--- title: "This Week in Package Management: 4 July 2026" url: https://daily.dev/posts/this-week-in-package-management-4-july-2026-m4ec89xlo source_url: https://nesbitt.io/2026/07/04/this-week-in-package-management.html type: article source: "Andrew Nesbitt" published: 2026-07-04T11:08:54.547Z updated: 2026-07-04T11:09:17.221Z tags: ["security", "python", "rust", "npm"] reading_time: 5 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week in Package Management: 4 July 2026 **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 5 min read · 1 upvotes · 0 comments ## Summary Weekly roundup of package management news covering releases, security advisories, and articles. Key releases include Hex 2.5.0 with organisation-defined dependency policies, uv 0.11.25/0.11.26 with hardened tar handling and resolver improvements, npm 12.0.0-pre.2 graduating linked installs to stable, and Rust 1.96.1 fixing Cargo HTTP client issues and libssh2 CVEs. Security highlights include multiple Composer vulnerabilities (path traversal, credential leakage), four Guix daemon/client vulnerabilities, a python.org API authentication bypass, and a campaign hijacking npm and Go packages to deploy an infostealer via VS Code tasks. Articles cover Guix packages as Nix flakes, vulnerability definition theory, and Zig moving all package management out of the compiler. Research papers examine Git tag mutability undermining reproducible builds, PyPI package replication spreading vulnerabilities, and scanner evasion techniques for agent-skill malware. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [This Week in Package Management: 11 July 2026](https://daily.dev/posts/this-week-in-package-management-11-july-2026-ohbtgofu3) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 23 May 2026](https://daily.dev/posts/this-week-in-package-management-23-may-2026-9v72i9cmf) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 20 June 2026](https://daily.dev/posts/this-week-in-package-management-20-june-2026-tqdsfzy2q) · Andrew Nesbitt · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#rust](https://daily.dev/tags/rust), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/this-week-in-package-management-4-july-2026-m4ec89xlo)