Week twelve of a package management roundup covering releases, security news, and articles. Key releases include pnpm 11.20 (fixing registry substitution risks) and 12.0.0-rc.1 (Rust engine), mise gaining declarative host-provisioning, uv 0.12.2 adding a vulnerability audit command, and zizmor 1.29.0 expanding CI auditing beyond GitHub Actions. Security highlights: NuGet.org is cutting API key lifetime from 365 to 30 days starting August 17, npm is restricting 2FA-bypass tokens with full removal of direct publish rights in early 2027, and sbt 1.12.15/2.0.6 fix a remote code execution vulnerability. Notable articles cover Cargo's future vision, SBOM quality from lockfiles vs binary scanners, and the Nixpkgs core team disbanding. The conda ecosystem reports 40% faster large solves in rattler 0.25.0 and conda-libmamba-solver caching improvements.
Questions this post answers
What is changing with NuGet.org API key lifetimes and when does it take effect?
NuGet.org is reducing the maximum API key lifetime from 365 days to 30 days starting August 17. All keys created before that date will expire on November 1. The recommended replacement is OIDC-based Trusted Publishing, which issues a short-lived key per publish operation scoped to a policy configured by the package owner. NuGet publishers rotating to Trusted Publishing track these deadlines on daily.dev before keys expire mid-pipeline.
What does pnpm 12.0.0-rc.1 change about git dependencies and SSH URLs?
pnpm 12.0.0-rc.1, the Rust-engine release candidate, resolves git dependencies on known hosts through the canonical HTTPS URL, ensuring the lockfile never records an SSH URL. It also refuses global commands run under sudo. The 11.20 release separately fixes a package-substitution risk by recording packages under registry-qualified lockfile keys such as foo@work:1.0.0. Teams evaluating the pnpm 12 Rust engine can follow the rc.1 discussion and related ecosystem moves on daily.dev.
What CVE or vulnerability was fixed in sbt 2.0.6 and who is affected?
sbt 1.12.15 and 2.0.6 fix a remote code execution vulnerability in the sbt server (GHSA-m2pw-22cj-jq4v). It is reachable only when Global / serverConnectionType is set to Tcp. The setting defaults to a local Unix domain socket, so only builds that explicitly opted into TCP are affected. Scala teams running sbt over TCP should track advisories like this one on daily.dev.