package-manager

uv 0.12.0 is a major release of the extremely fast Python package and project manager written in Rust, offering a replacement for pip, pip-tools, pipx, poetry, pyenv, twine, virtualenv, and more.

Sx 2.0 is a desktop app that enables teams to share AI skills via a shared folder (Dropbox, Google Drive, etc.), without requiring git or terminal. It translates skills into formats compatible with various AI clients.

Ant is a JavaScript runtime and ecosystem including an engine, package manager, registry (ants.land), deployment platform, and desktop app framework (Ant Desktop) designed as a coherent alternative to existing JavaScript stacks.

Evan You explains that Vite+ does not include a built-in package manager because he is uncomfortable with vendoring someone else's package manager and claiming its features as their own.

In preview, uv tool install now writes a uv.lock lockfile for every tool during installation.

skillhub is a package manager for AI agent skills, compatible with Claude Code, Cursor, and Codex.

Collider 1.3.0 adds path traversal protection for repository indices and strips bearer tokens on cross-origin redirects to prevent security vulnerabilities.

Charlie Marsh's talk explains how uv, a Rust-based Python package manager developed by Astral, solves dependency resolution with a CDCL SAT solver and a unified lockfile, achieving extreme speed by rethinking the toolchain from scratch.

The article identifies the problem that Nix binaries are not relocatable, causing hash changes and recompilation when the store prefix changes, and proposes using relative paths with $ORIGIN in RUNPATH to achieve relocatability without invalidating caches.

A talk introducing the four software freedoms, their importance and limitations, and how GNU Guix enables verification, modification, and sharing of software to ensure user freedom.

Charlie Marsh announces uv audit, a native vulnerability scanning feature for project dependencies in the uv package manager.

Security alert: malicious packages are being spread in the Arch User Repository (AUR), posing a risk to Arch Linux users.

Homebrew 6.0.0 introduces tap trust security, a new default internal JSON API for faster updates, Linux sandboxing via Bubblewrap, and various improvements based on user survey feedback.

uv announces new security features: a fast dependency auditing command (uv audit) and optional malware scanning on sync operations, both currently in preview.

A technical exploration showing how Nix can build a Guix derivation, highlighting the shared underlying 'Input Output Machine' architecture and the possibility of cross-ecosystem interoperability.

NixOS 26.05 'Yarara' is released, featuring systemd in initrd, GNOME 50, deprecation of x86_64-darwin, and thousands of package updates.

A technical guide on installing the Nix package manager on Sailfish OS for Sony Xperia devices, covering filesystem layout, LVM partitioning, and F2FS considerations.

npm introduces staged publishing, requiring human approval via 2FA for package releases, and new `--allow-*` flags (file, remote, directory) to control install sources, improving supply-chain security in npm CLI 11.15.0.

Satirical article highlighting the recurring supply chain attacks in the npm registry, contrasting with more secure ecosystems like Go and Rust, and mocking the JavaScript community's acceptance of such vulnerabilities.

sx is an open-source package manager for sharing AI skills, MCP configs, and commands across teams. It helps capture individual AI expertise and distribute it automatically to team members.