--- title: This Week in Package Management: 8 August 2026 | daily.dev description: Week twelve of a package management roundup covering releases, security news, and articles. Key releases include pnpm 11.20 (fixing registry substitution... canonical: https://daily.dev/posts/this-week-in-package-management-8-august-2026-0meuy9ifl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week in Package Management: 8 August 2026 | daily.dev og:description: Week twelve of a package management roundup covering releases, security news, and articles. Key releases include pnpm 11.20 (fixing registry substitution... og:url: https://daily.dev/posts/this-week-in-package-management-8-august-2026-0meuy9ifl og:image: https://api.daily.dev/og/posts/0MEuY9IfL.png og:image:alt: This Week in Package Management: 8 August 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week in Package Management: 8 August 2026 **[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 6 min read · 0 upvotes · 0 comments ## Summary Week twelve of a package management roundup covering releases, security news, and articles. Key releases include pnpm 11.20 (fixing registry substitution risks) and 12.0.0-rc.1 (Rust engine), mise gaining declarative host-provisioning, uv 0.12.2 adding a vulnerability audit command, and zizmor 1.29.0 expanding CI auditing beyond GitHub Actions. Security highlights: NuGet.org is cutting API key lifetime from 365 to 30 days starting August 17, npm is restricting 2FA-bypass tokens with full removal of direct publish rights in early 2027, and sbt 1.12.15/2.0.6 fix a remote code execution vulnerability. Notable articles cover Cargo's future vision, SBOM quality from lockfiles vs binary scanners, and the Nixpkgs core team disbanding. The conda ecosystem reports 40% faster large solves in rattler 0.25.0 and conda-libmamba-solver caching improvements. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is changing with NuGet.org API key lifetimes and when does it take effect? NuGet.org is reducing the maximum API key lifetime from 365 days to 30 days starting August 17. All keys created before that date will expire on November 1. The recommended replacement is OIDC-based Trusted Publishing, which issues a short-lived key per publish operation scoped to a policy configured by the package owner. _NuGet publishers rotating to Trusted Publishing track these deadlines on daily.dev before keys expire mid-pipeline._ ### What does pnpm 12.0.0-rc.1 change about git dependencies and SSH URLs? pnpm 12.0.0-rc.1, the Rust-engine release candidate, resolves git dependencies on known hosts through the canonical HTTPS URL, ensuring the lockfile never records an SSH URL. It also refuses global commands run under sudo. The 11.20 release separately fixes a package-substitution risk by recording packages under registry-qualified lockfile keys such as foo@work:1.0.0. _Teams evaluating the pnpm 12 Rust engine can follow the rc.1 discussion and related ecosystem moves on daily.dev._ ### What CVE or vulnerability was fixed in sbt 2.0.6 and who is affected? sbt 1.12.15 and 2.0.6 fix a remote code execution vulnerability in the sbt server (GHSA-m2pw-22cj-jq4v). It is reachable only when Global / serverConnectionType is set to Tcp. The setting defaults to a local Unix domain socket, so only builds that explicitly opted into TCP are affected. _Scala teams running sbt over TCP should track advisories like this one on daily.dev._ ## Similar posts on daily.dev - [This Week in Package Management: 20 June 2026](https://daily.dev/posts/this-week-in-package-management-20-june-2026-tqdsfzy2q) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 5 September 2026](https://daily.dev/posts/this-week-in-package-management-5-september-2026-9le2wg6t5) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 11 July 2026](https://daily.dev/posts/this-week-in-package-management-11-july-2026-ohbtgofu3) · Andrew Nesbitt · 0 upvotes · 0 comments - [This Week in Package Management: 23 May 2026](https://daily.dev/posts/this-week-in-package-management-23-may-2026-9v72i9cmf) · Andrew Nesbitt · 0 upvotes · 0 comments - [JavaScript Weekly Issue 785: May 12, 2026](https://daily.dev/posts/javascript-weekly-issue-785-may-12-2026-bstoiuda0) · JavaScript Weekly · 11 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#open-source](https://daily.dev/tags/open-source), [#pnpm](https://daily.dev/tags/pnpm) [View this post on daily.dev](https://daily.dev/posts/this-week-in-package-management-8-august-2026-0meuy9ifl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week in Package Management: 8 August 2026","url":"https://daily.dev/posts/this-week-in-package-management-8-august-2026-0meuy9ifl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-package-management-8-august-2026-0meuy9ifl"},"datePublished":"2026-08-08T10:07:36.411Z","dateModified":"2026-08-08T10:08:09.557Z","description":"Week twelve of a package management roundup covering releases, security news, and articles. Key releases include pnpm 11.20 (fixing registry substitution...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/416572ca2b211e96c4c4b92af22d1ec7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Andrew Nesbitt","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Andrew Nesbitt","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/nesbitt-io"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-package-management-8-august-2026-0meuy9ifl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,open-source,pnpm","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Andrew Nesbitt","item":"https://daily.dev/sources/nesbitt-io"},{"@type":"ListItem","position":3,"name":"This Week in Package Management: 8 August 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-package-management-8-august-2026-0meuy9ifl#faq","mainEntity":[{"@type":"Question","name":"What is changing with NuGet.org API key lifetimes and when does it take effect?","acceptedAnswer":{"@type":"Answer","text":"NuGet.org is reducing the maximum API key lifetime from 365 days to 30 days starting August 17. All keys created before that date will expire on November 1. The recommended replacement is OIDC-based Trusted Publishing, which issues a short-lived key per publish operation scoped to a policy configured by the package owner. NuGet publishers rotating to Trusted Publishing track these deadlines on daily.dev before keys expire mid-pipeline."}},{"@type":"Question","name":"What does pnpm 12.0.0-rc.1 change about git dependencies and SSH URLs?","acceptedAnswer":{"@type":"Answer","text":"pnpm 12.0.0-rc.1, the Rust-engine release candidate, resolves git dependencies on known hosts through the canonical HTTPS URL, ensuring the lockfile never records an SSH URL. It also refuses global commands run under sudo. The 11.20 release separately fixes a package-substitution risk by recording packages under registry-qualified lockfile keys such as foo@work:1.0.0. Teams evaluating the pnpm 12 Rust engine can follow the rc.1 discussion and related ecosystem moves on daily.dev."}},{"@type":"Question","name":"What CVE or vulnerability was fixed in sbt 2.0.6 and who is affected?","acceptedAnswer":{"@type":"Answer","text":"sbt 1.12.15 and 2.0.6 fix a remote code execution vulnerability in the sbt server (GHSA-m2pw-22cj-jq4v). It is reachable only when Global / serverConnectionType is set to Tcp. The setting defaults to a local Unix domain socket, so only builds that explicitly opted into TCP are affected. Scala teams running sbt over TCP should track advisories like this one on daily.dev."}}]} ```