Tag
PyPI now rejects uploads of new files to releases older than 14 days to prevent supply-chain attacks, a proactive security measure announced by Seth Larson.
PyPI now rejects new file uploads to releases older than 14 days, a security measure to prevent supply chain attacks by compromising old releases. The change was driven by incidents like the LiteLLM and Telnyx compromises.
Discusses the problem of AI coding agents installing typo-squatted npm packages (like loadash) and asks for methods to block such fakes before postinstall scripts run.
A guide on creating a Guix package from a binary using the copy-build-system, explaining how to set up an install plan.
Collider extends Meson's native wrap ecosystem with modern package management features including automatic dependency resolution, lockfiles, and publish/share capabilities, fully compatible with WrapDB.
This article explores how different package management strategies and tools reflect organizational communication structures, illustrating Conway's Law through monorepos, workspaces, Bazel, Nix, Docker, and more.
An optimization in uv's resolver improves performance for Jupyter by 13% and Boto3 by 2.4x, detailed in a write-up.
The article criticizes the misinterpretation of Trusted Publishing as a human trust mechanism, clarifying that it is a machine-to-machine OIDC-based authentication scheme that improves security by eliminating long-lived credentials.
Zig moves all package management functionality from the compiler to the build system, reducing binary size and enabling easier patching and safety checks. This architectural change improves the build server protocol and unblocks ZLS integration.
A Debian package xsnow includes a political Easter egg that displays Ukrainian flags when the language is set to Russian, sparking debate about DFSG compliance.
GuixPkgs is a project that makes every GNU Guix package available as a Nix flake, allowing users to mix Guix and Nixpkgs packages in a single flake. It uses guix-transfer to convert Guix derivations to Nix derivations and provides a binary cache to avoid rebuilding the entire Guix bootstrap.
yay v13 introduces Lua hooks for extensibility and displays PKGBUILD last modification time to help users review packages more carefully, responding to the AURpocalypse incident.
Introduces pkgcli, a new command-line client for PackageKit that offers human-friendly commands, colored output, a JSON scripting mode, and better internationalization, replacing the decade-old pkcon.
Arch Linux developers have contained a malware incident in the AUR user-contributed repository, deleting malicious commits affecting over 1,500 packages.
Refuse is a product that blocks vulnerable package installs for both users and AI systems.
A detailed comparison between Nix Flakes and their equivalents in the Guix package management system, covering dependency declarations, pinning, purity, outputs, development environments, and system configuration.
npm v12 introduces security-related breaking changes to npm install that disable automatic execution of scripts, git dependencies, and remote URL dependencies by default. Users can prepare by upgrading to npm 11.16.0+ and reviewing warnings to explicitly opt into trusted behaviors.
Gabriella439 introduces override-utils, a new package that simplifies Nixpkgs overrides and overlays, aiming to improve the usability of the Nix ecosystem.
This article critiques the user experience of uv's package management CLI, highlighting missing features like `uv outdated`, unsafe default version constraints without upper bounds, and clunky upgrade commands compared to pnpm and Poetry.
The article argues that dependency cooldowns unfairly burden developers in earlier time zones and proposes using deterministic phased rollouts based on project identifiers to distribute adoption more equitably.