--- title: This Week in Package Management: 1 August 2026 | daily.dev description: Weekly roundup of package management news covering releases across uv 0.12.0, pip 26.2, pnpm 11.15–11.19 and a first Rust-engine beta (12.0.0-beta.0), Renovate... canonical: https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week in Package Management: 1 August 2026 | daily.dev og:description: Weekly roundup of package management news covering releases across uv 0.12.0, pip 26.2, pnpm 11.15–11.19 and a first Rust-engine beta (12.0.0-beta.0), Renovate... og:url: https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a og:image: https://api.daily.dev/og/posts/Mb7IXoH4A.png og:image:alt: This Week in Package Management: 1 August 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week in Package Management: 1 August 2026 **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 8 min read · 0 upvotes · 0 comments ## Summary Weekly roundup of package management news covering releases across uv 0.12.0, pip 26.2, pnpm 11.15–11.19 and a first Rust-engine beta (12.0.0-beta.0), Renovate 43.x/44.x, Maven 4.0.0-rc-6, Docker 29.7.0, Homebrew 6.0.14, and many others. Security highlights include npm's new publish-time malware scanning with a contentPolicy declaration mechanism, GitHub Actions holding suspicious workflow runs for approval, and Arch Linux disabling AUR orphaned-package adoption after attackers injected a Tor-based RAT into unmaintained packages. Articles cover open source maintainer sustainability, Homebrew's cross-platform analytics, and a critique of the 'supply chain' metaphor. Research papers examine SBOM quality in the wild and reproducibility of PyPI wheel builds. Also noted: EuroPython 2026 Packaging Summit notes, Fedora 45 adopting PURL metadata in RPMs, Composer/Packagist launching a sponsorship programme, and a browser-based Renovate Config Debugger. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does npm's new publish-time malware scanning do and how do I declare legitimate security-relevant behavior? npm now scans packages at publish time before they become installable, holding or blocking uploads that trip the check. Packages with legitimate security-relevant behavior can declare it via a contentPolicy field in package.json plus a root DISCLOSURE file, but must then be published using 2FA or trusted publishing, and once declared neither can be removed in later versions. _Teams shipping security tooling to npm can track rollout details like this on daily.dev._ ### Why did Arch Linux disable orphaned-package adoption on the AUR? Arch Linux disabled orphaned-package adoption on the AUR after attackers adopted unmaintained packages to inject a Tor-based remote-access trojan, escalating a campaign that began with the alvr package takeover. New account registration had already been suspended and reopened with additional restrictions, which proved insufficient to stop the abuse. _Anyone relying on AUR packages can follow supply-chain incidents like this via daily.dev._ ### What breaking change should I know about before upgrading to setup-uv v9.0.0? setup-uv v9.0.0 flips the prune-cache default from true to false to reduce load on PyPI infrastructure. This major version bump means workflows may see higher GitHub Actions cache usage as a side effect of the new default, since caches are no longer pruned automatically. _Developers planning CI upgrades can track setup-uv changes like this through daily.dev._ ## Similar posts on daily.dev - [This Week in Package Management: 19 September 2026](https://daily.dev/posts/this-week-in-package-management-19-september-2026-pr3wvn6le) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 25 July 2026](https://daily.dev/posts/this-week-in-package-management-25-july-2026-04ksyp92r) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 20 June 2026](https://daily.dev/posts/this-week-in-package-management-20-june-2026-tqdsfzy2q) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 23 May 2026](https://daily.dev/posts/this-week-in-package-management-23-may-2026-9v72i9cmf) · Andrew Nesbitt · 0 upvotes · 0 comments - [JavaScript Weekly Issue 786: May 19, 2026](https://daily.dev/posts/javascript-weekly-issue-786-may-19-2026-zlrtdbbxy) · JavaScript Weekly · 6 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#open-source](https://daily.dev/tags/open-source) [View this post on daily.dev](https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week in Package Management: 1 August 2026","url":"https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a"},"datePublished":"2026-08-01T10:15:55.711Z","dateModified":"2026-09-13T20:19:29.311Z","description":"Weekly roundup of package management news covering releases across uv 0.12.0, pip 26.2, pnpm 11.15–11.19 and a first Rust-engine beta (12.0.0-beta.0), Renovate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,open-source","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"This Week in Package Management: 1 August 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a#faq","mainEntity":[{"@type":"Question","name":"What does npm's new publish-time malware scanning do and how do I declare legitimate security-relevant behavior?","acceptedAnswer":{"@type":"Answer","text":"npm now scans packages at publish time before they become installable, holding or blocking uploads that trip the check. Packages with legitimate security-relevant behavior can declare it via a contentPolicy field in package.json plus a root DISCLOSURE file, but must then be published using 2FA or trusted publishing, and once declared neither can be removed in later versions. Teams shipping security tooling to npm can track rollout details like this on daily.dev."}},{"@type":"Question","name":"Why did Arch Linux disable orphaned-package adoption on the AUR?","acceptedAnswer":{"@type":"Answer","text":"Arch Linux disabled orphaned-package adoption on the AUR after attackers adopted unmaintained packages to inject a Tor-based remote-access trojan, escalating a campaign that began with the alvr package takeover. New account registration had already been suspended and reopened with additional restrictions, which proved insufficient to stop the abuse. Anyone relying on AUR packages can follow supply-chain incidents like this via daily.dev."}},{"@type":"Question","name":"What breaking change should I know about before upgrading to setup-uv v9.0.0?","acceptedAnswer":{"@type":"Answer","text":"setup-uv v9.0.0 flips the prune-cache default from true to false to reduce load on PyPI infrastructure. This major version bump means workflows may see higher GitHub Actions cache usage as a side effect of the new default, since caches are no longer pruned automatically. Developers planning CI upgrades can track setup-uv changes like this through daily.dev."}}]} ```