» Tag
package-management
5 postsCargo Symlink Flaw Disclosed as CVE-2026-5223
CVE-2026-5223: Cargo mishandled symlinks in third-party registry tarballs, risking cache overwrites; fixed in Rust 1.96.0.
crates.io adds source code viewer and decouples accounts from GitHub
crates.io ships a source code viewer, GitHub-independent accounts via RFC, unmaintained-crate warnings, and a completed Svelte frontend migration.
uv audit tested: fast but narrower gate than pip-audit
Astral's uv package manager gained uv audit and UV_MALWARE_CHECK. Hands-on testing against pip-audit reveals what these experimental security gates actually catch.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comPrevent Losing Your Global CLIs with nvm
Avoid losing global CLIs with nvmpin. Pin each package to a specific node version.
Introducing the pkg.go.dev API
The pkg.go.dev API has been launched, offering developers programmatic access to Go module metadata for better tool integration.