# \[44.2026\] Обзор новых правил безопасности в пакетных индексах и менеджерах

DevFeed: [\[44.2026\] Обзор новых правил безопасности в пакетных индексах и менеджерах](<https://devfeed.tech/articles/44-2026-107651.md>)

Original publisher: [Read original article](<https://habr.com/ru/companies/codescoring/news/1101656/>)

Author: amaksimovv (CodeScoring)

Published: 2026-10-30T10:13:57Z

Content type: news

Language: ru

Sources: [Tagir Valeev](<https://devfeed.tech/sources/tagir-valeev.md>)

Topics: [pnpm](<https://devfeed.tech/topics/pnpm.md>), [Composer](<https://devfeed.tech/topics/composer.md>), [uv](<https://devfeed.tech/topics/uv.md>), [pip](<https://devfeed.tech/topics/pip.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [22](<https://devfeed.tech/tags/22.md>), [actions](<https://devfeed.tech/tags/actions.md>), [audit](<https://devfeed.tech/tags/audit.md>), [ci](<https://devfeed.tech/tags/ci.md>), [composer](<https://devfeed.tech/tags/composer.md>), [cpython](<https://devfeed.tech/tags/cpython.md>), [emudhra](<https://devfeed.tech/tags/emudhra.md>), [erlang](<https://devfeed.tech/tags/erlang.md>), [git](<https://devfeed.tech/tags/git.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [hex](<https://devfeed.tech/tags/hex.md>), [lock](<https://devfeed.tech/tags/lock.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [packagist](<https://devfeed.tech/tags/packagist.md>), [pnpm](<https://devfeed.tech/tags/pnpm.md>), [rebar3](<https://devfeed.tech/tags/rebar3.md>), [sbt](<https://devfeed.tech/tags/sbt.md>), [tag-29af69be3359](<https://devfeed.tech/tags/tag-29af69be3359.md>), [tag-67c2f7d620f2](<https://devfeed.tech/tags/tag-67c2f7d620f2.md>), [tag-a7ed2ec1fdeb](<https://devfeed.tech/tags/tag-a7ed2ec1fdeb.md>), [tag-cba70a559e52](<https://devfeed.tech/tags/tag-cba70a559e52.md>), [tag-d0659d997740](<https://devfeed.tech/tags/tag-d0659d997740.md>), [uv](<https://devfeed.tech/tags/uv.md>)

## AI overview

Hex 2.6 can audit locked dependencies and enforce package policies during fetch or update, stopping before writing the lock file when a policy is violated; minimum release age is not checked. Composer 2.11.0 adds an opt-in, configurable release delay while preserving lock-file installs, and fixes credential leakage and insecure-connection bypasses. pnpm corrected a crash on malformed registry responses and audit results that could incorrectly pass CI; sbt fixed archive extraction outside the target directory. GitHub Actions lock files pin referenced commits, with enforcement configurable by scenario or repository policy. After the eMudhra certificate incident, standalone pnpm builds and managed Python in uv need their respective upgrades; uv environments pinned to a Python patch version do not move automatically. rebar3 now uses system root certificates, which must be checked after upgrading.

## Source excerpt

Hex расширил проверку зафиксированных зависимостей, Composer исправил утечки учётных данных, а pnpm, uv и rebar3 пересмотрели доверие к сертификатам после инцидента eMudhra. Читать далее