--- title: This Week in Package Management: 31 October 2026 | daily.dev description: Go shipped its first URGENT-track security release, patching Go 1.27.3 and 1.26.10 within seven and a half hours of being alerted to eight eMudhra certificate... canonical: https://daily.dev/posts/this-week-in-package-management-31-october-2026-xpfjekr8y twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week in Package Management: 31 October 2026 | daily.dev og:description: Go shipped its first URGENT-track security release, patching Go 1.27.3 and 1.26.10 within seven and a half hours of being alerted to eight eMudhra certificate... og:url: https://daily.dev/posts/this-week-in-package-management-31-october-2026-xpfjekr8y og:image: https://api.daily.dev/og/posts/xPfjekR8Y.png og:image:alt: This Week in Package Management: 31 October 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week in Package Management: 31 October 2026 **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 7 min read · 0 upvotes · 0 comments ## Summary Go shipped its first URGENT-track security release, patching Go 1.27.3 and 1.26.10 within seven and a half hours of being alerted to eight eMudhra certificate intermediates added to OneCRL. The git, curl and python3 that Apple ships with macOS still trusted those intermediates as of 28 October. Composer 2.11 adds a cooldown policy that withholds newly published versions during update and require, and pnpm 12.16 and 12.17 fix security issues and expand outdated/update checks. PyPI now caps version strings at 128 characters, and vlt found 22% of new npm versions arrived with at least one dependency still missing from the registry. RubyGems.org revoked every legacy API key after a report that its CDN could cache that endpoint's responses and serve them to the wrong user. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did Go release an URGENT-track security patch for Go 1.27.3 and 1.26.10? Go shipped the patch to reject any certificate chain through eight eMudhra intermediates that Mozilla added to OneCRL on 17 October. The Go security team was alerted on 19 October and released Go 1.27.3 and 1.26.10 under seven and a half hours later. Go also plans to add revocation checking on Linux, and as of 28 October, Apple's macOS tools (git, curl, python3) still trusted the compromised intermediates. _Teams tracking critical CA and TLS trust issues can follow fast-moving security releases like this on daily.dev._ ### What does Composer 2.11's cooldown dependency policy do? It withholds newly published package versions from being installed for a configured period during composer update and composer require commands. A --no-cooldown flag lets you bypass this when you need to install a security fix immediately. Composer 2.11 also removes the source fallback deprecated in 2.10 and lets custom policies block installs during composer install. _Developers evaluating dependency update strategies can track Composer release notes like this on daily.dev._ ### How often do new npm package versions get published before their dependencies are available? 22% of new npm versions published in a 24-hour window arrived with at least one dependency still missing from the registry, according to research by vlt. In response, vlt's npm replication system now holds a publish until its transitive dependencies are also available, releasing it anyway after an hour if dependencies are still missing. _Developers debugging flaky npm installs can follow supply chain reliability research like this on daily.dev._ ## Similar posts on daily.dev - [This Week in Package Management: 11 July 2026](https://daily.dev/posts/this-week-in-package-management-11-july-2026-ohbtgofu3) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 30 May 2026](https://daily.dev/posts/this-week-in-package-management-30-may-2026-sdwe8gwi0) · Andrew Nesbitt · 0 upvotes · 0 comments - [Package Managers Need to Cool Down](https://daily.dev/posts/package-managers-need-to-cool-down-ee6vqq1u6) · Lobsters · 0 upvotes · 0 comments - [This Week in Package Management: 12 September 2026](https://daily.dev/posts/this-week-in-package-management-12-september-2026-gywbwyozp) · Andrew Nesbitt · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang), [#rust](https://daily.dev/tags/rust), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/this-week-in-package-management-31-october-2026-xpfjekr8y) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week in Package Management: 31 October 2026","url":"https://daily.dev/posts/this-week-in-package-management-31-october-2026-xpfjekr8y","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-package-management-31-october-2026-xpfjekr8y"},"datePublished":"2026-10-31T10:38:42.077Z","dateModified":"2026-10-31T10:39:12.430Z","description":"Go shipped its first URGENT-track security release, patching Go 1.27.3 and 1.26.10 within seven and a half hours of being alerted to eight eMudhra certificate...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-package-management-31-october-2026-xpfjekr8y","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,golang,rust,npm","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"This Week in Package Management: 31 October 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-package-management-31-october-2026-xpfjekr8y#faq","mainEntity":[{"@type":"Question","name":"Why did Go release an URGENT-track security patch for Go 1.27.3 and 1.26.10?","acceptedAnswer":{"@type":"Answer","text":"Go shipped the patch to reject any certificate chain through eight eMudhra intermediates that Mozilla added to OneCRL on 17 October. The Go security team was alerted on 19 October and released Go 1.27.3 and 1.26.10 under seven and a half hours later. Go also plans to add revocation checking on Linux, and as of 28 October, Apple's macOS tools (git, curl, python3) still trusted the compromised intermediates. Teams tracking critical CA and TLS trust issues can follow fast-moving security releases like this on daily.dev."}},{"@type":"Question","name":"What does Composer 2.11's cooldown dependency policy do?","acceptedAnswer":{"@type":"Answer","text":"It withholds newly published package versions from being installed for a configured period during composer update and composer require commands. A --no-cooldown flag lets you bypass this when you need to install a security fix immediately. Composer 2.11 also removes the source fallback deprecated in 2.10 and lets custom policies block installs during composer install. Developers evaluating dependency update strategies can track Composer release notes like this on daily.dev."}},{"@type":"Question","name":"How often do new npm package versions get published before their dependencies are available?","acceptedAnswer":{"@type":"Answer","text":"22% of new npm versions published in a 24-hour window arrived with at least one dependency still missing from the registry, according to research by vlt. In response, vlt's npm replication system now holds a publish until its transitive dependencies are also available, releasing it anyway after an hour if dependencies are still missing. Developers debugging flaky npm installs can follow supply chain reliability research like this on daily.dev."}}]} ```