--- title: This Week in Package Management: 22 August 2026 | daily.dev description: A roundup of package-management news covering Go 1.27's module tidy changes and a compress/flate encoding change that alters archive/zip and compress/gzip... canonical: https://daily.dev/posts/this-week-in-package-management-22-august-2026-zsf4sjr1b twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week in Package Management: 22 August 2026 | daily.dev og:description: A roundup of package-management news covering Go 1.27's module tidy changes and a compress/flate encoding change that alters archive/zip and compress/gzip... og:url: https://daily.dev/posts/this-week-in-package-management-22-august-2026-zsf4sjr1b og:image: https://api.daily.dev/og/posts/zSF4SJR1b.png og:image:alt: This Week in Package Management: 22 August 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week in Package Management: 22 August 2026 **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 6 min read · 1 upvotes · 0 comments ## Summary A roundup of package-management news covering Go 1.27's module tidy changes and a compress/flate encoding change that alters archive/zip and compress/gzip output bytes, Rust 1.98's Cargo min-publish-age flag, Bun 1.4's Rust rewrite with new package manager subcommands, pnpm 11.22 and 12 RC8, Hex 2.5 security advisories, and Renovate updates. Security section covers a crates.io supply-chain attack on arrayref and other crates, plus two sbt RCE advisories (GHSA-m2pw-22cj-jq4v and GHSA-943m-f264-54p4). Also links articles on PyPI reproducible builds, Rust stdlib semver protection, Ruby tooling, an open-source maturity metric tool, two arXiv papers on dependency resolution, and news on Commonhaus/HeroDevs, AWS funding PyPI, and npmx. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What changed in Go 1.27 that could break archive hashes in my build pipeline? Go 1.27 changed the compress/flate encoder, so archive/zip and compress/gzip now produce different bytes than under Go 1.26. This matters anywhere a Go-built tool's archive output is hash-pinned downstream, such as forge tarball endpoints, module proxies, or release pipelines, since the byte-for-byte output will no longer match prior pins. _Teams tracking Go version upgrades and their downstream effects can follow release changes like this on daily.dev._ ### What was the crates.io supply chain attack on arrayref in August 2026? A compromised maintainer account was used to publish malicious versions of arrayref, internment, append-only-vec, and several typosquat crates, each carrying a build script that downloaded a remote payload. The malicious versions were live on crates.io for under two hours before being removed. Developers were advised to check their local Cargo cache for the affected versions. _Rust developers guarding against supply chain attacks can track incidents like this via daily.dev._ ### What remote code execution vulnerability did sbt 2.0.6 and 1.12.15 fix? sbt 2.0.6 and 1.12.15 fixed GHSA-m2pw-22cj-jq4v, a remote code execution vulnerability reachable through the sbt server when serverConnectionType is set to Tcp. A related class of bug in the BSP handler, GHSA-943m-f264-54p4, was fixed in sbt 2.0.7 and 1.13.0. Builds using the default Unix domain socket connection type are unaffected. _Scala teams patching build tool vulnerabilities can keep up with advisories like this on daily.dev._ ## Similar posts on daily.dev - [This Week in Package Management: 5 September 2026](https://daily.dev/posts/this-week-in-package-management-5-september-2026-9le2wg6t5) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 11 July 2026](https://daily.dev/posts/this-week-in-package-management-11-july-2026-ohbtgofu3) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 20 June 2026](https://daily.dev/posts/this-week-in-package-management-20-june-2026-tqdsfzy2q) · Andrew Nesbitt · 0 upvotes · 0 comments - [JavaScript Weekly Issue 786: May 19, 2026](https://daily.dev/posts/javascript-weekly-issue-786-may-19-2026-zlrtdbbxy) · JavaScript Weekly · 6 upvotes · 0 comments - [This Week in Package Management: 23 May 2026](https://daily.dev/posts/this-week-in-package-management-23-may-2026-9v72i9cmf) · Andrew Nesbitt · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang), [#rust](https://daily.dev/tags/rust), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/this-week-in-package-management-22-august-2026-zsf4sjr1b) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week in Package Management: 22 August 2026","url":"https://daily.dev/posts/this-week-in-package-management-22-august-2026-zsf4sjr1b","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-package-management-22-august-2026-zsf4sjr1b"},"datePublished":"2026-08-22T10:22:53.647Z","dateModified":"2026-09-14T07:55:37.381Z","description":"A roundup of package-management news covering Go 1.27's module tidy changes and a compress/flate encoding change that alters archive/zip and compress/gzip...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-package-management-22-august-2026-zsf4sjr1b","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,golang,rust,npm","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"This Week in Package Management: 22 August 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-package-management-22-august-2026-zsf4sjr1b#faq","mainEntity":[{"@type":"Question","name":"What changed in Go 1.27 that could break archive hashes in my build pipeline?","acceptedAnswer":{"@type":"Answer","text":"Go 1.27 changed the compress/flate encoder, so archive/zip and compress/gzip now produce different bytes than under Go 1.26. This matters anywhere a Go-built tool's archive output is hash-pinned downstream, such as forge tarball endpoints, module proxies, or release pipelines, since the byte-for-byte output will no longer match prior pins. Teams tracking Go version upgrades and their downstream effects can follow release changes like this on daily.dev."}},{"@type":"Question","name":"What was the crates.io supply chain attack on arrayref in August 2026?","acceptedAnswer":{"@type":"Answer","text":"A compromised maintainer account was used to publish malicious versions of arrayref, internment, append-only-vec, and several typosquat crates, each carrying a build script that downloaded a remote payload. The malicious versions were live on crates.io for under two hours before being removed. Developers were advised to check their local Cargo cache for the affected versions. Rust developers guarding against supply chain attacks can track incidents like this via daily.dev."}},{"@type":"Question","name":"What remote code execution vulnerability did sbt 2.0.6 and 1.12.15 fix?","acceptedAnswer":{"@type":"Answer","text":"sbt 2.0.6 and 1.12.15 fixed GHSA-m2pw-22cj-jq4v, a remote code execution vulnerability reachable through the sbt server when serverConnectionType is set to Tcp. A related class of bug in the BSP handler, GHSA-943m-f264-54p4, was fixed in sbt 2.0.7 and 1.13.0. Builds using the default Unix domain socket connection type are unaffected. Scala teams patching build tool vulnerabilities can keep up with advisories like this on daily.dev."}}]} ```