Package manager feeds

Combined feed from package-managers-opml. 304 items from 104 feeds, generated 2026-10-21T06:46:11Z.

Wed 21 Oct 2026

• Renovate releases 44.174.0

  44.174.0 (2026-10-21) Features deps: update renovate-base-image to v13.137.0 (main) ( #47241 ) ( f9b9036 ) Miscellaneous Chores deps: update ghcr.io/containerbase/devcontainer docker tag to v14.45.0 (main) ( #47240 ) ( da3366e )

• Renovate releases 44.173.1

  44.173.1 (2026-10-21) Bug Fixes deps: update renovate-base-image to v13.136.1 (main) ( #47236 ) ( 5c2a683 )

• Renovate releases 44.173.0

  44.173.0 (2026-10-21) Features deps: update renovate-base-image to v13.136.0 (main) ( #47234 ) ( 482cf61 )

• mise releases v2026.10.17: Shell names in bootstrap login_shell, templated doctor checks, and a per-plugin vfox cache directory

  bootstrap.user.login_shell now accepts a shell name such as fish instead of a full path. [doctor.checks] can use templates, and vfox backend plugins get their own cache directory. This release also fixes PATH handling in zsh setups that deduplicate PATH, stale task cache hits, a pipx interpreter mix-up on macOS, and removes trust in the compromised eMudhra CA certificates. It also includes the changes prepared for 2026.10.16, which was tagged but never published: relative and templated write_ta…

Tue 20 Oct 2026

• Renovate releases 44.172.2

  44.172.2 (2026-10-20) Bug Fixes deps: update renovate-base-image to v13.135.6 (main) ( #47232 ) ( e698ff5 ) Miscellaneous Chores deps: update ghcr.io/containerbase/devcontainer docker tag to v14.44.4 (main) ( #47231 ) ( fc2a9d0 )

• PSResourceGet releases Release of Microsoft.PowerShell.PSResourceGet v1.3.0-rc1

  What's Changed Discover and install DSC dynamically for CI tests by Aditya Patwardhan (@adityapatwardhan) in #2007 Implement unimplemented concurrency methods for all server classes by alerickson in #2012 Add concurrency for parent packages by alerickson in #2016 Pin GitHub Actions to full-length commit SHAs by Dan Fiedler (@danfiedler-msft) in #2023 Add PSContentPath Standard Platform Paths by Justin Chung (@jshigetomi) in #1912 fix: capture cmdlet warnings to prevent stdout contamination brea…

• mise releases mise-system-v2026.10.4

  Release mise-system 2026.10.4

• mise releases vfox-v2026.10.17

  Release vfox 2026.10.17

• mise releases mise-ui-v2026.10.4

  Release mise-ui 2026.10.4

• mise releases mise-util-v2026.10.17

  Release mise-util 2026.10.17

• Docker Engine releases v29.9.2

  29.9.2 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: docker/cli, 29.9.2 milestone moby/moby, 29.9.2 milestone Security The Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected registries need a replacement ce…

• Hex releases v2.5.4

  Security fixes Stop trusting the emSign ECC Root CA - G3, emSign Root CA - C1 and emSign ECC Root CA - C3 root certificates, which Mozilla removed from its root store. The private keys of eight eMudhra intermediate CAs that chain to emSign ECC Root CA - G3 were compromised, so whoever holds them could impersonate the HTTPS servers Hex connects to ( eMudhra intermediate CA compromise )

• Renovate releases 44.172.1

  44.172.1 (2026-10-20) Bug Fixes deps: update renovate-base-image to v13.135.5 (main) ( #47228 ) ( 124e0e1 ) Miscellaneous Chores deps: update dependency astral-sh/uv to v0.13.4 (main) ( #47225 ) ( 320108e ) deps: update dependency uv to v0.13.4 (main) ( #47226 ) ( 7f7021a )

• uv releases 0.13.4

  Release Notes Released on 2026-10-20. This release addresses GHSA-hq85-5cpj-mr62 , which involves a root CA whose intermediate on the Web PKI have been compromised. Users are encouraged to upgrade immediately, as well as confirm that all other software that uses bundled CAs is also properly updated. Preview features Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under wheel-variants ( #22512 ) Other changes Update the bundled Mozilla root certi…

• pip releases 26.2.2

  Release 26.2.2

• Renovate releases 44.172.0

  44.172.0 (2026-10-20) Features workarounds: add helm-docs workaround for old tags from 2019 ( #46838 ) ( 33483f9 )

• Renovate releases 44.171.9

  44.171.9 (2026-10-20) Bug Fixes deps: update renovate-base-image to v13.135.4 (main) ( #47218 ) ( 1f75e11 ) Miscellaneous Chores deps: update ghcr.io/containerbase/devcontainer docker tag to v14.44.3 (main) ( #47217 ) ( 32306c6 ) deps: update linters to v1.88.0 (main) ( #47222 ) ( 6e01ad1 )

• Renovate releases 44.171.8

  44.171.8 (2026-10-20) Bug Fixes vulnerabilities: apply vulnerabilityAlerts limits to packageRule alerts ( #47211 ) ( dc71c78 ) Build System deps: update dependency google-auth-library to v11.3.0 (main) ( #47213 ) ( 85acb08 )

• Renovate releases 44.171.7

  44.171.7 (2026-10-20) Bug Fixes deps: update renovate-base-image to v13.135.3 (main) ( #47210 ) ( fce3625 )

• vlt Blog vlt skills

  Introducing v1.5.0: with this release, vlt now links the agent skills your dependencies ship into the dirs your coding agents read.

• Renovate releases 44.171.6

  44.171.6 (2026-10-20) Build System deps: update dependency @renovatebot/detect-tools to v4.0.23 (main) ( #47209 ) ( 1584a8e )

• pub.dev releases 20261020t112000-all

  Deployment at 2026-10-20T11:20:19.810605Z.

• mise releases v2026.10.16

  (config) resolve relative and templated write_targets paths by …

• mise releases mise-system-v2026.10.3

  Release mise-system 2026.10.3

• mise releases vfox-v2026.10.16

  Release vfox 2026.10.16

• mise releases mise-ui-v2026.10.3

  Release mise-ui 2026.10.3

• mise releases mise-util-v2026.10.16

  Release mise-util 2026.10.16

• vlt CLI releases v1.5.0

  What's Changed spec: improve catalog errors with suggestions by @ruyadorno in #1980 graph: keep pending build state across installs by @ruyadorno in #1990 cli-sdk: let publishConfig.registry satisfy publish/unpublish by @ruyadorno in #1991 security-archive: add fetch timeout to socket.dev requests by @ruyadorno in #1979 cli-sdk: save found workspaces to vlt.json on install by @ruyadorno in #2013 Use a worker pool to create hardlinks during placement. by @evert in #2018 Revert "Use a worker pool…

• Go releases [release-branch.go1.26] go1.26.10

  Change-Id: I1c15150b8e64627cc3fdf015b599258ab4753fa0 Reviewed-on: https://go-review.googlesource.com/c/go/+/851205 Auto-Submit: Gopher Robot [email protected] Reviewed-by: Carlos Amedee [email protected] Reviewed-by: Dmitri Shuralyov [email protected] TryBot-Bypass: Gopher Robot [email protected]

• Go releases [release-branch.go1.27] go1.27.3

  Change-Id: Icf51c3e5809b43e3137f6e269b1196ec9f74626e Reviewed-on: https://go-review.googlesource.com/c/go/+/851146 TryBot-Bypass: Gopher Robot [email protected] Reviewed-by: Dmitri Shuralyov [email protected] Reviewed-by: Carlos Amedee [email protected] Auto-Submit: Gopher Robot [email protected]

• uv releases 0.13.3

  Release Notes Released on 2026-10-20. Performance Avoid severe uv export slowdowns in dependency graphs with extras ( #22750 ) Install uv 0.13.3 Install prebuilt binaries via shell script curl --proto ' =https ' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.sh | sh Install prebuilt binaries via powershell script powershell -ExecutionPolicy Bypass -c " irm https://releases.astral.sh/github/uv/releases/download/0.13.3/uv-installer.ps1 | iex " Download …

Mon 19 Oct 2026

• NuGet Client releases 8.1.0.14

  Tag 8.1.0.14

• uv releases 0.13.2

  Release Notes Released on 2026-10-19. Enhancements Report all installed packages in uv workspace metadata , including packages outside the selected resolution ( #22395 ) Include supported environment restrictions when exporting pylock.toml ( #22596 ) Retry dropped GET and HEAD requests when fetching package and index data ( #22672 ) Preserve encoding declarations in wheel data scripts that require shell launchers ( #22526 ) Show causes and hints when uv python find --script cannot discover an i…

• APT releases 3.3.4

  apt Debian release 3.3.4

• Dependabot Core releases v0.401.0

  What's Changed bun: Update catalog dependencies by @fbartho in #16544 github_actions: pass home hostname to gh-actions-lock by @nodeselector in #16504 Type common model specs and shared RSpec ancestors by @JamieMagee in #16506 Type common credential, group, and experiment specs by @JamieMagee in #16552 Type common cooldown spec fixtures by @JamieMagee in #16551 Enable Sorbet checking for Git submodule specs by @JamieMagee in #16555 Enable staged Sorbet checking for .NET SDK specs by @JamieMagee…

• Gradle releases 9.8.2

  The Gradle team is excited to announce Gradle 9.8.2. Here are the highlights of this release: Java 27 support Maven mirror settings reuse Linked problem locations in build output Read the Release Notes We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam , Björn Kautler , Eng Zer Jun , Hashim Khan , Julian Krannich , KBS , Labh R Jethe , Mark Dodgson , Maxim , monkey , nataphon-ktsystems , Paul King , Qiu Tian , rg_sandesh , Rober…

• Homebrew releases 7.0.10

  What's Changed Ignore Ubuntu release list link check failures by @MikeMcQuaid in #24196 Require test resources in homebrew/core by @MikeMcQuaid in #24180 Preserve cask approval for copied helpers by @MikeMcQuaid in #24191 Add OSS Scanner Dockerfile and threat model by @p-linnane in #24199 spdx: store downcased licenses in hash across calls by @alebcay in #24197 Harden tap redirect trust and rollback by @p-linnane in #24198 Fix offline, vacuous and repo-leaking specs by @p-linnane in #24200 Igno…

• Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-17-a

  Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-17-a

• PDM releases v2.29.3

  Features & Improvements Add the --venv option to pdm outdated , like the other commands that read the installed packages. ( #3904 ) Bug Fixes Fix isolated PEP 517 builds skipping packages that are only visible via the host venv's --system-site-packages . ( #3895 ) Fix pdm import of Poetry projects dropping optional dependencies whose extras entry is spelled differently, and importing optional dependencies with multiple constraints as required ones. ( #3899 ) Keep the plain requirement in pdm ex…

• ORAS releases v1.3.5

  Changelog d6e7b58 bump: tag and release ORAS CLI v1.3.5 ( #2244 ) 4431829 docs: require cve fixes to land before preparing a release ( #2258 ) 8ee66ac docs: add ORAS CLI release process ( #2248 ) e09a8bb chore: bump oras-go to v2.6.4 in e2e tests ( #2247 ) 8270f5f chore: update oras-go to v2.6.4 ( #2242 ) ba3a3dc fix: validate extra destination tags before pushing ( #2237 ) 6ca02d0 build(deps): bump the github-actions group across 1 directory with 3 updates ( #2240 ) c9ccd95 build(deps): bump l…

Sun 18 Oct 2026

• Cabal releases cabal-head

  No release body provided.

• pipx releases 1.18.4

  Bugfixes pipx reset now cancels instead of crashing when the confirmation prompt reads EOF (Ctrl-D on POSIX, Ctrl-Z then Enter on Windows). ( #2160 ) PyPI release Full Changelog : 1.18.3...1.18.4

• pipx releases 1.18.3

  Bugfixes Allow selecting dependencies that ship only shell completions. ( #2157 ) PyPI release Full Changelog : 1.18.2...1.18.3

• pipx releases 1.18.2

  Bugfixes Accept absolute file:/// URLs as package specs, such as pipx install file:///wheels/tool-1-py3-none-any.whl . ( #2150 ) In a terminal, show the pipx spinner again during installs and upgrades instead of the full pip or uv log, which --verbose still streams. Installer errors are still printed on failure. ( #2151 ) Print the installer error once when a pipx upgrade --verbose or pip pipx install --verbose fails, instead of repeating it after the live output. ( #2153 ) Stop an -all command…

• pipx releases 1.18.1

  Bugfixes Stop pip and uv when Ctrl-C lands early, instead of hanging. ( #2146 ) PyPI release Full Changelog : 1.18.0...1.18.1

• pipx releases 1.18.0

  Features Put --suffix last, except before a Windows file extension. Apps exposed by 1.17.14 keep their old name until pipx next exposes them, which renames them. ( #2098 ) upgrade and reinstall-all refresh shared pip only after 30 days. ( #2116 ) Run pipx upgrade-shared to refresh shared pip sooner. ( #2116 ) Set PYTHON_LAZY_IMPORTS=normal to opt out; the entry point is pipx.__main__ . ( #2132 ) Defer every import, dependencies included, on Python 3.15 for faster startup. ( #2132 ) Run reinstal…

• pipx releases 1.17.14

  Bugfixes Build pipx wheels with Docutils 0.21.2 and later, including environments pinned to Docutils 0.22. ( #2084 ) Improved Documentation Say that pipx rejects --global before the subcommand instead of ignoring it. ( #2082 ) PyPI release Full Changelog : 1.17.13...1.17.14

• pipx releases 1.17.13

  Bugfixes Accept bare and suffixed injected package names in pipx pin --skip . ( #2079 ) Use each snapshot's recorded interpreter when pipx install-all rebuilds an environment unless the user passes --python . ( #2081 ) PyPI release Full Changelog : 1.17.12...1.17.13

• pipx releases 1.17.12

  Bugfixes Stop pipx reinstall from printing a traceback when the reinstall fails for an expected reason. ( #2070 ) Stop pipx install printing WARNING: Skipping setuptools as it is not installed. when the shared libraries are created on Python 3.12+, where setuptools is already absent. ( #2071 ) Stop an injected package in a suffixed environment from being renamed every time its record is rewritten: pipx upgrade , pipx pin and pipx reinstall no longer append the environment suffix again, so the p…

• pipx releases 1.17.11

  Improved Documentation Hide the extra documentation TOC toggle on narrow screens. ( #2064 ) PyPI release Full Changelog : 1.17.10...1.17.11

• pipx releases 1.17.10

  Bugfixes Remove an environment that has no pipx metadata and an interpreter that no longer runs, instead of crashing pipx uninstall and pipx uninstall-all . ( #2059 ) Derive local script command names from the filename when parent directories contain # . A script installed by an earlier release under its directory's name no longer upgrades; uninstall it and install it again. ( #2060 ) Install a local PEP 723 script from its file when the path reads as a PyPI name ( pipx install bare.py ), conta…

• Verdaccio releases @verdaccio/[email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases @verdaccio/[email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases @verdaccio/[email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases @verdaccio/[email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases @verdaccio/[email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases [email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases [email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases [email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases [email protected]

  chore: update versions (next-9) ( #6358 )

• Verdaccio releases [email protected]

  chore: update versions (next-9) ( #6358 )

• Swift Package Manager releases swift-DEVELOPMENT-SNAPSHOT-2026-10-17-a

  Tag build swift-DEVELOPMENT-SNAPSHOT-2026-10-17-a

• sbt releases 2.0.11

  🐛 bug fixes fix: Fix AccessDeniedException writing SemanticDB by @eed3si9n in #9878 fix: Fixes .m2/settings.xml overriding sbtResolvers by @eed3si9n in #9828 fix: Keep accepting after a client fails by @kitbellew in #9691 fix: Fix task output lost by the thin client under CPU load by @eed3si9n in #9868 fix: Read all forked test output before reporting the fork's exit by @eugkhp in #9860 fix: Use Path.userHome to work around user.home returning ? by @eed3si9n in #9866 fix: Fail a gRPC batch read…

Sat 17 Oct 2026

• Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-15-a

  Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-15-a

Fri 16 Oct 2026

• NuGet Client releases 8.1.0.12

  Tag 8.1.0.12

• Swift Package Manager releases swift-DEVELOPMENT-SNAPSHOT-2026-10-15-a

  Tag build swift-DEVELOPMENT-SNAPSHOT-2026-10-15-a

• Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-14-a

  Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-14-a

• PyPI Blog Checking email reputation, and allowing Outlook again

  PyPI improves on checks for the reputation of an email address when used to register an account or add to an existing account, and rejects addresses identified as disposable. With the new check in place, outlook.com and hotmail.com addresses can once again be used on PyPI. Background In June 2024 we prohibited Outlook email domains after a malware campaign registered accounts in bulk with outlook.com and hotmail.com addresses. Until now, PyPI has blocked disposable email addresses with two list…

• Go Blog Interactive refactoring in gopls

  Introducing interactive refactoring in gopls and the LSP: a new capability that brings dynamic, multi-step refactorings into your favorite editor.

Thu 15 Oct 2026

• npm CLI releases libnpmpack: v10.0.4

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases libnpmfund: v8.0.4

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases libnpmexec: v11.0.4

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases libnpmdiff: v9.0.4

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases v12.2.1

  12.2.1 (2026-10-14) Bug Fixes b317f16 #9941 write registry allowScripts keys under install-strategy=linked ( #9941 ) ( @manzoorwanijk ) Dependencies 7b0c2e8 #10088 [email protected] ( @reggi ) e9e99b4 #10088 [email protected] ( @reggi ) 857d7df #10088 [email protected] ( @reggi ) bc7bb3a #10088 [email protected] ( @reggi ) 7614360 #10088 [email protected] ( @reggi ) workspace : @npmcli/[email protected] workspace : [email protected] workspace : [email protected] workspace : l…

• NuGet Client releases 8.1.0.9

  Tag 8.1.0.9

• Helm releases Helm v3.22.1

  Helm v3.22.1 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! Join the discussion in Kubernetes Slack : for questions and just to hang out for discussing PRs, code, and bugs Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom Test, debug, and contribute charts: ArtifactHub/packages Notable Changes Bumps dependencies to remove Go package vulnerabilities Updates the k8s.io Go packages Insta…

• npm CLI releases libnpmpack: v9.1.15

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases libnpmfund: v7.0.28

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases libnpmexec: v10.3.4

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases libnpmdiff: v8.1.14

  Dependencies workspace : @npmcli/[email protected]

• npm CLI releases v11.21.1

  11.21.1 (2026-10-14) Bug Fixes 1c7b661 #10059 write registry allowScripts keys under install-strategy=linked ( #10059 ) (@github-actions[bot], @manzoorwanijk ) Dependencies 8cec7c9 #10089 [email protected] ( @reggi ) fd105c7 #10089 [email protected] ( @reggi ) fc2a0dd #10089 [email protected] ( @reggi ) bae8cd7 #10089 [email protected] ( @reggi ) 4a9d14d #10089 [email protected] ( @reggi ) workspace : @npmcli/[email protected] workspace : [email protected] workspace : libnpme…

• pnpm releases pnpm 11.28.6

  This release stops pnpm publish from sending a CI identity token to a registry it was not issued for. It also fixes installs that dropped a dependency also declared as an optional peer, and accepts empty httpProxy and httpsProxy settings again. Patch Changes Security pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org . A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials. …

• pnpm releases pnpm 12.14.0

  This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits. Minor Changes Added the sideEffectsCache.exclude setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the…

• Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-13-a

  Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-13-a

• Helm releases Helm v4.3.1

  Helm v4.3.1 is a patch release. Users are encouraged to upgrade for the best experience. The community keeps growing, and we'd love to see you there! Join the discussion in Kubernetes Slack : for questions and just to hang out for discussing PRs, code, and bugs Hang out at the Public Developer Call: Thursday, 9:30 Pacific via Zoom Test, debug, and contribute charts: ArtifactHub/packages Notable Changes fix(action): wait for CRD establishment under HookOnlyStrategy #32672 by @pujitha24 fix(linte…

• Forgejo Blog Forgejo v17.0 is available

  Forgejo v17.0 is available. Repository funding links are supported. Repositories can be migrated from Bitbucket Data Center. LFS support is revamped. Job summaries from Forgejo Actions jobs are displayed.

• RubyGems Blog rubygems.org now shows security warnings for gems

  Most of us have a routine for adding a gem: search for it, open its page on rubygems.org , glance at the download count and the number of days since the last release, then copy the Gemfile line. The whole process takes half a minute. But until now, rubygems.org did not tell you whether the version you were about to install had a known security issue. That information has been public for years. Sources such as the GitHub Advisory Database, OSV and Ruby Advisory Database already track vulnerabili…

• Rust Blog Announcing Rust 1.99.1

  The Rust team has published a new point release of Rust, 1.99.1. Rust is a programming language that is empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup, getting Rust 1.99.1 is as easy as: rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website. What's in 1.99.1 Rust 1.99.1 fixes the following regressions from prior releases: Missing symbol wcslen : Some Rust targets w…

• pnpm Blog pnpm 11.28.6

  This release stops pnpm publish from sending a CI identity token to a registry it was not issued for. It also fixes installs that dropped a dependency also declared as an optional peer, and accepts empty httpProxy and httpsProxy settings again.

• pnpm Blog pnpm 12.14.0

  This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

Wed 14 Oct 2026

• vlt CLI releases v1.4.0

  What's Changed tar: use cloneFile API on mac via node:ffi by @evert in #1925 cli-sdk: guard against colliding spec prefix aliases by @ruyadorno in #1973 workspaces: read pnpm-workspace.yaml packages by @ruyadorno in #1974 fast-split: fix benchmark, fast path for limit 2 and 3 by @ruyadorno in #1975 cli-sdk: add save-types to save matching types by @ruyadorno in #1976 cli-sdk: abort pending requests on error instead of process.exit by @ruyadorno in #1977 cli-sdk: run --scope targets in dependenc…

• Hex releases v2.5.3

  Bug fixes Percent-encode package names, versions and other values in the URLs of API and repository requests, so a / , ? , # or .. in a value can't change the request path Security fixes Fix unpacking a package or docs tarball that contains a GNU sparse file in mix deps.get , mix hex.package fetch --unpack , mix hex.docs fetch and mix hex.docs offline . A sparse file that ends in a hole made the task loop forever, and a sparse hole that crosses a 64 KiB boundary in the file made it fail ( GHSA-…

• Docker Engine releases v29.9.1

  29.9.1 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: docker/cli, 29.9.1 milestone moby/moby, 29.9.1 milestone Security The containerd update to v2.4.2 includes fixes for the following security vulnerabilities: CVE-2026-95839 : Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest. GHSA-8647-2jxj-p2rc : …

• Conda releases 26.9.3

  Bug fixes Preserve installed file metadata when safety checks are disabled so Windows launcher lookup can use the checksums supplied by the package. ( #16856 via #16855 ) Contributors @jezdez Full Changelog : 26.9.2...26.9.3

• Docker Engine releases v2.0.0-beta.28

  v2.0.0-beta.28

• Reproducible Builds Blog Reproducible Builds in September 2026

  Welcome to the September 2026 report from the Reproducible Builds project! In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced dur…

• vlt Blog Thank you, Deno

  Deno is joining Cloudflare & winding down its investment in the runtime. We're all better off because of its existence.

• OpenTofu releases v1.12.8

  SECURITY ADVISORIES: Previous versions of OpenTofu could potentially experience excessive CPU usage if connecting to an attacker-controlled HTTP2 server while installing dependencies in tofu init . ( #4700 ) BUG FIXES: Lifecycle destroy will no longer crash when given an expression with references ( #4648 )

• pixi releases pixi-build-r-v0.2.0

  chore(release): bump pixi-build-r to 0.2.0 ( #7271 )

• Chocolatey releases 2.7.5-beta-20261014

  v2.7.5-beta-20261014

• vlt Blog vlt v1.4.0: faster macOS installs and --save-types

  vlt v1.4.0 brings the global store to macOS for up to 3x faster installs on Node 26, plus a new --save-types flag.

• pixi releases v0.82.0

  [0.82.0] - 2026-10-13 ✨ Highlights Rich platforms now support AMD GPUs with amdgpu = true to declare GPU presence or amdgpu = "gfx90a" to require a specific GPU architecture. pixi global now supports exclude-newer in the global manifest. Set a cutoff date or a duration such as exclude-newer = "7d" to exclude recently published packages from all global environments. Added Add exclude-newer to the global manifest by @Hofer-Julian in #7016 Use toml edit to modify config by @samrosenf in #6576 Auto…

• Chocolatey releases 1.4.8-beta-20261014

  v1.4.8-beta-20261014

• Terraform releases v1.17.0-rc2

  1.17.0-rc2 (October 14, 2026) NEW FEATURES: Terraform now supports variables and locals in provider requirements ( #39153 ) A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. ( #35290 ) policy: Terraform Policy is now generally available. The -policies flag for plan , apply , and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and…

• Terraform releases v1.16.6

  1.16.6 (October 14, 2026) BUG FIXES: cloud: terraform init can now find workspaces selected by key/value tags whose keys contain uppercase letters. ( #39306 ) test: Allow module under test to use deprecated outputs. ( #39207 ) NOTES: Prevent a HTTP/2 resource exhaustion via CVE-2026-78669. Exploitation would require a compromised (untrusted) provider/module registry. Such a threat is considered to be outside the perimeter of Terraform core security guarantees. ( #39375 )

• pub.dev releases 20261014t070500-all

  Deployment at 2026-10-14T07:05:44.886281Z.

• uv releases 0.13.1

  Release Notes Released on 2026-10-14. Enhancements Ignore Requires-Python upper bounds in uv pip check and uv pip install --strict , consistent with resolution ( #22500 ) Support Linux SPARC by falling back when filesystem cloning and detailed cache accounting are unavailable ( #22463 ) Report missing trusted hashes in resolution errors ( #22241 ) Python Add CPython 3.16.0a1 ( #22527 ) Preview features Allow uv tool upgrade to upgrade installed tools when tool-install-locks is enabled ( #22498 …

• RubyGems releases v4.0.23

  RubyGems 4.0.23 Enhancements: Update vendored gems to latest versions. Pull request #9948 by Hiroshi SHIBATA Drop setuid, setgid and sticky bits when extracting gems. Pull request #9929 by Hiroshi SHIBATA Improve handling of paths with invalid Windows characters. Pull request #9276 by Said Kaldybaev and Hiroshi SHIBATA Installs bundler 4.0.23 as a default gem. Bundler 4.0.23 Enhancements: Update vendored gems to latest versions. Pull request #9948 by Hiroshi SHIBATA Bug fixes: Stop retrying a 4…

• Go Blog Better HTTP/1 connection reuse

  Go 1.27 includes a change to the HTTP client that can make programs sending many sequential HTTP/1 requests significantly faster.

• PHP Foundation Blog How the PHP Security Team Handles Your Reports

  If you've ever sent a security report to PHP and then refreshed the advisory page every morning for three weeks, hi, this one's for you, and yes, we read it. PHP runs a large share of the web, so keeping it secure and staying responsive matters far beyond this project, and we take that seriously. There is a small group of volunteers and PHP Foundation contractors doing its best to handle security for PHP core with the limited time and resources available, and this post will show how we are goin…

• RubyGems Blog 4.0.23 Released

  RubyGems 4.0.23 includes enhancements and Bundler 4.0.23 includes enhancements and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.23 RubyGems Release Notes Enhancements: Update vendored gems to latest versions. Pull request #9948 by Hiroshi SHIBATA Drop setuid, setgid and sticky bits when extracting gems. Pull request #9929 by Hiroshi SHIBATA Improve handlin…

Tue 13 Oct 2026

• NuGet Blog Announcing .NET 11 Release Candidate 2

  .NET 11 Release Candidate 2 is available with improvements across libraries, runtime, SDK, MSBuild, NuGet, F#, ASP.NET Core, .NET MAUI, and Windows Forms. The post Announcing .NET 11 Release Candidate 2 appeared first on .NET Blog .

• vlt Blog vlt outdated

  We shipped the "vlt outdated" command. Find out what packages need upgrading and if you're vulnerable.

• Nix releases 2.28.8

  Tagging release 2.28.8

• Nix releases 2.30.6

  Tagging release 2.30.6

• Nix releases 2.34.9

  Tagging release 2.34.9

• Nix releases 2.31.6

  Tagging release 2.31.6

• Nix releases 2.35.3

  Tagging release 2.35.3

• pub.dev releases 20261013t134500-all

  Deployment at 2026-10-13T13:45:47.280708Z.

• NuGet Client releases 8.1.0.8

  Insert 8.1.0.8 into main on 10/13/2026 12:37:14

• MacPorts releases MacPorts 2.12.7

  Changes since 2.12.6: Fixed error verifying signatures when multiple archive sites are configured and use different signature types. ( #74474 , pguyot in c225437 ) Fixed building with system curl on 10.5. ( #74362 , jmr in 847bfc2 )

• pnpm releases pnpm 12.13.0

  This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution. Minor Changes Added the pnpm profile command to view and update registry user profile settings. Added pnpm token to list, create, and revoke authentication tokens on the registry. Added the storeIndexFormat setting. Set it to files to keep a store's package index as one file per package instead of the SQLite index.d…

• Harbor releases v2.14.6-rc1

  What's Changed Component updates ⬆️ bump base version for v2.14.6 by @wy65701436 in #24115 Release 2.14 bump go trivy distribution by @wy65701436 in #24122 fix(webhook): allow private network access by default ( #24082 ) by @wy65701436 in #24129 fix(prepare): expose the legacy signer pull switch in harbor.yml ( #24 … by @wy65701436 in #24130 Cherry pick upload location origin 2.14 ( #24114 ) by @wy65701436 in #24131 fix(contenttrust): allow legacy signer pull by default to avoid regre… by @wy65…

• Astral Blog Bringing uv and ty together

  Experimental uv-ty integration enables first-class support for Python scripts on the CLI and in the editor, and a unified uv check command.

• pnpm Blog pnpm 12.13.0

  This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.

Mon 12 Oct 2026

• Podman releases v6.1.4

  Bugfixes Fixed an issue where Podman would not function when run under WSL 3 ( #29749 ). Misc Updated gvproxy to v0.9.0, resolving CVE-2026-107935 Updated Buildah to v1.45.2 Updated Storage to v1.64.2

• Podman releases v5.8.9

  Bugfixes Fixed an issue where Podman would not function when run under WSL 3 ( #29749 ). Fixed a bug with podman machine VMs on Mac where machines could be left in an inconsistent state if the podman machine start command was interrupted by a signal. Misc Updated gvproxy to v0.9.0, resolving CVE-2026-107935 Updated Buildah to v1.43.5 Updated Storage to v1.62.2

• Dependabot Core releases v0.400.0

  What's Changed Type Python registry distribution metadata by @JamieMagee in #16466 Maven: only propose updates with writable requirements by @v-kbukum1 in #16465 Support Bun 1.4 and lockfile versions 2 and 3 by @v-sachin-sandhu in #16485 Maven: reliable dependency tree scan behind maven_transitive_dependencies by @v-kbukum1 in #16487 Classify unchanged dependency files with typed error by @v-thavaahariharangit in #16495 Enable experimental Sorbet checking for common specs by @JamieMagee in #164…

• Hex releases v2.5.2

  Bug fixes Fail with the download error instead of crashing in mix hex.package fetch when the version isn't in the registry but a copy of it is cached Fetch the docs of organization packages in mix.lock with mix hex.docs fetch . They were requested from an organization named after the repository, such as hexpm:myorg , and never found. Packages from other repositories are skipped with a warning Reject package and organization names that hex.pm doesn't accept and invalid versions in mix hex.docs .…

• pnpm releases pnpm 10.34.7

  Patch Changes 97f550c : Switching to the pnpm version in packageManager now works through registry mirrors that strip npm's signatures or re-sign packages with their own key. pnpm then reads the signature from https://registry.npmjs.org/ and verifies it against the integrity of the downloaded pnpm #16778 . b11d7bb : The update notification now suggests the standalone install script instead of pnpm self-update when PNPM_HOME is not set, such as when another package manager installed pnpm. pnpm s…

Sun 11 Oct 2026

• Swift Package Manager releases swift-DEVELOPMENT-SNAPSHOT-2026-10-10-a

  Tag build swift-DEVELOPMENT-SNAPSHOT-2026-10-10-a

• pnpm releases pnpm 12.12.1

  This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it. Patch Changes pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org . A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials. pnpm dist-tag add , rm , and ls now support OIDC authentication in CI. Enable "Allow npm…

• sbt releases 2.1.0-RC1

  Changes with compatibility implications Metabuild is updated to Scala 3.9. Apache Ivy is removed from the dependency. Scala 3.9 sbt 2.1.0 updates the Scala version used by the metabuild to Scala 3.9.0. Since both sbt 2.x and Scala 3.x are only backward compatible across minor versions, appropriate Scala version must be used for building sbt plugins. Also a plugin built using sbt 2.1.x will not work on sbt 2.0.x: sbt 2.x Scala 3.x Plugin works on sbt 2.0.x 2.0.x 3.8.x ✅ 2.1.0 3.9.x ❌ Publishing …

• pnpm Blog pnpm 12.12.1

  This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Sat 10 Oct 2026

• pnpm releases pnpm 12.12.0

  This release shares task results and dependency builds through a remote cache, adds the addMissingPeerTypes setting, and lets pnpm add --config and pnpm update manage configuration dependencies. It also fixes dangerouslyAllowAllBuilds running the build scripts of packages that allowBuilds denies. Minor Changes pnpm pipeline can share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remo…

• pnpm releases pnpr 0.1.0-alpha.15

  pnpr 0.1.0-alpha.15 adds a web UI, admin APIs for package rules, teams, and accounts, and SCIM deprovisioning. It also carries a security fix for tokens that outlived their account. Minor Changes pnpr serves a web UI at /-/ui/ when the new @pnpm/pnpr-ui package is installed next to it, for example with pnpm add -g @pnpm/pnpr,@pnpm/pnpr-ui . The new ui setting turns the UI off or serves it from another directory. The web UI signs in with a password or with an OIDC provider that offers browser si…

• NuGet Client releases 8.1.0.5

  Insert 8.1.0.5 into main on 10/10/2026 12:34:36

• Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-08-a

  Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-08-a

• Bun releases Bun v1.4.3

  To install Bun v1.4.3 curl -fsSL https://bun.sh/install | bash # or you can use npm # npm install -g bun Windows: powershell -c " irm bun.sh/install.ps1|iex " To upgrade to Bun v1.4.3: bun upgrade Read Bun v1.4.3's release notes on Bun's blog Thanks to 8 contributors! @alii @cirospaciari @dylan-conway @eastlondoner @jarred-sumner @robobun @sosukesuzuki @steipete

• Bun Blog Bun v1.4.3

  Fixes 166 issues, addressing 122 👍. bun check, a TypeScript type checker built into Bun that is 3x to 6.4x faster than tsc 7, --check for bun run, bun build and bun test, 67–89% less idle CPU, Bun.FetchSession, experimental Bun.ModuleGraph, --disallow-code-generation-from-strings, up to 2.7x faster large node:http responses, a JavaScriptCore upgrade with faster JSON.parse, faster rejected-promise handling, CompressionStream compression levels, If-Range support in Bun.serve, bun install skips ta…

• pnpm Blog pnpm 12.12.0

  This release shares task results and dependency builds through a remote cache, adds the addMissingPeerTypes setting, and lets pnpm add --config and pnpm update manage configuration dependencies. It also fixes dangerouslyAllowAllBuilds running the build scripts of packages that allowBuilds denies.

Fri 9 Oct 2026

• setup-uv releases v10.3.0 🌈 Add Python architecture selection

  Changes This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners. It also includes embedded checksums for uv releases through 0.13.0. Use macOS 15 runners for tests @charliermarsh ( #1081 ) 🚀 Enhancements Add python-arch support @zanieb ( #1079 ) 🧰 Maintenance chore: update known checksums for 0.13.0 @ github-actions[bot] ( #1089 ) chore: update known c…

• uv releases 0.13.0

  Release Notes Released on 2026-10-09. uv 0.13.0 makes Python 3.15 the default stable Python version. We've also included several breaking changes to improve correctness, performance, and compatibility, described below. We expect most users to be able to upgrade without making changes. While not a breaking change, this release also updates the format of many of uv's cache entries to improve performance. uv may download or rebuild dependencies after upgrading , because some cached entries from ea…

• pnpm releases pnpm 12.11.2

  This release fixes --workspace-concurrency=Infinity , filters set by an updateConfig hook, and store fetches with enable-modules-dir=false . Patch Changes --workspace-concurrency=Infinity now runs workspace projects with no concurrency limit. It used to fail with invalid digit found in string #16793 . pnpm install and other recursive commands now apply the filter and filterProd that an updateConfig hook sets. They used to run on every workspace project #16792 . enable-modules-dir=false now also…

• Deno Blog Deno is joining Cloudflare

  Putting ourselves in the best place to build the future of the web

• NuGet Client releases 8.1.0.2

  Insert 8.1.0.2 into main on 10/09/2026 12:40:00

• pnpm releases pnpm 12.11.1

  This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx , and treats registry.npmjs.com as an alias of the npm registry. Patch Changes pnpm install no longer fails when packageManager pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it. pnpm install no longer fails with ERR_PNPM_CMD_SHI…

• Swift Package Manager releases swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-07-a

  Tag build swift-6.4.x-DEVELOPMENT-SNAPSHOT-2026-10-07-a

• pnpm releases pnpm 12.11.0

  This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output. Minor Changes pnpm install now links the agent skills that direct dependencies ship under skills/<name>/SKILL.md into the project's agent skill directories, such as .claude/skills . A package's skills are linked only after you approve them with pnpm approve . The skills.dirs setting chooses the directories pnpm/rfcs#35 . Added …

• Harbor releases v2.15.4

  What's Changed Component updates ⬆️ fix(webhook): allow private network access by default by @Vad1mo in #24082 fix(contenttrust): allow legacy signer pull by default to avoid regre… by @wy65701436 in #24086 fix(prepare): expose the legacy signer pull switch in harbor.yml by @bupd in #24101 Cherry pick upload location origin 2.15 by @wy65701436 in #24114 Bump Component Version 🤖 Bump trivy(0.75.0) and trivy adapter(0.39.1-rc2) by @stonezdj in #24080 bump v2.15.4 release by @wy65701436 in #24087 …

• vlt CLI releases v1.3.8

  What's Changed ci: widen Bencher alert threshold to 25% over 20 samples by @ruyadorno in #1948 package-info: drop eager cache mkdir from client ctor by @ruyadorno in #1949 package-info: add drain(), settle client work before fixture cleanup [ci full-matrix] by @ruyadorno in #1950 graph: keep test clients off the user cache by @ruyadorno in #1953 registry-client: drop revoked token from every keychain key on logout by @ruyadorno in #1952 graph: recompute dev/optional flags after ideal build by @…

• Astral Blog Python 3.15

  Python 3.15 is out today along with updates for Ruff, uv, and ty.

• pnpm Blog pnpm 12.11.0

  This release adds Rust toolchain management, links the agent skills that dependencies ship, adds the permissions setting, and keeps the colors of streamed script output.

• pnpm Blog pnpm 12.11.1

  This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

• pnpm Blog pnpm 12.11.2

  This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

Thu 8 Oct 2026

• Docker Engine releases v29.9.0

  29.9.0 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: docker/cli, 29.9.0 milestone moby/moby, 29.9.0 milestone Security The Go runtime update fixes the following security vulnerabilities in Docker Engine: CVE-2026-97032 : An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867 CVE-2026-78659 : An HTTP/2 client could exhaust daemon memory by declaring a large number of fields i…

• Docker Engine releases v2.0.0-beta.27

  v2.0.0-beta.27

• Docker Engine releases client/v0.6.2

  0.6.2 Changelog client: bump github.com/docker/go-connections v0.8.2, github.com/Azure/go-ansiterm 8c912ac31dd4. moby/moby#53891 Fix request cancellation and deadlines during client HTTP upgrade handshakes. moby/moby#53889

• uv releases 0.12.24

  Release Notes Released on 2026-10-08. Enhancements Remove orphaned temporary build environments with uv cache prune ( #22171 ) Accept PEP 508 marker operators directly before grouped expressions ( #22309 ) Reject malformed requirements-file options instead of partially parsing or ignoring them ( #22317 ) Show underlying filesystem and registry errors when managed Python uninstallation fails ( #22362 ) Identify the invalid source URL in Python mirror errors ( #22364 ) Preview features Display pr…

• Conda releases 26.9.2

  Bug fixes Fix conda run selecting the active environment instead of the requested target when conda-build is installed. ( #16811 via #16821 ) Fix AttributeError: 'PackageRecord' object has no attribute 'extras' when solving from channels whose repodata uses extra_depends by adding extra_depends to PackageRecord and ignoring the extras selector during record matching. ( #16822 via #16823 ) Contributors @danyeaw @jezdez @kenodegard Full Changelog : 26.9.1...26.9.2

• Swift Blog What's new in Swift: September 2026 Edition

  Welcome to “What’s new in Swift,” a curated digest of releases, videos, and discussions in the Swift project and community. The Vapor web framework recently turned ten and celebrated with Vapor Week! We’ve invited one of the authors of Vapor as this month’s guest contributor: Hi, I’m Tim from the Vapor Core Team! 10 years ago, in September, Vapor 1.0 was released, and over the years Vapor has matured into a comprehensive framework for building backends and APIs in Swift. On the anniversary we r…

• Go releases [release-branch.go1.26] go1.26.9

  Change-Id: Id12b30bb1c4f9e3e6a676fc04faf88dfd6d81021 Reviewed-on: https://go-review.googlesource.com/c/go/+/847127 Auto-Submit: Gopher Robot [email protected] Reviewed-by: Michael Pratt [email protected] TryBot-Bypass: Gopher Robot [email protected] Reviewed-by: Dmitri Shuralyov [email protected]

• Go releases [release-branch.go1.27] go1.27.2

  Change-Id: Ic0b65cb1b99dfa414ec1c8b11360114db21b7530 Reviewed-on: https://go-review.googlesource.com/c/go/+/846986 Auto-Submit: Gopher Robot [email protected] TryBot-Bypass: Gopher Robot [email protected] Reviewed-by: Dmitri Shuralyov [email protected] Reviewed-by: Michael Pratt [email protected]

• pixi releases pixi-build-cmake-v0.4.7

  chore: bump backend versions ( #7206 )

• pixi releases pixi-build-mojo-v0.2.8

  chore: bump backend versions ( #7206 )

• pixi releases pixi-build-python-v0.8.7

  chore: bump backend versions ( #7206 )

• pixi releases pixi-build-r-v0.1.8

  chore: bump backend versions ( #7206 )

• pixi releases pixi-build-rattler-build-v0.4.7

  chore: bump backend versions ( #7206 )

• pixi releases pixi-build-ros-v0.7.6

  chore: bump backend versions ( #7206 )

• pixi releases pixi-build-rust-v0.5.7

  chore: bump backend versions ( #7206 )

• Harbor releases v2.15.4-rc1

  What's Changed Component updates ⬆️ fix(webhook): allow private network access by default by @Vad1mo in #24082 fix(contenttrust): allow legacy signer pull by default to avoid regre… by @wy65701436 in #24086 fix(prepare): expose the legacy signer pull switch in harbor.yml by @bupd in #24101 Cherry pick upload location origin 2.15 by @wy65701436 in #24114 Bump Component Version 🤖 Bump trivy(0.75.0) and trivy adapter(0.39.1-rc2) by @stonezdj in #24080 bump v2.15.4 release by @wy65701436 in #24087 …

• pub.dev releases 20261008t124100-all

  Deployment at 2026-10-08T12:41:11.108163Z.

• Guix Blog Extending Guix

  Guix is all about empowering people, so it should come as no surprise that one can extend it with new guix commands . You can show the commands available in your current Guix through the help command: $ guix help If you are using a recent Guix, there are a number of extensions at your disposal, they are available as individual packages, and as a meta-package providing a collection of extensions . Try them out with: $ guix shell guix guile guix-extension-collection I'm adding the guix and guile …

• Gradle releases 8.14.6

  The Gradle team is excited to announce Gradle 8.14.6. Here are the highlights of this release: Java 24 support GraalVM Native Image toolchain selection Enhancements to test reporting Build Authoring improvements Read the Release Notes We would like to thank the following community members for their contributions to this release of Gradle: Aurimas , Ben Bader , Björn Kautler , chandre92 , Daniel Hammer , Danish Nawab , Florian Dreier , Ivy Chen , Jendrik Johannes , jimmy1995-gu , Madalin Valcele…

• Homebrew releases 7.0.9

  What's Changed formula: extract commit for goreleaser flags by @cho-m in #24163 advisory-match: ignore uncomparable sources by @p-linnane in #24169 Correct Command Line Tools version advice by @MikeMcQuaid in #24170 test/formula_spec: mock cached_download to avoid slow test by @cho-m in #24171 advisory-match: move fixes past shared versions by @p-linnane in #24172 Recommend Xcode 27 on Apple silicon Tahoe by @p-linnane in #24177 Infer Xcode 26.x versions from clang builds by @p-linnane in #2417…

• Harbor releases v2.13.6

  Warning Breaking change: webhooks to internal addresses are blocked by default The fix for GHSA-2phj-cp9f-qq6w blocks webhook and Slack delivery to private, loopback, link-local and other non-public addresses. That includes hostnames that resolve to them, such as *.svc.cluster.local . After you upgrade, existing webhooks to internal endpoints fail to deliver, and new ones are rejected. To allow them again, set the opt-out on both core and jobservice : harbor.yml : network.allow_private_network_…

• Harbor releases v2.14.5

  Warning Breaking change: webhooks to internal addresses are blocked by default The fix for GHSA-2phj-cp9f-qq6w blocks webhook and Slack delivery to private, loopback, link-local and other non-public addresses. That includes hostnames that resolve to them, such as *.svc.cluster.local . After you upgrade, existing webhooks to internal endpoints fail to deliver, and new ones are rejected. To allow them again, set the opt-out on both core and jobservice : harbor.yml : network.allow_private_network_…

• Harbor releases v2.15.3

  Warning Breaking change: webhooks to internal addresses are blocked by default The fix for GHSA-2phj-cp9f-qq6w blocks webhook and Slack delivery to private, loopback, link-local and other non-public addresses. That includes hostnames that resolve to them, such as *.svc.cluster.local . After you upgrade, existing webhooks to internal endpoints fail to deliver, and new ones are rejected. To allow them again, set the opt-out on both core and jobservice : harbor.yml : network.allow_private_network_…

• RubyGems releases v4.1.0.beta2

  RubyGems Changes already released in 4.0.x are not repeated here. Features: Support content addressable gems in Gem::PackageTask . Pull request #9897 by Harriet Oughton, Gira Chawda and Jenny Shen Add --content-addressable to gem build and make --ruby-abi only set the Ruby ABI. Pull request #9906 by Harriet Oughton Enhancements: Drop setuid, setgid and sticky bits when extracting gems. Pull request #9929 by Hiroshi SHIBATA Improve handling of paths with invalid Windows characters. Pull request …

• Swift Package Manager releases swift-DEVELOPMENT-SNAPSHOT-2026-10-06-a

  Tag build swift-DEVELOPMENT-SNAPSHOT-2026-10-06-a

• PHP Foundation Blog Your Tool Has a New Reader

  Every PHP tool that prints to a terminal now has two readers, and most of us have only been writing for one of them. The output of a PHP command-line tool used to have one reader: a developer looking at a terminal. That reader sees glyphs. The terminal interprets escape sequences, moves the cursor, erases lines, and shows the result. What the tool wrote and what the human sees are usually the same thing, and nobody thinks about the gap. A coding agent does not look at a terminal. It reads the b…

• RubyGems Blog 4.1.0.beta2 Released

  RubyGems and Bundler 4.1.0.beta2 include features, enhancements, breaking changes and bug fixes. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.1.0.beta2 Release Notes RubyGems Changes already released in 4.0.x are not repeated here. Features: Support content addressable gems in Gem::PackageTask . Pull request #9897 by Harriet Oughton, Gira Chawda and Jenny Shen Add --co…

Wed 7 Oct 2026

• Gradle releases 9.8.1

  This is a patch release for Gradle 9.8.0. We recommend using 9.8.1 instead of 9.8.0. This release addresses three high rated vulnerabilities: Unauthenticated worker-to-daemon channel deserializes untrusted Java objects Deserialization of untrusted Java objects before authentication in the client - daemon communication Failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts The following issues were resolved: [Gradle 9.8.0 complains again a…

• jj releases v0.46.0

  About jj is a Git-compatible version control system that is both simple and powerful. See the installation instructions to get started. Release highlights Jujutsu can now colocate workspaces besides the default one by creating Git worktrees. Use jj workspace add --[no-]colocate and the setting git.colocate to control this. Breaking changes The minimum supported git command version is now 2.42.0, up from 2.41.0. jj workspace add uses git worktree add --orphan , which was added in 2.42.0. The min…

• Docker Engine releases v29.9.0-rc.2

  29.9.0-rc.2 For a full list of changes from the last release candidate refer to the diff: moby/moby, 29.9.0-rc.1...29.9.0-rc.2 docker/cli, 29.9.0-rc.1...29.9.0-rc.2 Bug fixes and enhancements containerd image store: Add the lazy-pull daemon feature to control whether docker pull skips downloading layer content that the snapshotter already provides. Lazy pulls are enabled by default for known remote snapshotters ( nydus , overlaybd , soci , stargz ). moby/moby#53877 containerd image store: Fix a…

• Terraform releases v1.17.0-rc1

  1.17.0-rc1 (October 07, 2026) NEW FEATURES: Terraform now supports variables and locals in provider requirements ( #39153 ) A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. ( #35290 ) policy: Terraform Policy is now generally available. The -policies flag for plan , apply , and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and…

• Docker Engine releases v2.0.0-beta.26

  v2.0.0-beta.26

• opam releases 2.6.1

  This is the release of opam 2.6.1. Binaries and full archive are signed by the opam dev team (fingerprint 92C5 26AE 50DF 3947 0EB2 911B ED4C F1CA 67CB AA92 ). To verify the authenticity of one of these files, run the following commands: curl -fsSLO https://opam.ocaml.org/opam-dev-pubkey.pgp gpg --import opam-dev-pubkey.pgp gpg --verify *.sig Please see our blog post for more details and the upgrade instructions. Changelog : Changes Regression fixes Fix the depexts installation on opam install -…

• Snapd releases New Release 2.78

  FDE: update keyring after reprovision FDE: set new state after reprovision FDE: complete the decision for auto-repair/reprovision FDE: add memfd-secret backed state for secrets FDE: update secboot to rev dd95d85 - support thunderbolt security level 0 on UC components: account for components in seed refresh triggering components: prevent components in the seed from being removed components: set $SNAP_COMPONENTS in the application's environment, with the path to the snap's own components director…

• Pub releases SDK-3.14.0-312.0.dev

  SDK 3.14.0-312.0.dev

• Pub releases SDK-3.14.0-311.0.dev

  SDK 3.14.0-311.0.dev

• Pub releases SDK-3.14.0-310.0.dev

  SDK 3.14.0-310.0.dev

• PHP Foundation Blog PIE 1.5 Released

  The PIE team is pleased to announce the release of the PHP Installer for Extensions 1.5 series, which has been in the works for around five months. There has been significant work gone into some internal improvements which has enabled us to deliver several long-awaited features for the tool. Lets dive into a few of these new features! Install multiple extensions You are now able to install multiple extensions at once, for example: $ pie install php-amqp/php-amqp:^2.2 girgias/csv This is helpful…

• opam Blog opam 2.6.1 release

  Feedback on this post is welcome on Discuss! We are pleased to announce the release of opam 2.6.1 fixing a couple of regressions and minor annoyances. We advise everyone to upgrade. Please read on for installation and upgrade instructions. Regression fixes Fix the depexts installation on opam install --deps-only when the system packages already exist in a repository (#7153) Improvements Add support for using git repositories owned by another local user (common in docker containers) (#6963) Sinc…

Tue 6 Oct 2026

• Stack releases rc/v4.1.0.3 (release candidate)

  Changes since v4.1.0.1: Other enhancements: Consider Cabal 3.18 to be a tested library and remove warnings. Consider GHC 10.0 to be a tested compiler and remove warnings. Add flag --[no-]info-table-profiling (default: disabled) to Stack's build command. Set the flag to enable info table profiling, including the creation of a new info table for every use of a data constructor in the source program.

• vlt Blog How we made registry metadata 70% smaller

  Package managers download megabytes of package metadata on every clean install. Here is how vlt.io serves the same installs at a fraction of the size.

• pub.dev releases 20261006t104700-all

  Deployment at 2026-10-06T10:47:43.531853Z.

• Pub releases SDK-3.14.0-309.0.dev

  SDK 3.14.0-309.0.dev

• Pub releases SDK-3.14.0-308.0.dev

  SDK 3.14.0-308.0.dev

• Pub releases SDK-3.14.0-307.0.dev

  SDK 3.14.0-307.0.dev

• Pub releases SDK-3.14.0-306.0.dev

  SDK 3.14.0-306.0.dev

• Pub releases SDK-3.14.0-305.0.dev

  SDK 3.14.0-305.0.dev

• vlt CLI releases v1.3.7

  What's Changed fix(package-info): flush registry-client cache in remaining test teardowns by @vltbaudbot in #1945 vlt outdated command by @evert in #1941 fix(graph): keep lockfile integrity and brotli bit together by @evert in #1947 Release v1.3.7 by @vltops in #1946 Full Changelog : v1.3.6...v1.3.7

• pnpm Blog pnpm 11.28.5

  This release reads cached registry metadata faster and makes pnpm config get --global ignore project settings. It also carries several security fixes for package archives, git dependencies, and config dependencies.

• pnpm Blog pnpm 12.10.0

  This release adds an experimental loaded node linker, lets pnpm-lock.yaml record resolution settings, and reads cached registry metadata faster. It also carries several security fixes, including one that stops a dependency version from writing files outside the global virtual store.

• pnpm Blog pnpm 12.10.1

  This release fixes pnpm install failures after an overrides change and on a filtered frozen install with catalogPrune. It also fixes several bugs in the experimental nodeLinker.type: loaded, which now keeps its generated files in node_modules.

Mon 5 Oct 2026

• Dependabot Core releases v0.399.0

  What's Changed Bump pacote from 21.3.1 to 21.5.1 in /npm_and_yarn/helpers by @dependabot [bot] in #16411 Report conflicting dependencies for security updates by @v-thavaahariharangit with @Copilot in #16335 Fix vulnerable Yarn alias test fixture by @v-thavaahariharangit with @Copilot in #16414 Bump the dev-dependencies group across 1 directory with 2 updates by @dependabot [bot] in #16403 Use typed UV lockfile records in parsing and resolution by @JamieMagee in #16348 Add typed Composer manifes…

• Elm releases 0.19.3

  Elm 0.19.3 introduces some compiler infrastructure upgrades, giving a good foundation for the more exciting stuff in the pipeline. More info is available here: Another step towards Elm 1.0 There are no language changes , so once you swap to "elm-version": "0.19.3" in your elm.json file, you should be able to proceed without any further code changes. Install The links below include (1) a Mac and Windows installer and (2) 64-bit binaries for various platforms. ✨ Install ✨ For examples of download…

• Homebrew releases 7.0.8

  What's Changed test-bot: skip bottles for unsatisfiable formulae by @daeho-ro in #24104 Time out stalled cask audit downloads by @p-linnane in #24108 cask: remove pre-staged downloads when installs fail by @dergachoff in #24107 diagnostic: allowlist JPKI client dylibs by @ttsuru in #24110 shell: fish-quote the fish profile line by @rawsun007 in #24114 keg: keep versioned opt aliases that still point at an installed keg by @erikdw in #24113 docs/_layouts/base.html: fix heading permalinks by @bev…

• Pub releases SDK-3.14.0-304.0.dev

  SDK 3.14.0-304.0.dev

Sun 4 Oct 2026

• Pub releases SDK-3.14.0-303.0.dev

  SDK 3.14.0-303.0.dev

Sat 3 Oct 2026

• cargo-semver-checks releases v0.51.0

  In this release C-ABI variadic functions are new in Rust 1.99, and this is the first time a new language feature has had immediate SemVer linting support in the corresponding cargo-semver-checks release 🎉 Six new lints for variadic functions: function_no_longer_variadic function_now_variadic inherent_method_no_longer_variadic inherent_method_now_variadic trait_method_no_longer_variadic trait_method_now_variadic Bugfix in inherent_method_now_doc_hidden when multiple impl blocks for the same type…

• uv releases 0.12.23

  Release Notes Released on 2026-10-03. Python Add CPython 3.15.0rc3 ( #22164 ) Preview features Sync from uv.lock without a workspace manifest using uv sync --frozen with frozen-lockfile ( #22018 ) Export from uv.lock without a workspace manifest using uv export --frozen with frozen-lockfile ( #22007 ) Inspect dependency trees from uv.lock without a workspace manifest using uv tree --frozen with frozen-lockfile ( #22016 ) Inspect workspace metadata and optionally sync its environment from uv.loc…

• vlt CLI releases v1.3.6

  What's Changed Version parsing caching by @evert in #1940 fix(build): use portable shebang for Alpine / BusyBox compat by @vltbaudbot in #1943 fix(package-info): flush registry-client cache in prefetchResolve test teardown by @vltbaudbot in #1944 Release v1.3.6 by @vltops in #1942 Full Changelog : v1.3.5...v1.3.6

• pnpm Blog pnpm 11.28.4

  pnpm 11.28.4 fixes two ways credentials could leak, makes pnpm install --frozen-lockfile accept several lockfiles it rejected, warns when an optional dependency cannot be fetched, and stops pnpm self-update from installing a second pnpm next to a Homebrew one.

• pnpm Blog pnpm 12.9.1

  This release moves the WebContainer build into a separate @pnpm/wasm package, shrinks the pnpm package back to about 4 MB, and fixes pnpm publish with provenance from GitLab CI.

Fri 2 Oct 2026

• sbt releases 2.0.10

  changes with compatibility implications sbt runner script honors JAVA_HOME environment variable by @anatoliykmetyuk in #9825 🚀 updates deps: Updates to Coursier 2.1.26, and sets user agent header by @eed3si9n in #9784 , #9852 , #9786 and #9818 🐛 bug fixes fix: Removes write permission from the CAS to prevent cache corruption by @eed3si9n in #9847 fix: Implements copy-on-write for symlinks by @eed3si9n in sbt/io#568 fix: Restores the pipelining early output on an action-cache hit by @PhoenixmitX…

• Conda releases 26.9.1

  Bug fixes Keep cached package archive paths consistent with their recorded filenames and checksums when both archive formats are present. Restore the fix from conda 26.7.3 that was missing in 26.9.0. ( #9674 via #16793 ) Contributors @jezdez

• Terraform releases v1.16.5

  1.16.5 (September 30, 2026) BUG FIXES: Fixed a crash that happens when a tainted instance state is seen without a valid status ( #39287 ) resource-identity: fixed an issue where resource identity could be nil during delete ( #39285 )

• pub.dev releases 20261002t120500-all

  Deployment at 2026-10-02T12:05:10.244069Z.

• vlt CLI releases v1.3.5

  What's Changed Fix performance regressions by @evert in #1935 Hedge against a slow resolve endpoint by @evert in #1936 Release v1.3.5 by @vltops in #1938 Full Changelog : v1.3.4...v1.3.5

• uv releases 0.12.22

  Release Notes Released on 2026-10-01. Python Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 ( #22147 ) Enhancements Accept uppercase release suffixes in wheel platform tags ( #22113 ) Record workspace-member default groups in lockfiles ( #22010 , #22103 ) Record workspace-member dependency-group Python requirements in lockfiles ( #22044 , #22103 ) Record default groups for non-project workspace roots in lockfiles ( #22104 ) Record dependency-group Python requirements for non-project…

• Conda Blog August and September 2026 Releases

  conda and conda-build 26.9.0 are out, with native Windows ARM64 launchers, package timestamp filtering, v1 recipe fixes, and more releases since July.

• Go Blog Arch-specific SIMD in Go

  Go 1.27 introduces experimental arch-specific SIMD vector APIs

• Rust Blog Demoting i686 Windows targets to std-only

  With Rust 1.100.0, the following changes to 32-bit Windows targets will happen: i686-pc-windows-msvc Tier 1 with host tools target will be demoted to Tier 1 without host tools. i686-pc-windows-gnu Tier 2 with host tools target will be demoted to Tier 2 without host tools. Builds of the standard library will continue to be distributed, but host tools such as the compiler will be no longer available. i686-pc-windows-msvc as a Tier 1 target still undergoes CI testing. To build 32-bit Windows binar…

• Zig News 0.17.0 Released
• pnpm Blog pnpm 12.9.0

  This release runs pnpm in StackBlitz WebContainers, adds a per-registry networkConcurrency setting, and records every installed project in the store. It also carries a security fix for pnpm login.

Thu 1 Oct 2026

• vlt CLI releases v1.3.4

  What's Changed package-info, registry-client: verify remote tarballs against their stored integrity by @ruyadorno in #1898 graph: mark appendNodes entries seen at enqueue by @ruyadorno in #1910 graph: hardlink install-script packages, copy them only before their scripts run by @ruyadorno in #1918 Using the vlt resolve endpoints for server-side graph resolution by @evert in #1932 Release v1.3.4 by @vltops in #1933 Full Changelog : v1.3.3...v1.3.4

• Docker Engine releases v29.9.0-rc.1

  29.9.0-rc.1 For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: docker/cli, 29.9.0 milestone moby/moby, 29.9.0 milestone Bug fixes and enhancements containerd image store: Fix pulls skipping required layer blobs when unpacked layers already exist, leaving images runnable but incomplete for export or push. moby/moby#53615 Fix docker container create --name reporting a misleading validation error mentioning invalid characters instead of invalid n…

• Docker Engine releases v2.0.0-beta.25

  v2.0.0-beta.25

• Athens releases v0.19.2

  A rerelease of https://github.com/gomods/athens/releases/tag/v0.19.0

• OpenTofu releases v1.12.7

  SECURITY ADVISORIES: When using either a remote-exec or file provisioner to connect to an attacker-controlled SSH server, the server could previously deadlock the connection by sending certain unexpected packet types. ( #4551 ) This addresses the upstream Go security advisories CVE-2026-78662 and CVE-2026-56855 .

• Athens releases v0.19.1

  A rerelease of https://github.com/gomods/athens/releases/tag/v0.19.0

• OpenTofu releases v1.13.1

  BUG FIXES: tofu show -json <planfile> now works again when ephemeral resources are present in the configuration. ( 4623 ). Ephemeral output values are now always re-evaluated during the apply phase, instead of sometimes using stale values from the planning phase. ( #4582 )

• Athens releases v0.19.0

  What's Changed Add -verify-storage to purge checksum-mismatched modules from storage ( #2145 ) by @matt0x6F in #2146 docs: updating config.dev.toml to state NetworkMode env override by @deweesevs in #2150 Add a Cache-Control config option for module file endpoints by @ChrisJr404 in #2153 feat: Add support for upstream trace headers as request ID by @captainp1an3t in #2124 chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.83.1 by @dependabot [bot] in #2155 update-go-pkg(deps): bump go.op…

• Cargo releases 0.100.0

  0.100.0 release

• pub.dev releases 20261001t111400-all

  Deployment at 2026-10-01T11:14:55.901518Z.

• Maven releases 3.10.0

  🚀 New features and improvements Maven 3.10.x should use Maven 3.1 validation in strict mode ( #1542 ) @gnodet Do not depend on maven-resolver-supplier-mvn3 ( #13266 ) @cstamas [MNG-6797] - Remember if Maven model problems were encountered. ( #298 ) @wilx feat: add relativePath validation ( #12742 ) @cstamas Add validation for Plexus-based plugin dependency injection ( #12651 ) @slawekjaranowski Introduce validation control ( #12549 ) @cstamas Update to Resolver 2.0.21 ( #12504 ) @cstamas [MNG-5…

• Conda releases 26.9.0

  ✨ Special announcements ✨ Upcoming change to automatic pip installation Conda 26.9 marks the implicit installation of pip alongside Python as pending deprecation. It remains enabled by default in this release. The behavior becomes deprecated in conda 27.3, and add_pip_as_python_dependency will default to false in conda 27.9. The setting itself remains supported. If your environments need pip, request it explicitly, for example with conda create -n myenv python pip . To retain automatic installa…

• vlt CLI releases v1.3.3

  What's Changed graph: memoize node paths, create reify symlinks synchronously by @ruyadorno in #1915 graph: skip needless rm and unsupported optional deps in reify by @ruyadorno in #1914 package-info: serve fresh moving-selector packuments during installs by @ruyadorno in #1913 Release v1.3.3 by @vltops in #1931 Full Changelog : v1.3.2...v1.3.3

• Rust Blog Announcing Rust 1.99.0

  The Rust team is happy to announce a new version of Rust, 1.99.0. Rust is a programming language empowering everyone to build reliable and efficient software. If you have a previous version of Rust installed via rustup , you can get 1.99.0 with: $ rustup update stable If you don't have it already, you can get rustup from the appropriate page on our website, and check out the detailed release notes for 1.99.0 . If you'd like to help us out by testing future releases, you might consider updating …

Wed 30 Sep 2026

• Cabal releases cabal-install-v3.18.2.0

  No content.

• vlt CLI releases v1.3.2

  What's Changed Support for v2 vlt mimetype by @evert in #1929 cli-sdk: align ci allow-scripts default with install by @ruyadorno in #1908 infra-build: compile cache fallback when tmpdir is unwritable by @ruyadorno in #1911 Release v1.3.2 by @vltops in #1928 Full Changelog : v1.3.1...v1.3.2

• OpenTofu releases v1.13.0

  OpenTofu 1.13.0 We're proud to announce that OpenTofu 1.13.0 is now officially available! 🎉 Highlights Windows on ARM64 is now a supported platform Starting with OpenTofu v1.13.0 we are now offering official packages targeting Windows on the ARM64 (also known as "aarch64") CPU architecture. Reducing unknowns during planning OpenTofu v1.13 introduces a number of new functions that are all intended to allow module authors to give OpenTofu additional hints about what they know to be true even thou…

• NuGet Client releases 8.0.0.13

  Insert 8.0.0.13 into main on 09/30/2026 12:36:12

• Cabal releases cabal-install-solver-v3.18.2.0

  cabal-install-solver-v3.18.2.0

• Cabal releases Cabal-syntax-v3.18.2.0

  Cabal-syntax-v3.18.2.0

• Cabal releases Cabal-v3.18.2.0

  Cabal-v3.18.2.0

• Cabal releases 3.18.2+0: Merge pull request #12400 from ffaf1/fix-changelogs

  Fix changelogs

• RubyGems releases v4.0.22

  RubyGems 4.0.22 Enhancements: Add --source option to gem exec command. Pull request #9765 by Akshay Birajdar Keep credentials on redirects only within the same origin. Pull request #9909 by Hiroshi SHIBATA Validate the version field in Gem::Installer#verify_spec. Pull request #9890 by Hiroshi SHIBATA Installs bundler 4.0.22 as a default gem. Bug fixes: Remove the build_info file on uninstall and stop gem build from logging unknown extensions. Pull request #9894 by Hiroshi SHIBATA Bundler 4.0.22…

• Scoop releases Version 0.6.0

  ✨ Highlights This release contains changes that may be considered breaking. Manifest authors should review: checkver GitHub mode requires explicit github: key ( #6641 ): manifests using url: with a GitHub URL for checkver must switch to github: to opt into the GitHub token path. Token usage is now scoped to explicit github mode only. checkver GitHub mode defaults changed ( #6653 ): new default jsonpath / regex for GitHub-based version checks. checkver.script behavior is affected — verify script…

• PHP Foundation Blog 2027 Applications for Contractors are Open

  As we have done in past years, The PHP Foundation is opening applications for contractors for 2027. Foundation contractors are responsible for a variety of core development areas, and we are open to hearing your ideas. The application form will be open until October 20, 2026, end of day, Anywhere on Earth (AoE). Apply Now What are the requirements? Note: This is not a job for PHP developers or aspiring PHP developers. PHP is written in the C programming language, and as such, this role requires…

• RubyGems Blog 4.0.22 Released

  RubyGems 4.0.22 includes enhancements and bug fixes and Bundler 4.0.22 includes enhancements, bug fixes and documentation. To update to the latest RubyGems you can run: gem update --system [--pre] To update to the latest Bundler you can run: gem install bundler [--pre] bundle update --bundler=4.0.22 RubyGems Release Notes Enhancements: Add –source option to gem exec command. Pull request #9765 by Akshay Birajdar Keep credentials on redirects only within the same origin. Pull request #9909 by Hi…

• pnpm Blog pnpm 12.8.2

  pnpm 12.8.2 fixes a startup crash on Linux ppc64le and UnknownIssuer errors on systems without CA certificates. pnpm run no longer installs before every script on CI when autoDedupe is enabled, and resolution and hoisted installs on macOS are faster.

Tue 29 Sep 2026

• uv releases 0.12.21

  Release Notes Released on 2026-09-29. Python Update CPython to use OpenSSL 3.5.9 ( #22076 ) Enhancements Omit empty [manifest] tables from lockfiles that contain only manifest subtables ( #22070 ) Preview features Omit redundant runtime constraints from uv.lock , including those involving pre-releases, with the resolution-inputs preview feature ( #22004 , #22068 ) Bug fixes Prevent uv python pin --rm from removing a global .python-versions file without --global ( #21992 ) Fix installed-package …

• vlt CLI releases v1.3.1

  What's Changed registry-client: reuse connections on short keep-alive hints by @ruyadorno in #1917 Skipping 409ed published packages so this job can be re-run idempotently by @evert in #1923 Fix brotli regression by @evert in #1927 Release v1.3.1 by @vltops in #1922 Full Changelog : v1.3.0...v1.3.1

• Podman releases v5.8.8

  This release addresses CVE-2026-94603 , where a podman run on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created. Breaking Changes Removed support for checkpoint images in podman run due to serious security concerns with the different security models of running images and running checkpoints. Checkpoints ignore user-specified security configurati…

• Conan releases 2.33.0 (29-Sep-2026)

  Feature: Support for CPS components configurations. ( #20354 ) Feature: Use extra_info to provide CPEs to the component. ( #20353 ) Feature: Download recipe and package metadata in parallel with regular files instead of after them. ( #20351 ) Feature: Add core.net.http:trust_store conf to verify HTTPS certs against the OS trust store. ( #20343 ). Docs: 📃 Feature: New remotes force_auth capability. ( #20341 ). Docs: 📃 Feature: Add copy_config_files to the [runner] profile to copy extra host conf…

• Podman releases v6.1.3

  Security This release addresses CVE-2026-94603 , where a podman run on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created. Breaking Changes Removed support for checkpoint images in podman run due to serious security concerns with the different security models of running images and running checkpoints. Checkpoints ignore user-specified security co…

• Conda releases 26.7.3

  Bug fixes Ensure v3 packages are available when mixing sharded and unsharded repos. ( #16676 via #16688 ) Keep cached package archive paths consistent with their recorded filenames and checksums when both archive formats are present. ( #9674 ) Contributors @jezdez

• pub.dev releases 20260929t123100-all

  Deployment at 2026-09-29T12:31:04.540301Z.

• pub.dev releases 20260929t121300-all

  Deployment at 2026-09-29T12:13:26.515169Z.

• Packagist Blog 15 years of Packagist: Over 200 billion package installs

  On September 27th, 2011, Jordi submitted monolog/monolog to Packagist.org, it got package ID 1. Fifteen years later, Packagist.org lists more than 469,000 packages with over 5.8 million versions, and Composer has installed packages from it more than 200 billion times. Monolog alone has passed one

• Pkg.jl releases v1.13.1

  Merge pull request #4815 from JuliaLang/backports-release-1.13 Backports for 1.13

• PHP Foundation Blog Meet bunny.net: A PHP Foundation Sponsor supporting the language that powers the web it delivers

  Starting June 2026, bunny.net joined the PHP Foundation as a Silver Sponsor , reinforcing its commitment to the open-source technologies that keep a huge share of the modern web online. bunny.net is a European web infrastructure platform with 119 points of presence worldwide that brings together content delivery (DNS, CDN, video), security (WAF, DDoS and bot protection), and a developer platform (app containers, serverless functions, database and S3-compatible storage). In this way, bunny.net g…

Mon 28 Sep 2026

• uv releases 0.12.20

  Release Notes Released on 2026-09-28. Enhancements Reuse lockfiles when dependency declarations are semantically equivalent ( #21951 ) Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs ( #21990 ) Preview features Write normalized requirement declarations with the lockfile-normalization preview feature ( #21951 ) Honor synthetic default groups when installing or syncing from pylock.toml ( #22003 ) Resolve local paths in exported pylock.toml files relativ…

• vcpkg releases 2026-09-26 Release

  What's Changed Add privacy and telemetry notices to the help command by Victor Romero (@vicroms) in #2087 Add Windows arm64 release presets by Billy O'Neal (@BillyONeal) in #2082 Fix x-add-version to be as transactional as its error messages suggest (and 1/10th the time) by Billy O'Neal (@BillyONeal) in #2050 [curl] propagate VCPKG_SSL_REVOKE_BEST_EFFORT to spawned processes by Pavel Pokutnev (@mem16k) in #2098 Take the registries lock before git init by Bugale Bugalit (@bugale) in #2093 Add di…

• Flatpak releases 1.18.4

  Security fixes: Prevent privileged overwrite of arbitrary files with an empty file or a symlink to /run/host/monitor/resolv.conf when a malicious app is installed (CVE-2026-97024, GHSA-8xgq-v545-vgvf ; thanks to Sebastian Wick) Prevent privileged deletion of arbitrary files when a malicious app is installed (CVE-2026-97023, GHSA-5p67-xh8x-rq54 ; thanks to Sebastian Wick) When downloading apps or runtimes from an OCI repository that requires authentication, don't make the authentication token vi…

• Flatpak releases 1.19.2

  This is a development prerelease from the 1.19.x series. The first stable release from this branch will be 1.20.0. Changes in 1.19.2 Bug fixes: Use bubblewrap from our PPA in the CI pipeline for creating releases Changes in 1.19.1 Security fixes: Prevent privileged overwrite of arbitrary files with an empty file or a symlink to /run/host/monitor/resolv.conf when a malicious app is installed (CVE-2026-97024, GHSA-8xgq-v545-vgvf ; thanks to Sebastian Wick) Prevent privileged deletion of arbitrary…

• Flatpak releases flatpak 1.19.1

  This is a development prerelease from the 1.19.x series. The first stable release from this branch will be 1.20.0. Security fixes: Prevent privileged overwrite of arbitrary files with an empty file or a symlink to /run/host/monitor/resolv.conf when a malicious app is installed (CVE-2026-97024, GHSA-8xgq-v545-vgvf ; thanks to Sebastian Wick) Prevent privileged deletion of arbitrary files when a malicious app is installed (CVE-2026-97023, GHSA-5p67-xh8x-rq54 ; thanks to Sebastian Wick) When downl…

• sbt releases 2.1.0-M3

  updates and bug fixes fix: Restore cross-suffixed artifactIds in sbt 1 plugin POMs by @mkurz in #9804 fix: Restore sbt 1 plugin POM metadata by @mkurz in #9806 fix: Hash the boot classpath in sorted order by @hoangmaihuy in #9809 fix: Derive Maven paths from module and artifact names by @mkurz in #9811 fix: Restore the pipelining early output on an action-cache hit by @PhoenixmitX in #9793 fix: publishLocal must overwrite, remote publish must not by @jozanek in #9814 fix: Remove duplicate self …

• Homebrew releases 7.0.7

  What's Changed Reconcile records for removed resources by @p-linnane in #24049 Extend sandboxing to package processing by @MikeMcQuaid in #24038 Report analytics failure when debugging by @SMillerDev in #24059 Fix pkgconf infinite reinstall after macOS upgrade by @rseleven in #24061 Check extensionless scripts in style commands by @MikeMcQuaid in #24063 shims/super/cc: update swift path by @cho-m in #24065 install_steps: fix sandbox write path resolution by @kronikpillow in #24067 formula: prov…

• Dependabot Core releases v0.398.0

  What's Changed Fix NilClass passed to Pub cooldown in_cooldown_period? by @v-kbukum1 in #16362 Bump browserslist from 4.28.1 to 4.28.9 in /npm_and_yarn/helpers by @dependabot [bot] in #16145 Bump @humanfs/node from 0.16.6 to 0.16.8 in /bun/helpers by @dependabot [bot] in #16144 Bump js-yaml from 3.14.2 to 3.15.2 in /npm_and_yarn/helpers by @dependabot [bot] in #16236 Bump poetry from 2.4.1 to 2.4.3 in /python/helpers in the poetry group across 1 directory by @dependabot [bot] in #16193 Bump gol…

• PHP Foundation Blog Kicking Off the Community Events Coalition Special Interest Group

  Community events are the lifeblood of the PHP ecosystem. They're where people come to learn from each other, meet new people, expand their professional networks, build things together, strengthen friendships, sharpen their public speaking skills, and experience the power of belonging to a community. Most importantly, community events are where we build trust with each other . Trust has never been more important than it is today. It's always been a challenge in our industry, because so much of o…

• pnpm Blog pnpm 12.8

  pnpm 12.8 warns when pnpm pack or pnpm publish would ship a .env file, installs sharedWorkspaceLockfile: false workspaces concurrently, applies every setting passed as --config. = , and no longer leaves the Windows terminal stuck after Ctrl+C in a script. This release also carries a...

Sat 26 Sep 2026

• NuGet Client releases 8.0.0.10

  Insert 8.0.0.10 into main on 09/26/2026 12:27:36

Fri 25 Sep 2026

• NuGet Client releases 8.0.0.9

  Insert 8.0.0.9 into main on 09/25/2026 12:26:07

• pnpm Blog pnpm 11.28

  pnpm 11.28 adds the forceIgnoresPlatform setting and pnpm update --peer, and brings a large batch of fixes from pnpm 12 to the JavaScript CLI: pnpm deploy, --filter, nodeLinker: hoisted, and custom modulesDir setups all behave better. It also carries security fixes for shell completion, bin...

• pnpm Blog pnpm 12.7

  pnpm 12.7 lets the global node shim follow .nvmrc and .node-version, adds pnpm install --allow-build and pnpm publish --publish-wait-timeout, and creates pnpm-workspace.yaml from the workspaces field of package.json. pnpm install --force no longer installs optional dependencies built for other...

Thu 24 Sep 2026

• Maven releases Maven 4.0.0-rc-7

  This release candidate is expected to be the last before the Maven 4.0.0 GA release, which we aim to publish in the coming weeks, pending community feedback. 🚀 New features and improvements Log API enhancements and mojo MDC ( #12690 ) @gnodet Optimize reactor sort and phase comparator performance ( #12901 ) @gnodet Add AsyncDrainWriter to eliminate PrintWriter lock contention ( #12892 ) @gnodet Add validation for Plexus-based plugin dependency injection ( #12649 ) @slawekjaranowski 🔧 Maintenanc…

• Yarn releases v4.18.1

  What's Changed fix(core): patch got to prevent crash on settled promise cancelation by @Ayush442842q in #7249 New Contributors @Ayush442842q made their first contribution in #7249 Full Changelog : https://github.com/yarnpkg/berry/compare/@yarnpkg/cli/4.18.0...@yarnpkg/cli/4.18.1

• Yarn releases 2026-09-24

  2026-09-24

• Yarn releases @yarnpkg/core/4.9.2

  @yarnpkg/core

• DNF5 releases 5.4.6.0

  Update translations from weblate spec: Symlink microdnf(8) and yum(8) manual pages to dnf5(8) Update FSF's address in GPL-2.0 disclaimers Update LGPL-2.1 and GPL-2.0 texts to current FSF's wording fix: DNF5_FORCE_COLUMNS / non-TTY width in transaction table progressbar: Report progress to terminal taskbar via OSC 9;4 Makefile: Add FEDORA_VERSION to unify defaults spec: Require GCC ≥ 14.1 for std::chrono::parse() dnf5daemon: Hide invalid offline transactions Clarify plugin source language option…

• Gradle releases 9.8.0

  The Gradle team is excited to announce Gradle 9.8.0. Here are the highlights of this release: Java 27 support Maven mirror settings reuse Linked problem locations in build output Read the Release Notes We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam , Björn Kautler , Eng Zer Jun , Hashim Khan , Julian Krannich , KBS , Labh R Jethe , Mark Dodgson , Maxim , monkey , nataphon-ktsystems , Paul King , Qiu Tian , rg_sandesh , Rober…

• pub.dev releases 20260924t135800-all

  Deployment at 2026-09-24T13:58:59.167218Z.

• NuGet Client releases 8.0.0.8

  Insert 8.0.0.8 into main on 09/24/2026 12:20:36

• vlt Blog Public Packages

  Explore the JavaScript ecosystem without an account, and publish packages from your own registry for anyone to install.

• Harbor releases v2.15.3-rc2

  What's Changed Component updates ⬆️ (cherry-pick) fix: avoid panic in user audit event resolver on nil event data ( #23461 ) by @Aloui-Ikram in #23501 (cherry-pick) fix: Constrain /registries/ping to the saved URL for existing registries ( #23463 ) by @Aloui-Ikram in #23502 (cherry-pick) Add a size limit for manifest uploads by @Aloui-Ikram in #23503 cherry-pick: fix(ui): use dark login background in dark mode by @bupd in #23539 ci: remove third-party docker action by @stonezdj in #23693 (cherr…

• Go Blog Platform-independent SIMD in Go

  Go 1.27 adds an experimental platform-agnostic SIMD API

Wed 23 Sep 2026

• NuGet Blog Microsoft is updating its author-signing certificate starting September 23, 2026

  Starting September 23, 2026, Microsoft is updating the author-signing certificate used for NuGet packages. Customers using trusted signer policies or certificate fingerprint verification should add the new certificate as soon as possible. The post Microsoft is updating its author-signing certificate starting September 23, 2026 appeared first on .NET Blog .

• sbt releases 2.1.0-M2

  updates and bug fixes fix: Fixes Windows runner handling of sbt bsp by @stasimus in #9766 fix: Do not duplicate platform axes on a row by @kitbellew in #9757 fix: Warn on output declarations in uncached tasks by @anatoliykmetyuk in #9770 Allow adding rows and configuring them separately, and through any method by @kitbellew in #9765 fix: Update to Gigahorse 0.9.6 for pre-authentication by @eed3si9n in #9775 fix: Name taskValue in its compile-time diagnostic by @anatoliykmetyuk in #9779 ProjectM…

• Terraform releases v1.17.0-beta2

  1.17.0-beta2 (September 23, 2026) NEW FEATURES: Terraform now supports variables and locals in provider requirements ( #39153 ) A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. ( #35290 ) policy: Terraform Policy is now generally available. The -policies flag for plan , apply , and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks…

• Terraform releases v1.16.4

  1.16.4 (September 23, 2026) BUG FIXES: Fixed an issue where Terraform fails when rendering policy evaluation outcomes for older versions of Terraform Enterprise ( #39095 ) stacks: Fix invalid deferred error triggered by provider returning a deferral when a resource also has an unknown count/for_each. ( #39237 )

Tue 22 Sep 2026

• asdf releases v0.20.2

  0.20.2 (2026-09-22) Bug Fixes fix release ( #2337 ) ( eac99e3 )

• Gradle releases 9.8.0 RC3

  The Gradle team is excited to announce Gradle 9.8.0 RC3. Here are the highlights of this release: Java 27 support Maven mirror settings reuse Linked problem locations in build output Read the Release Notes We would like to thank the following community members for their contributions to this release of Gradle: Aman Gautam , Björn Kautler , Eng Zer Jun , Hashim Khan , Julian Krannich , KBS , Labh R Jethe , Mark Dodgson , Maxim , monkey , nataphon-ktsystems , Paul King , Qiu Tian , rg_sandesh , R…

• Flatpak releases 1.18.3

  Bug fixes: Update Meson wrap subprojects for projects that are normally taken from the host system: bubblewrap 0.12.0 (CVE-2026-87766) xdg-dbus-proxy 0.1.8 (CVE-2026-93676) Fix regressions in 1.18.2 when building apps/runtimes, especially on SELinux systems or when the runtime is not installed per-user ( #6818 ) Fix subsandbox startup ( flatpak-spawn ) when run from an app that was configured with --no-talk-name or --system-no-talk-name ( #6776 ) Fix a crash when a bundle is installed with expl…

• Rust Blog Announcing a Maintainer in Residence: Scott Schafer for the Cargo team

  At the end of August, we announced our first Maintainers in Residence, Rust Project contributors who are funded for their upstream contributions and maintenance work from the Rust Foundation Maintainers Fund (RFMF). Since then, the Rust Leadership Council has dedicated more funds from its Project Priorities budget to RFMF, and together with AWS also providing additional funds, this allowed us to open a new full-time Maintainer in Residence (MiR) position to support the Cargo team. We would like…

• pnpm Blog pnpm 12.6

  pnpm 12.6 ships with automatic dependency deduplication, relocatable node_modules, --save-types for installing @types/* packages alongside their counterparts, package.yaml manifest editing, and file: / link: protocols in catalogs.

Mon 21 Sep 2026

• winget releases Windows Package Manager 1.29.380

  This is a servicing release of Windows Package Manager v1.29. If you find any bugs or problems, please help us out by filing an issue . New in v1.29 New Feature: Source Priority Note Experimental under sourcePriority ; defaulted to disabled. With this feature, one can assign a numerical priority to sources when added or later through the source edit command. Sources with higher priority are sorted first in the list of sources, which results in them getting put first in the results if other thin…

• Dependabot Core releases v0.397.0

  What's Changed Bump js-yaml from 3.14.1 to 3.15.2 in /bun/helpers by @dependabot [bot] in #16292 Bump Microsoft.Extensions.Logging from 10.0.11 to 10.0.12 by @dependabot [bot] in #16284 Fix devcontainers crash on features referenced without a version tag by @v-kbukum1 in #16295 Add support for .zst nixpkgs tarball by @bazcatqubed in #16166 npm_and_yarn: route pnpm 12 native binary download through the proxy by @Stanzilla in #16170 julia: derive stdlib compat entries from the versions bundled ac…

• Homebrew releases 7.0.6

  What's Changed Revert "Use InfluxDB v3 API for analytics reporting" by @SMillerDev in #24056 Clear the environment when reopening cask apps by @MikeMcQuaid in #24057 Full Changelog : 7.0.5...7.0.6

• Homebrew releases 7.0.5

  What's Changed Reject redundant minimum macOS dependencies by @p-linnane in #24020 Avoid duplicate Caskroom loads in doctor by @joseph1020 in #24026 Fix historical loading and CPANSA fallback by @p-linnane in #24029 Type Style options instead of **options by @dduugg in #24025 Avoid repeated Cask rename migrations during update by @joseph1020 in #24031 Type Formulary options instead of **options by @dduugg in #24032 pypi: resolve non-PyPI sources missing from PyPI by @daeho-ro in #24036 shell: d…

• setup-uv releases v10.2.0 🌈 Disable automatic cache saves for merge queues

  Changes This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used. 🚀 Enhancements Disable automatic cache saves for merge queues @eifinger ( #1056 ) 🧰 Maintenance chore: update known checksums for 0.12.17 @ github-actions[bot] ( #1058 ) chore: update known checksums for 0.12.16 @ github-actions[bot] ( #1057 ) chore: update known checksums for 0.12.15 @ github-a…