package-manager

Soar is a fast, modern, bloat-free Linux package manager written in Rust, supporting static binaries, AppImages, and portable packages without requiring root, with distro-independent installation and secure builds.

Vlt 1.0 ships as a stable package manager release, now with support for hosted package registries.

Darcy Clarke announces vlt 1.0 and hosted registries/ecosystem mirrors now GA — a drop-in npm replacement that runs nothing on install, offers faster delivery, registry-layer malware blocking, and graph-native querying.

uv 0.12.0 introduces breaking changes to `uv init`, defaulting to a `src/`-based package layout, configuring the uv_build backend, and setting up a script alias. The update encourages modern Python project structure.

uv 0.12.0 is a major release of the extremely fast Python package and project manager written in Rust, offering a replacement for pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv, and more.

Sx 2.0 is a desktop app that enables teams to share AI skills via a shared folder (Dropbox, Google Drive, etc.), without requiring git or terminal. It translates skills into formats compatible with various AI clients.

Ant is a JavaScript runtime and ecosystem including an engine, package manager, registry (ants.land), deployment platform, and desktop app framework (Ant Desktop) designed as a coherent alternative to existing JavaScript stacks.

Evan You explains that Vite+ does not include a built-in package manager because he is uncomfortable with vendoring someone else's package manager and claiming its features as their own.

In preview, uv tool install now writes a uv.lock lockfile for every tool during installation.

skillhub is a package manager for AI agent skills, compatible with Claude Code, Cursor, and Codex.

Collider 1.3.0 adds path traversal protection for repository indices and strips bearer tokens on cross-origin redirects to prevent security vulnerabilities.

Charlie Marsh's talk explains how uv, a Rust-based Python package manager developed by Astral, solves dependency resolution with a CDCL SAT solver and a unified lockfile, achieving extreme speed by rethinking the toolchain from scratch.

The article identifies the problem that Nix binaries are not relocatable, causing hash changes and recompilation when the store prefix changes, and proposes using relative paths with $ORIGIN in RUNPATH to achieve relocatability without invalidating caches.

A talk introducing the four software freedoms, their importance and limitations, and how GNU Guix enables verification, modification, and sharing of software to ensure user freedom.

Charlie Marsh announces uv audit, a native vulnerability scanning feature for project dependencies in the uv package manager.

Security alert: malicious packages are being spread in the Arch User Repository (AUR), posing a risk to Arch Linux users.

Homebrew 6.0.0 introduces tap trust security, a new default internal JSON API for faster updates, Linux sandboxing via Bubblewrap, and various improvements based on user survey feedback.

uv announces new security features: a fast dependency auditing command (uv audit) and optional malware scanning on sync operations, both currently in preview.

A technical exploration showing how Nix can build a Guix derivation, highlighting the shared underlying 'Input Output Machine' architecture and the possibility of cross-ecosystem interoperability.

NixOS 26.05 'Yarara' is released, featuring systemd in initrd, GNOME 50, deprecation of x86_64-darwin, and thousands of package updates.