A roundup of package-management news covering Go 1.27's module tidy changes and a compress/flate encoding change that alters archive/zip and compress/gzip output bytes, Rust 1.98's Cargo min-publish-age flag, Bun 1.4's Rust rewrite with new package manager subcommands, pnpm 11.22 and 12 RC8, Hex 2.5 security advisories, and Renovate updates. Security section covers a crates.io supply-chain attack on arrayref and other crates, plus two sbt RCE advisories (GHSA-m2pw-22cj-jq4v and GHSA-943m-f264-54p4). Also links articles on PyPI reproducible builds, Rust stdlib semver protection, Ruby tooling, an open-source maturity metric tool, two arXiv papers on dependency resolution, and news on Commonhaus/HeroDevs, AWS funding PyPI, and npmx.
Questions this post answers
Does Go 1.27 change the bytes produced by archive/zip or compress/gzip compared to Go 1.26?
Yes, Go 1.27 includes a compress/flate encoder change that causes archive/zip and compress/gzip to produce different output bytes than Go 1.26. This matters anywhere a Go-built tool's archive output is hash-pinned downstream, such as forge tarball endpoints, module proxies, or release pipelines, since the hashes will no longer match after upgrading. Track runtime-level changes like this compress/flate shift on daily.dev before they break a hash-pinned release pipeline.
What happened with the arrayref crate on crates.io?
Malicious versions of arrayref, along with internment, append-only-vec, and several typosquat crates, were published from a compromised maintainer account and removed by crates.io. The malicious versions included a build script that downloaded a remote payload and were live for under two hours before being deleted, so developers are advised to check their local Cargo cache for the affected versions. Developers tightening supply-chain checks on crates.io dependencies can follow incidents like this on daily.dev.
What security vulnerability was fixed in sbt 2.0.6 and 1.12.15?
sbt 2.0.6 and 1.12.15 fix GHSA-m2pw-22cj-jq4v, a remote code execution vulnerability in the sbt server that occurs when serverConnectionType is set to Tcp. A related issue in the BSP handler, GHSA-943m-f264-54p4, was later fixed in sbt 2.0.7 and 1.13.0. Builds using the default Unix domain socket connection type are unaffected. Scala teams patching build tool RCEs can keep tabs on advisories like this sbt fix via daily.dev.