A weekly roundup of package management news covers pnpm 12 RC5 (a Rust rewrite reaching feature parity with pnpm 11 while adding deterministic dependency-cycle resolution), Hatch/Hatchling releases, Renovate updates for GitHub Actions lockfiles and Go monorepos, and DNF5 5.4.3.0. Security fixes include Flatpak sandbox escape and privilege escalation advisories, three Docker Engine symlink/path-traversal CVEs, a Podman quadlet file-truncation bug, and a proposal for GitHub Actions OIDC audience constraints. Articles cover nixpkgs-multiverse, OxCaml opam packaging, a developer's frustration with Linux packaging formats, Fedora Copr's coprtree tool, and the upcoming Swift package registry. Also noted: PyPI freezing its HTML simple index format, the 2026 Python Packaging Council election, the Soar package manager, and 24 git-pkgs library releases.
Questions this post answers
What CVEs were fixed in Docker Engine 25.0.17?
Docker Engine 25.0.17 backports fixes for three symlink and path-traversal vulnerabilities in mount handling and docker cp: CVE-2026-41567, CVE-2026-41568, and CVE-2026-42306. These were backported fixes rather than a new feature release, addressing path-traversal issues that could be triggered through container mount operations and the docker cp command. Teams patching container runtimes track Docker CVE disclosures like these on daily.dev.
What security vulnerabilities were fixed in Flatpak 1.18.1 and 1.19.0?
Flatpak 1.18.1 and 1.19.0 fix six advisories, including a sandbox escape allowing full host filesystem read/write via a symlink attack on app data directories (GHSA-8688-9x26-hhxj), and a local root privilege escalation through revokefs symlink traversal and commit tampering (GHSA-qrwq-7qwx-q9rp). Both flaws exploit symlink handling weaknesses to break out of Flatpak's sandbox isolation. Linux packaging teams tracking sandbox security patches follow advisories like these on daily.dev.
What changed in pnpm 12 compared to pnpm 11?
pnpm 12, a Rust rewrite that reached release candidate 5, keeps commands, flags, settings, and the lockfile format unchanged from pnpm 11, so upgrading is not a migration. RC5 additionally makes dependency cycle resolution deterministic during peer resolution by ordering cycle members by package id and always cutting the closing edge in the same place, ensuring the same lockfile regardless of resolution order. Developers planning a pnpm upgrade can follow release changes like this on daily.dev.