--- title: This Week in Package Management: 15 August 2026 | daily.dev description: A weekly roundup of package management news covers pnpm 12 RC5 (a Rust rewrite reaching feature parity with pnpm 11 while adding deterministic dependency-cycle... canonical: https://daily.dev/posts/this-week-in-package-management-15-august-2026-tgg3vj4uh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week in Package Management: 15 August 2026 | daily.dev og:description: A weekly roundup of package management news covers pnpm 12 RC5 (a Rust rewrite reaching feature parity with pnpm 11 while adding deterministic dependency-cycle... og:url: https://daily.dev/posts/this-week-in-package-management-15-august-2026-tgg3vj4uh og:image: https://api.daily.dev/og/posts/TGG3vj4uh.png og:image:alt: This Week in Package Management: 15 August 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week in Package Management: 15 August 2026 **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 5 min read · 0 upvotes · 0 comments ## Summary A weekly roundup of package management news covers pnpm 12 RC5 (a Rust rewrite reaching feature parity with pnpm 11 while adding deterministic dependency-cycle resolution), Hatch/Hatchling releases, Renovate updates for GitHub Actions lockfiles and Go monorepos, and DNF5 5.4.3.0. Security fixes include Flatpak sandbox escape and privilege escalation advisories, three Docker Engine symlink/path-traversal CVEs, a Podman quadlet file-truncation bug, and a proposal for GitHub Actions OIDC audience constraints. Articles cover nixpkgs-multiverse, OxCaml opam packaging, a developer's frustration with Linux packaging formats, Fedora Copr's coprtree tool, and the upcoming Swift package registry. Also noted: PyPI freezing its HTML simple index format, the 2026 Python Packaging Council election, the Soar package manager, and 24 git-pkgs library releases. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs were fixed in Docker Engine 25.0.17? Docker Engine 25.0.17 backports fixes for three symlink and path-traversal vulnerabilities in mount handling and docker cp: CVE-2026-41567, CVE-2026-41568, and CVE-2026-42306. These were backported fixes rather than a new feature release, addressing path-traversal issues that could be triggered through container mount operations and the docker cp command. _Teams patching container runtimes track Docker CVE disclosures like these on daily.dev._ ### What security vulnerabilities were fixed in Flatpak 1.18.1 and 1.19.0? Flatpak 1.18.1 and 1.19.0 fix six advisories, including a sandbox escape allowing full host filesystem read/write via a symlink attack on app data directories (GHSA-8688-9x26-hhxj), and a local root privilege escalation through revokefs symlink traversal and commit tampering (GHSA-qrwq-7qwx-q9rp). Both flaws exploit symlink handling weaknesses to break out of Flatpak's sandbox isolation. _Linux packaging teams tracking sandbox security patches follow advisories like these on daily.dev._ ### What changed in pnpm 12 compared to pnpm 11? pnpm 12, a Rust rewrite that reached release candidate 5, keeps commands, flags, settings, and the lockfile format unchanged from pnpm 11, so upgrading is not a migration. RC5 additionally makes dependency cycle resolution deterministic during peer resolution by ordering cycle members by package id and always cutting the closing edge in the same place, ensuring the same lockfile regardless of resolution order. _Developers planning a pnpm upgrade can follow release changes like this on daily.dev._ ## Similar posts on daily.dev - [This Week in Package Management: 1 August 2026](https://daily.dev/posts/this-week-in-package-management-1-august-2026-mb7ixoh4a) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 5 September 2026](https://daily.dev/posts/this-week-in-package-management-5-september-2026-9le2wg6t5) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 3 October 2026](https://daily.dev/posts/this-week-in-package-management-3-october-2026-azthrdyup) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 23 May 2026](https://daily.dev/posts/this-week-in-package-management-23-may-2026-9v72i9cmf) · Andrew Nesbitt · 0 upvotes · 0 comments - [Node Weekly Issue 606: January 8, 2026](https://daily.dev/posts/node-weekly-issue-606-january-8-2026-fifw1yocx) · Node Weekly · 3 upvotes · 0 comments --- Tags: [#docker](https://daily.dev/tags/docker), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/this-week-in-package-management-15-august-2026-tgg3vj4uh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week in Package Management: 15 August 2026","url":"https://daily.dev/posts/this-week-in-package-management-15-august-2026-tgg3vj4uh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-package-management-15-august-2026-tgg3vj4uh"},"datePublished":"2026-08-15T10:47:18.511Z","dateModified":"2026-08-17T23:58:00.779Z","description":"A weekly roundup of package management news covers pnpm 12 RC5 (a Rust rewrite reaching feature parity with pnpm 11 while adding deterministic dependency-cycle...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-package-management-15-august-2026-tgg3vj4uh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"docker,pnpm","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"This Week in Package Management: 15 August 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-package-management-15-august-2026-tgg3vj4uh#faq","mainEntity":[{"@type":"Question","name":"What CVEs were fixed in Docker Engine 25.0.17?","acceptedAnswer":{"@type":"Answer","text":"Docker Engine 25.0.17 backports fixes for three symlink and path-traversal vulnerabilities in mount handling and docker cp: CVE-2026-41567, CVE-2026-41568, and CVE-2026-42306. These were backported fixes rather than a new feature release, addressing path-traversal issues that could be triggered through container mount operations and the docker cp command. Teams patching container runtimes track Docker CVE disclosures like these on daily.dev."}},{"@type":"Question","name":"What security vulnerabilities were fixed in Flatpak 1.18.1 and 1.19.0?","acceptedAnswer":{"@type":"Answer","text":"Flatpak 1.18.1 and 1.19.0 fix six advisories, including a sandbox escape allowing full host filesystem read/write via a symlink attack on app data directories (GHSA-8688-9x26-hhxj), and a local root privilege escalation through revokefs symlink traversal and commit tampering (GHSA-qrwq-7qwx-q9rp). Both flaws exploit symlink handling weaknesses to break out of Flatpak's sandbox isolation. Linux packaging teams tracking sandbox security patches follow advisories like these on daily.dev."}},{"@type":"Question","name":"What changed in pnpm 12 compared to pnpm 11?","acceptedAnswer":{"@type":"Answer","text":"pnpm 12, a Rust rewrite that reached release candidate 5, keeps commands, flags, settings, and the lockfile format unchanged from pnpm 11, so upgrading is not a migration. RC5 additionally makes dependency cycle resolution deterministic during peer resolution by ordering cycle members by package id and always cutting the closing edge in the same place, ensuring the same lockfile regardless of resolution order. Developers planning a pnpm upgrade can follow release changes like this on daily.dev."}}]} ```