on 08/12/2026 12:17:36
Terraform releases v1.17.0-alpha20260812

1.17.0-alpha20260812 (August 12, 2026) ENHANCEMENTS: command/init: Enrich log messages with provider versions ( #38918 ) BUG FIXES: funcs: pow and log no longer panic when result is not a number ( #38912 ) ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticip…
pub.dev releases 20260812t113900-all

Deployment at 2026-08-12T11:39:40.328756Z.

Tue 11 Aug 2026

Homebrew releases 6.0.17

What's Changed sbom: build pkg:brew purls via Vulns::Purl by @andrew in #23488 Report skipped dependent upgrades by @MikeMcQuaid in #23491 Allow cask runs to access the network by @MikeMcQuaid in #23497 Full Changelog : 6.0.16...6.0.17
Flatpak releases 1.18.1

Security fixes: Fix sandbox escape with full host filesystem read/write access via symlink attack on app data directories ( GHSA-8688-9x26-hhxj ) Fix local root privilege escalation via revokefs symlink path traversal and commit tampering ( GHSA-qrwq-7qwx-q9rp ) Fix arbitrary root write via symlink and path traversal in extra-data extraction ( GHSA-fqx6-vh4p-42cg ) Fix arbitrary root write via path traversal in flatpak build-init ( GHSA-8qxj-x646-phcm ) Fix arbitrary host file read via hardlink…
Flatpak releases 1.19.0

Security fixes: Fix sandbox escape with full host filesystem read/write access via symlink attack on app data directories ( GHSA-8688-9x26-hhxj ) Fix local root privilege escalation via revokefs symlink path traversal and commit tampering ( GHSA-qrwq-7qwx-q9rp ) Fix arbitrary root write via symlink and path traversal in extra-data extraction ( GHSA-fqx6-vh4p-42cg ) Fix arbitrary root write via path traversal in flatpak build-init ( GHSA-8qxj-x646-phcm ) Fix arbitrary host file read via hardlink…
PDM releases v2.28.1

Features & Improvements Defer command action and Python installer imports until their corresponding runtime paths execute. ( #3673 ) Add {run_cwd} placeholder for scripts to reference the original working directory. ( #3734 ) Add opt-in canonical lock input freshness via tool.pdm.resolution.lock_inputs while retaining sticky lockfile behavior and legacy hash fallback for existing lock files. ( #3821 ) Integrate argcomplete for simplified command-line completion scripts. ( #3823 ) Bug Fixes Keep…
Hatch releases Hatch v1.18.0

Changed: Upgrade default CPython distributions to 20260807 Added: Add the sources environment option, which redirects dependencies to a local path, Git repository, URL, alternate index, or workspace member at install time without altering published metadata. The top-level [tool.hatch.sources] table is an alias for the default environment, environments inherit sources entry by entry, the HATCH_NO_SOURCES environment variable disables them, and hatch dep show sources reports what each source redi…
Hatch releases Hatchling v1.32.0

Changed: Bump default core metadata version to 2.5 Add tomlkit as a runtime dependency, which is required to rewrite pyproject.toml when setting a static version Added: The version command can now set a version that is statically defined by the project.version field, updating pyproject.toml in place. Pass --force to allow an explicit downgrade Fixed: Allow the ; private annotation on project.import-names and project.import-namespaces entries rather than rejecting them as invalid import names. R…

Mon 10 Aug 2026

Dependabot Core releases v0.391.0

What's Changed Add typed requirement metadata readers by @JamieMagee in #15740 Type common requirement access by @JamieMagee in #15741 gracefully handle exceptions generated during package detail fetch by @brettfo in #15762 Bump the dev-dependencies group across 2 directories with 7 updates by @dependabot [bot] in #15563 Upgrade uv to 0.11.31 by @ABruihler in #15424 Bump ip-address from 10.2.0 to 10.4.0 in /bun/helpers by @dependabot [bot] in #15768 Bump brace-expansion from 1.1.13 to 1.1.18 in…
Homebrew releases 6.0.16

What's Changed cask/audit: detect incorrect app case by @krehel in #23400 Start install downloads before local-only checks by @MikeMcQuaid in #23381 contributions: clarify Maintainer team access by @SSakutaro in #23394 Tolerate missing bottle manifests in prefetches by @MikeMcQuaid in #23403 Use workflow result for commit style by @MikeMcQuaid in #23402 docs/MCP-Server: update Cursor URL by @p-linnane in #23415 download_queue: print fetch heading to stderr when stdout is not a TTY by @carlocab …
Mamba releases 2.9.0

⚠️ Breaking changes Logs and JSON outputs are now properly handled together but at the cost of some adaptations of the JSON output. If you use --json , you might need to adapt your applications' logic to handle this change. For full background on the issue, see: #4202 You can update micromamba to this version using: micromamba self-update Enhancements: [libmamba, micromamba] Refactor and clean up by @Hind-M in #4359 [libmamba, libmambapy] feat: Support excluding recent builds using timestamp ( …
pnpm Blog What's different in pnpm 12

pnpm 12 is a rewrite of pnpm in Rust, and it is stable. Upgrading should not feel like a migration. Apart from the differences below, it keeps the commands, flags, settings, and lockfile format of pnpm 11, and the documentation applies to both versions.

Fri 7 Aug 2026

uv releases 0.12.3

Release Notes Released on 2026-08-07. Python Add CPython 3.13.15 ( #20997 ) Preview features Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size ( #20992 ) Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics ( #20991 ) Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output ( #20990 ) Performance Reduce Linux startup latency by initializing the workspace cache before spawning another thre…